1 /* 2 * services/authzone.c - authoritative zone that is locally hosted. 3 * 4 * Copyright (c) 2017, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains the functions for an authority zone. This zone 40 * is queried by the iterator, just like a stub or forward zone, but then 41 * the data is locally held. 42 */ 43 44 #include "config.h" 45 #include "services/authzone.h" 46 #include "util/data/dname.h" 47 #include "util/data/msgparse.h" 48 #include "util/data/msgreply.h" 49 #include "util/data/msgencode.h" 50 #include "util/data/packed_rrset.h" 51 #include "util/regional.h" 52 #include "util/net_help.h" 53 #include "util/netevent.h" 54 #include "util/config_file.h" 55 #include "util/log.h" 56 #include "util/module.h" 57 #include "util/random.h" 58 #include "util/timeval_func.h" 59 #include "services/cache/dns.h" 60 #include "services/outside_network.h" 61 #include "services/listen_dnsport.h" 62 #include "services/mesh.h" 63 #include "sldns/rrdef.h" 64 #include "sldns/pkthdr.h" 65 #include "sldns/sbuffer.h" 66 #include "sldns/str2wire.h" 67 #include "sldns/wire2str.h" 68 #include "sldns/parseutil.h" 69 #include "sldns/keyraw.h" 70 #include "validator/val_nsec3.h" 71 #include "validator/val_nsec.h" 72 #include "validator/val_secalgo.h" 73 #include "validator/val_sigcrypt.h" 74 #include "validator/val_anchor.h" 75 #include "validator/val_utils.h" 76 #include <ctype.h> 77 78 /** bytes to use for NSEC3 hash buffer. 20 for sha1 */ 79 #define N3HASHBUFLEN 32 80 /** max number of CNAMEs we are willing to follow (in one answer) */ 81 #define MAX_CNAME_CHAIN 8 82 /** timeout for probe packets for SOA */ 83 #define AUTH_PROBE_TIMEOUT 100 /* msec */ 84 /** when to stop with SOA probes (when exponential timeouts exceed this) */ 85 #define AUTH_PROBE_TIMEOUT_STOP 1000 /* msec */ 86 /* auth transfer timeout for TCP connections, in msec */ 87 #define AUTH_TRANSFER_TIMEOUT 10000 /* msec */ 88 /* auth transfer max backoff for failed transfers and probes */ 89 #define AUTH_TRANSFER_MAX_BACKOFF 86400 /* sec */ 90 /* auth http port number */ 91 #define AUTH_HTTP_PORT 80 92 /* auth https port number */ 93 #define AUTH_HTTPS_PORT 443 94 /* max depth for nested $INCLUDEs */ 95 #define MAX_INCLUDE_DEPTH 10 96 /** number of timeouts before we fallback from IXFR to AXFR, 97 * because some versions of servers (eg. dnsmasq) drop IXFR packets. */ 98 #define NUM_TIMEOUTS_FALLBACK_IXFR 3 99 /** number of IXFRs before an AXFR is performed, to consolidate RPZ memory. */ 100 #define NUM_IXFR_BEFORE_AXFR 5 101 102 /** pick up nextprobe task to start waiting to perform transfer actions */ 103 static void xfr_set_timeout(struct auth_xfer* xfr, struct module_env* env, 104 int failure, int lookup_only); 105 /** move to sending the probe packets, next if fails. task_probe */ 106 static void xfr_probe_send_or_end(struct auth_xfer* xfr, 107 struct module_env* env); 108 /** pick up probe task with specified(or NULL) destination first, 109 * or transfer task if nothing to probe, or false if already in progress */ 110 static int xfr_start_probe(struct auth_xfer* xfr, struct module_env* env, 111 struct auth_master* spec); 112 /** copy the master addresses from the task_probe lookups to the allow_notify 113 * list of masters */ 114 static void probe_copy_masters_for_allow_notify(struct auth_xfer* xfr); 115 /** delete xfer structure (not its tree entry) */ 116 void auth_xfer_delete(struct auth_xfer* xfr); 117 118 /** create new dns_msg */ 119 static struct dns_msg* 120 msg_create(struct regional* region, struct query_info* qinfo) 121 { 122 struct dns_msg* msg = (struct dns_msg*)regional_alloc(region, 123 sizeof(struct dns_msg)); 124 if(!msg) 125 return NULL; 126 msg->qinfo.qname = regional_alloc_init(region, qinfo->qname, 127 qinfo->qname_len); 128 if(!msg->qinfo.qname) 129 return NULL; 130 msg->qinfo.qname_len = qinfo->qname_len; 131 msg->qinfo.qtype = qinfo->qtype; 132 msg->qinfo.qclass = qinfo->qclass; 133 msg->qinfo.local_alias = NULL; 134 /* non-packed reply_info, because it needs to grow the array */ 135 msg->rep = (struct reply_info*)regional_alloc_zero(region, 136 sizeof(struct reply_info)-sizeof(struct rrset_ref)); 137 if(!msg->rep) 138 return NULL; 139 msg->rep->flags = (uint16_t)(BIT_QR | BIT_AA); 140 msg->rep->authoritative = 1; 141 msg->rep->reason_bogus = LDNS_EDE_NONE; 142 msg->rep->qdcount = 1; 143 /* rrsets is NULL, no rrsets yet */ 144 return msg; 145 } 146 147 /** grow rrset array by one in msg */ 148 static int 149 msg_grow_array(struct regional* region, struct dns_msg* msg) 150 { 151 if(msg->rep->rrsets == NULL) { 152 msg->rep->rrsets = regional_alloc_zero(region, 153 sizeof(struct ub_packed_rrset_key*)*(msg->rep->rrset_count+1)); 154 if(!msg->rep->rrsets) 155 return 0; 156 } else { 157 struct ub_packed_rrset_key** rrsets_old = msg->rep->rrsets; 158 msg->rep->rrsets = regional_alloc_zero(region, 159 sizeof(struct ub_packed_rrset_key*)*(msg->rep->rrset_count+1)); 160 if(!msg->rep->rrsets) 161 return 0; 162 memmove(msg->rep->rrsets, rrsets_old, 163 sizeof(struct ub_packed_rrset_key*)*msg->rep->rrset_count); 164 } 165 return 1; 166 } 167 168 /** get ttl of rrset */ 169 static time_t 170 get_rrset_ttl(struct ub_packed_rrset_key* k) 171 { 172 struct packed_rrset_data* d = (struct packed_rrset_data*) 173 k->entry.data; 174 return d->ttl; 175 } 176 177 /** Copy rrset into region from domain-datanode and packet rrset */ 178 static struct ub_packed_rrset_key* 179 auth_packed_rrset_copy_region(struct auth_zone* z, struct auth_data* node, 180 struct auth_rrset* rrset, struct regional* region) 181 { 182 struct ub_packed_rrset_key key; 183 memset(&key, 0, sizeof(key)); 184 key.entry.key = &key; 185 key.entry.data = rrset->data; 186 key.rk.dname = node->name; 187 key.rk.dname_len = node->namelen; 188 key.rk.type = htons(rrset->type); 189 key.rk.rrset_class = htons(z->dclass); 190 key.entry.hash = rrset_key_hash(&key.rk); 191 return packed_rrset_copy_region(&key, region, 0); 192 } 193 194 /** fix up msg->rep TTL and prefetch ttl */ 195 static void 196 msg_ttl(struct dns_msg* msg) 197 { 198 if(msg->rep->rrset_count == 0) return; 199 if(msg->rep->rrset_count == 1) { 200 msg->rep->ttl = get_rrset_ttl(msg->rep->rrsets[0]); 201 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 202 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 203 } else if(get_rrset_ttl(msg->rep->rrsets[msg->rep->rrset_count-1]) < 204 msg->rep->ttl) { 205 msg->rep->ttl = get_rrset_ttl(msg->rep->rrsets[ 206 msg->rep->rrset_count-1]); 207 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 208 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 209 } 210 } 211 212 /** see if rrset is a duplicate in the answer message */ 213 static int 214 msg_rrset_duplicate(struct dns_msg* msg, uint8_t* nm, size_t nmlen, 215 uint16_t type, uint16_t dclass) 216 { 217 size_t i; 218 for(i=0; i<msg->rep->rrset_count; i++) { 219 struct ub_packed_rrset_key* k = msg->rep->rrsets[i]; 220 if(ntohs(k->rk.type) == type && k->rk.dname_len == nmlen && 221 ntohs(k->rk.rrset_class) == dclass && 222 query_dname_compare(k->rk.dname, nm) == 0) 223 return 1; 224 } 225 return 0; 226 } 227 228 /** add rrset to answer section (no auth, add rrsets yet) */ 229 static int 230 msg_add_rrset_an(struct auth_zone* z, struct regional* region, 231 struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset) 232 { 233 log_assert(msg->rep->ns_numrrsets == 0); 234 log_assert(msg->rep->ar_numrrsets == 0); 235 if(!rrset || !node) 236 return 1; 237 if(msg_rrset_duplicate(msg, node->name, node->namelen, rrset->type, 238 z->dclass)) 239 return 1; 240 /* grow array */ 241 if(!msg_grow_array(region, msg)) 242 return 0; 243 /* copy it */ 244 if(!(msg->rep->rrsets[msg->rep->rrset_count] = 245 auth_packed_rrset_copy_region(z, node, rrset, region))) 246 return 0; 247 msg->rep->rrset_count++; 248 msg->rep->an_numrrsets++; 249 msg_ttl(msg); 250 return 1; 251 } 252 253 /** add rrset to authority section (no additional section rrsets yet) */ 254 static int 255 msg_add_rrset_ns(struct auth_zone* z, struct regional* region, 256 struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset) 257 { 258 log_assert(msg->rep->ar_numrrsets == 0); 259 if(!rrset || !node) 260 return 1; 261 if(msg_rrset_duplicate(msg, node->name, node->namelen, rrset->type, 262 z->dclass)) 263 return 1; 264 /* grow array */ 265 if(!msg_grow_array(region, msg)) 266 return 0; 267 /* copy it */ 268 if(!(msg->rep->rrsets[msg->rep->rrset_count] = 269 auth_packed_rrset_copy_region(z, node, rrset, region))) 270 return 0; 271 msg->rep->rrset_count++; 272 msg->rep->ns_numrrsets++; 273 msg_ttl(msg); 274 return 1; 275 } 276 277 /** add rrset to additional section */ 278 static int 279 msg_add_rrset_ar(struct auth_zone* z, struct regional* region, 280 struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset) 281 { 282 if(!rrset || !node) 283 return 1; 284 if(msg_rrset_duplicate(msg, node->name, node->namelen, rrset->type, 285 z->dclass)) 286 return 1; 287 /* grow array */ 288 if(!msg_grow_array(region, msg)) 289 return 0; 290 /* copy it */ 291 if(!(msg->rep->rrsets[msg->rep->rrset_count] = 292 auth_packed_rrset_copy_region(z, node, rrset, region))) 293 return 0; 294 msg->rep->rrset_count++; 295 msg->rep->ar_numrrsets++; 296 msg_ttl(msg); 297 return 1; 298 } 299 300 struct auth_zones* auth_zones_create(void) 301 { 302 struct auth_zones* az = (struct auth_zones*)calloc(1, sizeof(*az)); 303 if(!az) { 304 log_err("out of memory"); 305 return NULL; 306 } 307 rbtree_init(&az->ztree, &auth_zone_cmp); 308 rbtree_init(&az->xtree, &auth_xfer_cmp); 309 lock_rw_init(&az->lock); 310 lock_protect(&az->lock, &az->ztree, sizeof(az->ztree)); 311 lock_protect(&az->lock, &az->xtree, sizeof(az->xtree)); 312 /* also lock protects the rbnode's in struct auth_zone, auth_xfer */ 313 lock_rw_init(&az->rpz_lock); 314 lock_protect(&az->rpz_lock, &az->rpz_first, sizeof(az->rpz_first)); 315 return az; 316 } 317 318 int auth_zone_cmp(const void* z1, const void* z2) 319 { 320 /* first sort on class, so that hierarchy can be maintained within 321 * a class */ 322 struct auth_zone* a = (struct auth_zone*)z1; 323 struct auth_zone* b = (struct auth_zone*)z2; 324 int m; 325 if(a->dclass != b->dclass) { 326 if(a->dclass < b->dclass) 327 return -1; 328 return 1; 329 } 330 /* sorted such that higher zones sort before lower zones (their 331 * contents) */ 332 return dname_lab_cmp(a->name, a->namelabs, b->name, b->namelabs, &m); 333 } 334 335 int auth_data_cmp(const void* z1, const void* z2) 336 { 337 struct auth_data* a = (struct auth_data*)z1; 338 struct auth_data* b = (struct auth_data*)z2; 339 int m; 340 /* canonical sort, because DNSSEC needs that */ 341 return dname_canon_lab_cmp(a->name, a->namelabs, b->name, 342 b->namelabs, &m); 343 } 344 345 int auth_xfer_cmp(const void* z1, const void* z2) 346 { 347 /* first sort on class, so that hierarchy can be maintained within 348 * a class */ 349 struct auth_xfer* a = (struct auth_xfer*)z1; 350 struct auth_xfer* b = (struct auth_xfer*)z2; 351 int m; 352 if(a->dclass != b->dclass) { 353 if(a->dclass < b->dclass) 354 return -1; 355 return 1; 356 } 357 /* sorted such that higher zones sort before lower zones (their 358 * contents) */ 359 return dname_lab_cmp(a->name, a->namelabs, b->name, b->namelabs, &m); 360 } 361 362 /** delete auth rrset node */ 363 static void 364 auth_rrset_delete(struct auth_rrset* rrset) 365 { 366 if(!rrset) return; 367 free(rrset->data); 368 free(rrset); 369 } 370 371 /** delete auth data domain node */ 372 static void 373 auth_data_delete(struct auth_data* n) 374 { 375 struct auth_rrset* p, *np; 376 if(!n) return; 377 p = n->rrsets; 378 while(p) { 379 np = p->next; 380 auth_rrset_delete(p); 381 p = np; 382 } 383 free(n->name); 384 free(n); 385 } 386 387 /** helper traverse to delete zones */ 388 static void 389 auth_data_del(rbnode_type* n, void* ATTR_UNUSED(arg)) 390 { 391 struct auth_data* z = (struct auth_data*)n->key; 392 auth_data_delete(z); 393 } 394 395 /** delete chunklist */ 396 static void 397 auth_chunk_list_delete(struct auth_chunk* first) 398 { 399 struct auth_chunk* c, *cn; 400 c = first; 401 while(c) { 402 cn = c->next; 403 free(c->data); 404 free(c); 405 c = cn; 406 } 407 } 408 409 /** delete an auth zone structure (tree remove must be done elsewhere) */ 410 static void 411 auth_zone_delete(struct auth_zone* z, struct auth_zones* az) 412 { 413 if(!z) return; 414 lock_rw_destroy(&z->lock); 415 traverse_postorder(&z->data, auth_data_del, NULL); 416 417 if(az && z->rpz) { 418 /* keep RPZ linked list intact */ 419 lock_rw_wrlock(&az->rpz_lock); 420 if(z->rpz_az_prev) 421 z->rpz_az_prev->rpz_az_next = z->rpz_az_next; 422 else 423 az->rpz_first = z->rpz_az_next; 424 if(z->rpz_az_next) 425 z->rpz_az_next->rpz_az_prev = z->rpz_az_prev; 426 lock_rw_unlock(&az->rpz_lock); 427 } 428 if(z->rpz) 429 rpz_delete(z->rpz); 430 auth_chunk_list_delete(z->perform_write_chunk_list); 431 free(z->name); 432 free(z->zonefile); 433 free(z); 434 } 435 436 struct auth_zone* 437 auth_zone_create(struct auth_zones* az, uint8_t* nm, size_t nmlen, 438 uint16_t dclass) 439 { 440 struct auth_zone* z = (struct auth_zone*)calloc(1, sizeof(*z)); 441 if(!z) { 442 return NULL; 443 } 444 z->node.key = z; 445 z->dclass = dclass; 446 z->namelen = nmlen; 447 z->namelabs = dname_count_labels(nm); 448 z->name = memdup(nm, nmlen); 449 if(!z->name) { 450 free(z); 451 return NULL; 452 } 453 rbtree_init(&z->data, &auth_data_cmp); 454 lock_rw_init(&z->lock); 455 lock_protect(&z->lock, &z->name, sizeof(*z)-sizeof(rbnode_type)- 456 sizeof(z->rpz_az_next)-sizeof(z->rpz_az_prev)- 457 sizeof(z->max_transfer_size)-sizeof(z->max_transfer_size)); 458 lock_protect(&z->lock, &z->max_transfer_size, 459 sizeof(z->max_transfer_size)); 460 lock_protect(&z->lock, &z->max_transfer_time, 461 sizeof(z->max_transfer_time)); 462 lock_rw_wrlock(&z->lock); 463 /* z lock protects all, except rbtree itself and the rpz linked list 464 * pointers, which are protected using az->lock */ 465 if(!rbtree_insert(&az->ztree, &z->node)) { 466 lock_rw_unlock(&z->lock); 467 auth_zone_delete(z, NULL); 468 log_warn("duplicate auth zone"); 469 return NULL; 470 } 471 return z; 472 } 473 474 struct auth_zone* 475 auth_zone_find(struct auth_zones* az, uint8_t* nm, size_t nmlen, 476 uint16_t dclass) 477 { 478 struct auth_zone key; 479 key.node.key = &key; 480 key.dclass = dclass; 481 key.name = nm; 482 key.namelen = nmlen; 483 key.namelabs = dname_count_labels(nm); 484 return (struct auth_zone*)rbtree_search(&az->ztree, &key); 485 } 486 487 struct auth_xfer* 488 auth_xfer_find(struct auth_zones* az, uint8_t* nm, size_t nmlen, 489 uint16_t dclass) 490 { 491 struct auth_xfer key; 492 key.node.key = &key; 493 key.dclass = dclass; 494 key.name = nm; 495 key.namelen = nmlen; 496 key.namelabs = dname_count_labels(nm); 497 return (struct auth_xfer*)rbtree_search(&az->xtree, &key); 498 } 499 500 /** find an auth zone or sorted less-or-equal, return true if exact */ 501 static int 502 auth_zone_find_less_equal(struct auth_zones* az, uint8_t* nm, size_t nmlen, 503 uint16_t dclass, struct auth_zone** z) 504 { 505 struct auth_zone key; 506 key.node.key = &key; 507 key.dclass = dclass; 508 key.name = nm; 509 key.namelen = nmlen; 510 key.namelabs = dname_count_labels(nm); 511 return rbtree_find_less_equal(&az->ztree, &key, (rbnode_type**)z); 512 } 513 514 515 /** find the auth zone that is above the given name */ 516 struct auth_zone* 517 auth_zones_find_zone(struct auth_zones* az, uint8_t* name, size_t name_len, 518 uint16_t dclass) 519 { 520 uint8_t* nm = name; 521 size_t nmlen = name_len; 522 struct auth_zone* z; 523 if(auth_zone_find_less_equal(az, nm, nmlen, dclass, &z)) { 524 /* exact match */ 525 return z; 526 } else { 527 /* less-or-nothing */ 528 if(!z) return NULL; /* nothing smaller, nothing above it */ 529 /* we found smaller name; smaller may be above the name, 530 * but not below it. */ 531 nm = dname_get_shared_topdomain(z->name, name); 532 dname_count_size_labels(nm, &nmlen); 533 z = NULL; 534 } 535 536 /* search up */ 537 while(!z) { 538 z = auth_zone_find(az, nm, nmlen, dclass); 539 if(z) return z; 540 if(dname_is_root(nm)) break; 541 dname_remove_label(&nm, &nmlen); 542 } 543 return NULL; 544 } 545 546 /** find or create zone with name str. caller must have lock on az. 547 * returns a wrlocked zone */ 548 static struct auth_zone* 549 auth_zones_find_or_add_zone(struct auth_zones* az, char* name) 550 { 551 uint8_t nm[LDNS_MAX_DOMAINLEN+1]; 552 size_t nmlen = sizeof(nm); 553 struct auth_zone* z; 554 555 if(sldns_str2wire_dname_buf(name, nm, &nmlen) != 0) { 556 log_err("cannot parse auth zone name: %s", name); 557 return 0; 558 } 559 z = auth_zone_find(az, nm, nmlen, LDNS_RR_CLASS_IN); 560 if(!z) { 561 /* not found, create the zone */ 562 z = auth_zone_create(az, nm, nmlen, LDNS_RR_CLASS_IN); 563 } else { 564 lock_rw_wrlock(&z->lock); 565 } 566 return z; 567 } 568 569 /** find or create xfer zone with name str. caller must have lock on az. 570 * returns a locked xfer */ 571 static struct auth_xfer* 572 auth_zones_find_or_add_xfer(struct auth_zones* az, struct auth_zone* z) 573 { 574 struct auth_xfer* x; 575 x = auth_xfer_find(az, z->name, z->namelen, z->dclass); 576 if(!x) { 577 /* not found, create the zone */ 578 x = auth_xfer_create(az, z); 579 } else { 580 lock_basic_lock(&x->lock); 581 } 582 return x; 583 } 584 585 int 586 auth_zone_set_zonefile(struct auth_zone* z, char* zonefile) 587 { 588 if(z->zonefile) free(z->zonefile); 589 if(zonefile == NULL) { 590 z->zonefile = NULL; 591 } else { 592 z->zonefile = strdup(zonefile); 593 if(!z->zonefile) { 594 log_err("malloc failure"); 595 return 0; 596 } 597 } 598 return 1; 599 } 600 601 /** set auth zone fallback. caller must have lock on zone */ 602 int 603 auth_zone_set_fallback(struct auth_zone* z, char* fallbackstr) 604 { 605 if(strcmp(fallbackstr, "yes") != 0 && strcmp(fallbackstr, "no") != 0){ 606 log_err("auth zone fallback, expected yes or no, got %s", 607 fallbackstr); 608 return 0; 609 } 610 z->fallback_enabled = (strcmp(fallbackstr, "yes")==0); 611 return 1; 612 } 613 614 /** create domain with the given name */ 615 static struct auth_data* 616 az_domain_create(struct auth_zone* z, uint8_t* nm, size_t nmlen) 617 { 618 struct auth_data* n = (struct auth_data*)malloc(sizeof(*n)); 619 if(!n) return NULL; 620 memset(n, 0, sizeof(*n)); 621 n->node.key = n; 622 n->name = memdup(nm, nmlen); 623 if(!n->name) { 624 free(n); 625 return NULL; 626 } 627 n->namelen = nmlen; 628 n->namelabs = dname_count_labels(nm); 629 if(!rbtree_insert(&z->data, &n->node)) { 630 log_warn("duplicate auth domain name"); 631 free(n->name); 632 free(n); 633 return NULL; 634 } 635 return n; 636 } 637 638 /** find domain with exactly the given name */ 639 static struct auth_data* 640 az_find_name(struct auth_zone* z, uint8_t* nm, size_t nmlen) 641 { 642 struct auth_zone key; 643 key.node.key = &key; 644 key.name = nm; 645 key.namelen = nmlen; 646 key.namelabs = dname_count_labels(nm); 647 return (struct auth_data*)rbtree_search(&z->data, &key); 648 } 649 650 /** Find domain name (or closest match) */ 651 static void 652 az_find_domain(struct auth_zone* z, struct query_info* qinfo, int* node_exact, 653 struct auth_data** node) 654 { 655 struct auth_zone key; 656 key.node.key = &key; 657 key.name = qinfo->qname; 658 key.namelen = qinfo->qname_len; 659 key.namelabs = dname_count_labels(key.name); 660 *node_exact = rbtree_find_less_equal(&z->data, &key, 661 (rbnode_type**)node); 662 } 663 664 /** find or create domain with name in zone */ 665 static struct auth_data* 666 az_domain_find_or_create(struct auth_zone* z, uint8_t* dname, 667 size_t dname_len) 668 { 669 struct auth_data* n = az_find_name(z, dname, dname_len); 670 if(!n) { 671 n = az_domain_create(z, dname, dname_len); 672 } 673 return n; 674 } 675 676 /** find rrset of given type in the domain */ 677 static struct auth_rrset* 678 az_domain_rrset(struct auth_data* n, uint16_t t) 679 { 680 struct auth_rrset* rrset; 681 if(!n) return NULL; 682 rrset = n->rrsets; 683 while(rrset) { 684 if(rrset->type == t) 685 return rrset; 686 rrset = rrset->next; 687 } 688 return NULL; 689 } 690 691 /** remove rrset of this type from domain */ 692 static void 693 domain_remove_rrset(struct auth_data* node, uint16_t rr_type) 694 { 695 struct auth_rrset* rrset, *prev; 696 if(!node) return; 697 prev = NULL; 698 rrset = node->rrsets; 699 while(rrset) { 700 if(rrset->type == rr_type) { 701 /* found it, now delete it */ 702 if(prev) prev->next = rrset->next; 703 else node->rrsets = rrset->next; 704 auth_rrset_delete(rrset); 705 return; 706 } 707 prev = rrset; 708 rrset = rrset->next; 709 } 710 } 711 712 /** find an rrsig index in the rrset. returns true if found */ 713 static int 714 az_rrset_find_rrsig(struct packed_rrset_data* d, uint8_t* rdata, size_t len, 715 size_t* index) 716 { 717 size_t i; 718 for(i=d->count; i<d->count + d->rrsig_count; i++) { 719 if(d->rr_len[i] != len) 720 continue; 721 if(memcmp(d->rr_data[i], rdata, len) == 0) { 722 *index = i; 723 return 1; 724 } 725 } 726 return 0; 727 } 728 729 /** see if rdata is duplicate */ 730 static int 731 rdata_duplicate(struct packed_rrset_data* d, uint8_t* rdata, size_t len) 732 { 733 size_t i; 734 for(i=0; i<d->count + d->rrsig_count; i++) { 735 if(d->rr_len[i] != len) 736 continue; 737 if(memcmp(d->rr_data[i], rdata, len) == 0) 738 return 1; 739 } 740 return 0; 741 } 742 743 /** get rrsig type covered from rdata. 744 * @param rdata: rdata in wireformat, starting with 16bit rdlength. 745 * @param rdatalen: length of rdata buffer. 746 * @return type covered (or 0). 747 */ 748 static uint16_t 749 rrsig_rdata_get_type_covered(uint8_t* rdata, size_t rdatalen) 750 { 751 if(rdatalen < 4) 752 return 0; 753 return sldns_read_uint16(rdata+2); 754 } 755 756 /** remove RR from existing RRset. Also sig, if it is a signature. 757 * reallocates the packed rrset for a new one, false on alloc failure */ 758 static int 759 rrset_remove_rr(struct auth_rrset* rrset, size_t index) 760 { 761 struct packed_rrset_data* d, *old = rrset->data; 762 size_t i; 763 if(index >= old->count + old->rrsig_count) 764 return 0; /* index out of bounds */ 765 d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old) - ( 766 sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t) + 767 old->rr_len[index])); 768 if(!d) { 769 log_err("malloc failure"); 770 return 0; 771 } 772 d->ttl = old->ttl; 773 d->count = old->count; 774 d->rrsig_count = old->rrsig_count; 775 if(index < d->count) d->count--; 776 else d->rrsig_count--; 777 d->trust = old->trust; 778 d->security = old->security; 779 780 /* set rr_len, needed for ptr_fixup */ 781 d->rr_len = (size_t*)((uint8_t*)d + 782 sizeof(struct packed_rrset_data)); 783 if(index > 0) 784 memmove(d->rr_len, old->rr_len, (index)*sizeof(size_t)); 785 if(index+1 < old->count+old->rrsig_count) 786 memmove(&d->rr_len[index], &old->rr_len[index+1], 787 (old->count+old->rrsig_count - (index+1))*sizeof(size_t)); 788 packed_rrset_ptr_fixup(d); 789 790 /* move over ttls */ 791 if(index > 0) 792 memmove(d->rr_ttl, old->rr_ttl, (index)*sizeof(time_t)); 793 if(index+1 < old->count+old->rrsig_count) 794 memmove(&d->rr_ttl[index], &old->rr_ttl[index+1], 795 (old->count+old->rrsig_count - (index+1))*sizeof(time_t)); 796 797 /* move over rr_data */ 798 for(i=0; i<d->count+d->rrsig_count; i++) { 799 size_t oldi; 800 if(i < index) oldi = i; 801 else oldi = i+1; 802 memmove(d->rr_data[i], old->rr_data[oldi], d->rr_len[i]); 803 } 804 805 /* recalc ttl (lowest of remaining RR ttls) */ 806 if(d->count + d->rrsig_count > 0) 807 d->ttl = d->rr_ttl[0]; 808 for(i=0; i<d->count+d->rrsig_count; i++) { 809 if(d->rr_ttl[i] < d->ttl) 810 d->ttl = d->rr_ttl[i]; 811 } 812 813 free(rrset->data); 814 rrset->data = d; 815 return 1; 816 } 817 818 /** add RR to existing RRset. If insert_sig is true, add to rrsigs. 819 * This reallocates the packed rrset for a new one */ 820 static int 821 rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata, 822 size_t rdatalen, int insert_sig) 823 { 824 struct packed_rrset_data* d, *old = rrset->data; 825 size_t total, old_total; 826 827 d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old) 828 + sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t) 829 + rdatalen); 830 if(!d) { 831 log_err("out of memory"); 832 return 0; 833 } 834 /* copy base values */ 835 memcpy(d, old, sizeof(struct packed_rrset_data)); 836 if(!insert_sig) { 837 d->count++; 838 } else { 839 d->rrsig_count++; 840 } 841 old_total = old->count + old->rrsig_count; 842 total = d->count + d->rrsig_count; 843 /* set rr_len, needed for ptr_fixup */ 844 d->rr_len = (size_t*)((uint8_t*)d + 845 sizeof(struct packed_rrset_data)); 846 if(old->count != 0) 847 memmove(d->rr_len, old->rr_len, old->count*sizeof(size_t)); 848 if(old->rrsig_count != 0) 849 memmove(d->rr_len+d->count, old->rr_len+old->count, 850 old->rrsig_count*sizeof(size_t)); 851 if(!insert_sig) 852 d->rr_len[d->count-1] = rdatalen; 853 else d->rr_len[total-1] = rdatalen; 854 packed_rrset_ptr_fixup(d); 855 if((time_t)rr_ttl < d->ttl) 856 d->ttl = rr_ttl; 857 858 /* copy old values into new array */ 859 if(old->count != 0) { 860 memmove(d->rr_ttl, old->rr_ttl, old->count*sizeof(time_t)); 861 /* all the old rr pieces are allocated sequential, so we 862 * can copy them in one go */ 863 memmove(d->rr_data[0], old->rr_data[0], 864 (old->rr_data[old->count-1] - old->rr_data[0]) + 865 old->rr_len[old->count-1]); 866 } 867 if(old->rrsig_count != 0) { 868 memmove(d->rr_ttl+d->count, old->rr_ttl+old->count, 869 old->rrsig_count*sizeof(time_t)); 870 memmove(d->rr_data[d->count], old->rr_data[old->count], 871 (old->rr_data[old_total-1] - old->rr_data[old->count]) + 872 old->rr_len[old_total-1]); 873 } 874 875 /* insert new value */ 876 if(!insert_sig) { 877 d->rr_ttl[d->count-1] = rr_ttl; 878 memmove(d->rr_data[d->count-1], rdata, rdatalen); 879 } else { 880 d->rr_ttl[total-1] = rr_ttl; 881 memmove(d->rr_data[total-1], rdata, rdatalen); 882 } 883 884 rrset->data = d; 885 free(old); 886 return 1; 887 } 888 889 /** Create new rrset for node with packed rrset with one RR element */ 890 static struct auth_rrset* 891 rrset_create(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl, 892 uint8_t* rdata, size_t rdatalen) 893 { 894 struct auth_rrset* rrset = (struct auth_rrset*)calloc(1, 895 sizeof(*rrset)); 896 struct auth_rrset* p, *prev; 897 struct packed_rrset_data* d; 898 if(!rrset) { 899 log_err("out of memory"); 900 return NULL; 901 } 902 rrset->type = rr_type; 903 904 /* the rrset data structure, with one RR */ 905 d = (struct packed_rrset_data*)calloc(1, 906 sizeof(struct packed_rrset_data) + sizeof(size_t) + 907 sizeof(uint8_t*) + sizeof(time_t) + rdatalen); 908 if(!d) { 909 free(rrset); 910 log_err("out of memory"); 911 return NULL; 912 } 913 rrset->data = d; 914 d->ttl = rr_ttl; 915 d->trust = rrset_trust_prim_noglue; 916 d->rr_len = (size_t*)((uint8_t*)d + sizeof(struct packed_rrset_data)); 917 d->rr_data = (uint8_t**)&(d->rr_len[1]); 918 d->rr_ttl = (time_t*)&(d->rr_data[1]); 919 d->rr_data[0] = (uint8_t*)&(d->rr_ttl[1]); 920 921 /* insert the RR */ 922 d->rr_len[0] = rdatalen; 923 d->rr_ttl[0] = rr_ttl; 924 memmove(d->rr_data[0], rdata, rdatalen); 925 d->count++; 926 927 /* insert rrset into linked list for domain */ 928 /* find sorted place to link the rrset into the list */ 929 prev = NULL; 930 p = node->rrsets; 931 while(p && p->type<=rr_type) { 932 prev = p; 933 p = p->next; 934 } 935 /* so, prev is smaller, and p is larger than rr_type */ 936 rrset->next = p; 937 if(prev) prev->next = rrset; 938 else node->rrsets = rrset; 939 return rrset; 940 } 941 942 /** count number (and size) of rrsigs that cover a type */ 943 static size_t 944 rrsig_num_that_cover(struct auth_rrset* rrsig, uint16_t rr_type, size_t* sigsz) 945 { 946 struct packed_rrset_data* d = rrsig->data; 947 size_t i, num = 0; 948 *sigsz = 0; 949 log_assert(d && rrsig->type == LDNS_RR_TYPE_RRSIG); 950 for(i=0; i<d->count+d->rrsig_count; i++) { 951 if(rrsig_rdata_get_type_covered(d->rr_data[i], 952 d->rr_len[i]) == rr_type) { 953 num++; 954 (*sigsz) += d->rr_len[i]; 955 } 956 } 957 return num; 958 } 959 960 /** See if rrsig set has covered sigs for rrset and move them over */ 961 static int 962 rrset_moveover_rrsigs(struct auth_data* node, uint16_t rr_type, 963 struct auth_rrset* rrset, struct auth_rrset* rrsig) 964 { 965 size_t sigs, sigsz, i, j, total; 966 struct packed_rrset_data* sigold = rrsig->data; 967 struct packed_rrset_data* old = rrset->data; 968 struct packed_rrset_data* d, *sigd; 969 970 log_assert(rrset->type == rr_type); 971 log_assert(rrsig->type == LDNS_RR_TYPE_RRSIG); 972 sigs = rrsig_num_that_cover(rrsig, rr_type, &sigsz); 973 if(sigs == 0) { 974 /* 0 rrsigs to move over, done */ 975 return 1; 976 } 977 978 /* allocate rrset sigsz larger for extra sigs elements, and 979 * allocate rrsig sigsz smaller for less sigs elements. */ 980 d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old) 981 + sigs*(sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t)) 982 + sigsz); 983 if(!d) { 984 log_err("out of memory"); 985 return 0; 986 } 987 /* copy base values */ 988 total = old->count + old->rrsig_count; 989 memcpy(d, old, sizeof(struct packed_rrset_data)); 990 d->rrsig_count += sigs; 991 /* setup rr_len */ 992 d->rr_len = (size_t*)((uint8_t*)d + 993 sizeof(struct packed_rrset_data)); 994 if(total != 0) 995 memmove(d->rr_len, old->rr_len, total*sizeof(size_t)); 996 j = d->count+d->rrsig_count-sigs; 997 for(i=0; i<sigold->count+sigold->rrsig_count; i++) { 998 if(rrsig_rdata_get_type_covered(sigold->rr_data[i], 999 sigold->rr_len[i]) == rr_type) { 1000 d->rr_len[j] = sigold->rr_len[i]; 1001 j++; 1002 } 1003 } 1004 packed_rrset_ptr_fixup(d); 1005 1006 /* copy old values into new array */ 1007 if(total != 0) { 1008 memmove(d->rr_ttl, old->rr_ttl, total*sizeof(time_t)); 1009 /* all the old rr pieces are allocated sequential, so we 1010 * can copy them in one go */ 1011 memmove(d->rr_data[0], old->rr_data[0], 1012 (old->rr_data[total-1] - old->rr_data[0]) + 1013 old->rr_len[total-1]); 1014 } 1015 1016 /* move over the rrsigs to the larger rrset*/ 1017 j = d->count+d->rrsig_count-sigs; 1018 for(i=0; i<sigold->count+sigold->rrsig_count; i++) { 1019 if(rrsig_rdata_get_type_covered(sigold->rr_data[i], 1020 sigold->rr_len[i]) == rr_type) { 1021 /* move this one over to location j */ 1022 d->rr_ttl[j] = sigold->rr_ttl[i]; 1023 memmove(d->rr_data[j], sigold->rr_data[i], 1024 sigold->rr_len[i]); 1025 if(d->rr_ttl[j] < d->ttl) 1026 d->ttl = d->rr_ttl[j]; 1027 j++; 1028 } 1029 } 1030 1031 /* put it in and deallocate the old rrset */ 1032 rrset->data = d; 1033 free(old); 1034 1035 /* now make rrsig set smaller */ 1036 if(sigold->count+sigold->rrsig_count == sigs) { 1037 /* remove all sigs from rrsig, remove it entirely */ 1038 domain_remove_rrset(node, LDNS_RR_TYPE_RRSIG); 1039 return 1; 1040 } 1041 log_assert(packed_rrset_sizeof(sigold) > sigs*(sizeof(size_t) + 1042 sizeof(uint8_t*) + sizeof(time_t)) + sigsz); 1043 sigd = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(sigold) 1044 - sigs*(sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t)) 1045 - sigsz); 1046 if(!sigd) { 1047 /* no need to free up d, it has already been placed in the 1048 * node->rrset structure */ 1049 log_err("out of memory"); 1050 return 0; 1051 } 1052 /* copy base values */ 1053 memcpy(sigd, sigold, sizeof(struct packed_rrset_data)); 1054 /* in sigd the RRSIGs are stored in the base of the RR, in count */ 1055 sigd->count -= sigs; 1056 /* setup rr_len */ 1057 sigd->rr_len = (size_t*)((uint8_t*)sigd + 1058 sizeof(struct packed_rrset_data)); 1059 j = 0; 1060 for(i=0; i<sigold->count+sigold->rrsig_count; i++) { 1061 if(rrsig_rdata_get_type_covered(sigold->rr_data[i], 1062 sigold->rr_len[i]) != rr_type) { 1063 sigd->rr_len[j] = sigold->rr_len[i]; 1064 j++; 1065 } 1066 } 1067 packed_rrset_ptr_fixup(sigd); 1068 1069 /* copy old values into new rrsig array */ 1070 j = 0; 1071 for(i=0; i<sigold->count+sigold->rrsig_count; i++) { 1072 if(rrsig_rdata_get_type_covered(sigold->rr_data[i], 1073 sigold->rr_len[i]) != rr_type) { 1074 /* move this one over to location j */ 1075 sigd->rr_ttl[j] = sigold->rr_ttl[i]; 1076 memmove(sigd->rr_data[j], sigold->rr_data[i], 1077 sigold->rr_len[i]); 1078 if(j==0) sigd->ttl = sigd->rr_ttl[j]; 1079 else { 1080 if(sigd->rr_ttl[j] < sigd->ttl) 1081 sigd->ttl = sigd->rr_ttl[j]; 1082 } 1083 j++; 1084 } 1085 } 1086 1087 /* put it in and deallocate the old rrset */ 1088 rrsig->data = sigd; 1089 free(sigold); 1090 1091 return 1; 1092 } 1093 1094 /** copy the rrsigs from the rrset to the rrsig rrset, because the rrset 1095 * is going to be deleted. reallocates the RRSIG rrset data. */ 1096 static int 1097 rrsigs_copy_from_rrset_to_rrsigset(struct auth_rrset* rrset, 1098 struct auth_rrset* rrsigset) 1099 { 1100 size_t i; 1101 if(rrset->data->rrsig_count == 0) 1102 return 1; 1103 1104 /* move them over one by one, because there might be duplicates, 1105 * duplicates are ignored */ 1106 for(i=rrset->data->count; 1107 i<rrset->data->count+rrset->data->rrsig_count; i++) { 1108 uint8_t* rdata = rrset->data->rr_data[i]; 1109 size_t rdatalen = rrset->data->rr_len[i]; 1110 time_t rr_ttl = rrset->data->rr_ttl[i]; 1111 1112 if(rdata_duplicate(rrsigset->data, rdata, rdatalen)) { 1113 continue; 1114 } 1115 if(!rrset_add_rr(rrsigset, rr_ttl, rdata, rdatalen, 0)) 1116 return 0; 1117 } 1118 return 1; 1119 } 1120 1121 /** Add rr to node, ignores duplicate RRs, 1122 * rdata points to buffer with rdatalen octets, starts with 2bytelength. */ 1123 static int 1124 az_domain_add_rr(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl, 1125 uint8_t* rdata, size_t rdatalen, int* duplicate) 1126 { 1127 struct auth_rrset* rrset; 1128 /* packed rrsets have their rrsigs along with them, sort them out */ 1129 if(rr_type == LDNS_RR_TYPE_RRSIG) { 1130 uint16_t ctype = rrsig_rdata_get_type_covered(rdata, rdatalen); 1131 if((rrset=az_domain_rrset(node, ctype))!= NULL) { 1132 /* a node of the correct type exists, add the RRSIG 1133 * to the rrset of the covered data type */ 1134 if(rdata_duplicate(rrset->data, rdata, rdatalen)) { 1135 if(duplicate) *duplicate = 1; 1136 return 1; 1137 } 1138 if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 1)) 1139 return 0; 1140 } else if((rrset=az_domain_rrset(node, rr_type))!= NULL) { 1141 /* add RRSIG to rrset of type RRSIG */ 1142 if(rdata_duplicate(rrset->data, rdata, rdatalen)) { 1143 if(duplicate) *duplicate = 1; 1144 return 1; 1145 } 1146 if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 0)) 1147 return 0; 1148 } else { 1149 /* create rrset of type RRSIG */ 1150 if(!rrset_create(node, rr_type, rr_ttl, rdata, 1151 rdatalen)) 1152 return 0; 1153 } 1154 } else { 1155 /* normal RR type */ 1156 if((rrset=az_domain_rrset(node, rr_type))!= NULL) { 1157 /* add data to existing node with data type */ 1158 if(rdata_duplicate(rrset->data, rdata, rdatalen)) { 1159 if(duplicate) *duplicate = 1; 1160 return 1; 1161 } 1162 if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 0)) 1163 return 0; 1164 } else { 1165 struct auth_rrset* rrsig; 1166 /* create new node with data type */ 1167 if(!(rrset=rrset_create(node, rr_type, rr_ttl, rdata, 1168 rdatalen))) 1169 return 0; 1170 1171 /* see if node of type RRSIG has signatures that 1172 * cover the data type, and move them over */ 1173 /* and then make the RRSIG type smaller */ 1174 if((rrsig=az_domain_rrset(node, LDNS_RR_TYPE_RRSIG)) 1175 != NULL) { 1176 if(!rrset_moveover_rrsigs(node, rr_type, 1177 rrset, rrsig)) 1178 return 0; 1179 } 1180 } 1181 } 1182 return 1; 1183 } 1184 1185 /** insert RR into zone, ignore duplicates */ 1186 static int 1187 az_insert_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len, 1188 size_t dname_len, int* duplicate) 1189 { 1190 struct auth_data* node; 1191 uint8_t* dname = rr; 1192 uint16_t rr_type = sldns_wirerr_get_type(rr, rr_len, dname_len); 1193 uint16_t rr_class = sldns_wirerr_get_class(rr, rr_len, dname_len); 1194 uint32_t rr_ttl = sldns_wirerr_get_ttl(rr, rr_len, dname_len); 1195 size_t rdatalen = ((size_t)sldns_wirerr_get_rdatalen(rr, rr_len, 1196 dname_len))+2; 1197 /* rdata points to rdata prefixed with uint16 rdatalength */ 1198 uint8_t* rdata = sldns_wirerr_get_rdatawl(rr, rr_len, dname_len); 1199 1200 if(rr_class != z->dclass) { 1201 log_err("wrong class for RR"); 1202 return 0; 1203 } 1204 if(rr_type == LDNS_RR_TYPE_A && rdatalen != 6 /* 2 + 4 */) { 1205 log_err("malformed A record"); 1206 return 0; 1207 } else if(rr_type == LDNS_RR_TYPE_AAAA && rdatalen != 18 /* 2 + 16 */) { 1208 log_err("malformed AAAA record"); 1209 return 0; 1210 } 1211 if(!dname_subdomain_c(dname, z->name)) { 1212 char nm[LDNS_MAX_DOMAINLEN], zn[LDNS_MAX_DOMAINLEN]; 1213 dname_str(dname, nm); 1214 dname_str(z->name, zn); 1215 verbose(VERB_ALGO, "auth-zone %s: dropping out-of-zone RR " 1216 "%s", zn, nm); 1217 if(duplicate) *duplicate=1; /* treat as bad insert */ 1218 return 1; 1219 } 1220 if(!(node=az_domain_find_or_create(z, dname, dname_len))) { 1221 log_err("cannot create domain"); 1222 return 0; 1223 } 1224 if(!az_domain_add_rr(node, rr_type, rr_ttl, rdata, rdatalen, 1225 duplicate)) { 1226 log_err("cannot add RR to domain"); 1227 if(node->rrsets == NULL) { 1228 (void)rbtree_delete(&z->data, node); 1229 auth_data_delete(node); 1230 } 1231 return 0; 1232 } 1233 if(z->rpz) { 1234 if(!(rpz_insert_rr(z->rpz, z->name, z->namelen, dname, 1235 dname_len, rr_type, rr_class, rr_ttl, rdata, rdatalen, 1236 rr, rr_len))) 1237 return 0; 1238 } 1239 return 1; 1240 } 1241 1242 /** Remove rr from node, ignores nonexisting RRs, 1243 * rdata points to buffer with rdatalen octets, starts with 2bytelength. */ 1244 static int 1245 az_domain_remove_rr(struct auth_data* node, uint16_t rr_type, 1246 uint8_t* rdata, size_t rdatalen, int* nonexist) 1247 { 1248 struct auth_rrset* rrset; 1249 size_t index = 0; 1250 1251 /* find the plain RR of the given type */ 1252 if((rrset=az_domain_rrset(node, rr_type))!= NULL) { 1253 if(packed_rrset_find_rr(rrset->data, rdata, rdatalen, &index)) { 1254 if(rrset->data->count == 1 && 1255 rrset->data->rrsig_count == 0) { 1256 /* last RR, delete the rrset */ 1257 domain_remove_rrset(node, rr_type); 1258 } else if(rrset->data->count == 1 && 1259 rrset->data->rrsig_count != 0) { 1260 /* move RRSIGs to the RRSIG rrset, or 1261 * this one becomes that RRset */ 1262 struct auth_rrset* rrsigset = az_domain_rrset( 1263 node, LDNS_RR_TYPE_RRSIG); 1264 if(rrsigset) { 1265 /* move left over rrsigs to the 1266 * existing rrset of type RRSIG */ 1267 rrsigs_copy_from_rrset_to_rrsigset( 1268 rrset, rrsigset); 1269 /* and then delete the rrset */ 1270 domain_remove_rrset(node, rr_type); 1271 } else { 1272 /* no rrset of type RRSIG, this 1273 * set is now of that type, 1274 * just remove the rr */ 1275 if(!rrset_remove_rr(rrset, index)) 1276 return 0; 1277 rrset->type = LDNS_RR_TYPE_RRSIG; 1278 rrset->data->count = rrset->data->rrsig_count; 1279 rrset->data->rrsig_count = 0; 1280 } 1281 } else { 1282 /* remove the RR from the rrset */ 1283 if(!rrset_remove_rr(rrset, index)) 1284 return 0; 1285 } 1286 return 1; 1287 } 1288 /* rr not found in rrset */ 1289 } 1290 1291 /* is it a type RRSIG, look under the covered type */ 1292 if(rr_type == LDNS_RR_TYPE_RRSIG) { 1293 uint16_t ctype = rrsig_rdata_get_type_covered(rdata, rdatalen); 1294 if((rrset=az_domain_rrset(node, ctype))!= NULL) { 1295 if(az_rrset_find_rrsig(rrset->data, rdata, rdatalen, 1296 &index)) { 1297 /* rrsig should have d->count > 0, be 1298 * over some rr of that type */ 1299 /* remove the rrsig from the rrsigs list of the 1300 * rrset */ 1301 if(!rrset_remove_rr(rrset, index)) 1302 return 0; 1303 return 1; 1304 } 1305 } 1306 /* also RRSIG not found */ 1307 } 1308 1309 /* nothing found to delete */ 1310 if(nonexist) *nonexist = 1; 1311 return 1; 1312 } 1313 1314 /** remove RR from zone, ignore if it does not exist, false on alloc failure*/ 1315 static int 1316 az_remove_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len, 1317 size_t dname_len, int* nonexist) 1318 { 1319 struct auth_data* node; 1320 uint8_t* dname = rr; 1321 uint16_t rr_type = sldns_wirerr_get_type(rr, rr_len, dname_len); 1322 uint16_t rr_class = sldns_wirerr_get_class(rr, rr_len, dname_len); 1323 size_t rdatalen = ((size_t)sldns_wirerr_get_rdatalen(rr, rr_len, 1324 dname_len))+2; 1325 /* rdata points to rdata prefixed with uint16 rdatalength */ 1326 uint8_t* rdata = sldns_wirerr_get_rdatawl(rr, rr_len, dname_len); 1327 1328 if(rr_class != z->dclass) { 1329 log_err("wrong class for RR"); 1330 /* really also a nonexisting entry, because no records 1331 * of that class in the zone, but return an error because 1332 * getting records of the wrong class is a failure of the 1333 * zone transfer */ 1334 return 0; 1335 } 1336 node = az_find_name(z, dname, dname_len); 1337 if(!node) { 1338 /* node with that name does not exist */ 1339 /* nonexisting entry, because no such name */ 1340 *nonexist = 1; 1341 return 1; 1342 } 1343 if(!az_domain_remove_rr(node, rr_type, rdata, rdatalen, nonexist)) { 1344 /* alloc failure or so */ 1345 return 0; 1346 } 1347 /* remove the node, if necessary */ 1348 /* an rrsets==NULL entry is not kept around for empty nonterminals, 1349 * and also parent nodes are not kept around, so we just delete it */ 1350 if(node->rrsets == NULL) { 1351 (void)rbtree_delete(&z->data, node); 1352 auth_data_delete(node); 1353 } 1354 if(z->rpz) { 1355 rpz_remove_rr(z->rpz, z->name, z->namelen, dname, dname_len, 1356 rr_type, rr_class, rdata, rdatalen); 1357 } 1358 return 1; 1359 } 1360 1361 /** decompress an RR into the buffer where it'll be an uncompressed RR 1362 * with uncompressed dname and uncompressed rdata (dnames) */ 1363 static int 1364 decompress_rr_into_buffer(struct sldns_buffer* buf, uint8_t* pkt, 1365 size_t pktlen, uint8_t* dname, uint16_t rr_type, uint16_t rr_class, 1366 uint32_t rr_ttl, uint8_t* rr_data, uint16_t rr_rdlen) 1367 { 1368 sldns_buffer pktbuf; 1369 size_t dname_len = 0; 1370 size_t rdlenpos; 1371 size_t rdlen; 1372 uint8_t* rd; 1373 const sldns_rr_descriptor* desc; 1374 sldns_buffer_init_frm_data(&pktbuf, pkt, pktlen); 1375 sldns_buffer_clear(buf); 1376 1377 /* decompress dname */ 1378 sldns_buffer_set_position(&pktbuf, 1379 (size_t)(dname - sldns_buffer_current(&pktbuf))); 1380 dname_len = pkt_dname_len(&pktbuf); 1381 if(dname_len == 0) return 0; /* parse fail on dname */ 1382 if(!sldns_buffer_available(buf, dname_len)) return 0; 1383 dname_pkt_copy(&pktbuf, sldns_buffer_current(buf), dname); 1384 sldns_buffer_skip(buf, (ssize_t)dname_len); 1385 1386 /* type, class, ttl and rdatalength fields */ 1387 if(!sldns_buffer_available(buf, 10)) return 0; 1388 sldns_buffer_write_u16(buf, rr_type); 1389 sldns_buffer_write_u16(buf, rr_class); 1390 sldns_buffer_write_u32(buf, rr_ttl); 1391 rdlenpos = sldns_buffer_position(buf); 1392 sldns_buffer_write_u16(buf, 0); /* rd length position */ 1393 1394 /* decompress rdata */ 1395 desc = sldns_rr_descript(rr_type); 1396 rd = rr_data; 1397 rdlen = rr_rdlen; 1398 if(rdlen > 0 && desc && desc->_dname_count > 0) { 1399 int count = (int)desc->_dname_count; 1400 int rdf = 0; 1401 size_t len; /* how much rdata to plain copy */ 1402 size_t uncompressed_len, compressed_len; 1403 size_t oldpos; 1404 /* decompress dnames. */ 1405 while(rdlen > 0 && count) { 1406 switch(desc->_wireformat[rdf]) { 1407 case LDNS_RDF_TYPE_DNAME: 1408 sldns_buffer_set_position(&pktbuf, 1409 (size_t)(rd - 1410 sldns_buffer_begin(&pktbuf))); 1411 oldpos = sldns_buffer_position(&pktbuf); 1412 /* moves pktbuf to right after the 1413 * compressed dname, and returns uncompressed 1414 * dname length */ 1415 uncompressed_len = pkt_dname_len(&pktbuf); 1416 if(!uncompressed_len) 1417 return 0; /* parse error in dname */ 1418 compressed_len = sldns_buffer_position( 1419 &pktbuf) - oldpos; 1420 if(compressed_len > rdlen) 1421 return 0; /* dname exceeds rdata */ 1422 if(!sldns_buffer_available(buf, 1423 uncompressed_len)) 1424 /* dname too long for buffer */ 1425 return 0; 1426 dname_pkt_copy(&pktbuf, 1427 sldns_buffer_current(buf), rd); 1428 sldns_buffer_skip(buf, (ssize_t)uncompressed_len); 1429 rd += compressed_len; 1430 rdlen -= compressed_len; 1431 count--; 1432 len = 0; 1433 break; 1434 case LDNS_RDF_TYPE_STR: 1435 /* Check rdlen for resilience, because it is 1436 * checked above, that rdlen > 0 */ 1437 if(rdlen < 1) return 0; /* malformed */ 1438 len = rd[0] + 1; 1439 break; 1440 default: 1441 len = get_rdf_size(desc->_wireformat[rdf]); 1442 break; 1443 } 1444 if(len) { 1445 if(len > rdlen) 1446 return 0; /* malformed */ 1447 if(!sldns_buffer_available(buf, len)) 1448 return 0; /* too long for buffer */ 1449 sldns_buffer_write(buf, rd, len); 1450 rd += len; 1451 rdlen -= len; 1452 } 1453 rdf++; 1454 } 1455 } 1456 /* copy remaining data */ 1457 if(rdlen > 0) { 1458 if(!sldns_buffer_available(buf, rdlen)) return 0; 1459 sldns_buffer_write(buf, rd, rdlen); 1460 } 1461 /* fixup rdlength */ 1462 sldns_buffer_write_u16_at(buf, rdlenpos, 1463 sldns_buffer_position(buf)-rdlenpos-2); 1464 sldns_buffer_flip(buf); 1465 return 1; 1466 } 1467 1468 /** insert RR into zone, from packet, decompress RR, 1469 * if duplicate is nonNULL set the flag but otherwise ignore duplicates */ 1470 static int 1471 az_insert_rr_decompress(struct auth_zone* z, uint8_t* pkt, size_t pktlen, 1472 struct sldns_buffer* scratch_buffer, uint8_t* dname, uint16_t rr_type, 1473 uint16_t rr_class, uint32_t rr_ttl, uint8_t* rr_data, 1474 uint16_t rr_rdlen, int* duplicate) 1475 { 1476 uint8_t* rr; 1477 size_t rr_len; 1478 size_t dname_len; 1479 if(!decompress_rr_into_buffer(scratch_buffer, pkt, pktlen, dname, 1480 rr_type, rr_class, rr_ttl, rr_data, rr_rdlen)) { 1481 log_err("could not decompress RR"); 1482 return 0; 1483 } 1484 rr = sldns_buffer_begin(scratch_buffer); 1485 rr_len = sldns_buffer_limit(scratch_buffer); 1486 dname_len = dname_valid(rr, rr_len); 1487 return az_insert_rr(z, rr, rr_len, dname_len, duplicate); 1488 } 1489 1490 /** remove RR from zone, from packet, decompress RR, 1491 * if nonexist is nonNULL set the flag but otherwise ignore nonexisting entries*/ 1492 static int 1493 az_remove_rr_decompress(struct auth_zone* z, uint8_t* pkt, size_t pktlen, 1494 struct sldns_buffer* scratch_buffer, uint8_t* dname, uint16_t rr_type, 1495 uint16_t rr_class, uint32_t rr_ttl, uint8_t* rr_data, 1496 uint16_t rr_rdlen, int* nonexist) 1497 { 1498 uint8_t* rr; 1499 size_t rr_len; 1500 size_t dname_len; 1501 if(!decompress_rr_into_buffer(scratch_buffer, pkt, pktlen, dname, 1502 rr_type, rr_class, rr_ttl, rr_data, rr_rdlen)) { 1503 log_err("could not decompress RR"); 1504 return 0; 1505 } 1506 rr = sldns_buffer_begin(scratch_buffer); 1507 rr_len = sldns_buffer_limit(scratch_buffer); 1508 dname_len = dname_valid(rr, rr_len); 1509 return az_remove_rr(z, rr, rr_len, dname_len, nonexist); 1510 } 1511 1512 /** 1513 * Parse zonefile 1514 * @param z: zone to read in. 1515 * @param in: file to read from (just opened). 1516 * @param rr: buffer to use for RRs, 64k. 1517 * passed so that recursive includes can use the same buffer and do 1518 * not grow the stack too much. 1519 * @param rrbuflen: sizeof rr buffer. 1520 * @param state: parse state with $ORIGIN, $TTL and 'prev-dname' and so on, 1521 * that is kept between includes. 1522 * The lineno is set at 1 and then increased by the function. 1523 * @param fname: file name. 1524 * @param depth: recursion depth for includes 1525 * @param cfg: config for chroot. 1526 * returns false on failure, has printed an error message 1527 */ 1528 static int 1529 az_parse_file(struct auth_zone* z, FILE* in, uint8_t* rr, size_t rrbuflen, 1530 struct sldns_file_parse_state* state, char* fname, int depth, 1531 struct config_file* cfg) 1532 { 1533 size_t rr_len, dname_len; 1534 int status; 1535 state->lineno = 1; 1536 1537 while(!feof(in)) { 1538 rr_len = rrbuflen; 1539 dname_len = 0; 1540 status = sldns_fp2wire_rr_buf(in, rr, &rr_len, &dname_len, 1541 state); 1542 if(status == LDNS_WIREPARSE_ERR_INCLUDE && rr_len == 0) { 1543 /* we have $INCLUDE or $something */ 1544 if(strncmp((char*)rr, "$INCLUDE ", 9) == 0 || 1545 strncmp((char*)rr, "$INCLUDE\t", 9) == 0) { 1546 FILE* inc; 1547 int lineno_orig = state->lineno; 1548 char* incfile = (char*)rr + 8; 1549 if(depth > MAX_INCLUDE_DEPTH) { 1550 log_err("%s:%d max include depth" 1551 "exceeded", fname, state->lineno); 1552 return 0; 1553 } 1554 /* A $INCLUDE is not expected for a secondary zone. */ 1555 if(z->zone_is_slave) { 1556 log_err("%s:%d $INCLUDE not allowed for secondary zone", fname, state->lineno); 1557 return 0; 1558 } 1559 /* skip spaces */ 1560 while(*incfile == ' ' || *incfile == '\t') 1561 incfile++; 1562 /* adjust for chroot on include file */ 1563 if(cfg->chrootdir && cfg->chrootdir[0] && 1564 strncmp(incfile, cfg->chrootdir, 1565 strlen(cfg->chrootdir)) == 0) 1566 incfile += strlen(cfg->chrootdir); 1567 incfile = strdup(incfile); 1568 if(!incfile) { 1569 log_err("malloc failure"); 1570 return 0; 1571 } 1572 verbose(VERB_ALGO, "opening $INCLUDE %s", 1573 incfile); 1574 inc = fopen(incfile, "r"); 1575 if(!inc) { 1576 log_err("%s:%d cannot open include " 1577 "file %s: %s", fname, 1578 lineno_orig, incfile, 1579 strerror(errno)); 1580 free(incfile); 1581 return 0; 1582 } 1583 /* recurse read that file now */ 1584 if(!az_parse_file(z, inc, rr, rrbuflen, 1585 state, incfile, depth+1, cfg)) { 1586 log_err("%s:%d cannot parse include " 1587 "file %s", fname, 1588 lineno_orig, incfile); 1589 fclose(inc); 1590 free(incfile); 1591 return 0; 1592 } 1593 fclose(inc); 1594 verbose(VERB_ALGO, "done with $INCLUDE %s", 1595 incfile); 1596 free(incfile); 1597 state->lineno = lineno_orig; 1598 } 1599 continue; 1600 } 1601 if(status != 0) { 1602 log_err("parse error %s %d:%d: %s", fname, 1603 state->lineno, LDNS_WIREPARSE_OFFSET(status), 1604 sldns_get_errorstr_parse(status)); 1605 return 0; 1606 } 1607 if(rr_len == 0) { 1608 /* EMPTY line, TTL or ORIGIN */ 1609 continue; 1610 } 1611 /* insert wirerr in rrbuf */ 1612 if(!az_insert_rr(z, rr, rr_len, dname_len, NULL)) { 1613 char buf[17]; 1614 sldns_wire2str_type_buf(sldns_wirerr_get_type(rr, 1615 rr_len, dname_len), buf, sizeof(buf)); 1616 log_err("%s:%d cannot insert RR of type %s", 1617 fname, state->lineno, buf); 1618 return 0; 1619 } 1620 } 1621 return 1; 1622 } 1623 1624 void auth_zone_clear_data(struct auth_zone* z) 1625 { 1626 /* clear the data tree */ 1627 traverse_postorder(&z->data, auth_data_del, NULL); 1628 rbtree_init(&z->data, &auth_data_cmp); 1629 /* clear the RPZ policies */ 1630 if(z->rpz) 1631 rpz_clear(z->rpz); 1632 } 1633 1634 int 1635 auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg) 1636 { 1637 uint8_t rr[LDNS_RR_BUF_SIZE]; 1638 struct sldns_file_parse_state state; 1639 char* zfilename; 1640 FILE* in; 1641 if(!z || !z->zonefile || z->zonefile[0]==0) 1642 return 1; /* no file, or "", nothing to read */ 1643 1644 zfilename = z->zonefile; 1645 if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(zfilename, 1646 cfg->chrootdir, strlen(cfg->chrootdir)) == 0) 1647 zfilename += strlen(cfg->chrootdir); 1648 if(verbosity >= VERB_ALGO) { 1649 char nm[LDNS_MAX_DOMAINLEN]; 1650 dname_str(z->name, nm); 1651 verbose(VERB_ALGO, "read zonefile %s for %s", zfilename, nm); 1652 } 1653 in = fopen(zfilename, "r"); 1654 if(!in) { 1655 char* n = sldns_wire2str_dname(z->name, z->namelen); 1656 if(errno == ENOENT) { 1657 /* For a secondary, fetch the zone contents later, no 1658 * file yet. For a primary, no way to fetch the zone, 1659 * so warn. */ 1660 if(z->zone_is_slave) 1661 verbose(VERB_ALGO, "no zonefile %s for %s", 1662 zfilename, n?n:"error"); 1663 else 1664 log_warn("no zonefile %s for %s", 1665 zfilename, n?n:"error"); 1666 free(n); 1667 return 1; 1668 } 1669 log_err("cannot open zonefile %s for %s: %s", 1670 zfilename, n?n:"error", strerror(errno)); 1671 free(n); 1672 return 0; 1673 } 1674 1675 /* clear the data tree */ 1676 traverse_postorder(&z->data, auth_data_del, NULL); 1677 rbtree_init(&z->data, &auth_data_cmp); 1678 /* clear the RPZ policies */ 1679 if(z->rpz) 1680 rpz_clear(z->rpz); 1681 1682 memset(&state, 0, sizeof(state)); 1683 /* default TTL to 3600 */ 1684 state.default_ttl = 3600; 1685 /* set $ORIGIN to the zone name */ 1686 if(z->namelen <= sizeof(state.origin)) { 1687 memcpy(state.origin, z->name, z->namelen); 1688 state.origin_len = z->namelen; 1689 } 1690 /* parse the (toplevel) file */ 1691 if(!az_parse_file(z, in, rr, sizeof(rr), &state, zfilename, 0, cfg)) { 1692 char* n = sldns_wire2str_dname(z->name, z->namelen); 1693 log_err("error parsing zonefile %s for %s", 1694 zfilename, n?n:"error"); 1695 free(n); 1696 fclose(in); 1697 return 0; 1698 } 1699 fclose(in); 1700 1701 if(z->rpz) 1702 rpz_finish_config(z->rpz); 1703 return 1; 1704 } 1705 1706 /** write buffer to file and check return codes */ 1707 static int 1708 write_out(FILE* out, const char* str, size_t len) 1709 { 1710 size_t r; 1711 if(len == 0) 1712 return 1; 1713 r = fwrite(str, 1, len, out); 1714 if(r == 0) { 1715 log_err("write failed: %s", strerror(errno)); 1716 return 0; 1717 } else if(r < len) { 1718 log_err("write failed: too short (disk full?)"); 1719 return 0; 1720 } 1721 return 1; 1722 } 1723 1724 /** convert auth rr to string */ 1725 static int 1726 auth_rr_to_string(uint8_t* nm, size_t nmlen, uint16_t tp, uint16_t cl, 1727 struct packed_rrset_data* data, size_t i, char* s, size_t buflen) 1728 { 1729 int w = 0; 1730 size_t slen = buflen, datlen; 1731 uint8_t* dat; 1732 if(i >= data->count) tp = LDNS_RR_TYPE_RRSIG; 1733 dat = nm; 1734 datlen = nmlen; 1735 w += sldns_wire2str_dname_scan(&dat, &datlen, &s, &slen, NULL, 0, NULL); 1736 w += sldns_str_print(&s, &slen, "\t"); 1737 w += sldns_str_print(&s, &slen, "%lu\t", (unsigned long)data->rr_ttl[i]); 1738 w += sldns_wire2str_class_print(&s, &slen, cl); 1739 w += sldns_str_print(&s, &slen, "\t"); 1740 w += sldns_wire2str_type_print(&s, &slen, tp); 1741 w += sldns_str_print(&s, &slen, "\t"); 1742 datlen = data->rr_len[i]-2; 1743 dat = data->rr_data[i]+2; 1744 w += sldns_wire2str_rdata_scan(&dat, &datlen, &s, &slen, tp, NULL, 0, NULL); 1745 1746 if(tp == LDNS_RR_TYPE_DNSKEY) { 1747 w += sldns_str_print(&s, &slen, " ;{id = %u}", 1748 sldns_calc_keytag_raw(data->rr_data[i]+2, 1749 data->rr_len[i]-2)); 1750 } 1751 w += sldns_str_print(&s, &slen, "\n"); 1752 1753 if(w >= (int)buflen) { 1754 log_nametypeclass(NO_VERBOSE, "RR too long to print", nm, tp, cl); 1755 return 0; 1756 } 1757 return 1; 1758 } 1759 1760 /** write rrset to file */ 1761 static int 1762 auth_zone_write_rrset(struct auth_zone* z, struct auth_data* node, 1763 struct auth_rrset* r, FILE* out) 1764 { 1765 size_t i, count = r->data->count + r->data->rrsig_count; 1766 char buf[LDNS_RR_BUF_SIZE]; 1767 for(i=0; i<count; i++) { 1768 if(!auth_rr_to_string(node->name, node->namelen, r->type, 1769 z->dclass, r->data, i, buf, sizeof(buf))) { 1770 verbose(VERB_ALGO, "failed to rr2str rr %d", (int)i); 1771 continue; 1772 } 1773 if(!write_out(out, buf, strlen(buf))) 1774 return 0; 1775 } 1776 return 1; 1777 } 1778 1779 /** write domain to file */ 1780 static int 1781 auth_zone_write_domain(struct auth_zone* z, struct auth_data* n, FILE* out) 1782 { 1783 struct auth_rrset* r; 1784 /* if this is zone apex, write SOA first */ 1785 if(z->namelen == n->namelen) { 1786 struct auth_rrset* soa = az_domain_rrset(n, LDNS_RR_TYPE_SOA); 1787 if(soa) { 1788 if(!auth_zone_write_rrset(z, n, soa, out)) 1789 return 0; 1790 } 1791 } 1792 /* write all the RRsets for this domain */ 1793 for(r = n->rrsets; r; r = r->next) { 1794 if(z->namelen == n->namelen && 1795 r->type == LDNS_RR_TYPE_SOA) 1796 continue; /* skip SOA here */ 1797 if(!auth_zone_write_rrset(z, n, r, out)) 1798 return 0; 1799 } 1800 return 1; 1801 } 1802 1803 int auth_zone_write_file(struct auth_zone* z, const char* fname) 1804 { 1805 FILE* out; 1806 struct auth_data* n; 1807 out = fopen(fname, "w"); 1808 if(!out) { 1809 log_err("could not open %s: %s", fname, strerror(errno)); 1810 return 0; 1811 } 1812 RBTREE_FOR(n, struct auth_data*, &z->data) { 1813 if(!auth_zone_write_domain(z, n, out)) { 1814 log_err("could not write domain to %s", fname); 1815 fclose(out); 1816 return 0; 1817 } 1818 } 1819 fclose(out); 1820 return 1; 1821 } 1822 1823 /** offline verify for zonemd, while reading a zone file to immediately 1824 * spot bad hashes in zonefile as they are read. 1825 * Creates temp buffers, but uses anchors and validation environment 1826 * from the module_env. */ 1827 static void 1828 zonemd_offline_verify(struct auth_zone* z, struct module_env* env_for_val, 1829 struct module_stack* mods) 1830 { 1831 struct module_env env; 1832 time_t now = 0; 1833 if(!z->zonemd_check) 1834 return; 1835 env = *env_for_val; 1836 env.scratch_buffer = sldns_buffer_new(env.cfg->msg_buffer_size); 1837 if(!env.scratch_buffer) { 1838 log_err("out of memory"); 1839 goto clean_exit; 1840 } 1841 env.scratch = regional_create(); 1842 if(!env.now) { 1843 env.now = &now; 1844 now = time(NULL); 1845 } 1846 if(!env.scratch) { 1847 log_err("out of memory"); 1848 goto clean_exit; 1849 } 1850 auth_zone_verify_zonemd(z, &env, mods, NULL, 1, 0); 1851 1852 clean_exit: 1853 /* clean up and exit */ 1854 sldns_buffer_free(env.scratch_buffer); 1855 regional_destroy(env.scratch); 1856 } 1857 1858 /** read all auth zones from file (if they have) */ 1859 static int 1860 auth_zones_read_zones(struct auth_zones* az, struct config_file* cfg, 1861 struct module_env* env, struct module_stack* mods) 1862 { 1863 struct auth_zone* z; 1864 lock_rw_wrlock(&az->lock); 1865 RBTREE_FOR(z, struct auth_zone*, &az->ztree) { 1866 lock_rw_wrlock(&z->lock); 1867 if(!auth_zone_read_zonefile(z, cfg)) { 1868 /* For both secondary and primary zones, not fatal. 1869 * This keeps the server up. */ 1870 auth_zone_clear_data(z); 1871 lock_rw_unlock(&z->lock); 1872 continue; 1873 } 1874 if(z->zonefile && z->zonefile[0]!=0 && env) 1875 zonemd_offline_verify(z, env, mods); 1876 lock_rw_unlock(&z->lock); 1877 } 1878 lock_rw_unlock(&az->lock); 1879 return 1; 1880 } 1881 1882 /** fetch the content of a ZONEMD RR from the rdata */ 1883 static int zonemd_fetch_parameters(struct auth_rrset* zonemd_rrset, size_t i, 1884 uint32_t* serial, int* scheme, int* hashalgo, uint8_t** hash, 1885 size_t* hashlen) 1886 { 1887 size_t rr_len; 1888 uint8_t* rdata; 1889 if(i >= zonemd_rrset->data->count) 1890 return 0; 1891 rr_len = zonemd_rrset->data->rr_len[i]; 1892 if(rr_len < 2+4+1+1) 1893 return 0; /* too short, for rdlen+serial+scheme+algo */ 1894 rdata = zonemd_rrset->data->rr_data[i]; 1895 *serial = sldns_read_uint32(rdata+2); 1896 *scheme = rdata[6]; 1897 *hashalgo = rdata[7]; 1898 *hashlen = rr_len - 8; 1899 if(*hashlen == 0) 1900 *hash = NULL; 1901 else *hash = rdata+8; 1902 return 1; 1903 } 1904 1905 /** 1906 * See if the ZONEMD scheme, hash occurs more than once. 1907 * @param zonemd_rrset: the zonemd rrset to check with the RRs in it. 1908 * @param index: index of the original, this is allowed to have that 1909 * scheme and hashalgo, but other RRs should not have it. 1910 * @param scheme: the scheme to check for. 1911 * @param hashalgo: the hash algorithm to check for. 1912 * @return true if it occurs more than once. 1913 */ 1914 static int zonemd_is_duplicate_scheme_hash(struct auth_rrset* zonemd_rrset, 1915 size_t index, int scheme, int hashalgo) 1916 { 1917 size_t j; 1918 for(j=0; j<zonemd_rrset->data->count; j++) { 1919 uint32_t serial2 = 0; 1920 int scheme2 = 0, hashalgo2 = 0; 1921 uint8_t* hash2 = NULL; 1922 size_t hashlen2 = 0; 1923 if(index == j) { 1924 /* this is the original */ 1925 continue; 1926 } 1927 if(!zonemd_fetch_parameters(zonemd_rrset, j, &serial2, 1928 &scheme2, &hashalgo2, &hash2, &hashlen2)) { 1929 /* malformed, skip it */ 1930 continue; 1931 } 1932 if(scheme == scheme2 && hashalgo == hashalgo2) { 1933 /* duplicate scheme, hash */ 1934 verbose(VERB_ALGO, "zonemd duplicate for scheme %d " 1935 "and hash %d", scheme, hashalgo); 1936 return 1; 1937 } 1938 } 1939 return 0; 1940 } 1941 1942 /** 1943 * Check ZONEMDs if present for the auth zone. Depending on config 1944 * it can warn or fail on that. Checks the hash of the ZONEMD. 1945 * @param z: auth zone to check for. 1946 * caller must hold lock on zone. 1947 * @param env: module env for temp buffers. 1948 * @param reason: returned on failure. 1949 * @return false on failure, true if hash checks out. 1950 */ 1951 static int auth_zone_zonemd_check_hash(struct auth_zone* z, 1952 struct module_env* env, char** reason) 1953 { 1954 /* loop over ZONEMDs and see which one is valid. if not print 1955 * failure (depending on config) */ 1956 struct auth_data* apex; 1957 struct auth_rrset* zonemd_rrset; 1958 size_t i; 1959 struct regional* region = NULL; 1960 struct sldns_buffer* buf = NULL; 1961 uint32_t soa_serial = 0; 1962 char* unsupported_reason = NULL; 1963 int only_unsupported = 1; 1964 region = env->scratch; 1965 regional_free_all(region); 1966 buf = env->scratch_buffer; 1967 if(!auth_zone_get_serial(z, &soa_serial)) { 1968 *reason = "zone has no SOA serial"; 1969 return 0; 1970 } 1971 1972 apex = az_find_name(z, z->name, z->namelen); 1973 if(!apex) { 1974 *reason = "zone has no apex"; 1975 return 0; 1976 } 1977 zonemd_rrset = az_domain_rrset(apex, LDNS_RR_TYPE_ZONEMD); 1978 if(!zonemd_rrset || zonemd_rrset->data->count==0) { 1979 *reason = "zone has no ZONEMD"; 1980 return 0; /* no RRset or no RRs in rrset */ 1981 } 1982 1983 /* we have a ZONEMD, check if it is correct */ 1984 for(i=0; i<zonemd_rrset->data->count; i++) { 1985 uint32_t serial = 0; 1986 int scheme = 0, hashalgo = 0; 1987 uint8_t* hash = NULL; 1988 size_t hashlen = 0; 1989 if(!zonemd_fetch_parameters(zonemd_rrset, i, &serial, &scheme, 1990 &hashalgo, &hash, &hashlen)) { 1991 /* malformed RR */ 1992 *reason = "ZONEMD rdata malformed"; 1993 only_unsupported = 0; 1994 continue; 1995 } 1996 /* check for duplicates */ 1997 if(zonemd_is_duplicate_scheme_hash(zonemd_rrset, i, scheme, 1998 hashalgo)) { 1999 /* duplicate hash of the same scheme,hash 2000 * is not allowed. */ 2001 *reason = "ZONEMD RRSet contains more than one RR " 2002 "with the same scheme and hash algorithm"; 2003 only_unsupported = 0; 2004 continue; 2005 } 2006 regional_free_all(region); 2007 if(serial != soa_serial) { 2008 *reason = "ZONEMD serial is wrong"; 2009 only_unsupported = 0; 2010 continue; 2011 } 2012 *reason = NULL; 2013 if(auth_zone_generate_zonemd_check(z, scheme, hashalgo, 2014 hash, hashlen, region, buf, reason)) { 2015 /* success */ 2016 if(*reason) { 2017 if(!unsupported_reason) 2018 unsupported_reason = *reason; 2019 /* continue to check for valid ZONEMD */ 2020 if(verbosity >= VERB_ALGO) { 2021 char zstr[LDNS_MAX_DOMAINLEN]; 2022 dname_str(z->name, zstr); 2023 verbose(VERB_ALGO, "auth-zone %s ZONEMD %d %d is unsupported: %s", zstr, (int)scheme, (int)hashalgo, *reason); 2024 } 2025 *reason = NULL; 2026 continue; 2027 } 2028 if(verbosity >= VERB_ALGO) { 2029 char zstr[LDNS_MAX_DOMAINLEN]; 2030 dname_str(z->name, zstr); 2031 if(!*reason) 2032 verbose(VERB_ALGO, "auth-zone %s ZONEMD hash is correct", zstr); 2033 } 2034 return 1; 2035 } 2036 only_unsupported = 0; 2037 /* try next one */ 2038 } 2039 /* have we seen no failures but only unsupported algo, 2040 * and one unsupported algorithm, or more. */ 2041 if(only_unsupported && unsupported_reason) { 2042 /* only unsupported algorithms, with valid serial, not 2043 * malformed. Did not see supported algorithms, failed or 2044 * successful ones. */ 2045 *reason = unsupported_reason; 2046 return 1; 2047 } 2048 /* fail, we may have reason */ 2049 if(!*reason) 2050 *reason = "no ZONEMD records found"; 2051 if(verbosity >= VERB_ALGO) { 2052 char zstr[LDNS_MAX_DOMAINLEN]; 2053 dname_str(z->name, zstr); 2054 verbose(VERB_ALGO, "auth-zone %s ZONEMD failed: %s", zstr, *reason); 2055 } 2056 return 0; 2057 } 2058 2059 /** find the apex SOA RRset, if it exists */ 2060 struct auth_rrset* auth_zone_get_soa_rrset(struct auth_zone* z) 2061 { 2062 struct auth_data* apex; 2063 struct auth_rrset* soa; 2064 apex = az_find_name(z, z->name, z->namelen); 2065 if(!apex) return NULL; 2066 soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA); 2067 return soa; 2068 } 2069 2070 /** find serial number of zone or false if none */ 2071 int 2072 auth_zone_get_serial(struct auth_zone* z, uint32_t* serial) 2073 { 2074 struct auth_data* apex; 2075 struct auth_rrset* soa; 2076 struct packed_rrset_data* d; 2077 size_t primlen, mboxlen; 2078 apex = az_find_name(z, z->name, z->namelen); 2079 if(!apex) return 0; 2080 soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA); 2081 if(!soa || soa->data->count==0) 2082 return 0; /* no RRset or no RRs in rrset */ 2083 if(soa->data->rr_len[0] < 2+4*5) return 0; /* SOA too short */ 2084 if((primlen = dname_valid(soa->data->rr_data[0]+2, 2085 soa->data->rr_len[0]-2)) == 0) 2086 return 0; /* primary dname malformed */ 2087 if((mboxlen = dname_valid(soa->data->rr_data[0]+2+primlen, 2088 soa->data->rr_len[0]-2-primlen)) == 0) 2089 return 0; /* mailbox dname malformed */ 2090 if(2+primlen+mboxlen+4*5 != soa->data->rr_len[0]) 2091 return 0; /* rdata malformed */ 2092 d = soa->data; 2093 *serial = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-20)); 2094 return 1; 2095 } 2096 2097 /** Find auth_zone SOA and populate the values in xfr(soa values). */ 2098 int 2099 xfr_find_soa(struct auth_zone* z, struct auth_xfer* xfr) 2100 { 2101 struct auth_data* apex; 2102 struct auth_rrset* soa; 2103 struct packed_rrset_data* d; 2104 size_t primlen, mboxlen; 2105 apex = az_find_name(z, z->name, z->namelen); 2106 if(!apex) return 0; 2107 soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA); 2108 if(!soa || soa->data->count==0) 2109 return 0; /* no RRset or no RRs in rrset */ 2110 if(soa->data->rr_len[0] < 2+4*5) return 0; /* SOA too short */ 2111 if((primlen = dname_valid(soa->data->rr_data[0]+2, 2112 soa->data->rr_len[0]-2)) == 0) 2113 return 0; /* primary dname malformed */ 2114 if((mboxlen = dname_valid(soa->data->rr_data[0]+2+primlen, 2115 soa->data->rr_len[0]-2-primlen)) == 0) 2116 return 0; /* mailbox dname malformed */ 2117 if(2+primlen+mboxlen+4*5 != soa->data->rr_len[0]) 2118 return 0; /* rdata malformed */ 2119 /* SOA record ends with serial, refresh, retry, expiry, minimum, 2120 * as 4 byte fields */ 2121 d = soa->data; 2122 xfr->have_zone = 1; 2123 xfr->serial = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-20)); 2124 xfr->refresh = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-16)); 2125 xfr->retry = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-12)); 2126 xfr->expiry = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-8)); 2127 /* soa minimum at d->rr_len[0]-4 */ 2128 return 1; 2129 } 2130 2131 /** 2132 * Setup auth_xfer zone 2133 * This populates the have_zone, soa values, and so on times. 2134 * Doesn't do network traffic yet, can set option flags. 2135 * @param z: locked by caller, and modified for setup 2136 * @param x: locked by caller, and modified. 2137 * @return false on failure. 2138 */ 2139 static int 2140 auth_xfer_setup(struct auth_zone* z, struct auth_xfer* x) 2141 { 2142 /* for a zone without zone transfers, x==NULL, so skip them, 2143 * i.e. the zone config is fixed with no masters or urls */ 2144 if(!z || !x) return 1; 2145 if(!xfr_find_soa(z, x)) { 2146 return 1; 2147 } 2148 x->is_rpz = (z->rpz!=NULL); 2149 /* nothing for probe, nextprobe and transfer tasks */ 2150 return 1; 2151 } 2152 2153 /** 2154 * Setup all zones 2155 * @param az: auth zones structure 2156 * @return false on failure. 2157 */ 2158 static int 2159 auth_zones_setup_zones(struct auth_zones* az) 2160 { 2161 struct auth_zone* z; 2162 struct auth_xfer* x; 2163 lock_rw_wrlock(&az->lock); 2164 RBTREE_FOR(z, struct auth_zone*, &az->ztree) { 2165 lock_rw_wrlock(&z->lock); 2166 x = auth_xfer_find(az, z->name, z->namelen, z->dclass); 2167 if(x) { 2168 lock_basic_lock(&x->lock); 2169 } 2170 if(!auth_xfer_setup(z, x)) { 2171 if(x) { 2172 lock_basic_unlock(&x->lock); 2173 } 2174 lock_rw_unlock(&z->lock); 2175 lock_rw_unlock(&az->lock); 2176 return 0; 2177 } 2178 if(x) { 2179 lock_basic_unlock(&x->lock); 2180 } 2181 lock_rw_unlock(&z->lock); 2182 } 2183 lock_rw_unlock(&az->lock); 2184 return 1; 2185 } 2186 2187 /** set config items and create zones */ 2188 static int 2189 auth_zones_cfg(struct auth_zones* az, struct config_auth* c) 2190 { 2191 struct auth_zone* z; 2192 struct auth_xfer* x = NULL; 2193 2194 /* create zone */ 2195 if(c->isrpz) { 2196 /* if the rpz lock is needed, grab it before the other 2197 * locks to avoid a lock dependency cycle */ 2198 lock_rw_wrlock(&az->rpz_lock); 2199 } 2200 lock_rw_wrlock(&az->lock); 2201 if(!(z=auth_zones_find_or_add_zone(az, c->name))) { 2202 lock_rw_unlock(&az->lock); 2203 if(c->isrpz) { 2204 lock_rw_unlock(&az->rpz_lock); 2205 } 2206 return 0; 2207 } 2208 /* Populate the xfer related options early since we may create one now */ 2209 z->max_transfer_size = c->max_transfer_size; 2210 z->max_transfer_time = c->max_transfer_time; 2211 if(c->masters || c->urls) { 2212 if(!(x=auth_zones_find_or_add_xfer(az, z))) { 2213 lock_rw_unlock(&az->lock); 2214 lock_rw_unlock(&z->lock); 2215 if(c->isrpz) { 2216 lock_rw_unlock(&az->rpz_lock); 2217 } 2218 return 0; 2219 } 2220 } 2221 if(c->for_downstream) 2222 az->have_downstream = 1; 2223 lock_rw_unlock(&az->lock); 2224 2225 /* set options */ 2226 z->zone_deleted = 0; 2227 if(!auth_zone_set_zonefile(z, c->zonefile)) { 2228 if(x) { 2229 lock_basic_unlock(&x->lock); 2230 } 2231 lock_rw_unlock(&z->lock); 2232 if(c->isrpz) { 2233 lock_rw_unlock(&az->rpz_lock); 2234 } 2235 return 0; 2236 } 2237 z->for_downstream = c->for_downstream; 2238 z->for_upstream = c->for_upstream; 2239 z->fallback_enabled = c->fallback_enabled; 2240 z->zonemd_check = c->zonemd_check; 2241 z->zonemd_reject_absence = c->zonemd_reject_absence; 2242 if(c->isrpz && !z->rpz){ 2243 if(!(z->rpz = rpz_create(c))){ 2244 log_err("Could not setup RPZ zones"); 2245 if(x) { 2246 lock_basic_unlock(&x->lock); 2247 } 2248 lock_rw_unlock(&z->lock); 2249 lock_rw_unlock(&az->rpz_lock); 2250 return 0; 2251 } 2252 lock_protect(&z->lock, &z->rpz->local_zones, sizeof(*z->rpz)); 2253 /* the az->rpz_lock is locked above */ 2254 z->rpz_az_next = az->rpz_first; 2255 if(az->rpz_first) 2256 az->rpz_first->rpz_az_prev = z; 2257 az->rpz_first = z; 2258 } else if(c->isrpz && z->rpz) { 2259 if(!rpz_config(z->rpz, c)) { 2260 log_err("Could not change rpz config"); 2261 if(x) { 2262 lock_basic_unlock(&x->lock); 2263 } 2264 lock_rw_unlock(&z->lock); 2265 lock_rw_unlock(&az->rpz_lock); 2266 return 0; 2267 } 2268 } 2269 if(c->isrpz) { 2270 lock_rw_unlock(&az->rpz_lock); 2271 } 2272 2273 /* xfer zone */ 2274 if(x) { 2275 z->zone_is_slave = 1; 2276 /* set options on xfer zone */ 2277 if(!xfer_set_masters(&x->task_probe->masters, c, 0)) { 2278 lock_basic_unlock(&x->lock); 2279 lock_rw_unlock(&z->lock); 2280 return 0; 2281 } 2282 if(!xfer_set_masters(&x->task_transfer->masters, c, 1)) { 2283 lock_basic_unlock(&x->lock); 2284 lock_rw_unlock(&z->lock); 2285 return 0; 2286 } 2287 /* Pick up allow notify entries, early. This works for 2288 * addresses and netblocks. */ 2289 if(!x->allow_notify_list) 2290 probe_copy_masters_for_allow_notify(x); 2291 lock_basic_unlock(&x->lock); 2292 } 2293 2294 lock_rw_unlock(&z->lock); 2295 return 1; 2296 } 2297 2298 /** set all auth zones deleted, then in auth_zones_cfg, it marks them 2299 * as nondeleted (if they are still in the config), and then later 2300 * we can find deleted zones */ 2301 static void 2302 az_setall_deleted(struct auth_zones* az) 2303 { 2304 struct auth_zone* z; 2305 lock_rw_wrlock(&az->lock); 2306 RBTREE_FOR(z, struct auth_zone*, &az->ztree) { 2307 lock_rw_wrlock(&z->lock); 2308 z->zone_deleted = 1; 2309 lock_rw_unlock(&z->lock); 2310 } 2311 lock_rw_unlock(&az->lock); 2312 } 2313 2314 /** find zones that are marked deleted and delete them. 2315 * This is called from apply_cfg, and there are no threads and no 2316 * workers, so the xfr can just be deleted. */ 2317 static void 2318 az_delete_deleted_zones(struct auth_zones* az) 2319 { 2320 struct auth_zone* z; 2321 struct auth_zone* delete_list = NULL, *next; 2322 struct auth_xfer* xfr; 2323 lock_rw_wrlock(&az->lock); 2324 RBTREE_FOR(z, struct auth_zone*, &az->ztree) { 2325 lock_rw_wrlock(&z->lock); 2326 if(z->zone_deleted) { 2327 /* we cannot alter the rbtree right now, but 2328 * we can put it on a linked list and then 2329 * delete it */ 2330 z->delete_next = delete_list; 2331 delete_list = z; 2332 } 2333 lock_rw_unlock(&z->lock); 2334 } 2335 /* now we are out of the tree loop and we can loop and delete 2336 * the zones */ 2337 z = delete_list; 2338 while(z) { 2339 next = z->delete_next; 2340 xfr = auth_xfer_find(az, z->name, z->namelen, z->dclass); 2341 if(xfr) { 2342 (void)rbtree_delete(&az->xtree, &xfr->node); 2343 auth_xfer_delete(xfr); 2344 } 2345 (void)rbtree_delete(&az->ztree, &z->node); 2346 auth_zone_delete(z, az); 2347 z = next; 2348 } 2349 lock_rw_unlock(&az->lock); 2350 } 2351 2352 int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg, 2353 int setup, int* is_rpz, struct module_env* env, 2354 struct module_stack* mods) 2355 { 2356 struct config_auth* p; 2357 az_setall_deleted(az); 2358 for(p = cfg->auths; p; p = p->next) { 2359 if(!p->name || p->name[0] == 0) { 2360 log_warn("auth-zone without a name, skipped"); 2361 continue; 2362 } 2363 *is_rpz = (*is_rpz || p->isrpz); 2364 if(!auth_zones_cfg(az, p)) { 2365 log_err("cannot config auth zone %s", p->name); 2366 return 0; 2367 } 2368 } 2369 az_delete_deleted_zones(az); 2370 if(!auth_zones_read_zones(az, cfg, env, mods)) 2371 return 0; 2372 if(setup) { 2373 if(!auth_zones_setup_zones(az)) 2374 return 0; 2375 } 2376 return 1; 2377 } 2378 2379 /** delete chunks 2380 * @param at: transfer structure with chunks list. The chunks and their 2381 * data are freed. 2382 */ 2383 static void 2384 auth_chunks_delete(struct auth_transfer* at) 2385 { 2386 if(at->chunks_first) { 2387 auth_chunk_list_delete(at->chunks_first); 2388 } 2389 at->chunks_first = NULL; 2390 at->chunks_last = NULL; 2391 at->chunks_total = 0; 2392 } 2393 2394 /** free master addr list */ 2395 static void 2396 auth_free_master_addrs(struct auth_addr* list) 2397 { 2398 struct auth_addr *n; 2399 while(list) { 2400 n = list->next; 2401 free(list); 2402 list = n; 2403 } 2404 } 2405 2406 /** free the masters list */ 2407 static void 2408 auth_free_masters(struct auth_master* list) 2409 { 2410 struct auth_master* n; 2411 while(list) { 2412 n = list->next; 2413 auth_free_master_addrs(list->list); 2414 free(list->host); 2415 free(list->file); 2416 free(list); 2417 list = n; 2418 } 2419 } 2420 2421 void 2422 auth_xfer_delete(struct auth_xfer* xfr) 2423 { 2424 if(!xfr) return; 2425 lock_basic_destroy(&xfr->lock); 2426 free(xfr->name); 2427 if(xfr->task_nextprobe) { 2428 comm_timer_delete(xfr->task_nextprobe->timer); 2429 free(xfr->task_nextprobe); 2430 } 2431 if(xfr->task_probe) { 2432 auth_free_masters(xfr->task_probe->masters); 2433 comm_point_delete(xfr->task_probe->cp); 2434 comm_timer_delete(xfr->task_probe->timer); 2435 free(xfr->task_probe); 2436 } 2437 if(xfr->task_transfer) { 2438 auth_free_masters(xfr->task_transfer->masters); 2439 comm_point_delete(xfr->task_transfer->cp); 2440 comm_timer_delete(xfr->task_transfer->timer); 2441 if(xfr->task_transfer->chunks_first) { 2442 auth_chunks_delete(xfr->task_transfer); 2443 } 2444 free(xfr->task_transfer); 2445 } 2446 auth_free_masters(xfr->allow_notify_list); 2447 free(xfr); 2448 } 2449 2450 /** helper traverse to delete zones */ 2451 static void 2452 auth_zone_del(rbnode_type* n, void* ATTR_UNUSED(arg)) 2453 { 2454 struct auth_zone* z = (struct auth_zone*)n->key; 2455 auth_zone_delete(z, NULL); 2456 } 2457 2458 /** helper traverse to delete xfer zones */ 2459 static void 2460 auth_xfer_del(rbnode_type* n, void* ATTR_UNUSED(arg)) 2461 { 2462 struct auth_xfer* z = (struct auth_xfer*)n->key; 2463 auth_xfer_delete(z); 2464 } 2465 2466 void auth_zones_delete(struct auth_zones* az) 2467 { 2468 if(!az) return; 2469 lock_rw_destroy(&az->lock); 2470 lock_rw_destroy(&az->rpz_lock); 2471 traverse_postorder(&az->ztree, auth_zone_del, NULL); 2472 traverse_postorder(&az->xtree, auth_xfer_del, NULL); 2473 free(az); 2474 } 2475 2476 /** true if domain has only nsec3 */ 2477 static int 2478 domain_has_only_nsec3(struct auth_data* n) 2479 { 2480 struct auth_rrset* rrset = n->rrsets; 2481 int nsec3_seen = 0; 2482 while(rrset) { 2483 if(rrset->type == LDNS_RR_TYPE_NSEC3) { 2484 nsec3_seen = 1; 2485 } else if(rrset->type != LDNS_RR_TYPE_RRSIG) { 2486 return 0; 2487 } 2488 rrset = rrset->next; 2489 } 2490 return nsec3_seen; 2491 } 2492 2493 /** see if the domain has a wildcard child '*.domain' */ 2494 static struct auth_data* 2495 az_find_wildcard_domain(struct auth_zone* z, uint8_t* nm, size_t nmlen) 2496 { 2497 uint8_t wc[LDNS_MAX_DOMAINLEN]; 2498 if(nmlen+2 > sizeof(wc)) 2499 return NULL; /* result would be too long */ 2500 wc[0] = 1; /* length of wildcard label */ 2501 wc[1] = (uint8_t)'*'; /* wildcard label */ 2502 memmove(wc+2, nm, nmlen); 2503 return az_find_name(z, wc, nmlen+2); 2504 } 2505 2506 /** find wildcard between qname and cename */ 2507 static struct auth_data* 2508 az_find_wildcard(struct auth_zone* z, struct query_info* qinfo, 2509 struct auth_data* ce) 2510 { 2511 uint8_t* nm = qinfo->qname; 2512 size_t nmlen = qinfo->qname_len; 2513 struct auth_data* node; 2514 if(!dname_subdomain_c(nm, z->name)) 2515 return NULL; /* out of zone */ 2516 while((node=az_find_wildcard_domain(z, nm, nmlen))==NULL) { 2517 if(nmlen == z->namelen) 2518 return NULL; /* top of zone reached */ 2519 if(ce && nmlen == ce->namelen) 2520 return NULL; /* ce reached */ 2521 if(!dname_remove_label_limit_len(&nm, &nmlen, z->namelen)) 2522 return NULL; /* can't go up */ 2523 } 2524 return node; 2525 } 2526 2527 /** domain is not exact, find first candidate ce (name that matches 2528 * a part of qname) in tree */ 2529 static struct auth_data* 2530 az_find_candidate_ce(struct auth_zone* z, struct query_info* qinfo, 2531 struct auth_data* n) 2532 { 2533 uint8_t* nm; 2534 size_t nmlen; 2535 if(n) { 2536 nm = dname_get_shared_topdomain(qinfo->qname, n->name); 2537 } else { 2538 nm = qinfo->qname; 2539 } 2540 dname_count_size_labels(nm, &nmlen); 2541 n = az_find_name(z, nm, nmlen); 2542 /* delete labels and go up on name */ 2543 while(!n) { 2544 if(!dname_remove_label_limit_len(&nm, &nmlen, z->namelen)) 2545 return NULL; /* can't go up */ 2546 n = az_find_name(z, nm, nmlen); 2547 } 2548 return n; 2549 } 2550 2551 /** go up the auth tree to next existing name. */ 2552 static struct auth_data* 2553 az_domain_go_up(struct auth_zone* z, struct auth_data* n) 2554 { 2555 uint8_t* nm = n->name; 2556 size_t nmlen = n->namelen; 2557 while(dname_remove_label_limit_len(&nm, &nmlen, z->namelen)) { 2558 if((n=az_find_name(z, nm, nmlen)) != NULL) 2559 return n; 2560 } 2561 return NULL; 2562 } 2563 2564 /** Find the closest encloser, an name that exists and is above the 2565 * qname. 2566 * return true if the node (param node) is existing, nonobscured and 2567 * can be used to generate answers from. It is then also node_exact. 2568 * returns false if the node is not good enough (or it wasn't node_exact) 2569 * in this case the ce can be filled. 2570 * if ce is NULL, no ce exists, and likely the zone is completely empty, 2571 * not even with a zone apex. 2572 * if ce is nonNULL it is the closest enclosing upper name (that exists 2573 * itself for answer purposes). That name may have DNAME, NS or wildcard 2574 * rrset is the closest DNAME or NS rrset that was found. 2575 */ 2576 static int 2577 az_find_ce(struct auth_zone* z, struct query_info* qinfo, 2578 struct auth_data* node, int node_exact, struct auth_data** ce, 2579 struct auth_rrset** rrset) 2580 { 2581 struct auth_data* n = node; 2582 struct auth_rrset* lookrrset; 2583 *ce = NULL; 2584 *rrset = NULL; 2585 if(!node_exact) { 2586 /* if not exact, lookup closest exact match */ 2587 n = az_find_candidate_ce(z, qinfo, n); 2588 } else { 2589 /* if exact, the node itself is the first candidate ce */ 2590 *ce = n; 2591 } 2592 2593 /* no direct answer from nsec3-only domains */ 2594 if(n && domain_has_only_nsec3(n)) { 2595 node_exact = 0; 2596 *ce = NULL; 2597 } 2598 2599 /* with exact matches, walk up the labels until we find the 2600 * delegation, or DNAME or zone end */ 2601 while(n) { 2602 /* see if the current candidate has issues */ 2603 /* not zone apex and has type NS */ 2604 if(n->namelen != z->namelen && 2605 (lookrrset=az_domain_rrset(n, LDNS_RR_TYPE_NS)) && 2606 /* delegate here, but DS at exact the dp has notype */ 2607 (qinfo->qtype != LDNS_RR_TYPE_DS || 2608 n->namelen != qinfo->qname_len)) { 2609 /* referral */ 2610 /* this is ce and the lowernode is nonexisting */ 2611 *ce = n; 2612 *rrset = lookrrset; 2613 node_exact = 0; 2614 } 2615 /* not equal to qname and has type DNAME */ 2616 if(n->namelen != qinfo->qname_len && 2617 (lookrrset=az_domain_rrset(n, LDNS_RR_TYPE_DNAME))) { 2618 /* this is ce and the lowernode is nonexisting */ 2619 *ce = n; 2620 *rrset = lookrrset; 2621 node_exact = 0; 2622 } 2623 2624 if(*ce == NULL && !domain_has_only_nsec3(n)) { 2625 /* if not found yet, this exact name must be 2626 * our lowest match (but not nsec3onlydomain) */ 2627 *ce = n; 2628 } 2629 2630 /* walk up the tree by removing labels from name and lookup */ 2631 n = az_domain_go_up(z, n); 2632 } 2633 /* found no problems, if it was an exact node, it is fine to use */ 2634 return node_exact; 2635 } 2636 2637 /** add additional A/AAAA from domain names in rrset rdata (+offset) 2638 * offset is number of bytes in rdata where the dname is located. */ 2639 static int 2640 az_add_additionals_from(struct auth_zone* z, struct regional* region, 2641 struct dns_msg* msg, struct auth_rrset* rrset, size_t offset) 2642 { 2643 struct packed_rrset_data* d = rrset->data; 2644 size_t i; 2645 if(!d) return 0; 2646 for(i=0; i<d->count; i++) { 2647 size_t dlen; 2648 struct auth_data* domain; 2649 struct auth_rrset* ref; 2650 if(d->rr_len[i] < 2+offset) 2651 continue; /* too short */ 2652 if(!(dlen = dname_valid(d->rr_data[i]+2+offset, 2653 d->rr_len[i]-2-offset))) 2654 continue; /* malformed */ 2655 domain = az_find_name(z, d->rr_data[i]+2+offset, dlen); 2656 if(!domain) 2657 continue; 2658 if((ref=az_domain_rrset(domain, LDNS_RR_TYPE_A)) != NULL) { 2659 if(!msg_add_rrset_ar(z, region, msg, domain, ref)) 2660 return 0; 2661 } 2662 if((ref=az_domain_rrset(domain, LDNS_RR_TYPE_AAAA)) != NULL) { 2663 if(!msg_add_rrset_ar(z, region, msg, domain, ref)) 2664 return 0; 2665 } 2666 } 2667 return 1; 2668 } 2669 2670 /** add negative SOA record (with negative TTL) */ 2671 static int 2672 az_add_negative_soa(struct auth_zone* z, struct regional* region, 2673 struct dns_msg* msg) 2674 { 2675 time_t minimum; 2676 size_t i; 2677 struct packed_rrset_data* d; 2678 struct auth_rrset* soa; 2679 struct auth_data* apex = az_find_name(z, z->name, z->namelen); 2680 if(!apex) return 0; 2681 soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA); 2682 if(!soa) return 0; 2683 /* must be first to put in message; we want to fix the TTL with 2684 * one RRset here, otherwise we'd need to loop over the RRs to get 2685 * the resulting lower TTL */ 2686 log_assert(msg->rep->rrset_count == 0); 2687 if(!msg_add_rrset_ns(z, region, msg, apex, soa)) return 0; 2688 /* fixup TTL */ 2689 d = (struct packed_rrset_data*)msg->rep->rrsets[msg->rep->rrset_count-1]->entry.data; 2690 /* last 4 bytes are minimum ttl in network format */ 2691 if(d->count == 0) return 0; 2692 if(d->rr_len[0] < 2+4) return 0; 2693 minimum = (time_t)sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-4)); 2694 minimum = d->ttl<minimum?d->ttl:minimum; 2695 d->ttl = minimum; 2696 for(i=0; i < d->count + d->rrsig_count; i++) 2697 d->rr_ttl[i] = minimum; 2698 msg->rep->ttl = get_rrset_ttl(msg->rep->rrsets[0]); 2699 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 2700 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 2701 return 1; 2702 } 2703 2704 /** See if the query goes to empty nonterminal (that has no auth_data, 2705 * but there are nodes underneath. We already checked that there are 2706 * not NS, or DNAME above, so that we only need to check if some node 2707 * exists below (with nonempty rr list), return true if emptynonterminal */ 2708 static int 2709 az_empty_nonterminal(struct auth_zone* z, struct query_info* qinfo, 2710 struct auth_data* node) 2711 { 2712 struct auth_data* next; 2713 if(!node) { 2714 /* no smaller was found, use first (smallest) node as the 2715 * next one */ 2716 next = (struct auth_data*)rbtree_first(&z->data); 2717 } else { 2718 next = (struct auth_data*)rbtree_next(&node->node); 2719 } 2720 while(next && (rbnode_type*)next != RBTREE_NULL && next->rrsets == NULL) { 2721 /* the next name has empty rrsets, is an empty nonterminal 2722 * itself, see if there exists something below it */ 2723 next = (struct auth_data*)rbtree_next(&next->node); 2724 } 2725 if((rbnode_type*)next == RBTREE_NULL || !next) { 2726 /* there is no next node, so something below it cannot 2727 * exist */ 2728 return 0; 2729 } 2730 /* a next node exists, if there was something below the query, 2731 * this node has to be it. See if it is below the query name */ 2732 if(dname_strict_subdomain_c(next->name, qinfo->qname)) 2733 return 1; 2734 return 0; 2735 } 2736 2737 /** create synth cname target name in buffer, or fail if too long */ 2738 static size_t 2739 synth_cname_buf(uint8_t* qname, size_t qname_len, size_t dname_len, 2740 uint8_t* dtarg, size_t dtarglen, uint8_t* buf, size_t buflen) 2741 { 2742 size_t newlen = qname_len + dtarglen - dname_len; 2743 if(newlen > buflen) { 2744 /* YXDOMAIN error */ 2745 return 0; 2746 } 2747 /* new name is concatenation of qname front (without DNAME owner) 2748 * and DNAME target name */ 2749 memcpy(buf, qname, qname_len-dname_len); 2750 memmove(buf+(qname_len-dname_len), dtarg, dtarglen); 2751 return newlen; 2752 } 2753 2754 /** create synthetic CNAME rrset for in a DNAME answer in region, 2755 * false on alloc failure, cname==NULL when name too long. */ 2756 static int 2757 create_synth_cname(uint8_t* qname, size_t qname_len, struct regional* region, 2758 struct auth_data* node, struct auth_rrset* dname, uint16_t dclass, 2759 struct ub_packed_rrset_key** cname) 2760 { 2761 uint8_t buf[LDNS_MAX_DOMAINLEN]; 2762 uint8_t* dtarg; 2763 size_t dtarglen, newlen; 2764 struct packed_rrset_data* d; 2765 2766 /* get DNAME target name */ 2767 if(dname->data->count < 1) return 0; 2768 if(dname->data->rr_len[0] < 3) return 0; /* at least rdatalen +1 */ 2769 dtarg = dname->data->rr_data[0]+2; 2770 dtarglen = dname->data->rr_len[0]-2; 2771 if(sldns_read_uint16(dname->data->rr_data[0]) != dtarglen) 2772 return 0; /* rdatalen in DNAME rdata is malformed */ 2773 if(dname_valid(dtarg, dtarglen) != dtarglen) 2774 return 0; /* DNAME RR has malformed rdata */ 2775 if(qname_len == 0) 2776 return 0; /* too short */ 2777 if(qname_len <= node->namelen) 2778 return 0; /* qname too short for dname removal */ 2779 2780 /* synthesize a CNAME */ 2781 newlen = synth_cname_buf(qname, qname_len, node->namelen, 2782 dtarg, dtarglen, buf, sizeof(buf)); 2783 if(newlen == 0) { 2784 /* YXDOMAIN error */ 2785 *cname = NULL; 2786 return 1; 2787 } 2788 *cname = (struct ub_packed_rrset_key*)regional_alloc(region, 2789 sizeof(struct ub_packed_rrset_key)); 2790 if(!*cname) 2791 return 0; /* out of memory */ 2792 memset(&(*cname)->entry, 0, sizeof((*cname)->entry)); 2793 (*cname)->entry.key = (*cname); 2794 (*cname)->rk.type = htons(LDNS_RR_TYPE_CNAME); 2795 (*cname)->rk.rrset_class = htons(dclass); 2796 (*cname)->rk.flags = 0; 2797 (*cname)->rk.dname = regional_alloc_init(region, qname, qname_len); 2798 if(!(*cname)->rk.dname) 2799 return 0; /* out of memory */ 2800 (*cname)->rk.dname_len = qname_len; 2801 (*cname)->entry.hash = rrset_key_hash(&(*cname)->rk); 2802 d = (struct packed_rrset_data*)regional_alloc_zero(region, 2803 sizeof(struct packed_rrset_data) + sizeof(size_t) + 2804 sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t) 2805 + newlen); 2806 if(!d) 2807 return 0; /* out of memory */ 2808 (*cname)->entry.data = d; 2809 d->ttl = dname->data->ttl; /* RFC6672: synth CNAME TTL == DNAME TTL */ 2810 d->count = 1; 2811 d->rrsig_count = 0; 2812 d->trust = rrset_trust_ans_noAA; 2813 d->rr_len = (size_t*)((uint8_t*)d + 2814 sizeof(struct packed_rrset_data)); 2815 d->rr_len[0] = newlen + sizeof(uint16_t); 2816 packed_rrset_ptr_fixup(d); 2817 d->rr_ttl[0] = d->ttl; 2818 sldns_write_uint16(d->rr_data[0], newlen); 2819 memmove(d->rr_data[0] + sizeof(uint16_t), buf, newlen); 2820 return 1; 2821 } 2822 2823 /** add a synthesized CNAME to the answer section */ 2824 static int 2825 add_synth_cname(struct auth_zone* z, uint8_t* qname, size_t qname_len, 2826 struct regional* region, struct dns_msg* msg, struct auth_data* dname, 2827 struct auth_rrset* rrset) 2828 { 2829 struct ub_packed_rrset_key* cname; 2830 /* synthesize a CNAME */ 2831 if(!create_synth_cname(qname, qname_len, region, dname, rrset, 2832 z->dclass, &cname)) { 2833 /* out of memory */ 2834 return 0; 2835 } 2836 if(!cname) { 2837 /* cname cannot be create because of YXDOMAIN */ 2838 msg->rep->flags |= LDNS_RCODE_YXDOMAIN; 2839 return 1; 2840 } 2841 /* add cname to message */ 2842 if(!msg_grow_array(region, msg)) 2843 return 0; 2844 msg->rep->rrsets[msg->rep->rrset_count] = cname; 2845 msg->rep->rrset_count++; 2846 msg->rep->an_numrrsets++; 2847 msg_ttl(msg); 2848 return 1; 2849 } 2850 2851 /** Change a dname to a different one, for wildcard namechange */ 2852 static void 2853 az_change_dnames(struct dns_msg* msg, uint8_t* oldname, uint8_t* newname, 2854 size_t newlen, int an_only) 2855 { 2856 size_t i; 2857 size_t start = 0, end = msg->rep->rrset_count; 2858 if(!an_only) start = msg->rep->an_numrrsets; 2859 if(an_only) end = msg->rep->an_numrrsets; 2860 for(i=start; i<end; i++) { 2861 /* allocated in region so we can change the ptrs */ 2862 if(query_dname_compare(msg->rep->rrsets[i]->rk.dname, oldname) 2863 == 0) { 2864 msg->rep->rrsets[i]->rk.dname = newname; 2865 msg->rep->rrsets[i]->rk.dname_len = newlen; 2866 msg->rep->rrsets[i]->entry.hash = rrset_key_hash(&msg->rep->rrsets[i]->rk); 2867 } 2868 } 2869 } 2870 2871 /** find NSEC record covering the query, with the given node in the zone */ 2872 static struct auth_rrset* 2873 az_find_nsec_cover(struct auth_zone* z, struct auth_data** node) 2874 { 2875 uint8_t* nm; 2876 size_t nmlen; 2877 struct auth_rrset* rrset; 2878 log_assert(*node); /* we already have a node when calling this */ 2879 nm = (*node)->name; 2880 nmlen = (*node)->namelen; 2881 /* find the NSEC for the smallest-or-equal node */ 2882 /* But there could be glue, and then it has no NSEC. 2883 * Go up to find nonglue (previous) NSEC-holding nodes */ 2884 while((rrset=az_domain_rrset(*node, LDNS_RR_TYPE_NSEC)) == NULL) { 2885 if(nmlen == z->namelen) return NULL; 2886 if(!dname_remove_label_limit_len(&nm, &nmlen, z->namelen)) 2887 return NULL; /* can't go up */ 2888 /* adjust *node for the nsec rrset to find in */ 2889 *node = az_find_name(z, nm, nmlen); 2890 } 2891 return rrset; 2892 } 2893 2894 /** Find NSEC and add for wildcard denial */ 2895 static int 2896 az_nsec_wildcard_denial(struct auth_zone* z, struct regional* region, 2897 struct dns_msg* msg, uint8_t* cenm, size_t cenmlen) 2898 { 2899 struct query_info qinfo; 2900 int node_exact; 2901 struct auth_data* node; 2902 struct auth_rrset* nsec; 2903 uint8_t wc[LDNS_MAX_DOMAINLEN]; 2904 if(cenmlen+2 > sizeof(wc)) 2905 return 0; /* result would be too long */ 2906 wc[0] = 1; /* length of wildcard label */ 2907 wc[1] = (uint8_t)'*'; /* wildcard label */ 2908 memmove(wc+2, cenm, cenmlen); 2909 2910 /* we have '*.ce' in wc wildcard name buffer */ 2911 /* get nsec cover for that */ 2912 qinfo.qname = wc; 2913 qinfo.qname_len = cenmlen+2; 2914 qinfo.qtype = 0; 2915 qinfo.qclass = 0; 2916 az_find_domain(z, &qinfo, &node_exact, &node); 2917 if((nsec=az_find_nsec_cover(z, &node)) != NULL) { 2918 if(!msg_add_rrset_ns(z, region, msg, node, nsec)) return 0; 2919 } 2920 return 1; 2921 } 2922 2923 /** Find the NSEC3PARAM rrset (if any) and if true you have the parameters */ 2924 static int 2925 az_nsec3_param(struct auth_zone* z, int* algo, size_t* iter, uint8_t** salt, 2926 size_t* saltlen) 2927 { 2928 struct auth_data* apex; 2929 struct auth_rrset* param; 2930 size_t i; 2931 apex = az_find_name(z, z->name, z->namelen); 2932 if(!apex) return 0; 2933 param = az_domain_rrset(apex, LDNS_RR_TYPE_NSEC3PARAM); 2934 if(!param || param->data->count==0) 2935 return 0; /* no RRset or no RRs in rrset */ 2936 /* find out which NSEC3PARAM RR has supported parameters */ 2937 /* skip unknown flags (dynamic signer is recalculating nsec3 chain) */ 2938 for(i=0; i<param->data->count; i++) { 2939 uint8_t* rdata = param->data->rr_data[i]+2; 2940 size_t rdatalen = param->data->rr_len[i]; 2941 if(rdatalen < 2+5) 2942 continue; /* too short */ 2943 if(!nsec3_hash_algo_size_supported((int)(rdata[0]))) 2944 continue; /* unsupported algo */ 2945 if(rdatalen < (size_t)(2+5+(size_t)rdata[4])) 2946 continue; /* salt missing */ 2947 if((rdata[1]&NSEC3_UNKNOWN_FLAGS)!=0) 2948 continue; /* unknown flags */ 2949 *algo = (int)(rdata[0]); 2950 *iter = sldns_read_uint16(rdata+2); 2951 *saltlen = rdata[4]; 2952 if(*saltlen == 0) 2953 *salt = NULL; 2954 else *salt = rdata+5; 2955 return 1; 2956 } 2957 /* no supported params */ 2958 return 0; 2959 } 2960 2961 /** Hash a name with nsec3param into buffer, it has zone name appended. 2962 * return length of hash */ 2963 static size_t 2964 az_nsec3_hash(uint8_t* buf, size_t buflen, uint8_t* nm, size_t nmlen, 2965 int algo, size_t iter, uint8_t* salt, size_t saltlen) 2966 { 2967 size_t hlen = nsec3_hash_algo_size_supported(algo); 2968 /* buffer has domain name, nsec3hash, and 256 is for max saltlen 2969 * (salt has 0-255 length) */ 2970 unsigned char p[LDNS_MAX_DOMAINLEN+1+N3HASHBUFLEN+256]; 2971 size_t i; 2972 if(nmlen+saltlen > sizeof(p) || hlen+saltlen > sizeof(p)) 2973 return 0; 2974 if(hlen > buflen) 2975 return 0; /* somehow too large for destination buffer */ 2976 /* hashfunc(name, salt) */ 2977 memmove(p, nm, nmlen); 2978 query_dname_tolower(p); 2979 if(salt && saltlen > 0) 2980 memmove(p+nmlen, salt, saltlen); 2981 (void)secalgo_nsec3_hash(algo, p, nmlen+saltlen, (unsigned char*)buf); 2982 for(i=0; i<iter; i++) { 2983 /* hashfunc(hash, salt) */ 2984 memmove(p, buf, hlen); 2985 if(salt && saltlen > 0) 2986 memmove(p+hlen, salt, saltlen); 2987 (void)secalgo_nsec3_hash(algo, p, hlen+saltlen, 2988 (unsigned char*)buf); 2989 } 2990 return hlen; 2991 } 2992 2993 /** Hash name and return b32encoded hashname for lookup, zone name appended */ 2994 static int 2995 az_nsec3_hashname(struct auth_zone* z, uint8_t* hashname, size_t* hashnmlen, 2996 uint8_t* nm, size_t nmlen, int algo, size_t iter, uint8_t* salt, 2997 size_t saltlen) 2998 { 2999 uint8_t hash[N3HASHBUFLEN]; 3000 size_t hlen; 3001 int ret; 3002 hlen = az_nsec3_hash(hash, sizeof(hash), nm, nmlen, algo, iter, 3003 salt, saltlen); 3004 if(!hlen) return 0; 3005 /* b32 encode */ 3006 if(*hashnmlen < hlen*2+1+z->namelen) /* approx b32 as hexb16 */ 3007 return 0; 3008 ret = sldns_b32_ntop_extended_hex(hash, hlen, (char*)(hashname+1), 3009 (*hashnmlen)-1); 3010 if(ret<1) 3011 return 0; 3012 hashname[0] = (uint8_t)ret; 3013 ret++; 3014 if((*hashnmlen) - ret < z->namelen) 3015 return 0; 3016 memmove(hashname+ret, z->name, z->namelen); 3017 *hashnmlen = z->namelen+(size_t)ret; 3018 return 1; 3019 } 3020 3021 /** Find the datanode that covers the nsec3hash-name */ 3022 static struct auth_data* 3023 az_nsec3_findnode(struct auth_zone* z, uint8_t* hashnm, size_t hashnmlen) 3024 { 3025 struct query_info qinfo; 3026 struct auth_data* node; 3027 int node_exact; 3028 qinfo.qclass = 0; 3029 qinfo.qtype = 0; 3030 qinfo.qname = hashnm; 3031 qinfo.qname_len = hashnmlen; 3032 /* because canonical ordering and b32 nsec3 ordering are the same. 3033 * this is a good lookup to find the nsec3 name. */ 3034 az_find_domain(z, &qinfo, &node_exact, &node); 3035 /* but we may have to skip non-nsec3 nodes */ 3036 /* this may be a lot, the way to speed that up is to have a 3037 * separate nsec3 tree with nsec3 nodes */ 3038 while(node && (rbnode_type*)node != RBTREE_NULL && 3039 !az_domain_rrset(node, LDNS_RR_TYPE_NSEC3)) { 3040 node = (struct auth_data*)rbtree_previous(&node->node); 3041 } 3042 if((rbnode_type*)node == RBTREE_NULL) 3043 node = NULL; 3044 return node; 3045 } 3046 3047 /** Find cover for hashed(nm, nmlen) (or NULL) */ 3048 static struct auth_data* 3049 az_nsec3_find_cover(struct auth_zone* z, uint8_t* nm, size_t nmlen, 3050 int algo, size_t iter, uint8_t* salt, size_t saltlen) 3051 { 3052 struct auth_data* node; 3053 uint8_t hname[LDNS_MAX_DOMAINLEN]; 3054 size_t hlen = sizeof(hname); 3055 if(!az_nsec3_hashname(z, hname, &hlen, nm, nmlen, algo, iter, 3056 salt, saltlen)) 3057 return NULL; 3058 node = az_nsec3_findnode(z, hname, hlen); 3059 if(node) 3060 return node; 3061 /* we did not find any, perhaps because the NSEC3 hash is before 3062 * the first hash, we have to find the 'last hash' in the zone */ 3063 node = (struct auth_data*)rbtree_last(&z->data); 3064 while(node && (rbnode_type*)node != RBTREE_NULL && 3065 !az_domain_rrset(node, LDNS_RR_TYPE_NSEC3)) { 3066 node = (struct auth_data*)rbtree_previous(&node->node); 3067 } 3068 if((rbnode_type*)node == RBTREE_NULL) 3069 node = NULL; 3070 return node; 3071 } 3072 3073 /** Find exact match for hashed(nm, nmlen) NSEC3 record or NULL */ 3074 static struct auth_data* 3075 az_nsec3_find_exact(struct auth_zone* z, uint8_t* nm, size_t nmlen, 3076 int algo, size_t iter, uint8_t* salt, size_t saltlen) 3077 { 3078 struct auth_data* node; 3079 uint8_t hname[LDNS_MAX_DOMAINLEN]; 3080 size_t hlen = sizeof(hname); 3081 if(!az_nsec3_hashname(z, hname, &hlen, nm, nmlen, algo, iter, 3082 salt, saltlen)) 3083 return NULL; 3084 node = az_find_name(z, hname, hlen); 3085 if(az_domain_rrset(node, LDNS_RR_TYPE_NSEC3)) 3086 return node; 3087 return NULL; 3088 } 3089 3090 /** Return nextcloser name (as a ref into the qname). This is one label 3091 * more than the cenm (cename must be a suffix of qname) */ 3092 static void 3093 az_nsec3_get_nextcloser(uint8_t* cenm, uint8_t* qname, size_t qname_len, 3094 uint8_t** nx, size_t* nxlen) 3095 { 3096 int celabs = dname_count_labels(cenm); 3097 int qlabs = dname_count_labels(qname); 3098 int strip = qlabs - celabs -1; 3099 log_assert(dname_strict_subdomain(qname, qlabs, cenm, celabs)); 3100 *nx = qname; 3101 *nxlen = qname_len; 3102 if(strip>0) 3103 dname_remove_labels(nx, nxlen, strip); 3104 } 3105 3106 /** Find the closest encloser that has exact NSEC3. 3107 * updated cenm to the new name. If it went up no-exact-ce is true. */ 3108 static struct auth_data* 3109 az_nsec3_find_ce(struct auth_zone* z, uint8_t** cenm, size_t* cenmlen, 3110 int* no_exact_ce, int algo, size_t iter, uint8_t* salt, size_t saltlen) 3111 { 3112 struct auth_data* node; 3113 while((node = az_nsec3_find_exact(z, *cenm, *cenmlen, 3114 algo, iter, salt, saltlen)) == NULL) { 3115 if(!dname_remove_label_limit_len(cenm, cenmlen, z->namelen)) 3116 return NULL; /* can't go up */ 3117 *no_exact_ce = 1; 3118 } 3119 return node; 3120 } 3121 3122 /* Insert NSEC3 record in authority section, if NULL does nothing */ 3123 static int 3124 az_nsec3_insert(struct auth_zone* z, struct regional* region, 3125 struct dns_msg* msg, struct auth_data* node) 3126 { 3127 struct auth_rrset* nsec3; 3128 if(!node) return 1; /* no node, skip this */ 3129 nsec3 = az_domain_rrset(node, LDNS_RR_TYPE_NSEC3); 3130 if(!nsec3) return 1; /* if no nsec3 RR, skip it */ 3131 if(!msg_add_rrset_ns(z, region, msg, node, nsec3)) return 0; 3132 return 1; 3133 } 3134 3135 /** add NSEC3 records to the zone for the nsec3 proof. 3136 * Specify with the flags with parts of the proof are required. 3137 * the ce is the exact matching name (for notype) but also delegation points. 3138 * qname is the one where the nextcloser name can be derived from. 3139 * If NSEC3 is not properly there (in the zone) nothing is added. 3140 * always enabled: include nsec3 proving about the Closest Encloser. 3141 * that is an exact match that should exist for it. 3142 * If that does not exist, a higher exact match + nxproof is enabled 3143 * (for some sort of opt-out empty nonterminal cases). 3144 * nodataproof: search for exact match and include that instead. 3145 * ceproof: include ce proof NSEC3 (omitted for wildcard replies). 3146 * nxproof: include denial of the qname. 3147 * wcproof: include denial of wildcard (wildcard.ce). 3148 */ 3149 static int 3150 az_add_nsec3_proof(struct auth_zone* z, struct regional* region, 3151 struct dns_msg* msg, uint8_t* cenm, size_t cenmlen, uint8_t* qname, 3152 size_t qname_len, int nodataproof, int ceproof, int nxproof, 3153 int wcproof) 3154 { 3155 int algo; 3156 size_t iter, saltlen; 3157 uint8_t* salt; 3158 int no_exact_ce = 0; 3159 struct auth_data* node; 3160 3161 /* find parameters of nsec3 proof */ 3162 if(!az_nsec3_param(z, &algo, &iter, &salt, &saltlen)) 3163 return 1; /* no nsec3 */ 3164 if(nodataproof) { 3165 /* see if the node has a hash of itself for the nodata 3166 * proof nsec3, this has to be an exact match nsec3. */ 3167 struct auth_data* match; 3168 match = az_nsec3_find_exact(z, qname, qname_len, algo, 3169 iter, salt, saltlen); 3170 if(match) { 3171 if(!az_nsec3_insert(z, region, msg, match)) 3172 return 0; 3173 /* only nodata NSEC3 needed, no CE or others. */ 3174 return 1; 3175 } 3176 } 3177 /* find ce that has an NSEC3 */ 3178 if(ceproof) { 3179 node = az_nsec3_find_ce(z, &cenm, &cenmlen, &no_exact_ce, 3180 algo, iter, salt, saltlen); 3181 if(no_exact_ce) nxproof = 1; 3182 if(!az_nsec3_insert(z, region, msg, node)) 3183 return 0; 3184 } 3185 3186 if(nxproof) { 3187 uint8_t* nx; 3188 size_t nxlen; 3189 /* create nextcloser domain name */ 3190 az_nsec3_get_nextcloser(cenm, qname, qname_len, &nx, &nxlen); 3191 /* find nsec3 that matches or covers it */ 3192 node = az_nsec3_find_cover(z, nx, nxlen, algo, iter, salt, 3193 saltlen); 3194 if(!az_nsec3_insert(z, region, msg, node)) 3195 return 0; 3196 } 3197 if(wcproof) { 3198 /* create wildcard name *.ce */ 3199 uint8_t wc[LDNS_MAX_DOMAINLEN]; 3200 size_t wclen; 3201 if(cenmlen+2 > sizeof(wc)) 3202 return 0; /* result would be too long */ 3203 wc[0] = 1; /* length of wildcard label */ 3204 wc[1] = (uint8_t)'*'; /* wildcard label */ 3205 memmove(wc+2, cenm, cenmlen); 3206 wclen = cenmlen+2; 3207 /* find nsec3 that matches or covers it */ 3208 node = az_nsec3_find_cover(z, wc, wclen, algo, iter, salt, 3209 saltlen); 3210 if(!az_nsec3_insert(z, region, msg, node)) 3211 return 0; 3212 } 3213 return 1; 3214 } 3215 3216 /** generate answer for positive answer */ 3217 static int 3218 az_generate_positive_answer(struct auth_zone* z, struct regional* region, 3219 struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset) 3220 { 3221 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 3222 /* see if we want additional rrs */ 3223 if(rrset->type == LDNS_RR_TYPE_MX) { 3224 if(!az_add_additionals_from(z, region, msg, rrset, 2)) 3225 return 0; 3226 } else if(rrset->type == LDNS_RR_TYPE_SRV) { 3227 if(!az_add_additionals_from(z, region, msg, rrset, 6)) 3228 return 0; 3229 } else if(rrset->type == LDNS_RR_TYPE_NS) { 3230 if(!az_add_additionals_from(z, region, msg, rrset, 0)) 3231 return 0; 3232 } 3233 return 1; 3234 } 3235 3236 /** generate answer for type ANY answer */ 3237 static int 3238 az_generate_any_answer(struct auth_zone* z, struct regional* region, 3239 struct dns_msg* msg, struct auth_data* node) 3240 { 3241 struct auth_rrset* rrset; 3242 int added = 0; 3243 /* add a couple (at least one) RRs */ 3244 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_SOA)) != NULL) { 3245 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 3246 added++; 3247 } 3248 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_MX)) != NULL) { 3249 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 3250 added++; 3251 } 3252 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_A)) != NULL) { 3253 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 3254 added++; 3255 } 3256 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_AAAA)) != NULL) { 3257 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 3258 added++; 3259 } 3260 if(added == 0 && node && node->rrsets) { 3261 if(!msg_add_rrset_an(z, region, msg, node, 3262 node->rrsets)) return 0; 3263 } 3264 return 1; 3265 } 3266 3267 /** follow cname chain and add more data to the answer section */ 3268 static int 3269 follow_cname_chain(struct auth_zone* z, uint16_t qtype, 3270 struct regional* region, struct dns_msg* msg, 3271 struct packed_rrset_data* d) 3272 { 3273 int maxchain = 0; 3274 /* see if we can add the target of the CNAME into the answer */ 3275 while(maxchain++ < MAX_CNAME_CHAIN) { 3276 struct auth_data* node; 3277 struct auth_rrset* rrset; 3278 size_t clen; 3279 /* d has cname rdata */ 3280 if(d->count == 0) break; /* no CNAME */ 3281 if(d->rr_len[0] < 2+1) break; /* too small */ 3282 if((clen=dname_valid(d->rr_data[0]+2, d->rr_len[0]-2))==0) 3283 break; /* malformed */ 3284 if(!dname_subdomain_c(d->rr_data[0]+2, z->name)) 3285 break; /* target out of zone */ 3286 if((node = az_find_name(z, d->rr_data[0]+2, clen))==NULL) 3287 break; /* no such target name */ 3288 if((rrset=az_domain_rrset(node, qtype))!=NULL) { 3289 /* done we found the target */ 3290 if(!msg_add_rrset_an(z, region, msg, node, rrset)) 3291 return 0; 3292 break; 3293 } 3294 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_CNAME))==NULL) 3295 break; /* no further CNAME chain, notype */ 3296 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 3297 d = rrset->data; 3298 } 3299 return 1; 3300 } 3301 3302 /** generate answer for cname answer */ 3303 static int 3304 az_generate_cname_answer(struct auth_zone* z, struct query_info* qinfo, 3305 struct regional* region, struct dns_msg* msg, 3306 struct auth_data* node, struct auth_rrset* rrset) 3307 { 3308 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 3309 if(!rrset) return 1; 3310 if(!follow_cname_chain(z, qinfo->qtype, region, msg, rrset->data)) 3311 return 0; 3312 return 1; 3313 } 3314 3315 /** generate answer for notype answer */ 3316 static int 3317 az_generate_notype_answer(struct auth_zone* z, struct regional* region, 3318 struct dns_msg* msg, struct auth_data* node) 3319 { 3320 struct auth_rrset* rrset; 3321 if(!az_add_negative_soa(z, region, msg)) return 0; 3322 /* DNSSEC denial NSEC */ 3323 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_NSEC))!=NULL) { 3324 if(!msg_add_rrset_ns(z, region, msg, node, rrset)) return 0; 3325 } else if(node) { 3326 /* DNSSEC denial NSEC3 */ 3327 if(!az_add_nsec3_proof(z, region, msg, node->name, 3328 node->namelen, msg->qinfo.qname, 3329 msg->qinfo.qname_len, 1, 1, 0, 0)) 3330 return 0; 3331 } 3332 return 1; 3333 } 3334 3335 /** generate answer for referral answer */ 3336 static int 3337 az_generate_referral_answer(struct auth_zone* z, struct regional* region, 3338 struct dns_msg* msg, struct auth_data* ce, struct auth_rrset* rrset) 3339 { 3340 struct auth_rrset* ds, *nsec; 3341 /* turn off AA flag, referral is nonAA because it leaves the zone */ 3342 log_assert(ce); 3343 msg->rep->flags &= ~BIT_AA; 3344 if(!msg_add_rrset_ns(z, region, msg, ce, rrset)) return 0; 3345 /* add DS or deny it */ 3346 if((ds=az_domain_rrset(ce, LDNS_RR_TYPE_DS))!=NULL) { 3347 if(!msg_add_rrset_ns(z, region, msg, ce, ds)) return 0; 3348 } else { 3349 /* deny the DS */ 3350 if((nsec=az_domain_rrset(ce, LDNS_RR_TYPE_NSEC))!=NULL) { 3351 if(!msg_add_rrset_ns(z, region, msg, ce, nsec)) 3352 return 0; 3353 } else { 3354 if(!az_add_nsec3_proof(z, region, msg, ce->name, 3355 ce->namelen, msg->qinfo.qname, 3356 msg->qinfo.qname_len, 1, 1, 0, 0)) 3357 return 0; 3358 } 3359 } 3360 /* add additional rrs for type NS */ 3361 if(!az_add_additionals_from(z, region, msg, rrset, 0)) return 0; 3362 return 1; 3363 } 3364 3365 /** generate answer for DNAME answer */ 3366 static int 3367 az_generate_dname_answer(struct auth_zone* z, struct query_info* qinfo, 3368 struct regional* region, struct dns_msg* msg, struct auth_data* ce, 3369 struct auth_rrset* rrset) 3370 { 3371 log_assert(ce); 3372 /* add the DNAME and then a CNAME */ 3373 if(!msg_add_rrset_an(z, region, msg, ce, rrset)) return 0; 3374 if(!add_synth_cname(z, qinfo->qname, qinfo->qname_len, region, 3375 msg, ce, rrset)) return 0; 3376 if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_YXDOMAIN) 3377 return 1; 3378 if(msg->rep->rrset_count == 0 || 3379 !msg->rep->rrsets[msg->rep->rrset_count-1]) 3380 return 0; 3381 if(!follow_cname_chain(z, qinfo->qtype, region, msg, 3382 (struct packed_rrset_data*)msg->rep->rrsets[ 3383 msg->rep->rrset_count-1]->entry.data)) 3384 return 0; 3385 return 1; 3386 } 3387 3388 /** generate answer for wildcard answer */ 3389 static int 3390 az_generate_wildcard_answer(struct auth_zone* z, struct query_info* qinfo, 3391 struct regional* region, struct dns_msg* msg, struct auth_data* ce, 3392 struct auth_data* wildcard, struct auth_data* node) 3393 { 3394 struct auth_rrset* rrset, *nsec; 3395 int insert_ce = 0; 3396 if((rrset=az_domain_rrset(wildcard, qinfo->qtype)) != NULL) { 3397 /* wildcard has type, add it */ 3398 if(!msg_add_rrset_an(z, region, msg, wildcard, rrset)) 3399 return 0; 3400 az_change_dnames(msg, wildcard->name, msg->qinfo.qname, 3401 msg->qinfo.qname_len, 1); 3402 } else if((rrset=az_domain_rrset(wildcard, LDNS_RR_TYPE_CNAME))!=NULL) { 3403 /* wildcard has cname instead, do that */ 3404 if(!msg_add_rrset_an(z, region, msg, wildcard, rrset)) 3405 return 0; 3406 az_change_dnames(msg, wildcard->name, msg->qinfo.qname, 3407 msg->qinfo.qname_len, 1); 3408 if(!follow_cname_chain(z, qinfo->qtype, region, msg, 3409 rrset->data)) 3410 return 0; 3411 } else if(qinfo->qtype == LDNS_RR_TYPE_ANY && wildcard->rrsets) { 3412 /* add ANY rrsets from wildcard node */ 3413 if(!az_generate_any_answer(z, region, msg, wildcard)) 3414 return 0; 3415 az_change_dnames(msg, wildcard->name, msg->qinfo.qname, 3416 msg->qinfo.qname_len, 1); 3417 } else { 3418 /* wildcard has nodata, notype answer */ 3419 /* call other notype routine for dnssec notype denials */ 3420 if(!az_generate_notype_answer(z, region, msg, wildcard)) 3421 return 0; 3422 /* because the notype, there is no positive data with an 3423 * RRSIG that indicates the wildcard position. Thus the 3424 * wildcard qname denial needs to have a CE nsec3. */ 3425 insert_ce = 1; 3426 } 3427 3428 /* ce and node for dnssec denial of wildcard original name */ 3429 if((nsec=az_find_nsec_cover(z, &node)) != NULL) { 3430 if(!msg_add_rrset_ns(z, region, msg, node, nsec)) return 0; 3431 } else if(ce) { 3432 uint8_t* wildup = wildcard->name; 3433 size_t wilduplen= wildcard->namelen; 3434 if(!dname_remove_label_limit_len(&wildup, &wilduplen, z->namelen)) 3435 return 0; /* can't go up */ 3436 if(!az_add_nsec3_proof(z, region, msg, wildup, 3437 wilduplen, msg->qinfo.qname, 3438 msg->qinfo.qname_len, 0, insert_ce, 1, 0)) 3439 return 0; 3440 } 3441 3442 /* fixup name of wildcard from *.zone to qname, use already allocated 3443 * pointer to msg qname */ 3444 az_change_dnames(msg, wildcard->name, msg->qinfo.qname, 3445 msg->qinfo.qname_len, 0); 3446 return 1; 3447 } 3448 3449 /** generate answer for nxdomain answer */ 3450 static int 3451 az_generate_nxdomain_answer(struct auth_zone* z, struct regional* region, 3452 struct dns_msg* msg, struct auth_data* ce, struct auth_data* node) 3453 { 3454 struct auth_rrset* nsec; 3455 msg->rep->flags |= LDNS_RCODE_NXDOMAIN; 3456 if(!az_add_negative_soa(z, region, msg)) return 0; 3457 if((nsec=az_find_nsec_cover(z, &node)) != NULL) { 3458 if(!msg_add_rrset_ns(z, region, msg, node, nsec)) return 0; 3459 if(ce && !az_nsec_wildcard_denial(z, region, msg, ce->name, 3460 ce->namelen)) return 0; 3461 } else if(ce) { 3462 if(!az_add_nsec3_proof(z, region, msg, ce->name, 3463 ce->namelen, msg->qinfo.qname, 3464 msg->qinfo.qname_len, 0, 1, 1, 1)) 3465 return 0; 3466 } 3467 return 1; 3468 } 3469 3470 /** Create answers when an exact match exists for the domain name */ 3471 static int 3472 az_generate_answer_with_node(struct auth_zone* z, struct query_info* qinfo, 3473 struct regional* region, struct dns_msg* msg, struct auth_data* node) 3474 { 3475 struct auth_rrset* rrset; 3476 /* positive answer, rrset we are looking for exists */ 3477 if((rrset=az_domain_rrset(node, qinfo->qtype)) != NULL) { 3478 return az_generate_positive_answer(z, region, msg, node, rrset); 3479 } 3480 /* CNAME? */ 3481 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_CNAME)) != NULL) { 3482 return az_generate_cname_answer(z, qinfo, region, msg, 3483 node, rrset); 3484 } 3485 /* type ANY ? */ 3486 if(qinfo->qtype == LDNS_RR_TYPE_ANY) { 3487 return az_generate_any_answer(z, region, msg, node); 3488 } 3489 /* NOERROR/NODATA (no such type at domain name) */ 3490 return az_generate_notype_answer(z, region, msg, node); 3491 } 3492 3493 /** Generate answer without an existing-node that we can use. 3494 * So it'll be a referral, DNAME, notype, wildcard or nxdomain */ 3495 static int 3496 az_generate_answer_nonexistnode(struct auth_zone* z, struct query_info* qinfo, 3497 struct regional* region, struct dns_msg* msg, struct auth_data* ce, 3498 struct auth_rrset* rrset, struct auth_data* node) 3499 { 3500 struct auth_data* wildcard; 3501 3502 /* we do not have an exact matching name (that exists) */ 3503 /* see if we have a NS or DNAME in the ce */ 3504 if(ce && rrset && rrset->type == LDNS_RR_TYPE_NS) { 3505 return az_generate_referral_answer(z, region, msg, ce, rrset); 3506 } 3507 if(ce && rrset && rrset->type == LDNS_RR_TYPE_DNAME) { 3508 return az_generate_dname_answer(z, qinfo, region, msg, ce, 3509 rrset); 3510 } 3511 /* if there is an empty nonterminal, wildcard and nxdomain don't 3512 * happen, it is a notype answer */ 3513 if(az_empty_nonterminal(z, qinfo, node)) { 3514 return az_generate_notype_answer(z, region, msg, node); 3515 } 3516 /* see if we have a wildcard under the ce */ 3517 if((wildcard=az_find_wildcard(z, qinfo, ce)) != NULL) { 3518 return az_generate_wildcard_answer(z, qinfo, region, msg, 3519 ce, wildcard, node); 3520 } 3521 /* generate nxdomain answer */ 3522 return az_generate_nxdomain_answer(z, region, msg, ce, node); 3523 } 3524 3525 /** Lookup answer in a zone. */ 3526 static int 3527 auth_zone_generate_answer(struct auth_zone* z, struct query_info* qinfo, 3528 struct regional* region, struct dns_msg** msg, int* fallback) 3529 { 3530 struct auth_data* node, *ce; 3531 struct auth_rrset* rrset; 3532 int node_exact, node_exists; 3533 /* does the zone want fallback in case of failure? */ 3534 *fallback = z->fallback_enabled; 3535 if(!(*msg=msg_create(region, qinfo))) return 0; 3536 3537 /* lookup if there is a matching domain name for the query */ 3538 az_find_domain(z, qinfo, &node_exact, &node); 3539 3540 /* see if node exists for generating answers from (i.e. not glue and 3541 * obscured by NS or DNAME or NSEC3-only), and also return the 3542 * closest-encloser from that, closest node that should be used 3543 * to generate answers from that is above the query */ 3544 node_exists = az_find_ce(z, qinfo, node, node_exact, &ce, &rrset); 3545 3546 if(verbosity >= VERB_ALGO) { 3547 char zname[256], qname[256], nname[256], cename[256], 3548 tpstr[32], rrstr[32]; 3549 sldns_wire2str_dname_buf(qinfo->qname, qinfo->qname_len, qname, 3550 sizeof(qname)); 3551 sldns_wire2str_type_buf(qinfo->qtype, tpstr, sizeof(tpstr)); 3552 sldns_wire2str_dname_buf(z->name, z->namelen, zname, 3553 sizeof(zname)); 3554 if(node) 3555 sldns_wire2str_dname_buf(node->name, node->namelen, 3556 nname, sizeof(nname)); 3557 else snprintf(nname, sizeof(nname), "NULL"); 3558 if(ce) 3559 sldns_wire2str_dname_buf(ce->name, ce->namelen, 3560 cename, sizeof(cename)); 3561 else snprintf(cename, sizeof(cename), "NULL"); 3562 if(rrset) sldns_wire2str_type_buf(rrset->type, rrstr, 3563 sizeof(rrstr)); 3564 else snprintf(rrstr, sizeof(rrstr), "NULL"); 3565 log_info("auth_zone %s query %s %s, domain %s %s %s, " 3566 "ce %s, rrset %s", zname, qname, tpstr, nname, 3567 (node_exact?"exact":"notexact"), 3568 (node_exists?"exist":"notexist"), cename, rrstr); 3569 } 3570 3571 if(node_exists) { 3572 /* the node is fine, generate answer from node */ 3573 return az_generate_answer_with_node(z, qinfo, region, *msg, 3574 node); 3575 } 3576 return az_generate_answer_nonexistnode(z, qinfo, region, *msg, 3577 ce, rrset, node); 3578 } 3579 3580 int auth_zones_lookup(struct auth_zones* az, struct query_info* qinfo, 3581 struct regional* region, struct dns_msg** msg, int* fallback, 3582 uint8_t* dp_nm, size_t dp_nmlen) 3583 { 3584 int r; 3585 struct auth_zone* z; 3586 /* find the zone that should contain the answer. */ 3587 lock_rw_rdlock(&az->lock); 3588 z = auth_zone_find(az, dp_nm, dp_nmlen, qinfo->qclass); 3589 if(!z) { 3590 lock_rw_unlock(&az->lock); 3591 /* no auth zone, fallback to internet */ 3592 *fallback = 1; 3593 return 0; 3594 } 3595 lock_rw_rdlock(&z->lock); 3596 lock_rw_unlock(&az->lock); 3597 3598 /* if not for upstream queries, fallback */ 3599 if(!z->for_upstream) { 3600 lock_rw_unlock(&z->lock); 3601 *fallback = 1; 3602 return 0; 3603 } 3604 if(z->zone_expired || (z->zonemd_check && z->zonemd_callback_env)) { 3605 /* Do not serve from a zonemd-check zone while its ZONEMD 3606 * verification is still pending: the content is not yet known 3607 * to pass the configured check. The pending marker 3608 * (zonemd_callback_env) is set under z->lock when the async 3609 * lookup is spawned and cleared by the callback under z->lock, 3610 * so this test is race-free. */ 3611 *fallback = z->fallback_enabled; 3612 lock_rw_unlock(&z->lock); 3613 return 0; 3614 } 3615 /* see what answer that zone would generate */ 3616 r = auth_zone_generate_answer(z, qinfo, region, msg, fallback); 3617 lock_rw_unlock(&z->lock); 3618 return r; 3619 } 3620 3621 /** encode auth answer */ 3622 static void 3623 auth_answer_encode(struct query_info* qinfo, struct module_env* env, 3624 struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf, 3625 struct regional* temp, struct dns_msg* msg) 3626 { 3627 uint16_t udpsize; 3628 udpsize = edns->udp_size; 3629 edns->edns_version = EDNS_ADVERTISED_VERSION; 3630 edns->udp_size = EDNS_ADVERTISED_SIZE; 3631 edns->ext_rcode = 0; 3632 edns->bits &= EDNS_DO; 3633 3634 if(!inplace_cb_reply_local_call(env, qinfo, NULL, msg->rep, 3635 (int)FLAGS_GET_RCODE(msg->rep->flags), edns, repinfo, temp, env->now_tv) 3636 || !reply_info_answer_encode(qinfo, msg->rep, 3637 *(uint16_t*)sldns_buffer_begin(buf), 3638 sldns_buffer_read_u16_at(buf, 2), 3639 buf, 0, 0, temp, udpsize, edns, 3640 (int)(edns->bits&EDNS_DO), 0)) { 3641 error_encode(buf, (LDNS_RCODE_SERVFAIL|BIT_AA), qinfo, 3642 *(uint16_t*)sldns_buffer_begin(buf), 3643 sldns_buffer_read_u16_at(buf, 2), edns); 3644 } 3645 } 3646 3647 /** encode auth error answer */ 3648 static void 3649 auth_error_encode(struct query_info* qinfo, struct module_env* env, 3650 struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf, 3651 struct regional* temp, int rcode) 3652 { 3653 edns->edns_version = EDNS_ADVERTISED_VERSION; 3654 edns->udp_size = EDNS_ADVERTISED_SIZE; 3655 edns->ext_rcode = 0; 3656 edns->bits &= EDNS_DO; 3657 3658 if(!inplace_cb_reply_local_call(env, qinfo, NULL, NULL, 3659 rcode, edns, repinfo, temp, env->now_tv)) 3660 edns->opt_list_inplace_cb_out = NULL; 3661 error_encode(buf, rcode|BIT_AA, qinfo, 3662 *(uint16_t*)sldns_buffer_begin(buf), 3663 sldns_buffer_read_u16_at(buf, 2), edns); 3664 } 3665 3666 int auth_zones_downstream_answer(struct auth_zones* az, struct module_env* env, 3667 struct query_info* qinfo, struct edns_data* edns, 3668 struct comm_reply* repinfo, struct sldns_buffer* buf, 3669 struct regional* temp) 3670 { 3671 struct dns_msg* msg = NULL; 3672 struct auth_zone* z; 3673 int r; 3674 int fallback = 0; 3675 /* Copy the qinfo in case of cname aliasing from local-zone */ 3676 struct query_info zqinfo = *qinfo; 3677 3678 lock_rw_rdlock(&az->lock); 3679 if(!az->have_downstream) { 3680 /* no downstream auth zones */ 3681 lock_rw_unlock(&az->lock); 3682 return 0; 3683 } 3684 3685 if(qinfo->qtype == LDNS_RR_TYPE_DS) { 3686 uint8_t* delname = qinfo->qname; 3687 size_t delnamelen = qinfo->qname_len; 3688 dname_remove_label(&delname, &delnamelen); 3689 z = auth_zones_find_zone(az, delname, delnamelen, 3690 qinfo->qclass); 3691 } else { 3692 if(zqinfo.local_alias && !local_alias_shallow_copy_qname( 3693 zqinfo.local_alias, &zqinfo.qname, 3694 &zqinfo.qname_len)) { 3695 lock_rw_unlock(&az->lock); 3696 return 0; 3697 } 3698 z = auth_zones_find_zone(az, zqinfo.qname, zqinfo.qname_len, 3699 zqinfo.qclass); 3700 } 3701 if(!z) { 3702 /* no zone above it */ 3703 lock_rw_unlock(&az->lock); 3704 return 0; 3705 } 3706 lock_rw_rdlock(&z->lock); 3707 lock_rw_unlock(&az->lock); 3708 if(!z->for_downstream) { 3709 lock_rw_unlock(&z->lock); 3710 return 0; 3711 } 3712 if(z->zone_expired || (z->zonemd_check && z->zonemd_callback_env)) { 3713 /* see auth_zones_lookup: a pending ZONEMD verification is 3714 * treated like expiry - the zone content is not yet known 3715 * to pass the configured check. */ 3716 if(z->fallback_enabled) { 3717 lock_rw_unlock(&z->lock); 3718 return 0; 3719 } 3720 lock_rw_unlock(&z->lock); 3721 env->mesh->num_query_authzone_down++; 3722 auth_error_encode(qinfo, env, edns, repinfo, buf, temp, 3723 LDNS_RCODE_SERVFAIL); 3724 return 1; 3725 } 3726 3727 /* answer it from zone z */ 3728 r = auth_zone_generate_answer(z, &zqinfo, temp, &msg, &fallback); 3729 lock_rw_unlock(&z->lock); 3730 if(!r && fallback) { 3731 /* fallback to regular answering (recursive) */ 3732 return 0; 3733 } 3734 env->mesh->num_query_authzone_down++; 3735 3736 /* encode answer */ 3737 if(!r) 3738 auth_error_encode(qinfo, env, edns, repinfo, buf, temp, 3739 LDNS_RCODE_SERVFAIL); 3740 else auth_answer_encode(qinfo, env, edns, repinfo, buf, temp, msg); 3741 3742 return 1; 3743 } 3744 3745 int auth_zones_can_fallback(struct auth_zones* az, uint8_t* nm, size_t nmlen, 3746 uint16_t dclass) 3747 { 3748 int r; 3749 struct auth_zone* z; 3750 lock_rw_rdlock(&az->lock); 3751 z = auth_zone_find(az, nm, nmlen, dclass); 3752 if(!z) { 3753 lock_rw_unlock(&az->lock); 3754 /* no such auth zone, fallback */ 3755 return 1; 3756 } 3757 lock_rw_rdlock(&z->lock); 3758 lock_rw_unlock(&az->lock); 3759 r = z->fallback_enabled || (!z->for_upstream); 3760 lock_rw_unlock(&z->lock); 3761 return r; 3762 } 3763 3764 int 3765 auth_zone_parse_notify_serial(sldns_buffer* pkt, uint32_t *serial) 3766 { 3767 struct query_info q; 3768 uint16_t rdlen; 3769 memset(&q, 0, sizeof(q)); 3770 sldns_buffer_set_position(pkt, 0); 3771 if(!query_info_parse(&q, pkt)) return 0; 3772 if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) == 0) return 0; 3773 /* skip name of RR in answer section */ 3774 if(sldns_buffer_remaining(pkt) < 1) return 0; 3775 if(pkt_dname_len(pkt) == 0) return 0; 3776 /* check type */ 3777 if(sldns_buffer_remaining(pkt) < 10 /* type,class,ttl,rdatalen*/) 3778 return 0; 3779 if(sldns_buffer_read_u16(pkt) != LDNS_RR_TYPE_SOA) return 0; 3780 sldns_buffer_skip(pkt, 2); /* class */ 3781 sldns_buffer_skip(pkt, 4); /* ttl */ 3782 rdlen = sldns_buffer_read_u16(pkt); /* rdatalen */ 3783 if(sldns_buffer_remaining(pkt) < rdlen) return 0; 3784 if(rdlen < 22) return 0; /* bad soa length */ 3785 sldns_buffer_skip(pkt, (ssize_t)(rdlen-20)); 3786 *serial = sldns_buffer_read_u32(pkt); 3787 /* return true when has serial in answer section */ 3788 return 1; 3789 } 3790 3791 /** print addr to str, and if not 53, append "@port_number", for logs. */ 3792 static void addr_port_to_str(struct sockaddr_storage* addr, socklen_t addrlen, 3793 char* buf, size_t len) 3794 { 3795 uint16_t port = 0; 3796 if(addr_is_ip6(addr, addrlen)) { 3797 struct sockaddr_in6* sa = (struct sockaddr_in6*)addr; 3798 port = ntohs((uint16_t)sa->sin6_port); 3799 } else { 3800 struct sockaddr_in* sa = (struct sockaddr_in*)addr; 3801 port = ntohs((uint16_t)sa->sin_port); 3802 } 3803 if(port == UNBOUND_DNS_PORT) { 3804 /* If it is port 53, print it plainly. */ 3805 addr_to_str(addr, addrlen, buf, len); 3806 } else { 3807 char a[256]; 3808 a[0]=0; 3809 addr_to_str(addr, addrlen, a, sizeof(a)); 3810 snprintf(buf, len, "%s@%d", a, (int)port); 3811 } 3812 } 3813 3814 /** see if addr appears in the list */ 3815 static int 3816 addr_in_list(struct auth_addr* list, struct sockaddr_storage* addr, 3817 socklen_t addrlen) 3818 { 3819 struct auth_addr* p; 3820 for(p=list; p; p=p->next) { 3821 if(sockaddr_cmp_addr(addr, addrlen, &p->addr, p->addrlen)==0) 3822 return 1; 3823 } 3824 return 0; 3825 } 3826 3827 /** check if an address matches a master specification (or one of its 3828 * addresses in the addr list) */ 3829 static int 3830 addr_matches_master(struct auth_master* master, struct sockaddr_storage* addr, 3831 socklen_t addrlen, struct auth_master** fromhost) 3832 { 3833 struct sockaddr_storage a; 3834 socklen_t alen = 0; 3835 int net = 0; 3836 if(addr_in_list(master->list, addr, addrlen)) { 3837 *fromhost = master; 3838 return 1; 3839 } 3840 /* compare address (but not port number, that is the destination 3841 * port of the master, the port number of the received notify is 3842 * allowed to by any port on that master) */ 3843 if(extstrtoaddr(master->host, &a, &alen, UNBOUND_DNS_PORT) && 3844 sockaddr_cmp_addr(addr, addrlen, &a, alen)==0) { 3845 *fromhost = master; 3846 return 1; 3847 } 3848 /* prefixes, addr/len, like 10.0.0.0/8 */ 3849 /* not http and has a / and there is one / */ 3850 if(master->allow_notify && !master->http && 3851 strchr(master->host, '/') != NULL && 3852 strchr(master->host, '/') == strrchr(master->host, '/') && 3853 netblockstrtoaddr(master->host, UNBOUND_DNS_PORT, &a, &alen, 3854 &net) && alen == addrlen) { 3855 if(addr_in_common(addr, (addr_is_ip6(addr, addrlen)?128:32), 3856 &a, net, alen) >= net) { 3857 *fromhost = NULL; /* prefix does not have destination 3858 to send the probe or transfer with */ 3859 return 1; /* matches the netblock */ 3860 } 3861 } 3862 return 0; 3863 } 3864 3865 /** check access list for notifies */ 3866 static int 3867 az_xfr_allowed_notify(struct auth_xfer* xfr, struct sockaddr_storage* addr, 3868 socklen_t addrlen, struct auth_master** fromhost) 3869 { 3870 struct auth_master* p; 3871 for(p=xfr->allow_notify_list; p; p=p->next) { 3872 if(addr_matches_master(p, addr, addrlen, fromhost)) { 3873 return 1; 3874 } 3875 } 3876 return 0; 3877 } 3878 3879 /** see if the serial means the zone has to be updated, i.e. the serial 3880 * is newer than the zone serial, or we have no zone */ 3881 static int 3882 xfr_serial_means_update(struct auth_xfer* xfr, uint32_t serial) 3883 { 3884 if(!xfr->have_zone) 3885 return 1; /* no zone, anything is better */ 3886 if(xfr->zone_expired) 3887 return 1; /* expired, the sent serial is better than expired 3888 data */ 3889 if(compare_serial(xfr->serial, serial) < 0) 3890 return 1; /* our serial is smaller than the sent serial, 3891 the data is newer, fetch it */ 3892 return 0; 3893 } 3894 3895 /** note notify serial, updates the notify information in the xfr struct */ 3896 static void 3897 xfr_note_notify_serial(struct auth_xfer* xfr, int has_serial, uint32_t serial) 3898 { 3899 if(xfr->notify_received && xfr->notify_has_serial && has_serial) { 3900 /* see if this serial is newer */ 3901 if(compare_serial(xfr->notify_serial, serial) < 0) 3902 xfr->notify_serial = serial; 3903 } else if(xfr->notify_received && xfr->notify_has_serial && 3904 !has_serial) { 3905 /* remove serial, we have notify without serial */ 3906 xfr->notify_has_serial = 0; 3907 xfr->notify_serial = 0; 3908 } else if(xfr->notify_received && !xfr->notify_has_serial) { 3909 /* we already have notify without serial, keep it 3910 * that way; no serial check when current operation 3911 * is done */ 3912 } else { 3913 xfr->notify_received = 1; 3914 xfr->notify_has_serial = has_serial; 3915 xfr->notify_serial = serial; 3916 } 3917 } 3918 3919 /** process a notify serial, start new probe or note serial. xfr is locked */ 3920 static void 3921 xfr_process_notify(struct auth_xfer* xfr, struct module_env* env, 3922 int has_serial, uint32_t serial, struct auth_master* fromhost) 3923 { 3924 /* if the serial of notify is older than we have, don't fetch 3925 * a zone, we already have it */ 3926 if(has_serial && !xfr_serial_means_update(xfr, serial)) { 3927 lock_basic_unlock(&xfr->lock); 3928 return; 3929 } 3930 /* start new probe with this addr src, or note serial */ 3931 if(!xfr_start_probe(xfr, env, fromhost)) { 3932 /* not started because already in progress, note the serial */ 3933 xfr_note_notify_serial(xfr, has_serial, serial); 3934 lock_basic_unlock(&xfr->lock); 3935 } 3936 /* successful end of start_probe unlocked xfr->lock */ 3937 } 3938 3939 int auth_zones_notify(struct auth_zones* az, struct module_env* env, 3940 uint8_t* nm, size_t nmlen, uint16_t dclass, 3941 struct sockaddr_storage* addr, socklen_t addrlen, int has_serial, 3942 uint32_t serial, int* refused) 3943 { 3944 struct auth_xfer* xfr; 3945 struct auth_master* fromhost = NULL; 3946 /* see which zone this is */ 3947 lock_rw_rdlock(&az->lock); 3948 xfr = auth_xfer_find(az, nm, nmlen, dclass); 3949 if(!xfr) { 3950 lock_rw_unlock(&az->lock); 3951 /* no such zone, refuse the notify */ 3952 *refused = 1; 3953 return 0; 3954 } 3955 lock_basic_lock(&xfr->lock); 3956 lock_rw_unlock(&az->lock); 3957 3958 /* check access list for notifies */ 3959 if(!az_xfr_allowed_notify(xfr, addr, addrlen, &fromhost)) { 3960 lock_basic_unlock(&xfr->lock); 3961 /* notify not allowed, refuse the notify */ 3962 *refused = 1; 3963 return 0; 3964 } 3965 3966 /* process the notify */ 3967 xfr_process_notify(xfr, env, has_serial, serial, fromhost); 3968 return 1; 3969 } 3970 3971 int auth_zones_startprobesequence(struct auth_zones* az, 3972 struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t dclass) 3973 { 3974 struct auth_xfer* xfr; 3975 lock_rw_rdlock(&az->lock); 3976 xfr = auth_xfer_find(az, nm, nmlen, dclass); 3977 if(!xfr) { 3978 lock_rw_unlock(&az->lock); 3979 return 0; 3980 } 3981 lock_basic_lock(&xfr->lock); 3982 lock_rw_unlock(&az->lock); 3983 3984 xfr_process_notify(xfr, env, 0, 0, NULL); 3985 return 1; 3986 } 3987 3988 /** set a zone expired */ 3989 static void 3990 auth_xfer_set_expired(struct auth_xfer* xfr, struct module_env* env, 3991 int expired) 3992 { 3993 struct auth_zone* z; 3994 3995 /* expire xfr */ 3996 lock_basic_lock(&xfr->lock); 3997 xfr->zone_expired = expired; 3998 lock_basic_unlock(&xfr->lock); 3999 4000 /* find auth_zone */ 4001 lock_rw_rdlock(&env->auth_zones->lock); 4002 z = auth_zone_find(env->auth_zones, xfr->name, xfr->namelen, 4003 xfr->dclass); 4004 if(!z) { 4005 lock_rw_unlock(&env->auth_zones->lock); 4006 return; 4007 } 4008 lock_rw_wrlock(&z->lock); 4009 lock_rw_unlock(&env->auth_zones->lock); 4010 4011 /* expire auth_zone */ 4012 z->zone_expired = expired; 4013 lock_rw_unlock(&z->lock); 4014 } 4015 4016 /** find master (from notify or probe) in list of masters */ 4017 static struct auth_master* 4018 find_master_by_host(struct auth_master* list, char* host) 4019 { 4020 struct auth_master* p; 4021 for(p=list; p; p=p->next) { 4022 if(strcmp(p->host, host) == 0) 4023 return p; 4024 } 4025 return NULL; 4026 } 4027 4028 /** delete the looked up auth_addrs for all the masters in the list */ 4029 static void 4030 xfr_masterlist_free_addrs(struct auth_master* list) 4031 { 4032 struct auth_master* m; 4033 for(m=list; m; m=m->next) { 4034 if(m->list) { 4035 auth_free_master_addrs(m->list); 4036 m->list = NULL; 4037 } 4038 } 4039 } 4040 4041 /** copy a list of auth_addrs */ 4042 static struct auth_addr* 4043 auth_addr_list_copy(struct auth_addr* source) 4044 { 4045 struct auth_addr* list = NULL, *last = NULL; 4046 struct auth_addr* p; 4047 for(p=source; p; p=p->next) { 4048 struct auth_addr* a = (struct auth_addr*)memdup(p, sizeof(*p)); 4049 if(!a) { 4050 log_err("malloc failure"); 4051 auth_free_master_addrs(list); 4052 return NULL; 4053 } 4054 a->next = NULL; 4055 if(last) last->next = a; 4056 if(!list) list = a; 4057 last = a; 4058 } 4059 return list; 4060 } 4061 4062 /** copy a master to a new structure, NULL on alloc failure */ 4063 static struct auth_master* 4064 auth_master_copy(struct auth_master* o) 4065 { 4066 struct auth_master* m; 4067 if(!o) return NULL; 4068 m = (struct auth_master*)memdup(o, sizeof(*o)); 4069 if(!m) { 4070 log_err("malloc failure"); 4071 return NULL; 4072 } 4073 m->next = NULL; 4074 if(m->host) { 4075 m->host = strdup(m->host); 4076 if(!m->host) { 4077 free(m); 4078 log_err("malloc failure"); 4079 return NULL; 4080 } 4081 } 4082 if(m->file) { 4083 m->file = strdup(m->file); 4084 if(!m->file) { 4085 free(m->host); 4086 free(m); 4087 log_err("malloc failure"); 4088 return NULL; 4089 } 4090 } 4091 if(m->list) { 4092 m->list = auth_addr_list_copy(m->list); 4093 if(!m->list) { 4094 free(m->file); 4095 free(m->host); 4096 free(m); 4097 return NULL; 4098 } 4099 } 4100 return m; 4101 } 4102 4103 /** append the master to the copied list. */ 4104 static int 4105 auth_master_copy_and_append(struct auth_master* p, struct auth_master** list, 4106 struct auth_master** last) 4107 { 4108 struct auth_master* m = auth_master_copy(p); 4109 if(!m) { 4110 return 0; 4111 } 4112 m->next = NULL; 4113 if(*last) (*last)->next = m; 4114 if(!*list) *list = m; 4115 *last = m; 4116 return 1; 4117 } 4118 4119 /** copy the master addresses from the task_probe lookups to the allow_notify 4120 * list of masters */ 4121 static void 4122 probe_copy_masters_for_allow_notify(struct auth_xfer* xfr) 4123 { 4124 struct auth_master* list = NULL, *last = NULL; 4125 struct auth_master* p; 4126 /* build up new list with copies */ 4127 /* The list in task probe has been looked up before the list in 4128 * task transfer. */ 4129 for(p = xfr->task_probe->masters; p; p=p->next) { 4130 if(!auth_master_copy_and_append(p, &list, &last)) { 4131 auth_free_masters(list); 4132 /* failed because of malloc failure, use old list */ 4133 return; 4134 } 4135 } 4136 /* The list in task transfer also contains the http entries. */ 4137 for(p = xfr->task_transfer->masters; p; p=p->next) { 4138 /* Copy the http entries from this lookup. The allow_notify 4139 * entries are not looked up from this list. The other 4140 * ones are already in from the probe lookups. */ 4141 if(!p->http) 4142 continue; 4143 if(!auth_master_copy_and_append(p, &list, &last)) { 4144 auth_free_masters(list); 4145 /* failed because of malloc failure, use old list */ 4146 return; 4147 } 4148 } 4149 /* success, replace list */ 4150 auth_free_masters(xfr->allow_notify_list); 4151 xfr->allow_notify_list = list; 4152 } 4153 4154 /** start the lookups for task_transfer */ 4155 static void 4156 xfr_transfer_start_lookups(struct auth_xfer* xfr) 4157 { 4158 /* delete all the looked up addresses in the list */ 4159 xfr->task_transfer->scan_addr = NULL; 4160 xfr_masterlist_free_addrs(xfr->task_transfer->masters); 4161 4162 /* start lookup at the first master */ 4163 xfr->task_transfer->lookup_target = xfr->task_transfer->masters; 4164 xfr->task_transfer->lookup_aaaa = 0; 4165 } 4166 4167 /** move to the next lookup of hostname for task_transfer */ 4168 static void 4169 xfr_transfer_move_to_next_lookup(struct auth_xfer* xfr, struct module_env* env) 4170 { 4171 if(!xfr->task_transfer->lookup_target) 4172 return; /* already at end of list */ 4173 if(!xfr->task_transfer->lookup_aaaa && env->cfg->do_ip6) { 4174 /* move to lookup AAAA */ 4175 xfr->task_transfer->lookup_aaaa = 1; 4176 return; 4177 } 4178 xfr->task_transfer->lookup_target = 4179 xfr->task_transfer->lookup_target->next; 4180 xfr->task_transfer->lookup_aaaa = 0; 4181 if(!env->cfg->do_ip4 && xfr->task_transfer->lookup_target!=NULL) 4182 xfr->task_transfer->lookup_aaaa = 1; 4183 } 4184 4185 /** start the lookups for task_probe */ 4186 static void 4187 xfr_probe_start_lookups(struct auth_xfer* xfr) 4188 { 4189 /* delete all the looked up addresses in the list */ 4190 xfr->task_probe->scan_addr = NULL; 4191 xfr_masterlist_free_addrs(xfr->task_probe->masters); 4192 4193 /* start lookup at the first master */ 4194 xfr->task_probe->lookup_target = xfr->task_probe->masters; 4195 xfr->task_probe->lookup_aaaa = 0; 4196 } 4197 4198 /** move to the next lookup of hostname for task_probe */ 4199 static void 4200 xfr_probe_move_to_next_lookup(struct auth_xfer* xfr, struct module_env* env) 4201 { 4202 if(!xfr->task_probe->lookup_target) 4203 return; /* already at end of list */ 4204 if(!xfr->task_probe->lookup_aaaa && env->cfg->do_ip6) { 4205 /* move to lookup AAAA */ 4206 xfr->task_probe->lookup_aaaa = 1; 4207 return; 4208 } 4209 xfr->task_probe->lookup_target = xfr->task_probe->lookup_target->next; 4210 xfr->task_probe->lookup_aaaa = 0; 4211 if(!env->cfg->do_ip4 && xfr->task_probe->lookup_target!=NULL) 4212 xfr->task_probe->lookup_aaaa = 1; 4213 } 4214 4215 /** start the iteration of the task_transfer list of masters */ 4216 static void 4217 xfr_transfer_start_list(struct auth_xfer* xfr, struct auth_master* spec) 4218 { 4219 if(spec) { 4220 xfr->task_transfer->scan_specific = find_master_by_host( 4221 xfr->task_transfer->masters, spec->host); 4222 if(xfr->task_transfer->scan_specific) { 4223 xfr->task_transfer->scan_target = NULL; 4224 xfr->task_transfer->scan_addr = NULL; 4225 if(xfr->task_transfer->scan_specific->list) 4226 xfr->task_transfer->scan_addr = 4227 xfr->task_transfer->scan_specific->list; 4228 return; 4229 } 4230 } 4231 /* no specific (notified) host to scan */ 4232 xfr->task_transfer->scan_specific = NULL; 4233 xfr->task_transfer->scan_addr = NULL; 4234 /* pick up first scan target */ 4235 xfr->task_transfer->scan_target = xfr->task_transfer->masters; 4236 if(xfr->task_transfer->scan_target && xfr->task_transfer-> 4237 scan_target->list) 4238 xfr->task_transfer->scan_addr = 4239 xfr->task_transfer->scan_target->list; 4240 } 4241 4242 /** start the iteration of the task_probe list of masters */ 4243 static void 4244 xfr_probe_start_list(struct auth_xfer* xfr, struct auth_master* spec) 4245 { 4246 if(spec) { 4247 xfr->task_probe->scan_specific = find_master_by_host( 4248 xfr->task_probe->masters, spec->host); 4249 if(xfr->task_probe->scan_specific) { 4250 xfr->task_probe->scan_target = NULL; 4251 xfr->task_probe->scan_addr = NULL; 4252 if(xfr->task_probe->scan_specific->list) 4253 xfr->task_probe->scan_addr = 4254 xfr->task_probe->scan_specific->list; 4255 return; 4256 } 4257 } 4258 /* no specific (notified) host to scan */ 4259 xfr->task_probe->scan_specific = NULL; 4260 xfr->task_probe->scan_addr = NULL; 4261 /* pick up first scan target */ 4262 xfr->task_probe->scan_target = xfr->task_probe->masters; 4263 if(xfr->task_probe->scan_target && xfr->task_probe->scan_target->list) 4264 xfr->task_probe->scan_addr = 4265 xfr->task_probe->scan_target->list; 4266 } 4267 4268 /** pick up the master that is being scanned right now, task_transfer */ 4269 static struct auth_master* 4270 xfr_transfer_current_master(struct auth_xfer* xfr) 4271 { 4272 if(xfr->task_transfer->scan_specific) 4273 return xfr->task_transfer->scan_specific; 4274 return xfr->task_transfer->scan_target; 4275 } 4276 4277 /** pick up the master that is being scanned right now, task_probe */ 4278 static struct auth_master* 4279 xfr_probe_current_master(struct auth_xfer* xfr) 4280 { 4281 if(xfr->task_probe->scan_specific) 4282 return xfr->task_probe->scan_specific; 4283 return xfr->task_probe->scan_target; 4284 } 4285 4286 /** true if at end of list, task_transfer */ 4287 static int 4288 xfr_transfer_end_of_list(struct auth_xfer* xfr) 4289 { 4290 return !xfr->task_transfer->scan_specific && 4291 !xfr->task_transfer->scan_target; 4292 } 4293 4294 /** true if at end of list, task_probe */ 4295 static int 4296 xfr_probe_end_of_list(struct auth_xfer* xfr) 4297 { 4298 return !xfr->task_probe->scan_specific && !xfr->task_probe->scan_target; 4299 } 4300 4301 /** move to next master in list, task_transfer */ 4302 static void 4303 xfr_transfer_nextmaster(struct auth_xfer* xfr) 4304 { 4305 if(!xfr->task_transfer->scan_specific && 4306 !xfr->task_transfer->scan_target) 4307 return; 4308 if(xfr->task_transfer->scan_addr) { 4309 xfr->task_transfer->scan_addr = 4310 xfr->task_transfer->scan_addr->next; 4311 if(xfr->task_transfer->scan_addr) 4312 return; 4313 } 4314 if(xfr->task_transfer->scan_specific) { 4315 xfr->task_transfer->scan_specific = NULL; 4316 xfr->task_transfer->scan_target = xfr->task_transfer->masters; 4317 if(xfr->task_transfer->scan_target && xfr->task_transfer-> 4318 scan_target->list) 4319 xfr->task_transfer->scan_addr = 4320 xfr->task_transfer->scan_target->list; 4321 return; 4322 } 4323 if(!xfr->task_transfer->scan_target) 4324 return; 4325 xfr->task_transfer->scan_target = xfr->task_transfer->scan_target->next; 4326 if(xfr->task_transfer->scan_target && xfr->task_transfer-> 4327 scan_target->list) 4328 xfr->task_transfer->scan_addr = 4329 xfr->task_transfer->scan_target->list; 4330 return; 4331 } 4332 4333 /** move to next master in list, task_probe */ 4334 static void 4335 xfr_probe_nextmaster(struct auth_xfer* xfr) 4336 { 4337 if(!xfr->task_probe->scan_specific && !xfr->task_probe->scan_target) 4338 return; 4339 if(xfr->task_probe->scan_addr) { 4340 xfr->task_probe->scan_addr = xfr->task_probe->scan_addr->next; 4341 if(xfr->task_probe->scan_addr) 4342 return; 4343 } 4344 if(xfr->task_probe->scan_specific) { 4345 xfr->task_probe->scan_specific = NULL; 4346 xfr->task_probe->scan_target = xfr->task_probe->masters; 4347 if(xfr->task_probe->scan_target && xfr->task_probe-> 4348 scan_target->list) 4349 xfr->task_probe->scan_addr = 4350 xfr->task_probe->scan_target->list; 4351 return; 4352 } 4353 if(!xfr->task_probe->scan_target) 4354 return; 4355 xfr->task_probe->scan_target = xfr->task_probe->scan_target->next; 4356 if(xfr->task_probe->scan_target && xfr->task_probe-> 4357 scan_target->list) 4358 xfr->task_probe->scan_addr = 4359 xfr->task_probe->scan_target->list; 4360 return; 4361 } 4362 4363 /** create SOA probe packet for xfr */ 4364 static void 4365 xfr_create_soa_probe_packet(struct auth_xfer* xfr, sldns_buffer* buf, 4366 uint16_t id) 4367 { 4368 struct query_info qinfo; 4369 4370 memset(&qinfo, 0, sizeof(qinfo)); 4371 qinfo.qname = xfr->name; 4372 qinfo.qname_len = xfr->namelen; 4373 qinfo.qtype = LDNS_RR_TYPE_SOA; 4374 qinfo.qclass = xfr->dclass; 4375 qinfo_query_encode(buf, &qinfo); 4376 sldns_buffer_write_u16_at(buf, 0, id); 4377 } 4378 4379 /** create IXFR/AXFR packet for xfr */ 4380 static void 4381 xfr_create_ixfr_packet(struct auth_xfer* xfr, sldns_buffer* buf, uint16_t id, 4382 struct auth_master* master) 4383 { 4384 struct query_info qinfo; 4385 uint32_t serial; 4386 int have_zone, get_full = 0; 4387 have_zone = xfr->have_zone; 4388 serial = xfr->serial; 4389 4390 memset(&qinfo, 0, sizeof(qinfo)); 4391 qinfo.qname = xfr->name; 4392 qinfo.qname_len = xfr->namelen; 4393 xfr->task_transfer->got_xfr_serial = 0; 4394 xfr->task_transfer->rr_scan_num = 0; 4395 xfr->task_transfer->incoming_xfr_serial = 0; 4396 xfr->task_transfer->on_ixfr_is_axfr = 0; 4397 xfr->task_transfer->on_ixfr = 1; 4398 qinfo.qtype = LDNS_RR_TYPE_IXFR; 4399 if(xfr->num_ixfrs >= NUM_IXFR_BEFORE_AXFR && xfr->is_rpz) { 4400 /* For the RPZ, an IXFR is going to grow regions, and a 4401 * full transfer, zonefile read, AXFR and HTTP clear the 4402 * region, but IXFR does not. That memory keeps growing, 4403 * and getting a full transfer with AXFR here resets that. 4404 * The rpz->client_set->region, rpz->ns_set->region and 4405 * rpz->respip_set->region need to be reset, they are for 4406 * rpz-client-ip, rpz-nsip and rpz-ip. */ 4407 get_full = 1; 4408 } 4409 if(!have_zone || xfr->task_transfer->ixfr_fail || !master->ixfr 4410 || get_full) { 4411 qinfo.qtype = LDNS_RR_TYPE_AXFR; 4412 xfr->task_transfer->ixfr_fail = 0; 4413 xfr->task_transfer->on_ixfr = 0; 4414 } 4415 4416 qinfo.qclass = xfr->dclass; 4417 qinfo_query_encode(buf, &qinfo); 4418 sldns_buffer_write_u16_at(buf, 0, id); 4419 4420 /* append serial for IXFR */ 4421 if(qinfo.qtype == LDNS_RR_TYPE_IXFR) { 4422 size_t end = sldns_buffer_limit(buf); 4423 sldns_buffer_clear(buf); 4424 sldns_buffer_set_position(buf, end); 4425 /* auth section count 1 */ 4426 sldns_buffer_write_u16_at(buf, LDNS_NSCOUNT_OFF, 1); 4427 /* write SOA */ 4428 sldns_buffer_write_u8(buf, 0xC0); /* compressed ptr to qname */ 4429 sldns_buffer_write_u8(buf, 0x0C); 4430 sldns_buffer_write_u16(buf, LDNS_RR_TYPE_SOA); 4431 sldns_buffer_write_u16(buf, qinfo.qclass); 4432 sldns_buffer_write_u32(buf, 0); /* ttl */ 4433 sldns_buffer_write_u16(buf, 22); /* rdata length */ 4434 sldns_buffer_write_u8(buf, 0); /* . */ 4435 sldns_buffer_write_u8(buf, 0); /* . */ 4436 sldns_buffer_write_u32(buf, serial); /* serial */ 4437 sldns_buffer_write_u32(buf, 0); /* refresh */ 4438 sldns_buffer_write_u32(buf, 0); /* retry */ 4439 sldns_buffer_write_u32(buf, 0); /* expire */ 4440 sldns_buffer_write_u32(buf, 0); /* minimum */ 4441 sldns_buffer_flip(buf); 4442 } 4443 } 4444 4445 /** check if returned packet is OK */ 4446 static int 4447 check_packet_ok(sldns_buffer* pkt, uint16_t qtype, struct auth_xfer* xfr, 4448 uint32_t* serial) 4449 { 4450 /* parse to see if packet worked, valid reply */ 4451 4452 /* check serial number of SOA */ 4453 if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) 4454 return 0; 4455 4456 /* check ID */ 4457 if(LDNS_ID_WIRE(sldns_buffer_begin(pkt)) != xfr->task_probe->id) 4458 return 0; 4459 4460 /* check flag bits and rcode */ 4461 if(!LDNS_QR_WIRE(sldns_buffer_begin(pkt))) 4462 return 0; 4463 if(LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_QUERY) 4464 return 0; 4465 if(LDNS_RCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_RCODE_NOERROR) 4466 return 0; 4467 4468 /* check qname */ 4469 if(LDNS_QDCOUNT(sldns_buffer_begin(pkt)) != 1) 4470 return 0; 4471 sldns_buffer_skip(pkt, LDNS_HEADER_SIZE); 4472 if(sldns_buffer_remaining(pkt) < xfr->namelen) 4473 return 0; 4474 if(query_dname_compare(sldns_buffer_current(pkt), xfr->name) != 0) 4475 return 0; 4476 sldns_buffer_skip(pkt, (ssize_t)xfr->namelen); 4477 4478 /* check qtype, qclass */ 4479 if(sldns_buffer_remaining(pkt) < 4) 4480 return 0; 4481 if(sldns_buffer_read_u16(pkt) != qtype) 4482 return 0; 4483 if(sldns_buffer_read_u16(pkt) != xfr->dclass) 4484 return 0; 4485 4486 if(serial) { 4487 uint16_t rdlen; 4488 /* read serial number, from answer section SOA */ 4489 if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) == 0) 4490 return 0; 4491 /* read from first record SOA record */ 4492 if(sldns_buffer_remaining(pkt) < 1) 4493 return 0; 4494 if(dname_pkt_compare(pkt, sldns_buffer_current(pkt), 4495 xfr->name) != 0) 4496 return 0; 4497 if(!pkt_dname_len(pkt)) 4498 return 0; 4499 /* type, class, ttl, rdatalen */ 4500 if(sldns_buffer_remaining(pkt) < 4+4+2) 4501 return 0; 4502 if(sldns_buffer_read_u16(pkt) != qtype) 4503 return 0; 4504 if(sldns_buffer_read_u16(pkt) != xfr->dclass) 4505 return 0; 4506 sldns_buffer_skip(pkt, 4); /* ttl */ 4507 rdlen = sldns_buffer_read_u16(pkt); 4508 if(sldns_buffer_remaining(pkt) < rdlen) 4509 return 0; 4510 if(sldns_buffer_remaining(pkt) < 1) 4511 return 0; 4512 if(!pkt_dname_len(pkt)) /* soa name */ 4513 return 0; 4514 if(sldns_buffer_remaining(pkt) < 1) 4515 return 0; 4516 if(!pkt_dname_len(pkt)) /* soa name */ 4517 return 0; 4518 if(sldns_buffer_remaining(pkt) < 20) 4519 return 0; 4520 *serial = sldns_buffer_read_u32(pkt); 4521 } 4522 return 1; 4523 } 4524 4525 /** read one line from chunks into buffer at current position */ 4526 static int 4527 chunkline_get_line(struct auth_chunk** chunk, size_t* chunk_pos, 4528 sldns_buffer* buf) 4529 { 4530 int readsome = 0; 4531 while(*chunk) { 4532 /* more text in this chunk? */ 4533 if(*chunk_pos < (*chunk)->len) { 4534 readsome = 1; 4535 while(*chunk_pos < (*chunk)->len) { 4536 char c = (char)((*chunk)->data[*chunk_pos]); 4537 (*chunk_pos)++; 4538 if(sldns_buffer_remaining(buf) < 2) { 4539 /* buffer too short */ 4540 verbose(VERB_ALGO, "http chunkline, " 4541 "line too long"); 4542 return 0; 4543 } 4544 sldns_buffer_write_u8(buf, (uint8_t)c); 4545 if(c == '\n') { 4546 /* we are done */ 4547 return 1; 4548 } 4549 } 4550 } 4551 /* move to next chunk */ 4552 *chunk = (*chunk)->next; 4553 *chunk_pos = 0; 4554 } 4555 /* no more text */ 4556 if(readsome) return 1; 4557 return 0; 4558 } 4559 4560 /** count number of open and closed parenthesis in a chunkline */ 4561 int 4562 chunkline_count_parens(sldns_buffer* buf, size_t start) 4563 { 4564 size_t end = sldns_buffer_position(buf); 4565 size_t i; 4566 int count = 0; 4567 int dquote = 0; 4568 char prev_c = 0; 4569 for(i=start; i<end; i++) { 4570 char c = (char)sldns_buffer_read_u8_at(buf, i); 4571 if(dquote && !(c == '"' && prev_c != '\\')) { 4572 prev_c = (prev_c == '\\' && c == '\\') ? 0 : c; 4573 continue; 4574 } 4575 if(c == '"' && prev_c != '\\') 4576 dquote = !dquote; /* skip quoted part */ 4577 else if(c == '(' && prev_c != '\\') 4578 count ++; 4579 else if(c == ')' && prev_c != '\\') 4580 count --; 4581 else if(c == ';' && prev_c != '\\') { 4582 /* rest is a comment */ 4583 return count; 4584 } 4585 prev_c = (prev_c == '\\' && c == '\\') ? 0 : c; 4586 } 4587 return count; 4588 } 4589 4590 /** remove trailing ;... comment from a line in the chunkline buffer */ 4591 static void 4592 chunkline_remove_trailcomment(sldns_buffer* buf, size_t start) 4593 { 4594 size_t end = sldns_buffer_position(buf); 4595 size_t i; 4596 int dquote = 0; 4597 char prev_c = 0; 4598 for(i=start; i<end; i++) { 4599 char c = (char)sldns_buffer_read_u8_at(buf, i); 4600 if(dquote && !(c == '"' && prev_c != '\\')) { 4601 prev_c = (prev_c == '\\' && c == '\\') ? 0 : c; 4602 continue; 4603 } 4604 if(c == '"' && prev_c != '\\') 4605 dquote = !dquote; /* skip quoted part */ 4606 else if(c == ';' && prev_c != '\\') { 4607 /* rest is a comment */ 4608 sldns_buffer_set_position(buf, i); 4609 return; 4610 } 4611 prev_c = (prev_c == '\\' && c == '\\') ? 0 : c; 4612 } 4613 /* nothing to remove */ 4614 } 4615 4616 /** see if a chunkline is a comment line (or empty line) */ 4617 static int 4618 chunkline_is_comment_line_or_empty(sldns_buffer* buf) 4619 { 4620 size_t i, end = sldns_buffer_limit(buf); 4621 for(i=0; i<end; i++) { 4622 char c = (char)sldns_buffer_read_u8_at(buf, i); 4623 if(c == ';') 4624 return 1; /* comment */ 4625 else if(c != ' ' && c != '\t' && c != '\r' && c != '\n') 4626 return 0; /* not a comment */ 4627 } 4628 return 1; /* empty */ 4629 } 4630 4631 /** find a line with ( ) collated */ 4632 static int 4633 chunkline_get_line_collated(struct auth_chunk** chunk, size_t* chunk_pos, 4634 sldns_buffer* buf) 4635 { 4636 size_t pos; 4637 int parens = 0; 4638 sldns_buffer_clear(buf); 4639 pos = sldns_buffer_position(buf); 4640 if(!chunkline_get_line(chunk, chunk_pos, buf)) { 4641 if(sldns_buffer_position(buf) < sldns_buffer_limit(buf)) 4642 sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0); 4643 else sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf)-1, 0); 4644 sldns_buffer_flip(buf); 4645 return 0; 4646 } 4647 parens += chunkline_count_parens(buf, pos); 4648 while(parens > 0) { 4649 chunkline_remove_trailcomment(buf, pos); 4650 pos = sldns_buffer_position(buf); 4651 if(!chunkline_get_line(chunk, chunk_pos, buf)) { 4652 if(sldns_buffer_position(buf) < sldns_buffer_limit(buf)) 4653 sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0); 4654 else sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf)-1, 0); 4655 sldns_buffer_flip(buf); 4656 return 0; 4657 } 4658 parens += chunkline_count_parens(buf, pos); 4659 } 4660 4661 if(sldns_buffer_remaining(buf) < 1) { 4662 verbose(VERB_ALGO, "http chunkline: " 4663 "line too long"); 4664 return 0; 4665 } 4666 sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0); 4667 sldns_buffer_flip(buf); 4668 return 1; 4669 } 4670 4671 /** process $ORIGIN for http, 0 nothing, 1 done, 2 error */ 4672 static int 4673 http_parse_origin(sldns_buffer* buf, struct sldns_file_parse_state* pstate) 4674 { 4675 char* line = (char*)sldns_buffer_begin(buf); 4676 if(strncmp(line, "$ORIGIN", 7) == 0 && 4677 isspace((unsigned char)line[7])) { 4678 int s; 4679 pstate->origin_len = sizeof(pstate->origin); 4680 s = sldns_str2wire_dname_buf(sldns_strip_ws(line+8), 4681 pstate->origin, &pstate->origin_len); 4682 if(s) { 4683 pstate->origin_len = 0; 4684 return 2; 4685 } 4686 return 1; 4687 } 4688 return 0; 4689 } 4690 4691 /** process $TTL for http, 0 nothing, 1 done, 2 error */ 4692 static int 4693 http_parse_ttl(sldns_buffer* buf, struct sldns_file_parse_state* pstate) 4694 { 4695 char* line = (char*)sldns_buffer_begin(buf); 4696 if(strncmp(line, "$TTL", 4) == 0 && 4697 isspace((unsigned char)line[4])) { 4698 const char* end = NULL; 4699 int overflow = 0; 4700 pstate->default_ttl = sldns_str2period( 4701 sldns_strip_ws(line+5), &end, &overflow); 4702 if(overflow) { 4703 return 2; 4704 } 4705 return 1; 4706 } 4707 return 0; 4708 } 4709 4710 /** remove newlines from collated line */ 4711 static void 4712 chunkline_newline_removal(sldns_buffer* buf) 4713 { 4714 size_t i, end=sldns_buffer_limit(buf); 4715 for(i=0; i<end; i++) { 4716 char c = (char)sldns_buffer_read_u8_at(buf, i); 4717 if(c == '\n' && i==end-1) { 4718 sldns_buffer_write_u8_at(buf, i, 0); 4719 sldns_buffer_set_limit(buf, end-1); 4720 return; 4721 } 4722 if(c == '\n') 4723 sldns_buffer_write_u8_at(buf, i, (uint8_t)' '); 4724 } 4725 } 4726 4727 /** find noncomment RR line in chunks, collates lines if ( ) format */ 4728 static int 4729 chunkline_non_comment_RR(struct auth_chunk** chunk, size_t* chunk_pos, 4730 sldns_buffer* buf, struct sldns_file_parse_state* pstate) 4731 { 4732 int ret; 4733 while(chunkline_get_line_collated(chunk, chunk_pos, buf)) { 4734 chunkline_newline_removal(buf); 4735 if(chunkline_is_comment_line_or_empty(buf)) { 4736 /* a comment, go to next line */ 4737 continue; 4738 } 4739 if((ret=http_parse_origin(buf, pstate))!=0) { 4740 if(ret == 2) 4741 return 0; 4742 continue; /* $ORIGIN has been handled */ 4743 } 4744 if((ret=http_parse_ttl(buf, pstate))!=0) { 4745 if(ret == 2) 4746 return 0; 4747 continue; /* $TTL has been handled */ 4748 } 4749 return 1; 4750 } 4751 /* no noncomments, fail */ 4752 return 0; 4753 } 4754 4755 /** check syntax of chunklist zonefile, parse first RR, return false on 4756 * failure and return a string in the scratch buffer (first RR string) 4757 * on failure. */ 4758 static int 4759 http_zonefile_syntax_check(struct auth_xfer* xfr, sldns_buffer* buf) 4760 { 4761 uint8_t rr[LDNS_RR_BUF_SIZE]; 4762 size_t rr_len, dname_len = 0; 4763 struct sldns_file_parse_state pstate; 4764 struct auth_chunk* chunk; 4765 size_t chunk_pos; 4766 int e; 4767 memset(&pstate, 0, sizeof(pstate)); 4768 pstate.default_ttl = 3600; 4769 if(xfr->namelen < sizeof(pstate.origin)) { 4770 pstate.origin_len = xfr->namelen; 4771 memmove(pstate.origin, xfr->name, xfr->namelen); 4772 } 4773 chunk = xfr->task_transfer->chunks_first; 4774 chunk_pos = 0; 4775 if(!chunkline_non_comment_RR(&chunk, &chunk_pos, buf, &pstate)) { 4776 return 0; 4777 } 4778 rr_len = sizeof(rr); 4779 e=sldns_str2wire_rr_buf((char*)sldns_buffer_begin(buf), rr, &rr_len, 4780 &dname_len, pstate.default_ttl, 4781 pstate.origin_len?pstate.origin:NULL, pstate.origin_len, 4782 pstate.prev_rr_len?pstate.prev_rr:NULL, pstate.prev_rr_len); 4783 if(e != 0) { 4784 log_err("parse failure on first RR[%d]: %s", 4785 LDNS_WIREPARSE_OFFSET(e), 4786 sldns_get_errorstr_parse(LDNS_WIREPARSE_ERROR(e))); 4787 return 0; 4788 } 4789 /* check that class is correct */ 4790 if(sldns_wirerr_get_class(rr, rr_len, dname_len) != xfr->dclass) { 4791 log_err("parse failure: first record in downloaded zonefile " 4792 "from wrong RR class"); 4793 return 0; 4794 } 4795 return 1; 4796 } 4797 4798 /** sum sizes of chunklist */ 4799 static size_t 4800 chunklist_sum(struct auth_chunk* list) 4801 { 4802 struct auth_chunk* p; 4803 size_t s = 0; 4804 for(p=list; p; p=p->next) { 4805 s += p->len; 4806 } 4807 return s; 4808 } 4809 4810 /** for http download, parse and add RR to zone */ 4811 static int 4812 http_parse_add_rr(struct auth_xfer* xfr, struct auth_zone* z, 4813 sldns_buffer* buf, struct sldns_file_parse_state* pstate) 4814 { 4815 uint8_t rr[LDNS_RR_BUF_SIZE]; 4816 size_t rr_len, dname_len = 0; 4817 int e; 4818 char* line = (char*)sldns_buffer_begin(buf); 4819 rr_len = sizeof(rr); 4820 e = sldns_str2wire_rr_buf(line, rr, &rr_len, &dname_len, 4821 pstate->default_ttl, 4822 pstate->origin_len?pstate->origin:NULL, pstate->origin_len, 4823 pstate->prev_rr_len?pstate->prev_rr:NULL, pstate->prev_rr_len); 4824 if(e != 0) { 4825 log_err("%s/%s parse failure RR[%d]: %s in '%s'", 4826 xfr->task_transfer->master->host, 4827 xfr->task_transfer->master->file, 4828 LDNS_WIREPARSE_OFFSET(e), 4829 sldns_get_errorstr_parse(LDNS_WIREPARSE_ERROR(e)), 4830 line); 4831 return 0; 4832 } 4833 if(rr_len == 0) 4834 return 1; /* empty line or so */ 4835 4836 /* set prev */ 4837 if(dname_len < sizeof(pstate->prev_rr)) { 4838 memmove(pstate->prev_rr, rr, dname_len); 4839 pstate->prev_rr_len = dname_len; 4840 } 4841 4842 return az_insert_rr(z, rr, rr_len, dname_len, NULL); 4843 } 4844 4845 /** RR list iterator, returns RRs from answer section one by one from the 4846 * dns packets in the chunklist */ 4847 static void 4848 chunk_rrlist_start(struct auth_xfer* xfr, struct auth_chunk** rr_chunk, 4849 int* rr_num, size_t* rr_pos) 4850 { 4851 *rr_chunk = xfr->task_transfer->chunks_first; 4852 *rr_num = 0; 4853 *rr_pos = 0; 4854 } 4855 4856 /** RR list iterator, see if we are at the end of the list */ 4857 static int 4858 chunk_rrlist_end(struct auth_chunk* rr_chunk, int rr_num) 4859 { 4860 while(rr_chunk) { 4861 if(rr_chunk->len < LDNS_HEADER_SIZE) 4862 return 1; 4863 if(rr_num < (int)LDNS_ANCOUNT(rr_chunk->data)) 4864 return 0; 4865 /* no more RRs in this chunk */ 4866 /* continue with next chunk, see if it has RRs */ 4867 rr_chunk = rr_chunk->next; 4868 rr_num = 0; 4869 } 4870 return 1; 4871 } 4872 4873 /** RR list iterator, move to next RR */ 4874 static void 4875 chunk_rrlist_gonext(struct auth_chunk** rr_chunk, int* rr_num, 4876 size_t* rr_pos, size_t rr_nextpos) 4877 { 4878 /* already at end of chunks? */ 4879 if(!*rr_chunk) 4880 return; 4881 /* move within this chunk */ 4882 if((*rr_chunk)->len >= LDNS_HEADER_SIZE && 4883 (*rr_num)+1 < (int)LDNS_ANCOUNT((*rr_chunk)->data)) { 4884 (*rr_num) += 1; 4885 *rr_pos = rr_nextpos; 4886 return; 4887 } 4888 /* no more RRs in this chunk */ 4889 /* continue with next chunk, see if it has RRs */ 4890 if(*rr_chunk) 4891 *rr_chunk = (*rr_chunk)->next; 4892 while(*rr_chunk) { 4893 *rr_num = 0; 4894 *rr_pos = 0; 4895 if((*rr_chunk)->len >= LDNS_HEADER_SIZE && 4896 LDNS_ANCOUNT((*rr_chunk)->data) > 0) { 4897 return; 4898 } 4899 *rr_chunk = (*rr_chunk)->next; 4900 } 4901 } 4902 4903 /** RR iterator, get current RR information, false on parse error */ 4904 static int 4905 chunk_rrlist_get_current(struct auth_chunk* rr_chunk, int rr_num, 4906 size_t rr_pos, uint8_t** rr_dname, uint16_t* rr_type, 4907 uint16_t* rr_class, uint32_t* rr_ttl, uint16_t* rr_rdlen, 4908 uint8_t** rr_rdata, size_t* rr_nextpos) 4909 { 4910 sldns_buffer pkt; 4911 /* integrity checks on position */ 4912 if(!rr_chunk) return 0; 4913 if(rr_chunk->len < LDNS_HEADER_SIZE) return 0; 4914 if(rr_num >= (int)LDNS_ANCOUNT(rr_chunk->data)) return 0; 4915 if(rr_pos >= rr_chunk->len) return 0; 4916 4917 /* fetch rr information */ 4918 sldns_buffer_init_frm_data(&pkt, rr_chunk->data, rr_chunk->len); 4919 if(rr_pos == 0) { 4920 size_t i; 4921 /* skip question section */ 4922 sldns_buffer_set_position(&pkt, LDNS_HEADER_SIZE); 4923 for(i=0; i<LDNS_QDCOUNT(rr_chunk->data); i++) { 4924 if(pkt_dname_len(&pkt) == 0) return 0; 4925 if(sldns_buffer_remaining(&pkt) < 4) return 0; 4926 sldns_buffer_skip(&pkt, 4); /* type and class */ 4927 } 4928 } else { 4929 sldns_buffer_set_position(&pkt, rr_pos); 4930 } 4931 *rr_dname = sldns_buffer_current(&pkt); 4932 if(pkt_dname_len(&pkt) == 0) return 0; 4933 if(sldns_buffer_remaining(&pkt) < 10) return 0; 4934 *rr_type = sldns_buffer_read_u16(&pkt); 4935 *rr_class = sldns_buffer_read_u16(&pkt); 4936 *rr_ttl = sldns_buffer_read_u32(&pkt); 4937 *rr_rdlen = sldns_buffer_read_u16(&pkt); 4938 if(sldns_buffer_remaining(&pkt) < (*rr_rdlen)) return 0; 4939 *rr_rdata = sldns_buffer_current(&pkt); 4940 sldns_buffer_skip(&pkt, (ssize_t)(*rr_rdlen)); 4941 *rr_nextpos = sldns_buffer_position(&pkt); 4942 return 1; 4943 } 4944 4945 /** print log message where we are in parsing the zone transfer */ 4946 static void 4947 log_rrlist_position(const char* label, struct auth_chunk* rr_chunk, 4948 uint8_t* rr_dname, uint16_t rr_type, size_t rr_counter) 4949 { 4950 sldns_buffer pkt; 4951 size_t dlen; 4952 uint8_t buf[LDNS_MAX_DOMAINLEN]; 4953 char str[LDNS_MAX_DOMAINLEN]; 4954 char typestr[32]; 4955 sldns_buffer_init_frm_data(&pkt, rr_chunk->data, rr_chunk->len); 4956 sldns_buffer_set_position(&pkt, (size_t)(rr_dname - 4957 sldns_buffer_begin(&pkt))); 4958 if((dlen=pkt_dname_len(&pkt)) == 0) return; 4959 if(dlen >= sizeof(buf)) return; 4960 dname_pkt_copy(&pkt, buf, rr_dname); 4961 dname_str(buf, str); 4962 (void)sldns_wire2str_type_buf(rr_type, typestr, sizeof(typestr)); 4963 verbose(VERB_ALGO, "%s at[%d] %s %s", label, (int)rr_counter, 4964 str, typestr); 4965 } 4966 4967 /** check that start serial is OK for ixfr. we are at rr_counter == 0, 4968 * and we are going to check rr_counter == 1 (has to be type SOA) serial */ 4969 static int 4970 ixfr_start_serial(struct auth_chunk* rr_chunk, int rr_num, size_t rr_pos, 4971 uint8_t* rr_dname, uint16_t rr_type, uint16_t rr_class, 4972 uint32_t rr_ttl, uint16_t rr_rdlen, uint8_t* rr_rdata, 4973 size_t rr_nextpos, uint32_t transfer_serial, uint32_t xfr_serial) 4974 { 4975 uint32_t startserial; 4976 /* move forward on RR */ 4977 chunk_rrlist_gonext(&rr_chunk, &rr_num, &rr_pos, rr_nextpos); 4978 if(chunk_rrlist_end(rr_chunk, rr_num)) { 4979 /* no second SOA */ 4980 verbose(VERB_OPS, "IXFR has no second SOA record"); 4981 return 0; 4982 } 4983 if(!chunk_rrlist_get_current(rr_chunk, rr_num, rr_pos, 4984 &rr_dname, &rr_type, &rr_class, &rr_ttl, &rr_rdlen, 4985 &rr_rdata, &rr_nextpos)) { 4986 verbose(VERB_OPS, "IXFR cannot parse second SOA record"); 4987 /* failed to parse RR */ 4988 return 0; 4989 } 4990 if(rr_type != LDNS_RR_TYPE_SOA) { 4991 verbose(VERB_OPS, "IXFR second record is not type SOA"); 4992 return 0; 4993 } 4994 if(rr_rdlen < 22) { 4995 verbose(VERB_OPS, "IXFR, second SOA has short rdlength"); 4996 return 0; /* bad SOA rdlen */ 4997 } 4998 startserial = sldns_read_uint32(rr_rdata+rr_rdlen-20); 4999 if(startserial == transfer_serial) { 5000 /* empty AXFR, not an IXFR */ 5001 verbose(VERB_OPS, "IXFR second serial same as first"); 5002 return 0; 5003 } 5004 if(startserial != xfr_serial) { 5005 /* wrong start serial, it does not match the serial in 5006 * memory */ 5007 verbose(VERB_OPS, "IXFR is from serial %u to %u but %u " 5008 "in memory, rejecting the zone transfer", 5009 (unsigned)startserial, (unsigned)transfer_serial, 5010 (unsigned)xfr_serial); 5011 return 0; 5012 } 5013 /* everything OK in second SOA serial */ 5014 return 1; 5015 } 5016 5017 /** apply IXFR to zone in memory. z is locked. false on failure(mallocfail) */ 5018 static int 5019 apply_ixfr(struct auth_xfer* xfr, struct auth_zone* z, 5020 struct sldns_buffer* scratch_buffer) 5021 { 5022 struct auth_chunk* rr_chunk; 5023 int rr_num; 5024 size_t rr_pos; 5025 uint8_t* rr_dname, *rr_rdata; 5026 uint16_t rr_type, rr_class, rr_rdlen; 5027 uint32_t rr_ttl; 5028 size_t rr_nextpos; 5029 int have_transfer_serial = 0; 5030 uint32_t transfer_serial = 0; 5031 size_t rr_counter = 0; 5032 int delmode = 0; 5033 int softfail = 0; 5034 5035 xfr->num_ixfrs++; 5036 5037 /* start RR iterator over chunklist of packets */ 5038 chunk_rrlist_start(xfr, &rr_chunk, &rr_num, &rr_pos); 5039 while(!chunk_rrlist_end(rr_chunk, rr_num)) { 5040 if(!chunk_rrlist_get_current(rr_chunk, rr_num, rr_pos, 5041 &rr_dname, &rr_type, &rr_class, &rr_ttl, &rr_rdlen, 5042 &rr_rdata, &rr_nextpos)) { 5043 /* failed to parse RR */ 5044 return 0; 5045 } 5046 if(verbosity>=7) log_rrlist_position("apply ixfr", 5047 rr_chunk, rr_dname, rr_type, rr_counter); 5048 /* twiddle add/del mode and check for start and end */ 5049 if(rr_counter == 0 && rr_type != LDNS_RR_TYPE_SOA) 5050 return 0; 5051 if(rr_counter == 1 && rr_type != LDNS_RR_TYPE_SOA) { 5052 /* this is an AXFR returned from the IXFR master */ 5053 /* but that should already have been detected, by 5054 * on_ixfr_is_axfr */ 5055 return 0; 5056 } 5057 if(rr_type == LDNS_RR_TYPE_SOA) { 5058 uint32_t serial; 5059 if(rr_rdlen < 22) return 0; /* bad SOA rdlen */ 5060 serial = sldns_read_uint32(rr_rdata+rr_rdlen-20); 5061 if(have_transfer_serial == 0) { 5062 have_transfer_serial = 1; 5063 transfer_serial = serial; 5064 delmode = 1; /* gets negated below */ 5065 /* check second RR before going any further */ 5066 if(!ixfr_start_serial(rr_chunk, rr_num, rr_pos, 5067 rr_dname, rr_type, rr_class, rr_ttl, 5068 rr_rdlen, rr_rdata, rr_nextpos, 5069 transfer_serial, xfr->serial)) { 5070 return 0; 5071 } 5072 } else if(transfer_serial == serial) { 5073 have_transfer_serial++; 5074 if(rr_counter == 1) { 5075 /* empty AXFR, with SOA; SOA; */ 5076 /* should have been detected by 5077 * on_ixfr_is_axfr */ 5078 return 0; 5079 } 5080 if(have_transfer_serial == 3) { 5081 /* see serial three times for end */ 5082 /* eg. IXFR: 5083 * SOA 3 start 5084 * SOA 1 second RR, followed by del 5085 * SOA 2 followed by add 5086 * SOA 2 followed by del 5087 * SOA 3 followed by add 5088 * SOA 3 end */ 5089 /* ended by SOA record */ 5090 xfr->serial = transfer_serial; 5091 break; 5092 } 5093 } 5094 /* twiddle add/del mode */ 5095 /* switch from delete part to add part and back again 5096 * just before the soa, it gets deleted and added too 5097 * this means we switch to delete mode for the final 5098 * SOA(so skip that one) */ 5099 delmode = !delmode; 5100 } 5101 /* process this RR */ 5102 /* if the RR is deleted twice or added twice, then we 5103 * softfail, and continue with the rest of the IXFR, so 5104 * that we serve something fairly nice during the refetch */ 5105 if(verbosity>=7) log_rrlist_position((delmode?"del":"add"), 5106 rr_chunk, rr_dname, rr_type, rr_counter); 5107 if(delmode) { 5108 /* delete this RR */ 5109 int nonexist = 0; 5110 if(!az_remove_rr_decompress(z, rr_chunk->data, 5111 rr_chunk->len, scratch_buffer, rr_dname, 5112 rr_type, rr_class, rr_ttl, rr_rdata, rr_rdlen, 5113 &nonexist)) { 5114 /* failed, malloc error or so */ 5115 return 0; 5116 } 5117 if(nonexist) { 5118 /* it was removal of a nonexisting RR */ 5119 if(verbosity>=4) log_rrlist_position( 5120 "IXFR error nonexistent RR", 5121 rr_chunk, rr_dname, rr_type, rr_counter); 5122 softfail = 1; 5123 } 5124 } else if(rr_counter != 0) { 5125 /* skip first SOA RR for addition, it is added in 5126 * the addition part near the end of the ixfr, when 5127 * that serial is seen the second time. */ 5128 int duplicate = 0; 5129 /* add this RR */ 5130 if(!az_insert_rr_decompress(z, rr_chunk->data, 5131 rr_chunk->len, scratch_buffer, rr_dname, 5132 rr_type, rr_class, rr_ttl, rr_rdata, rr_rdlen, 5133 &duplicate)) { 5134 /* failed, malloc error or so */ 5135 return 0; 5136 } 5137 if(duplicate) { 5138 /* it was a duplicate */ 5139 if(verbosity>=4) log_rrlist_position( 5140 "IXFR error duplicate RR", 5141 rr_chunk, rr_dname, rr_type, rr_counter); 5142 softfail = 1; 5143 } 5144 } 5145 5146 rr_counter++; 5147 chunk_rrlist_gonext(&rr_chunk, &rr_num, &rr_pos, rr_nextpos); 5148 } 5149 if(softfail) { 5150 verbose(VERB_ALGO, "IXFR did not apply cleanly, fetching full zone"); 5151 return 0; 5152 } 5153 return 1; 5154 } 5155 5156 /** apply AXFR to zone in memory. z is locked. false on failure(mallocfail) */ 5157 static int 5158 apply_axfr(struct auth_xfer* xfr, struct auth_zone* z, 5159 struct sldns_buffer* scratch_buffer) 5160 { 5161 struct auth_chunk* rr_chunk; 5162 int rr_num; 5163 size_t rr_pos; 5164 uint8_t* rr_dname, *rr_rdata; 5165 uint16_t rr_type, rr_class, rr_rdlen; 5166 uint32_t rr_ttl; 5167 uint32_t serial = 0; 5168 size_t rr_nextpos; 5169 size_t rr_counter = 0; 5170 int have_end_soa = 0; 5171 5172 auth_zone_clear_data(z); 5173 xfr->have_zone = 0; 5174 xfr->serial = 0; 5175 xfr->soa_zone_acquired = 0; 5176 xfr->num_ixfrs = 0; 5177 5178 /* insert all RRs in to the zone */ 5179 /* insert the SOA only once, skip the last one */ 5180 /* start RR iterator over chunklist of packets */ 5181 chunk_rrlist_start(xfr, &rr_chunk, &rr_num, &rr_pos); 5182 while(!chunk_rrlist_end(rr_chunk, rr_num)) { 5183 if(!chunk_rrlist_get_current(rr_chunk, rr_num, rr_pos, 5184 &rr_dname, &rr_type, &rr_class, &rr_ttl, &rr_rdlen, 5185 &rr_rdata, &rr_nextpos)) { 5186 /* failed to parse RR */ 5187 return 0; 5188 } 5189 if(verbosity>=7) log_rrlist_position("apply_axfr", 5190 rr_chunk, rr_dname, rr_type, rr_counter); 5191 if(rr_type == LDNS_RR_TYPE_SOA) { 5192 if(rr_counter != 0) { 5193 /* end of the axfr */ 5194 have_end_soa = 1; 5195 break; 5196 } 5197 if(rr_rdlen < 22) return 0; /* bad SOA rdlen */ 5198 serial = sldns_read_uint32(rr_rdata+rr_rdlen-20); 5199 } 5200 5201 /* add this RR */ 5202 if(!az_insert_rr_decompress(z, rr_chunk->data, rr_chunk->len, 5203 scratch_buffer, rr_dname, rr_type, rr_class, rr_ttl, 5204 rr_rdata, rr_rdlen, NULL)) { 5205 /* failed, malloc error or so */ 5206 return 0; 5207 } 5208 5209 rr_counter++; 5210 chunk_rrlist_gonext(&rr_chunk, &rr_num, &rr_pos, rr_nextpos); 5211 } 5212 if(!have_end_soa) { 5213 log_err("no end SOA record for AXFR"); 5214 return 0; 5215 } 5216 5217 xfr->serial = serial; 5218 xfr->have_zone = 1; 5219 return 1; 5220 } 5221 5222 /** apply HTTP to zone in memory. z is locked. false on failure(mallocfail) */ 5223 static int 5224 apply_http(struct auth_xfer* xfr, struct auth_zone* z, 5225 struct sldns_buffer* scratch_buffer) 5226 { 5227 /* parse data in chunks */ 5228 /* parse RR's and read into memory. ignore $INCLUDE from the 5229 * downloaded file*/ 5230 struct sldns_file_parse_state pstate; 5231 struct auth_chunk* chunk; 5232 size_t chunk_pos; 5233 int ret; 5234 memset(&pstate, 0, sizeof(pstate)); 5235 pstate.default_ttl = 3600; 5236 if(xfr->namelen < sizeof(pstate.origin)) { 5237 pstate.origin_len = xfr->namelen; 5238 memmove(pstate.origin, xfr->name, xfr->namelen); 5239 } 5240 5241 if(verbosity >= VERB_ALGO) 5242 verbose(VERB_ALGO, "http download %s of size %d", 5243 xfr->task_transfer->master->file, 5244 (int)chunklist_sum(xfr->task_transfer->chunks_first)); 5245 if(xfr->task_transfer->chunks_first && verbosity >= VERB_ALGO) { 5246 char preview[1024]; 5247 if(xfr->task_transfer->chunks_first->len+1 > sizeof(preview)) { 5248 memmove(preview, xfr->task_transfer->chunks_first->data, 5249 sizeof(preview)-1); 5250 preview[sizeof(preview)-1]=0; 5251 } else { 5252 memmove(preview, xfr->task_transfer->chunks_first->data, 5253 xfr->task_transfer->chunks_first->len); 5254 preview[xfr->task_transfer->chunks_first->len]=0; 5255 } 5256 log_info("auth zone http downloaded content preview: %s", 5257 preview); 5258 } 5259 5260 /* perhaps a little syntax check before we try to apply the data? */ 5261 if(!http_zonefile_syntax_check(xfr, scratch_buffer)) { 5262 log_err("http download %s/%s does not contain a zonefile, " 5263 "but got '%s'", xfr->task_transfer->master->host, 5264 xfr->task_transfer->master->file, 5265 sldns_buffer_begin(scratch_buffer)); 5266 return 0; 5267 } 5268 5269 auth_zone_clear_data(z); 5270 xfr->have_zone = 0; 5271 xfr->serial = 0; 5272 xfr->soa_zone_acquired = 0; 5273 xfr->num_ixfrs = 0; 5274 5275 chunk = xfr->task_transfer->chunks_first; 5276 chunk_pos = 0; 5277 pstate.lineno = 0; 5278 while(chunkline_get_line_collated(&chunk, &chunk_pos, scratch_buffer)) { 5279 /* process this line */ 5280 pstate.lineno++; 5281 chunkline_newline_removal(scratch_buffer); 5282 if(chunkline_is_comment_line_or_empty(scratch_buffer)) { 5283 continue; 5284 } 5285 /* parse line and add RR */ 5286 if((ret=http_parse_origin(scratch_buffer, &pstate))!=0) { 5287 if(ret == 2) { 5288 verbose(VERB_ALGO, "error parsing ORIGIN on line [%s:%d] %s", 5289 xfr->task_transfer->master->file, 5290 pstate.lineno, 5291 sldns_buffer_begin(scratch_buffer)); 5292 return 0; 5293 } 5294 continue; /* $ORIGIN has been handled */ 5295 } 5296 if((ret=http_parse_ttl(scratch_buffer, &pstate))!=0) { 5297 if(ret == 2) { 5298 verbose(VERB_ALGO, "error parsing TTL on line [%s:%d] %s", 5299 xfr->task_transfer->master->file, 5300 pstate.lineno, 5301 sldns_buffer_begin(scratch_buffer)); 5302 return 0; 5303 } 5304 continue; /* $TTL has been handled */ 5305 } 5306 if(!http_parse_add_rr(xfr, z, scratch_buffer, &pstate)) { 5307 verbose(VERB_ALGO, "error parsing line [%s:%d] %s", 5308 xfr->task_transfer->master->file, 5309 pstate.lineno, 5310 sldns_buffer_begin(scratch_buffer)); 5311 return 0; 5312 } 5313 } 5314 return 1; 5315 } 5316 5317 /** write http chunks to zonefile to create downloaded file */ 5318 static int 5319 auth_zone_write_chunks(struct auth_chunk* chunk_list, const char* fname) 5320 { 5321 FILE* out; 5322 struct auth_chunk* p; 5323 out = fopen(fname, "w"); 5324 if(!out) { 5325 log_err("could not open %s: %s", fname, strerror(errno)); 5326 return 0; 5327 } 5328 for(p = chunk_list; p ; p = p->next) { 5329 if(!write_out(out, (char*)p->data, p->len)) { 5330 log_err("could not write http download to %s", fname); 5331 fclose(out); 5332 return 0; 5333 } 5334 } 5335 fclose(out); 5336 return 1; 5337 } 5338 5339 /** write to zonefile after zone has been updated, z has rdlock by caller. */ 5340 static void 5341 zone_write_after_update(struct auth_zone* z, struct module_env* env, 5342 struct auth_chunk* chunk_list) 5343 { 5344 struct config_file* cfg = env->cfg; 5345 char tmpfile[1024]; 5346 char* zfilename; 5347 5348 if(z->zonefile == NULL || z->zonefile[0] == 0) { 5349 /* no write needed, no zonefile set */ 5350 auth_chunk_list_delete(chunk_list); 5351 return; 5352 } 5353 zfilename = z->zonefile; 5354 if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(zfilename, 5355 cfg->chrootdir, strlen(cfg->chrootdir)) == 0) 5356 zfilename += strlen(cfg->chrootdir); 5357 if(verbosity >= VERB_ALGO) { 5358 char nm[LDNS_MAX_DOMAINLEN]; 5359 dname_str(z->name, nm); 5360 verbose(VERB_ALGO, "write zonefile %s for %s", zfilename, nm); 5361 } 5362 5363 /* write to tempfile first */ 5364 if((size_t)strlen(zfilename) + 16 > sizeof(tmpfile)) { 5365 verbose(VERB_ALGO, "tmpfilename too long, cannot update " 5366 " zonefile %s", zfilename); 5367 auth_chunk_list_delete(chunk_list); 5368 return; 5369 } 5370 snprintf(tmpfile, sizeof(tmpfile), "%s.tmp%u", zfilename, 5371 (unsigned)getpid()); 5372 if(chunk_list) { 5373 /* use the stored chunk list to write them */ 5374 if(!auth_zone_write_chunks(chunk_list, tmpfile)) { 5375 unlink(tmpfile); 5376 auth_chunk_list_delete(chunk_list); 5377 return; 5378 } 5379 auth_chunk_list_delete(chunk_list); 5380 } else if(!auth_zone_write_file(z, tmpfile)) { 5381 unlink(tmpfile); 5382 return; 5383 } 5384 #ifdef UB_ON_WINDOWS 5385 (void)unlink(zfilename); /* windows does not replace file with rename() */ 5386 #endif 5387 if(rename(tmpfile, zfilename) < 0) { 5388 log_err("could not rename(%s, %s): %s", tmpfile, zfilename, 5389 strerror(errno)); 5390 unlink(tmpfile); 5391 return; 5392 } 5393 } 5394 5395 /** write to zonefile after zone has updated, reacquires z readlock. */ 5396 static void 5397 zone_write_after_update_reacq(uint8_t* bakname, size_t baknamelen, 5398 uint16_t bakdclass, struct module_env* env, 5399 struct auth_chunk* chunk_list) 5400 { 5401 struct auth_zone* z; 5402 /* get lock again, so it is a readlock and concurrently queries 5403 * can be answered */ 5404 lock_rw_rdlock(&env->auth_zones->lock); 5405 z = auth_zone_find(env->auth_zones, bakname, baknamelen, bakdclass); 5406 if(!z) { 5407 lock_rw_unlock(&env->auth_zones->lock); 5408 /* the zone is gone, ignore xfr results */ 5409 return; 5410 } 5411 lock_rw_rdlock(&z->lock); 5412 lock_rw_unlock(&env->auth_zones->lock); 5413 5414 zone_write_after_update(z, env, chunk_list); 5415 lock_rw_unlock(&z->lock); 5416 } 5417 5418 /** write to zonefile after zone has been updated */ 5419 static void 5420 xfr_write_after_update(struct auth_xfer* xfr, struct module_env* env, 5421 struct auth_chunk* chunk_list) 5422 { 5423 struct auth_zone* z; 5424 lock_basic_unlock(&xfr->lock); 5425 5426 /* get lock again, so it is a readlock and concurrently queries 5427 * can be answered */ 5428 lock_rw_rdlock(&env->auth_zones->lock); 5429 z = auth_zone_find(env->auth_zones, xfr->name, xfr->namelen, 5430 xfr->dclass); 5431 if(!z) { 5432 lock_rw_unlock(&env->auth_zones->lock); 5433 /* the zone is gone, ignore xfr results */ 5434 lock_basic_lock(&xfr->lock); 5435 return; 5436 } 5437 lock_rw_rdlock(&z->lock); 5438 lock_basic_lock(&xfr->lock); 5439 lock_rw_unlock(&env->auth_zones->lock); 5440 5441 zone_write_after_update(z, env, chunk_list); 5442 lock_rw_unlock(&z->lock); 5443 } 5444 5445 /** reacquire locks and structures. Starts with no locks, ends 5446 * with xfr and z locks, if fail, no z lock */ 5447 static int xfr_process_reacquire_locks(struct auth_xfer* xfr, 5448 struct module_env* env, struct auth_zone** z) 5449 { 5450 /* release xfr lock, then, while holding az->lock grab both 5451 * z->lock and xfr->lock */ 5452 lock_rw_rdlock(&env->auth_zones->lock); 5453 *z = auth_zone_find(env->auth_zones, xfr->name, xfr->namelen, 5454 xfr->dclass); 5455 if(!*z) { 5456 lock_rw_unlock(&env->auth_zones->lock); 5457 lock_basic_lock(&xfr->lock); 5458 *z = NULL; 5459 return 0; 5460 } 5461 lock_rw_wrlock(&(*z)->lock); 5462 lock_basic_lock(&xfr->lock); 5463 lock_rw_unlock(&env->auth_zones->lock); 5464 return 1; 5465 } 5466 5467 /** process chunk list and update zone in memory, 5468 * return false if it did not work */ 5469 static int 5470 xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env, 5471 int* ixfr_fail) 5472 { 5473 struct auth_zone* z; 5474 int zonemd_in_progress; 5475 struct auth_chunk* current_chunk_list = NULL; 5476 5477 /* obtain locks and structures */ 5478 lock_basic_unlock(&xfr->lock); 5479 if(!xfr_process_reacquire_locks(xfr, env, &z)) { 5480 /* the zone is gone, ignore xfr results */ 5481 return 0; 5482 } 5483 /* holding xfr and z locks */ 5484 5485 /* apply data */ 5486 if(xfr->task_transfer->master->http) { 5487 if(!apply_http(xfr, z, env->scratch_buffer)) { 5488 auth_zone_clear_data(z); 5489 lock_rw_unlock(&z->lock); 5490 verbose(VERB_ALGO, "http from %s: could not store data", 5491 xfr->task_transfer->master->host); 5492 return 0; 5493 } 5494 } else if(xfr->task_transfer->on_ixfr && 5495 !xfr->task_transfer->on_ixfr_is_axfr) { 5496 if(!apply_ixfr(xfr, z, env->scratch_buffer)) { 5497 auth_zone_clear_data(z); 5498 lock_rw_unlock(&z->lock); 5499 verbose(VERB_ALGO, "xfr from %s: could not store IXFR" 5500 " data", xfr->task_transfer->master->host); 5501 *ixfr_fail = 1; 5502 return 0; 5503 } 5504 } else { 5505 if(!apply_axfr(xfr, z, env->scratch_buffer)) { 5506 auth_zone_clear_data(z); 5507 lock_rw_unlock(&z->lock); 5508 verbose(VERB_ALGO, "xfr from %s: could not store AXFR" 5509 " data", xfr->task_transfer->master->host); 5510 return 0; 5511 } 5512 } 5513 xfr->zone_expired = 0; 5514 z->zone_expired = 0; 5515 if(!xfr_find_soa(z, xfr)) { 5516 lock_rw_unlock(&z->lock); 5517 verbose(VERB_ALGO, "xfr from %s: no SOA in zone after update" 5518 " (or malformed RR)", xfr->task_transfer->master->host); 5519 return 0; 5520 } 5521 z->soa_zone_acquired = *env->now; 5522 xfr->soa_zone_acquired = *env->now; 5523 xfr->is_rpz = (z->rpz!=NULL); 5524 5525 /* release xfr lock while verifying zonemd because it may have 5526 * to spawn lookups in the state machines */ 5527 lock_basic_unlock(&xfr->lock); 5528 /* holding z lock */ 5529 auth_zone_verify_zonemd(z, env, &env->mesh->mods, NULL, 0, 0); 5530 if(z->zone_expired) { 5531 char zname[LDNS_MAX_DOMAINLEN]; 5532 /* ZONEMD must have failed */ 5533 /* reacquire locks, so we hold xfr lock on exit of routine, 5534 * and both xfr and z again after releasing xfr for potential 5535 * state machine mesh callbacks */ 5536 lock_rw_unlock(&z->lock); 5537 if(!xfr_process_reacquire_locks(xfr, env, &z)) 5538 return 0; 5539 dname_str(xfr->name, zname); 5540 verbose(VERB_ALGO, "xfr from %s: ZONEMD failed for %s, transfer is failed", xfr->task_transfer->master->host, zname); 5541 xfr->zone_expired = 1; 5542 lock_rw_unlock(&z->lock); 5543 return 0; 5544 } 5545 /* reacquire locks, so we hold xfr lock on exit of routine, 5546 * and both xfr and z again after releasing xfr for potential 5547 * state machine mesh callbacks */ 5548 lock_rw_unlock(&z->lock); 5549 if(!xfr_process_reacquire_locks(xfr, env, &z)) 5550 return 0; 5551 /* holding xfr and z locks */ 5552 5553 if(xfr->have_zone) 5554 xfr->lease_time = *env->now; 5555 5556 if(z->rpz) 5557 rpz_finish_config(z->rpz); 5558 5559 if(z->zonemd_check && z->zonemd_callback_env) { 5560 zonemd_in_progress = 1; 5561 z->zonemd_callback_perform_write = 1; 5562 auth_chunk_list_delete(z->perform_write_chunk_list); 5563 z->perform_write_chunk_list = NULL; 5564 if(xfr->task_transfer->master->http) { 5565 z->perform_write_chunk_list = xfr->task_transfer->chunks_first; 5566 xfr->task_transfer->chunks_first = NULL; 5567 auth_chunks_delete(xfr->task_transfer); 5568 } 5569 } else { 5570 zonemd_in_progress = 0; 5571 z->zonemd_callback_perform_write = 0; 5572 if(xfr->task_transfer->master->http) { 5573 current_chunk_list = xfr->task_transfer->chunks_first; 5574 xfr->task_transfer->chunks_first = NULL; 5575 auth_chunks_delete(xfr->task_transfer); 5576 } 5577 } 5578 /* unlock */ 5579 lock_rw_unlock(&z->lock); 5580 5581 if(verbosity >= VERB_QUERY && xfr->have_zone) { 5582 char zname[LDNS_MAX_DOMAINLEN]; 5583 dname_str(xfr->name, zname); 5584 verbose(VERB_QUERY, "auth zone %s updated to serial %u", zname, 5585 (unsigned)xfr->serial); 5586 } 5587 /* see if we need to write to a zonefile */ 5588 if(!zonemd_in_progress) { 5589 xfr_write_after_update(xfr, env, current_chunk_list); 5590 } 5591 return 1; 5592 } 5593 5594 /** Stop lookup using callback */ 5595 static void 5596 xfr_stop_lookup(struct auth_master** lookup_target, void* lookup_unique_info, 5597 int lookup_aaaa, uint16_t dclass, struct mesh_area* mesh, 5598 mesh_cb_func_type cb, void* cb_arg) 5599 { 5600 struct query_info qinfo; 5601 uint8_t dname[LDNS_MAX_DOMAINLEN+1]; 5602 if(!*lookup_target) return; 5603 qinfo.qname_len = sizeof(dname); 5604 if(sldns_str2wire_dname_buf((*lookup_target)->host, dname, 5605 &qinfo.qname_len) != 0) { 5606 *lookup_target = NULL; 5607 return; 5608 } 5609 qinfo.qname = dname; 5610 qinfo.qclass = dclass; 5611 qinfo.qtype = lookup_aaaa ? LDNS_RR_TYPE_AAAA : LDNS_RR_TYPE_A; 5612 qinfo.local_alias = NULL; 5613 log_query_info(VERB_ALGO, "removing xfr callback", &qinfo); 5614 5615 mesh_remove_callback(mesh, &qinfo, BIT_RD, cb, cb_arg, 5616 lookup_unique_info); 5617 *lookup_target = NULL; 5618 } 5619 5620 /** disown task_transfer. caller must hold xfr.lock */ 5621 static void 5622 xfr_transfer_disown(struct auth_xfer* xfr) 5623 { 5624 /* remove data chunks */ 5625 auth_chunks_delete(xfr->task_transfer); 5626 /* remove timer (from this worker's event base) */ 5627 comm_timer_delete(xfr->task_transfer->timer); 5628 xfr->task_transfer->timer = NULL; 5629 /* remove the commpoint */ 5630 comm_point_delete(xfr->task_transfer->cp); 5631 xfr->task_transfer->cp = NULL; 5632 if(xfr->task_transfer->env) 5633 xfr_stop_lookup(&xfr->task_transfer->lookup_target, 5634 xfr->task_transfer->lookup_unique_info, 5635 xfr->task_transfer->lookup_aaaa, xfr->dclass, 5636 xfr->task_transfer->env->mesh, 5637 &auth_xfer_transfer_lookup_callback, xfr); 5638 /* we don't own this item anymore */ 5639 xfr->task_transfer->worker = NULL; 5640 xfr->task_transfer->env = NULL; 5641 } 5642 5643 /** lookup a host name for its addresses, if needed */ 5644 static int 5645 xfr_transfer_lookup_host(struct auth_xfer* xfr, struct module_env* env) 5646 { 5647 struct sockaddr_storage addr; 5648 socklen_t addrlen = 0; 5649 struct auth_master* master = xfr->task_transfer->lookup_target; 5650 struct query_info qinfo; 5651 uint16_t qflags = BIT_RD; 5652 uint8_t dname[LDNS_MAX_DOMAINLEN+1]; 5653 struct edns_data edns; 5654 sldns_buffer* buf = env->scratch_buffer; 5655 if(!master) return 0; 5656 if(extstrtoaddr(master->host, &addr, &addrlen, UNBOUND_DNS_PORT)) { 5657 /* not needed, host is in IP addr format */ 5658 return 0; 5659 } 5660 if(master->allow_notify) 5661 return 0; /* allow-notifies are not transferred from, no 5662 lookup is needed */ 5663 5664 /* use mesh_new_callback to probe for non-addr hosts, 5665 * and then wait for them to be looked up (in cache, or query) */ 5666 qinfo.qname_len = sizeof(dname); 5667 if(sldns_str2wire_dname_buf(master->host, dname, &qinfo.qname_len) 5668 != 0) { 5669 log_err("cannot parse host name of master %s", master->host); 5670 return 0; 5671 } 5672 qinfo.qname = dname; 5673 qinfo.qclass = xfr->dclass; 5674 qinfo.qtype = LDNS_RR_TYPE_A; 5675 if(xfr->task_transfer->lookup_aaaa) 5676 qinfo.qtype = LDNS_RR_TYPE_AAAA; 5677 qinfo.local_alias = NULL; 5678 if(verbosity >= VERB_ALGO) { 5679 char buf1[512]; 5680 char buf2[LDNS_MAX_DOMAINLEN]; 5681 dname_str(xfr->name, buf2); 5682 snprintf(buf1, sizeof(buf1), "auth zone %s: master lookup" 5683 " for task_transfer", buf2); 5684 log_query_info(VERB_ALGO, buf1, &qinfo); 5685 } 5686 edns.edns_present = 1; 5687 edns.ext_rcode = 0; 5688 edns.edns_version = 0; 5689 edns.bits = EDNS_DO; 5690 edns.opt_list_in = NULL; 5691 edns.opt_list_out = NULL; 5692 edns.opt_list_inplace_cb_out = NULL; 5693 edns.padding_block_size = 0; 5694 edns.cookie_present = 0; 5695 edns.cookie_valid = 0; 5696 if(sldns_buffer_capacity(buf) < 65535) 5697 edns.udp_size = (uint16_t)sldns_buffer_capacity(buf); 5698 else edns.udp_size = 65535; 5699 5700 /* unlock xfr during mesh_new_callback() because the callback can be 5701 * called straight away */ 5702 lock_basic_unlock(&xfr->lock); 5703 if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0, 5704 &auth_xfer_transfer_lookup_callback, xfr, 0, 5705 &xfr->task_transfer->lookup_unique_info)) { 5706 lock_basic_lock(&xfr->lock); 5707 log_err("out of memory lookup up master %s", master->host); 5708 return 0; 5709 } 5710 lock_basic_lock(&xfr->lock); 5711 return 1; 5712 } 5713 5714 /** initiate TCP to the target and fetch zone. 5715 * returns true if that was successfully started, and timeout setup. */ 5716 static int 5717 xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env) 5718 { 5719 struct sockaddr_storage addr; 5720 socklen_t addrlen = 0; 5721 struct auth_master* master = xfr->task_transfer->master; 5722 char *auth_name = NULL; 5723 struct timeval t; 5724 int timeout; 5725 if(!master) return 0; 5726 if(master->allow_notify) return 0; /* only for notify */ 5727 5728 /* get master addr */ 5729 if(xfr->task_transfer->scan_addr) { 5730 addrlen = xfr->task_transfer->scan_addr->addrlen; 5731 memmove(&addr, &xfr->task_transfer->scan_addr->addr, addrlen); 5732 } else { 5733 if(!authextstrtoaddr(master->host, &addr, &addrlen, &auth_name)) { 5734 /* the ones that are not in addr format are supposed 5735 * to be looked up. The lookup has failed however, 5736 * so skip them */ 5737 char zname[LDNS_MAX_DOMAINLEN]; 5738 dname_str(xfr->name, zname); 5739 log_err("%s: failed lookup, cannot transfer from master %s", 5740 zname, master->host); 5741 return 0; 5742 } 5743 } 5744 5745 /* remove previous TCP connection (if any) */ 5746 if(xfr->task_transfer->cp) { 5747 comm_point_delete(xfr->task_transfer->cp); 5748 xfr->task_transfer->cp = NULL; 5749 } 5750 if(!xfr->task_transfer->timer) { 5751 xfr->task_transfer->timer = comm_timer_create(env->worker_base, 5752 auth_xfer_transfer_timer_callback, xfr); 5753 if(!xfr->task_transfer->timer) { 5754 log_err("malloc failure"); 5755 return 0; 5756 } 5757 } 5758 timeout = AUTH_TRANSFER_TIMEOUT; 5759 #ifndef S_SPLINT_S 5760 t.tv_sec = timeout/1000; 5761 t.tv_usec = (timeout%1000)*1000; 5762 #endif 5763 xfr->task_transfer->start_time = *env->now_tv; 5764 5765 if(master->http) { 5766 /* perform http fetch */ 5767 /* store http port number into sockaddr, 5768 * unless someone used unbound's host@port notation */ 5769 xfr->task_transfer->on_ixfr = 0; 5770 if(strchr(master->host, '@') == NULL) 5771 sockaddr_store_port(&addr, addrlen, master->port); 5772 xfr->task_transfer->cp = outnet_comm_point_for_http( 5773 env->outnet, auth_xfer_transfer_http_callback, xfr, 5774 &addr, addrlen, -1, master->ssl, master->host, 5775 master->file, env->cfg); 5776 if(!xfr->task_transfer->cp) { 5777 char zname[LDNS_MAX_DOMAINLEN], as[256]; 5778 dname_str(xfr->name, zname); 5779 addr_port_to_str(&addr, addrlen, as, sizeof(as)); 5780 verbose(VERB_ALGO, "cannot create http cp " 5781 "connection for %s to %s", zname, as); 5782 return 0; 5783 } 5784 comm_timer_set(xfr->task_transfer->timer, &t); 5785 if(verbosity >= VERB_ALGO) { 5786 char zname[LDNS_MAX_DOMAINLEN], as[256]; 5787 dname_str(xfr->name, zname); 5788 addr_port_to_str(&addr, addrlen, as, sizeof(as)); 5789 verbose(VERB_ALGO, "auth zone %s transfer next HTTP fetch from %s started", zname, as); 5790 } 5791 /* Create or refresh the list of allow_notify addrs */ 5792 probe_copy_masters_for_allow_notify(xfr); 5793 return 1; 5794 } 5795 5796 /* perform AXFR/IXFR */ 5797 /* set the packet to be written */ 5798 /* create new ID */ 5799 xfr->task_transfer->id = GET_RANDOM_ID(env->rnd); 5800 xfr_create_ixfr_packet(xfr, env->scratch_buffer, 5801 xfr->task_transfer->id, master); 5802 5803 /* connect on fd */ 5804 xfr->task_transfer->cp = outnet_comm_point_for_tcp(env->outnet, 5805 auth_xfer_transfer_tcp_callback, xfr, &addr, addrlen, 5806 env->scratch_buffer, -1, 5807 auth_name != NULL, auth_name); 5808 if(!xfr->task_transfer->cp) { 5809 char zname[LDNS_MAX_DOMAINLEN], as[256]; 5810 dname_str(xfr->name, zname); 5811 addr_port_to_str(&addr, addrlen, as, sizeof(as)); 5812 verbose(VERB_ALGO, "cannot create tcp cp connection for " 5813 "xfr %s to %s", zname, as); 5814 return 0; 5815 } 5816 comm_timer_set(xfr->task_transfer->timer, &t); 5817 if(verbosity >= VERB_ALGO) { 5818 char zname[LDNS_MAX_DOMAINLEN], as[256]; 5819 dname_str(xfr->name, zname); 5820 addr_port_to_str(&addr, addrlen, as, sizeof(as)); 5821 verbose(VERB_ALGO, "auth zone %s transfer next %s fetch from %s started", zname, 5822 (xfr->task_transfer->on_ixfr?"IXFR":"AXFR"), as); 5823 } 5824 return 1; 5825 } 5826 5827 /** perform next lookup, next transfer TCP, or end and resume wait time task */ 5828 static void 5829 xfr_transfer_nexttarget_or_end(struct auth_xfer* xfr, struct module_env* env) 5830 { 5831 log_assert(xfr->task_transfer->worker == env->worker); 5832 5833 /* are we performing lookups? */ 5834 while(xfr->task_transfer->lookup_target) { 5835 if(xfr_transfer_lookup_host(xfr, env)) { 5836 /* wait for lookup to finish, 5837 * note that the hostname may be in unbound's cache 5838 * and we may then get an instant cache response, 5839 * and that calls the callback just like a full 5840 * lookup and lookup failures also call callback */ 5841 if(verbosity >= VERB_ALGO) { 5842 char zname[LDNS_MAX_DOMAINLEN]; 5843 dname_str(xfr->name, zname); 5844 verbose(VERB_ALGO, "auth zone %s transfer next target lookup", zname); 5845 } 5846 lock_basic_unlock(&xfr->lock); 5847 return; 5848 } 5849 xfr_transfer_move_to_next_lookup(xfr, env); 5850 } 5851 5852 /* initiate TCP and fetch the zone from the master */ 5853 /* and set timeout on it */ 5854 while(!xfr_transfer_end_of_list(xfr)) { 5855 xfr->task_transfer->master = xfr_transfer_current_master(xfr); 5856 if(xfr_transfer_init_fetch(xfr, env)) { 5857 /* successfully started, wait for callback */ 5858 lock_basic_unlock(&xfr->lock); 5859 return; 5860 } 5861 /* failed to fetch, next master */ 5862 xfr_transfer_nextmaster(xfr); 5863 } 5864 if(verbosity >= VERB_ALGO) { 5865 char zname[LDNS_MAX_DOMAINLEN]; 5866 dname_str(xfr->name, zname); 5867 verbose(VERB_ALGO, "auth zone %s transfer failed, wait", zname); 5868 } 5869 5870 /* we failed to fetch the zone, move to wait task 5871 * use the shorter retry timeout */ 5872 xfr_transfer_disown(xfr); 5873 5874 /* pick up the nextprobe task and wait */ 5875 if(xfr->task_nextprobe->worker == NULL) 5876 xfr_set_timeout(xfr, env, 1, 0); 5877 lock_basic_unlock(&xfr->lock); 5878 } 5879 5880 /** add addrs from A or AAAA rrset to the master */ 5881 static void 5882 xfr_master_add_addrs(struct auth_master* m, struct ub_packed_rrset_key* rrset, 5883 uint16_t rrtype) 5884 { 5885 size_t i; 5886 struct packed_rrset_data* data; 5887 if(!m || !rrset) return; 5888 if(rrtype != LDNS_RR_TYPE_A && rrtype != LDNS_RR_TYPE_AAAA) 5889 return; 5890 data = (struct packed_rrset_data*)rrset->entry.data; 5891 for(i=0; i<data->count; i++) { 5892 struct auth_addr* a; 5893 size_t len = data->rr_len[i] - 2; 5894 uint8_t* rdata = data->rr_data[i]+2; 5895 if(rrtype == LDNS_RR_TYPE_A && len != INET_SIZE) 5896 continue; /* wrong length for A */ 5897 if(rrtype == LDNS_RR_TYPE_AAAA && len != INET6_SIZE) 5898 continue; /* wrong length for AAAA */ 5899 5900 /* add and alloc it */ 5901 a = (struct auth_addr*)calloc(1, sizeof(*a)); 5902 if(!a) { 5903 log_err("out of memory"); 5904 return; 5905 } 5906 if(rrtype == LDNS_RR_TYPE_A) { 5907 struct sockaddr_in* sa; 5908 a->addrlen = (socklen_t)sizeof(*sa); 5909 sa = (struct sockaddr_in*)&a->addr; 5910 sa->sin_family = AF_INET; 5911 sa->sin_port = (in_port_t)htons(UNBOUND_DNS_PORT); 5912 memmove(&sa->sin_addr, rdata, INET_SIZE); 5913 } else { 5914 struct sockaddr_in6* sa; 5915 a->addrlen = (socklen_t)sizeof(*sa); 5916 sa = (struct sockaddr_in6*)&a->addr; 5917 sa->sin6_family = AF_INET6; 5918 sa->sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT); 5919 memmove(&sa->sin6_addr, rdata, INET6_SIZE); 5920 } 5921 if(verbosity >= VERB_ALGO) { 5922 char s[64]; 5923 addr_port_to_str(&a->addr, a->addrlen, s, sizeof(s)); 5924 verbose(VERB_ALGO, "auth host %s lookup %s", 5925 m->host, s); 5926 } 5927 /* append to list */ 5928 a->next = m->list; 5929 m->list = a; 5930 } 5931 } 5932 5933 /** check if the lookup target name equals the found answer name. */ 5934 static int 5935 xfer_target_equals_answer_name(struct auth_master* lookup_target, 5936 struct ub_packed_rrset_key* answer, struct query_info* rq, 5937 struct reply_info* rep) 5938 { 5939 uint8_t qname[LDNS_MAX_DOMAINLEN+1]; 5940 size_t qname_len; 5941 if(!lookup_target) return 0; 5942 if(!answer) return 0; 5943 qname_len = sizeof(qname); 5944 if(sldns_str2wire_dname_buf(lookup_target->host, qname, &qname_len) 5945 != 0) { 5946 verbose(VERB_ALGO, "xfer_target_equals_answer_name: could not parse auth host name"); 5947 return 0; 5948 } 5949 if(query_dname_compare(answer->rk.dname, qname) == 0) 5950 return 1; 5951 /* It could be a CNAME. */ 5952 if(reply_find_rrset_section_an(rep, qname, qname_len, 5953 LDNS_RR_TYPE_CNAME, rq->qclass)) 5954 return 1; 5955 return 0; 5956 } 5957 5958 /** callback for task_transfer lookup of host name, of A or AAAA */ 5959 void auth_xfer_transfer_lookup_callback(void* arg, int rcode, sldns_buffer* buf, 5960 enum sec_status sec, char* why_bogus, int ATTR_UNUSED(was_ratelimited)) 5961 { 5962 struct auth_xfer* xfr = (struct auth_xfer*)arg; 5963 struct module_env* env; 5964 log_assert(xfr->task_transfer); 5965 lock_basic_lock(&xfr->lock); 5966 env = xfr->task_transfer->env; 5967 if(!env || env->outnet->want_to_quit) { 5968 lock_basic_unlock(&xfr->lock); 5969 return; /* stop on quit */ 5970 } 5971 5972 /* process result */ 5973 if(sec == sec_status_bogus || sec == sec_status_secure_sentinel_fail) { 5974 if(verbosity >= VERB_OPS) { 5975 char zname[LDNS_MAX_DOMAINLEN]; 5976 dname_str(xfr->name, zname); 5977 verbose(VERB_OPS, "auth zone %s: primary %s address lookup is DNSSEC bogus: %s", 5978 zname, xfr->task_transfer->lookup_target->host, 5979 (why_bogus?why_bogus:"")); 5980 } 5981 /* fall through to next-lookup / next-master */ 5982 } else if(rcode == LDNS_RCODE_NOERROR) { 5983 uint16_t wanted_qtype = LDNS_RR_TYPE_A; 5984 struct regional* temp = env->scratch; 5985 struct query_info rq; 5986 struct reply_info* rep; 5987 if(xfr->task_transfer->lookup_aaaa) 5988 wanted_qtype = LDNS_RR_TYPE_AAAA; 5989 memset(&rq, 0, sizeof(rq)); 5990 rep = parse_reply_in_temp_region(buf, temp, &rq); 5991 if(rep && rq.qtype == wanted_qtype && 5992 FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR) { 5993 /* parsed successfully */ 5994 struct ub_packed_rrset_key* answer = 5995 reply_find_answer_rrset(&rq, rep); 5996 if(answer && xfer_target_equals_answer_name( 5997 xfr->task_transfer->lookup_target, answer, 5998 &rq, rep)) { 5999 xfr_master_add_addrs(xfr->task_transfer-> 6000 lookup_target, answer, wanted_qtype); 6001 } else if(answer) { 6002 if(verbosity >= VERB_ALGO) { 6003 char zname[LDNS_MAX_DOMAINLEN]; 6004 dname_str(xfr->name, zname); 6005 verbose(VERB_ALGO, "auth zone %s host %s type %s transfer lookup has mismatch in answer name", zname, ((xfr->task_transfer->lookup_target && xfr->task_transfer->lookup_target->host) ? xfr->task_transfer->lookup_target->host : "null"), (xfr->task_transfer->lookup_aaaa?"AAAA":"A")); 6006 } 6007 } else { 6008 if(verbosity >= VERB_ALGO) { 6009 char zname[LDNS_MAX_DOMAINLEN]; 6010 dname_str(xfr->name, zname); 6011 verbose(VERB_ALGO, "auth zone %s host %s type %s transfer lookup has nodata", zname, ((xfr->task_transfer->lookup_target && xfr->task_transfer->lookup_target->host) ? xfr->task_transfer->lookup_target->host : "null"), (xfr->task_transfer->lookup_aaaa?"AAAA":"A")); 6012 } 6013 } 6014 } else { 6015 if(verbosity >= VERB_ALGO) { 6016 char zname[LDNS_MAX_DOMAINLEN]; 6017 dname_str(xfr->name, zname); 6018 verbose(VERB_ALGO, "auth zone %s host %s type %s transfer lookup has no answer", zname, ((xfr->task_transfer->lookup_target && xfr->task_transfer->lookup_target->host) ? xfr->task_transfer->lookup_target->host : "null"), (xfr->task_transfer->lookup_aaaa?"AAAA":"A")); 6019 } 6020 } 6021 regional_free_all(temp); 6022 } else { 6023 if(verbosity >= VERB_ALGO) { 6024 char zname[LDNS_MAX_DOMAINLEN]; 6025 dname_str(xfr->name, zname); 6026 verbose(VERB_ALGO, "auth zone %s host %s type %s transfer lookup failed", zname, ((xfr->task_transfer->lookup_target && xfr->task_transfer->lookup_target->host) ? xfr->task_transfer->lookup_target->host : "null"), (xfr->task_transfer->lookup_aaaa?"AAAA":"A")); 6027 } 6028 } 6029 if(xfr->task_transfer->lookup_target && 6030 xfr->task_transfer->lookup_target->list && 6031 xfr->task_transfer->lookup_target == xfr_transfer_current_master(xfr)) 6032 xfr->task_transfer->scan_addr = xfr->task_transfer->lookup_target->list; 6033 6034 /* move to lookup AAAA after A lookup, move to next hostname lookup, 6035 * or move to fetch the zone, or, if nothing to do, end task_transfer */ 6036 xfr_transfer_move_to_next_lookup(xfr, env); 6037 xfr_transfer_nexttarget_or_end(xfr, env); 6038 } 6039 6040 /** check if xfer (AXFR or IXFR) packet is OK. 6041 * return false if we lost connection (SERVFAIL, or unreadable). 6042 * return false if we need to move from IXFR to AXFR, with gonextonfail 6043 * set to false, so the same master is tried again, but with AXFR. 6044 * return true if fine to link into data. 6045 * return true with transferdone=true when the transfer has ended. 6046 */ 6047 static int 6048 check_xfer_packet(sldns_buffer* pkt, struct auth_xfer* xfr, 6049 int* gonextonfail, int* transferdone) 6050 { 6051 uint8_t* wire = sldns_buffer_begin(pkt); 6052 int i; 6053 if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) { 6054 verbose(VERB_ALGO, "xfr to %s failed, packet too small", 6055 xfr->task_transfer->master->host); 6056 return 0; 6057 } 6058 if(!LDNS_QR_WIRE(wire)) { 6059 verbose(VERB_ALGO, "xfr to %s failed, packet has no QR flag", 6060 xfr->task_transfer->master->host); 6061 return 0; 6062 } 6063 if(LDNS_TC_WIRE(wire)) { 6064 verbose(VERB_ALGO, "xfr to %s failed, packet has TC flag", 6065 xfr->task_transfer->master->host); 6066 return 0; 6067 } 6068 /* check ID */ 6069 if(LDNS_ID_WIRE(wire) != xfr->task_transfer->id) { 6070 verbose(VERB_ALGO, "xfr to %s failed, packet wrong ID", 6071 xfr->task_transfer->master->host); 6072 return 0; 6073 } 6074 if(LDNS_RCODE_WIRE(wire) != LDNS_RCODE_NOERROR) { 6075 char rcode[32]; 6076 sldns_wire2str_rcode_buf((int)LDNS_RCODE_WIRE(wire), rcode, 6077 sizeof(rcode)); 6078 /* if we are doing IXFR, check for fallback */ 6079 if(xfr->task_transfer->on_ixfr) { 6080 if(LDNS_RCODE_WIRE(wire) == LDNS_RCODE_NOTIMPL || 6081 LDNS_RCODE_WIRE(wire) == LDNS_RCODE_SERVFAIL || 6082 LDNS_RCODE_WIRE(wire) == LDNS_RCODE_REFUSED || 6083 LDNS_RCODE_WIRE(wire) == LDNS_RCODE_FORMERR) { 6084 verbose(VERB_ALGO, "xfr to %s, fallback " 6085 "from IXFR to AXFR (with rcode %s)", 6086 xfr->task_transfer->master->host, 6087 rcode); 6088 xfr->task_transfer->ixfr_fail = 1; 6089 *gonextonfail = 0; 6090 return 0; 6091 } 6092 } 6093 verbose(VERB_ALGO, "xfr to %s failed, packet with rcode %s", 6094 xfr->task_transfer->master->host, rcode); 6095 return 0; 6096 } 6097 if(LDNS_OPCODE_WIRE(wire) != LDNS_PACKET_QUERY) { 6098 verbose(VERB_ALGO, "xfr to %s failed, packet with bad opcode", 6099 xfr->task_transfer->master->host); 6100 return 0; 6101 } 6102 if(LDNS_QDCOUNT(wire) > 1) { 6103 verbose(VERB_ALGO, "xfr to %s failed, packet has qdcount %d", 6104 xfr->task_transfer->master->host, 6105 (int)LDNS_QDCOUNT(wire)); 6106 return 0; 6107 } 6108 6109 /* check qname */ 6110 sldns_buffer_set_position(pkt, LDNS_HEADER_SIZE); 6111 for(i=0; i<(int)LDNS_QDCOUNT(wire); i++) { 6112 size_t pos = sldns_buffer_position(pkt); 6113 uint16_t qtype, qclass; 6114 if(pkt_dname_len(pkt) == 0) { 6115 verbose(VERB_ALGO, "xfr to %s failed, packet with " 6116 "malformed dname", 6117 xfr->task_transfer->master->host); 6118 return 0; 6119 } 6120 if(dname_pkt_compare(pkt, sldns_buffer_at(pkt, pos), 6121 xfr->name) != 0) { 6122 verbose(VERB_ALGO, "xfr to %s failed, packet with " 6123 "wrong qname", 6124 xfr->task_transfer->master->host); 6125 return 0; 6126 } 6127 if(sldns_buffer_remaining(pkt) < 4) { 6128 verbose(VERB_ALGO, "xfr to %s failed, packet with " 6129 "truncated query RR", 6130 xfr->task_transfer->master->host); 6131 return 0; 6132 } 6133 qtype = sldns_buffer_read_u16(pkt); 6134 qclass = sldns_buffer_read_u16(pkt); 6135 if(qclass != xfr->dclass) { 6136 verbose(VERB_ALGO, "xfr to %s failed, packet with " 6137 "wrong qclass", 6138 xfr->task_transfer->master->host); 6139 return 0; 6140 } 6141 if(xfr->task_transfer->on_ixfr) { 6142 if(qtype != LDNS_RR_TYPE_IXFR) { 6143 verbose(VERB_ALGO, "xfr to %s failed, packet " 6144 "with wrong qtype, expected IXFR", 6145 xfr->task_transfer->master->host); 6146 return 0; 6147 } 6148 } else { 6149 if(qtype != LDNS_RR_TYPE_AXFR) { 6150 verbose(VERB_ALGO, "xfr to %s failed, packet " 6151 "with wrong qtype, expected AXFR", 6152 xfr->task_transfer->master->host); 6153 return 0; 6154 } 6155 } 6156 } 6157 6158 /* check parse of RRs in packet, store first SOA serial 6159 * to be able to detect last SOA (with that serial) to see if done */ 6160 /* also check for IXFR 'zone up to date' reply */ 6161 for(i=0; i<(int)LDNS_ANCOUNT(wire); i++) { 6162 size_t pos = sldns_buffer_position(pkt); 6163 uint16_t tp, rdlen; 6164 if(pkt_dname_len(pkt) == 0) { 6165 verbose(VERB_ALGO, "xfr to %s failed, packet with " 6166 "malformed dname in answer section", 6167 xfr->task_transfer->master->host); 6168 return 0; 6169 } 6170 if(sldns_buffer_remaining(pkt) < 10) { 6171 verbose(VERB_ALGO, "xfr to %s failed, packet with " 6172 "truncated RR", 6173 xfr->task_transfer->master->host); 6174 return 0; 6175 } 6176 tp = sldns_buffer_read_u16(pkt); 6177 (void)sldns_buffer_read_u16(pkt); /* class */ 6178 (void)sldns_buffer_read_u32(pkt); /* ttl */ 6179 rdlen = sldns_buffer_read_u16(pkt); 6180 if(sldns_buffer_remaining(pkt) < rdlen) { 6181 verbose(VERB_ALGO, "xfr to %s failed, packet with " 6182 "truncated RR rdata", 6183 xfr->task_transfer->master->host); 6184 return 0; 6185 } 6186 6187 /* RR parses (haven't checked rdata itself), now look at 6188 * SOA records to see serial number */ 6189 if(xfr->task_transfer->rr_scan_num == 0 && 6190 tp != LDNS_RR_TYPE_SOA) { 6191 verbose(VERB_ALGO, "xfr to %s failed, packet with " 6192 "malformed zone transfer, no start SOA", 6193 xfr->task_transfer->master->host); 6194 return 0; 6195 } 6196 if(xfr->task_transfer->rr_scan_num == 1 && 6197 tp != LDNS_RR_TYPE_SOA) { 6198 /* second RR is not a SOA record, this is not an IXFR 6199 * the master is replying with an AXFR */ 6200 xfr->task_transfer->on_ixfr_is_axfr = 1; 6201 } 6202 if(tp == LDNS_RR_TYPE_SOA) { 6203 uint32_t serial; 6204 if(rdlen < 22) { 6205 verbose(VERB_ALGO, "xfr to %s failed, packet " 6206 "with SOA with malformed rdata", 6207 xfr->task_transfer->master->host); 6208 return 0; 6209 } 6210 if(dname_pkt_compare(pkt, sldns_buffer_at(pkt, pos), 6211 xfr->name) != 0) { 6212 verbose(VERB_ALGO, "xfr to %s failed, packet " 6213 "with SOA with wrong dname", 6214 xfr->task_transfer->master->host); 6215 return 0; 6216 } 6217 6218 /* read serial number of SOA */ 6219 serial = sldns_buffer_read_u32_at(pkt, 6220 sldns_buffer_position(pkt)+rdlen-20); 6221 6222 /* check for IXFR 'zone has SOA x' reply */ 6223 if(xfr->task_transfer->on_ixfr && 6224 xfr->task_transfer->rr_scan_num == 0 && 6225 LDNS_ANCOUNT(wire)==1) { 6226 verbose(VERB_ALGO, "xfr to %s ended, " 6227 "IXFR reply that zone has serial %u," 6228 " fallback from IXFR to AXFR", 6229 xfr->task_transfer->master->host, 6230 (unsigned)serial); 6231 xfr->task_transfer->ixfr_fail = 1; 6232 *gonextonfail = 0; 6233 return 0; 6234 } 6235 6236 /* if first SOA, store serial number */ 6237 if(xfr->task_transfer->got_xfr_serial == 0) { 6238 xfr->task_transfer->got_xfr_serial = 1; 6239 xfr->task_transfer->incoming_xfr_serial = 6240 serial; 6241 verbose(VERB_ALGO, "xfr %s: contains " 6242 "SOA serial %u", 6243 xfr->task_transfer->master->host, 6244 (unsigned)serial); 6245 /* see if end of AXFR */ 6246 } else if(!xfr->task_transfer->on_ixfr || 6247 xfr->task_transfer->on_ixfr_is_axfr) { 6248 /* second SOA with serial is the end 6249 * for AXFR */ 6250 *transferdone = 1; 6251 verbose(VERB_ALGO, "xfr %s: last AXFR packet", 6252 xfr->task_transfer->master->host); 6253 /* for IXFR, count SOA records with that serial */ 6254 } else if(xfr->task_transfer->incoming_xfr_serial == 6255 serial && xfr->task_transfer->got_xfr_serial 6256 == 1) { 6257 xfr->task_transfer->got_xfr_serial++; 6258 /* if not first soa, if serial==firstserial, the 6259 * third time we are at the end, for IXFR */ 6260 } else if(xfr->task_transfer->incoming_xfr_serial == 6261 serial && xfr->task_transfer->got_xfr_serial 6262 == 2) { 6263 verbose(VERB_ALGO, "xfr %s: last IXFR packet", 6264 xfr->task_transfer->master->host); 6265 *transferdone = 1; 6266 /* continue parse check, if that succeeds, 6267 * transfer is done */ 6268 } 6269 } 6270 xfr->task_transfer->rr_scan_num++; 6271 6272 /* skip over RR rdata to go to the next RR */ 6273 sldns_buffer_skip(pkt, (ssize_t)rdlen); 6274 } 6275 6276 /* check authority section */ 6277 /* we skip over the RRs checking packet format */ 6278 for(i=0; i<(int)LDNS_NSCOUNT(wire); i++) { 6279 uint16_t rdlen; 6280 if(pkt_dname_len(pkt) == 0) { 6281 verbose(VERB_ALGO, "xfr to %s failed, packet with " 6282 "malformed dname in authority section", 6283 xfr->task_transfer->master->host); 6284 return 0; 6285 } 6286 if(sldns_buffer_remaining(pkt) < 10) { 6287 verbose(VERB_ALGO, "xfr to %s failed, packet with " 6288 "truncated RR", 6289 xfr->task_transfer->master->host); 6290 return 0; 6291 } 6292 (void)sldns_buffer_read_u16(pkt); /* type */ 6293 (void)sldns_buffer_read_u16(pkt); /* class */ 6294 (void)sldns_buffer_read_u32(pkt); /* ttl */ 6295 rdlen = sldns_buffer_read_u16(pkt); 6296 if(sldns_buffer_remaining(pkt) < rdlen) { 6297 verbose(VERB_ALGO, "xfr to %s failed, packet with " 6298 "truncated RR rdata", 6299 xfr->task_transfer->master->host); 6300 return 0; 6301 } 6302 /* skip over RR rdata to go to the next RR */ 6303 sldns_buffer_skip(pkt, (ssize_t)rdlen); 6304 } 6305 6306 /* check additional section */ 6307 for(i=0; i<(int)LDNS_ARCOUNT(wire); i++) { 6308 uint16_t rdlen; 6309 if(pkt_dname_len(pkt) == 0) { 6310 verbose(VERB_ALGO, "xfr to %s failed, packet with " 6311 "malformed dname in additional section", 6312 xfr->task_transfer->master->host); 6313 return 0; 6314 } 6315 if(sldns_buffer_remaining(pkt) < 10) { 6316 verbose(VERB_ALGO, "xfr to %s failed, packet with " 6317 "truncated RR", 6318 xfr->task_transfer->master->host); 6319 return 0; 6320 } 6321 (void)sldns_buffer_read_u16(pkt); /* type */ 6322 (void)sldns_buffer_read_u16(pkt); /* class */ 6323 (void)sldns_buffer_read_u32(pkt); /* ttl */ 6324 rdlen = sldns_buffer_read_u16(pkt); 6325 if(sldns_buffer_remaining(pkt) < rdlen) { 6326 verbose(VERB_ALGO, "xfr to %s failed, packet with " 6327 "truncated RR rdata", 6328 xfr->task_transfer->master->host); 6329 return 0; 6330 } 6331 /* skip over RR rdata to go to the next RR */ 6332 sldns_buffer_skip(pkt, (ssize_t)rdlen); 6333 } 6334 6335 return 1; 6336 } 6337 6338 /** Link the data from this packet into the worklist of transferred data */ 6339 static int 6340 xfer_link_data(sldns_buffer* pkt, struct auth_xfer* xfr) 6341 { 6342 /* alloc it */ 6343 struct auth_chunk* e; 6344 e = (struct auth_chunk*)calloc(1, sizeof(*e)); 6345 if(!e) return 0; 6346 e->next = NULL; 6347 e->len = sldns_buffer_limit(pkt); 6348 e->data = memdup(sldns_buffer_begin(pkt), e->len); 6349 if(!e->data) { 6350 free(e); 6351 return 0; 6352 } 6353 6354 /* alloc succeeded, link into list */ 6355 if(!xfr->task_transfer->chunks_first) 6356 xfr->task_transfer->chunks_first = e; 6357 if(xfr->task_transfer->chunks_last) 6358 xfr->task_transfer->chunks_last->next = e; 6359 xfr->task_transfer->chunks_last = e; 6360 xfr->task_transfer->chunks_total += e->len; 6361 return 1; 6362 } 6363 6364 /** task transfer. the list of data is complete. process it and if failed 6365 * move to next master, if succeeded, end the task transfer */ 6366 static void 6367 process_list_end_transfer(struct auth_xfer* xfr, struct module_env* env) 6368 { 6369 int ixfr_fail = 0; 6370 if(xfr_process_chunk_list(xfr, env, &ixfr_fail)) { 6371 /* it worked! */ 6372 auth_chunks_delete(xfr->task_transfer); 6373 6374 /* we fetched the zone, move to wait task */ 6375 xfr_transfer_disown(xfr); 6376 6377 if(xfr->notify_received && (!xfr->notify_has_serial || 6378 (xfr->notify_has_serial && 6379 xfr_serial_means_update(xfr, xfr->notify_serial)))) { 6380 uint32_t sr = xfr->notify_serial; 6381 int has_sr = xfr->notify_has_serial; 6382 /* we received a notify while probe/transfer was 6383 * in progress. start a new probe and transfer */ 6384 xfr->notify_received = 0; 6385 xfr->notify_has_serial = 0; 6386 xfr->notify_serial = 0; 6387 if(!xfr_start_probe(xfr, env, NULL)) { 6388 /* if we couldn't start it, already in 6389 * progress; restore notify serial, 6390 * while xfr still locked */ 6391 xfr->notify_received = 1; 6392 xfr->notify_has_serial = has_sr; 6393 xfr->notify_serial = sr; 6394 lock_basic_unlock(&xfr->lock); 6395 } 6396 return; 6397 } else { 6398 /* pick up the nextprobe task and wait (normail wait time) */ 6399 if(xfr->task_nextprobe->worker == NULL) 6400 xfr_set_timeout(xfr, env, 0, 0); 6401 } 6402 lock_basic_unlock(&xfr->lock); 6403 return; 6404 } 6405 /* processing failed */ 6406 /* when done, delete data from list */ 6407 auth_chunks_delete(xfr->task_transfer); 6408 if(ixfr_fail) { 6409 xfr->task_transfer->ixfr_fail = 1; 6410 } else { 6411 xfr_transfer_nextmaster(xfr); 6412 } 6413 xfr_transfer_nexttarget_or_end(xfr, env); 6414 } 6415 6416 /** callback for the task_transfer timer */ 6417 void 6418 auth_xfer_transfer_timer_callback(void* arg) 6419 { 6420 struct auth_xfer* xfr = (struct auth_xfer*)arg; 6421 struct module_env* env; 6422 int gonextonfail = 1; 6423 log_assert(xfr->task_transfer); 6424 lock_basic_lock(&xfr->lock); 6425 env = xfr->task_transfer->env; 6426 if(!env || env->outnet->want_to_quit) { 6427 lock_basic_unlock(&xfr->lock); 6428 return; /* stop on quit */ 6429 } 6430 6431 verbose(VERB_ALGO, "xfr stopped, connection timeout to %s", 6432 xfr->task_transfer->master->host); 6433 6434 /* see if IXFR caused the failure, if so, try AXFR */ 6435 if(xfr->task_transfer->on_ixfr) { 6436 xfr->task_transfer->ixfr_possible_timeout_count++; 6437 if(xfr->task_transfer->ixfr_possible_timeout_count >= 6438 NUM_TIMEOUTS_FALLBACK_IXFR) { 6439 verbose(VERB_ALGO, "xfr to %s, fallback " 6440 "from IXFR to AXFR (because of timeouts)", 6441 xfr->task_transfer->master->host); 6442 xfr->task_transfer->ixfr_fail = 1; 6443 gonextonfail = 0; 6444 } 6445 } 6446 6447 /* delete transferred data from list */ 6448 auth_chunks_delete(xfr->task_transfer); 6449 comm_point_delete(xfr->task_transfer->cp); 6450 xfr->task_transfer->cp = NULL; 6451 if(gonextonfail) 6452 xfr_transfer_nextmaster(xfr); 6453 xfr_transfer_nexttarget_or_end(xfr, env); 6454 } 6455 6456 /** return the time taken by the transfer */ 6457 static int 6458 auth_xfer_transfer_time_taken(struct auth_xfer* xfr, struct module_env* env) 6459 { 6460 struct timeval delta; 6461 timeval_subtract(&delta, env->now_tv, &xfr->task_transfer->start_time); 6462 return ((int)delta.tv_sec)*1000 + ((int)delta.tv_usec)/1000; 6463 } 6464 6465 /** callback for task_transfer tcp connections */ 6466 int 6467 auth_xfer_transfer_tcp_callback(struct comm_point* c, void* arg, int err, 6468 struct comm_reply* ATTR_UNUSED(repinfo)) 6469 { 6470 struct auth_xfer* xfr = (struct auth_xfer*)arg; 6471 struct module_env* env; 6472 int gonextonfail = 1; 6473 int transferdone = 0; 6474 log_assert(xfr->task_transfer); 6475 lock_basic_lock(&xfr->lock); 6476 env = xfr->task_transfer->env; 6477 if(!env || env->outnet->want_to_quit) { 6478 lock_basic_unlock(&xfr->lock); 6479 return 0; /* stop on quit */ 6480 } 6481 /* stop the timer */ 6482 comm_timer_disable(xfr->task_transfer->timer); 6483 6484 if(err != NETEVENT_NOERROR) { 6485 /* connection failed, closed, or timeout */ 6486 /* stop this transfer, cleanup 6487 * and continue task_transfer*/ 6488 verbose(VERB_ALGO, "xfr stopped, connection lost to %s", 6489 xfr->task_transfer->master->host); 6490 6491 /* see if IXFR caused the failure, if so, try AXFR */ 6492 if(xfr->task_transfer->on_ixfr) { 6493 xfr->task_transfer->ixfr_possible_timeout_count++; 6494 if(xfr->task_transfer->ixfr_possible_timeout_count >= 6495 NUM_TIMEOUTS_FALLBACK_IXFR) { 6496 verbose(VERB_ALGO, "xfr to %s, fallback " 6497 "from IXFR to AXFR (because of timeouts)", 6498 xfr->task_transfer->master->host); 6499 xfr->task_transfer->ixfr_fail = 1; 6500 gonextonfail = 0; 6501 } 6502 } 6503 6504 failed: 6505 /* delete transferred data from list */ 6506 auth_chunks_delete(xfr->task_transfer); 6507 comm_point_delete(xfr->task_transfer->cp); 6508 xfr->task_transfer->cp = NULL; 6509 if(gonextonfail) 6510 xfr_transfer_nextmaster(xfr); 6511 xfr_transfer_nexttarget_or_end(xfr, env); 6512 return 0; 6513 } 6514 /* note that IXFR worked without timeout */ 6515 if(xfr->task_transfer->on_ixfr) 6516 xfr->task_transfer->ixfr_possible_timeout_count = 0; 6517 6518 /* handle returned packet */ 6519 /* if it fails, cleanup and end this transfer */ 6520 /* if it needs to fallback from IXFR to AXFR, do that */ 6521 if(!check_xfer_packet(c->buffer, xfr, &gonextonfail, &transferdone)) { 6522 goto failed; 6523 } 6524 /* if it is good, link it into the list of data */ 6525 /* if the link into list of data fails (malloc fail) cleanup and end */ 6526 if(!xfer_link_data(c->buffer, xfr)) { 6527 verbose(VERB_ALGO, "xfr stopped to %s, malloc failed", 6528 xfr->task_transfer->master->host); 6529 goto failed; 6530 } 6531 if(xfr->max_transfer_size > 0 && 6532 xfr->task_transfer->chunks_total > xfr->max_transfer_size) { 6533 char zname[LDNS_MAX_DOMAINLEN]; 6534 dname_str(xfr->name, zname); 6535 log_err("auth zone %s transfer from %s exceeded %u bytes, aborting", 6536 zname, xfr->task_transfer->master->host, 6537 (unsigned)xfr->max_transfer_size); 6538 goto failed; 6539 } 6540 /* if the transfer is done now, disconnect and process the list */ 6541 if(transferdone) { 6542 comm_point_delete(xfr->task_transfer->cp); 6543 xfr->task_transfer->cp = NULL; 6544 process_list_end_transfer(xfr, env); 6545 return 0; 6546 } 6547 6548 if(xfr->max_transfer_time > 0 && 6549 auth_xfer_transfer_time_taken(xfr, env) > xfr->max_transfer_time) { 6550 char zname[LDNS_MAX_DOMAINLEN]; 6551 dname_str(xfr->name, zname); 6552 log_err("auth zone %s transfer from %s exceeded %u msec total running time, aborting", 6553 zname, xfr->task_transfer->master->host, 6554 (unsigned)xfr->max_transfer_time); 6555 goto failed; 6556 } 6557 6558 /* if we want to read more messages, setup the commpoint to read 6559 * a DNS packet, and the timeout */ 6560 lock_basic_unlock(&xfr->lock); 6561 c->tcp_is_reading = 1; 6562 sldns_buffer_clear(c->buffer); 6563 comm_point_start_listening(c, -1, AUTH_TRANSFER_TIMEOUT); 6564 return 0; 6565 } 6566 6567 /** callback for task_transfer http connections */ 6568 int 6569 auth_xfer_transfer_http_callback(struct comm_point* c, void* arg, int err, 6570 struct comm_reply* repinfo) 6571 { 6572 struct auth_xfer* xfr = (struct auth_xfer*)arg; 6573 struct module_env* env; 6574 log_assert(xfr->task_transfer); 6575 lock_basic_lock(&xfr->lock); 6576 env = xfr->task_transfer->env; 6577 if(!env || env->outnet->want_to_quit) { 6578 lock_basic_unlock(&xfr->lock); 6579 return 0; /* stop on quit */ 6580 } 6581 verbose(VERB_ALGO, "auth zone transfer http callback"); 6582 /* stop the timer */ 6583 comm_timer_disable(xfr->task_transfer->timer); 6584 6585 if(err != NETEVENT_NOERROR && err != NETEVENT_DONE) { 6586 /* connection failed, closed, or timeout */ 6587 /* stop this transfer, cleanup 6588 * and continue task_transfer*/ 6589 verbose(VERB_ALGO, "http stopped, connection lost to %s", 6590 xfr->task_transfer->master->host); 6591 failed: 6592 /* delete transferred data from list */ 6593 auth_chunks_delete(xfr->task_transfer); 6594 if(repinfo) repinfo->c = NULL; /* signal cp deleted to 6595 the routine calling this callback */ 6596 comm_point_delete(xfr->task_transfer->cp); 6597 xfr->task_transfer->cp = NULL; 6598 xfr_transfer_nextmaster(xfr); 6599 xfr_transfer_nexttarget_or_end(xfr, env); 6600 return 0; 6601 } 6602 6603 /* if it is good, link it into the list of data */ 6604 /* if the link into list of data fails (malloc fail) cleanup and end */ 6605 if(sldns_buffer_limit(c->buffer) > 0) { 6606 verbose(VERB_ALGO, "auth zone http queued up %d bytes", 6607 (int)sldns_buffer_limit(c->buffer)); 6608 if(!xfer_link_data(c->buffer, xfr)) { 6609 verbose(VERB_ALGO, "http stopped to %s, malloc failed", 6610 xfr->task_transfer->master->host); 6611 goto failed; 6612 } 6613 if(xfr->max_transfer_size > 0 && 6614 xfr->task_transfer->chunks_total > xfr->max_transfer_size) { 6615 char zname[LDNS_MAX_DOMAINLEN]; 6616 dname_str(xfr->name, zname); 6617 log_err("auth zone %s http %s/%s exceeded %u bytes, aborting", 6618 zname, xfr->task_transfer->master->host, 6619 xfr->task_transfer->master->file, 6620 (unsigned)xfr->max_transfer_size); 6621 goto failed; 6622 } 6623 } 6624 /* if the transfer is done now, disconnect and process the list */ 6625 if(err == NETEVENT_DONE) { 6626 if(repinfo) repinfo->c = NULL; /* signal cp deleted to 6627 the routine calling this callback */ 6628 comm_point_delete(xfr->task_transfer->cp); 6629 xfr->task_transfer->cp = NULL; 6630 process_list_end_transfer(xfr, env); 6631 return 0; 6632 } 6633 6634 if(xfr->max_transfer_time > 0 && 6635 auth_xfer_transfer_time_taken(xfr, env) > xfr->max_transfer_time) { 6636 char zname[LDNS_MAX_DOMAINLEN]; 6637 dname_str(xfr->name, zname); 6638 log_err("auth zone %s transfer http %s/%s exceeded %u msec total running time, aborting", 6639 zname, xfr->task_transfer->master->host, 6640 xfr->task_transfer->master->file, 6641 (unsigned)xfr->max_transfer_time); 6642 goto failed; 6643 } 6644 6645 /* if we want to read more messages, setup the commpoint to read 6646 * a DNS packet, and the timeout */ 6647 lock_basic_unlock(&xfr->lock); 6648 c->tcp_is_reading = 1; 6649 sldns_buffer_clear(c->buffer); 6650 comm_point_start_listening(c, -1, AUTH_TRANSFER_TIMEOUT); 6651 return 0; 6652 } 6653 6654 6655 /** start transfer task by this worker , xfr is locked. */ 6656 static void 6657 xfr_start_transfer(struct auth_xfer* xfr, struct module_env* env, 6658 struct auth_master* master) 6659 { 6660 log_assert(xfr->task_transfer != NULL); 6661 log_assert(xfr->task_transfer->worker == NULL); 6662 log_assert(xfr->task_transfer->chunks_first == NULL); 6663 log_assert(xfr->task_transfer->chunks_last == NULL); 6664 xfr->task_transfer->worker = env->worker; 6665 xfr->task_transfer->env = env; 6666 6667 /* init transfer process */ 6668 /* find that master in the transfer's list of masters? */ 6669 xfr_transfer_start_list(xfr, master); 6670 /* start lookup for hostnames in transfer master list */ 6671 xfr_transfer_start_lookups(xfr); 6672 6673 /* initiate TCP, and set timeout on it */ 6674 xfr_transfer_nexttarget_or_end(xfr, env); 6675 } 6676 6677 /** disown task_probe. caller must hold xfr.lock */ 6678 static void 6679 xfr_probe_disown(struct auth_xfer* xfr) 6680 { 6681 /* remove timer (from this worker's event base) */ 6682 comm_timer_delete(xfr->task_probe->timer); 6683 xfr->task_probe->timer = NULL; 6684 /* remove the commpoint */ 6685 comm_point_delete(xfr->task_probe->cp); 6686 xfr->task_probe->cp = NULL; 6687 if(xfr->task_probe->env) 6688 xfr_stop_lookup(&xfr->task_probe->lookup_target, 6689 xfr->task_probe->lookup_unique_info, 6690 xfr->task_probe->lookup_aaaa, xfr->dclass, 6691 xfr->task_probe->env->mesh, 6692 &auth_xfer_probe_lookup_callback, xfr); 6693 /* we don't own this item anymore */ 6694 xfr->task_probe->worker = NULL; 6695 xfr->task_probe->env = NULL; 6696 } 6697 6698 /** send the UDP probe to the master, this is part of task_probe */ 6699 static int 6700 xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env, 6701 int timeout) 6702 { 6703 struct sockaddr_storage addr; 6704 socklen_t addrlen = 0; 6705 struct timeval t; 6706 /* pick master */ 6707 struct auth_master* master = xfr_probe_current_master(xfr); 6708 char *auth_name = NULL; 6709 if(!master) return 0; 6710 if(master->allow_notify) return 0; /* only for notify */ 6711 if(master->http) return 0; /* only masters get SOA UDP probe, 6712 not urls, if those are in this list */ 6713 6714 /* get master addr */ 6715 if(xfr->task_probe->scan_addr) { 6716 addrlen = xfr->task_probe->scan_addr->addrlen; 6717 memmove(&addr, &xfr->task_probe->scan_addr->addr, addrlen); 6718 } else { 6719 if(!authextstrtoaddr(master->host, &addr, &addrlen, &auth_name)) { 6720 /* the ones that are not in addr format are supposed 6721 * to be looked up. The lookup has failed however, 6722 * so skip them */ 6723 char zname[LDNS_MAX_DOMAINLEN]; 6724 dname_str(xfr->name, zname); 6725 log_err("%s: failed lookup, cannot probe to master %s", 6726 zname, master->host); 6727 return 0; 6728 } 6729 if (auth_name != NULL) { 6730 if (addr.ss_family == AF_INET 6731 && (int)ntohs(((struct sockaddr_in *)&addr)->sin_port) 6732 == env->cfg->ssl_port) 6733 ((struct sockaddr_in *)&addr)->sin_port 6734 = htons((uint16_t)env->cfg->port); 6735 else if (addr.ss_family == AF_INET6 6736 && (int)ntohs(((struct sockaddr_in6 *)&addr)->sin6_port) 6737 == env->cfg->ssl_port) 6738 ((struct sockaddr_in6 *)&addr)->sin6_port 6739 = htons((uint16_t)env->cfg->port); 6740 } 6741 } 6742 6743 /* create packet */ 6744 /* create new ID for new probes, but not on timeout retries, 6745 * this means we'll accept replies to previous retries to same ip */ 6746 if(timeout == AUTH_PROBE_TIMEOUT) 6747 xfr->task_probe->id = GET_RANDOM_ID(env->rnd); 6748 xfr_create_soa_probe_packet(xfr, env->scratch_buffer, 6749 xfr->task_probe->id); 6750 /* we need to remove the cp if we have a different ip4/ip6 type now */ 6751 if(xfr->task_probe->cp && 6752 ((xfr->task_probe->cp_is_ip6 && !addr_is_ip6(&addr, addrlen)) || 6753 (!xfr->task_probe->cp_is_ip6 && addr_is_ip6(&addr, addrlen))) 6754 ) { 6755 comm_point_delete(xfr->task_probe->cp); 6756 xfr->task_probe->cp = NULL; 6757 } 6758 if(!xfr->task_probe->cp) { 6759 if(addr_is_ip6(&addr, addrlen)) 6760 xfr->task_probe->cp_is_ip6 = 1; 6761 else xfr->task_probe->cp_is_ip6 = 0; 6762 xfr->task_probe->cp = outnet_comm_point_for_udp(env->outnet, 6763 auth_xfer_probe_udp_callback, xfr, &addr, addrlen); 6764 if(!xfr->task_probe->cp) { 6765 char zname[LDNS_MAX_DOMAINLEN], as[256]; 6766 dname_str(xfr->name, zname); 6767 addr_port_to_str(&addr, addrlen, as, sizeof(as)); 6768 verbose(VERB_ALGO, "cannot create udp cp for " 6769 "probe %s to %s", zname, as); 6770 return 0; 6771 } 6772 } 6773 if(!xfr->task_probe->timer) { 6774 xfr->task_probe->timer = comm_timer_create(env->worker_base, 6775 auth_xfer_probe_timer_callback, xfr); 6776 if(!xfr->task_probe->timer) { 6777 log_err("malloc failure"); 6778 return 0; 6779 } 6780 } 6781 6782 /* send udp packet */ 6783 if(!comm_point_send_udp_msg(xfr->task_probe->cp, env->scratch_buffer, 6784 (struct sockaddr*)&addr, addrlen, 0)) { 6785 char zname[LDNS_MAX_DOMAINLEN], as[256]; 6786 dname_str(xfr->name, zname); 6787 addr_port_to_str(&addr, addrlen, as, sizeof(as)); 6788 verbose(VERB_ALGO, "failed to send soa probe for %s to %s", 6789 zname, as); 6790 return 0; 6791 } 6792 if(verbosity >= VERB_ALGO) { 6793 char zname[LDNS_MAX_DOMAINLEN], as[256]; 6794 dname_str(xfr->name, zname); 6795 addr_port_to_str(&addr, addrlen, as, sizeof(as)); 6796 verbose(VERB_ALGO, "auth zone %s soa probe sent to %s", zname, 6797 as); 6798 } 6799 xfr->task_probe->timeout = timeout; 6800 #ifndef S_SPLINT_S 6801 t.tv_sec = timeout/1000; 6802 t.tv_usec = (timeout%1000)*1000; 6803 #endif 6804 comm_timer_set(xfr->task_probe->timer, &t); 6805 6806 return 1; 6807 } 6808 6809 /** callback for task_probe timer */ 6810 void 6811 auth_xfer_probe_timer_callback(void* arg) 6812 { 6813 struct auth_xfer* xfr = (struct auth_xfer*)arg; 6814 struct module_env* env; 6815 log_assert(xfr->task_probe); 6816 lock_basic_lock(&xfr->lock); 6817 env = xfr->task_probe->env; 6818 if(!env || env->outnet->want_to_quit) { 6819 lock_basic_unlock(&xfr->lock); 6820 return; /* stop on quit */ 6821 } 6822 6823 if(verbosity >= VERB_ALGO) { 6824 char zname[LDNS_MAX_DOMAINLEN]; 6825 dname_str(xfr->name, zname); 6826 verbose(VERB_ALGO, "auth zone %s soa probe timeout", zname); 6827 } 6828 if(xfr->task_probe->timeout <= AUTH_PROBE_TIMEOUT_STOP) { 6829 /* try again with bigger timeout */ 6830 if(xfr_probe_send_probe(xfr, env, xfr->task_probe->timeout*2)) { 6831 lock_basic_unlock(&xfr->lock); 6832 return; 6833 } 6834 } 6835 /* delete commpoint so a new one is created, with a fresh port nr */ 6836 comm_point_delete(xfr->task_probe->cp); 6837 xfr->task_probe->cp = NULL; 6838 6839 /* too many timeouts (or fail to send), move to next or end */ 6840 xfr_probe_nextmaster(xfr); 6841 xfr_probe_send_or_end(xfr, env); 6842 } 6843 6844 /** callback for task_probe udp packets */ 6845 int 6846 auth_xfer_probe_udp_callback(struct comm_point* c, void* arg, int err, 6847 struct comm_reply* repinfo) 6848 { 6849 struct auth_xfer* xfr = (struct auth_xfer*)arg; 6850 struct module_env* env; 6851 log_assert(xfr->task_probe); 6852 lock_basic_lock(&xfr->lock); 6853 env = xfr->task_probe->env; 6854 if(!env || env->outnet->want_to_quit) { 6855 lock_basic_unlock(&xfr->lock); 6856 return 0; /* stop on quit */ 6857 } 6858 6859 /* the comm_point_udp_callback is in a for loop for NUM_UDP_PER_SELECT 6860 * and we set rep.c=NULL to stop if from looking inside the commpoint*/ 6861 repinfo->c = NULL; 6862 /* stop the timer */ 6863 comm_timer_disable(xfr->task_probe->timer); 6864 6865 /* see if we got a packet and what that means */ 6866 if(err == NETEVENT_NOERROR) { 6867 uint32_t serial = 0; 6868 if(check_packet_ok(c->buffer, LDNS_RR_TYPE_SOA, xfr, 6869 &serial)) { 6870 /* successful lookup */ 6871 if(verbosity >= VERB_ALGO) { 6872 char buf[LDNS_MAX_DOMAINLEN]; 6873 dname_str(xfr->name, buf); 6874 verbose(VERB_ALGO, "auth zone %s: soa probe " 6875 "serial is %u", buf, (unsigned)serial); 6876 } 6877 /* see if this serial indicates that the zone has 6878 * to be updated */ 6879 if(xfr_serial_means_update(xfr, serial)) { 6880 /* if updated, start the transfer task, if needed */ 6881 verbose(VERB_ALGO, "auth_zone updated, start transfer"); 6882 if(xfr->task_transfer->worker == NULL) { 6883 struct auth_master* master = 6884 xfr_probe_current_master(xfr); 6885 /* if we have download URLs use them 6886 * in preference to this master we 6887 * just probed the SOA from */ 6888 if(xfr->task_transfer->masters && 6889 xfr->task_transfer->masters->http) 6890 master = NULL; 6891 xfr_probe_disown(xfr); 6892 xfr_start_transfer(xfr, env, master); 6893 return 0; 6894 6895 } 6896 /* other tasks are running, we don't do this anymore */ 6897 xfr_probe_disown(xfr); 6898 lock_basic_unlock(&xfr->lock); 6899 /* return, we don't sent a reply to this udp packet, 6900 * and we setup the tasks to do next */ 6901 return 0; 6902 } else { 6903 verbose(VERB_ALGO, "auth_zone master reports unchanged soa serial"); 6904 /* we if cannot find updates amongst the 6905 * masters, this means we then have a new lease 6906 * on the zone */ 6907 xfr->task_probe->have_new_lease = 1; 6908 } 6909 } else { 6910 if(verbosity >= VERB_ALGO) { 6911 char buf[LDNS_MAX_DOMAINLEN]; 6912 dname_str(xfr->name, buf); 6913 verbose(VERB_ALGO, "auth zone %s: bad reply to soa probe", buf); 6914 } 6915 } 6916 } else { 6917 if(verbosity >= VERB_ALGO) { 6918 char buf[LDNS_MAX_DOMAINLEN]; 6919 dname_str(xfr->name, buf); 6920 verbose(VERB_ALGO, "auth zone %s: soa probe failed", buf); 6921 } 6922 } 6923 6924 /* failed lookup or not an update */ 6925 /* delete commpoint so a new one is created, with a fresh port nr */ 6926 comm_point_delete(xfr->task_probe->cp); 6927 xfr->task_probe->cp = NULL; 6928 6929 /* if the result was not a successful probe, we need 6930 * to send the next one */ 6931 xfr_probe_nextmaster(xfr); 6932 xfr_probe_send_or_end(xfr, env); 6933 return 0; 6934 } 6935 6936 /** lookup a host name for its addresses, if needed */ 6937 static int 6938 xfr_probe_lookup_host(struct auth_xfer* xfr, struct module_env* env) 6939 { 6940 struct sockaddr_storage addr; 6941 socklen_t addrlen = 0; 6942 struct auth_master* master = xfr->task_probe->lookup_target; 6943 struct query_info qinfo; 6944 uint16_t qflags = BIT_RD; 6945 uint8_t dname[LDNS_MAX_DOMAINLEN+1]; 6946 struct edns_data edns; 6947 sldns_buffer* buf = env->scratch_buffer; 6948 if(!master) return 0; 6949 if(extstrtoaddr(master->host, &addr, &addrlen, UNBOUND_DNS_PORT)) { 6950 /* not needed, host is in IP addr format */ 6951 return 0; 6952 } 6953 if(master->allow_notify && !master->http && 6954 strchr(master->host, '/') != NULL && 6955 strchr(master->host, '/') == strrchr(master->host, '/')) { 6956 return 0; /* is IP/prefix format, not something to look up */ 6957 } 6958 6959 /* use mesh_new_callback to probe for non-addr hosts, 6960 * and then wait for them to be looked up (in cache, or query) */ 6961 qinfo.qname_len = sizeof(dname); 6962 if(sldns_str2wire_dname_buf(master->host, dname, &qinfo.qname_len) 6963 != 0) { 6964 log_err("cannot parse host name of master %s", master->host); 6965 return 0; 6966 } 6967 qinfo.qname = dname; 6968 qinfo.qclass = xfr->dclass; 6969 qinfo.qtype = LDNS_RR_TYPE_A; 6970 if(xfr->task_probe->lookup_aaaa) 6971 qinfo.qtype = LDNS_RR_TYPE_AAAA; 6972 qinfo.local_alias = NULL; 6973 if(verbosity >= VERB_ALGO) { 6974 char buf1[512]; 6975 char buf2[LDNS_MAX_DOMAINLEN]; 6976 dname_str(xfr->name, buf2); 6977 snprintf(buf1, sizeof(buf1), "auth zone %s: master lookup" 6978 " for task_probe", buf2); 6979 log_query_info(VERB_ALGO, buf1, &qinfo); 6980 } 6981 edns.edns_present = 1; 6982 edns.ext_rcode = 0; 6983 edns.edns_version = 0; 6984 edns.bits = EDNS_DO; 6985 edns.opt_list_in = NULL; 6986 edns.opt_list_out = NULL; 6987 edns.opt_list_inplace_cb_out = NULL; 6988 edns.padding_block_size = 0; 6989 edns.cookie_present = 0; 6990 edns.cookie_valid = 0; 6991 if(sldns_buffer_capacity(buf) < 65535) 6992 edns.udp_size = (uint16_t)sldns_buffer_capacity(buf); 6993 else edns.udp_size = 65535; 6994 6995 /* unlock xfr during mesh_new_callback() because the callback can be 6996 * called straight away */ 6997 lock_basic_unlock(&xfr->lock); 6998 if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0, 6999 &auth_xfer_probe_lookup_callback, xfr, 0, 7000 &xfr->task_probe->lookup_unique_info)) { 7001 lock_basic_lock(&xfr->lock); 7002 log_err("out of memory lookup up master %s", master->host); 7003 return 0; 7004 } 7005 lock_basic_lock(&xfr->lock); 7006 return 1; 7007 } 7008 7009 /** return true if there are probe (SOA UDP query) targets in the master list*/ 7010 static int 7011 have_probe_targets(struct auth_master* list) 7012 { 7013 struct auth_master* p; 7014 for(p=list; p; p = p->next) { 7015 if(!p->allow_notify && p->host) 7016 return 1; 7017 } 7018 return 0; 7019 } 7020 7021 /** move to sending the probe packets, next if fails. task_probe */ 7022 static void 7023 xfr_probe_send_or_end(struct auth_xfer* xfr, struct module_env* env) 7024 { 7025 /* are we doing hostname lookups? */ 7026 while(xfr->task_probe->lookup_target) { 7027 if(xfr_probe_lookup_host(xfr, env)) { 7028 /* wait for lookup to finish, 7029 * note that the hostname may be in unbound's cache 7030 * and we may then get an instant cache response, 7031 * and that calls the callback just like a full 7032 * lookup and lookup failures also call callback */ 7033 if(verbosity >= VERB_ALGO) { 7034 char zname[LDNS_MAX_DOMAINLEN]; 7035 dname_str(xfr->name, zname); 7036 verbose(VERB_ALGO, "auth zone %s probe next target lookup", zname); 7037 } 7038 lock_basic_unlock(&xfr->lock); 7039 return; 7040 } 7041 xfr_probe_move_to_next_lookup(xfr, env); 7042 } 7043 /* probe of list has ended. Create or refresh the list of of 7044 * allow_notify addrs */ 7045 probe_copy_masters_for_allow_notify(xfr); 7046 if(verbosity >= VERB_ALGO) { 7047 char zname[LDNS_MAX_DOMAINLEN]; 7048 dname_str(xfr->name, zname); 7049 verbose(VERB_ALGO, "auth zone %s probe: notify addrs updated", zname); 7050 } 7051 if(xfr->task_probe->only_lookup) { 7052 /* only wanted lookups for copy, stop probe and start wait */ 7053 xfr->task_probe->only_lookup = 0; 7054 if(verbosity >= VERB_ALGO) { 7055 char zname[LDNS_MAX_DOMAINLEN]; 7056 dname_str(xfr->name, zname); 7057 verbose(VERB_ALGO, "auth zone %s probe: finished only_lookup", zname); 7058 } 7059 xfr_probe_disown(xfr); 7060 if(!have_probe_targets(xfr->task_probe->masters)) { 7061 /* If there are no masters to probe, go to transfer. */ 7062 if(xfr->task_transfer->worker == NULL) { 7063 xfr_start_transfer(xfr, env, NULL); 7064 return; 7065 } 7066 /* The transfer is already in progress. */ 7067 lock_basic_unlock(&xfr->lock); 7068 return; 7069 } 7070 if(xfr->task_nextprobe->worker == NULL) 7071 xfr_set_timeout(xfr, env, 0, 0); 7072 lock_basic_unlock(&xfr->lock); 7073 return; 7074 } 7075 7076 /* send probe packets */ 7077 while(!xfr_probe_end_of_list(xfr)) { 7078 if(xfr_probe_send_probe(xfr, env, AUTH_PROBE_TIMEOUT)) { 7079 /* successfully sent probe, wait for callback */ 7080 lock_basic_unlock(&xfr->lock); 7081 return; 7082 } 7083 /* failed to send probe, next master */ 7084 xfr_probe_nextmaster(xfr); 7085 } 7086 7087 /* done with probe sequence, wait */ 7088 if(xfr->task_probe->have_new_lease) { 7089 /* if zone not updated, start the wait timer again */ 7090 if(verbosity >= VERB_ALGO) { 7091 char zname[LDNS_MAX_DOMAINLEN]; 7092 dname_str(xfr->name, zname); 7093 verbose(VERB_ALGO, "auth_zone %s unchanged, new lease, wait", zname); 7094 } 7095 xfr_probe_disown(xfr); 7096 if(xfr->have_zone) 7097 xfr->lease_time = *env->now; 7098 if(xfr->task_nextprobe->worker == NULL) 7099 xfr_set_timeout(xfr, env, 0, 0); 7100 } else { 7101 if(verbosity >= VERB_ALGO) { 7102 char zname[LDNS_MAX_DOMAINLEN]; 7103 dname_str(xfr->name, zname); 7104 verbose(VERB_ALGO, "auth zone %s soa probe failed, wait to retry", zname); 7105 } 7106 /* we failed to send this as well, move to the wait task, 7107 * use the shorter retry timeout */ 7108 xfr_probe_disown(xfr); 7109 /* pick up the nextprobe task and wait */ 7110 if(xfr->task_nextprobe->worker == NULL) 7111 xfr_set_timeout(xfr, env, 1, 0); 7112 } 7113 7114 lock_basic_unlock(&xfr->lock); 7115 } 7116 7117 /** callback for task_probe lookup of host name, of A or AAAA */ 7118 void auth_xfer_probe_lookup_callback(void* arg, int rcode, sldns_buffer* buf, 7119 enum sec_status sec, char* why_bogus, int ATTR_UNUSED(was_ratelimited)) 7120 { 7121 struct auth_xfer* xfr = (struct auth_xfer*)arg; 7122 struct module_env* env; 7123 log_assert(xfr->task_probe); 7124 lock_basic_lock(&xfr->lock); 7125 env = xfr->task_probe->env; 7126 if(!env || env->outnet->want_to_quit) { 7127 lock_basic_unlock(&xfr->lock); 7128 return; /* stop on quit */ 7129 } 7130 7131 /* process result */ 7132 if(sec == sec_status_bogus || sec == sec_status_secure_sentinel_fail) { 7133 if(verbosity >= VERB_OPS) { 7134 char zname[LDNS_MAX_DOMAINLEN]; 7135 dname_str(xfr->name, zname); 7136 verbose(VERB_OPS, "auth zone %s: primary %s address probe lookup is DNSSEC bogus: %s", 7137 zname, xfr->task_probe->lookup_target->host, 7138 (why_bogus?why_bogus:"")); 7139 } 7140 /* fall through to next-lookup / next-master */ 7141 } else if(rcode == LDNS_RCODE_NOERROR) { 7142 uint16_t wanted_qtype = LDNS_RR_TYPE_A; 7143 struct regional* temp = env->scratch; 7144 struct query_info rq; 7145 struct reply_info* rep; 7146 if(xfr->task_probe->lookup_aaaa) 7147 wanted_qtype = LDNS_RR_TYPE_AAAA; 7148 memset(&rq, 0, sizeof(rq)); 7149 rep = parse_reply_in_temp_region(buf, temp, &rq); 7150 if(rep && rq.qtype == wanted_qtype && 7151 FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR) { 7152 /* parsed successfully */ 7153 struct ub_packed_rrset_key* answer = 7154 reply_find_answer_rrset(&rq, rep); 7155 if(answer && xfer_target_equals_answer_name( 7156 xfr->task_probe->lookup_target, answer, 7157 &rq, rep)) { 7158 xfr_master_add_addrs(xfr->task_probe-> 7159 lookup_target, answer, wanted_qtype); 7160 } else if(answer) { 7161 if(verbosity >= VERB_ALGO) { 7162 char zname[LDNS_MAX_DOMAINLEN]; 7163 dname_str(xfr->name, zname); 7164 verbose(VERB_ALGO, "auth zone %s host %s type %s probe lookup has mismatch in answer name", zname, ((xfr->task_probe->lookup_target && xfr->task_probe->lookup_target->host) ? xfr->task_probe->lookup_target->host : "null"), (xfr->task_probe->lookup_aaaa?"AAAA":"A")); 7165 } 7166 } else { 7167 if(verbosity >= VERB_ALGO) { 7168 char zname[LDNS_MAX_DOMAINLEN]; 7169 dname_str(xfr->name, zname); 7170 verbose(VERB_ALGO, "auth zone %s host %s type %s probe lookup has nodata", zname, ((xfr->task_probe->lookup_target && xfr->task_probe->lookup_target->host) ? xfr->task_probe->lookup_target->host : "null"), (xfr->task_probe->lookup_aaaa?"AAAA":"A")); 7171 } 7172 } 7173 } else { 7174 if(verbosity >= VERB_ALGO) { 7175 char zname[LDNS_MAX_DOMAINLEN]; 7176 dname_str(xfr->name, zname); 7177 verbose(VERB_ALGO, "auth zone %s host %s type %s probe lookup has no address", zname, ((xfr->task_probe->lookup_target && xfr->task_probe->lookup_target->host) ? xfr->task_probe->lookup_target->host : "null"), (xfr->task_probe->lookup_aaaa?"AAAA":"A")); 7178 } 7179 } 7180 regional_free_all(temp); 7181 } else { 7182 if(verbosity >= VERB_ALGO) { 7183 char zname[LDNS_MAX_DOMAINLEN]; 7184 dname_str(xfr->name, zname); 7185 verbose(VERB_ALGO, "auth zone %s host %s type %s probe lookup failed", zname, ((xfr->task_probe->lookup_target && xfr->task_probe->lookup_target->host) ? xfr->task_probe->lookup_target->host : "null"), (xfr->task_probe->lookup_aaaa?"AAAA":"A")); 7186 } 7187 } 7188 if(xfr->task_probe->lookup_target && 7189 xfr->task_probe->lookup_target->list && 7190 xfr->task_probe->lookup_target == xfr_probe_current_master(xfr)) 7191 xfr->task_probe->scan_addr = xfr->task_probe->lookup_target->list; 7192 7193 /* move to lookup AAAA after A lookup, move to next hostname lookup, 7194 * or move to send the probes, or, if nothing to do, end task_probe */ 7195 xfr_probe_move_to_next_lookup(xfr, env); 7196 xfr_probe_send_or_end(xfr, env); 7197 } 7198 7199 /** disown task_nextprobe. caller must hold xfr.lock */ 7200 static void 7201 xfr_nextprobe_disown(struct auth_xfer* xfr) 7202 { 7203 /* delete the timer, because the next worker to pick this up may 7204 * not have the same event base */ 7205 comm_timer_delete(xfr->task_nextprobe->timer); 7206 xfr->task_nextprobe->timer = NULL; 7207 xfr->task_nextprobe->next_probe = 0; 7208 /* we don't own this item anymore */ 7209 xfr->task_nextprobe->worker = NULL; 7210 xfr->task_nextprobe->env = NULL; 7211 } 7212 7213 /** xfer nextprobe timeout callback, this is part of task_nextprobe */ 7214 void 7215 auth_xfer_timer(void* arg) 7216 { 7217 struct auth_xfer* xfr = (struct auth_xfer*)arg; 7218 struct module_env* env; 7219 log_assert(xfr->task_nextprobe); 7220 lock_basic_lock(&xfr->lock); 7221 env = xfr->task_nextprobe->env; 7222 if(!env || env->outnet->want_to_quit) { 7223 lock_basic_unlock(&xfr->lock); 7224 return; /* stop on quit */ 7225 } 7226 7227 /* see if zone has expired, and if so, also set auth_zone expired */ 7228 if(xfr->have_zone && !xfr->zone_expired && 7229 *env->now >= xfr->lease_time + xfr->expiry) { 7230 lock_basic_unlock(&xfr->lock); 7231 auth_xfer_set_expired(xfr, env, 1); 7232 lock_basic_lock(&xfr->lock); 7233 } 7234 7235 xfr_nextprobe_disown(xfr); 7236 7237 if(!xfr_start_probe(xfr, env, NULL)) { 7238 /* not started because already in progress */ 7239 lock_basic_unlock(&xfr->lock); 7240 } 7241 } 7242 7243 /** start task_probe if possible, if no masters for probe start task_transfer 7244 * returns true if task has been started, and false if the task is already 7245 * in progress. */ 7246 static int 7247 xfr_start_probe(struct auth_xfer* xfr, struct module_env* env, 7248 struct auth_master* spec) 7249 { 7250 /* see if we need to start a probe (or maybe it is already in 7251 * progress (due to notify)) */ 7252 if(xfr->task_probe->worker == NULL) { 7253 if(!have_probe_targets(xfr->task_probe->masters) && 7254 xfr->task_probe->masters != NULL) 7255 xfr->task_probe->only_lookup = 1; 7256 if(!xfr->task_probe->only_lookup && 7257 !have_probe_targets(xfr->task_probe->masters)) { 7258 /* useless to pick up task_probe, no masters to 7259 * probe. Instead attempt to pick up task transfer */ 7260 if(xfr->task_transfer->worker == NULL) { 7261 xfr_start_transfer(xfr, env, spec); 7262 return 1; 7263 } 7264 /* task transfer already in progress */ 7265 return 0; 7266 } 7267 7268 /* pick up the probe task ourselves */ 7269 xfr->task_probe->worker = env->worker; 7270 xfr->task_probe->env = env; 7271 xfr->task_probe->cp = NULL; 7272 7273 /* start the task */ 7274 /* have not seen a new lease yet, this scan */ 7275 xfr->task_probe->have_new_lease = 0; 7276 /* if this was a timeout, no specific first master to scan */ 7277 /* otherwise, spec is nonNULL the notified master, scan 7278 * first and also transfer first from it */ 7279 xfr_probe_start_list(xfr, spec); 7280 /* setup to start the lookup of hostnames of masters afresh */ 7281 xfr_probe_start_lookups(xfr); 7282 /* send the probe packet or next send, or end task */ 7283 xfr_probe_send_or_end(xfr, env); 7284 return 1; 7285 } 7286 return 0; 7287 } 7288 7289 /** for task_nextprobe. 7290 * determine next timeout for auth_xfer. Also (re)sets timer. 7291 * @param xfr: task structure 7292 * @param env: module environment, with worker and time. 7293 * @param failure: set true if timer should be set for failure retry. 7294 * @param lookup_only: only perform lookups when timer done, 0 sec timeout 7295 */ 7296 static void 7297 xfr_set_timeout(struct auth_xfer* xfr, struct module_env* env, 7298 int failure, int lookup_only) 7299 { 7300 struct timeval tv; 7301 log_assert(xfr->task_nextprobe != NULL); 7302 log_assert(xfr->task_nextprobe->worker == NULL || 7303 xfr->task_nextprobe->worker == env->worker); 7304 /* normally, nextprobe = startoflease + refresh, 7305 * but if expiry is sooner, use that one. 7306 * after a failure, use the retry timer instead. */ 7307 xfr->task_nextprobe->next_probe = *env->now; 7308 if(xfr->lease_time && !failure) 7309 xfr->task_nextprobe->next_probe = xfr->lease_time; 7310 7311 if(!failure) { 7312 xfr->task_nextprobe->backoff = 0; 7313 } else { 7314 if(xfr->task_nextprobe->backoff == 0) 7315 xfr->task_nextprobe->backoff = 3; 7316 else xfr->task_nextprobe->backoff *= 2; 7317 if(xfr->task_nextprobe->backoff > AUTH_TRANSFER_MAX_BACKOFF) 7318 xfr->task_nextprobe->backoff = 7319 AUTH_TRANSFER_MAX_BACKOFF; 7320 } 7321 7322 if(xfr->have_zone) { 7323 time_t wait = xfr->refresh; 7324 if(failure) wait = xfr->retry; 7325 if(xfr->expiry < wait) 7326 xfr->task_nextprobe->next_probe += xfr->expiry; 7327 else xfr->task_nextprobe->next_probe += wait; 7328 if(failure) 7329 xfr->task_nextprobe->next_probe += 7330 xfr->task_nextprobe->backoff; 7331 /* put the timer exactly on expiry, if possible */ 7332 if(xfr->lease_time && xfr->lease_time+xfr->expiry < 7333 xfr->task_nextprobe->next_probe && 7334 xfr->lease_time+xfr->expiry > *env->now) 7335 xfr->task_nextprobe->next_probe = 7336 xfr->lease_time+xfr->expiry; 7337 } else { 7338 xfr->task_nextprobe->next_probe += 7339 xfr->task_nextprobe->backoff; 7340 } 7341 7342 if(!xfr->task_nextprobe->timer) { 7343 xfr->task_nextprobe->timer = comm_timer_create( 7344 env->worker_base, auth_xfer_timer, xfr); 7345 if(!xfr->task_nextprobe->timer) { 7346 /* failed to malloc memory. likely zone transfer 7347 * also fails for that. skip the timeout */ 7348 char zname[LDNS_MAX_DOMAINLEN]; 7349 dname_str(xfr->name, zname); 7350 log_err("cannot allocate timer, no refresh for %s", 7351 zname); 7352 return; 7353 } 7354 } 7355 xfr->task_nextprobe->worker = env->worker; 7356 xfr->task_nextprobe->env = env; 7357 if(*(xfr->task_nextprobe->env->now) <= xfr->task_nextprobe->next_probe) 7358 tv.tv_sec = xfr->task_nextprobe->next_probe - 7359 *(xfr->task_nextprobe->env->now); 7360 else tv.tv_sec = 0; 7361 if(tv.tv_sec != 0 && lookup_only && xfr->task_probe->masters) { 7362 /* don't lookup_only, if lookup timeout is 0 anyway, 7363 * or if we don't have masters to lookup */ 7364 tv.tv_sec = 0; 7365 if(xfr->task_probe->worker == NULL) 7366 xfr->task_probe->only_lookup = 1; 7367 } 7368 if(verbosity >= VERB_ALGO) { 7369 char zname[LDNS_MAX_DOMAINLEN]; 7370 dname_str(xfr->name, zname); 7371 verbose(VERB_ALGO, "auth zone %s timeout in %d seconds", 7372 zname, (int)tv.tv_sec); 7373 } 7374 tv.tv_usec = 0; 7375 comm_timer_set(xfr->task_nextprobe->timer, &tv); 7376 } 7377 7378 void auth_zone_pickup_initial_zone(struct auth_zone* z, struct module_env* env) 7379 { 7380 /* Set the time, because we now have timestamp in env, 7381 * (not earlier during startup and apply_cfg), and this 7382 * notes the start time when the data was acquired. */ 7383 z->soa_zone_acquired = *env->now; 7384 } 7385 7386 void auth_xfer_pickup_initial_zone(struct auth_xfer* x, struct module_env* env) 7387 { 7388 /* set lease_time, because we now have timestamp in env, 7389 * (not earlier during startup and apply_cfg), and this 7390 * notes the start time when the data was acquired */ 7391 if(x->have_zone) { 7392 x->lease_time = *env->now; 7393 x->soa_zone_acquired = *env->now; 7394 } 7395 if(x->task_nextprobe && x->task_nextprobe->worker == NULL) { 7396 xfr_set_timeout(x, env, 0, 1); 7397 } 7398 } 7399 7400 /** initial pick up of worker timeouts, ties events to worker event loop */ 7401 void 7402 auth_xfer_pickup_initial(struct auth_zones* az, struct module_env* env) 7403 { 7404 struct auth_xfer* x; 7405 struct auth_zone* z; 7406 lock_rw_wrlock(&az->lock); 7407 RBTREE_FOR(z, struct auth_zone*, &az->ztree) { 7408 lock_rw_wrlock(&z->lock); 7409 auth_zone_pickup_initial_zone(z, env); 7410 lock_rw_unlock(&z->lock); 7411 } 7412 RBTREE_FOR(x, struct auth_xfer*, &az->xtree) { 7413 lock_basic_lock(&x->lock); 7414 auth_xfer_pickup_initial_zone(x, env); 7415 lock_basic_unlock(&x->lock); 7416 } 7417 lock_rw_unlock(&az->lock); 7418 } 7419 7420 void auth_zones_cleanup(struct auth_zones* az) 7421 { 7422 struct auth_xfer* x; 7423 lock_rw_wrlock(&az->lock); 7424 RBTREE_FOR(x, struct auth_xfer*, &az->xtree) { 7425 lock_basic_lock(&x->lock); 7426 if(x->task_nextprobe && x->task_nextprobe->worker != NULL) { 7427 xfr_nextprobe_disown(x); 7428 } 7429 if(x->task_probe && x->task_probe->worker != NULL) { 7430 xfr_probe_disown(x); 7431 } 7432 if(x->task_transfer && x->task_transfer->worker != NULL) { 7433 auth_chunks_delete(x->task_transfer); 7434 xfr_transfer_disown(x); 7435 } 7436 lock_basic_unlock(&x->lock); 7437 } 7438 lock_rw_unlock(&az->lock); 7439 } 7440 7441 /** 7442 * malloc the xfer and tasks 7443 * @param z: auth_zone with name of zone. 7444 */ 7445 static struct auth_xfer* 7446 auth_xfer_new(struct auth_zone* z) 7447 { 7448 struct auth_xfer* xfr; 7449 xfr = (struct auth_xfer*)calloc(1, sizeof(*xfr)); 7450 if(!xfr) return NULL; 7451 xfr->name = memdup(z->name, z->namelen); 7452 if(!xfr->name) { 7453 free(xfr); 7454 return NULL; 7455 } 7456 xfr->node.key = xfr; 7457 xfr->namelen = z->namelen; 7458 xfr->namelabs = z->namelabs; 7459 xfr->dclass = z->dclass; 7460 xfr->max_transfer_size = z->max_transfer_size; 7461 xfr->max_transfer_time = z->max_transfer_time; 7462 7463 xfr->task_nextprobe = (struct auth_nextprobe*)calloc(1, 7464 sizeof(struct auth_nextprobe)); 7465 if(!xfr->task_nextprobe) { 7466 free(xfr->name); 7467 free(xfr); 7468 return NULL; 7469 } 7470 xfr->task_probe = (struct auth_probe*)calloc(1, 7471 sizeof(struct auth_probe)); 7472 if(!xfr->task_probe) { 7473 free(xfr->task_nextprobe); 7474 free(xfr->name); 7475 free(xfr); 7476 return NULL; 7477 } 7478 xfr->task_transfer = (struct auth_transfer*)calloc(1, 7479 sizeof(struct auth_transfer)); 7480 if(!xfr->task_transfer) { 7481 free(xfr->task_probe); 7482 free(xfr->task_nextprobe); 7483 free(xfr->name); 7484 free(xfr); 7485 return NULL; 7486 } 7487 7488 lock_basic_init(&xfr->lock); 7489 lock_protect(&xfr->lock, &xfr->name, sizeof(xfr->name)); 7490 lock_protect(&xfr->lock, &xfr->namelen, sizeof(xfr->namelen)); 7491 lock_protect(&xfr->lock, xfr->name, xfr->namelen); 7492 lock_protect(&xfr->lock, &xfr->namelabs, sizeof(xfr->namelabs)); 7493 lock_protect(&xfr->lock, &xfr->dclass, sizeof(xfr->dclass)); 7494 lock_protect(&xfr->lock, &xfr->notify_received, sizeof(xfr->notify_received)); 7495 lock_protect(&xfr->lock, &xfr->notify_serial, sizeof(xfr->notify_serial)); 7496 lock_protect(&xfr->lock, &xfr->zone_expired, sizeof(xfr->zone_expired)); 7497 lock_protect(&xfr->lock, &xfr->have_zone, sizeof(xfr->have_zone)); 7498 lock_protect(&xfr->lock, &xfr->soa_zone_acquired, sizeof(xfr->soa_zone_acquired)); 7499 lock_protect(&xfr->lock, &xfr->serial, sizeof(xfr->serial)); 7500 lock_protect(&xfr->lock, &xfr->retry, sizeof(xfr->retry)); 7501 lock_protect(&xfr->lock, &xfr->refresh, sizeof(xfr->refresh)); 7502 lock_protect(&xfr->lock, &xfr->expiry, sizeof(xfr->expiry)); 7503 lock_protect(&xfr->lock, &xfr->lease_time, sizeof(xfr->lease_time)); 7504 lock_protect(&xfr->lock, &xfr->task_nextprobe->worker, 7505 sizeof(xfr->task_nextprobe->worker)); 7506 lock_protect(&xfr->lock, &xfr->task_probe->worker, 7507 sizeof(xfr->task_probe->worker)); 7508 lock_protect(&xfr->lock, &xfr->task_transfer->worker, 7509 sizeof(xfr->task_transfer->worker)); 7510 lock_basic_lock(&xfr->lock); 7511 return xfr; 7512 } 7513 7514 /** Create auth_xfer structure. 7515 * This populates the have_zone, soa values, and so on times. 7516 * and sets the timeout, if a zone transfer is needed a short timeout is set. 7517 * For that the auth_zone itself must exist (and read in zonefile) 7518 * returns false on alloc failure. */ 7519 struct auth_xfer* 7520 auth_xfer_create(struct auth_zones* az, struct auth_zone* z) 7521 { 7522 struct auth_xfer* xfr; 7523 7524 /* malloc it */ 7525 xfr = auth_xfer_new(z); 7526 if(!xfr) { 7527 log_err("malloc failure"); 7528 return NULL; 7529 } 7530 /* insert in tree */ 7531 (void)rbtree_insert(&az->xtree, &xfr->node); 7532 return xfr; 7533 } 7534 7535 /** create new auth_master structure */ 7536 static struct auth_master* 7537 auth_master_new(struct auth_master*** list) 7538 { 7539 struct auth_master *m; 7540 m = (struct auth_master*)calloc(1, sizeof(*m)); 7541 if(!m) { 7542 log_err("malloc failure"); 7543 return NULL; 7544 } 7545 /* set first pointer to m, or next pointer of previous element to m */ 7546 (**list) = m; 7547 /* store m's next pointer as future point to store at */ 7548 (*list) = &(m->next); 7549 return m; 7550 } 7551 7552 /** dup_prefix : create string from initial part of other string, malloced */ 7553 static char* 7554 dup_prefix(char* str, size_t num) 7555 { 7556 char* result; 7557 size_t len = strlen(str); 7558 if(len < num) num = len; /* not more than strlen */ 7559 result = (char*)malloc(num+1); 7560 if(!result) { 7561 log_err("malloc failure"); 7562 return result; 7563 } 7564 memmove(result, str, num); 7565 result[num] = 0; 7566 return result; 7567 } 7568 7569 /** dup string and print error on error */ 7570 static char* 7571 dup_all(char* str) 7572 { 7573 char* result = strdup(str); 7574 if(!result) { 7575 log_err("malloc failure"); 7576 return NULL; 7577 } 7578 return result; 7579 } 7580 7581 /** find first of two characters */ 7582 static char* 7583 str_find_first_of_chars(char* s, char a, char b) 7584 { 7585 char* ra = strchr(s, a); 7586 char* rb = strchr(s, b); 7587 if(!ra) return rb; 7588 if(!rb) return ra; 7589 if(ra < rb) return ra; 7590 return rb; 7591 } 7592 7593 /** parse URL into host and file parts, false on malloc or parse error */ 7594 static int 7595 parse_url(char* url, char** host, char** file, int* port, int* ssl) 7596 { 7597 char* p = url; 7598 /* parse http://www.example.com/file.htm 7599 * or http://127.0.0.1 (index.html) 7600 * or https://[::1@1234]/a/b/c/d */ 7601 *ssl = 1; 7602 *port = AUTH_HTTPS_PORT; 7603 7604 /* parse http:// or https:// */ 7605 if(strncmp(p, "http://", 7) == 0) { 7606 p += 7; 7607 *ssl = 0; 7608 *port = AUTH_HTTP_PORT; 7609 } else if(strncmp(p, "https://", 8) == 0) { 7610 p += 8; 7611 } else if(strstr(p, "://") && strchr(p, '/') > strstr(p, "://") && 7612 strchr(p, ':') >= strstr(p, "://")) { 7613 char* uri = dup_prefix(p, (size_t)(strstr(p, "://")-p)); 7614 log_err("protocol %s:// not supported (for url %s)", 7615 uri?uri:"", p); 7616 free(uri); 7617 return 0; 7618 } 7619 7620 /* parse hostname part */ 7621 if(p[0] == '[') { 7622 char* end = strchr(p, ']'); 7623 p++; /* skip over [ */ 7624 if(end) { 7625 *host = dup_prefix(p, (size_t)(end-p)); 7626 if(!*host) return 0; 7627 p = end+1; /* skip over ] */ 7628 } else { 7629 *host = dup_all(p); 7630 if(!*host) return 0; 7631 p = end; 7632 } 7633 } else { 7634 char* end = str_find_first_of_chars(p, ':', '/'); 7635 if(end) { 7636 *host = dup_prefix(p, (size_t)(end-p)); 7637 if(!*host) return 0; 7638 } else { 7639 *host = dup_all(p); 7640 if(!*host) return 0; 7641 } 7642 p = end; /* at next : or / or NULL */ 7643 } 7644 7645 /* parse port number */ 7646 if(p && p[0] == ':') { 7647 char* end = NULL; 7648 *port = strtol(p+1, &end, 10); 7649 p = end; 7650 } 7651 7652 /* parse filename part */ 7653 while(p && *p == '/') 7654 p++; 7655 if(!p || p[0] == 0) 7656 *file = strdup("/"); 7657 else *file = strdup(p); 7658 if(!*file) { 7659 log_err("malloc failure"); 7660 return 0; 7661 } 7662 return 1; 7663 } 7664 7665 int 7666 xfer_set_masters(struct auth_master** list, struct config_auth* c, 7667 int with_http) 7668 { 7669 struct auth_master* m; 7670 struct config_strlist* p; 7671 struct auth_master** tail; 7672 /* list points to the first, or next pointer for the new element */ 7673 while(*list) { 7674 list = &( (*list)->next ); 7675 } 7676 if(with_http) 7677 for(p = c->urls; p; p = p->next) { 7678 tail = list; 7679 m = auth_master_new(&list); 7680 if(!m) return 0; 7681 m->http = 1; 7682 if(!parse_url(p->str, &m->host, &m->file, &m->port, &m->ssl)) { 7683 free(m->host); 7684 free(m->file); 7685 free(m); 7686 *tail = NULL; 7687 return 0; 7688 } 7689 } 7690 for(p = c->masters; p; p = p->next) { 7691 tail = list; 7692 m = auth_master_new(&list); 7693 if(!m) return 0; 7694 m->ixfr = 1; /* this flag is not configurable */ 7695 m->host = strdup(p->str); 7696 if(!m->host) { 7697 log_err("malloc failure"); 7698 free(m); 7699 *tail = NULL; 7700 return 0; 7701 } 7702 } 7703 for(p = c->allow_notify; p; p = p->next) { 7704 tail = list; 7705 m = auth_master_new(&list); 7706 if(!m) return 0; 7707 m->allow_notify = 1; 7708 m->host = strdup(p->str); 7709 if(!m->host) { 7710 log_err("malloc failure"); 7711 free(m); 7712 *tail = NULL; 7713 return 0; 7714 } 7715 } 7716 return 1; 7717 } 7718 7719 #define SERIAL_BITS 32 7720 int 7721 compare_serial(uint32_t a, uint32_t b) 7722 { 7723 const uint32_t cutoff = ((uint32_t) 1 << (SERIAL_BITS - 1)); 7724 7725 if (a == b) { 7726 return 0; 7727 } else if ((a < b && b - a < cutoff) || (a > b && a - b > cutoff)) { 7728 return -1; 7729 } else { 7730 return 1; 7731 } 7732 } 7733 7734 int zonemd_hashalgo_supported(int hashalgo) 7735 { 7736 if(hashalgo == ZONEMD_ALGO_SHA384) return 1; 7737 if(hashalgo == ZONEMD_ALGO_SHA512) return 1; 7738 return 0; 7739 } 7740 7741 int zonemd_scheme_supported(int scheme) 7742 { 7743 if(scheme == ZONEMD_SCHEME_SIMPLE) return 1; 7744 return 0; 7745 } 7746 7747 /** initialize hash for hashing with zonemd hash algo */ 7748 static struct secalgo_hash* zonemd_digest_init(int hashalgo, char** reason) 7749 { 7750 struct secalgo_hash *h; 7751 if(hashalgo == ZONEMD_ALGO_SHA384) { 7752 /* sha384 */ 7753 h = secalgo_hash_create_sha384(); 7754 if(!h) 7755 *reason = "digest sha384 could not be created"; 7756 return h; 7757 } else if(hashalgo == ZONEMD_ALGO_SHA512) { 7758 /* sha512 */ 7759 h = secalgo_hash_create_sha512(); 7760 if(!h) 7761 *reason = "digest sha512 could not be created"; 7762 return h; 7763 } 7764 /* unknown hash algo */ 7765 *reason = "unsupported algorithm"; 7766 return NULL; 7767 } 7768 7769 /** update the hash for zonemd */ 7770 static int zonemd_digest_update(int hashalgo, struct secalgo_hash* h, 7771 uint8_t* data, size_t len, char** reason) 7772 { 7773 if(hashalgo == ZONEMD_ALGO_SHA384) { 7774 if(!secalgo_hash_update(h, data, len)) { 7775 *reason = "digest sha384 failed"; 7776 return 0; 7777 } 7778 return 1; 7779 } else if(hashalgo == ZONEMD_ALGO_SHA512) { 7780 if(!secalgo_hash_update(h, data, len)) { 7781 *reason = "digest sha512 failed"; 7782 return 0; 7783 } 7784 return 1; 7785 } 7786 /* unknown hash algo */ 7787 *reason = "unsupported algorithm"; 7788 return 0; 7789 } 7790 7791 /** finish the hash for zonemd */ 7792 static int zonemd_digest_finish(int hashalgo, struct secalgo_hash* h, 7793 uint8_t* result, size_t hashlen, size_t* resultlen, char** reason) 7794 { 7795 if(hashalgo == ZONEMD_ALGO_SHA384) { 7796 if(hashlen < 384/8) { 7797 *reason = "digest buffer too small for sha384"; 7798 return 0; 7799 } 7800 if(!secalgo_hash_final(h, result, hashlen, resultlen)) { 7801 *reason = "digest sha384 finish failed"; 7802 return 0; 7803 } 7804 return 1; 7805 } else if(hashalgo == ZONEMD_ALGO_SHA512) { 7806 if(hashlen < 512/8) { 7807 *reason = "digest buffer too small for sha512"; 7808 return 0; 7809 } 7810 if(!secalgo_hash_final(h, result, hashlen, resultlen)) { 7811 *reason = "digest sha512 finish failed"; 7812 return 0; 7813 } 7814 return 1; 7815 } 7816 /* unknown algo */ 7817 *reason = "unsupported algorithm"; 7818 return 0; 7819 } 7820 7821 /** add rrsets from node to the list */ 7822 static size_t authdata_rrsets_to_list(struct auth_rrset** array, 7823 size_t arraysize, struct auth_rrset* first) 7824 { 7825 struct auth_rrset* rrset = first; 7826 size_t num = 0; 7827 while(rrset) { 7828 if(num >= arraysize) 7829 return num; 7830 array[num] = rrset; 7831 num++; 7832 rrset = rrset->next; 7833 } 7834 return num; 7835 } 7836 7837 /** compare rr list entries */ 7838 static int rrlist_compare(const void* arg1, const void* arg2) 7839 { 7840 struct auth_rrset* r1 = *(struct auth_rrset**)arg1; 7841 struct auth_rrset* r2 = *(struct auth_rrset**)arg2; 7842 uint16_t t1, t2; 7843 if(r1 == NULL) t1 = LDNS_RR_TYPE_RRSIG; 7844 else t1 = r1->type; 7845 if(r2 == NULL) t2 = LDNS_RR_TYPE_RRSIG; 7846 else t2 = r2->type; 7847 if(t1 < t2) 7848 return -1; 7849 if(t1 > t2) 7850 return 1; 7851 return 0; 7852 } 7853 7854 /** add type RRSIG to rr list if not one there already, 7855 * this is to perform RRSIG collate processing at that point. */ 7856 static void addrrsigtype_if_needed(struct auth_rrset** array, 7857 size_t arraysize, size_t* rrnum, struct auth_data* node) 7858 { 7859 if(az_domain_rrset(node, LDNS_RR_TYPE_RRSIG)) 7860 return; /* already one there */ 7861 if((*rrnum) >= arraysize) 7862 return; /* array too small? */ 7863 array[*rrnum] = NULL; /* nothing there, but need entry in list */ 7864 (*rrnum)++; 7865 } 7866 7867 /** collate the RRs in an RRset using the simple scheme */ 7868 static int zonemd_simple_rrset(struct auth_zone* z, int hashalgo, 7869 struct secalgo_hash* h, struct auth_data* node, 7870 struct auth_rrset* rrset, struct regional* region, 7871 struct sldns_buffer* buf, char** reason) 7872 { 7873 /* canonicalize */ 7874 struct ub_packed_rrset_key key; 7875 memset(&key, 0, sizeof(key)); 7876 key.entry.key = &key; 7877 key.entry.data = rrset->data; 7878 key.rk.dname = node->name; 7879 key.rk.dname_len = node->namelen; 7880 key.rk.type = htons(rrset->type); 7881 key.rk.rrset_class = htons(z->dclass); 7882 if(!rrset_canonicalize_to_buffer(region, buf, &key)) { 7883 *reason = "out of memory"; 7884 return 0; 7885 } 7886 regional_free_all(region); 7887 7888 /* hash */ 7889 if(!zonemd_digest_update(hashalgo, h, sldns_buffer_begin(buf), 7890 sldns_buffer_limit(buf), reason)) { 7891 return 0; 7892 } 7893 return 1; 7894 } 7895 7896 /** count number of RRSIGs in a domain name rrset list */ 7897 static size_t zonemd_simple_count_rrsig(struct auth_rrset* rrset, 7898 struct auth_rrset** rrlist, size_t rrnum, 7899 struct auth_zone* z, struct auth_data* node) 7900 { 7901 size_t i, count = 0; 7902 if(rrset) { 7903 size_t j; 7904 for(j = 0; j<rrset->data->count; j++) { 7905 if(rrsig_rdata_get_type_covered(rrset->data-> 7906 rr_data[j], rrset->data->rr_len[j]) == 7907 LDNS_RR_TYPE_ZONEMD && 7908 query_dname_compare(z->name, node->name)==0) { 7909 /* omit RRSIGs over type ZONEMD at apex */ 7910 continue; 7911 } 7912 count++; 7913 } 7914 } 7915 for(i=0; i<rrnum; i++) { 7916 if(rrlist[i] && rrlist[i]->type == LDNS_RR_TYPE_ZONEMD && 7917 query_dname_compare(z->name, node->name)==0) { 7918 /* omit RRSIGs over type ZONEMD at apex */ 7919 continue; 7920 } 7921 count += (rrlist[i]?rrlist[i]->data->rrsig_count:0); 7922 } 7923 return count; 7924 } 7925 7926 /** allocate sparse rrset data for the number of entries in tepm region */ 7927 static int zonemd_simple_rrsig_allocs(struct regional* region, 7928 struct packed_rrset_data* data, size_t count) 7929 { 7930 data->rr_len = regional_alloc(region, sizeof(*data->rr_len) * count); 7931 if(!data->rr_len) { 7932 return 0; 7933 } 7934 data->rr_ttl = regional_alloc(region, sizeof(*data->rr_ttl) * count); 7935 if(!data->rr_ttl) { 7936 return 0; 7937 } 7938 data->rr_data = regional_alloc(region, sizeof(*data->rr_data) * count); 7939 if(!data->rr_data) { 7940 return 0; 7941 } 7942 return 1; 7943 } 7944 7945 /** add the RRSIGs from the rrs in the domain into the data */ 7946 static void add_rrlist_rrsigs_into_data(struct packed_rrset_data* data, 7947 size_t* done, struct auth_rrset** rrlist, size_t rrnum, 7948 struct auth_zone* z, struct auth_data* node) 7949 { 7950 size_t i; 7951 for(i=0; i<rrnum; i++) { 7952 size_t j; 7953 if(!rrlist[i]) 7954 continue; 7955 if(rrlist[i]->type == LDNS_RR_TYPE_ZONEMD && 7956 query_dname_compare(z->name, node->name)==0) { 7957 /* omit RRSIGs over type ZONEMD at apex */ 7958 continue; 7959 } 7960 for(j = 0; j<rrlist[i]->data->rrsig_count; j++) { 7961 data->rr_len[*done] = rrlist[i]->data->rr_len[rrlist[i]->data->count + j]; 7962 data->rr_ttl[*done] = rrlist[i]->data->rr_ttl[rrlist[i]->data->count + j]; 7963 /* reference the rdata in the rrset, no need to 7964 * copy it, it is no longer needed at the end of 7965 * the routine */ 7966 data->rr_data[*done] = rrlist[i]->data->rr_data[rrlist[i]->data->count + j]; 7967 (*done)++; 7968 } 7969 } 7970 } 7971 7972 static void add_rrset_into_data(struct packed_rrset_data* data, 7973 size_t* done, struct auth_rrset* rrset, 7974 struct auth_zone* z, struct auth_data* node) 7975 { 7976 if(rrset) { 7977 size_t j; 7978 for(j = 0; j<rrset->data->count; j++) { 7979 if(rrsig_rdata_get_type_covered(rrset->data-> 7980 rr_data[j], rrset->data->rr_len[j]) == 7981 LDNS_RR_TYPE_ZONEMD && 7982 query_dname_compare(z->name, node->name)==0) { 7983 /* omit RRSIGs over type ZONEMD at apex */ 7984 continue; 7985 } 7986 data->rr_len[*done] = rrset->data->rr_len[j]; 7987 data->rr_ttl[*done] = rrset->data->rr_ttl[j]; 7988 /* reference the rdata in the rrset, no need to 7989 * copy it, it is no longer need at the end of 7990 * the routine */ 7991 data->rr_data[*done] = rrset->data->rr_data[j]; 7992 (*done)++; 7993 } 7994 } 7995 } 7996 7997 /** collate the RRSIGs using the simple scheme */ 7998 static int zonemd_simple_rrsig(struct auth_zone* z, int hashalgo, 7999 struct secalgo_hash* h, struct auth_data* node, 8000 struct auth_rrset* rrset, struct auth_rrset** rrlist, size_t rrnum, 8001 struct regional* region, struct sldns_buffer* buf, char** reason) 8002 { 8003 /* the rrset pointer can be NULL, this means it is type RRSIG and 8004 * there is no ordinary type RRSIG there. The RRSIGs are stored 8005 * with the RRsets in their data. 8006 * 8007 * The RRset pointer can be nonNULL. This happens if there is 8008 * no RR that is covered by the RRSIG for the domain. Then this 8009 * RRSIG RR is stored in an rrset of type RRSIG. The other RRSIGs 8010 * are stored in the rrset entries for the RRs in the rr list for 8011 * the domain node. We need to collate the rrset's data, if any, and 8012 * the rrlist's rrsigs */ 8013 /* if this is the apex, omit RRSIGs that cover type ZONEMD */ 8014 /* build rrsig rrset */ 8015 size_t done = 0; 8016 struct ub_packed_rrset_key key; 8017 struct packed_rrset_data data; 8018 memset(&key, 0, sizeof(key)); 8019 memset(&data, 0, sizeof(data)); 8020 key.entry.key = &key; 8021 key.entry.data = &data; 8022 key.rk.dname = node->name; 8023 key.rk.dname_len = node->namelen; 8024 key.rk.type = htons(LDNS_RR_TYPE_RRSIG); 8025 key.rk.rrset_class = htons(z->dclass); 8026 data.count = zonemd_simple_count_rrsig(rrset, rrlist, rrnum, z, node); 8027 if(!zonemd_simple_rrsig_allocs(region, &data, data.count)) { 8028 *reason = "out of memory"; 8029 regional_free_all(region); 8030 return 0; 8031 } 8032 /* all the RRSIGs stored in the other rrsets for this domain node */ 8033 add_rrlist_rrsigs_into_data(&data, &done, rrlist, rrnum, z, node); 8034 /* plus the RRSIGs stored in an rrset of type RRSIG for this node */ 8035 add_rrset_into_data(&data, &done, rrset, z, node); 8036 8037 /* canonicalize */ 8038 if(!rrset_canonicalize_to_buffer(region, buf, &key)) { 8039 *reason = "out of memory"; 8040 regional_free_all(region); 8041 return 0; 8042 } 8043 regional_free_all(region); 8044 8045 /* hash */ 8046 if(!zonemd_digest_update(hashalgo, h, sldns_buffer_begin(buf), 8047 sldns_buffer_limit(buf), reason)) { 8048 return 0; 8049 } 8050 return 1; 8051 } 8052 8053 /** collate a domain's rrsets using the simple scheme */ 8054 static int zonemd_simple_domain(struct auth_zone* z, int hashalgo, 8055 struct secalgo_hash* h, struct auth_data* node, 8056 struct regional* region, struct sldns_buffer* buf, char** reason) 8057 { 8058 #define rrlistsize 65536 8059 struct auth_rrset* rrlist[rrlistsize]; 8060 size_t i, rrnum = 0; 8061 /* see if the domain is out of scope, the zone origin, 8062 * that would be omitted */ 8063 if(!dname_subdomain_c(node->name, z->name)) 8064 return 1; /* continue */ 8065 /* loop over the rrsets in ascending order. */ 8066 rrnum = authdata_rrsets_to_list(rrlist, rrlistsize, node->rrsets); 8067 addrrsigtype_if_needed(rrlist, rrlistsize, &rrnum, node); 8068 qsort(rrlist, rrnum, sizeof(*rrlist), rrlist_compare); 8069 for(i=0; i<rrnum; i++) { 8070 if(rrlist[i] && rrlist[i]->type == LDNS_RR_TYPE_ZONEMD && 8071 query_dname_compare(z->name, node->name) == 0) { 8072 /* omit type ZONEMD at apex */ 8073 continue; 8074 } 8075 if(rrlist[i] == NULL || rrlist[i]->type == 8076 LDNS_RR_TYPE_RRSIG) { 8077 if(!zonemd_simple_rrsig(z, hashalgo, h, node, 8078 rrlist[i], rrlist, rrnum, region, buf, reason)) 8079 return 0; 8080 } else if(!zonemd_simple_rrset(z, hashalgo, h, node, 8081 rrlist[i], region, buf, reason)) { 8082 return 0; 8083 } 8084 } 8085 return 1; 8086 } 8087 8088 /** collate the zone using the simple scheme */ 8089 static int zonemd_simple_collate(struct auth_zone* z, int hashalgo, 8090 struct secalgo_hash* h, struct regional* region, 8091 struct sldns_buffer* buf, char** reason) 8092 { 8093 /* our tree is sorted in canonical order, so we can just loop over 8094 * the tree */ 8095 struct auth_data* n; 8096 RBTREE_FOR(n, struct auth_data*, &z->data) { 8097 if(!zonemd_simple_domain(z, hashalgo, h, n, region, buf, 8098 reason)) 8099 return 0; 8100 } 8101 return 1; 8102 } 8103 8104 int auth_zone_generate_zonemd_hash(struct auth_zone* z, int scheme, 8105 int hashalgo, uint8_t* hash, size_t hashlen, size_t* resultlen, 8106 struct regional* region, struct sldns_buffer* buf, char** reason) 8107 { 8108 struct secalgo_hash* h = zonemd_digest_init(hashalgo, reason); 8109 if(!h) { 8110 if(!*reason) 8111 *reason = "digest init fail"; 8112 return 0; 8113 } 8114 if(scheme == ZONEMD_SCHEME_SIMPLE) { 8115 if(!zonemd_simple_collate(z, hashalgo, h, region, buf, reason)) { 8116 if(!*reason) *reason = "scheme simple collate fail"; 8117 secalgo_hash_delete(h); 8118 return 0; 8119 } 8120 } 8121 if(!zonemd_digest_finish(hashalgo, h, hash, hashlen, resultlen, 8122 reason)) { 8123 secalgo_hash_delete(h); 8124 *reason = "digest finish fail"; 8125 return 0; 8126 } 8127 secalgo_hash_delete(h); 8128 return 1; 8129 } 8130 8131 int auth_zone_generate_zonemd_check(struct auth_zone* z, int scheme, 8132 int hashalgo, uint8_t* hash, size_t hashlen, struct regional* region, 8133 struct sldns_buffer* buf, char** reason) 8134 { 8135 uint8_t gen[512]; 8136 size_t genlen = 0; 8137 *reason = NULL; 8138 if(!zonemd_hashalgo_supported(hashalgo)) { 8139 /* allow it */ 8140 *reason = "unsupported algorithm"; 8141 return 1; 8142 } 8143 if(!zonemd_scheme_supported(scheme)) { 8144 /* allow it */ 8145 *reason = "unsupported scheme"; 8146 return 1; 8147 } 8148 if(hashlen < 12) { 8149 /* the ZONEMD draft requires digests to fail if too small */ 8150 *reason = "digest length too small, less than 12"; 8151 return 0; 8152 } 8153 /* generate digest */ 8154 if(!auth_zone_generate_zonemd_hash(z, scheme, hashalgo, gen, 8155 sizeof(gen), &genlen, region, buf, reason)) { 8156 /* reason filled in by zonemd hash routine */ 8157 return 0; 8158 } 8159 /* check digest length */ 8160 if(hashlen != genlen) { 8161 *reason = "incorrect digest length"; 8162 if(verbosity >= VERB_ALGO) { 8163 verbose(VERB_ALGO, "zonemd scheme=%d hashalgo=%d", 8164 scheme, hashalgo); 8165 log_hex("ZONEMD should be ", gen, genlen); 8166 log_hex("ZONEMD to check is", hash, hashlen); 8167 } 8168 return 0; 8169 } 8170 /* check digest */ 8171 if(memcmp(hash, gen, genlen) != 0) { 8172 *reason = "incorrect digest"; 8173 if(verbosity >= VERB_ALGO) { 8174 verbose(VERB_ALGO, "zonemd scheme=%d hashalgo=%d", 8175 scheme, hashalgo); 8176 log_hex("ZONEMD should be ", gen, genlen); 8177 log_hex("ZONEMD to check is", hash, hashlen); 8178 } 8179 return 0; 8180 } 8181 return 1; 8182 } 8183 8184 /** log auth zone message with zone name in front. */ 8185 static void auth_zone_log(uint8_t* name, enum verbosity_value level, 8186 const char* format, ...) ATTR_FORMAT(printf, 3, 4); 8187 static void auth_zone_log(uint8_t* name, enum verbosity_value level, 8188 const char* format, ...) 8189 { 8190 va_list args; 8191 va_start(args, format); 8192 if(verbosity >= level) { 8193 char str[LDNS_MAX_DOMAINLEN]; 8194 char msg[MAXSYSLOGMSGLEN]; 8195 dname_str(name, str); 8196 vsnprintf(msg, sizeof(msg), format, args); 8197 verbose(level, "auth zone %s %s", str, msg); 8198 } 8199 va_end(args); 8200 } 8201 8202 /** ZONEMD, dnssec verify the rrset with the dnskey */ 8203 static int zonemd_dnssec_verify_rrset(struct auth_zone* z, 8204 struct module_env* env, struct module_stack* mods, 8205 struct ub_packed_rrset_key* dnskey, struct auth_data* node, 8206 struct auth_rrset* rrset, char** why_bogus, uint8_t* sigalg, 8207 char* reasonbuf, size_t reasonlen) 8208 { 8209 struct ub_packed_rrset_key pk; 8210 enum sec_status sec; 8211 struct val_env* ve; 8212 int m; 8213 int verified = 0; 8214 m = modstack_find(mods, "validator"); 8215 if(m == -1) { 8216 auth_zone_log(z->name, VERB_ALGO, "zonemd dnssec verify: have " 8217 "DNSKEY chain of trust, but no validator module"); 8218 return 0; 8219 } 8220 ve = (struct val_env*)env->modinfo[m]; 8221 8222 memset(&pk, 0, sizeof(pk)); 8223 pk.entry.key = &pk; 8224 pk.entry.data = rrset->data; 8225 pk.rk.dname = node->name; 8226 pk.rk.dname_len = node->namelen; 8227 pk.rk.type = htons(rrset->type); 8228 pk.rk.rrset_class = htons(z->dclass); 8229 if(verbosity >= VERB_ALGO) { 8230 char typestr[32]; 8231 typestr[0]=0; 8232 sldns_wire2str_type_buf(rrset->type, typestr, sizeof(typestr)); 8233 auth_zone_log(z->name, VERB_ALGO, 8234 "zonemd: verify %s RRset with DNSKEY", typestr); 8235 } 8236 sec = dnskeyset_verify_rrset(env, ve, &pk, dnskey, sigalg, why_bogus, NULL, 8237 LDNS_SECTION_ANSWER, NULL, NULL, &verified, reasonbuf, 8238 reasonlen); 8239 if(sec == sec_status_secure) { 8240 return 1; 8241 } 8242 if(why_bogus) 8243 auth_zone_log(z->name, VERB_ALGO, "DNSSEC verify was bogus: %s", *why_bogus); 8244 return 0; 8245 } 8246 8247 /** check for nsec3, the RR with params equal, if bitmap has the type */ 8248 static int nsec3_of_param_has_type(struct auth_rrset* nsec3, int algo, 8249 size_t iter, uint8_t* salt, size_t saltlen, uint16_t rrtype) 8250 { 8251 int i, count = (int)nsec3->data->count; 8252 struct ub_packed_rrset_key pk; 8253 memset(&pk, 0, sizeof(pk)); 8254 pk.entry.data = nsec3->data; 8255 for(i=0; i<count; i++) { 8256 int rralgo; 8257 size_t rriter, rrsaltlen; 8258 uint8_t* rrsalt; 8259 if(!nsec3_get_params(&pk, i, &rralgo, &rriter, &rrsalt, 8260 &rrsaltlen)) 8261 continue; /* no parameters, malformed */ 8262 if(rralgo != algo || rriter != iter || rrsaltlen != saltlen) 8263 continue; /* different parameters */ 8264 if(saltlen != 0) { 8265 if(rrsalt == NULL || salt == NULL) 8266 continue; 8267 if(memcmp(rrsalt, salt, saltlen) != 0) 8268 continue; /* different salt parameters */ 8269 } 8270 if(nsec3_has_type(&pk, i, rrtype)) 8271 return 1; 8272 } 8273 return 0; 8274 } 8275 8276 /** Verify the absence of ZONEMD with DNSSEC by checking NSEC, NSEC3 type flag. 8277 * return false on failure, reason contains description of failure. */ 8278 static int zonemd_check_dnssec_absence(struct auth_zone* z, 8279 struct module_env* env, struct module_stack* mods, 8280 struct ub_packed_rrset_key* dnskey, struct auth_data* apex, 8281 char** reason, char** why_bogus, uint8_t* sigalg, char* reasonbuf, 8282 size_t reasonlen) 8283 { 8284 struct auth_rrset* nsec = NULL; 8285 if(!apex) { 8286 *reason = "zone has no apex domain but ZONEMD missing"; 8287 return 0; 8288 } 8289 nsec = az_domain_rrset(apex, LDNS_RR_TYPE_NSEC); 8290 if(nsec) { 8291 struct ub_packed_rrset_key pk; 8292 /* dnssec verify the NSEC */ 8293 if(!zonemd_dnssec_verify_rrset(z, env, mods, dnskey, apex, 8294 nsec, why_bogus, sigalg, reasonbuf, reasonlen)) { 8295 *reason = "DNSSEC verify failed for NSEC RRset"; 8296 return 0; 8297 } 8298 /* check type bitmap */ 8299 memset(&pk, 0, sizeof(pk)); 8300 pk.entry.data = nsec->data; 8301 if(nsec_has_type(&pk, LDNS_RR_TYPE_ZONEMD)) { 8302 *reason = "DNSSEC NSEC bitmap says type ZONEMD exists"; 8303 return 0; 8304 } 8305 auth_zone_log(z->name, VERB_ALGO, "zonemd DNSSEC NSEC verification of absence of ZONEMD secure"); 8306 } else { 8307 /* NSEC3 perhaps ? */ 8308 int algo; 8309 size_t iter, saltlen; 8310 uint8_t* salt; 8311 struct auth_rrset* nsec3param = az_domain_rrset(apex, 8312 LDNS_RR_TYPE_NSEC3PARAM); 8313 struct auth_data* match; 8314 struct auth_rrset* nsec3; 8315 if(!nsec3param) { 8316 *reason = "zone has no NSEC information but ZONEMD missing"; 8317 return 0; 8318 } 8319 if(!az_nsec3_param(z, &algo, &iter, &salt, &saltlen)) { 8320 *reason = "zone has no NSEC information but ZONEMD missing"; 8321 return 0; 8322 } 8323 /* find the NSEC3 record */ 8324 match = az_nsec3_find_exact(z, z->name, z->namelen, algo, 8325 iter, salt, saltlen); 8326 if(!match) { 8327 *reason = "zone has no NSEC3 domain for the apex but ZONEMD missing"; 8328 return 0; 8329 } 8330 nsec3 = az_domain_rrset(match, LDNS_RR_TYPE_NSEC3); 8331 if(!nsec3) { 8332 *reason = "zone has no NSEC3 RRset for the apex but ZONEMD missing"; 8333 return 0; 8334 } 8335 /* dnssec verify the NSEC3 */ 8336 if(!zonemd_dnssec_verify_rrset(z, env, mods, dnskey, match, 8337 nsec3, why_bogus, sigalg, reasonbuf, reasonlen)) { 8338 *reason = "DNSSEC verify failed for NSEC3 RRset"; 8339 return 0; 8340 } 8341 /* check type bitmap */ 8342 if(nsec3_of_param_has_type(nsec3, algo, iter, salt, saltlen, 8343 LDNS_RR_TYPE_ZONEMD)) { 8344 *reason = "DNSSEC NSEC3 bitmap says type ZONEMD exists"; 8345 return 0; 8346 } 8347 auth_zone_log(z->name, VERB_ALGO, "zonemd DNSSEC NSEC3 verification of absence of ZONEMD secure"); 8348 } 8349 8350 return 1; 8351 } 8352 8353 /** Verify the SOA and ZONEMD DNSSEC signatures. 8354 * return false on failure, reason contains description of failure. */ 8355 static int zonemd_check_dnssec_soazonemd(struct auth_zone* z, 8356 struct module_env* env, struct module_stack* mods, 8357 struct ub_packed_rrset_key* dnskey, struct auth_data* apex, 8358 struct auth_rrset* zonemd_rrset, char** reason, char** why_bogus, 8359 uint8_t* sigalg, char* reasonbuf, size_t reasonlen) 8360 { 8361 struct auth_rrset* soa; 8362 if(!apex) { 8363 *reason = "zone has no apex domain"; 8364 return 0; 8365 } 8366 soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA); 8367 if(!soa) { 8368 *reason = "zone has no SOA RRset"; 8369 return 0; 8370 } 8371 if(!zonemd_dnssec_verify_rrset(z, env, mods, dnskey, apex, soa, 8372 why_bogus, sigalg, reasonbuf, reasonlen)) { 8373 *reason = "DNSSEC verify failed for SOA RRset"; 8374 return 0; 8375 } 8376 if(!zonemd_dnssec_verify_rrset(z, env, mods, dnskey, apex, 8377 zonemd_rrset, why_bogus, sigalg, reasonbuf, reasonlen)) { 8378 *reason = "DNSSEC verify failed for ZONEMD RRset"; 8379 return 0; 8380 } 8381 auth_zone_log(z->name, VERB_ALGO, "zonemd DNSSEC verification of SOA and ZONEMD RRsets secure"); 8382 return 1; 8383 } 8384 8385 /** 8386 * Fail the ZONEMD verification. 8387 * @param z: auth zone that fails. 8388 * @param env: environment with config, to ignore failure or not. 8389 * @param reason: failure string description. 8390 * @param why_bogus: failure string for DNSSEC verification failure. 8391 * @param result: strdup result in here if not NULL. 8392 */ 8393 static void auth_zone_zonemd_fail(struct auth_zone* z, struct module_env* env, 8394 char* reason, char* why_bogus, char** result) 8395 { 8396 char zstr[LDNS_MAX_DOMAINLEN]; 8397 /* if fail: log reason, and depending on config also take action 8398 * and drop the zone, eg. it is gone from memory, set zone_expired */ 8399 dname_str(z->name, zstr); 8400 if(!reason) reason = "verification failed"; 8401 if(result) { 8402 if(why_bogus) { 8403 char res[1024]; 8404 snprintf(res, sizeof(res), "%s: %s", reason, 8405 why_bogus); 8406 *result = strdup(res); 8407 } else { 8408 *result = strdup(reason); 8409 } 8410 if(!*result) log_err("out of memory"); 8411 } else { 8412 log_warn("auth zone %s: ZONEMD verification failed: %s", zstr, reason); 8413 } 8414 8415 if(env->cfg->zonemd_permissive_mode) { 8416 verbose(VERB_ALGO, "zonemd-permissive-mode enabled, " 8417 "not blocking zone %s", zstr); 8418 return; 8419 } 8420 8421 /* expired means the zone gives servfail and is not used by 8422 * lookup if fallback_enabled*/ 8423 z->zone_expired = 1; 8424 } 8425 8426 /** 8427 * Verify the zonemd with DNSSEC and hash check, with given key. 8428 * @param z: auth zone. 8429 * @param env: environment with config and temp buffers. 8430 * @param mods: module stack with validator env for verification. 8431 * @param dnskey: dnskey that we can use, or NULL. If nonnull, the key 8432 * has been verified and is the start of the chain of trust. 8433 * @param is_insecure: if true, the dnskey is not used, the zone is insecure. 8434 * And dnssec is not used. It is DNSSEC secure insecure or not under 8435 * a trust anchor. 8436 * @param sigalg: if nonNULL provide algorithm downgrade protection. 8437 * Otherwise one algorithm is enough. Must have space of ALGO_NEEDS_MAX+1. 8438 * @param result: if not NULL result reason copied here. 8439 */ 8440 static void 8441 auth_zone_verify_zonemd_with_key(struct auth_zone* z, struct module_env* env, 8442 struct module_stack* mods, struct ub_packed_rrset_key* dnskey, 8443 int is_insecure, char** result, uint8_t* sigalg) 8444 { 8445 char reasonbuf[256]; 8446 char* reason = NULL, *why_bogus = NULL; 8447 struct auth_data* apex = NULL; 8448 struct auth_rrset* zonemd_rrset = NULL; 8449 int zonemd_absent = 0, zonemd_absence_dnssecok = 0; 8450 8451 /* see if ZONEMD is present or absent. */ 8452 apex = az_find_name(z, z->name, z->namelen); 8453 if(!apex) { 8454 zonemd_absent = 1; 8455 } else { 8456 zonemd_rrset = az_domain_rrset(apex, LDNS_RR_TYPE_ZONEMD); 8457 if(!zonemd_rrset || zonemd_rrset->data->count==0) { 8458 zonemd_absent = 1; 8459 zonemd_rrset = NULL; 8460 } 8461 } 8462 8463 /* if no DNSSEC, done. */ 8464 /* if no ZONEMD, and DNSSEC, use DNSKEY to verify NSEC or NSEC3 for 8465 * zone apex. Check ZONEMD bit is turned off or else fail */ 8466 /* if ZONEMD, and DNSSEC, check DNSSEC signature on SOA and ZONEMD, 8467 * or else fail */ 8468 if(!dnskey && !is_insecure) { 8469 auth_zone_zonemd_fail(z, env, "DNSKEY missing", NULL, result); 8470 return; 8471 } else if(!zonemd_rrset && dnskey && !is_insecure) { 8472 /* fetch, DNSSEC verify, and check NSEC/NSEC3 */ 8473 if(!zonemd_check_dnssec_absence(z, env, mods, dnskey, apex, 8474 &reason, &why_bogus, sigalg, reasonbuf, 8475 sizeof(reasonbuf))) { 8476 auth_zone_zonemd_fail(z, env, reason, why_bogus, result); 8477 return; 8478 } 8479 zonemd_absence_dnssecok = 1; 8480 } else if(zonemd_rrset && dnskey && !is_insecure) { 8481 /* check DNSSEC verify of SOA and ZONEMD */ 8482 if(!zonemd_check_dnssec_soazonemd(z, env, mods, dnskey, apex, 8483 zonemd_rrset, &reason, &why_bogus, sigalg, reasonbuf, 8484 sizeof(reasonbuf))) { 8485 auth_zone_zonemd_fail(z, env, reason, why_bogus, result); 8486 return; 8487 } 8488 } 8489 8490 if(zonemd_absent && z->zonemd_reject_absence) { 8491 auth_zone_zonemd_fail(z, env, "ZONEMD absent and that is not allowed by config", NULL, result); 8492 return; 8493 } 8494 if(zonemd_absent && zonemd_absence_dnssecok) { 8495 auth_zone_log(z->name, VERB_ALGO, "DNSSEC verified nonexistence of ZONEMD"); 8496 if(result) { 8497 *result = strdup("DNSSEC verified nonexistence of ZONEMD"); 8498 if(!*result) log_err("out of memory"); 8499 } 8500 return; 8501 } 8502 if(zonemd_absent) { 8503 auth_zone_log(z->name, VERB_ALGO, "no ZONEMD present"); 8504 if(result) { 8505 *result = strdup("no ZONEMD present"); 8506 if(!*result) log_err("out of memory"); 8507 } 8508 return; 8509 } 8510 8511 /* check ZONEMD checksum and report or else fail. */ 8512 if(!auth_zone_zonemd_check_hash(z, env, &reason)) { 8513 auth_zone_zonemd_fail(z, env, reason, NULL, result); 8514 return; 8515 } 8516 8517 /* success! log the success */ 8518 if(reason) 8519 auth_zone_log(z->name, VERB_ALGO, "ZONEMD %s", reason); 8520 else auth_zone_log(z->name, VERB_ALGO, "ZONEMD verification successful"); 8521 if(result) { 8522 if(reason) 8523 *result = strdup(reason); 8524 else *result = strdup("ZONEMD verification successful"); 8525 if(!*result) log_err("out of memory"); 8526 } 8527 } 8528 8529 /** 8530 * verify the zone DNSKEY rrset from the trust anchor 8531 * This is possible because the anchor is for the zone itself, and can 8532 * thus apply straight to the zone DNSKEY set. 8533 * @param z: the auth zone. 8534 * @param env: environment with time and temp buffers. 8535 * @param mods: module stack for validator environment for dnssec validation. 8536 * @param anchor: trust anchor to use 8537 * @param is_insecure: returned, true if the zone is securely insecure. 8538 * @param why_bogus: if the routine fails, returns the failure reason. 8539 * @param keystorage: where to store the ub_packed_rrset_key that is created 8540 * on success. A pointer to it is returned on success. 8541 * @param reasonbuf: buffer to use for fail reason string print. 8542 * @param reasonlen: length of reasonbuf. 8543 * @return the dnskey RRset, reference to zone data and keystorage, or 8544 * NULL on failure. 8545 */ 8546 static struct ub_packed_rrset_key* 8547 zonemd_get_dnskey_from_anchor(struct auth_zone* z, struct module_env* env, 8548 struct module_stack* mods, struct trust_anchor* anchor, 8549 int* is_insecure, char** why_bogus, 8550 struct ub_packed_rrset_key* keystorage, char* reasonbuf, 8551 size_t reasonlen) 8552 { 8553 struct auth_data* apex; 8554 struct auth_rrset* dnskey_rrset; 8555 enum sec_status sec; 8556 struct val_env* ve; 8557 int m; 8558 8559 apex = az_find_name(z, z->name, z->namelen); 8560 if(!apex) { 8561 *why_bogus = "have trust anchor, but zone has no apex domain for DNSKEY"; 8562 return 0; 8563 } 8564 dnskey_rrset = az_domain_rrset(apex, LDNS_RR_TYPE_DNSKEY); 8565 if(!dnskey_rrset || dnskey_rrset->data->count==0) { 8566 *why_bogus = "have trust anchor, but zone has no DNSKEY"; 8567 return 0; 8568 } 8569 8570 m = modstack_find(mods, "validator"); 8571 if(m == -1) { 8572 *why_bogus = "have trust anchor, but no validator module"; 8573 return 0; 8574 } 8575 ve = (struct val_env*)env->modinfo[m]; 8576 8577 memset(keystorage, 0, sizeof(*keystorage)); 8578 keystorage->entry.key = keystorage; 8579 keystorage->entry.data = dnskey_rrset->data; 8580 keystorage->rk.dname = apex->name; 8581 keystorage->rk.dname_len = apex->namelen; 8582 keystorage->rk.type = htons(LDNS_RR_TYPE_DNSKEY); 8583 keystorage->rk.rrset_class = htons(z->dclass); 8584 auth_zone_log(z->name, VERB_QUERY, 8585 "zonemd: verify DNSKEY RRset with trust anchor"); 8586 sec = val_verify_DNSKEY_with_TA(env, ve, keystorage, anchor->ds_rrset, 8587 anchor->dnskey_rrset, NULL, why_bogus, NULL, NULL, NULL, 8588 reasonbuf, reasonlen); 8589 regional_free_all(env->scratch); 8590 if(sec == sec_status_secure) { 8591 /* success */ 8592 *is_insecure = 0; 8593 return keystorage; 8594 } else if(sec == sec_status_insecure) { 8595 /* insecure */ 8596 *is_insecure = 1; 8597 } else { 8598 /* bogus */ 8599 *is_insecure = 0; 8600 auth_zone_log(z->name, VERB_ALGO, 8601 "zonemd: verify DNSKEY RRset with trust anchor failed: %s", *why_bogus); 8602 } 8603 return NULL; 8604 } 8605 8606 /** verify the DNSKEY from the zone with looked up DS record */ 8607 static struct ub_packed_rrset_key* 8608 auth_zone_verify_zonemd_key_with_ds(struct auth_zone* z, 8609 struct module_env* env, struct module_stack* mods, 8610 struct ub_packed_rrset_key* ds, int* is_insecure, char** why_bogus, 8611 struct ub_packed_rrset_key* keystorage, uint8_t* sigalg, 8612 char* reasonbuf, size_t reasonlen) 8613 { 8614 struct auth_data* apex; 8615 struct auth_rrset* dnskey_rrset; 8616 enum sec_status sec; 8617 struct val_env* ve; 8618 int m; 8619 8620 /* fetch DNSKEY from zone data */ 8621 apex = az_find_name(z, z->name, z->namelen); 8622 if(!apex) { 8623 *why_bogus = "in verifywithDS, zone has no apex"; 8624 return NULL; 8625 } 8626 dnskey_rrset = az_domain_rrset(apex, LDNS_RR_TYPE_DNSKEY); 8627 if(!dnskey_rrset || dnskey_rrset->data->count==0) { 8628 *why_bogus = "in verifywithDS, zone has no DNSKEY"; 8629 return NULL; 8630 } 8631 8632 m = modstack_find(mods, "validator"); 8633 if(m == -1) { 8634 *why_bogus = "in verifywithDS, have no validator module"; 8635 return NULL; 8636 } 8637 ve = (struct val_env*)env->modinfo[m]; 8638 8639 memset(keystorage, 0, sizeof(*keystorage)); 8640 keystorage->entry.key = keystorage; 8641 keystorage->entry.data = dnskey_rrset->data; 8642 keystorage->rk.dname = apex->name; 8643 keystorage->rk.dname_len = apex->namelen; 8644 keystorage->rk.type = htons(LDNS_RR_TYPE_DNSKEY); 8645 keystorage->rk.rrset_class = htons(z->dclass); 8646 auth_zone_log(z->name, VERB_QUERY, "zonemd: verify zone DNSKEY with DS"); 8647 sec = val_verify_DNSKEY_with_DS(env, ve, keystorage, ds, sigalg, 8648 why_bogus, NULL, NULL, NULL, reasonbuf, reasonlen); 8649 regional_free_all(env->scratch); 8650 if(sec == sec_status_secure) { 8651 /* success */ 8652 return keystorage; 8653 } else if(sec == sec_status_insecure) { 8654 /* insecure */ 8655 *is_insecure = 1; 8656 } else { 8657 /* bogus */ 8658 *is_insecure = 0; 8659 if(*why_bogus == NULL) 8660 *why_bogus = "verify failed"; 8661 auth_zone_log(z->name, VERB_ALGO, 8662 "zonemd: verify DNSKEY RRset with DS failed: %s", 8663 *why_bogus); 8664 } 8665 return NULL; 8666 } 8667 8668 /** callback for ZONEMD lookup of DNSKEY */ 8669 void auth_zonemd_dnskey_lookup_callback(void* arg, int rcode, sldns_buffer* buf, 8670 enum sec_status sec, char* why_bogus, int ATTR_UNUSED(was_ratelimited)) 8671 { 8672 struct auth_zone* z = (struct auth_zone*)arg; 8673 struct module_env* env; 8674 char reasonbuf[256]; 8675 char* reason = NULL, *ds_bogus = NULL, *typestr="DNSKEY"; 8676 struct ub_packed_rrset_key* dnskey = NULL, *ds = NULL; 8677 int is_insecure = 0, downprot, perform_write = 0; 8678 struct ub_packed_rrset_key keystorage; 8679 uint8_t sigalg[ALGO_NEEDS_MAX+1]; 8680 uint8_t bakname[LDNS_MAX_DOMAINLEN]; 8681 size_t baknamelen; 8682 uint16_t bakdclass; 8683 struct auth_chunk* chunk_list = NULL; 8684 8685 lock_rw_wrlock(&z->lock); 8686 env = z->zonemd_callback_env; 8687 /* release the env variable so another worker can pick up the 8688 * ZONEMD verification task if it wants to */ 8689 z->zonemd_callback_env = NULL; 8690 if(!env || env->outnet->want_to_quit || z->zone_deleted) { 8691 lock_rw_unlock(&z->lock); 8692 return; /* stop on quit */ 8693 } 8694 if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DS) 8695 typestr = "DS"; 8696 downprot = env->cfg->harden_algo_downgrade; 8697 8698 /* process result */ 8699 if(sec == sec_status_bogus) { 8700 reason = why_bogus; 8701 if(!reason) { 8702 if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DNSKEY) 8703 reason = "lookup of DNSKEY was bogus"; 8704 else reason = "lookup of DS was bogus"; 8705 } 8706 auth_zone_log(z->name, VERB_ALGO, 8707 "zonemd lookup of %s was bogus: %s", typestr, reason); 8708 } else if(rcode == LDNS_RCODE_NOERROR) { 8709 uint16_t wanted_qtype = z->zonemd_callback_qtype; 8710 struct regional* temp = env->scratch; 8711 struct query_info rq; 8712 struct reply_info* rep; 8713 memset(&rq, 0, sizeof(rq)); 8714 rep = parse_reply_in_temp_region(buf, temp, &rq); 8715 if(rep && rq.qtype == wanted_qtype && 8716 query_dname_compare(z->name, rq.qname) == 0 && 8717 FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR) { 8718 /* parsed successfully */ 8719 struct ub_packed_rrset_key* answer = 8720 reply_find_answer_rrset(&rq, rep); 8721 if(answer && sec == sec_status_secure) { 8722 if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DNSKEY) 8723 dnskey = answer; 8724 else ds = answer; 8725 auth_zone_log(z->name, VERB_ALGO, 8726 "zonemd lookup of %s was secure", typestr); 8727 } else if(sec == sec_status_secure && !answer) { 8728 is_insecure = 1; 8729 auth_zone_log(z->name, VERB_ALGO, 8730 "zonemd lookup of %s has no content, but is secure, treat as insecure", typestr); 8731 } else if(sec == sec_status_insecure) { 8732 is_insecure = 1; 8733 auth_zone_log(z->name, VERB_ALGO, 8734 "zonemd lookup of %s was insecure", typestr); 8735 } else if(sec == sec_status_indeterminate) { 8736 is_insecure = 1; 8737 auth_zone_log(z->name, VERB_ALGO, 8738 "zonemd lookup of %s was indeterminate, treat as insecure", typestr); 8739 } else { 8740 auth_zone_log(z->name, VERB_ALGO, 8741 "zonemd lookup of %s has nodata", typestr); 8742 if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DNSKEY) 8743 reason = "lookup of DNSKEY has nodata"; 8744 else reason = "lookup of DS has nodata"; 8745 } 8746 } else if(rep && rq.qtype == wanted_qtype && 8747 query_dname_compare(z->name, rq.qname) == 0 && 8748 FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NXDOMAIN && 8749 sec == sec_status_secure) { 8750 /* secure nxdomain, so the zone is like some RPZ zone 8751 * that does not exist in the wider internet, with 8752 * a secure nxdomain answer outside of it. So we 8753 * treat the zonemd zone without a dnssec chain of 8754 * trust, as insecure. */ 8755 is_insecure = 1; 8756 auth_zone_log(z->name, VERB_ALGO, 8757 "zonemd lookup of %s was secure NXDOMAIN, treat as insecure", typestr); 8758 } else if(rep && rq.qtype == wanted_qtype && 8759 query_dname_compare(z->name, rq.qname) == 0 && 8760 FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NXDOMAIN && 8761 sec == sec_status_insecure) { 8762 is_insecure = 1; 8763 auth_zone_log(z->name, VERB_ALGO, 8764 "zonemd lookup of %s was insecure NXDOMAIN, treat as insecure", typestr); 8765 } else if(rep && rq.qtype == wanted_qtype && 8766 query_dname_compare(z->name, rq.qname) == 0 && 8767 FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NXDOMAIN && 8768 sec == sec_status_indeterminate) { 8769 is_insecure = 1; 8770 auth_zone_log(z->name, VERB_ALGO, 8771 "zonemd lookup of %s was indeterminate NXDOMAIN, treat as insecure", typestr); 8772 } else { 8773 auth_zone_log(z->name, VERB_ALGO, 8774 "zonemd lookup of %s has no answer", typestr); 8775 if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DNSKEY) 8776 reason = "lookup of DNSKEY has no answer"; 8777 else reason = "lookup of DS has no answer"; 8778 } 8779 } else { 8780 auth_zone_log(z->name, VERB_ALGO, 8781 "zonemd lookup of %s failed", typestr); 8782 if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DNSKEY) 8783 reason = "lookup of DNSKEY failed"; 8784 else reason = "lookup of DS failed"; 8785 } 8786 8787 if(!reason && !is_insecure && !dnskey && ds) { 8788 dnskey = auth_zone_verify_zonemd_key_with_ds(z, env, 8789 &env->mesh->mods, ds, &is_insecure, &ds_bogus, 8790 &keystorage, downprot?sigalg:NULL, reasonbuf, 8791 sizeof(reasonbuf)); 8792 if(!dnskey && !is_insecure && !reason) 8793 reason = "DNSKEY verify with DS failed"; 8794 } 8795 8796 if(reason) { 8797 auth_zone_zonemd_fail(z, env, reason, ds_bogus, NULL); 8798 lock_rw_unlock(&z->lock); 8799 regional_free_all(env->scratch); 8800 return; 8801 } 8802 8803 auth_zone_verify_zonemd_with_key(z, env, &env->mesh->mods, dnskey, 8804 is_insecure, NULL, downprot?sigalg:NULL); 8805 regional_free_all(env->scratch); 8806 8807 if(z->zonemd_callback_perform_write) { 8808 if(!z->zone_expired) { 8809 /* Write to zonefile if the ZONEMD is okay. */ 8810 perform_write = 1; 8811 /* copy the key to lookup the z structure. 8812 * The new lookup is readonly so concurrent 8813 * queries can continue. */ 8814 if(z->namelen > sizeof(bakname)) { 8815 perform_write = 0; 8816 auth_chunk_list_delete(z->perform_write_chunk_list); 8817 z->perform_write_chunk_list = NULL; 8818 } else { 8819 memcpy(bakname, z->name, z->namelen); 8820 baknamelen = z->namelen; 8821 bakdclass = z->dclass; 8822 chunk_list = z->perform_write_chunk_list; 8823 z->perform_write_chunk_list = NULL; 8824 } 8825 } else { 8826 auth_chunk_list_delete(z->perform_write_chunk_list); 8827 z->perform_write_chunk_list = NULL; 8828 } 8829 z->zonemd_callback_perform_write = 0; 8830 } 8831 lock_rw_unlock(&z->lock); 8832 8833 if(perform_write) { 8834 zone_write_after_update_reacq(bakname, baknamelen, bakdclass, 8835 env, chunk_list); 8836 } 8837 } 8838 8839 /** lookup DNSKEY for ZONEMD verification */ 8840 static int 8841 zonemd_lookup_dnskey(struct auth_zone* z, struct module_env* env) 8842 { 8843 struct query_info qinfo; 8844 uint16_t qflags = BIT_RD; 8845 struct edns_data edns; 8846 sldns_buffer* buf = env->scratch_buffer; 8847 int fetch_ds = 0; 8848 8849 if(!z->fallback_enabled) { 8850 /* we cannot actually get the DNSKEY, because it is in the 8851 * zone we have ourselves, and it is not served yet 8852 * (possibly), so fetch type DS */ 8853 fetch_ds = 1; 8854 } 8855 if(z->zonemd_callback_env) { 8856 /* another worker is already working on the callback 8857 * for the DNSKEY lookup for ZONEMD verification. 8858 * We do not also have to do ZONEMD verification, let that 8859 * worker do it */ 8860 auth_zone_log(z->name, VERB_ALGO, 8861 "zonemd needs lookup of %s and that already is worked on by another worker", (fetch_ds?"DS":"DNSKEY")); 8862 return 1; 8863 } 8864 8865 /* use mesh_new_callback to lookup the DNSKEY, 8866 * and then wait for them to be looked up (in cache, or query) */ 8867 qinfo.qname_len = z->namelen; 8868 qinfo.qname = z->name; 8869 qinfo.qclass = z->dclass; 8870 if(fetch_ds) 8871 qinfo.qtype = LDNS_RR_TYPE_DS; 8872 else qinfo.qtype = LDNS_RR_TYPE_DNSKEY; 8873 qinfo.local_alias = NULL; 8874 if(verbosity >= VERB_ALGO) { 8875 char buf1[512]; 8876 char buf2[LDNS_MAX_DOMAINLEN]; 8877 dname_str(z->name, buf2); 8878 snprintf(buf1, sizeof(buf1), "auth zone %s: lookup %s " 8879 "for zonemd verification", buf2, 8880 (fetch_ds?"DS":"DNSKEY")); 8881 log_query_info(VERB_ALGO, buf1, &qinfo); 8882 } 8883 edns.edns_present = 1; 8884 edns.ext_rcode = 0; 8885 edns.edns_version = 0; 8886 edns.bits = EDNS_DO; 8887 edns.opt_list_in = NULL; 8888 edns.opt_list_out = NULL; 8889 edns.opt_list_inplace_cb_out = NULL; 8890 if(sldns_buffer_capacity(buf) < 65535) 8891 edns.udp_size = (uint16_t)sldns_buffer_capacity(buf); 8892 else edns.udp_size = 65535; 8893 8894 /* store the worker-specific module env for the callback. 8895 * We can then reference this when the callback executes */ 8896 z->zonemd_callback_env = env; 8897 z->zonemd_callback_qtype = qinfo.qtype; 8898 /* the callback can be called straight away */ 8899 lock_rw_unlock(&z->lock); 8900 if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0, 8901 &auth_zonemd_dnskey_lookup_callback, z, 0, 8902 &z->zonemd_callback_unique_info)) { 8903 lock_rw_wrlock(&z->lock); 8904 /* no callback will run; do not leave the pending 8905 * marker set */ 8906 z->zonemd_callback_env = NULL; 8907 log_err("out of memory lookup of %s for zonemd", 8908 (fetch_ds?"DS":"DNSKEY")); 8909 return 0; 8910 } 8911 lock_rw_wrlock(&z->lock); 8912 return 1; 8913 } 8914 8915 void auth_zone_verify_zonemd(struct auth_zone* z, struct module_env* env, 8916 struct module_stack* mods, char** result, int offline, int only_online) 8917 { 8918 char reasonbuf[256]; 8919 char* reason = NULL, *why_bogus = NULL; 8920 struct trust_anchor* anchor = NULL; 8921 struct ub_packed_rrset_key* dnskey = NULL; 8922 struct ub_packed_rrset_key keystorage; 8923 int is_insecure = 0; 8924 /* verify the ZONEMD if present. 8925 * If not present check if absence is allowed by DNSSEC */ 8926 if(!z->zonemd_check) 8927 return; 8928 if(z->data.count == 0) 8929 return; /* no data */ 8930 8931 /* if zone is under a trustanchor */ 8932 /* is it equal to trustanchor - get dnskey's verified */ 8933 /* else, find chain of trust by fetching DNSKEYs lookup for zone */ 8934 /* result if that, if insecure, means no DNSSEC for the ZONEMD, 8935 * otherwise we have the zone DNSKEY for the DNSSEC verification. */ 8936 if(env->anchors) 8937 anchor = anchors_lookup(env->anchors, z->name, z->namelen, 8938 z->dclass); 8939 if(anchor && anchor->numDS == 0 && anchor->numDNSKEY == 0) { 8940 /* domain-insecure trust anchor for unsigned zones */ 8941 lock_basic_unlock(&anchor->lock); 8942 if(only_online) 8943 return; 8944 dnskey = NULL; 8945 is_insecure = 1; 8946 } else if(anchor && query_dname_compare(z->name, anchor->name) == 0) { 8947 if(only_online) { 8948 lock_basic_unlock(&anchor->lock); 8949 return; 8950 } 8951 /* equal to trustanchor, no need for online lookups */ 8952 dnskey = zonemd_get_dnskey_from_anchor(z, env, mods, anchor, 8953 &is_insecure, &why_bogus, &keystorage, reasonbuf, 8954 sizeof(reasonbuf)); 8955 lock_basic_unlock(&anchor->lock); 8956 if(!dnskey && !reason && !is_insecure) { 8957 reason = "verify DNSKEY RRset with trust anchor failed"; 8958 } 8959 } else if(anchor) { 8960 lock_basic_unlock(&anchor->lock); 8961 /* perform online lookups */ 8962 if(offline) 8963 return; 8964 /* setup online lookups, and wait for them */ 8965 if(zonemd_lookup_dnskey(z, env)) { 8966 /* wait for the lookup */ 8967 return; 8968 } 8969 reason = "could not lookup DNSKEY for chain of trust"; 8970 } else { 8971 /* the zone is not under a trust anchor */ 8972 if(only_online) 8973 return; 8974 dnskey = NULL; 8975 is_insecure = 1; 8976 } 8977 8978 if(reason) { 8979 auth_zone_zonemd_fail(z, env, reason, why_bogus, result); 8980 regional_free_all(env->scratch); 8981 return; 8982 } 8983 8984 auth_zone_verify_zonemd_with_key(z, env, mods, dnskey, is_insecure, 8985 result, NULL); 8986 regional_free_all(env->scratch); 8987 } 8988 8989 void auth_zones_pickup_zonemd_verify(struct auth_zones* az, 8990 struct module_env* env) 8991 { 8992 struct auth_zone key; 8993 uint8_t savezname[255+1]; 8994 size_t savezname_len; 8995 struct auth_zone* z; 8996 key.node.key = &key; 8997 lock_rw_rdlock(&az->lock); 8998 RBTREE_FOR(z, struct auth_zone*, &az->ztree) { 8999 lock_rw_wrlock(&z->lock); 9000 if(!z->zonemd_check) { 9001 lock_rw_unlock(&z->lock); 9002 continue; 9003 } 9004 key.dclass = z->dclass; 9005 key.namelabs = z->namelabs; 9006 if(z->namelen > sizeof(savezname)) { 9007 lock_rw_unlock(&z->lock); 9008 log_err("auth_zones_pickup_zonemd_verify: zone name too long"); 9009 continue; 9010 } 9011 savezname_len = z->namelen; 9012 memmove(savezname, z->name, z->namelen); 9013 lock_rw_unlock(&az->lock); 9014 auth_zone_verify_zonemd(z, env, &env->mesh->mods, NULL, 0, 1); 9015 lock_rw_unlock(&z->lock); 9016 lock_rw_rdlock(&az->lock); 9017 /* find the zone we had before, it is not deleted, 9018 * because we have a flag for that that is processed at 9019 * apply_cfg time */ 9020 key.namelen = savezname_len; 9021 key.name = savezname; 9022 z = (struct auth_zone*)rbtree_search(&az->ztree, &key); 9023 if(!z) 9024 break; 9025 } 9026 lock_rw_unlock(&az->lock); 9027 } 9028 9029 /** Get memory usage of auth rrset */ 9030 static size_t 9031 auth_rrset_get_mem(struct auth_rrset* rrset) 9032 { 9033 size_t m = sizeof(*rrset) + packed_rrset_sizeof(rrset->data); 9034 return m; 9035 } 9036 9037 /** Get memory usage of auth data */ 9038 static size_t 9039 auth_data_get_mem(struct auth_data* node) 9040 { 9041 size_t m = sizeof(*node) + node->namelen; 9042 struct auth_rrset* rrset; 9043 for(rrset = node->rrsets; rrset; rrset = rrset->next) { 9044 m += auth_rrset_get_mem(rrset); 9045 } 9046 return m; 9047 } 9048 9049 /** Get memory usage of auth zone */ 9050 static size_t 9051 auth_zone_get_mem(struct auth_zone* z) 9052 { 9053 size_t m = sizeof(*z) + z->namelen; 9054 struct auth_data* node; 9055 if(z->zonefile) 9056 m += strlen(z->zonefile)+1; 9057 RBTREE_FOR(node, struct auth_data*, &z->data) { 9058 m += auth_data_get_mem(node); 9059 } 9060 if(z->rpz) 9061 m += rpz_get_mem(z->rpz); 9062 return m; 9063 } 9064 9065 /** Get memory usage of list of auth addr */ 9066 static size_t 9067 auth_addrs_get_mem(struct auth_addr* list) 9068 { 9069 size_t m = 0; 9070 struct auth_addr* a; 9071 for(a = list; a; a = a->next) { 9072 m += sizeof(*a); 9073 } 9074 return m; 9075 } 9076 9077 /** Get memory usage of list of primaries for auth xfer */ 9078 static size_t 9079 auth_primaries_get_mem(struct auth_master* list) 9080 { 9081 size_t m = 0; 9082 struct auth_master* n; 9083 for(n = list; n; n = n->next) { 9084 m += sizeof(*n); 9085 m += auth_addrs_get_mem(n->list); 9086 if(n->host) 9087 m += strlen(n->host)+1; 9088 if(n->file) 9089 m += strlen(n->file)+1; 9090 } 9091 return m; 9092 } 9093 9094 /** Get memory usage or list of auth chunks */ 9095 static size_t 9096 auth_chunks_get_mem(struct auth_chunk* list) 9097 { 9098 size_t m = 0; 9099 struct auth_chunk* chunk; 9100 for(chunk = list; chunk; chunk = chunk->next) { 9101 m += sizeof(*chunk) + chunk->len; 9102 } 9103 return m; 9104 } 9105 9106 /** Get memory usage of auth xfer */ 9107 static size_t 9108 auth_xfer_get_mem(struct auth_xfer* xfr) 9109 { 9110 size_t m = sizeof(*xfr) + xfr->namelen; 9111 9112 /* auth_nextprobe */ 9113 m += comm_timer_get_mem(xfr->task_nextprobe->timer); 9114 9115 /* auth_probe */ 9116 m += auth_primaries_get_mem(xfr->task_probe->masters); 9117 m += comm_point_get_mem(xfr->task_probe->cp); 9118 m += comm_timer_get_mem(xfr->task_probe->timer); 9119 9120 /* auth_transfer */ 9121 m += auth_chunks_get_mem(xfr->task_transfer->chunks_first); 9122 m += auth_primaries_get_mem(xfr->task_transfer->masters); 9123 m += comm_point_get_mem(xfr->task_transfer->cp); 9124 m += comm_timer_get_mem(xfr->task_transfer->timer); 9125 9126 /* allow_notify_list */ 9127 m += auth_primaries_get_mem(xfr->allow_notify_list); 9128 9129 return m; 9130 } 9131 9132 /** Get memory usage of auth zones ztree */ 9133 static size_t 9134 az_ztree_get_mem(struct auth_zones* az) 9135 { 9136 size_t m = 0; 9137 struct auth_zone* z; 9138 RBTREE_FOR(z, struct auth_zone*, &az->ztree) { 9139 lock_rw_rdlock(&z->lock); 9140 m += auth_zone_get_mem(z); 9141 lock_rw_unlock(&z->lock); 9142 } 9143 return m; 9144 } 9145 9146 /** Get memory usage of auth zones xtree */ 9147 static size_t 9148 az_xtree_get_mem(struct auth_zones* az) 9149 { 9150 size_t m = 0; 9151 struct auth_xfer* xfr; 9152 RBTREE_FOR(xfr, struct auth_xfer*, &az->xtree) { 9153 lock_basic_lock(&xfr->lock); 9154 m += auth_xfer_get_mem(xfr); 9155 lock_basic_unlock(&xfr->lock); 9156 } 9157 return m; 9158 } 9159 9160 size_t auth_zones_get_mem(struct auth_zones* zones) 9161 { 9162 size_t m; 9163 if(!zones) return 0; 9164 m = sizeof(*zones); 9165 lock_rw_rdlock(&zones->rpz_lock); 9166 lock_rw_rdlock(&zones->lock); 9167 m += az_ztree_get_mem(zones); 9168 m += az_xtree_get_mem(zones); 9169 lock_rw_unlock(&zones->lock); 9170 lock_rw_unlock(&zones->rpz_lock); 9171 return m; 9172 } 9173 9174 void xfr_disown_tasks(struct auth_xfer* xfr, struct worker* worker) 9175 { 9176 if(xfr->task_nextprobe->worker == worker) { 9177 xfr_nextprobe_disown(xfr); 9178 } 9179 if(xfr->task_probe->worker == worker) { 9180 xfr_probe_disown(xfr); 9181 } 9182 if(xfr->task_transfer->worker == worker) { 9183 xfr_transfer_disown(xfr); 9184 } 9185 } 9186
Indexes created Sat Oct 03 00:25:10 UTC 2026