1 /* 2 * daemon/daemon.c - collection of workers that handles requests. 3 * 4 * Copyright (c) 2007, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * The daemon consists of global settings and a number of workers. 40 */ 41 42 #include "config.h" 43 #ifdef HAVE_OPENSSL_ERR_H 44 #include <openssl/err.h> 45 #endif 46 47 #ifdef HAVE_OPENSSL_RAND_H 48 #include <openssl/rand.h> 49 #endif 50 51 #ifdef HAVE_OPENSSL_CONF_H 52 #include <openssl/conf.h> 53 #endif 54 55 #ifdef HAVE_OPENSSL_ENGINE_H 56 #include <openssl/engine.h> 57 #endif 58 59 #ifdef HAVE_TIME_H 60 #include <time.h> 61 #endif 62 #include <sys/time.h> 63 64 #ifdef HAVE_NSS 65 /* nss3 */ 66 #include "nss.h" 67 #endif 68 69 #include "daemon/daemon.h" 70 #include "daemon/worker.h" 71 #include "daemon/remote.h" 72 #include "daemon/acl_list.h" 73 #include "util/log.h" 74 #include "util/config_file.h" 75 #include "util/data/msgreply.h" 76 #include "util/shm_side/shm_main.h" 77 #include "util/storage/lookup3.h" 78 #include "util/storage/slabhash.h" 79 #include "util/tcp_conn_limit.h" 80 #include "util/edns.h" 81 #include "services/listen_dnsport.h" 82 #include "services/outside_network.h" 83 #include "services/cache/rrset.h" 84 #include "services/cache/infra.h" 85 #include "services/localzone.h" 86 #include "services/view.h" 87 #include "services/modstack.h" 88 #include "services/authzone.h" 89 #include "util/module.h" 90 #include "util/random.h" 91 #include "util/tube.h" 92 #include "util/net_help.h" 93 #include "sldns/keyraw.h" 94 #include "respip/respip.h" 95 #include "iterator/iter_fwd.h" 96 #include "iterator/iter_hints.h" 97 #include <signal.h> 98 99 #ifdef HAVE_SYSTEMD 100 #include <systemd/sd-daemon.h> 101 #endif 102 #ifdef HAVE_NETDB_H 103 #include <netdb.h> 104 #endif 105 #ifdef USE_CACHEDB 106 #include "cachedb/cachedb.h" 107 #endif 108 109 /** How many quit requests happened. */ 110 static int sig_record_quit = 0; 111 /** How many reload requests happened. */ 112 static int sig_record_reload = 0; 113 114 #if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS 115 /** cleaner ssl memory freeup */ 116 static void* comp_meth = NULL; 117 #endif 118 /** remove buffers for parsing and init */ 119 int ub_c_lex_destroy(void); 120 121 /** used when no other sighandling happens, so we don't die 122 * when multiple signals in quick succession are sent to us. 123 * @param sig: signal number. 124 * @return signal handler return type (void or int). 125 */ 126 static RETSIGTYPE record_sigh(int sig) 127 { 128 #ifdef LIBEVENT_SIGNAL_PROBLEM 129 /* cannot log, verbose here because locks may be held */ 130 /* quit on signal, no cleanup and statistics, 131 because installed libevent version is not threadsafe */ 132 exit(0); 133 #endif 134 switch(sig) 135 { 136 case SIGTERM: 137 #ifdef SIGQUIT 138 case SIGQUIT: 139 #endif 140 #ifdef SIGBREAK 141 case SIGBREAK: 142 #endif 143 case SIGINT: 144 sig_record_quit++; 145 break; 146 #ifdef SIGHUP 147 case SIGHUP: 148 sig_record_reload++; 149 break; 150 #endif 151 #ifdef SIGPIPE 152 case SIGPIPE: 153 break; 154 #endif 155 default: 156 /* ignoring signal */ 157 break; 158 } 159 } 160 161 /** 162 * Signal handling during the time when netevent is disabled. 163 * Stores signals to replay later. 164 */ 165 static void 166 signal_handling_record(void) 167 { 168 if( signal(SIGTERM, record_sigh) == SIG_ERR || 169 #ifdef SIGQUIT 170 signal(SIGQUIT, record_sigh) == SIG_ERR || 171 #endif 172 #ifdef SIGBREAK 173 signal(SIGBREAK, record_sigh) == SIG_ERR || 174 #endif 175 #ifdef SIGHUP 176 signal(SIGHUP, record_sigh) == SIG_ERR || 177 #endif 178 #ifdef SIGPIPE 179 signal(SIGPIPE, SIG_IGN) == SIG_ERR || 180 #endif 181 signal(SIGINT, record_sigh) == SIG_ERR 182 ) 183 log_err("install sighandler: %s", strerror(errno)); 184 } 185 186 /** 187 * Replay old signals. 188 * @param wrk: worker that handles signals. 189 */ 190 static void 191 signal_handling_playback(struct worker* wrk) 192 { 193 #ifdef SIGHUP 194 if(sig_record_reload) 195 worker_sighandler(SIGHUP, wrk); 196 #endif 197 if(sig_record_quit) 198 worker_sighandler(SIGTERM, wrk); 199 sig_record_quit = 0; 200 sig_record_reload = 0; 201 } 202 203 #ifdef HAVE_SSL 204 /* setup a listening ssl context, fatal_exit() on any failure */ 205 static void 206 setup_listen_sslctx(void** ctx, int is_dot, int is_doh, 207 struct config_file* cfg, char* chroot) 208 { 209 char* key = cfg->ssl_service_key; 210 char* pem = cfg->ssl_service_pem; 211 if(chroot && strncmp(key, chroot, strlen(chroot)) == 0) 212 key += strlen(chroot); 213 if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0) 214 pem += strlen(chroot); 215 if(!(*ctx = listen_sslctx_create(key, pem, NULL, 216 cfg->tls_ciphers, cfg->tls_ciphersuites, 217 (cfg->tls_session_ticket_keys.first && 218 cfg->tls_session_ticket_keys.first->str[0] != 0), 219 is_dot, is_doh, cfg->tls_protocols))) { 220 log_err("could not set up listen SSL_CTX"); 221 *ctx = NULL; 222 } 223 } 224 #endif /* HAVE_SSL */ 225 226 #ifdef HAVE_SSL 227 void* daemon_setup_listen_dot_sslctx(struct daemon* daemon, 228 struct config_file* cfg) 229 { 230 void* ctx; 231 (void)setup_listen_sslctx(&ctx, 1, 0, cfg, daemon->chroot); 232 return ctx; 233 } 234 #endif /* HAVE_SSL */ 235 236 #ifdef HAVE_SSL 237 #ifdef HAVE_NGHTTP2_NGHTTP2_H 238 void* daemon_setup_listen_doh_sslctx(struct daemon* daemon, 239 struct config_file* cfg) 240 { 241 void* ctx; 242 (void)setup_listen_sslctx(&ctx, 0, 1, cfg, daemon->chroot); 243 return ctx; 244 } 245 #endif /* HAVE_NGHTTP2_NGHTTP2_H */ 246 #endif /* HAVE_SSL */ 247 248 #ifdef HAVE_SSL 249 #ifdef HAVE_NGTCP2 250 void* daemon_setup_listen_quic_sslctx(struct daemon* daemon, 251 struct config_file* cfg) 252 { 253 void* ctx; 254 char* chroot = daemon->chroot; 255 char* key = cfg->ssl_service_key; 256 char* pem = cfg->ssl_service_pem; 257 if(chroot && strncmp(key, chroot, strlen(chroot)) == 0) 258 key += strlen(chroot); 259 if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0) 260 pem += strlen(chroot); 261 262 if(!(ctx = quic_sslctx_create(key, pem, NULL))) { 263 log_err("could not set up quic SSL_CTX"); 264 return NULL; 265 } 266 return ctx; 267 } 268 #endif /* HAVE_NGTCP2 */ 269 #endif /* HAVE_SSL */ 270 271 #ifdef HAVE_SSL 272 void* daemon_setup_connect_dot_sslctx(struct daemon* daemon, 273 struct config_file* cfg) 274 { 275 void* ctx; 276 char* bundle, *chroot = daemon->chroot; 277 bundle = cfg->tls_cert_bundle; 278 if(chroot && bundle && strncmp(bundle, chroot, strlen(chroot)) == 0) 279 bundle += strlen(chroot); 280 281 if(!(ctx = connect_sslctx_create(NULL, NULL, bundle, 282 cfg->tls_win_cert))) { 283 log_err("could not set up connect SSL_CTX"); 284 return NULL; 285 } 286 return ctx; 287 } 288 #endif /* HAVE_SSL */ 289 290 /* setups the needed ssl contexts, fatal_exit() on any failure */ 291 void 292 daemon_setup_sslctxs(struct daemon* daemon, struct config_file* cfg) 293 { 294 #ifdef HAVE_SSL 295 char* chroot = daemon->chroot; 296 if(cfg->ssl_service_key && cfg->ssl_service_key[0]) { 297 char* key = cfg->ssl_service_key; 298 char* pem = cfg->ssl_service_pem; 299 if(chroot && strncmp(key, chroot, strlen(chroot)) == 0) 300 key += strlen(chroot); 301 if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0) 302 pem += strlen(chroot); 303 304 /* setup the session keys; the callback to use them will be 305 * attached to each sslctx separately */ 306 if(cfg->tls_session_ticket_keys.first && 307 cfg->tls_session_ticket_keys.first->str[0] != 0) { 308 if(!listen_sslctx_setup_ticket_keys( 309 cfg->tls_session_ticket_keys.first, chroot)) { 310 fatal_exit("could not set session ticket SSL_CTX"); 311 } 312 } 313 daemon->listen_dot_sslctx = daemon_setup_listen_dot_sslctx( 314 daemon, cfg); 315 if(!daemon->listen_dot_sslctx) 316 fatal_exit("Could not set up listen dot sslctx"); 317 #ifdef HAVE_NGHTTP2_NGHTTP2_H 318 if(cfg_has_https(cfg)) { 319 daemon->listen_doh_sslctx = 320 daemon_setup_listen_doh_sslctx(daemon, cfg); 321 if(!daemon->listen_doh_sslctx) 322 fatal_exit("Could not set up listen doh sslctx"); 323 } 324 #endif 325 #ifdef HAVE_NGTCP2 326 if(cfg_has_quic(cfg)) { 327 daemon->listen_quic_sslctx = 328 daemon_setup_listen_quic_sslctx(daemon, cfg); 329 if(!daemon->listen_quic_sslctx) 330 fatal_exit("Could not set up listen quic sslctx"); 331 } 332 #endif /* HAVE_NGTCP2 */ 333 334 /* Store the file name and mtime to detect changes later. */ 335 daemon->ssl_service_key = strdup(cfg->ssl_service_key); 336 if(!daemon->ssl_service_key) 337 fatal_exit("could not setup ssl ctx: out of memory"); 338 if(cfg->ssl_service_pem) { 339 daemon->ssl_service_pem = strdup(cfg->ssl_service_pem); 340 if(!daemon->ssl_service_pem) 341 fatal_exit("could not setup ssl ctx: out of memory"); 342 } else { 343 daemon->ssl_service_pem = NULL; 344 } 345 if(!file_get_mtime(key, 346 &daemon->mtime_ssl_service_key, 347 &daemon->mtime_ns_ssl_service_key, NULL)) 348 log_err("Could not stat(%s): %s", 349 key, strerror(errno)); 350 if(pem) { 351 if(!file_get_mtime(pem, 352 &daemon->mtime_ssl_service_pem, 353 &daemon->mtime_ns_ssl_service_pem, NULL)) 354 log_err("Could not stat(%s): %s", 355 pem, strerror(errno)); 356 } else { 357 daemon->mtime_ssl_service_pem = 0; 358 daemon->mtime_ns_ssl_service_pem = 0; 359 } 360 } 361 daemon->connect_dot_sslctx = daemon_setup_connect_dot_sslctx( 362 daemon, cfg); 363 if(!daemon->connect_dot_sslctx) 364 fatal_exit("could not setup connect dot sslctx"); 365 #else /* HAVE_SSL */ 366 (void)daemon;(void)cfg; 367 #endif /* HAVE_SSL */ 368 } 369 370 /** Delete the ssl ctxs */ 371 static void 372 daemon_delete_sslctxs(struct daemon* daemon) 373 { 374 #ifdef HAVE_SSL 375 listen_sslctx_delete_ticket_keys(); 376 SSL_CTX_free((SSL_CTX*)daemon->listen_dot_sslctx); 377 daemon->listen_dot_sslctx = NULL; 378 SSL_CTX_free((SSL_CTX*)daemon->listen_doh_sslctx); 379 daemon->listen_doh_sslctx = NULL; 380 SSL_CTX_free((SSL_CTX*)daemon->connect_dot_sslctx); 381 daemon->connect_dot_sslctx = NULL; 382 free(daemon->ssl_service_key); 383 daemon->ssl_service_key = NULL; 384 free(daemon->ssl_service_pem); 385 daemon->ssl_service_pem = NULL; 386 #else 387 (void)daemon; 388 #endif 389 #ifdef HAVE_NGTCP2 390 SSL_CTX_free((SSL_CTX*)daemon->listen_quic_sslctx); 391 daemon->listen_quic_sslctx = NULL; 392 #endif 393 } 394 395 int 396 ssl_cert_changed(struct daemon* daemon, struct config_file* cfg) 397 { 398 time_t mtime = 0; 399 long ns = 0; 400 char* chroot = daemon->chroot; 401 char* key = cfg->ssl_service_key; 402 char* pem = cfg->ssl_service_pem; 403 log_assert(daemon->ssl_service_key && cfg->ssl_service_key); 404 if(chroot && strncmp(key, chroot, strlen(chroot)) == 0) 405 key += strlen(chroot); 406 if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0) 407 pem += strlen(chroot); 408 409 if(strcmp(daemon->ssl_service_key, cfg->ssl_service_key) != 0) 410 return 1; 411 if(daemon->ssl_service_pem && cfg->ssl_service_pem && 412 strcmp(daemon->ssl_service_pem, cfg->ssl_service_pem) != 0) 413 return 1; 414 if(!file_get_mtime(key, &mtime, &ns, NULL)) { 415 log_err("Could not stat(%s): %s", 416 key, strerror(errno)); 417 /* It has probably changed, but file read is likely going to 418 * fail. */ 419 return 0; 420 } 421 if(mtime != daemon->mtime_ssl_service_key || 422 ns != daemon->mtime_ns_ssl_service_key) 423 return 1; 424 if(pem) { 425 if(!file_get_mtime(pem, &mtime, &ns, NULL)) { 426 log_err("Could not stat(%s): %s", 427 pem, strerror(errno)); 428 /* It has probably changed, but file read is likely going to 429 * fail. */ 430 return 0; 431 } 432 if(mtime != daemon->mtime_ssl_service_pem || 433 ns != daemon->mtime_ns_ssl_service_pem) 434 return 1; 435 } 436 return 0; 437 } 438 439 /** Reload the sslctxs if they have changed */ 440 static void 441 daemon_reload_sslctxs(struct daemon* daemon) 442 { 443 #ifdef HAVE_SSL 444 if(daemon->cfg->ssl_service_key && daemon->cfg->ssl_service_key[0]) { 445 /* See if changed */ 446 if(!daemon->ssl_service_key || 447 ssl_cert_changed(daemon,daemon->cfg)) { 448 verbose(VERB_ALGO, "Reloading certificates"); 449 daemon_delete_sslctxs(daemon); 450 daemon_setup_sslctxs(daemon, daemon->cfg); 451 } 452 } else { 453 /* See if sslctxs are removed from config. */ 454 if(daemon->ssl_service_key) { 455 verbose(VERB_ALGO, "Removing certificates"); 456 daemon_delete_sslctxs(daemon); 457 } 458 } 459 #else 460 (void)daemon; 461 #endif 462 } 463 464 struct daemon* 465 daemon_init(void) 466 { 467 struct daemon* daemon = (struct daemon*)calloc(1, 468 sizeof(struct daemon)); 469 #ifdef USE_WINSOCK 470 int r; 471 WSADATA wsa_data; 472 #endif 473 if(!daemon) 474 return NULL; 475 #ifdef USE_WINSOCK 476 r = WSAStartup(MAKEWORD(2,2), &wsa_data); 477 if(r != 0) { 478 fatal_exit("could not init winsock. WSAStartup: %s", 479 wsa_strerror(r)); 480 } 481 #endif /* USE_WINSOCK */ 482 signal_handling_record(); 483 #ifdef HAVE_SSL 484 # ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS 485 ERR_load_crypto_strings(); 486 # endif 487 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL) 488 ERR_load_SSL_strings(); 489 #endif 490 # ifdef USE_GOST 491 (void)sldns_key_EVP_load_gost_id(); 492 # endif 493 # if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_CRYPTO) 494 # ifndef S_SPLINT_S 495 OpenSSL_add_all_algorithms(); 496 # endif 497 # else 498 OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS 499 | OPENSSL_INIT_ADD_ALL_DIGESTS 500 | OPENSSL_INIT_LOAD_CRYPTO_STRINGS 501 # if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS) 502 | OPENSSL_INIT_NO_LOAD_CONFIG 503 # endif 504 , NULL); 505 # endif 506 # if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS 507 /* grab the COMP method ptr because openssl leaks it */ 508 comp_meth = (void*)SSL_COMP_get_compression_methods(); 509 # endif 510 # if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL) 511 (void)SSL_library_init(); 512 # else 513 (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS 514 # if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS) 515 | OPENSSL_INIT_NO_LOAD_CONFIG 516 # endif 517 , NULL); 518 # endif 519 # if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED) 520 if(!ub_openssl_lock_init()) 521 fatal_exit("could not init openssl locks"); 522 # endif 523 #elif defined(HAVE_NSS) 524 if(NSS_NoDB_Init(NULL) != SECSuccess) 525 fatal_exit("could not init NSS"); 526 #endif /* HAVE_SSL or HAVE_NSS */ 527 #ifdef HAVE_TZSET 528 /* init timezone info while we are not chrooted yet */ 529 tzset(); 530 #endif 531 daemon->need_to_exit = 0; 532 modstack_init(&daemon->mods); 533 if(!(daemon->env = (struct module_env*)calloc(1, 534 sizeof(*daemon->env)))) { 535 free(daemon); 536 return NULL; 537 } 538 daemon->env->modstack = &daemon->mods; 539 /* init edns_known_options */ 540 if(!edns_known_options_init(daemon->env)) { 541 free(daemon->env); 542 free(daemon); 543 return NULL; 544 } 545 alloc_init(&daemon->superalloc, NULL, 0); 546 daemon->acl = acl_list_create(); 547 if(!daemon->acl) { 548 edns_known_options_delete(daemon->env); 549 free(daemon->env); 550 free(daemon); 551 return NULL; 552 } 553 daemon->acl_interface = acl_list_create(); 554 if(!daemon->acl_interface) { 555 acl_list_delete(daemon->acl); 556 edns_known_options_delete(daemon->env); 557 free(daemon->env); 558 free(daemon); 559 return NULL; 560 } 561 daemon->tcl = tcl_list_create(); 562 if(!daemon->tcl) { 563 acl_list_delete(daemon->acl_interface); 564 acl_list_delete(daemon->acl); 565 edns_known_options_delete(daemon->env); 566 free(daemon->env); 567 free(daemon); 568 return NULL; 569 } 570 listen_setup_locks(); 571 if(gettimeofday(&daemon->time_boot, NULL) < 0) 572 log_err("gettimeofday: %s", strerror(errno)); 573 daemon->time_last_stat = daemon->time_boot; 574 if((daemon->env->auth_zones = auth_zones_create()) == 0) { 575 acl_list_delete(daemon->acl_interface); 576 acl_list_delete(daemon->acl); 577 tcl_list_delete(daemon->tcl); 578 edns_known_options_delete(daemon->env); 579 free(daemon->env); 580 free(daemon); 581 return NULL; 582 } 583 if(!(daemon->env->edns_strings = edns_strings_create())) { 584 auth_zones_delete(daemon->env->auth_zones); 585 acl_list_delete(daemon->acl_interface); 586 acl_list_delete(daemon->acl); 587 tcl_list_delete(daemon->tcl); 588 edns_known_options_delete(daemon->env); 589 free(daemon->env); 590 free(daemon); 591 return NULL; 592 } 593 return daemon; 594 } 595 596 int setup_acl_for_ports(struct acl_list* list, struct listen_port* port_list) 597 { 598 struct acl_addr* acl_node; 599 for(; port_list; port_list=port_list->next) { 600 if(!port_list->socket) { 601 /* This is mainly for testbound where port_list is 602 * empty. */ 603 continue; 604 } 605 if(!(acl_node = acl_interface_insert(list, 606 (struct sockaddr_storage*)port_list->socket->addr, 607 port_list->socket->addrlen, 608 acl_refuse))) { 609 return 0; 610 } 611 port_list->socket->acl = acl_node; 612 } 613 return 1; 614 } 615 616 int 617 daemon_open_shared_ports(struct daemon* daemon) 618 { 619 log_assert(daemon); 620 if(daemon->cfg->port != daemon->listening_port) { 621 char** resif = NULL; 622 int num_resif = 0; 623 size_t i; 624 struct listen_port* p0; 625 daemon->reuseport = 0; 626 /* free and close old ports */ 627 if(daemon->ports != NULL) { 628 for(i=0; i<daemon->num_ports; i++) 629 listening_ports_free(daemon->ports[i]); 630 free(daemon->ports); 631 daemon->ports = NULL; 632 } 633 /* clean acl_interface */ 634 acl_interface_init(daemon->acl_interface); 635 if(!resolve_interface_names(daemon->cfg->ifs, 636 daemon->cfg->num_ifs, NULL, &resif, &num_resif)) 637 return 0; 638 /* see if we want to reuseport */ 639 #ifdef SO_REUSEPORT 640 if(daemon->cfg->so_reuseport && daemon->cfg->num_threads > 0) 641 daemon->reuseport = 1; 642 #endif 643 /* try to use reuseport */ 644 p0 = listening_ports_open(daemon->cfg, resif, num_resif, 645 &daemon->reuseport); 646 if(!p0) { 647 listening_ports_free(p0); 648 config_del_strarray(resif, num_resif); 649 return 0; 650 } 651 if(daemon->reuseport) { 652 /* reuseport was successful, allocate for it */ 653 daemon->num_ports = (size_t)daemon->cfg->num_threads; 654 } else { 655 /* do the normal, singleportslist thing, 656 * reuseport not enabled or did not work */ 657 daemon->num_ports = 1; 658 } 659 if(!(daemon->ports = (struct listen_port**)calloc( 660 daemon->num_ports, sizeof(*daemon->ports)))) { 661 listening_ports_free(p0); 662 config_del_strarray(resif, num_resif); 663 return 0; 664 } 665 daemon->ports[0] = p0; 666 if(!setup_acl_for_ports(daemon->acl_interface, 667 daemon->ports[0])) { 668 listening_ports_free(p0); 669 config_del_strarray(resif, num_resif); 670 return 0; 671 } 672 if(daemon->reuseport) { 673 /* continue to use reuseport */ 674 for(i=1; i<daemon->num_ports; i++) { 675 if(!(daemon->ports[i]= 676 listening_ports_open(daemon->cfg, 677 resif, num_resif, 678 &daemon->reuseport)) 679 || !daemon->reuseport ) { 680 for(i=0; i<daemon->num_ports; i++) 681 listening_ports_free(daemon->ports[i]); 682 free(daemon->ports); 683 daemon->ports = NULL; 684 config_del_strarray(resif, num_resif); 685 return 0; 686 } 687 if(!setup_acl_for_ports(daemon->acl_interface, 688 daemon->ports[i])) { 689 for(i=0; i<daemon->num_ports; i++) 690 listening_ports_free(daemon->ports[i]); 691 free(daemon->ports); 692 daemon->ports = NULL; 693 config_del_strarray(resif, num_resif); 694 return 0; 695 } 696 } 697 } 698 config_del_strarray(resif, num_resif); 699 daemon->listening_port = daemon->cfg->port; 700 } 701 if(!daemon->cfg->remote_control_enable && daemon->rc_port) { 702 listening_ports_free(daemon->rc_ports); 703 daemon->rc_ports = NULL; 704 daemon->rc_port = 0; 705 } 706 if(daemon->cfg->remote_control_enable && 707 daemon->cfg->control_port != daemon->rc_port) { 708 listening_ports_free(daemon->rc_ports); 709 if(!(daemon->rc_ports=daemon_remote_open_ports(daemon->cfg))) 710 return 0; 711 daemon->rc_port = daemon->cfg->control_port; 712 } 713 return 1; 714 } 715 716 int 717 daemon_privileged(struct daemon* daemon) 718 { 719 daemon->env->cfg = daemon->cfg; 720 daemon->env->alloc = &daemon->superalloc; 721 daemon->env->worker = NULL; 722 if(!modstack_call_startup(&daemon->mods, daemon->cfg->module_conf, 723 daemon->env)) { 724 fatal_exit("failed to startup modules"); 725 } 726 return 1; 727 } 728 729 /** 730 * Setup modules. setup module stack. 731 * @param daemon: the daemon 732 */ 733 static void daemon_setup_modules(struct daemon* daemon) 734 { 735 daemon->env->cfg = daemon->cfg; 736 daemon->env->alloc = &daemon->superalloc; 737 daemon->env->worker = NULL; 738 if(daemon->mods_inited) { 739 modstack_call_deinit(&daemon->mods, daemon->env); 740 } 741 daemon->env->need_to_validate = 0; /* set by module init below */ 742 if(!modstack_call_init(&daemon->mods, daemon->cfg->module_conf, 743 daemon->env)) { 744 fatal_exit("failed to init modules"); 745 } 746 daemon->mods_inited = 1; 747 log_edns_known_options(VERB_ALGO, daemon->env); 748 } 749 750 /** 751 * Obtain allowed port numbers, concatenate the list, and shuffle them 752 * (ready to be handed out to threads). 753 * @param daemon: the daemon. Uses rand and cfg. 754 * @param shufport: the portlist output. 755 * @return number of ports available. 756 */ 757 static int daemon_get_shufport(struct daemon* daemon, int* shufport) 758 { 759 int i, n, k, temp; 760 int avail = 0; 761 for(i=0; i<65536; i++) { 762 if(daemon->cfg->outgoing_avail_ports[i]) { 763 shufport[avail++] = daemon->cfg-> 764 outgoing_avail_ports[i]; 765 } 766 } 767 if(avail == 0) 768 fatal_exit("no ports are permitted for UDP, add " 769 "with outgoing-port-permit"); 770 /* Knuth shuffle */ 771 n = avail; 772 while(--n > 0) { 773 k = ub_random_max(daemon->rand, n+1); /* 0<= k<= n */ 774 temp = shufport[k]; 775 shufport[k] = shufport[n]; 776 shufport[n] = temp; 777 } 778 return avail; 779 } 780 781 /** 782 * Clear and delete per-worker alloc caches, and free memory maintained in 783 * superalloc. 784 * The rrset and message caches must be empty at the time of call. 785 * @param daemon: the daemon that maintains the alloc caches to be cleared. 786 */ 787 static void 788 daemon_clear_allocs(struct daemon* daemon) 789 { 790 int i; 791 792 /* daemon->num may be different during reloads (after configuration 793 * read). Use old_num which has the correct value used to setup the 794 * worker_allocs */ 795 for(i=0; i<daemon->old_num; i++) { 796 alloc_clear(daemon->worker_allocs[i]); 797 free(daemon->worker_allocs[i]); 798 } 799 free(daemon->worker_allocs); 800 daemon->worker_allocs = NULL; 801 802 alloc_clear_special(&daemon->superalloc); 803 } 804 805 /** 806 * Allocate empty worker structures. With backptr and thread-number, 807 * from 0..numthread initialised. Used as user arguments to new threads. 808 * Creates the daemon random generator if it does not exist yet. 809 * The random generator stays existing between reloads with a unique state. 810 * @param daemon: the daemon with (new) config settings. 811 */ 812 static void 813 daemon_create_workers(struct daemon* daemon) 814 { 815 int i, numport; 816 int* shufport; 817 log_assert(daemon && daemon->cfg); 818 if(!daemon->rand) { 819 daemon->rand = ub_initstate(NULL); 820 if(!daemon->rand) 821 fatal_exit("could not init random generator"); 822 hash_set_raninit((uint32_t)ub_random(daemon->rand)); 823 } 824 shufport = (int*)calloc(65536, sizeof(int)); 825 if(!shufport) 826 fatal_exit("out of memory during daemon init"); 827 numport = daemon_get_shufport(daemon, shufport); 828 verbose(VERB_ALGO, "total of %d outgoing ports available", numport); 829 if(!(daemon->shared_ports = shared_ports_create(daemon->cfg->out_ifs, 830 daemon->cfg->num_out_ifs, daemon->cfg->do_ip4, 831 daemon->cfg->do_ip6, shufport, numport))) 832 fatal_exit("could not setup shared ports: out of memory"); 833 834 #ifdef HAVE_NGTCP2 835 if (cfg_has_quic(daemon->cfg)) { 836 daemon->doq_table = doq_table_create(daemon->cfg, daemon->rand); 837 if(!daemon->doq_table) 838 fatal_exit("could not create doq_table: out of memory"); 839 } 840 #endif 841 842 daemon->num = (daemon->cfg->num_threads?daemon->cfg->num_threads:1); 843 if(daemon->reuseport && (int)daemon->num < (int)daemon->num_ports) { 844 log_warn("cannot reduce num-threads to %d because so-reuseport " 845 "so continuing with %d threads.", (int)daemon->num, 846 (int)daemon->num_ports); 847 daemon->num = (int)daemon->num_ports; 848 } 849 daemon->workers = (struct worker**)calloc((size_t)daemon->num, 850 sizeof(struct worker*)); 851 if(!daemon->workers) 852 fatal_exit("out of memory during daemon init"); 853 if(daemon->cfg->dnstap) { 854 #ifdef USE_DNSTAP 855 daemon->dtenv = dt_create(daemon->cfg); 856 if (!daemon->dtenv) 857 fatal_exit("dt_create failed"); 858 #else 859 fatal_exit("dnstap enabled in config but not built with dnstap support"); 860 #endif 861 } 862 for(i=0; i<daemon->num; i++) { 863 if(!(daemon->workers[i] = worker_create(daemon, i))) 864 fatal_exit("could not create worker"); 865 } 866 /* create per-worker alloc caches if not reusing existing ones. */ 867 if(!daemon->worker_allocs) { 868 daemon->worker_allocs = (struct alloc_cache**)calloc( 869 (size_t)daemon->num, sizeof(struct alloc_cache*)); 870 if(!daemon->worker_allocs) 871 fatal_exit("could not allocate worker allocs"); 872 for(i=0; i<daemon->num; i++) { 873 struct alloc_cache* alloc = calloc(1, 874 sizeof(struct alloc_cache)); 875 if (!alloc) 876 fatal_exit("could not allocate worker alloc"); 877 alloc_init(alloc, &daemon->superalloc, i); 878 daemon->worker_allocs[i] = alloc; 879 } 880 } 881 free(shufport); 882 } 883 884 #ifdef THREADS_DISABLED 885 /** 886 * Close all pipes except for the numbered thread. 887 * @param daemon: daemon to close pipes in. 888 * @param thr: thread number 0..num-1 of thread to skip. 889 */ 890 static void close_other_pipes(struct daemon* daemon, int thr) 891 { 892 int i; 893 for(i=0; i<daemon->num; i++) 894 if(i!=thr) { 895 if(i==0) { 896 /* only close read part, need to write stats */ 897 tube_close_read(daemon->workers[i]->cmd); 898 } else { 899 /* complete close channel to others */ 900 tube_delete(daemon->workers[i]->cmd); 901 daemon->workers[i]->cmd = NULL; 902 } 903 } 904 } 905 #endif /* THREADS_DISABLED */ 906 907 /** 908 * Function to set the thread local log ID. 909 * Either the internal thread number, or the LWP ID on Linux based on 910 * configuration. 911 */ 912 static void 913 set_log_thread_id(struct worker* worker, struct config_file* cfg) 914 { 915 (void)cfg; 916 log_assert(worker); 917 #if defined(HAVE_GETTID) && !defined(THREADS_DISABLED) 918 worker->thread_tid = gettid(); 919 if(cfg->log_thread_id) 920 log_thread_set(&worker->thread_tid); 921 else 922 #endif 923 log_thread_set(&worker->thread_num); 924 } 925 926 /** 927 * Function to start one thread. 928 * @param arg: user argument. 929 * @return: void* user return value could be used for thread_join results. 930 */ 931 static void* 932 thread_start(void* arg) 933 { 934 struct worker* worker = (struct worker*)arg; 935 int port_num = 0; 936 set_log_thread_id(worker, worker->daemon->cfg); 937 { 938 char name[16]; /* seems to be the safest size between 939 different OSes */ 940 snprintf(name, sizeof(name), "unbound/%u", worker->thread_num); 941 /* worker->thr_id can be written to after the thread was made 942 * by the creating thread, so this uses pthread_self. */ 943 ub_thread_setname(ub_thread_self(), name); 944 } 945 ub_thread_blocksigs(); 946 #ifdef THREADS_DISABLED 947 /* close pipe ends used by main */ 948 tube_close_write(worker->cmd); 949 close_other_pipes(worker->daemon, worker->thread_num); 950 #endif 951 #ifdef SO_REUSEPORT 952 if(worker->daemon->cfg->so_reuseport) 953 port_num = worker->thread_num % worker->daemon->num_ports; 954 else 955 port_num = 0; 956 #endif 957 if(!worker_init(worker, worker->daemon->cfg, 958 worker->daemon->ports[port_num], 0)) { 959 fatal_exit("Could not initialize thread"); 960 } 961 962 worker_work(worker); 963 return NULL; 964 } 965 966 /** 967 * Fork and init the other threads. Main thread returns for special handling. 968 * @param daemon: the daemon with other threads to fork. 969 */ 970 static void 971 daemon_start_others(struct daemon* daemon) 972 { 973 int i; 974 log_assert(daemon); 975 verbose(VERB_ALGO, "start threads"); 976 /* skip i=0, is this thread */ 977 for(i=1; i<daemon->num; i++) { 978 ub_thread_create(&daemon->workers[i]->thr_id, 979 thread_start, daemon->workers[i]); 980 #ifdef THREADS_DISABLED 981 /* close pipe end of child */ 982 tube_close_read(daemon->workers[i]->cmd); 983 #endif /* no threads */ 984 } 985 } 986 987 /** 988 * Stop the other threads. 989 * @param daemon: the daemon with other threads. 990 */ 991 static void 992 daemon_stop_others(struct daemon* daemon) 993 { 994 int i; 995 log_assert(daemon); 996 verbose(VERB_ALGO, "stop threads"); 997 /* skip i=0, is this thread */ 998 /* use i=0 buffer for sending cmds; because we are #0 */ 999 for(i=1; i<daemon->num; i++) { 1000 worker_send_cmd(daemon->workers[i], worker_cmd_quit); 1001 } 1002 /* wait for them to quit */ 1003 for(i=1; i<daemon->num; i++) { 1004 /* join it to make sure its dead */ 1005 verbose(VERB_ALGO, "join %d", i); 1006 ub_thread_join(daemon->workers[i]->thr_id); 1007 verbose(VERB_ALGO, "join success %d", i); 1008 } 1009 } 1010 1011 void 1012 daemon_fork(struct daemon* daemon) 1013 { 1014 int have_view_respip_cfg = 0; 1015 #ifdef HAVE_SYSTEMD 1016 int ret; 1017 #endif 1018 1019 log_assert(daemon); 1020 daemon_reload_sslctxs(daemon); 1021 if(!(daemon->env->views = views_create())) 1022 fatal_exit("Could not create views: out of memory"); 1023 /* create individual views and their localzone/data trees */ 1024 if(!views_apply_cfg(daemon->env->views, daemon->cfg)) 1025 fatal_exit("Could not set up views"); 1026 1027 if(!acl_list_apply_cfg(daemon->acl, daemon->cfg, daemon->env->views)) 1028 fatal_exit("Could not setup access control list"); 1029 if(!acl_interface_apply_cfg(daemon->acl_interface, daemon->cfg, 1030 daemon->env->views)) 1031 fatal_exit("Could not setup interface control list"); 1032 if(!tcl_list_apply_cfg(daemon->tcl, daemon->cfg)) 1033 fatal_exit("Could not setup TCP connection limits"); 1034 if(daemon->cfg->dnscrypt) { 1035 #ifdef USE_DNSCRYPT 1036 daemon->dnscenv = dnsc_create(); 1037 if (!daemon->dnscenv) 1038 fatal_exit("dnsc_create failed"); 1039 dnsc_apply_cfg(daemon->dnscenv, daemon->cfg); 1040 #else 1041 fatal_exit("dnscrypt enabled in config but unbound was not built with " 1042 "dnscrypt support"); 1043 #endif 1044 } 1045 if(daemon->cfg->cookie_secret_file && 1046 daemon->cfg->cookie_secret_file[0]) { 1047 if(!(daemon->cookie_secrets = cookie_secrets_create())) 1048 fatal_exit("Could not create cookie_secrets: out of memory"); 1049 if(!cookie_secrets_apply_cfg(daemon->cookie_secrets, 1050 daemon->cfg->cookie_secret_file)) 1051 fatal_exit("Could not setup cookie_secrets"); 1052 } 1053 /* create global local_zones */ 1054 if(!(daemon->local_zones = local_zones_create())) 1055 fatal_exit("Could not create local zones: out of memory"); 1056 if(!local_zones_apply_cfg(daemon->local_zones, daemon->cfg)) 1057 fatal_exit("Could not set up local zones"); 1058 if(!(daemon->env->fwds = forwards_create()) || 1059 !forwards_apply_cfg(daemon->env->fwds, daemon->cfg)) 1060 fatal_exit("Could not set forward zones"); 1061 if(!(daemon->env->hints = hints_create()) || 1062 !hints_apply_cfg(daemon->env->hints, daemon->cfg)) 1063 fatal_exit("Could not set root or stub hints"); 1064 1065 /* process raw response-ip configuration data */ 1066 if(!(daemon->env->respip_set = respip_set_create())) 1067 fatal_exit("Could not create response IP set"); 1068 if(!respip_global_apply_cfg(daemon->env->respip_set, daemon->cfg)) 1069 fatal_exit("Could not set up response IP set"); 1070 if(!respip_views_apply_cfg(daemon->env->views, daemon->cfg, 1071 &have_view_respip_cfg)) 1072 fatal_exit("Could not set up per-view response IP sets"); 1073 daemon->use_response_ip = !respip_set_is_empty( 1074 daemon->env->respip_set) || have_view_respip_cfg; 1075 1076 /* setup modules */ 1077 daemon_setup_modules(daemon); 1078 1079 /* read auth zonefiles */ 1080 if(!auth_zones_apply_cfg(daemon->env->auth_zones, daemon->cfg, 1, 1081 &daemon->use_rpz, daemon->env, &daemon->mods)) 1082 fatal_exit("auth_zones could not be setup"); 1083 1084 /* Set-up EDNS strings */ 1085 if(!edns_strings_apply_cfg(daemon->env->edns_strings, daemon->cfg)) 1086 fatal_exit("Could not set up EDNS strings"); 1087 1088 #ifdef USE_CACHEDB 1089 daemon->env->cachedb_enabled = cachedb_is_enabled(&daemon->mods, 1090 daemon->env); 1091 #endif 1092 /* response-ip-xxx options don't work as expected without the respip 1093 * module. To avoid run-time operational surprise we reject such 1094 * configuration. */ 1095 if(daemon->use_response_ip && 1096 modstack_find(&daemon->mods, "respip") < 0) 1097 fatal_exit("response-ip options require respip module"); 1098 /* RPZ response ip triggers don't work as expected without the respip 1099 * module. To avoid run-time operational surprise we reject such 1100 * configuration. */ 1101 if(daemon->use_rpz && 1102 modstack_find(&daemon->mods, "respip") < 0) 1103 fatal_exit("RPZ requires the respip module"); 1104 1105 /* first create all the worker structures, so we can pass 1106 * them to the newly created threads. 1107 */ 1108 daemon_create_workers(daemon); 1109 /* Set it for the first (main) worker since it does not take part in 1110 * the thread_start() procedure. 1111 */ 1112 set_log_thread_id(daemon->workers[0], daemon->cfg); 1113 /* If shm stats need an offset, calculate it */ 1114 if(daemon->cfg->shm_enable && daemon->cfg->stat_interval > 0) { 1115 daemon->stat_time_specific = 1; 1116 daemon->stat_time_offset = 1117 ((int)time(NULL))%daemon->cfg->stat_interval; 1118 } 1119 1120 #if defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP) 1121 /* in libev the first inited base gets signals */ 1122 if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports[0], 1)) { 1123 fatal_exit("Could not initialize main thread"); 1124 } 1125 #endif 1126 1127 /* Now create the threads and init the workers. 1128 * By the way, this is thread #0 (the main thread). 1129 */ 1130 daemon_start_others(daemon); 1131 1132 /* Special handling for the main thread. This is the thread 1133 * that handles signals and remote control. 1134 */ 1135 #if !(defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)) 1136 /* libevent has the last inited base get signals (or any base) */ 1137 if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports[0], 1)) { 1138 fatal_exit("Could not initialize main thread"); 1139 } 1140 #endif 1141 signal_handling_playback(daemon->workers[0]); 1142 1143 if (!shm_main_init(daemon)) 1144 log_warn("SHM has failed"); 1145 1146 /* Start resolver service on main thread. */ 1147 #ifdef HAVE_SYSTEMD 1148 ret = sd_notify(0, "READY=1"); 1149 if(ret <= 0 && getenv("NOTIFY_SOCKET")) 1150 fatal_exit("sd_notify failed %s: %s. Make sure that unbound has " 1151 "access/permission to use the socket presented by systemd.", 1152 getenv("NOTIFY_SOCKET"), 1153 (ret==0?"no $NOTIFY_SOCKET": strerror(-ret))); 1154 #endif 1155 log_info("start of service (%s).", PACKAGE_STRING); 1156 worker_work(daemon->workers[0]); 1157 #ifdef HAVE_SYSTEMD 1158 if (daemon->workers[0]->need_to_exit) 1159 sd_notify(0, "STOPPING=1"); 1160 else 1161 sd_notify(0, "RELOADING=1"); 1162 #endif 1163 log_info("service stopped (%s).", PACKAGE_STRING); 1164 1165 /* we exited! a signal happened! Stop other threads */ 1166 daemon_stop_others(daemon); 1167 1168 /* Shutdown SHM */ 1169 shm_main_shutdown(daemon); 1170 1171 daemon->reuse_cache = daemon->workers[0]->reuse_cache; 1172 daemon->need_to_exit = daemon->workers[0]->need_to_exit; 1173 } 1174 1175 void 1176 daemon_cleanup(struct daemon* daemon) 1177 { 1178 int i; 1179 log_assert(daemon); 1180 /* before stopping main worker, handle signals ourselves, so we 1181 don't die on multiple reload signals for example. */ 1182 signal_handling_record(); 1183 /* clean up caches because 1184 * a) RRset IDs will be recycled after a reload, causing collisions 1185 * b) validation config can change, thus rrset, msg, keycache clear 1186 * 1187 * If we are trying to keep the cache as long as possible, we should 1188 * defer the cleanup until we know whether the new configuration allows 1189 * the reuse. (If we're exiting, cleanup should be done here). */ 1190 if(!daemon->reuse_cache || daemon->need_to_exit) { 1191 slabhash_clear(&daemon->env->rrset_cache->table); 1192 slabhash_clear(daemon->env->msg_cache); 1193 } 1194 daemon->old_num = daemon->num; /* save the current num */ 1195 forwards_delete(daemon->env->fwds); 1196 daemon->env->fwds = NULL; 1197 hints_delete(daemon->env->hints); 1198 daemon->env->hints = NULL; 1199 local_zones_delete(daemon->local_zones); 1200 daemon->local_zones = NULL; 1201 respip_set_delete(daemon->env->respip_set); 1202 daemon->env->respip_set = NULL; 1203 views_delete(daemon->env->views); 1204 daemon->env->views = NULL; 1205 if(daemon->env->auth_zones) 1206 auth_zones_cleanup(daemon->env->auth_zones); 1207 /* key cache is cleared by module deinit during next daemon_fork() */ 1208 daemon_remote_clear(daemon->rc); 1209 if(daemon->fast_reload_thread) 1210 fast_reload_thread_stop(daemon->fast_reload_thread); 1211 if(daemon->fast_reload_printq_list) 1212 fast_reload_printq_list_delete(daemon->fast_reload_printq_list); 1213 for(i=0; i<daemon->num; i++) 1214 worker_delete(daemon->workers[i]); 1215 free(daemon->workers); 1216 daemon->workers = NULL; 1217 /* Unless we're trying to keep the cache, worker alloc_caches should be 1218 * cleared and freed here. We do this after deleting workers to 1219 * guarantee that the alloc caches are valid throughout the lifetime 1220 * of workers. */ 1221 if(!daemon->reuse_cache || daemon->need_to_exit) 1222 daemon_clear_allocs(daemon); 1223 daemon->num = 0; 1224 shared_ports_delete(daemon->shared_ports); 1225 daemon->shared_ports = NULL; 1226 #ifdef USE_DNSTAP 1227 dt_delete(daemon->dtenv); 1228 daemon->dtenv = NULL; 1229 #endif 1230 #ifdef USE_DNSCRYPT 1231 dnsc_delete(daemon->dnscenv); 1232 daemon->dnscenv = NULL; 1233 #endif 1234 #ifdef HAVE_NGTCP2 1235 if (daemon->doq_table) { 1236 doq_table_delete(daemon->doq_table); 1237 daemon->doq_table = NULL; 1238 } 1239 #endif 1240 daemon->cfg = NULL; 1241 } 1242 1243 void 1244 daemon_delete(struct daemon* daemon) 1245 { 1246 size_t i; 1247 if(!daemon) 1248 return; 1249 modstack_call_deinit(&daemon->mods, daemon->env); 1250 modstack_call_destartup(&daemon->mods, daemon->env); 1251 modstack_free(&daemon->mods); 1252 daemon_remote_delete(daemon->rc); 1253 for(i = 0; i < daemon->num_ports; i++) 1254 listening_ports_free(daemon->ports[i]); 1255 free(daemon->ports); 1256 listening_ports_free(daemon->rc_ports); 1257 if(daemon->env) { 1258 slabhash_delete(daemon->env->msg_cache); 1259 rrset_cache_delete(daemon->env->rrset_cache); 1260 infra_delete(daemon->env->infra_cache); 1261 edns_known_options_delete(daemon->env); 1262 edns_strings_delete(daemon->env->edns_strings); 1263 auth_zones_delete(daemon->env->auth_zones); 1264 } 1265 ub_randfree(daemon->rand); 1266 alloc_clear(&daemon->superalloc); 1267 acl_list_delete(daemon->acl); 1268 acl_list_delete(daemon->acl_interface); 1269 tcl_list_delete(daemon->tcl); 1270 cookie_secrets_delete(daemon->cookie_secrets); 1271 listen_desetup_locks(); 1272 free(daemon->chroot); 1273 free(daemon->pidfile); 1274 free(daemon->cfgfile); 1275 free(daemon->env); 1276 daemon_delete_sslctxs(daemon); 1277 free(daemon); 1278 /* lex cleanup */ 1279 ub_c_lex_destroy(); 1280 /* libcrypto cleanup */ 1281 #ifdef HAVE_SSL 1282 # if defined(USE_GOST) 1283 sldns_key_EVP_unload_gost(); 1284 # endif 1285 # if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS && HAVE_DECL_SK_SSL_COMP_POP_FREE 1286 # ifndef S_SPLINT_S 1287 # if OPENSSL_VERSION_NUMBER < 0x10100000 1288 sk_SSL_COMP_pop_free(comp_meth, (void(*)(SSL_COMP*))CRYPTO_free); 1289 # endif 1290 # endif 1291 # endif 1292 # ifdef HAVE_OPENSSL_CONFIG 1293 EVP_cleanup(); 1294 # if (OPENSSL_VERSION_NUMBER < 0x10100000) && !defined(OPENSSL_NO_ENGINE) && defined(HAVE_ENGINE_CLEANUP) 1295 ENGINE_cleanup(); 1296 # endif 1297 CONF_modules_free(); 1298 # endif 1299 # ifdef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA 1300 CRYPTO_cleanup_all_ex_data(); /* safe, no more threads right now */ 1301 # endif 1302 # ifdef HAVE_ERR_FREE_STRINGS 1303 ERR_free_strings(); 1304 # endif 1305 # if OPENSSL_VERSION_NUMBER < 0x10100000 1306 RAND_cleanup(); 1307 # endif 1308 # if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED) 1309 ub_openssl_lock_delete(); 1310 # endif 1311 #ifdef HAVE_OPENSSL_CLEANUP 1312 OPENSSL_cleanup(); 1313 #endif 1314 #ifndef HAVE_ARC4RANDOM 1315 _ARC4_LOCK_DESTROY(); 1316 #endif 1317 #elif defined(HAVE_NSS) 1318 NSS_Shutdown(); 1319 #endif /* HAVE_SSL or HAVE_NSS */ 1320 checklock_stop(); 1321 #ifdef USE_WINSOCK 1322 if(WSACleanup() != 0) { 1323 log_err("Could not WSACleanup: %s", 1324 wsa_strerror(WSAGetLastError())); 1325 } 1326 #endif 1327 } 1328 1329 void daemon_apply_cfg(struct daemon* daemon, struct config_file* cfg) 1330 { 1331 int new_num = cfg->num_threads?cfg->num_threads:1; 1332 1333 daemon->cfg = cfg; 1334 config_apply(cfg); 1335 1336 /* If this is a reload and we deferred the decision on whether to 1337 * reuse the alloc, RRset, and message caches, then check to see if 1338 * it's safe to keep the caches: 1339 * - changing the number of threads is obviously incompatible with 1340 * keeping the per-thread alloc caches. It also means we have to 1341 * clear RRset and message caches. (note that 'new_num' may be 1342 * adjusted in daemon_create_workers, but for our purpose we can 1343 * simply compare it with 'old_num'; if they are equal here, 1344 * 'new_num' won't be adjusted to a different value than 'old_num'). 1345 * - changing RRset cache size effectively clears any remaining cache 1346 * entries. We could keep their keys in alloc caches, but it would 1347 * be more consistent with the sense of the change to clear allocs 1348 * and free memory. To do so we also have to clear message cache. 1349 * - only changing message cache size does not necessarily affect 1350 * RRset or alloc cache. But almost all new subsequent queries will 1351 * require recursive resolution anyway, so it doesn't help much to 1352 * just keep RRset and alloc caches. For simplicity we clear/free 1353 * the other two, too. */ 1354 if(daemon->worker_allocs && 1355 (new_num != daemon->old_num || 1356 !slabhash_is_size(daemon->env->msg_cache, cfg->msg_cache_size, 1357 cfg->msg_cache_slabs) || 1358 !slabhash_is_size(&daemon->env->rrset_cache->table, 1359 cfg->rrset_cache_size, cfg->rrset_cache_slabs))) 1360 { 1361 log_warn("cannot reuse caches due to critical config change"); 1362 slabhash_clear(&daemon->env->rrset_cache->table); 1363 slabhash_clear(daemon->env->msg_cache); 1364 daemon_clear_allocs(daemon); 1365 } 1366 1367 if(!slabhash_is_size(daemon->env->msg_cache, cfg->msg_cache_size, 1368 cfg->msg_cache_slabs)) { 1369 slabhash_delete(daemon->env->msg_cache); 1370 daemon->env->msg_cache = slabhash_create(cfg->msg_cache_slabs, 1371 HASH_DEFAULT_STARTARRAY, cfg->msg_cache_size, 1372 msgreply_sizefunc, query_info_compare, 1373 query_entry_delete, reply_info_delete, NULL); 1374 if(!daemon->env->msg_cache) { 1375 fatal_exit("malloc failure updating config settings"); 1376 } 1377 } 1378 if((daemon->env->rrset_cache = rrset_cache_adjust( 1379 daemon->env->rrset_cache, cfg, &daemon->superalloc)) == 0) 1380 fatal_exit("malloc failure updating config settings"); 1381 if((daemon->env->infra_cache = infra_adjust(daemon->env->infra_cache, 1382 cfg))==0) 1383 fatal_exit("malloc failure updating config settings"); 1384 } 1385
Indexes created Sat Oct 03 00:25:10 UTC 2026