1 /* $NetBSD: resolver.c,v 1.26 2026/05/20 16:53:45 christos Exp $ */ 2 3 /* 4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC") 5 * 6 * SPDX-License-Identifier: MPL-2.0 7 * 8 * This Source Code Form is subject to the terms of the Mozilla Public 9 * License, v. 2.0. If a copy of the MPL was not distributed with this 10 * file, you can obtain one at https://mozilla.org/MPL/2.0/. 11 * 12 * See the COPYRIGHT file distributed with this work for additional 13 * information regarding copyright ownership. 14 */ 15 16 /*! \file */ 17 18 #include <ctype.h> 19 #include <inttypes.h> 20 #include <stdbool.h> 21 #include <stdint.h> 22 23 #include <isc/ascii.h> 24 #include <isc/async.h> 25 #include <isc/atomic.h> 26 #include <isc/counter.h> 27 #include <isc/hash.h> 28 #include <isc/hashmap.h> 29 #include <isc/list.h> 30 #include <isc/log.h> 31 #include <isc/loop.h> 32 #include <isc/mutex.h> 33 #include <isc/random.h> 34 #include <isc/refcount.h> 35 #include <isc/result.h> 36 #include <isc/rwlock.h> 37 #include <isc/siphash.h> 38 #include <isc/stats.h> 39 #include <isc/string.h> 40 #include <isc/tid.h> 41 #include <isc/time.h> 42 #include <isc/timer.h> 43 #include <isc/util.h> 44 45 #include <dns/acl.h> 46 #include <dns/adb.h> 47 #include <dns/cache.h> 48 #include <dns/db.h> 49 #include <dns/dispatch.h> 50 #include <dns/dns64.h> 51 #include <dns/dnstap.h> 52 #include <dns/ds.h> 53 #include <dns/ede.h> 54 #include <dns/edns.h> 55 #include <dns/forward.h> 56 #include <dns/keytable.h> 57 #include <dns/log.h> 58 #include <dns/message.h> 59 #include <dns/name.h> 60 #include <dns/nametree.h> 61 #include <dns/ncache.h> 62 #include <dns/nsec.h> 63 #include <dns/nsec3.h> 64 #include <dns/opcode.h> 65 #include <dns/peer.h> 66 #include <dns/rbt.h> 67 #include <dns/rcode.h> 68 #include <dns/rdata.h> 69 #include <dns/rdataclass.h> 70 #include <dns/rdatalist.h> 71 #include <dns/rdataset.h> 72 #include <dns/rdatastruct.h> 73 #include <dns/rdatatype.h> 74 #include <dns/resolver.h> 75 #include <dns/rootns.h> 76 #include <dns/stats.h> 77 #include <dns/tsig.h> 78 #include <dns/validator.h> 79 #include <dns/zone.h> 80 81 #ifdef WANT_QUERYTRACE 82 #define RTRACE(m) \ 83 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 84 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), "res %p: %s", \ 85 res, (m)) 86 #define RRTRACE(r, m) \ 87 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 88 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), "res %p: %s", \ 89 (r), (m)) 90 #define FCTXTRACE(m) \ 91 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 92 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 93 "fctx %p(%s): %s", fctx, fctx->info, (m)) 94 #define FCTXTRACE2(m1, m2) \ 95 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 96 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 97 "fctx %p(%s): %s %s", fctx, fctx->info, (m1), (m2)) 98 #define FCTXTRACE3(m, res) \ 99 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 100 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 101 "fctx %p(%s): [result: %s] %s", fctx, fctx->info, \ 102 isc_result_totext(res), (m)) 103 #define FCTXTRACE4(m1, m2, res) \ 104 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 105 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 106 "fctx %p(%s): [result: %s] %s %s", fctx, fctx->info, \ 107 isc_result_totext(res), (m1), (m2)) 108 #define FCTXTRACE5(m1, m2, v) \ 109 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 110 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 111 "fctx %p(%s): %s %s%u", fctx, fctx->info, (m1), (m2), \ 112 (v)) 113 #define FCTXTRACEN(m1, name, res) \ 114 do { \ 115 if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) { \ 116 char dbuf[DNS_NAME_FORMATSIZE]; \ 117 dns_name_format((name), dbuf, sizeof(dbuf)); \ 118 FCTXTRACE4((m1), dbuf, (res)); \ 119 } \ 120 } while (0) 121 #define FTRACE(m) \ 122 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 123 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 124 "fetch %p (fctx %p(%s)): %s", fetch, fetch->private, \ 125 fetch->private->info, (m)) 126 #define QTRACE(m) \ 127 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 128 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 129 "resquery %p (fctx %p(%s)): %s", query, query->fctx, \ 130 query->fctx->info, (m)) 131 #else /* ifdef WANT_QUERYTRACE */ 132 #define RTRACE(m) \ 133 do { \ 134 UNUSED(m); \ 135 } while (0) 136 #define RRTRACE(r, m) \ 137 do { \ 138 UNUSED(r); \ 139 UNUSED(m); \ 140 } while (0) 141 #define FCTXTRACE(m) \ 142 do { \ 143 UNUSED(fctx); \ 144 UNUSED(m); \ 145 } while (0) 146 #define FCTXTRACE2(m1, m2) \ 147 do { \ 148 UNUSED(fctx); \ 149 UNUSED(m1); \ 150 UNUSED(m2); \ 151 } while (0) 152 #define FCTXTRACE3(m1, res) \ 153 do { \ 154 UNUSED(fctx); \ 155 UNUSED(m1); \ 156 UNUSED(res); \ 157 } while (0) 158 #define FCTXTRACE4(m1, m2, res) \ 159 do { \ 160 UNUSED(fctx); \ 161 UNUSED(m1); \ 162 UNUSED(m2); \ 163 UNUSED(res); \ 164 } while (0) 165 #define FCTXTRACE5(m1, m2, v) \ 166 do { \ 167 UNUSED(fctx); \ 168 UNUSED(m1); \ 169 UNUSED(m2); \ 170 UNUSED(v); \ 171 } while (0) 172 #define FCTXTRACEN(m1, name, res) FCTXTRACE4(m1, name, res) 173 #define FTRACE(m) \ 174 do { \ 175 UNUSED(m); \ 176 } while (0) 177 #define QTRACE(m) \ 178 do { \ 179 UNUSED(m); \ 180 } while (0) 181 #endif /* WANT_QUERYTRACE */ 182 183 /* 184 * The maximum time we will wait for a single query. 185 */ 186 #define MAX_SINGLE_QUERY_TIMEOUT 9000U 187 #define MAX_SINGLE_QUERY_TIMEOUT_US (MAX_SINGLE_QUERY_TIMEOUT * US_PER_MS) 188 189 /* 190 * The default maximum number of validations and validation failures per-fetch 191 */ 192 #ifndef DEFAULT_MAX_VALIDATIONS 193 #define DEFAULT_MAX_VALIDATIONS 16 194 #endif 195 #ifndef DEFAULT_MAX_VALIDATION_FAILURES 196 #define DEFAULT_MAX_VALIDATION_FAILURES 1 197 #endif 198 199 /* 200 * A minumum sane timeout value for the whole query to live when e.g. talking to 201 * a backend server and a quick timeout is preferred by the user. 202 * 203 * IMPORTANT: if changing this value, note there is a documented behavior when 204 * values of 'resolver-query-timeout' less than or equal to 300 are treated as 205 * seconds and converted to milliseconds before applying the limits, that's 206 * why the value of 301 was chosen as the absolute minimum in order to not break 207 * backward compatibility. 208 */ 209 #define MINIMUM_QUERY_TIMEOUT 301U 210 211 /* 212 * The default time in seconds for the whole query to live. 213 * We want to allow an individual query time to complete / timeout. 214 */ 215 #ifndef DEFAULT_QUERY_TIMEOUT 216 #define DEFAULT_QUERY_TIMEOUT (MAX_SINGLE_QUERY_TIMEOUT + 1000U) 217 #endif /* ifndef DEFAULT_QUERY_TIMEOUT */ 218 219 /* The maximum time in seconds for the whole query to live. */ 220 #ifndef MAXIMUM_QUERY_TIMEOUT 221 #define MAXIMUM_QUERY_TIMEOUT 30000 222 #endif /* ifndef MAXIMUM_QUERY_TIMEOUT */ 223 224 /* The default maximum number of recursions to follow before giving up. */ 225 #ifndef DEFAULT_RECURSION_DEPTH 226 #define DEFAULT_RECURSION_DEPTH 7 227 #endif /* ifndef DEFAULT_RECURSION_DEPTH */ 228 229 /* The default maximum number of iterative queries to allow before giving up. */ 230 #ifndef DEFAULT_MAX_QUERIES 231 #define DEFAULT_MAX_QUERIES 50 232 #endif /* ifndef DEFAULT_MAX_QUERIES */ 233 234 /* 235 * IP address lookups are performed for at most NS_PROCESSING_LIMIT NS RRs in 236 * any NS RRset encountered, to avoid excessive resource use while processing 237 * large delegations. 238 */ 239 #define NS_PROCESSING_LIMIT 20 240 241 /* Hash table for zone counters */ 242 #ifndef RES_DOMAIN_HASH_BITS 243 #define RES_DOMAIN_HASH_BITS 12 244 #endif /* ifndef RES_DOMAIN_HASH_BITS */ 245 246 /*% 247 * Maximum EDNS0 input packet size. 248 */ 249 #define RECV_BUFFER_SIZE 4096 /* XXXRTH Constant. */ 250 251 /*% 252 * This defines the maximum number of timeouts we will permit before we 253 * disable EDNS0 on the query. 254 */ 255 #define MAX_EDNS0_TIMEOUTS 3 256 257 typedef struct fetchctx fetchctx_t; 258 259 typedef struct query { 260 /* Locked by loop event serialization. */ 261 unsigned int magic; 262 isc_refcount_t references; 263 fetchctx_t *fctx; 264 dns_message_t *rmessage; 265 dns_dispatch_t *dispatch; 266 dns_adbaddrinfo_t *addrinfo; 267 isc_time_t start; 268 dns_messageid_t id; 269 dns_dispentry_t *dispentry; 270 ISC_LINK(struct query) link; 271 isc_buffer_t buffer; 272 isc_buffer_t *tsig; 273 dns_tsigkey_t *tsigkey; 274 int ednsversion; 275 unsigned int options; 276 unsigned int attributes; 277 unsigned int udpsize; 278 unsigned char data[512]; 279 } resquery_t; 280 281 #if DNS_RESOLVER_TRACE 282 #define resquery_ref(ptr) resquery__ref(ptr, __func__, __FILE__, __LINE__) 283 #define resquery_unref(ptr) resquery__unref(ptr, __func__, __FILE__, __LINE__) 284 #define resquery_attach(ptr, ptrp) \ 285 resquery__attach(ptr, ptrp, __func__, __FILE__, __LINE__) 286 #define resquery_detach(ptrp) \ 287 resquery__detach(ptrp, __func__, __FILE__, __LINE__) 288 ISC_REFCOUNT_TRACE_DECL(resquery); 289 #else 290 ISC_REFCOUNT_DECL(resquery); 291 #endif 292 293 struct tried { 294 isc_sockaddr_t addr; 295 unsigned int count; 296 ISC_LINK(struct tried) link; 297 }; 298 299 #define QUERY_MAGIC ISC_MAGIC('Q', '!', '!', '!') 300 #define VALID_QUERY(query) ISC_MAGIC_VALID(query, QUERY_MAGIC) 301 302 #define RESQUERY_ATTR_CANCELED 0x02 303 304 #define RESQUERY_CONNECTING(q) ((q)->connects > 0) 305 #define RESQUERY_CANCELED(q) (((q)->attributes & RESQUERY_ATTR_CANCELED) != 0) 306 #define RESQUERY_SENDING(q) ((q)->sends > 0) 307 308 typedef enum { 309 fetchstate_active, 310 fetchstate_done /*%< Fetch completion events posted. */ 311 } fetchstate_t; 312 313 typedef enum { 314 badns_unreachable = 0, 315 badns_response, 316 badns_validation, 317 badns_forwarder, 318 } badnstype_t; 319 320 #define FCTXCOUNT_MAGIC ISC_MAGIC('F', 'C', 'n', 't') 321 #define VALID_FCTXCOUNT(counter) ISC_MAGIC_VALID(counter, FCTXCOUNT_MAGIC) 322 323 typedef struct fctxcount fctxcount_t; 324 struct fctxcount { 325 unsigned int magic; 326 isc_mem_t *mctx; 327 isc_mutex_t lock; 328 dns_fixedname_t dfname; 329 dns_name_t *domain; 330 uint_fast32_t count; 331 uint_fast32_t allowed; 332 uint_fast32_t dropped; 333 isc_stdtime_t logged; 334 }; 335 336 struct fetchctx { 337 /*% Not locked. */ 338 unsigned int magic; 339 dns_resolver_t *res; 340 dns_fixedname_t fname; 341 dns_name_t *name; 342 dns_rdatatype_t type; 343 unsigned int options; 344 fctxcount_t *counter; 345 char *info; 346 isc_mem_t *mctx; 347 isc_stdtime_t now; 348 349 isc_loop_t *loop; 350 unsigned int tid; 351 352 dns_edectx_t edectx; 353 354 /* Atomic */ 355 isc_refcount_t references; 356 357 /*% Locked by lock. */ 358 isc_mutex_t lock; 359 fetchstate_t state; 360 bool cloned; 361 bool spilled; 362 uint_fast32_t allowed; 363 uint_fast32_t dropped; 364 ISC_LINK(struct fetchctx) link; 365 ISC_LIST(dns_fetchresponse_t) resps; 366 367 /*% Locked by loop event serialization. */ 368 dns_fixedname_t dfname; 369 dns_name_t *domain; 370 dns_rdataset_t nameservers; 371 atomic_uint_fast32_t attributes; 372 isc_timer_t *timer; 373 isc_time_t expires; 374 isc_time_t next_timeout; 375 isc_interval_t interval; 376 dns_message_t *qmessage; 377 ISC_LIST(resquery_t) queries; 378 dns_adbfindlist_t finds; 379 /* 380 * This is a state to keep track of the latest upstream server which is 381 * being queried. See `nextaddress()`. 382 * 383 * `addrinfo` is basically a copy of `foundaddrinfo` but came from the 384 * response of the query, so fields like the SRTT/timing might have been 385 * altered. So it might be possible (?) to wrap those two in an union 386 * for clarity (and memory saving). 387 */ 388 dns_adbaddrinfo_t *foundaddrinfo; 389 /* 390 * altfinds are names and/or addresses of dual stack servers that 391 * should be used when iterative resolution to a server is not 392 * possible because the address family of that server is not usable. 393 */ 394 dns_adbfindlist_t altfinds; 395 dns_adbfind_t *altfind; 396 dns_adbaddrinfolist_t forwaddrs; 397 dns_adbaddrinfolist_t altaddrs; 398 dns_forwarderlist_t forwarders; 399 dns_fwdpolicy_t fwdpolicy; 400 isc_sockaddrlist_t bad; 401 ISC_LIST(struct tried) edns; 402 dns_validator_t *validator; 403 ISC_LIST(dns_validator_t) validators; 404 dns_db_t *cache; 405 dns_adb_t *adb; 406 dns_dispatchmgr_t *dispatchmgr; 407 bool ns_ttl_ok; 408 uint32_t ns_ttl; 409 isc_counter_t *qc; 410 isc_counter_t *gqc; 411 bool minimized; 412 unsigned int qmin_labels; 413 isc_result_t qmin_warning; 414 bool force_qmin_warning; 415 bool ip6arpaskip; 416 bool forwarding; 417 dns_fixedname_t qminfname; 418 dns_name_t *qminname; 419 dns_rdatatype_t qmintype; 420 dns_fetch_t *qminfetch; 421 dns_rdataset_t qminrrset; 422 dns_fixedname_t qmindcfname; 423 dns_name_t *qmindcname; 424 dns_fixedname_t fwdfname; 425 dns_name_t *fwdname; 426 427 /*% 428 * Used to track started ADB finds with event. 429 */ 430 size_t pending_running; 431 dns_adbfindlist_t pending_finds; 432 433 /*% 434 * The number of times we've "restarted" the current 435 * nameserver set. This acts as a failsafe to prevent 436 * us from pounding constantly on a particular set of 437 * servers that, for whatever reason, are not giving 438 * us useful responses, but are responding in such a 439 * way that they are not marked "bad". 440 */ 441 unsigned int restarts; 442 443 /*% 444 * The number of timeouts that have occurred since we 445 * last successfully received a response packet. This 446 * is used for EDNS0 black hole detection. 447 */ 448 unsigned int timeouts; 449 450 /*% 451 * Look aside state for DS lookups. 452 */ 453 dns_fixedname_t nsfname; 454 dns_name_t *nsname; 455 456 dns_fetch_t *nsfetch; 457 dns_rdataset_t nsrrset; 458 459 /*% 460 * Number of queries that reference this context. 461 */ 462 atomic_uint_fast32_t nqueries; /* Bucket lock. */ 463 464 /*% 465 * Random numbers to use for mixing up server addresses. 466 */ 467 uint32_t rand_buf; 468 uint32_t rand_bits; 469 470 /*% 471 * Fetch-local statistics for detailed logging. 472 */ 473 isc_result_t result; /*%< fetch result */ 474 isc_result_t vresult; /*%< validation result */ 475 isc_time_t start; 476 uint64_t duration; 477 bool logged; 478 unsigned int querysent; 479 unsigned int referrals; 480 unsigned int lamecount; 481 unsigned int quotacount; 482 unsigned int neterr; 483 unsigned int badresp; 484 unsigned int adberr; 485 unsigned int findfail; 486 unsigned int valfail; 487 bool timeout; 488 dns_adbaddrinfo_t *addrinfo; 489 unsigned int depth; 490 char clientstr[ISC_SOCKADDR_FORMATSIZE]; 491 492 isc_counter_t *nvalidations; 493 isc_counter_t *nfails; 494 495 fetchctx_t *parent; 496 }; 497 498 #define FCTX_MAGIC ISC_MAGIC('F', '!', '!', '!') 499 #define VALID_FCTX(fctx) ISC_MAGIC_VALID(fctx, FCTX_MAGIC) 500 501 #define FCTX_ATTR_HAVEANSWER 0x0001 502 #define FCTX_ATTR_GLUING 0x0002 503 #define FCTX_ATTR_ADDRWAIT 0x0004 504 #define FCTX_ATTR_WANTCACHE 0x0010 505 #define FCTX_ATTR_WANTNCACHE 0x0020 506 #define FCTX_ATTR_NEEDEDNS0 0x0040 507 #define FCTX_ATTR_TRIEDFIND 0x0080 508 #define FCTX_ATTR_TRIEDALT 0x0100 509 510 #define HAVE_ANSWER(f) \ 511 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_HAVEANSWER) != 0) 512 #define GLUING(f) \ 513 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_GLUING) != 0) 514 #define ADDRWAIT(f) \ 515 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_ADDRWAIT) != 0) 516 #define SHUTTINGDOWN(f) ((f)->state == fetchstate_done) 517 #define WANTCACHE(f) \ 518 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_WANTCACHE) != 0) 519 #define WANTNCACHE(f) \ 520 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_WANTNCACHE) != 0) 521 #define NEEDEDNS0(f) \ 522 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_NEEDEDNS0) != 0) 523 #define TRIEDFIND(f) \ 524 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_TRIEDFIND) != 0) 525 #define TRIEDALT(f) \ 526 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_TRIEDALT) != 0) 527 528 #define FCTX_ATTR_SET(f, a) atomic_fetch_or_release(&(f)->attributes, (a)) 529 #define FCTX_ATTR_CLR(f, a) atomic_fetch_and_release(&(f)->attributes, ~(a)) 530 531 typedef struct { 532 dns_adbaddrinfo_t *addrinfo; 533 fetchctx_t *fctx; 534 } dns_valarg_t; 535 536 struct dns_fetch { 537 unsigned int magic; 538 isc_mem_t *mctx; 539 dns_resolver_t *res; 540 fetchctx_t *private; 541 }; 542 543 #define DNS_FETCH_MAGIC ISC_MAGIC('F', 't', 'c', 'h') 544 #define DNS_FETCH_VALID(fetch) ISC_MAGIC_VALID(fetch, DNS_FETCH_MAGIC) 545 546 typedef struct alternate { 547 bool isaddress; 548 union { 549 isc_sockaddr_t addr; 550 struct { 551 dns_name_t name; 552 in_port_t port; 553 } _n; 554 } _u; 555 ISC_LINK(struct alternate) link; 556 } alternate_t; 557 558 struct dns_resolver { 559 /* Unlocked. */ 560 unsigned int magic; 561 isc_mem_t *mctx; 562 isc_mutex_t lock; 563 isc_mutex_t primelock; 564 dns_rdataclass_t rdclass; 565 isc_loopmgr_t *loopmgr; 566 isc_nm_t *nm; 567 dns_view_t *view; 568 bool frozen; 569 unsigned int options; 570 isc_tlsctx_cache_t *tlsctx_cache; 571 dns_dispatchset_t *dispatches4; 572 dns_dispatchset_t *dispatches6; 573 574 isc_hashmap_t *fctxs; 575 isc_rwlock_t fctxs_lock; 576 577 isc_hashmap_t *counters; 578 isc_rwlock_t counters_lock; 579 580 uint32_t lame_ttl; 581 ISC_LIST(alternate_t) alternates; 582 dns_nametree_t *algorithms; 583 dns_nametree_t *digests; 584 dns_nametree_t *mustbesecure; 585 unsigned int spillatmax; 586 unsigned int spillatmin; 587 isc_timer_t *spillattimer; 588 bool zero_no_soa_ttl; 589 unsigned int query_timeout; 590 unsigned int maxdepth; 591 unsigned int maxqueries; 592 isc_result_t quotaresp[2]; 593 isc_stats_t *stats; 594 dns_stats_t *querystats; 595 596 /* Additions for serve-stale feature. */ 597 unsigned int retryinterval; /* in milliseconds */ 598 unsigned int nonbackofftries; 599 600 /* Atomic */ 601 isc_refcount_t references; 602 atomic_uint_fast32_t zspill; /* fetches-per-zone */ 603 atomic_bool exiting; 604 atomic_bool priming; 605 606 atomic_uint_fast32_t maxvalidations; 607 atomic_uint_fast32_t maxvalidationfails; 608 609 /* Locked by lock. */ 610 unsigned int spillat; /* clients-per-query */ 611 612 /* Locked by primelock. */ 613 dns_fetch_t *primefetch; 614 615 uint32_t nloops; 616 617 isc_mempool_t **namepools; 618 isc_mempool_t **rdspools; 619 }; 620 621 #define RES_MAGIC ISC_MAGIC('R', 'e', 's', '!') 622 #define VALID_RESOLVER(res) ISC_MAGIC_VALID(res, RES_MAGIC) 623 624 /*% 625 * Private addrinfo flags. 626 */ 627 enum { 628 FCTX_ADDRINFO_MARK = 1 << 0, 629 FCTX_ADDRINFO_FORWARDER = 1 << 1, 630 FCTX_ADDRINFO_EDNSOK = 1 << 2, 631 FCTX_ADDRINFO_NOCOOKIE = 1 << 3, 632 FCTX_ADDRINFO_BADCOOKIE = 1 << 4, 633 FCTX_ADDRINFO_DUALSTACK = 1 << 5, 634 FCTX_ADDRINFO_NOEDNS0 = 1 << 6, 635 }; 636 637 #define UNMARKED(a) (((a)->flags & FCTX_ADDRINFO_MARK) == 0) 638 #define ISFORWARDER(a) (((a)->flags & FCTX_ADDRINFO_FORWARDER) != 0) 639 #define NOCOOKIE(a) (((a)->flags & FCTX_ADDRINFO_NOCOOKIE) != 0) 640 #define EDNSOK(a) (((a)->flags & FCTX_ADDRINFO_EDNSOK) != 0) 641 #define BADCOOKIE(a) (((a)->flags & FCTX_ADDRINFO_BADCOOKIE) != 0) 642 #define ISDUALSTACK(a) (((a)->flags & FCTX_ADDRINFO_DUALSTACK) != 0) 643 644 #define NXDOMAIN(r) (((r)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0) 645 #define NEGATIVE(r) (((r)->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) 646 #define STATICSTUB(r) (((r)->attributes & DNS_RDATASETATTR_STATICSTUB) != 0) 647 648 #ifdef ENABLE_AFL 649 bool dns_fuzzing_resolver = false; 650 void 651 dns_resolver_setfuzzing(void) { 652 dns_fuzzing_resolver = true; 653 } 654 #endif /* ifdef ENABLE_AFL */ 655 656 static unsigned char ip6_arpa_data[] = "\003IP6\004ARPA"; 657 static unsigned char ip6_arpa_offsets[] = { 0, 4, 9 }; 658 static const dns_name_t ip6_arpa = DNS_NAME_INITABSOLUTE(ip6_arpa_data, 659 ip6_arpa_offsets); 660 661 static void 662 dns_resolver__destroy(dns_resolver_t *res); 663 static isc_result_t 664 resquery_send(resquery_t *query); 665 static void 666 resquery_response(isc_result_t eresult, isc_region_t *region, void *arg); 667 static void 668 resquery_response_continue(void *arg, isc_result_t result); 669 static void 670 resquery_connected(isc_result_t eresult, isc_region_t *region, void *arg); 671 static void 672 fctx_try(fetchctx_t *fctx, bool retrying); 673 static void 674 fctx_shutdown(void *arg); 675 static void 676 fctx_minimize_qname(fetchctx_t *fctx); 677 static void 678 fctx_destroy(fetchctx_t *fctx); 679 static isc_result_t 680 ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node, 681 dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl, 682 dns_ttl_t maxttl, bool optout, bool secure, 683 dns_rdataset_t *ardataset, isc_result_t *eresultp); 684 static void 685 validated(void *arg); 686 static void 687 add_bad(fetchctx_t *fctx, dns_message_t *rmessage, dns_adbaddrinfo_t *addrinfo, 688 isc_result_t reason, badnstype_t badtype); 689 static isc_result_t 690 findnoqname(fetchctx_t *fctx, dns_message_t *message, dns_name_t *name, 691 dns_rdatatype_t type, dns_name_t **noqname); 692 693 #define fctx_done_detach(fctxp, result) \ 694 if (fctx__done(*fctxp, result, __func__, __FILE__, __LINE__)) { \ 695 fetchctx_detach(fctxp); \ 696 } 697 698 #define fctx_done_unref(fctx, result) \ 699 if (fctx__done(fctx, result, __func__, __FILE__, __LINE__)) { \ 700 fetchctx_unref(fctx); \ 701 } 702 703 #if DNS_RESOLVER_TRACE 704 #define fetchctx_ref(ptr) fetchctx__ref(ptr, __func__, __FILE__, __LINE__) 705 #define fetchctx_unref(ptr) fetchctx__unref(ptr, __func__, __FILE__, __LINE__) 706 #define fetchctx_attach(ptr, ptrp) \ 707 fetchctx__attach(ptr, ptrp, __func__, __FILE__, __LINE__) 708 #define fetchctx_detach(ptrp) \ 709 fetchctx__detach(ptrp, __func__, __FILE__, __LINE__) 710 ISC_REFCOUNT_TRACE_DECL(fetchctx); 711 #else 712 ISC_REFCOUNT_DECL(fetchctx); 713 #endif 714 715 static bool 716 fctx__done(fetchctx_t *fctx, isc_result_t result, const char *func, 717 const char *file, unsigned int line); 718 719 static void 720 resume_qmin(void *arg); 721 722 static isc_result_t 723 get_attached_fctx(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name, 724 dns_rdatatype_t type, const dns_name_t *domain, 725 dns_rdataset_t *nameservers, const isc_sockaddr_t *client, 726 unsigned int options, unsigned int depth, isc_counter_t *qc, 727 isc_counter_t *gqc, fetchctx_t *parent, fetchctx_t **fctxp, 728 bool *new_fctx); 729 730 /*% 731 * The structure and functions defined below implement the resolver 732 * query (resquery) response handling logic. 733 * 734 * When a resolver query is sent and a response is received, the 735 * resquery_response() event handler is run, which calls the rctx_*() 736 * functions. The respctx_t structure maintains state from function 737 * to function. 738 * 739 * The call flow is described below: 740 * 741 * 1. resquery_response(): 742 * - Initialize a respctx_t structure (rctx_respinit()). 743 * - Check for dispatcher failure (rctx_dispfail()). 744 * - Parse the response (rctx_parse()). 745 * - Log the response (rctx_logpacket()). 746 * - Check the parsed response for an OPT record and handle 747 * EDNS (rctx_opt(), rctx_edns()). 748 * - Check for a bad or lame server (rctx_badserver(), rctx_lameserver()). 749 * - If RCODE and ANCOUNT suggest this is a positive answer, and 750 * if so, call rctx_answer(): go to step 2. 751 * - If RCODE and NSCOUNT suggest this is a negative answer or a 752 * referral, call rctx_answer_none(): go to step 4. 753 * - Check the additional section for data that should be cached 754 * (rctx_additional()). 755 * - Clean up and finish by calling rctx_done(): go to step 5. 756 * 757 * 2. rctx_answer(): 758 * - If the answer appears to be positive, call rctx_answer_positive(): 759 * go to step 3. 760 * - If the response is a malformed delegation (with glue or NS records 761 * in the answer section), call rctx_answer_none(): go to step 4. 762 * 763 * 3. rctx_answer_positive(): 764 * - Initialize the portions of respctx_t needed for processing an answer 765 * (rctx_answer_init()). 766 * - Scan the answer section to find records that are responsive to the 767 * query (rctx_answer_scan()). 768 * - For whichever type of response was found, call a separate routine 769 * to handle it: matching QNAME/QTYPE (rctx_answer_match()), 770 * CNAME (rctx_answer_cname()), covering DNAME (rctx_answer_dname()), 771 * or any records returned in response to a query of type ANY 772 * (rctx_answer_any()). 773 * - Scan the authority section for NS or other records that may be 774 * included with a positive answer (rctx_authority_scan()). 775 * 776 * 4. rctx_answer_none(): 777 * - Determine whether this is an NXDOMAIN, NXRRSET, or referral. 778 * - If referral, set up the resolver to follow the delegation 779 * (rctx_referral()). 780 * - If NXDOMAIN/NXRRSET, scan the authority section for NS and SOA 781 * records included with a negative response (rctx_authority_negative()), 782 * then for DNSSEC proof of nonexistence (rctx_authority_dnssec()). 783 * 784 * 5. rctx_done(): 785 * - Set up chasing of DS records if needed (rctx_chaseds()). 786 * - If the response wasn't intended for us, wait for another response 787 * from the dispatcher (rctx_next()). 788 * - If there is a problem with the responding server, set up another 789 * query to a different server (rctx_nextserver()). 790 * - If there is a problem that might be temporary or dependent on 791 * EDNS options, set up another query to the same server with changed 792 * options (rctx_resend()). 793 * - Shut down the fetch context. 794 */ 795 796 typedef struct respctx { 797 resquery_t *query; 798 fetchctx_t *fctx; 799 isc_mem_t *mctx; 800 isc_result_t result; 801 isc_buffer_t buffer; 802 unsigned int retryopts; /* updated options to pass to 803 * fctx_query() when resending */ 804 805 dns_rdatatype_t type; /* type being sought (set to 806 * ANY if qtype was SIG or RRSIG) */ 807 bool aa; /* authoritative answer? */ 808 dns_trust_t trust; /* answer trust level */ 809 bool chaining; /* CNAME/DNAME processing? */ 810 bool next_server; /* give up, try the next server 811 * */ 812 813 badnstype_t broken_type; /* type of name server problem 814 * */ 815 isc_result_t broken_server; 816 817 bool get_nameservers; /* get a new NS rrset at 818 * zone cut? */ 819 bool resend; /* resend this query? */ 820 bool secured; /* message was signed or had a valid cookie */ 821 bool nextitem; /* invalid response; keep 822 * listening for the correct one */ 823 bool truncated; /* response was truncated */ 824 bool no_response; /* no response was received */ 825 bool glue_in_answer; /* glue may be in the answer 826 * section */ 827 bool ns_in_answer; /* NS may be in the answer 828 * section */ 829 bool negative; /* is this a negative response? */ 830 831 isc_stdtime_t now; /* time info */ 832 isc_time_t tnow; 833 isc_time_t *finish; 834 835 unsigned int dname_labels; 836 unsigned int domain_labels; /* range of permissible number 837 * of 838 * labels in a DNAME */ 839 840 dns_name_t *aname; /* answer name */ 841 dns_rdataset_t *ardataset; /* answer rdataset */ 842 843 dns_name_t *cname; /* CNAME name */ 844 dns_rdataset_t *crdataset; /* CNAME rdataset */ 845 846 dns_name_t *dname; /* DNAME name */ 847 dns_rdataset_t *drdataset; /* DNAME rdataset */ 848 849 dns_name_t *ns_name; /* NS name */ 850 dns_rdataset_t *ns_rdataset; /* NS rdataset */ 851 852 dns_name_t *soa_name; /* SOA name in a negative answer */ 853 dns_name_t *ds_name; /* DS name in a negative answer */ 854 855 dns_name_t *found_name; /* invalid name in negative 856 * response */ 857 dns_rdatatype_t found_type; /* invalid type in negative 858 * response */ 859 860 dns_rdataset_t *opt; /* OPT rdataset */ 861 } respctx_t; 862 863 static void 864 rctx_respinit(resquery_t *query, fetchctx_t *fctx, isc_result_t result, 865 isc_region_t *region, respctx_t *rctx); 866 867 static void 868 rctx_answer_init(respctx_t *rctx); 869 870 static void 871 rctx_answer_scan(respctx_t *rctx); 872 873 static void 874 rctx_authority_positive(respctx_t *rctx); 875 876 static isc_result_t 877 rctx_answer_any(respctx_t *rctx); 878 879 static isc_result_t 880 rctx_answer_match(respctx_t *rctx); 881 882 static isc_result_t 883 rctx_answer_cname(respctx_t *rctx); 884 885 static isc_result_t 886 rctx_answer_dname(respctx_t *rctx); 887 888 static isc_result_t 889 rctx_answer_positive(respctx_t *rctx); 890 891 static isc_result_t 892 rctx_authority_negative(respctx_t *rctx); 893 894 static isc_result_t 895 rctx_authority_dnssec(respctx_t *rctx); 896 897 static void 898 rctx_additional(respctx_t *rctx); 899 900 static isc_result_t 901 rctx_referral(respctx_t *rctx); 902 903 static isc_result_t 904 rctx_answer_none(respctx_t *rctx); 905 906 static void 907 rctx_nextserver(respctx_t *rctx, dns_message_t *message, 908 dns_adbaddrinfo_t *addrinfo, isc_result_t result); 909 910 static void 911 rctx_resend(respctx_t *rctx, dns_adbaddrinfo_t *addrinfo); 912 913 static isc_result_t 914 rctx_next(respctx_t *rctx); 915 916 static void 917 rctx_chaseds(respctx_t *rctx, dns_message_t *message, 918 dns_adbaddrinfo_t *addrinfo, isc_result_t result); 919 920 static void 921 rctx_done(respctx_t *rctx, isc_result_t result); 922 923 static void 924 rctx_logpacket(respctx_t *rctx); 925 926 static void 927 rctx_opt(respctx_t *rctx); 928 929 static void 930 rctx_edns(respctx_t *rctx); 931 932 static isc_result_t 933 rctx_parse(respctx_t *rctx); 934 935 static isc_result_t 936 rctx_badserver(respctx_t *rctx, isc_result_t result); 937 938 static isc_result_t 939 rctx_answer(respctx_t *rctx); 940 941 static isc_result_t 942 rctx_lameserver(respctx_t *rctx); 943 944 static isc_result_t 945 rctx_dispfail(respctx_t *rctx); 946 947 static isc_result_t 948 rctx_timedout(respctx_t *rctx); 949 950 static void 951 rctx_ncache(respctx_t *rctx); 952 953 /*% 954 * Increment resolver-related statistics counters. 955 */ 956 static void 957 inc_stats(dns_resolver_t *res, isc_statscounter_t counter) { 958 if (res->stats != NULL) { 959 isc_stats_increment(res->stats, counter); 960 } 961 } 962 963 static void 964 dec_stats(dns_resolver_t *res, isc_statscounter_t counter) { 965 if (res->stats != NULL) { 966 isc_stats_decrement(res->stats, counter); 967 } 968 } 969 970 static void 971 set_stats(dns_resolver_t *res, isc_statscounter_t counter, uint64_t val) { 972 if (res->stats != NULL) { 973 isc_stats_set(res->stats, val, counter); 974 } 975 } 976 977 static bool 978 waiting_for_fetch(fetchctx_t *fctx, const dns_name_t *name, 979 dns_rdatatype_t type, const dns_name_t *domain); 980 981 static isc_result_t 982 valcreate(fetchctx_t *fctx, dns_message_t *message, dns_adbaddrinfo_t *addrinfo, 983 dns_name_t *name, dns_rdatatype_t type, dns_rdataset_t *rdataset, 984 dns_rdataset_t *sigrdataset, unsigned int valoptions) { 985 dns_validator_t *validator = NULL; 986 dns_valarg_t *valarg = NULL; 987 isc_result_t result; 988 989 valarg = isc_mem_get(fctx->mctx, sizeof(*valarg)); 990 *valarg = (dns_valarg_t){ 991 .addrinfo = addrinfo, 992 }; 993 994 fetchctx_attach(fctx, &valarg->fctx); 995 996 if (!ISC_LIST_EMPTY(fctx->validators)) { 997 valoptions |= DNS_VALIDATOR_DEFER; 998 } else { 999 valoptions &= ~DNS_VALIDATOR_DEFER; 1000 } 1001 1002 result = dns_validator_create( 1003 fctx->res->view, name, type, rdataset, sigrdataset, message, 1004 valoptions, fctx->loop, validated, valarg, fctx->nvalidations, 1005 fctx->nfails, fctx->qc, fctx->gqc, fctx, &fctx->edectx, 1006 &validator); 1007 RUNTIME_CHECK(result == ISC_R_SUCCESS); 1008 inc_stats(fctx->res, dns_resstatscounter_val); 1009 if ((valoptions & DNS_VALIDATOR_DEFER) == 0) { 1010 INSIST(fctx->validator == NULL); 1011 fctx->validator = validator; 1012 } 1013 ISC_LIST_APPEND(fctx->validators, validator, link); 1014 return ISC_R_SUCCESS; 1015 } 1016 1017 static void 1018 resquery_destroy(resquery_t *query) { 1019 fetchctx_t *fctx = query->fctx; 1020 1021 query->magic = 0; 1022 1023 if (ISC_LINK_LINKED(query, link)) { 1024 ISC_LIST_UNLINK(fctx->queries, query, link); 1025 } 1026 1027 if (query->tsig != NULL) { 1028 isc_buffer_free(&query->tsig); 1029 } 1030 1031 if (query->tsigkey != NULL) { 1032 dns_tsigkey_detach(&query->tsigkey); 1033 } 1034 1035 if (query->dispentry != NULL) { 1036 dns_dispatch_done(&query->dispentry); 1037 } 1038 1039 if (query->dispatch != NULL) { 1040 dns_dispatch_detach(&query->dispatch); 1041 } 1042 1043 LOCK(&fctx->lock); 1044 atomic_fetch_sub_release(&fctx->nqueries, 1); 1045 UNLOCK(&fctx->lock); 1046 1047 if (query->rmessage != NULL) { 1048 dns_message_detach(&query->rmessage); 1049 } 1050 1051 isc_mem_put(fctx->mctx, query, sizeof(*query)); 1052 1053 fetchctx_detach(&fctx); 1054 } 1055 1056 #if DNS_RESOLVER_TRACE 1057 ISC_REFCOUNT_TRACE_IMPL(resquery, resquery_destroy); 1058 #else 1059 ISC_REFCOUNT_IMPL(resquery, resquery_destroy); 1060 #endif 1061 1062 /*% 1063 * Update EDNS statistics for a server after not getting a response to a UDP 1064 * query sent to it. 1065 */ 1066 static void 1067 update_edns_stats(resquery_t *query) { 1068 fetchctx_t *fctx = query->fctx; 1069 1070 if ((query->options & DNS_FETCHOPT_TCP) != 0) { 1071 return; 1072 } 1073 1074 if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0) { 1075 dns_adb_ednsto(fctx->adb, query->addrinfo); 1076 } else { 1077 dns_adb_timeout(fctx->adb, query->addrinfo); 1078 } 1079 } 1080 1081 static void 1082 fctx_expired(void *arg); 1083 1084 /* 1085 * Start the maximum lifetime timer for the fetch. This will 1086 * trigger if, for example, some ADB or validator dependency 1087 * loop occurs and causes a fetch to hang. 1088 */ 1089 static void 1090 fctx_starttimer(fetchctx_t *fctx) { 1091 isc_interval_t interval; 1092 isc_time_t now; 1093 isc_time_t expires; 1094 1095 isc_interval_set(&interval, 2, 0); 1096 isc_time_add(&fctx->expires, &interval, &expires); 1097 1098 now = isc_time_now(); 1099 if (isc_time_compare(&expires, &now) <= 0) { 1100 isc_interval_set(&interval, 0, 1); 1101 } else { 1102 isc_time_subtract(&expires, &now, &interval); 1103 } 1104 1105 isc_timer_start(fctx->timer, isc_timertype_once, &interval); 1106 } 1107 1108 static void 1109 fctx_stoptimer(fetchctx_t *fctx) { 1110 isc_timer_stop(fctx->timer); 1111 } 1112 1113 static void 1114 fctx_cancelquery(resquery_t **queryp, isc_time_t *finish, bool no_response, 1115 bool age_untried) { 1116 resquery_t *query = NULL; 1117 fetchctx_t *fctx = NULL; 1118 dns_adbfind_t *find = NULL; 1119 dns_adbaddrinfo_t *addrinfo; 1120 isc_stdtime_t now = isc_stdtime_now(); 1121 1122 REQUIRE(queryp != NULL); 1123 1124 query = *queryp; 1125 fctx = query->fctx; 1126 1127 if (RESQUERY_CANCELED(query)) { 1128 return; 1129 } 1130 1131 FCTXTRACE("cancelquery"); 1132 1133 query->attributes |= RESQUERY_ATTR_CANCELED; 1134 1135 /* 1136 * Should we update the RTT? 1137 */ 1138 if (finish != NULL || no_response) { 1139 unsigned int rtt, factor; 1140 if (finish != NULL) { 1141 /* 1142 * We have both the start and finish times for this 1143 * packet, so we can compute a real RTT. 1144 */ 1145 unsigned int rttms; 1146 1147 rtt = (unsigned int)isc_time_microdiff(finish, 1148 &query->start); 1149 rttms = rtt / US_PER_MS; 1150 factor = DNS_ADB_RTTADJDEFAULT; 1151 1152 if (rttms < DNS_RESOLVER_QRYRTTCLASS0) { 1153 inc_stats(fctx->res, 1154 dns_resstatscounter_queryrtt0); 1155 } else if (rttms < DNS_RESOLVER_QRYRTTCLASS1) { 1156 inc_stats(fctx->res, 1157 dns_resstatscounter_queryrtt1); 1158 } else if (rttms < DNS_RESOLVER_QRYRTTCLASS2) { 1159 inc_stats(fctx->res, 1160 dns_resstatscounter_queryrtt2); 1161 } else if (rttms < DNS_RESOLVER_QRYRTTCLASS3) { 1162 inc_stats(fctx->res, 1163 dns_resstatscounter_queryrtt3); 1164 } else if (rttms < DNS_RESOLVER_QRYRTTCLASS4) { 1165 inc_stats(fctx->res, 1166 dns_resstatscounter_queryrtt4); 1167 } else { 1168 inc_stats(fctx->res, 1169 dns_resstatscounter_queryrtt5); 1170 } 1171 } else { 1172 uint32_t value; 1173 uint32_t mask; 1174 1175 update_edns_stats(query); 1176 1177 /* 1178 * If "forward first;" is used and a forwarder timed 1179 * out, do not attempt to query it again in this fetch 1180 * context. 1181 */ 1182 if (fctx->fwdpolicy == dns_fwdpolicy_first && 1183 ISFORWARDER(query->addrinfo)) 1184 { 1185 add_bad(fctx, query->rmessage, query->addrinfo, 1186 ISC_R_TIMEDOUT, badns_forwarder); 1187 } 1188 1189 /* 1190 * We don't have an RTT for this query. Maybe the 1191 * packet was lost, or maybe this server is very 1192 * slow. We don't know. Increase the RTT. 1193 */ 1194 INSIST(no_response); 1195 value = isc_random32(); 1196 if (query->addrinfo->srtt > 800000) { 1197 mask = 0x3fff; 1198 } else if (query->addrinfo->srtt > 400000) { 1199 mask = 0x7fff; 1200 } else if (query->addrinfo->srtt > 200000) { 1201 mask = 0xffff; 1202 } else if (query->addrinfo->srtt > 100000) { 1203 mask = 0x1ffff; 1204 } else if (query->addrinfo->srtt > 50000) { 1205 mask = 0x3ffff; 1206 } else if (query->addrinfo->srtt > 25000) { 1207 mask = 0x7ffff; 1208 } else { 1209 mask = 0xfffff; 1210 } 1211 1212 /* 1213 * Don't adjust timeout on EDNS queries unless we have 1214 * seen a EDNS response. 1215 */ 1216 if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0 && 1217 !EDNSOK(query->addrinfo)) 1218 { 1219 mask >>= 2; 1220 } 1221 1222 rtt = query->addrinfo->srtt + (value & mask); 1223 if (rtt > MAX_SINGLE_QUERY_TIMEOUT_US) { 1224 rtt = MAX_SINGLE_QUERY_TIMEOUT_US; 1225 } 1226 if (rtt > fctx->res->query_timeout * US_PER_MS) { 1227 rtt = fctx->res->query_timeout * US_PER_MS; 1228 } 1229 1230 /* 1231 * Replace the current RTT with our value. 1232 */ 1233 factor = DNS_ADB_RTTADJREPLACE; 1234 } 1235 1236 dns_adb_adjustsrtt(fctx->adb, query->addrinfo, rtt, factor); 1237 } 1238 1239 if ((query->options & DNS_FETCHOPT_TCP) == 0) { 1240 /* Inform the ADB that we're ending a UDP fetch */ 1241 dns_adb_endudpfetch(fctx->adb, query->addrinfo); 1242 } 1243 1244 /* 1245 * Age RTTs of servers not tried. 1246 */ 1247 if (finish != NULL || age_untried) { 1248 for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs); 1249 addrinfo != NULL; 1250 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 1251 { 1252 if (UNMARKED(addrinfo)) { 1253 dns_adb_agesrtt(fctx->adb, addrinfo, now); 1254 } 1255 } 1256 } 1257 1258 if ((finish != NULL || age_untried) && TRIEDFIND(fctx)) { 1259 for (find = ISC_LIST_HEAD(fctx->finds); find != NULL; 1260 find = ISC_LIST_NEXT(find, publink)) 1261 { 1262 for (addrinfo = ISC_LIST_HEAD(find->list); 1263 addrinfo != NULL; 1264 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 1265 { 1266 if (UNMARKED(addrinfo)) { 1267 dns_adb_agesrtt(fctx->adb, addrinfo, 1268 now); 1269 } 1270 } 1271 } 1272 } 1273 1274 if ((finish != NULL || age_untried) && TRIEDALT(fctx)) { 1275 for (addrinfo = ISC_LIST_HEAD(fctx->altaddrs); addrinfo != NULL; 1276 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 1277 { 1278 if (UNMARKED(addrinfo)) { 1279 dns_adb_agesrtt(fctx->adb, addrinfo, now); 1280 } 1281 } 1282 for (find = ISC_LIST_HEAD(fctx->altfinds); find != NULL; 1283 find = ISC_LIST_NEXT(find, publink)) 1284 { 1285 for (addrinfo = ISC_LIST_HEAD(find->list); 1286 addrinfo != NULL; 1287 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 1288 { 1289 if (UNMARKED(addrinfo)) { 1290 dns_adb_agesrtt(fctx->adb, addrinfo, 1291 now); 1292 } 1293 } 1294 } 1295 } 1296 1297 /* 1298 * Check for any outstanding dispatch responses and if they 1299 * exist, cancel them. 1300 */ 1301 if (query->dispentry != NULL) { 1302 dns_dispatch_done(&query->dispentry); 1303 } 1304 1305 LOCK(&fctx->lock); 1306 if (ISC_LINK_LINKED(query, link)) { 1307 ISC_LIST_UNLINK(fctx->queries, query, link); 1308 } 1309 UNLOCK(&fctx->lock); 1310 1311 resquery_detach(queryp); 1312 } 1313 1314 static void 1315 fctx_cleanup(fetchctx_t *fctx) { 1316 dns_adbfind_t *find = NULL, *next_find = NULL; 1317 dns_adbaddrinfo_t *addr = NULL, *next_addr = NULL; 1318 1319 REQUIRE(ISC_LIST_EMPTY(fctx->queries)); 1320 1321 for (find = ISC_LIST_HEAD(fctx->finds); find != NULL; find = next_find) 1322 { 1323 next_find = ISC_LIST_NEXT(find, publink); 1324 ISC_LIST_UNLINK(fctx->finds, find, publink); 1325 dns_adb_destroyfind(&find); 1326 fetchctx_unref(fctx); 1327 } 1328 fctx->foundaddrinfo = NULL; 1329 1330 for (find = ISC_LIST_HEAD(fctx->altfinds); find != NULL; 1331 find = next_find) 1332 { 1333 next_find = ISC_LIST_NEXT(find, publink); 1334 ISC_LIST_UNLINK(fctx->altfinds, find, publink); 1335 dns_adb_destroyfind(&find); 1336 fetchctx_unref(fctx); 1337 } 1338 fctx->altfind = NULL; 1339 1340 for (addr = ISC_LIST_HEAD(fctx->forwaddrs); addr != NULL; 1341 addr = next_addr) 1342 { 1343 next_addr = ISC_LIST_NEXT(addr, publink); 1344 ISC_LIST_UNLINK(fctx->forwaddrs, addr, publink); 1345 dns_adb_freeaddrinfo(fctx->adb, &addr); 1346 } 1347 1348 for (addr = ISC_LIST_HEAD(fctx->altaddrs); addr != NULL; 1349 addr = next_addr) 1350 { 1351 next_addr = ISC_LIST_NEXT(addr, publink); 1352 ISC_LIST_UNLINK(fctx->altaddrs, addr, publink); 1353 dns_adb_freeaddrinfo(fctx->adb, &addr); 1354 } 1355 } 1356 1357 static void 1358 fctx_cancelqueries(fetchctx_t *fctx, bool no_response, bool age_untried) { 1359 resquery_t *query = NULL, *next_query = NULL; 1360 ISC_LIST(resquery_t) queries; 1361 1362 FCTXTRACE("cancelqueries"); 1363 1364 ISC_LIST_INIT(queries); 1365 1366 /* 1367 * Move the queries to a local list so we can cancel 1368 * them without holding the lock. 1369 */ 1370 LOCK(&fctx->lock); 1371 ISC_LIST_MOVE(queries, fctx->queries); 1372 UNLOCK(&fctx->lock); 1373 1374 for (query = ISC_LIST_HEAD(queries); query != NULL; query = next_query) 1375 { 1376 next_query = ISC_LIST_NEXT(query, link); 1377 1378 /* 1379 * Note that we have to unlink the query here, 1380 * because if it's still linked in fctx_cancelquery(), 1381 * then it will try to unlink it from fctx->queries. 1382 */ 1383 ISC_LIST_UNLINK(queries, query, link); 1384 fctx_cancelquery(&query, NULL, no_response, age_untried); 1385 } 1386 } 1387 1388 static void 1389 fcount_logspill(fetchctx_t *fctx, fctxcount_t *counter, bool final) { 1390 char dbuf[DNS_NAME_FORMATSIZE]; 1391 isc_stdtime_t now; 1392 1393 if (!isc_log_wouldlog(dns_lctx, ISC_LOG_INFO)) { 1394 return; 1395 } 1396 1397 /* Do not log a message if there were no dropped fetches. */ 1398 if (counter->dropped == 0) { 1399 return; 1400 } 1401 1402 /* Do not log the cumulative message if the previous log is recent. */ 1403 now = isc_stdtime_now(); 1404 if (!final && counter->logged > now - 60) { 1405 return; 1406 } 1407 1408 dns_name_format(fctx->domain, dbuf, sizeof(dbuf)); 1409 1410 if (!final) { 1411 isc_log_write(dns_lctx, DNS_LOGCATEGORY_SPILL, 1412 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 1413 "too many simultaneous fetches for %s " 1414 "(allowed %" PRIuFAST32 " spilled %" PRIuFAST32 1415 "; %s)", 1416 dbuf, counter->allowed, counter->dropped, 1417 counter->dropped == 1 ? "initial trigger event" 1418 : "cumulative since " 1419 "initial trigger event"); 1420 } else { 1421 isc_log_write(dns_lctx, DNS_LOGCATEGORY_SPILL, 1422 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 1423 "fetch counters for %s now being discarded " 1424 "(allowed %" PRIuFAST32 " spilled %" PRIuFAST32 1425 "; cumulative since initial trigger event)", 1426 dbuf, counter->allowed, counter->dropped); 1427 } 1428 1429 counter->logged = now; 1430 } 1431 1432 static bool 1433 fcount_match(void *node, const void *key) { 1434 const fctxcount_t *counter = node; 1435 const dns_name_t *domain = key; 1436 1437 return dns_name_equal(counter->domain, domain); 1438 } 1439 1440 static isc_result_t 1441 fcount_incr(fetchctx_t *fctx, bool force) { 1442 isc_result_t result = ISC_R_SUCCESS; 1443 dns_resolver_t *res = NULL; 1444 fctxcount_t *counter = NULL; 1445 uint32_t hashval; 1446 uint_fast32_t spill; 1447 isc_rwlocktype_t locktype = isc_rwlocktype_read; 1448 1449 REQUIRE(fctx != NULL); 1450 res = fctx->res; 1451 REQUIRE(res != NULL); 1452 INSIST(fctx->counter == NULL); 1453 1454 /* Skip any counting if fetches-per-zone is disabled */ 1455 spill = atomic_load_acquire(&res->zspill); 1456 if (spill == 0) { 1457 return ISC_R_SUCCESS; 1458 } 1459 1460 hashval = dns_name_hash(fctx->domain); 1461 1462 RWLOCK(&res->counters_lock, locktype); 1463 result = isc_hashmap_find(res->counters, hashval, fcount_match, 1464 fctx->domain, (void **)&counter); 1465 switch (result) { 1466 case ISC_R_SUCCESS: 1467 break; 1468 case ISC_R_NOTFOUND: 1469 counter = isc_mem_get(fctx->mctx, sizeof(*counter)); 1470 *counter = (fctxcount_t){ 1471 .magic = FCTXCOUNT_MAGIC, 1472 .count = 0, 1473 .allowed = 0, 1474 }; 1475 isc_mem_attach(fctx->mctx, &counter->mctx); 1476 isc_mutex_init(&counter->lock); 1477 counter->domain = dns_fixedname_initname(&counter->dfname); 1478 dns_name_copy(fctx->domain, counter->domain); 1479 1480 UPGRADELOCK(&res->counters_lock, locktype); 1481 1482 void *found = NULL; 1483 result = isc_hashmap_add(res->counters, hashval, fcount_match, 1484 counter->domain, counter, &found); 1485 if (result == ISC_R_EXISTS) { 1486 isc_mutex_destroy(&counter->lock); 1487 isc_mem_putanddetach(&counter->mctx, counter, 1488 sizeof(*counter)); 1489 counter = found; 1490 result = ISC_R_SUCCESS; 1491 } 1492 1493 INSIST(result == ISC_R_SUCCESS); 1494 break; 1495 default: 1496 UNREACHABLE(); 1497 } 1498 INSIST(VALID_FCTXCOUNT(counter)); 1499 1500 INSIST(spill > 0); 1501 LOCK(&counter->lock); 1502 if (++counter->count > spill && !force) { 1503 counter->count--; 1504 INSIST(counter->count > 0); 1505 counter->dropped++; 1506 fcount_logspill(fctx, counter, false); 1507 result = ISC_R_QUOTA; 1508 } else { 1509 counter->allowed++; 1510 fctx->counter = counter; 1511 } 1512 UNLOCK(&counter->lock); 1513 RWUNLOCK(&res->counters_lock, locktype); 1514 1515 return result; 1516 } 1517 1518 static bool 1519 match_ptr(void *node, const void *key) { 1520 return node == key; 1521 } 1522 1523 static void 1524 fcount_decr(fetchctx_t *fctx) { 1525 REQUIRE(fctx != NULL); 1526 1527 fctxcount_t *counter = fctx->counter; 1528 if (counter == NULL) { 1529 return; 1530 } 1531 fctx->counter = NULL; 1532 1533 /* 1534 * FIXME: This should not require a write lock, but should be 1535 * implemented using reference counting later, otherwise we would could 1536 * encounter ABA problem here - the count could go up and down when we 1537 * switch from read to write lock. 1538 */ 1539 RWLOCK(&fctx->res->counters_lock, isc_rwlocktype_write); 1540 1541 LOCK(&counter->lock); 1542 INSIST(VALID_FCTXCOUNT(counter)); 1543 INSIST(counter->count > 0); 1544 if (--counter->count > 0) { 1545 UNLOCK(&counter->lock); 1546 RWUNLOCK(&fctx->res->counters_lock, isc_rwlocktype_write); 1547 return; 1548 } 1549 1550 isc_result_t result = isc_hashmap_delete(fctx->res->counters, 1551 dns_name_hash(counter->domain), 1552 match_ptr, counter); 1553 INSIST(result == ISC_R_SUCCESS); 1554 1555 fcount_logspill(fctx, counter, true); 1556 UNLOCK(&counter->lock); 1557 1558 isc_mutex_destroy(&counter->lock); 1559 isc_mem_putanddetach(&counter->mctx, counter, sizeof(*counter)); 1560 1561 RWUNLOCK(&fctx->res->counters_lock, isc_rwlocktype_write); 1562 } 1563 1564 static void 1565 spillattimer_countdown(void *arg); 1566 1567 static void 1568 fctx_sendevents(fetchctx_t *fctx, isc_result_t result) { 1569 dns_fetchresponse_t *resp = NULL, *next = NULL; 1570 unsigned int count = 0; 1571 bool logit = false; 1572 isc_time_t now; 1573 unsigned int old_spillat; 1574 unsigned int new_spillat = 0; /* initialized to silence 1575 * compiler warnings */ 1576 1577 LOCK(&fctx->lock); 1578 1579 REQUIRE(fctx->state == fetchstate_done); 1580 1581 FCTXTRACE("sendevents"); 1582 1583 /* 1584 * Keep some record of fetch result for logging later (if required). 1585 */ 1586 fctx->result = result; 1587 now = isc_time_now(); 1588 fctx->duration = isc_time_microdiff(&now, &fctx->start); 1589 1590 for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL; resp = next) { 1591 next = ISC_LIST_NEXT(resp, link); 1592 ISC_LIST_UNLINK(fctx->resps, resp, link); 1593 1594 count++; 1595 1596 resp->vresult = fctx->vresult; 1597 if (!HAVE_ANSWER(fctx)) { 1598 resp->result = result; 1599 } 1600 1601 INSIST(resp->result != ISC_R_SUCCESS || 1602 dns_rdataset_isassociated(resp->rdataset) || 1603 fctx->type == dns_rdatatype_any || 1604 fctx->type == dns_rdatatype_rrsig || 1605 fctx->type == dns_rdatatype_sig); 1606 1607 /* 1608 * Negative results must be indicated in resp->result. 1609 */ 1610 if (dns_rdataset_isassociated(resp->rdataset) && 1611 NEGATIVE(resp->rdataset)) 1612 { 1613 INSIST(resp->result == DNS_R_NCACHENXDOMAIN || 1614 resp->result == DNS_R_NCACHENXRRSET); 1615 } 1616 1617 /* 1618 * Finalize the EDE context, so it becomes "constant" and assign 1619 * it to all clients. 1620 */ 1621 if (resp->edectx != NULL) { 1622 dns_ede_copy(resp->edectx, &fctx->edectx); 1623 } 1624 1625 FCTXTRACE("post response event"); 1626 isc_async_run(resp->loop, resp->cb, resp); 1627 } 1628 UNLOCK(&fctx->lock); 1629 1630 if (HAVE_ANSWER(fctx) && fctx->spilled && 1631 (count < fctx->res->spillatmax || fctx->res->spillatmax == 0)) 1632 { 1633 LOCK(&fctx->res->lock); 1634 if (count == fctx->res->spillat && 1635 !atomic_load_acquire(&fctx->res->exiting)) 1636 { 1637 old_spillat = fctx->res->spillat; 1638 fctx->res->spillat += 5; 1639 if (fctx->res->spillat > fctx->res->spillatmax && 1640 fctx->res->spillatmax != 0) 1641 { 1642 fctx->res->spillat = fctx->res->spillatmax; 1643 } 1644 new_spillat = fctx->res->spillat; 1645 if (new_spillat != old_spillat) { 1646 logit = true; 1647 } 1648 1649 /* Timer not running */ 1650 if (fctx->res->spillattimer == NULL) { 1651 isc_interval_t i; 1652 1653 isc_timer_create( 1654 isc_loop(), spillattimer_countdown, 1655 fctx->res, &fctx->res->spillattimer); 1656 1657 isc_interval_set(&i, 20 * 60, 0); 1658 isc_timer_start(fctx->res->spillattimer, 1659 isc_timertype_ticker, &i); 1660 } 1661 } 1662 UNLOCK(&fctx->res->lock); 1663 if (logit) { 1664 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 1665 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 1666 "clients-per-query increased to %u", 1667 new_spillat); 1668 } 1669 } 1670 } 1671 1672 static uint32_t 1673 fctx_hash(fetchctx_t *fctx) { 1674 isc_hash32_t hash32; 1675 isc_hash32_init(&hash32); 1676 isc_hash32_hash(&hash32, fctx->name->ndata, fctx->name->length, false); 1677 isc_hash32_hash(&hash32, &fctx->options, sizeof(fctx->options), true); 1678 isc_hash32_hash(&hash32, &fctx->type, sizeof(fctx->type), true); 1679 return isc_hash32_finalize(&hash32); 1680 } 1681 1682 static bool 1683 fctx_match(void *node, const void *key) { 1684 const fetchctx_t *fctx0 = node; 1685 const fetchctx_t *fctx1 = key; 1686 1687 return fctx0->options == fctx1->options && fctx0->type == fctx1->type && 1688 dns_name_equal(fctx0->name, fctx1->name); 1689 } 1690 1691 static bool 1692 fctx__done(fetchctx_t *fctx, isc_result_t result, const char *func, 1693 const char *file, unsigned int line) { 1694 bool no_response = false; 1695 bool age_untried = false; 1696 1697 REQUIRE(fctx != NULL); 1698 REQUIRE(fctx->tid == isc_tid()); 1699 1700 FCTXTRACE("done"); 1701 1702 #ifdef DNS_RESOLVER_TRACE 1703 fprintf(stderr, "%s:%s:%s:%u:(%p): %s\n", __func__, func, file, line, 1704 fctx, isc_result_totext(result)); 1705 #else 1706 UNUSED(file); 1707 UNUSED(line); 1708 UNUSED(func); 1709 #endif 1710 1711 LOCK(&fctx->lock); 1712 /* We need to do this under the lock for intra-thread synchronization */ 1713 if (fctx->state == fetchstate_done) { 1714 UNLOCK(&fctx->lock); 1715 return false; 1716 } 1717 fctx->state = fetchstate_done; 1718 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 1719 UNLOCK(&fctx->lock); 1720 1721 /* The fctx will get deleted either here or in get_attached_fctx() */ 1722 RWLOCK(&fctx->res->fctxs_lock, isc_rwlocktype_write); 1723 (void)isc_hashmap_delete(fctx->res->fctxs, fctx_hash(fctx), match_ptr, 1724 fctx); 1725 RWUNLOCK(&fctx->res->fctxs_lock, isc_rwlocktype_write); 1726 1727 if (result == ISC_R_SUCCESS) { 1728 if (fctx->qmin_warning != ISC_R_SUCCESS) { 1729 isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS, 1730 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 1731 "success resolving '%s' after disabling " 1732 "qname minimization due to '%s'", 1733 fctx->info, 1734 isc_result_totext(fctx->qmin_warning)); 1735 } 1736 1737 /* 1738 * A success result indicates we got a response to a 1739 * query. That query should be canceled already. If 1740 * there still are any outstanding queries attached to the 1741 * same fctx, then those have *not* gotten a response, 1742 * so we set 'no_response' to true here: that way, when 1743 * we run fctx_cancelqueries() below, the SRTTs will 1744 * be adjusted. 1745 */ 1746 no_response = true; 1747 } else if (result == ISC_R_TIMEDOUT) { 1748 age_untried = true; 1749 } 1750 1751 fctx->qmin_warning = ISC_R_SUCCESS; 1752 1753 /* 1754 * Cancel all pending ADB finds if we have not been successful 1755 * or we are shutting down. 1756 */ 1757 if (result != ISC_R_SUCCESS) { 1758 dns_adbfind_t *find = NULL; 1759 for (find = ISC_LIST_HEAD(fctx->pending_finds); find != NULL; 1760 find = ISC_LIST_NEXT(find, publink)) 1761 { 1762 dns_adb_cancelfind(find); 1763 } 1764 } 1765 1766 fctx_cancelqueries(fctx, no_response, age_untried); 1767 fctx_stoptimer(fctx); 1768 1769 /* 1770 * Cancel all pending validators. 1771 */ 1772 dns_validator_t *validator = NULL; 1773 for (validator = ISC_LIST_HEAD(fctx->validators); validator != NULL; 1774 validator = ISC_LIST_NEXT(validator, link)) 1775 { 1776 dns_validator_cancel(validator); 1777 } 1778 1779 if (fctx->nsfetch != NULL) { 1780 dns_resolver_cancelfetch(fctx->nsfetch); 1781 } 1782 1783 if (fctx->qminfetch != NULL) { 1784 dns_resolver_cancelfetch(fctx->qminfetch); 1785 } 1786 1787 /* 1788 * Shut down anything still running on behalf of this 1789 * fetch, and clean up finds and addresses. 1790 */ 1791 fctx_sendevents(fctx, result); 1792 fctx_cleanup(fctx); 1793 1794 isc_timer_destroy(&fctx->timer); 1795 1796 return true; 1797 } 1798 1799 static void 1800 resquery_senddone(isc_result_t eresult, isc_region_t *region, void *arg) { 1801 resquery_t *query = (resquery_t *)arg; 1802 resquery_t *copy = query; 1803 fetchctx_t *fctx = NULL; 1804 1805 QTRACE("senddone"); 1806 1807 UNUSED(region); 1808 1809 REQUIRE(VALID_QUERY(query)); 1810 fctx = query->fctx; 1811 REQUIRE(VALID_FCTX(fctx)); 1812 REQUIRE(fctx->tid == isc_tid()); 1813 1814 if (RESQUERY_CANCELED(query)) { 1815 goto detach; 1816 } 1817 1818 /* 1819 * See the note in resquery_connected() about reference 1820 * counting on error conditions. 1821 */ 1822 switch (eresult) { 1823 case ISC_R_SUCCESS: 1824 case ISC_R_CANCELED: 1825 case ISC_R_SHUTTINGDOWN: 1826 break; 1827 1828 case ISC_R_HOSTDOWN: 1829 case ISC_R_HOSTUNREACH: 1830 case ISC_R_NETDOWN: 1831 case ISC_R_NETUNREACH: 1832 case ISC_R_NOPERM: 1833 case ISC_R_ADDRNOTAVAIL: 1834 case ISC_R_CONNREFUSED: 1835 case ISC_R_CONNECTIONRESET: 1836 case ISC_R_TIMEDOUT: 1837 /* No route to remote. */ 1838 FCTXTRACE3("query canceled in resquery_senddone(): " 1839 "no route to host; no response", 1840 eresult); 1841 add_bad(fctx, query->rmessage, query->addrinfo, eresult, 1842 badns_unreachable); 1843 fctx_cancelquery(©, NULL, true, false); 1844 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 1845 fctx_try(fctx, true); 1846 break; 1847 1848 default: 1849 FCTXTRACE3("query canceled in resquery_senddone() " 1850 "due to unexpected result; responding", 1851 eresult); 1852 fctx_cancelquery(©, NULL, false, false); 1853 fctx_done_detach(&fctx, eresult); 1854 break; 1855 } 1856 1857 detach: 1858 resquery_detach(&query); 1859 } 1860 1861 static isc_result_t 1862 fctx_addopt(dns_message_t *message, unsigned int version, uint16_t udpsize, 1863 dns_ednsopt_t *ednsopts, size_t count) { 1864 dns_rdataset_t *rdataset = NULL; 1865 isc_result_t result; 1866 1867 result = dns_message_buildopt(message, &rdataset, version, udpsize, 1868 DNS_MESSAGEEXTFLAG_DO, ednsopts, count); 1869 if (result != ISC_R_SUCCESS) { 1870 return result; 1871 } 1872 return dns_message_setopt(message, rdataset); 1873 } 1874 1875 static void 1876 fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) { 1877 unsigned int seconds, us; 1878 uint64_t limit; 1879 isc_time_t now; 1880 1881 /* 1882 * Has this fetch already expired? 1883 */ 1884 now = isc_time_now(); 1885 limit = isc_time_microdiff(&fctx->expires, &now); 1886 if (limit < US_PER_MS) { 1887 FCTXTRACE("fetch already expired"); 1888 isc_interval_set(&fctx->interval, 0, 0); 1889 return; 1890 } 1891 1892 us = fctx->res->retryinterval * US_PER_MS; 1893 1894 /* 1895 * Exponential backoff after the first few tries. 1896 */ 1897 if (fctx->restarts > fctx->res->nonbackofftries) { 1898 int shift = fctx->restarts - fctx->res->nonbackofftries; 1899 if (shift > 6) { 1900 shift = 6; 1901 } 1902 us <<= shift; 1903 } 1904 1905 /* 1906 * Add a fudge factor to the expected rtt based on the current 1907 * estimate. 1908 */ 1909 if (rtt < 50000) { 1910 rtt += 50000; 1911 } else if (rtt < 100000) { 1912 rtt += 100000; 1913 } else { 1914 rtt += 200000; 1915 } 1916 1917 /* 1918 * Always wait for at least the expected rtt. 1919 */ 1920 if (us < rtt) { 1921 us = rtt; 1922 } 1923 1924 /* 1925 * But don't wait past the the final expiration of the fetch, 1926 * or for more than 10 seconds total. 1927 */ 1928 if (us > limit) { 1929 us = limit; 1930 } 1931 if (us > MAX_SINGLE_QUERY_TIMEOUT_US) { 1932 us = MAX_SINGLE_QUERY_TIMEOUT_US; 1933 } 1934 if (us > fctx->res->query_timeout * US_PER_MS) { 1935 us = fctx->res->query_timeout * US_PER_MS; 1936 } 1937 1938 seconds = us / US_PER_SEC; 1939 us -= seconds * US_PER_SEC; 1940 isc_interval_set(&fctx->interval, seconds, us * NS_PER_US); 1941 isc_time_nowplusinterval(&fctx->next_timeout, &fctx->interval); 1942 } 1943 1944 static isc_result_t 1945 fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, 1946 unsigned int options) { 1947 isc_result_t result; 1948 dns_resolver_t *res = NULL; 1949 dns_dns64_t *dns64 = NULL; 1950 resquery_t *query = NULL; 1951 isc_sockaddr_t addr, sockaddr; 1952 bool have_addr = false; 1953 unsigned int srtt; 1954 isc_tlsctx_cache_t *tlsctx_cache = NULL; 1955 1956 FCTXTRACE("query"); 1957 1958 res = fctx->res; 1959 1960 srtt = addrinfo->srtt; 1961 1962 if (addrinfo->transport != NULL) { 1963 switch (dns_transport_get_type(addrinfo->transport)) { 1964 case DNS_TRANSPORT_TLS: 1965 options |= DNS_FETCHOPT_TCP; 1966 tlsctx_cache = res->tlsctx_cache; 1967 break; 1968 case DNS_TRANSPORT_TCP: 1969 case DNS_TRANSPORT_HTTP: 1970 options |= DNS_FETCHOPT_TCP; 1971 break; 1972 default: 1973 break; 1974 } 1975 } 1976 1977 /* 1978 * Allow an additional second for the kernel to resend the SYN 1979 * (or SYN without ECN in the case of stupid firewalls blocking 1980 * ECN negotiation) over the current RTT estimate. 1981 */ 1982 if ((options & DNS_FETCHOPT_TCP) != 0) { 1983 srtt += US_PER_SEC; 1984 } 1985 1986 /* 1987 * A forwarder needs to make multiple queries. Give it at least 1988 * a second to do these in. 1989 */ 1990 if (ISFORWARDER(addrinfo) && srtt < US_PER_SEC) { 1991 srtt = US_PER_SEC; 1992 } 1993 1994 fctx_setretryinterval(fctx, srtt); 1995 if (isc_interval_iszero(&fctx->interval)) { 1996 FCTXTRACE("fetch expired"); 1997 dns_ede_add(&fctx->edectx, DNS_EDE_NOREACHABLEAUTH, NULL); 1998 return ISC_R_TIMEDOUT; 1999 } 2000 2001 INSIST(ISC_LIST_EMPTY(fctx->validators)); 2002 2003 query = isc_mem_get(fctx->mctx, sizeof(*query)); 2004 *query = (resquery_t){ 2005 .options = options, 2006 .addrinfo = addrinfo, 2007 .link = ISC_LINK_INITIALIZER, 2008 }; 2009 2010 #if DNS_RESOLVER_TRACE 2011 fprintf(stderr, "rctx_init:%s:%s:%d:%p->references = 1\n", __func__, 2012 __FILE__, __LINE__, query); 2013 #endif 2014 isc_refcount_init(&query->references, 1); 2015 2016 /* 2017 * Note that the caller MUST guarantee that 'addrinfo' will 2018 * remain valid until this query is canceled. 2019 */ 2020 2021 dns_message_create(fctx->mctx, fctx->res->namepools[fctx->tid], 2022 fctx->res->rdspools[fctx->tid], 2023 DNS_MESSAGE_INTENTPARSE, &query->rmessage); 2024 query->start = isc_time_now(); 2025 2026 /* 2027 * Maybe apply DNS64 mappings to IPv4 addresses. 2028 */ 2029 sockaddr = addrinfo->sockaddr; 2030 dns64 = ISC_LIST_HEAD(fctx->res->view->dns64); 2031 if (isc_sockaddr_pf(&sockaddr) == AF_INET && 2032 fctx->res->view->usedns64 && dns64 != NULL) 2033 { 2034 struct in6_addr aaaa; 2035 2036 result = dns_dns64_aaaafroma( 2037 dns64, NULL, NULL, fctx->res->view->aclenv, 0, 2038 (unsigned char *)&sockaddr.type.sin.sin_addr.s_addr, 2039 aaaa.s6_addr); 2040 if (result == ISC_R_SUCCESS) { 2041 char sockaddrbuf1[ISC_SOCKADDR_FORMATSIZE]; 2042 char sockaddrbuf2[ISC_SOCKADDR_FORMATSIZE]; 2043 2044 /* format old address */ 2045 isc_sockaddr_format(&sockaddr, sockaddrbuf1, 2046 sizeof(sockaddrbuf1)); 2047 2048 /* replace address */ 2049 isc_sockaddr_fromin6(&sockaddr, &aaaa, 2050 ntohs(sockaddr.type.sin.sin_port)); 2051 addrinfo->sockaddr = sockaddr; 2052 2053 /* format new address */ 2054 isc_sockaddr_format(&sockaddr, sockaddrbuf2, 2055 sizeof(sockaddrbuf2)); 2056 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 2057 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 2058 "Using DNS64 address %s to talk to %s\n", 2059 sockaddrbuf2, sockaddrbuf1); 2060 } 2061 } 2062 if (res->view->peers != NULL) { 2063 dns_peer_t *peer = NULL; 2064 isc_netaddr_t dstip; 2065 bool usetcp = false; 2066 isc_netaddr_fromsockaddr(&dstip, &sockaddr); 2067 result = dns_peerlist_peerbyaddr(res->view->peers, &dstip, 2068 &peer); 2069 if (result == ISC_R_SUCCESS) { 2070 result = dns_peer_getquerysource(peer, &addr); 2071 if (result == ISC_R_SUCCESS) { 2072 have_addr = true; 2073 } 2074 result = dns_peer_getforcetcp(peer, &usetcp); 2075 if (result == ISC_R_SUCCESS && usetcp) { 2076 query->options |= DNS_FETCHOPT_TCP; 2077 } 2078 } 2079 } 2080 2081 /* 2082 * If this is a TCP query, then we need to make a socket and 2083 * a dispatch for it here. Otherwise we use the resolver's 2084 * shared dispatch. 2085 */ 2086 if ((query->options & DNS_FETCHOPT_TCP) != 0) { 2087 int pf; 2088 2089 pf = isc_sockaddr_pf(&sockaddr); 2090 if (!have_addr) { 2091 switch (pf) { 2092 case PF_INET: 2093 result = dns_dispatch_getlocaladdress( 2094 res->dispatches4->dispatches[0], &addr); 2095 break; 2096 case PF_INET6: 2097 result = dns_dispatch_getlocaladdress( 2098 res->dispatches6->dispatches[0], &addr); 2099 break; 2100 default: 2101 result = ISC_R_NOTIMPLEMENTED; 2102 break; 2103 } 2104 if (result != ISC_R_SUCCESS) { 2105 goto cleanup_query; 2106 } 2107 } 2108 isc_sockaddr_setport(&addr, 0); 2109 2110 result = dns_dispatch_createtcp(fctx->dispatchmgr, &addr, 2111 &sockaddr, addrinfo->transport, 2112 DNS_DISPATCHTYPE_RESOLVER, 0, 2113 &query->dispatch); 2114 if (result != ISC_R_SUCCESS) { 2115 goto cleanup_query; 2116 } 2117 2118 FCTXTRACE("connecting via TCP"); 2119 } else { 2120 if (have_addr) { 2121 result = dns_dispatch_createudp( 2122 fctx->dispatchmgr, &addr, &query->dispatch); 2123 if (result != ISC_R_SUCCESS) { 2124 goto cleanup_query; 2125 } 2126 } else { 2127 switch (isc_sockaddr_pf(&sockaddr)) { 2128 case PF_INET: 2129 dns_dispatch_attach( 2130 dns_resolver_dispatchv4(res), 2131 &query->dispatch); 2132 break; 2133 case PF_INET6: 2134 dns_dispatch_attach( 2135 dns_resolver_dispatchv6(res), 2136 &query->dispatch); 2137 break; 2138 default: 2139 result = ISC_R_NOTIMPLEMENTED; 2140 goto cleanup_query; 2141 } 2142 } 2143 2144 /* 2145 * We should always have a valid dispatcher here. If we 2146 * don't support a protocol family, then its dispatcher 2147 * will be NULL, but we shouldn't be finding addresses 2148 * for protocol types we don't support, so the 2149 * dispatcher we found should never be NULL. 2150 */ 2151 INSIST(query->dispatch != NULL); 2152 } 2153 2154 LOCK(&fctx->lock); 2155 INSIST(!SHUTTINGDOWN(fctx)); 2156 fetchctx_attach(fctx, &query->fctx); 2157 query->magic = QUERY_MAGIC; 2158 2159 if ((query->options & DNS_FETCHOPT_TCP) == 0) { 2160 if (dns_adb_overquota(fctx->adb, addrinfo)) { 2161 UNLOCK(&fctx->lock); 2162 result = ISC_R_QUOTA; 2163 goto cleanup_dispatch; 2164 } 2165 2166 /* Inform the ADB that we're starting a UDP fetch */ 2167 dns_adb_beginudpfetch(fctx->adb, addrinfo); 2168 } 2169 2170 ISC_LIST_APPEND(fctx->queries, query, link); 2171 atomic_fetch_add_relaxed(&fctx->nqueries, 1); 2172 UNLOCK(&fctx->lock); 2173 2174 /* Set up the dispatch and set the query ID */ 2175 result = dns_dispatch_add(query->dispatch, fctx->loop, 0, 2176 isc_interval_ms(&fctx->interval), &sockaddr, 2177 addrinfo->transport, tlsctx_cache, 2178 resquery_connected, resquery_senddone, 2179 resquery_response, query, &query->id, 2180 &query->dispentry); 2181 if (result != ISC_R_SUCCESS) { 2182 goto cleanup_udpfetch; 2183 } 2184 2185 /* Connect the socket */ 2186 resquery_ref(query); 2187 result = dns_dispatch_connect(query->dispentry); 2188 2189 if (result != ISC_R_SUCCESS && (query->options & DNS_FETCHOPT_TCP) != 0) 2190 { 2191 int log_level = ISC_LOG_NOTICE; 2192 if (isc_log_wouldlog(dns_lctx, log_level)) { 2193 char peerbuf[ISC_SOCKADDR_FORMATSIZE]; 2194 2195 isc_sockaddr_format(&sockaddr, peerbuf, 2196 ISC_SOCKADDR_FORMATSIZE); 2197 2198 isc_log_write( 2199 dns_lctx, DNS_LOGCATEGORY_RESOLVER, 2200 DNS_LOGMODULE_RESOLVER, log_level, 2201 "Unable to establish a connection to %s: %s", 2202 peerbuf, isc_result_totext(result)); 2203 } 2204 dns_dispatch_done(&query->dispentry); 2205 resquery_unref(query); 2206 goto cleanup_fetch; 2207 } else { 2208 RUNTIME_CHECK(result == ISC_R_SUCCESS); 2209 } 2210 2211 return result; 2212 2213 cleanup_udpfetch: 2214 if (!RESQUERY_CANCELED(query)) { 2215 if ((query->options & DNS_FETCHOPT_TCP) == 0) { 2216 /* Inform the ADB that we're ending a UDP fetch */ 2217 dns_adb_endudpfetch(fctx->adb, addrinfo); 2218 } 2219 } 2220 2221 cleanup_fetch: 2222 LOCK(&fctx->lock); 2223 if (ISC_LINK_LINKED(query, link)) { 2224 atomic_fetch_sub_release(&fctx->nqueries, 1); 2225 ISC_LIST_UNLINK(fctx->queries, query, link); 2226 } 2227 UNLOCK(&fctx->lock); 2228 2229 cleanup_dispatch: 2230 fetchctx_detach(&query->fctx); 2231 2232 if (query->dispatch != NULL) { 2233 dns_dispatch_detach(&query->dispatch); 2234 } 2235 2236 cleanup_query: 2237 query->magic = 0; 2238 dns_message_detach(&query->rmessage); 2239 isc_mem_put(fctx->mctx, query, sizeof(*query)); 2240 2241 return result; 2242 } 2243 2244 static struct tried * 2245 triededns(fetchctx_t *fctx, isc_sockaddr_t *address) { 2246 struct tried *tried; 2247 2248 for (tried = ISC_LIST_HEAD(fctx->edns); tried != NULL; 2249 tried = ISC_LIST_NEXT(tried, link)) 2250 { 2251 if (isc_sockaddr_equal(&tried->addr, address)) { 2252 return tried; 2253 } 2254 } 2255 2256 return NULL; 2257 } 2258 2259 static void 2260 add_triededns(fetchctx_t *fctx, isc_sockaddr_t *address) { 2261 struct tried *tried; 2262 2263 tried = triededns(fctx, address); 2264 if (tried != NULL) { 2265 tried->count++; 2266 return; 2267 } 2268 2269 tried = isc_mem_get(fctx->mctx, sizeof(*tried)); 2270 2271 tried->addr = *address; 2272 tried->count = 1; 2273 ISC_LIST_INITANDAPPEND(fctx->edns, tried, link); 2274 } 2275 2276 static size_t 2277 addr2buf(void *buf, const size_t bufsize, const isc_sockaddr_t *sockaddr) { 2278 isc_netaddr_t netaddr; 2279 isc_netaddr_fromsockaddr(&netaddr, sockaddr); 2280 switch (netaddr.family) { 2281 case AF_INET: 2282 INSIST(bufsize >= 4); 2283 memmove(buf, &netaddr.type.in, 4); 2284 return 4; 2285 case AF_INET6: 2286 INSIST(bufsize >= 16); 2287 memmove(buf, &netaddr.type.in6, 16); 2288 return 16; 2289 default: 2290 UNREACHABLE(); 2291 } 2292 return 0; 2293 } 2294 2295 static size_t 2296 add_serveraddr(uint8_t *buf, const size_t bufsize, const resquery_t *query) { 2297 return addr2buf(buf, bufsize, &query->addrinfo->sockaddr); 2298 } 2299 2300 /* 2301 * Client cookie is 8 octets. 2302 * Server cookie is [8..32] octets. 2303 */ 2304 #define CLIENT_COOKIE_SIZE 8U 2305 #define COOKIE_BUFFER_SIZE (8U + 32U) 2306 2307 static void 2308 compute_cc(const resquery_t *query, uint8_t *cookie, const size_t len) { 2309 INSIST(len >= CLIENT_COOKIE_SIZE); 2310 STATIC_ASSERT(sizeof(query->fctx->res->view->secret) >= 2311 ISC_SIPHASH24_KEY_LENGTH, 2312 "The view->secret size can't fit SipHash 2-4 key " 2313 "length"); 2314 2315 uint8_t buf[16] ISC_NONSTRING = { 0 }; 2316 size_t buflen = add_serveraddr(buf, sizeof(buf), query); 2317 2318 uint8_t digest[ISC_SIPHASH24_TAG_LENGTH] ISC_NONSTRING = { 0 }; 2319 isc_siphash24(query->fctx->res->view->secret, buf, buflen, true, 2320 digest); 2321 memmove(cookie, digest, CLIENT_COOKIE_SIZE); 2322 } 2323 2324 static isc_result_t 2325 issecuredomain(dns_view_t *view, const dns_name_t *name, dns_rdatatype_t type, 2326 isc_stdtime_t now, bool checknta, bool *ntap, bool *issecure) { 2327 dns_name_t suffix; 2328 unsigned int labels; 2329 2330 /* 2331 * For DS variants we need to check fom the parent domain, 2332 * since there may be a negative trust anchor for the name, 2333 * while the enclosing domain where the DS record lives is 2334 * under a secure entry point. 2335 */ 2336 labels = dns_name_countlabels(name); 2337 if (dns_rdatatype_atparent(type) && labels > 1) { 2338 dns_name_init(&suffix, NULL); 2339 dns_name_getlabelsequence(name, 1, labels - 1, &suffix); 2340 name = &suffix; 2341 } 2342 2343 return dns_view_issecuredomain(view, name, now, checknta, ntap, 2344 issecure); 2345 } 2346 2347 static isc_result_t 2348 resquery_send(resquery_t *query) { 2349 isc_result_t result; 2350 fetchctx_t *fctx = query->fctx; 2351 dns_resolver_t *res = fctx->res; 2352 isc_buffer_t buffer; 2353 dns_name_t *qname = NULL; 2354 dns_rdataset_t *qrdataset = NULL; 2355 isc_region_t r; 2356 isc_netaddr_t ipaddr; 2357 dns_tsigkey_t *tsigkey = NULL; 2358 dns_peer_t *peer = NULL; 2359 dns_compress_t cctx; 2360 bool useedns; 2361 bool secure_domain; 2362 bool tcp = ((query->options & DNS_FETCHOPT_TCP) != 0); 2363 dns_ednsopt_t ednsopts[DNS_EDNSOPTIONS]; 2364 unsigned int ednsopt = 0; 2365 uint16_t hint = 0, udpsize = 0; /* No EDNS */ 2366 #ifdef HAVE_DNSTAP 2367 isc_sockaddr_t localaddr, *la = NULL; 2368 unsigned char zone[DNS_NAME_MAXWIRE]; 2369 dns_transport_type_t transport_type; 2370 dns_dtmsgtype_t dtmsgtype; 2371 isc_region_t zr; 2372 isc_buffer_t zb; 2373 #endif /* HAVE_DNSTAP */ 2374 2375 QTRACE("send"); 2376 2377 if (atomic_load_acquire(&res->exiting)) { 2378 FCTXTRACE("resquery_send: resolver shutting down"); 2379 return ISC_R_SHUTTINGDOWN; 2380 } 2381 2382 dns_message_gettempname(fctx->qmessage, &qname); 2383 dns_message_gettemprdataset(fctx->qmessage, &qrdataset); 2384 2385 fctx->qmessage->opcode = dns_opcode_query; 2386 2387 /* 2388 * Set up question. 2389 */ 2390 dns_name_clone(fctx->name, qname); 2391 dns_rdataset_makequestion(qrdataset, res->rdclass, fctx->type); 2392 ISC_LIST_APPEND(qname->list, qrdataset, link); 2393 dns_message_addname(fctx->qmessage, qname, DNS_SECTION_QUESTION); 2394 2395 /* 2396 * Set RD if the client has requested that we do a recursive 2397 * query, or if we're sending to a forwarder. 2398 */ 2399 if ((query->options & DNS_FETCHOPT_RECURSIVE) != 0 || 2400 ISFORWARDER(query->addrinfo)) 2401 { 2402 fctx->qmessage->flags |= DNS_MESSAGEFLAG_RD; 2403 } 2404 2405 /* 2406 * Set CD if the client says not to validate, or if the 2407 * question is under a secure entry point and this is a 2408 * recursive/forward query -- unless the client said not to. 2409 */ 2410 if ((query->options & DNS_FETCHOPT_NOCDFLAG) != 0) { 2411 /* Do nothing */ 2412 } else if ((query->options & DNS_FETCHOPT_NOVALIDATE) != 0) { 2413 fctx->qmessage->flags |= DNS_MESSAGEFLAG_CD; 2414 } else if (res->view->enablevalidation && 2415 ((fctx->qmessage->flags & DNS_MESSAGEFLAG_RD) != 0)) 2416 { 2417 bool checknta = ((query->options & DNS_FETCHOPT_NONTA) == 0); 2418 bool ntacovered = false; 2419 result = issecuredomain(res->view, fctx->name, fctx->type, 2420 isc_time_seconds(&query->start), 2421 checknta, &ntacovered, &secure_domain); 2422 if (result != ISC_R_SUCCESS) { 2423 secure_domain = false; 2424 } 2425 if (secure_domain || 2426 (ISFORWARDER(query->addrinfo) && ntacovered)) 2427 { 2428 fctx->qmessage->flags |= DNS_MESSAGEFLAG_CD; 2429 } 2430 } 2431 2432 /* 2433 * We don't have to set opcode because it defaults to query. 2434 */ 2435 fctx->qmessage->id = query->id; 2436 2437 /* 2438 * Convert the question to wire format. 2439 */ 2440 dns_compress_init(&cctx, fctx->mctx, 0); 2441 2442 isc_buffer_init(&buffer, query->data, sizeof(query->data)); 2443 result = dns_message_renderbegin(fctx->qmessage, &cctx, &buffer); 2444 if (result != ISC_R_SUCCESS) { 2445 goto cleanup_message; 2446 } 2447 2448 result = dns_message_rendersection(fctx->qmessage, DNS_SECTION_QUESTION, 2449 0); 2450 if (result != ISC_R_SUCCESS) { 2451 goto cleanup_message; 2452 } 2453 2454 isc_netaddr_fromsockaddr(&ipaddr, &query->addrinfo->sockaddr); 2455 (void)dns_peerlist_peerbyaddr(fctx->res->view->peers, &ipaddr, &peer); 2456 2457 /* 2458 * The ADB does not know about servers with "edns no". Check 2459 * this, and then inform the ADB for future use. 2460 */ 2461 if ((query->addrinfo->flags & FCTX_ADDRINFO_NOEDNS0) == 0 && 2462 peer != NULL && 2463 dns_peer_getsupportedns(peer, &useedns) == ISC_R_SUCCESS && 2464 !useedns) 2465 { 2466 query->options |= DNS_FETCHOPT_NOEDNS0; 2467 dns_adb_changeflags(fctx->adb, query->addrinfo, 2468 FCTX_ADDRINFO_NOEDNS0, 2469 FCTX_ADDRINFO_NOEDNS0); 2470 } 2471 2472 /* Sync NOEDNS0 flag in addrinfo->flags and options now. */ 2473 if ((query->addrinfo->flags & FCTX_ADDRINFO_NOEDNS0) != 0) { 2474 query->options |= DNS_FETCHOPT_NOEDNS0; 2475 } 2476 2477 if (fctx->timeout && (query->options & DNS_FETCHOPT_NOEDNS0) == 0) { 2478 isc_sockaddr_t *sockaddr = &query->addrinfo->sockaddr; 2479 struct tried *tried; 2480 2481 /* 2482 * If this is the first timeout for this server in this 2483 * fetch context, try setting EDNS UDP buffer size to 2484 * the largest UDP response size we have seen from this 2485 * server so far. 2486 * 2487 * If this server has already timed out twice or more in 2488 * this fetch context, force TCP. 2489 */ 2490 if ((tried = triededns(fctx, sockaddr)) != NULL) { 2491 if (tried->count == 1U) { 2492 hint = dns_adb_getudpsize(fctx->adb, 2493 query->addrinfo); 2494 } else if (tried->count >= 2U) { 2495 if ((query->options & DNS_FETCHOPT_TCP) == 0) { 2496 /* 2497 * Inform the ADB that we're ending a 2498 * UDP fetch, and turn the query into 2499 * a TCP query. 2500 */ 2501 dns_adb_endudpfetch(fctx->adb, 2502 query->addrinfo); 2503 query->options |= DNS_FETCHOPT_TCP; 2504 } 2505 } 2506 } 2507 } 2508 fctx->timeout = false; 2509 2510 /* 2511 * Use EDNS0, unless the caller doesn't want it, or we know that 2512 * the remote server doesn't like it. 2513 */ 2514 if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0) { 2515 if ((query->addrinfo->flags & FCTX_ADDRINFO_NOEDNS0) == 0) { 2516 uint16_t peerudpsize = 0; 2517 unsigned int version = DNS_EDNS_VERSION; 2518 unsigned int flags = query->addrinfo->flags; 2519 bool reqnsid = res->view->requestnsid; 2520 bool sendcookie = res->view->sendcookie; 2521 bool tcpkeepalive = false; 2522 unsigned char cookie[COOKIE_BUFFER_SIZE]; 2523 uint16_t padding = 0; 2524 2525 /* 2526 * Set the default UDP size to what was 2527 * configured as 'edns-buffer-size' 2528 */ 2529 udpsize = res->view->udpsize; 2530 2531 /* 2532 * This server timed out for the first time in 2533 * this fetch context and we received a response 2534 * from it before (either in this fetch context 2535 * or in a different one). Set 'udpsize' to the 2536 * size of the largest UDP response we have 2537 * received from this server so far. 2538 */ 2539 if (hint != 0U) { 2540 udpsize = hint; 2541 } 2542 2543 /* 2544 * If a fixed EDNS UDP buffer size is configured 2545 * for this server, make sure we obey that. 2546 */ 2547 if (peer != NULL) { 2548 (void)dns_peer_getudpsize(peer, &peerudpsize); 2549 if (peerudpsize != 0) { 2550 udpsize = peerudpsize; 2551 } 2552 } 2553 2554 if ((flags & DNS_FETCHOPT_EDNSVERSIONSET) != 0) { 2555 version = flags & DNS_FETCHOPT_EDNSVERSIONMASK; 2556 version >>= DNS_FETCHOPT_EDNSVERSIONSHIFT; 2557 } 2558 2559 /* Request NSID/COOKIE/VERSION for current peer? 2560 */ 2561 if (peer != NULL) { 2562 uint8_t ednsversion; 2563 (void)dns_peer_getrequestnsid(peer, &reqnsid); 2564 (void)dns_peer_getsendcookie(peer, &sendcookie); 2565 result = dns_peer_getednsversion(peer, 2566 &ednsversion); 2567 if (result == ISC_R_SUCCESS && 2568 ednsversion < version) 2569 { 2570 version = ednsversion; 2571 } 2572 } 2573 if (NOCOOKIE(query->addrinfo)) { 2574 sendcookie = false; 2575 } 2576 if (reqnsid) { 2577 INSIST(ednsopt < DNS_EDNSOPTIONS); 2578 ednsopts[ednsopt].code = DNS_OPT_NSID; 2579 ednsopts[ednsopt].length = 0; 2580 ednsopts[ednsopt].value = NULL; 2581 ednsopt++; 2582 } 2583 if (sendcookie) { 2584 INSIST(ednsopt < DNS_EDNSOPTIONS); 2585 ednsopts[ednsopt].code = DNS_OPT_COOKIE; 2586 ednsopts[ednsopt].length = 2587 (uint16_t)dns_adb_getcookie( 2588 query->addrinfo, cookie, 2589 sizeof(cookie)); 2590 if (ednsopts[ednsopt].length != 0) { 2591 ednsopts[ednsopt].value = cookie; 2592 inc_stats( 2593 fctx->res, 2594 dns_resstatscounter_cookieout); 2595 } else { 2596 compute_cc(query, cookie, 2597 CLIENT_COOKIE_SIZE); 2598 ednsopts[ednsopt].value = cookie; 2599 ednsopts[ednsopt].length = 2600 CLIENT_COOKIE_SIZE; 2601 inc_stats( 2602 fctx->res, 2603 dns_resstatscounter_cookienew); 2604 } 2605 ednsopt++; 2606 } 2607 2608 /* Add TCP keepalive option if appropriate */ 2609 if ((peer != NULL) && tcp) { 2610 (void)dns_peer_gettcpkeepalive(peer, 2611 &tcpkeepalive); 2612 } 2613 if (tcpkeepalive) { 2614 INSIST(ednsopt < DNS_EDNSOPTIONS); 2615 ednsopts[ednsopt].code = DNS_OPT_TCP_KEEPALIVE; 2616 ednsopts[ednsopt].length = 0; 2617 ednsopts[ednsopt].value = NULL; 2618 ednsopt++; 2619 } 2620 2621 /* Add PAD for current peer? Require TCP for now 2622 */ 2623 if ((peer != NULL) && tcp) { 2624 (void)dns_peer_getpadding(peer, &padding); 2625 } 2626 if (padding != 0) { 2627 INSIST(ednsopt < DNS_EDNSOPTIONS); 2628 ednsopts[ednsopt].code = DNS_OPT_PAD; 2629 ednsopts[ednsopt].length = 0; 2630 ednsopt++; 2631 dns_message_setpadding(fctx->qmessage, padding); 2632 } 2633 2634 query->ednsversion = version; 2635 result = fctx_addopt(fctx->qmessage, version, udpsize, 2636 ednsopts, ednsopt); 2637 if (reqnsid && result == ISC_R_SUCCESS) { 2638 query->options |= DNS_FETCHOPT_WANTNSID; 2639 } else if (result != ISC_R_SUCCESS) { 2640 /* 2641 * We couldn't add the OPT, but we'll 2642 * press on. We're not using EDNS0, so 2643 * set the NOEDNS0 bit. 2644 */ 2645 query->options |= DNS_FETCHOPT_NOEDNS0; 2646 query->ednsversion = -1; 2647 udpsize = 0; 2648 } 2649 } else { 2650 /* 2651 * We know this server doesn't like EDNS0, so we 2652 * won't use it. Set the NOEDNS0 bit since 2653 * we're not using EDNS0. 2654 */ 2655 query->options |= DNS_FETCHOPT_NOEDNS0; 2656 query->ednsversion = -1; 2657 } 2658 } else { 2659 query->ednsversion = -1; 2660 } 2661 2662 /* 2663 * Record the UDP EDNS size chosen. 2664 */ 2665 query->udpsize = udpsize; 2666 2667 /* 2668 * If we need EDNS0 to do this query and aren't using it, we 2669 * lose. 2670 */ 2671 if (NEEDEDNS0(fctx) && (query->options & DNS_FETCHOPT_NOEDNS0) != 0) { 2672 result = DNS_R_SERVFAIL; 2673 goto cleanup_message; 2674 } 2675 2676 add_triededns(fctx, &query->addrinfo->sockaddr); 2677 2678 /* 2679 * Clear CD if EDNS is not in use. 2680 */ 2681 if ((query->options & DNS_FETCHOPT_NOEDNS0) != 0) { 2682 fctx->qmessage->flags &= ~DNS_MESSAGEFLAG_CD; 2683 } 2684 2685 /* 2686 * Add TSIG record tailored to the current recipient. 2687 */ 2688 result = dns_view_getpeertsig(fctx->res->view, &ipaddr, &tsigkey); 2689 if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) { 2690 goto cleanup_message; 2691 } 2692 2693 if (tsigkey != NULL) { 2694 result = dns_message_settsigkey(fctx->qmessage, tsigkey); 2695 dns_tsigkey_detach(&tsigkey); 2696 if (result != ISC_R_SUCCESS) { 2697 goto cleanup_message; 2698 } 2699 } 2700 2701 result = dns_message_rendersection(fctx->qmessage, 2702 DNS_SECTION_ADDITIONAL, 0); 2703 if (result != ISC_R_SUCCESS) { 2704 goto cleanup_message; 2705 } 2706 2707 result = dns_message_renderend(fctx->qmessage); 2708 if (result != ISC_R_SUCCESS) { 2709 goto cleanup_message; 2710 } 2711 2712 #ifdef HAVE_DNSTAP 2713 memset(&zr, 0, sizeof(zr)); 2714 isc_buffer_init(&zb, zone, sizeof(zone)); 2715 dns_compress_setpermitted(&cctx, false); 2716 result = dns_name_towire(fctx->domain, &cctx, &zb, NULL); 2717 if (result == ISC_R_SUCCESS) { 2718 isc_buffer_usedregion(&zb, &zr); 2719 } 2720 #endif /* HAVE_DNSTAP */ 2721 2722 if (dns_message_gettsigkey(fctx->qmessage) != NULL) { 2723 dns_tsigkey_attach(dns_message_gettsigkey(fctx->qmessage), 2724 &query->tsigkey); 2725 result = dns_message_getquerytsig(fctx->qmessage, fctx->mctx, 2726 &query->tsig); 2727 if (result != ISC_R_SUCCESS) { 2728 goto cleanup_message; 2729 } 2730 } 2731 2732 /* 2733 * Log the outgoing packet. 2734 */ 2735 dns_message_logfmtpacket( 2736 fctx->qmessage, "sending packet to", &query->addrinfo->sockaddr, 2737 DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_PACKETS, 2738 &dns_master_style_comment, ISC_LOG_DEBUG(11), fctx->mctx); 2739 2740 /* 2741 * We're now done with the query message. 2742 */ 2743 dns_compress_invalidate(&cctx); 2744 dns_message_reset(fctx->qmessage, DNS_MESSAGE_INTENTRENDER); 2745 2746 isc_buffer_usedregion(&buffer, &r); 2747 2748 resquery_ref(query); 2749 dns_dispatch_send(query->dispentry, &r); 2750 2751 QTRACE("sent"); 2752 2753 #ifdef HAVE_DNSTAP 2754 /* 2755 * Log the outgoing query via dnstap. 2756 */ 2757 if (ISFORWARDER(query->addrinfo)) { 2758 dtmsgtype = DNS_DTTYPE_FQ; 2759 } else { 2760 dtmsgtype = DNS_DTTYPE_RQ; 2761 } 2762 2763 result = dns_dispentry_getlocaladdress(query->dispentry, &localaddr); 2764 if (result == ISC_R_SUCCESS) { 2765 la = &localaddr; 2766 } 2767 2768 if (query->addrinfo->transport != NULL) { 2769 transport_type = 2770 dns_transport_get_type(query->addrinfo->transport); 2771 } else if ((query->options & DNS_FETCHOPT_TCP) != 0) { 2772 transport_type = DNS_TRANSPORT_TCP; 2773 } else { 2774 transport_type = DNS_TRANSPORT_UDP; 2775 } 2776 2777 dns_dt_send(fctx->res->view, dtmsgtype, la, &query->addrinfo->sockaddr, 2778 transport_type, &zr, &query->start, NULL, &buffer); 2779 #endif /* HAVE_DNSTAP */ 2780 2781 return ISC_R_SUCCESS; 2782 2783 cleanup_message: 2784 dns_compress_invalidate(&cctx); 2785 2786 dns_message_reset(fctx->qmessage, DNS_MESSAGE_INTENTRENDER); 2787 2788 /* 2789 * Stop the dispatcher from listening. 2790 */ 2791 dns_dispatch_done(&query->dispentry); 2792 2793 return result; 2794 } 2795 2796 static void 2797 resquery_connected(isc_result_t eresult, isc_region_t *region, void *arg) { 2798 resquery_t *query = (resquery_t *)arg; 2799 resquery_t *copy = query; 2800 isc_result_t result; 2801 fetchctx_t *fctx = NULL; 2802 dns_resolver_t *res = NULL; 2803 int pf; 2804 2805 REQUIRE(VALID_QUERY(query)); 2806 2807 QTRACE("connected"); 2808 2809 UNUSED(region); 2810 2811 fctx = query->fctx; 2812 2813 REQUIRE(VALID_FCTX(fctx)); 2814 REQUIRE(fctx->tid == isc_tid()); 2815 2816 res = fctx->res; 2817 2818 if (RESQUERY_CANCELED(query)) { 2819 goto detach; 2820 } 2821 2822 if (atomic_load_acquire(&fctx->res->exiting)) { 2823 eresult = ISC_R_SHUTTINGDOWN; 2824 } 2825 2826 /* 2827 * The reference counting of resquery objects is complex: 2828 * 2829 * 1. attached in fctx_query() 2830 * 2. attached prior to dns_dispatch_connect(), detached in 2831 * resquery_connected() 2832 * 3. attached prior to dns_dispatch_send(), detached in 2833 * resquery_senddone() 2834 * 4. finally detached in fctx_cancelquery() 2835 * 2836 * On error conditions, it's necessary to call fctx_cancelquery() 2837 * from resquery_connected() or _senddone(), detaching twice 2838 * within the same function. To make it clear that's what's 2839 * happening, we cancel-and-detach 'copy' and detach 'query', 2840 * which are both pointing to the same object. 2841 */ 2842 switch (eresult) { 2843 case ISC_R_SUCCESS: 2844 /* 2845 * We are connected. Send the query. 2846 */ 2847 2848 result = resquery_send(query); 2849 if (result != ISC_R_SUCCESS) { 2850 FCTXTRACE("query canceled: resquery_send() failed; " 2851 "responding"); 2852 2853 fctx_cancelquery(©, NULL, false, false); 2854 fctx_done_detach(&fctx, result); 2855 break; 2856 } 2857 2858 fctx->querysent++; 2859 2860 pf = isc_sockaddr_pf(&query->addrinfo->sockaddr); 2861 if (pf == PF_INET) { 2862 inc_stats(res, dns_resstatscounter_queryv4); 2863 } else { 2864 inc_stats(res, dns_resstatscounter_queryv6); 2865 } 2866 if (res->querystats != NULL) { 2867 dns_rdatatypestats_increment(res->querystats, 2868 fctx->type); 2869 } 2870 break; 2871 2872 case ISC_R_CANCELED: 2873 case ISC_R_SHUTTINGDOWN: 2874 FCTXTRACE3("shutdown in resquery_connected()", eresult); 2875 fctx_cancelquery(©, NULL, true, false); 2876 fctx_done_detach(&fctx, eresult); 2877 break; 2878 2879 case ISC_R_HOSTDOWN: 2880 case ISC_R_HOSTUNREACH: 2881 case ISC_R_NETDOWN: 2882 case ISC_R_NETUNREACH: 2883 case ISC_R_CONNREFUSED: 2884 case ISC_R_NOPERM: 2885 case ISC_R_ADDRNOTAVAIL: 2886 case ISC_R_CONNECTIONRESET: 2887 case ISC_R_TIMEDOUT: 2888 /* 2889 * Do not query this server again in this fetch context. 2890 */ 2891 FCTXTRACE3("query failed in resquery_connected(): " 2892 "no response", 2893 eresult); 2894 add_bad(fctx, query->rmessage, query->addrinfo, eresult, 2895 badns_unreachable); 2896 fctx_cancelquery(©, NULL, true, false); 2897 2898 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 2899 fctx_try(fctx, true); 2900 break; 2901 2902 default: 2903 FCTXTRACE3("query canceled in resquery_connected() " 2904 "due to unexpected result; responding", 2905 eresult); 2906 2907 fctx_cancelquery(©, NULL, false, false); 2908 fctx_done_detach(&fctx, eresult); 2909 break; 2910 } 2911 2912 detach: 2913 resquery_detach(&query); 2914 } 2915 2916 static isc_result_t 2917 fctx_finddone_fail(fetchctx_t *fctx) { 2918 fctx->findfail++; 2919 2920 /* 2921 * There are still running ADB finds and these can be more successful. 2922 */ 2923 if (!ISC_LIST_EMPTY(fctx->pending_finds)) { 2924 return DNS_R_WAIT; 2925 } 2926 2927 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 2928 2929 /* 2930 * There's something on the alternate list. Try that. 2931 */ 2932 if (!ISC_LIST_EMPTY(fctx->res->alternates)) { 2933 return DNS_R_CONTINUE; 2934 } 2935 2936 /* 2937 * We've got nothing else to wait for and don't know the answer. 2938 * There's nothing to do but fail the fctx. 2939 */ 2940 return ISC_R_FAILURE; 2941 } 2942 2943 static void 2944 fctx_finddone(void *arg) { 2945 dns_adbfind_t *find = (dns_adbfind_t *)arg; 2946 fetchctx_t *fctx = (fetchctx_t *)find->cbarg; 2947 isc_result_t result = ISC_R_SUCCESS; 2948 2949 REQUIRE(VALID_FCTX(fctx)); 2950 2951 FCTXTRACE("finddone"); 2952 2953 REQUIRE(fctx->tid == isc_tid()); 2954 2955 LOCK(&fctx->lock); 2956 if (ISC_LINK_LINKED(find, publink)) { 2957 /* 2958 * If we canceled the find directly in findname(), 2959 * it won't be linked here as dns_adb_cancelfind() 2960 * is not idempotent. 2961 */ 2962 fctx->pending_running--; 2963 ISC_LIST_UNLINK(fctx->pending_finds, find, publink); 2964 } 2965 2966 if (ADDRWAIT(fctx)) { 2967 /* 2968 * The fetch is waiting for a name to be found. 2969 */ 2970 INSIST(!SHUTTINGDOWN(fctx)); 2971 if (dns_adb_findstatus(find) == DNS_ADB_MOREADDRESSES) { 2972 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 2973 result = DNS_R_CONTINUE; 2974 } else { 2975 result = fctx_finddone_fail(fctx); 2976 } 2977 } 2978 2979 UNLOCK(&fctx->lock); 2980 2981 dns_adb_destroyfind(&find); 2982 2983 switch (result) { 2984 case ISC_R_SUCCESS: 2985 case DNS_R_WAIT: 2986 break; 2987 case DNS_R_CONTINUE: 2988 fctx_try(fctx, true); 2989 break; 2990 default: 2991 FCTXTRACE2("fetch failed in finddone()", 2992 isc_result_totext(result)); 2993 fctx_done_unref(fctx, result); 2994 break; 2995 } 2996 2997 fetchctx_detach(&fctx); 2998 } 2999 3000 static bool 3001 bad_server(fetchctx_t *fctx, isc_sockaddr_t *address) { 3002 isc_sockaddr_t *sa; 3003 3004 for (sa = ISC_LIST_HEAD(fctx->bad); sa != NULL; 3005 sa = ISC_LIST_NEXT(sa, link)) 3006 { 3007 if (isc_sockaddr_equal(sa, address)) { 3008 return true; 3009 } 3010 } 3011 3012 return false; 3013 } 3014 3015 static bool 3016 mark_bad(fetchctx_t *fctx) { 3017 dns_adbfind_t *curr; 3018 dns_adbaddrinfo_t *addrinfo; 3019 bool all_bad = true; 3020 3021 #ifdef ENABLE_AFL 3022 if (dns_fuzzing_resolver) { 3023 return false; 3024 } 3025 #endif /* ifdef ENABLE_AFL */ 3026 3027 /* 3028 * Mark all known bad servers, so we don't try to talk to them 3029 * again. 3030 */ 3031 3032 /* 3033 * Mark any bad nameservers. 3034 */ 3035 for (curr = ISC_LIST_HEAD(fctx->finds); curr != NULL; 3036 curr = ISC_LIST_NEXT(curr, publink)) 3037 { 3038 for (addrinfo = ISC_LIST_HEAD(curr->list); addrinfo != NULL; 3039 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3040 { 3041 if (bad_server(fctx, &addrinfo->sockaddr)) { 3042 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3043 } else { 3044 all_bad = false; 3045 } 3046 } 3047 } 3048 3049 /* 3050 * Mark any bad forwarders. 3051 */ 3052 for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs); addrinfo != NULL; 3053 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3054 { 3055 if (bad_server(fctx, &addrinfo->sockaddr)) { 3056 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3057 } else { 3058 all_bad = false; 3059 } 3060 } 3061 3062 /* 3063 * Mark any bad alternates. 3064 */ 3065 for (curr = ISC_LIST_HEAD(fctx->altfinds); curr != NULL; 3066 curr = ISC_LIST_NEXT(curr, publink)) 3067 { 3068 for (addrinfo = ISC_LIST_HEAD(curr->list); addrinfo != NULL; 3069 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3070 { 3071 if (bad_server(fctx, &addrinfo->sockaddr)) { 3072 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3073 } else { 3074 all_bad = false; 3075 } 3076 } 3077 } 3078 3079 for (addrinfo = ISC_LIST_HEAD(fctx->altaddrs); addrinfo != NULL; 3080 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3081 { 3082 if (bad_server(fctx, &addrinfo->sockaddr)) { 3083 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3084 } else { 3085 all_bad = false; 3086 } 3087 } 3088 3089 return all_bad; 3090 } 3091 3092 static void 3093 add_bad(fetchctx_t *fctx, dns_message_t *rmessage, dns_adbaddrinfo_t *addrinfo, 3094 isc_result_t reason, badnstype_t badtype) { 3095 char namebuf[DNS_NAME_FORMATSIZE]; 3096 char addrbuf[ISC_SOCKADDR_FORMATSIZE]; 3097 char classbuf[64]; 3098 char typebuf[64]; 3099 char code[64]; 3100 isc_buffer_t b; 3101 isc_sockaddr_t *sa; 3102 const char *spc = ""; 3103 isc_sockaddr_t *address = &addrinfo->sockaddr; 3104 3105 #ifdef ENABLE_AFL 3106 if (dns_fuzzing_resolver) { 3107 return; 3108 } 3109 #endif /* ifdef ENABLE_AFL */ 3110 3111 if (reason == DNS_R_LAME) { 3112 fctx->lamecount++; 3113 } else { 3114 switch (badtype) { 3115 case badns_unreachable: 3116 fctx->neterr++; 3117 break; 3118 case badns_response: 3119 fctx->badresp++; 3120 break; 3121 case badns_validation: 3122 break; /* counted as 'valfail' */ 3123 case badns_forwarder: 3124 /* 3125 * We were called to prevent the given forwarder 3126 * from being used again for this fetch context. 3127 */ 3128 break; 3129 } 3130 } 3131 3132 if (bad_server(fctx, address)) { 3133 /* 3134 * We already know this server is bad. 3135 */ 3136 return; 3137 } 3138 3139 FCTXTRACE("add_bad"); 3140 3141 sa = isc_mem_get(fctx->mctx, sizeof(*sa)); 3142 *sa = *address; 3143 ISC_LIST_INITANDAPPEND(fctx->bad, sa, link); 3144 3145 if (reason == DNS_R_LAME) { /* already logged */ 3146 return; 3147 } 3148 3149 if (reason == DNS_R_UNEXPECTEDRCODE && 3150 rmessage->rcode == dns_rcode_servfail && ISFORWARDER(addrinfo)) 3151 { 3152 return; 3153 } 3154 3155 if (reason == DNS_R_UNEXPECTEDRCODE) { 3156 isc_buffer_init(&b, code, sizeof(code) - 1); 3157 dns_rcode_totext(rmessage->rcode, &b); 3158 code[isc_buffer_usedlength(&b)] = '\0'; 3159 spc = " "; 3160 } else if (reason == DNS_R_UNEXPECTEDOPCODE) { 3161 isc_buffer_init(&b, code, sizeof(code) - 1); 3162 dns_opcode_totext((dns_opcode_t)rmessage->opcode, &b); 3163 code[isc_buffer_usedlength(&b)] = '\0'; 3164 spc = " "; 3165 } else { 3166 code[0] = '\0'; 3167 } 3168 dns_name_format(fctx->name, namebuf, sizeof(namebuf)); 3169 dns_rdatatype_format(fctx->type, typebuf, sizeof(typebuf)); 3170 dns_rdataclass_format(fctx->res->rdclass, classbuf, sizeof(classbuf)); 3171 isc_sockaddr_format(address, addrbuf, sizeof(addrbuf)); 3172 isc_log_write( 3173 dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS, DNS_LOGMODULE_RESOLVER, 3174 ISC_LOG_INFO, "%s%s%s resolving '%s/%s/%s': %s", code, spc, 3175 isc_result_totext(reason), namebuf, typebuf, classbuf, addrbuf); 3176 } 3177 3178 /* 3179 * Return true iff the ADB find has an already pending fetch for 'type'. This 3180 * is used to find out whether we're in a loop, where a fetch is waiting for a 3181 * find which is waiting for that same fetch. So if the current find actually 3182 * started the fetch, we know it can't be a loop, so we returns false. 3183 * 3184 * Note: This could be done with either an equivalence check (e.g., 3185 * query_pending == DNS_ADBFIND_INET) or with a bit check, as below. If 3186 * we checked for equivalence, that would mean we could only detect a loop 3187 * when there is exactly one pending fetch, and we're it. If there were 3188 * pending fetches for *both* address families, then a loop would be 3189 * undetected. 3190 * 3191 * However, using a bit check means that in theory, an ADB find might be 3192 * aborted that could have succeeded, if the other fetch had returned an 3193 * answer. 3194 * 3195 * Since there's a good chance the server is broken and won't answer either 3196 * query, and since an ADB find with two pending fetches is a very rare 3197 * occurrance anyway, we regard this theoretical SERVFAIL as the lesser 3198 * evil. 3199 */ 3200 static bool 3201 already_waiting_for(dns_adbfind_t *find, dns_rdatatype_t type) { 3202 if ((find->options & DNS_ADBFIND_STARTEDFETCH) != 0) { 3203 return false; 3204 } 3205 3206 switch (type) { 3207 case dns_rdatatype_a: 3208 return (find->query_pending & DNS_ADBFIND_INET) != 0; 3209 case dns_rdatatype_aaaa: 3210 return (find->query_pending & DNS_ADBFIND_INET6) != 0; 3211 default: 3212 return false; 3213 } 3214 } 3215 3216 static void 3217 findname(fetchctx_t *fctx, const dns_name_t *name, in_port_t port, 3218 unsigned int options, unsigned int flags, isc_stdtime_t now, 3219 bool *overquota, bool *need_alternate, bool *have_address) { 3220 dns_adbaddrinfo_t *ai = NULL; 3221 dns_adbfind_t *find = NULL; 3222 dns_resolver_t *res = fctx->res; 3223 bool unshared = ((fctx->options & DNS_FETCHOPT_UNSHARED) != 0); 3224 isc_result_t result; 3225 3226 FCTXTRACE("FINDNAME"); 3227 3228 /* 3229 * If this name is a subdomain of the query domain, tell 3230 * the ADB to start looking using zone/hint data. This keeps us 3231 * from getting stuck if the nameserver is beneath the zone cut 3232 * and we don't know its address (e.g. because the A record has 3233 * expired). 3234 */ 3235 if (dns_name_issubdomain(name, fctx->domain)) { 3236 options |= DNS_ADBFIND_STARTATZONE; 3237 } 3238 3239 /* 3240 * Exempt prefetches from ADB quota. 3241 */ 3242 if ((fctx->options & DNS_FETCHOPT_PREFETCH) != 0) { 3243 options |= DNS_ADBFIND_QUOTAEXEMPT; 3244 } 3245 3246 /* 3247 * See what we know about this address. 3248 */ 3249 INSIST(!SHUTTINGDOWN(fctx)); 3250 fetchctx_ref(fctx); 3251 result = dns_adb_createfind(fctx->adb, fctx->loop, fctx_finddone, fctx, 3252 name, fctx->name, fctx->type, options, now, 3253 NULL, res->view->dstport, fctx->depth + 1, 3254 fctx->qc, fctx->gqc, fctx, &find); 3255 3256 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 3257 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 3258 "fctx %p(%s): createfind for %s - %s", fctx, fctx->info, 3259 fctx->clientstr, isc_result_totext(result)); 3260 3261 if (result != ISC_R_SUCCESS) { 3262 if (result == DNS_R_ALIAS) { 3263 char namebuf[DNS_NAME_FORMATSIZE]; 3264 3265 /* 3266 * XXXRTH Follow the CNAME/DNAME chain? 3267 */ 3268 dns_adb_destroyfind(&find); 3269 fctx->adberr++; 3270 dns_name_format(name, namebuf, sizeof(namebuf)); 3271 isc_log_write(dns_lctx, DNS_LOGCATEGORY_CNAME, 3272 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 3273 "skipping nameserver '%s' because it " 3274 "is a CNAME, while resolving '%s'", 3275 namebuf, fctx->info); 3276 } 3277 fetchctx_detach(&fctx); 3278 return; 3279 } 3280 3281 if (!ISC_LIST_EMPTY(find->list)) { 3282 /* 3283 * We have at least some of the addresses for the 3284 * name. 3285 */ 3286 INSIST((find->options & DNS_ADBFIND_WANTEVENT) == 0); 3287 if (flags != 0 || port != 0) { 3288 for (ai = ISC_LIST_HEAD(find->list); ai != NULL; 3289 ai = ISC_LIST_NEXT(ai, publink)) 3290 { 3291 ai->flags |= flags; 3292 if (port != 0) { 3293 isc_sockaddr_setport(&ai->sockaddr, 3294 port); 3295 } 3296 } 3297 } 3298 3299 if ((flags & FCTX_ADDRINFO_DUALSTACK) != 0) { 3300 ISC_LIST_APPEND(fctx->altfinds, find, publink); 3301 } else { 3302 ISC_LIST_APPEND(fctx->finds, find, publink); 3303 } 3304 SET_IF_NOT_NULL(have_address, true); 3305 return; 3306 } 3307 3308 /* 3309 * We don't know any of the addresses for this name. 3310 * 3311 * The find may be waiting on a resolver fetch for a server 3312 * address. We need to make sure it isn't waiting before *this* 3313 * fetch, because if it is, we won't be answering it and it 3314 * won't be answering us. 3315 */ 3316 if (already_waiting_for(find, fctx->type) && 3317 dns_name_equal(name, fctx->name)) 3318 { 3319 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 3320 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 3321 "loop detected resolving '%s'", fctx->info); 3322 3323 fctx->adberr++; 3324 if ((find->options & DNS_ADBFIND_WANTEVENT) != 0) { 3325 dns_adb_cancelfind(find); 3326 } else { 3327 dns_adb_destroyfind(&find); 3328 fetchctx_detach(&fctx); 3329 } 3330 3331 return; 3332 } 3333 3334 /* 3335 * We may be waiting for another fetch to complete, and 3336 * we'll get an event later when the find has what it needs. 3337 */ 3338 if ((find->options & DNS_ADBFIND_WANTEVENT) != 0) { 3339 fctx->pending_running++; 3340 ISC_LIST_APPEND(fctx->pending_finds, find, publink); 3341 3342 /* 3343 * Bootstrap. 3344 */ 3345 if (need_alternate != NULL && !*need_alternate && unshared && 3346 ((res->dispatches4 == NULL && 3347 find->result_v6 != DNS_R_NXDOMAIN) || 3348 (res->dispatches6 == NULL && 3349 find->result_v4 != DNS_R_NXDOMAIN))) 3350 { 3351 *need_alternate = true; 3352 } 3353 return; 3354 } 3355 3356 /* 3357 * No addresses and no pending events: the find failed. 3358 */ 3359 if ((find->options & DNS_ADBFIND_OVERQUOTA) != 0) { 3360 if (overquota != NULL) { 3361 *overquota = true; 3362 } 3363 fctx->quotacount++; /* quota exceeded */ 3364 } else { 3365 fctx->adberr++; /* unreachable server, etc. */ 3366 } 3367 3368 /* 3369 * If we know there are no addresses for the family we are using then 3370 * try to add an alternative server. 3371 */ 3372 if (need_alternate != NULL && !*need_alternate && 3373 ((res->dispatches4 == NULL && find->result_v6 == DNS_R_NXRRSET) || 3374 (res->dispatches6 == NULL && find->result_v4 == DNS_R_NXRRSET))) 3375 { 3376 *need_alternate = true; 3377 } 3378 dns_adb_destroyfind(&find); 3379 fetchctx_detach(&fctx); 3380 } 3381 3382 static bool 3383 isstrictsubdomain(const dns_name_t *name1, const dns_name_t *name2) { 3384 int order; 3385 unsigned int nlabels; 3386 dns_namereln_t namereln; 3387 3388 namereln = dns_name_fullcompare(name1, name2, &order, &nlabels); 3389 return namereln == dns_namereln_subdomain; 3390 } 3391 3392 static isc_result_t 3393 fctx_getaddresses(fetchctx_t *fctx) { 3394 isc_result_t result; 3395 dns_resolver_t *res; 3396 isc_stdtime_t now; 3397 unsigned int stdoptions = 0; 3398 dns_forwarder_t *fwd; 3399 dns_adbaddrinfo_t *ai; 3400 bool all_bad; 3401 dns_rdata_ns_t ns; 3402 bool need_alternate = false; 3403 bool all_spilled = false; 3404 bool have_address = false; 3405 unsigned int ns_processed = 0; 3406 size_t fetches_allowed = 0; 3407 dns_rdata_t nameservers_s[NS_PROCESSING_LIMIT]; 3408 dns_rdata_t *nameservers[NS_PROCESSING_LIMIT]; 3409 3410 FCTXTRACE5("getaddresses", "fctx->depth=", fctx->depth); 3411 3412 /* 3413 * Don't pound on remote servers. (Failsafe!) 3414 */ 3415 fctx->restarts++; 3416 if (fctx->restarts > 100) { 3417 FCTXTRACE("too many restarts"); 3418 return DNS_R_SERVFAIL; 3419 } 3420 3421 res = fctx->res; 3422 3423 if (fctx->depth > res->maxdepth) { 3424 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 3425 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 3426 "too much NS indirection resolving '%s' " 3427 "(depth=%u, maxdepth=%u)", 3428 fctx->info, fctx->depth, res->maxdepth); 3429 return DNS_R_SERVFAIL; 3430 } 3431 3432 /* 3433 * Forwarders. 3434 */ 3435 3436 INSIST(ISC_LIST_EMPTY(fctx->forwaddrs)); 3437 INSIST(ISC_LIST_EMPTY(fctx->altaddrs)); 3438 3439 /* 3440 * If we have DNS_FETCHOPT_NOFORWARD set and forwarding policy 3441 * allows us to not forward - skip forwarders and go straight 3442 * to NSes. This is currently used to make sure that priming 3443 * query gets root servers' IP addresses in ADDITIONAL section. 3444 */ 3445 if ((fctx->options & DNS_FETCHOPT_NOFORWARD) != 0 && 3446 (fctx->fwdpolicy != dns_fwdpolicy_only)) 3447 { 3448 goto normal_nses; 3449 } 3450 3451 /* 3452 * If this fctx has forwarders, use them; otherwise use any 3453 * selective forwarders specified in the view; otherwise use the 3454 * resolver's forwarders (if any). 3455 */ 3456 fwd = ISC_LIST_HEAD(fctx->forwarders); 3457 if (fwd == NULL) { 3458 dns_forwarders_t *forwarders = NULL; 3459 dns_name_t *name = fctx->name; 3460 dns_name_t suffix; 3461 3462 /* 3463 * DS records are found in the parent server. 3464 * Strip label to get the correct forwarder (if any). 3465 */ 3466 if (dns_rdatatype_atparent(fctx->type) && 3467 dns_name_countlabels(name) > 1) 3468 { 3469 unsigned int labels; 3470 dns_name_init(&suffix, NULL); 3471 labels = dns_name_countlabels(name); 3472 dns_name_getlabelsequence(name, 1, labels - 1, &suffix); 3473 name = &suffix; 3474 } 3475 3476 result = dns_fwdtable_find(res->view->fwdtable, name, 3477 &forwarders); 3478 if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { 3479 fwd = ISC_LIST_HEAD(forwarders->fwdrs); 3480 fctx->fwdpolicy = forwarders->fwdpolicy; 3481 dns_name_copy(&forwarders->name, fctx->fwdname); 3482 if (fctx->fwdpolicy == dns_fwdpolicy_only && 3483 isstrictsubdomain(&forwarders->name, fctx->domain)) 3484 { 3485 fcount_decr(fctx); 3486 dns_name_copy(&forwarders->name, fctx->domain); 3487 result = fcount_incr(fctx, true); 3488 if (result != ISC_R_SUCCESS) { 3489 dns_forwarders_detach(&forwarders); 3490 return result; 3491 } 3492 } 3493 dns_forwarders_detach(&forwarders); 3494 } 3495 } 3496 3497 while (fwd != NULL) { 3498 if ((isc_sockaddr_pf(&fwd->addr) == AF_INET && 3499 res->dispatches4 == NULL) || 3500 (isc_sockaddr_pf(&fwd->addr) == AF_INET6 && 3501 res->dispatches6 == NULL)) 3502 { 3503 fwd = ISC_LIST_NEXT(fwd, link); 3504 continue; 3505 } 3506 ai = NULL; 3507 result = dns_adb_findaddrinfo(fctx->adb, &fwd->addr, &ai, 0); 3508 if (result == ISC_R_SUCCESS) { 3509 dns_adbaddrinfo_t *cur; 3510 ai->flags |= FCTX_ADDRINFO_FORWARDER; 3511 if (fwd->tlsname != NULL) { 3512 result = dns_view_gettransport( 3513 res->view, DNS_TRANSPORT_TLS, 3514 fwd->tlsname, &ai->transport); 3515 if (result != ISC_R_SUCCESS) { 3516 dns_adb_freeaddrinfo(fctx->adb, &ai); 3517 goto next; 3518 } 3519 } 3520 cur = ISC_LIST_HEAD(fctx->forwaddrs); 3521 while (cur != NULL && cur->srtt < ai->srtt) { 3522 cur = ISC_LIST_NEXT(cur, publink); 3523 } 3524 if (cur != NULL) { 3525 ISC_LIST_INSERTBEFORE(fctx->forwaddrs, cur, ai, 3526 publink); 3527 } else { 3528 ISC_LIST_APPEND(fctx->forwaddrs, ai, publink); 3529 } 3530 } 3531 next: 3532 fwd = ISC_LIST_NEXT(fwd, link); 3533 } 3534 3535 /* 3536 * If the forwarding policy is "only", we don't need the 3537 * addresses of the nameservers. 3538 */ 3539 if (fctx->fwdpolicy == dns_fwdpolicy_only) { 3540 goto out; 3541 } 3542 3543 /* 3544 * Normal nameservers. 3545 */ 3546 normal_nses: 3547 stdoptions = DNS_ADBFIND_WANTEVENT | DNS_ADBFIND_EMPTYEVENT; 3548 if (fctx->restarts == 1) { 3549 /* 3550 * To avoid sending out a flood of queries likely to 3551 * result in NXRRSET, we suppress fetches for address 3552 * families we don't have the first time through, 3553 * provided that we have addresses in some family we 3554 * can use. 3555 * 3556 * We don't want to set this option all the time, since 3557 * if fctx->restarts > 1, we've clearly been having 3558 * trouble with the addresses we had, so getting more 3559 * could help. 3560 */ 3561 stdoptions |= DNS_ADBFIND_AVOIDFETCHES; 3562 } 3563 if (res->dispatches4 != NULL) { 3564 stdoptions |= DNS_ADBFIND_INET; 3565 } 3566 if (res->dispatches6 != NULL) { 3567 stdoptions |= DNS_ADBFIND_INET6; 3568 } 3569 3570 if ((stdoptions & DNS_ADBFIND_ADDRESSMASK) == 0) { 3571 return DNS_R_SERVFAIL; 3572 } 3573 3574 now = isc_stdtime_now(); 3575 all_spilled = true; /* resets to false below after the first success */ 3576 3577 INSIST(ISC_LIST_EMPTY(fctx->finds)); 3578 INSIST(ISC_LIST_EMPTY(fctx->altfinds)); 3579 3580 switch (fctx->depth) { 3581 case 0: 3582 fetches_allowed = 3; 3583 break; 3584 case 1: 3585 fetches_allowed = 2; 3586 break; 3587 default: 3588 fetches_allowed = 1; 3589 break; 3590 } 3591 3592 for (result = dns_rdataset_first(&fctx->nameservers); 3593 result == ISC_R_SUCCESS; 3594 result = dns_rdataset_next(&fctx->nameservers)) 3595 { 3596 dns_rdata_t *rdata = nameservers[ns_processed] = 3597 &nameservers_s[ns_processed]; 3598 3599 dns_rdata_init(rdata); 3600 3601 dns_rdataset_current(&fctx->nameservers, rdata); 3602 3603 if (++ns_processed >= NS_PROCESSING_LIMIT) { 3604 break; 3605 } 3606 } 3607 3608 if (ns_processed > 1 && ns_processed > fetches_allowed) { 3609 /* 3610 * Skip the shuffle if: 3611 * - there's nothing to shuffle (no or one nameserver) 3612 * - there are less nameserver than allowed fetches as 3613 * we are going to start fetches for all of them. 3614 */ 3615 for (size_t i = 0; i < ns_processed - 1; i++) { 3616 size_t j = i + isc_random_uniform(ns_processed - i); 3617 3618 ISC_SWAP(nameservers[i], nameservers[j]); 3619 } 3620 } 3621 3622 for (;;) { 3623 for (size_t i = 0; i < ns_processed; i++) { 3624 bool overquota = false; 3625 unsigned int static_stub = 0; 3626 unsigned int no_fetch = 0; 3627 dns_rdata_t *rdata = nameservers[i]; 3628 3629 /* 3630 * Extract the name from the NS record. 3631 */ 3632 result = dns_rdata_tostruct(rdata, &ns, NULL); 3633 if (result != ISC_R_SUCCESS) { 3634 continue; 3635 } 3636 3637 if (STATICSTUB(&fctx->nameservers) && 3638 dns_name_equal(&ns.name, fctx->domain)) 3639 { 3640 static_stub = DNS_ADBFIND_STATICSTUB; 3641 } 3642 3643 /* 3644 * Make sure we only launch a limited number of 3645 * outgoing fetches. 3646 */ 3647 if (fctx->pending_running >= fetches_allowed) { 3648 no_fetch = DNS_ADBFIND_NOFETCH; 3649 } 3650 3651 findname(fctx, &ns.name, 0, 3652 stdoptions | static_stub | no_fetch, 0, now, 3653 &overquota, &need_alternate, &have_address); 3654 3655 if (!overquota) { 3656 all_spilled = false; 3657 } 3658 3659 dns_rdata_freestruct(&ns); 3660 } 3661 3662 /* 3663 * Don't start alternate fetch if we just started one above. 3664 */ 3665 if (fctx->pending_running > 0) { 3666 stdoptions |= DNS_ADBFIND_NOFETCH; 3667 result = ISC_R_NOMORE; 3668 } else if (have_address || fetches_allowed != 0) { 3669 result = ISC_R_NOMORE; 3670 } 3671 3672 if (result != ISC_R_SUCCESS) { 3673 break; 3674 } 3675 3676 /* 3677 * We have no addresses and we haven't allowed any 3678 * fetches to be started. Allow one extra fetch and try 3679 * again. 3680 */ 3681 fetches_allowed = 1; 3682 } 3683 if (result != ISC_R_NOMORE) { 3684 return result; 3685 } 3686 3687 /* 3688 * Do we need to use 6 to 4? 3689 */ 3690 if (need_alternate) { 3691 int family; 3692 alternate_t *a; 3693 family = (res->dispatches6 != NULL) ? AF_INET6 : AF_INET; 3694 for (a = ISC_LIST_HEAD(res->alternates); a != NULL; 3695 a = ISC_LIST_NEXT(a, link)) 3696 { 3697 if (!a->isaddress) { 3698 findname(fctx, &a->_u._n.name, a->_u._n.port, 3699 stdoptions, FCTX_ADDRINFO_DUALSTACK, 3700 now, NULL, NULL, NULL); 3701 continue; 3702 } 3703 if (isc_sockaddr_pf(&a->_u.addr) != family) { 3704 continue; 3705 } 3706 ai = NULL; 3707 result = dns_adb_findaddrinfo(fctx->adb, &a->_u.addr, 3708 &ai, 0); 3709 if (result == ISC_R_SUCCESS) { 3710 dns_adbaddrinfo_t *cur; 3711 ai->flags |= FCTX_ADDRINFO_FORWARDER; 3712 ai->flags |= FCTX_ADDRINFO_DUALSTACK; 3713 cur = ISC_LIST_HEAD(fctx->altaddrs); 3714 while (cur != NULL && cur->srtt < ai->srtt) { 3715 cur = ISC_LIST_NEXT(cur, publink); 3716 } 3717 if (cur != NULL) { 3718 ISC_LIST_INSERTBEFORE(fctx->altaddrs, 3719 cur, ai, publink); 3720 } else { 3721 ISC_LIST_APPEND(fctx->altaddrs, ai, 3722 publink); 3723 } 3724 } 3725 } 3726 } 3727 3728 out: 3729 /* 3730 * Mark all known bad servers. 3731 */ 3732 all_bad = mark_bad(fctx); 3733 3734 /* 3735 * How are we doing? 3736 */ 3737 if (all_bad) { 3738 /* 3739 * We've got no addresses. 3740 */ 3741 if (fctx->pending_running > 0) { 3742 /* 3743 * We're fetching the addresses, but don't have 3744 * any yet. Tell the caller to wait for an 3745 * answer. 3746 */ 3747 result = DNS_R_WAIT; 3748 } else { 3749 /* 3750 * We've lost completely. We don't know any 3751 * addresses, and the ADB has told us it can't 3752 * get them. 3753 */ 3754 FCTXTRACE("no addresses"); 3755 3756 result = ISC_R_FAILURE; 3757 3758 /* 3759 * If all of the addresses found were over the 3760 * fetches-per-server quota, return the 3761 * configured response. 3762 */ 3763 if (all_spilled) { 3764 result = res->quotaresp[dns_quotatype_server]; 3765 inc_stats(res, dns_resstatscounter_serverquota); 3766 } 3767 } 3768 } else { 3769 /* 3770 * We've found some addresses. We might still be 3771 * looking for more addresses. 3772 */ 3773 result = ISC_R_SUCCESS; 3774 } 3775 3776 return result; 3777 } 3778 3779 static void 3780 possibly_mark(fetchctx_t *fctx, dns_adbaddrinfo_t *addr) { 3781 isc_netaddr_t na; 3782 isc_sockaddr_t *sa = &addr->sockaddr; 3783 bool aborted = false; 3784 bool bogus; 3785 dns_acl_t *blackhole; 3786 isc_netaddr_t ipaddr; 3787 dns_peer_t *peer = NULL; 3788 dns_resolver_t *res = fctx->res; 3789 const char *msg = NULL; 3790 3791 isc_netaddr_fromsockaddr(&ipaddr, sa); 3792 blackhole = dns_dispatchmgr_getblackhole(fctx->dispatchmgr); 3793 (void)dns_peerlist_peerbyaddr(res->view->peers, &ipaddr, &peer); 3794 3795 if (blackhole != NULL) { 3796 int match; 3797 3798 if ((dns_acl_match(&ipaddr, NULL, blackhole, res->view->aclenv, 3799 &match, NULL) == ISC_R_SUCCESS) && 3800 match > 0) 3801 { 3802 aborted = true; 3803 } 3804 } 3805 3806 if (peer != NULL && dns_peer_getbogus(peer, &bogus) == ISC_R_SUCCESS && 3807 bogus) 3808 { 3809 aborted = true; 3810 } 3811 3812 if (aborted) { 3813 addr->flags |= FCTX_ADDRINFO_MARK; 3814 msg = "ignoring blackholed / bogus server: "; 3815 } else if (isc_sockaddr_isnetzero(sa)) { 3816 addr->flags |= FCTX_ADDRINFO_MARK; 3817 msg = "ignoring net zero address: "; 3818 } else if (isc_sockaddr_ismulticast(sa)) { 3819 addr->flags |= FCTX_ADDRINFO_MARK; 3820 msg = "ignoring multicast address: "; 3821 } else if (isc_sockaddr_isexperimental(sa)) { 3822 addr->flags |= FCTX_ADDRINFO_MARK; 3823 msg = "ignoring experimental address: "; 3824 } else if (sa->type.sa.sa_family != AF_INET6) { 3825 return; 3826 } else if (IN6_IS_ADDR_V4MAPPED(&sa->type.sin6.sin6_addr)) { 3827 addr->flags |= FCTX_ADDRINFO_MARK; 3828 msg = "ignoring IPv6 mapped IPV4 address: "; 3829 } else if (IN6_IS_ADDR_V4COMPAT(&sa->type.sin6.sin6_addr)) { 3830 addr->flags |= FCTX_ADDRINFO_MARK; 3831 msg = "ignoring IPv6 compatibility IPV4 address: "; 3832 } else { 3833 return; 3834 } 3835 3836 if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) { 3837 char buf[ISC_NETADDR_FORMATSIZE]; 3838 isc_netaddr_fromsockaddr(&na, sa); 3839 isc_netaddr_format(&na, buf, sizeof(buf)); 3840 FCTXTRACE2(msg, buf); 3841 } 3842 } 3843 3844 static dns_adbaddrinfo_t * 3845 nextaddress(fetchctx_t *fctx) { 3846 dns_adbaddrinfo_t *prevai = fctx->foundaddrinfo, *lowestsrttai = NULL; 3847 unsigned int v6bias = fctx->res->view->v6bias, lowestsrtt = 0; 3848 3849 /* 3850 * Let's walk through the list of dns_adbaddrinfo_t to find the best 3851 * next server address to query. This is linear on the number of 3852 * dns_adbaddrinfo_t which are grouped in find list (for each ADB find). 3853 */ 3854 for (dns_adbfind_t *find = ISC_LIST_HEAD(fctx->finds); find != NULL; 3855 find = ISC_LIST_NEXT(find, publink)) 3856 { 3857 for (dns_adbaddrinfo_t *ai = ISC_LIST_HEAD(find->list); 3858 ai != NULL; ai = ISC_LIST_NEXT(ai, publink)) 3859 { 3860 /* 3861 * This address has been marked already, skip it. 3862 */ 3863 if (!UNMARKED(ai)) { 3864 continue; 3865 } 3866 3867 /* 3868 * This address is the same as the previously used 3869 * address, it's a duplicate, mark it and skip it! 3870 */ 3871 if (prevai != NULL) { 3872 if (prevai->entry == ai->entry) { 3873 ai->flags |= FCTX_ADDRINFO_MARK; 3874 continue; 3875 } 3876 } 3877 3878 /* 3879 * Mark and skip this address if incompatible (i.e. IPv6 3880 * address on a v4 only server, or for ACL reason, etc.) 3881 */ 3882 possibly_mark(fctx, ai); 3883 if (!UNMARKED(ai)) { 3884 continue; 3885 } 3886 3887 /* 3888 * This address hasn't been tried yet and is a 3889 * good candidate. Let's keep track of it if it 3890 * has the lowest SRTT so far (or if there is no 3891 * address with lowest SRTT found yet). 3892 */ 3893 unsigned int aisrtt = ai->srtt; 3894 3895 if (isc_sockaddr_pf(&ai->sockaddr) != AF_INET6) { 3896 aisrtt += v6bias; 3897 } 3898 3899 if (lowestsrttai == NULL || aisrtt < lowestsrtt) { 3900 lowestsrttai = ai; 3901 lowestsrtt = aisrtt; 3902 continue; 3903 } 3904 } 3905 } 3906 3907 /* 3908 * This is the next address to query. If this is NULL, we're done. 3909 */ 3910 if (lowestsrttai != NULL) { 3911 lowestsrttai->flags |= FCTX_ADDRINFO_MARK; 3912 } 3913 fctx->foundaddrinfo = lowestsrttai; 3914 3915 return lowestsrttai; 3916 } 3917 3918 static dns_adbaddrinfo_t * 3919 fctx_nextaddress(fetchctx_t *fctx) { 3920 dns_adbfind_t *find, *start; 3921 dns_adbaddrinfo_t *addrinfo; 3922 dns_adbaddrinfo_t *faddrinfo; 3923 3924 /* 3925 * Return the next untried address, if any. 3926 */ 3927 3928 /* 3929 * Find the first unmarked forwarder (if any). 3930 */ 3931 for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs); addrinfo != NULL; 3932 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3933 { 3934 if (!UNMARKED(addrinfo)) { 3935 continue; 3936 } 3937 possibly_mark(fctx, addrinfo); 3938 if (UNMARKED(addrinfo)) { 3939 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3940 fctx->forwarding = true; 3941 3942 /* 3943 * QNAME minimization is disabled when 3944 * forwarding, and has to remain disabled if 3945 * we switch back to normal recursion; otherwise 3946 * forwarding could leave us in an inconsistent 3947 * state. 3948 */ 3949 fctx->minimized = false; 3950 return addrinfo; 3951 } 3952 } 3953 3954 /* 3955 * No forwarders. Move to the next find. 3956 */ 3957 fctx->forwarding = false; 3958 FCTX_ATTR_SET(fctx, FCTX_ATTR_TRIEDFIND); 3959 3960 faddrinfo = nextaddress(fctx); 3961 if (faddrinfo != NULL) { 3962 return faddrinfo; 3963 } 3964 3965 /* 3966 * No nameservers left. Try alternates. 3967 */ 3968 3969 FCTX_ATTR_SET(fctx, FCTX_ATTR_TRIEDALT); 3970 3971 find = fctx->altfind; 3972 if (find == NULL) { 3973 find = ISC_LIST_HEAD(fctx->altfinds); 3974 } else { 3975 find = ISC_LIST_NEXT(find, publink); 3976 if (find == NULL) { 3977 find = ISC_LIST_HEAD(fctx->altfinds); 3978 } 3979 } 3980 3981 /* 3982 * Find the first unmarked addrinfo. 3983 */ 3984 addrinfo = NULL; 3985 if (find != NULL) { 3986 start = find; 3987 do { 3988 for (addrinfo = ISC_LIST_HEAD(find->list); 3989 addrinfo != NULL; 3990 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3991 { 3992 if (!UNMARKED(addrinfo)) { 3993 continue; 3994 } 3995 possibly_mark(fctx, addrinfo); 3996 if (UNMARKED(addrinfo)) { 3997 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3998 break; 3999 } 4000 } 4001 if (addrinfo != NULL) { 4002 break; 4003 } 4004 find = ISC_LIST_NEXT(find, publink); 4005 if (find == NULL) { 4006 find = ISC_LIST_HEAD(fctx->altfinds); 4007 } 4008 } while (find != start); 4009 } 4010 4011 faddrinfo = addrinfo; 4012 4013 /* 4014 * See if we have a better alternate server by address. 4015 */ 4016 4017 for (addrinfo = ISC_LIST_HEAD(fctx->altaddrs); addrinfo != NULL; 4018 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 4019 { 4020 if (!UNMARKED(addrinfo)) { 4021 continue; 4022 } 4023 possibly_mark(fctx, addrinfo); 4024 if (UNMARKED(addrinfo) && 4025 (faddrinfo == NULL || addrinfo->srtt < faddrinfo->srtt)) 4026 { 4027 if (faddrinfo != NULL) { 4028 faddrinfo->flags &= ~FCTX_ADDRINFO_MARK; 4029 } 4030 addrinfo->flags |= FCTX_ADDRINFO_MARK; 4031 break; 4032 } 4033 } 4034 4035 if (addrinfo == NULL) { 4036 addrinfo = faddrinfo; 4037 fctx->altfind = find; 4038 } 4039 4040 return addrinfo; 4041 } 4042 4043 static isc_result_t 4044 incr_query_counters(fetchctx_t *fctx) { 4045 isc_result_t result; 4046 4047 result = isc_counter_increment(fctx->qc); 4048 #if WANT_QUERYTRACE 4049 FCTXTRACE5("query", "max-recursion-queries, querycount=", 4050 isc_counter_used(fctx->qc)); 4051 #endif 4052 if (result != ISC_R_SUCCESS) { 4053 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4054 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 4055 "exceeded max queries resolving '%s' " 4056 "(max-recursion-queries, querycount=%u)", 4057 fctx->info, isc_counter_used(fctx->qc)); 4058 } else if (fctx->gqc != NULL) { 4059 result = isc_counter_increment(fctx->gqc); 4060 #if WANT_QUERYTRACE 4061 FCTXTRACE5("query", "max-query-count, querycount=", 4062 isc_counter_used(fctx->gqc)); 4063 #endif 4064 if (result != ISC_R_SUCCESS) { 4065 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4066 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 4067 "exceeded global max queries resolving " 4068 "'%s' (max-query-count, querycount=%u)", 4069 fctx->info, isc_counter_used(fctx->gqc)); 4070 } 4071 } 4072 4073 return result; 4074 } 4075 4076 static void 4077 fctx_try(fetchctx_t *fctx, bool retrying) { 4078 isc_result_t result; 4079 dns_adbaddrinfo_t *addrinfo = NULL; 4080 dns_resolver_t *res = NULL; 4081 4082 REQUIRE(!ADDRWAIT(fctx)); 4083 REQUIRE(fctx->tid == isc_tid()); 4084 4085 res = fctx->res; 4086 4087 /* We've already exceeded maximum query count */ 4088 if (isc_counter_used(fctx->qc) > isc_counter_getlimit(fctx->qc)) { 4089 isc_log_write( 4090 dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4091 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 4092 "exceeded max queries resolving '%s' " 4093 "(max-recursion-queries, querycount=%u, maxqueries=%u)", 4094 fctx->info, isc_counter_used(fctx->qc), 4095 isc_counter_getlimit(fctx->qc)); 4096 result = DNS_R_SERVFAIL; 4097 goto done; 4098 } 4099 4100 if (fctx->gqc != NULL && 4101 isc_counter_used(fctx->gqc) > isc_counter_getlimit(fctx->gqc)) 4102 { 4103 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4104 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 4105 "exceeded global max queries resolving '%s' " 4106 "(max-query-count, querycount=%u, maxqueries=%u)", 4107 fctx->info, isc_counter_used(fctx->gqc), 4108 isc_counter_getlimit(fctx->gqc)); 4109 result = DNS_R_SERVFAIL; 4110 goto done; 4111 } 4112 4113 addrinfo = fctx_nextaddress(fctx); 4114 4115 /* Try to find an address that isn't over quota */ 4116 while (addrinfo != NULL && dns_adb_overquota(fctx->adb, addrinfo)) { 4117 addrinfo = fctx_nextaddress(fctx); 4118 } 4119 4120 if (addrinfo == NULL) { 4121 /* We have no more addresses. Start over. */ 4122 fctx_cancelqueries(fctx, true, false); 4123 fctx_cleanup(fctx); 4124 result = fctx_getaddresses(fctx); 4125 switch (result) { 4126 case ISC_R_SUCCESS: 4127 break; 4128 case DNS_R_WAIT: 4129 /* Sleep waiting for addresses. */ 4130 FCTXTRACE("addrwait"); 4131 FCTX_ATTR_SET(fctx, FCTX_ATTR_ADDRWAIT); 4132 return; 4133 default: 4134 goto done; 4135 } 4136 4137 addrinfo = fctx_nextaddress(fctx); 4138 4139 while (addrinfo != NULL && 4140 dns_adb_overquota(fctx->adb, addrinfo)) 4141 { 4142 addrinfo = fctx_nextaddress(fctx); 4143 } 4144 4145 /* 4146 * While we may have addresses from the ADB, they 4147 * might be bad ones. In this case, return SERVFAIL. 4148 */ 4149 if (addrinfo == NULL) { 4150 result = DNS_R_SERVFAIL; 4151 goto done; 4152 } 4153 } 4154 /* 4155 * We're minimizing and we're not yet at the final NS - 4156 * we need to launch a query for NS for 'upper' domain 4157 */ 4158 if (fctx->minimized && !fctx->forwarding) { 4159 unsigned int options = fctx->options; 4160 4161 options &= ~DNS_FETCHOPT_QMINIMIZE; 4162 4163 /* 4164 * Is another QNAME minimization fetch still running? 4165 */ 4166 if (fctx->qminfetch != NULL) { 4167 bool validfctx = (DNS_FETCH_VALID(fctx->qminfetch) && 4168 VALID_FCTX(fctx->qminfetch->private)); 4169 char namebuf[DNS_NAME_FORMATSIZE]; 4170 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 4171 4172 dns_name_format(fctx->qminname, namebuf, 4173 sizeof(namebuf)); 4174 dns_rdatatype_format(fctx->qmintype, typebuf, 4175 sizeof(typebuf)); 4176 4177 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4178 DNS_LOGMODULE_RESOLVER, ISC_LOG_ERROR, 4179 "fctx %p(%s): attempting QNAME " 4180 "minimization fetch for %s/%s but " 4181 "fetch %p(%s) still running", 4182 fctx, fctx->info, namebuf, typebuf, 4183 fctx->qminfetch, 4184 validfctx ? fctx->qminfetch->private->info 4185 : "<invalid>"); 4186 result = DNS_R_SERVFAIL; 4187 goto done; 4188 } 4189 4190 /* 4191 * Turn on NOFOLLOW in relaxed mode so that QNAME minimization 4192 * doesn't cause additional queries to resolve the target of the 4193 * QNAME minimization request when a referral is returned. This 4194 * will also reduce the impact of mis-matched NS RRsets where 4195 * the child's NS RRset is garbage. If a delegation is 4196 * discovered DNS_R_DELEGATION will be returned to resume_qmin. 4197 */ 4198 if ((options & DNS_FETCHOPT_QMIN_STRICT) == 0) { 4199 options |= DNS_FETCHOPT_NOFOLLOW; 4200 } 4201 4202 fetchctx_ref(fctx); 4203 result = dns_resolver_createfetch( 4204 fctx->res, fctx->qminname, fctx->qmintype, fctx->domain, 4205 &fctx->nameservers, NULL, NULL, 0, options, 0, fctx->qc, 4206 fctx->gqc, fctx, fctx->loop, resume_qmin, fctx, 4207 &fctx->edectx, &fctx->qminrrset, NULL, 4208 &fctx->qminfetch); 4209 if (result != ISC_R_SUCCESS) { 4210 fetchctx_unref(fctx); 4211 goto done; 4212 } 4213 return; 4214 } 4215 4216 result = incr_query_counters(fctx); 4217 if (result != ISC_R_SUCCESS) { 4218 goto done; 4219 } 4220 4221 result = fctx_query(fctx, addrinfo, fctx->options); 4222 if (result != ISC_R_SUCCESS) { 4223 goto done; 4224 } 4225 if (retrying) { 4226 inc_stats(res, dns_resstatscounter_retry); 4227 } 4228 4229 done: 4230 if (result != ISC_R_SUCCESS) { 4231 fctx_done_detach(&fctx, result); 4232 } 4233 } 4234 4235 static void 4236 resume_qmin(void *arg) { 4237 dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg; 4238 fetchctx_t *fctx = resp->arg; 4239 dns_resolver_t *res = NULL; 4240 isc_result_t result; 4241 unsigned int findoptions = 0; 4242 dns_name_t *fname = NULL, *dcname = NULL; 4243 dns_fixedname_t ffixed, dcfixed; 4244 4245 REQUIRE(VALID_FCTX(fctx)); 4246 4247 res = fctx->res; 4248 4249 REQUIRE(fctx->tid == isc_tid()); 4250 4251 FCTXTRACE("resume_qmin"); 4252 4253 fname = dns_fixedname_initname(&ffixed); 4254 dcname = dns_fixedname_initname(&dcfixed); 4255 4256 if (resp->node != NULL) { 4257 dns_db_detachnode(resp->db, &resp->node); 4258 } 4259 if (resp->db != NULL) { 4260 dns_db_detach(&resp->db); 4261 } 4262 4263 if (dns_rdataset_isassociated(resp->rdataset)) { 4264 dns_rdataset_disassociate(resp->rdataset); 4265 } 4266 4267 result = resp->result; 4268 4269 dns_resolver_freefresp(&resp); 4270 4271 LOCK(&fctx->lock); 4272 if (SHUTTINGDOWN(fctx)) { 4273 result = ISC_R_SHUTTINGDOWN; 4274 } 4275 UNLOCK(&fctx->lock); 4276 4277 dns_resolver_destroyfetch(&fctx->qminfetch); 4278 4279 /* 4280 * Beware, the switch() below is little bit tricky - the order of the 4281 * branches is important. 4282 */ 4283 switch (result) { 4284 case ISC_R_SHUTTINGDOWN: 4285 case ISC_R_CANCELED: 4286 goto cleanup; 4287 4288 case DNS_R_NXDOMAIN: 4289 case DNS_R_NCACHENXDOMAIN: 4290 case DNS_R_FORMERR: 4291 case DNS_R_REMOTEFORMERR: 4292 case ISC_R_FAILURE: 4293 if ((fctx->options & DNS_FETCHOPT_QMIN_STRICT) != 0) { 4294 /* These results cause a hard fail in strict mode */ 4295 goto cleanup; 4296 } 4297 4298 /* ...or disable minimization in relaxed mode */ 4299 fctx->qmin_labels = DNS_NAME_MAXLABELS; 4300 4301 /* 4302 * We store the result. If we succeed in the end 4303 * we'll issue a warning that the server is 4304 * broken. 4305 */ 4306 fctx->qmin_warning = result; 4307 break; 4308 4309 case ISC_R_SUCCESS: 4310 case DNS_R_DELEGATION: 4311 case DNS_R_NXRRSET: 4312 case DNS_R_NCACHENXRRSET: 4313 case DNS_R_CNAME: 4314 case DNS_R_DNAME: 4315 /* 4316 * We have previously detected a possible error of an 4317 * incorrect NXDOMAIN and now have a response that 4318 * indicates that it was an actual error. 4319 */ 4320 if (fctx->qmin_warning == DNS_R_NCACHENXDOMAIN || 4321 fctx->qmin_warning == DNS_R_NXDOMAIN) 4322 { 4323 fctx->force_qmin_warning = true; 4324 } 4325 /* 4326 * Any other result will *not* cause a failure in strict 4327 * mode, or cause minimization to be disabled in relaxed 4328 * mode. 4329 * 4330 * If DNS_R_DELEGATION is set here, it implies that 4331 * DNS_FETCHOPT_NOFOLLOW was set, and a delegation was 4332 * discovered but not followed; we will do so now. 4333 */ 4334 break; 4335 4336 default: 4337 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4338 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(5), 4339 "QNAME minimization: unexpected result %s", 4340 isc_result_totext(result)); 4341 break; 4342 } 4343 4344 if (dns_rdataset_isassociated(&fctx->nameservers)) { 4345 dns_rdataset_disassociate(&fctx->nameservers); 4346 } 4347 4348 if (dns_rdatatype_atparent(fctx->type)) { 4349 findoptions |= DNS_DBFIND_NOEXACT; 4350 } 4351 result = dns_view_findzonecut(res->view, fctx->name, fname, dcname, 4352 fctx->now, findoptions, true, true, 4353 &fctx->nameservers, NULL); 4354 FCTXTRACEN("resume_qmin findzonecut", fname, result); 4355 4356 /* 4357 * DNS_R_NXDOMAIN here means we have not loaded the root zone 4358 * mirror yet - but DNS_R_NXDOMAIN is not a valid return value 4359 * when doing recursion, we need to patch it. 4360 * 4361 * CNAME or DNAME means zone were added with that record 4362 * after the start of a recursion. It means we do not have 4363 * initialized correct hevent->foundname and have to fail. 4364 */ 4365 if (result == DNS_R_NXDOMAIN || result == DNS_R_CNAME || 4366 result == DNS_R_DNAME) 4367 { 4368 result = DNS_R_SERVFAIL; 4369 } 4370 4371 if (result != ISC_R_SUCCESS) { 4372 goto cleanup; 4373 } 4374 fcount_decr(fctx); 4375 dns_name_copy(fname, fctx->domain); 4376 4377 result = fcount_incr(fctx, true); 4378 if (result != ISC_R_SUCCESS) { 4379 goto cleanup; 4380 } 4381 4382 dns_name_copy(dcname, fctx->qmindcname); 4383 fctx->ns_ttl = fctx->nameservers.ttl; 4384 fctx->ns_ttl_ok = true; 4385 4386 fctx_minimize_qname(fctx); 4387 4388 if (!fctx->minimized) { 4389 /* 4390 * We have finished minimizing, but fctx->finds was 4391 * filled at the beginning of the run - now we need to 4392 * clear it before sending the final query to use proper 4393 * nameservers. 4394 */ 4395 fctx_cancelqueries(fctx, false, false); 4396 fctx_cleanup(fctx); 4397 } 4398 4399 fctx_try(fctx, true); 4400 4401 cleanup: 4402 if (result != ISC_R_SUCCESS) { 4403 /* An error occurred, tear down whole fctx */ 4404 fctx_done_unref(fctx, result); 4405 } 4406 fetchctx_detach(&fctx); 4407 } 4408 4409 static void 4410 fctx_destroy(fetchctx_t *fctx) { 4411 dns_resolver_t *res = NULL; 4412 isc_sockaddr_t *sa = NULL, *next_sa = NULL; 4413 struct tried *tried = NULL; 4414 4415 REQUIRE(VALID_FCTX(fctx)); 4416 REQUIRE(ISC_LIST_EMPTY(fctx->resps)); 4417 REQUIRE(ISC_LIST_EMPTY(fctx->queries)); 4418 REQUIRE(ISC_LIST_EMPTY(fctx->finds)); 4419 REQUIRE(ISC_LIST_EMPTY(fctx->altfinds)); 4420 REQUIRE(ISC_LIST_EMPTY(fctx->pending_finds)); 4421 REQUIRE(ISC_LIST_EMPTY(fctx->validators)); 4422 REQUIRE(fctx->state != fetchstate_active); 4423 REQUIRE(fctx->timer == NULL); 4424 4425 FCTXTRACE("destroy"); 4426 4427 fctx->magic = 0; 4428 4429 res = fctx->res; 4430 4431 dec_stats(res, dns_resstatscounter_nfetch); 4432 4433 /* Free bad */ 4434 for (sa = ISC_LIST_HEAD(fctx->bad); sa != NULL; sa = next_sa) { 4435 next_sa = ISC_LIST_NEXT(sa, link); 4436 ISC_LIST_UNLINK(fctx->bad, sa, link); 4437 isc_mem_put(fctx->mctx, sa, sizeof(*sa)); 4438 } 4439 4440 for (tried = ISC_LIST_HEAD(fctx->edns); tried != NULL; 4441 tried = ISC_LIST_HEAD(fctx->edns)) 4442 { 4443 ISC_LIST_UNLINK(fctx->edns, tried, link); 4444 isc_mem_put(fctx->mctx, tried, sizeof(*tried)); 4445 } 4446 4447 if (fctx->nfails != NULL) { 4448 isc_counter_detach(&fctx->nfails); 4449 } 4450 if (fctx->nvalidations != NULL) { 4451 isc_counter_detach(&fctx->nvalidations); 4452 } 4453 isc_counter_detach(&fctx->qc); 4454 if (fctx->gqc != NULL) { 4455 isc_counter_detach(&fctx->gqc); 4456 } 4457 if (fctx->parent != NULL) { 4458 fetchctx_detach(&fctx->parent); 4459 } 4460 fcount_decr(fctx); 4461 dns_message_detach(&fctx->qmessage); 4462 if (dns_rdataset_isassociated(&fctx->nameservers)) { 4463 dns_rdataset_disassociate(&fctx->nameservers); 4464 } 4465 dns_db_detach(&fctx->cache); 4466 dns_adb_detach(&fctx->adb); 4467 dns_dispatchmgr_detach(&fctx->dispatchmgr); 4468 4469 dns_resolver_detach(&fctx->res); 4470 4471 dns_ede_invalidate(&fctx->edectx); 4472 4473 isc_mutex_destroy(&fctx->lock); 4474 4475 isc_mem_free(fctx->mctx, fctx->info); 4476 isc_mem_putanddetach(&fctx->mctx, fctx, sizeof(*fctx)); 4477 } 4478 4479 static void 4480 fctx_expired(void *arg) { 4481 fetchctx_t *fctx = (fetchctx_t *)arg; 4482 4483 REQUIRE(VALID_FCTX(fctx)); 4484 REQUIRE(fctx->tid == isc_tid()); 4485 4486 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4487 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 4488 "shut down hung fetch while resolving %p(%s)", fctx, 4489 fctx->info); 4490 4491 dns_ede_add(&fctx->edectx, DNS_EDE_NOREACHABLEAUTH, NULL); 4492 4493 fctx_done_detach(&fctx, DNS_R_SERVFAIL); 4494 } 4495 4496 static void 4497 fctx_shutdown(void *arg) { 4498 fetchctx_t *fctx = arg; 4499 4500 REQUIRE(VALID_FCTX(fctx)); 4501 4502 fctx_done_unref(fctx, ISC_R_SHUTTINGDOWN); 4503 fetchctx_detach(&fctx); 4504 } 4505 4506 static void 4507 fctx_start(void *arg) { 4508 fetchctx_t *fctx = (fetchctx_t *)arg; 4509 4510 REQUIRE(VALID_FCTX(fctx)); 4511 4512 FCTXTRACE("start"); 4513 4514 LOCK(&fctx->lock); 4515 if (SHUTTINGDOWN(fctx)) { 4516 UNLOCK(&fctx->lock); 4517 goto detach; 4518 } 4519 4520 /* 4521 * Normal fctx startup. 4522 */ 4523 fctx->state = fetchstate_active; 4524 UNLOCK(&fctx->lock); 4525 4526 /* 4527 * As a backstop, we also set a timer to stop the fetch 4528 * if in-band netmgr timeouts don't work. It will fire two 4529 * seconds after the fetch should have finished. (This 4530 * should be enough of a gap to avoid the timer firing 4531 * while a response is being processed normally.) 4532 */ 4533 fctx_starttimer(fctx); 4534 fctx_try(fctx, false); 4535 4536 detach: 4537 fetchctx_detach(&fctx); 4538 } 4539 4540 /* 4541 * Fetch Creation, Joining, and Cancellation. 4542 */ 4543 4544 static void 4545 fctx_add_event(fetchctx_t *fctx, isc_loop_t *loop, const isc_sockaddr_t *client, 4546 dns_messageid_t id, isc_job_cb cb, void *arg, 4547 dns_edectx_t *edectx, dns_rdataset_t *rdataset, 4548 dns_rdataset_t *sigrdataset, dns_fetch_t *fetch) { 4549 dns_fetchresponse_t *resp = NULL; 4550 4551 FCTXTRACE("addevent"); 4552 4553 resp = isc_mem_get(fctx->mctx, sizeof(*resp)); 4554 *resp = (dns_fetchresponse_t){ 4555 .result = DNS_R_SERVFAIL, 4556 .qtype = fctx->type, 4557 .rdataset = rdataset, 4558 .sigrdataset = sigrdataset, 4559 .fetch = fetch, 4560 .client = client, 4561 .id = id, 4562 .loop = loop, 4563 .cb = cb, 4564 .arg = arg, 4565 .link = ISC_LINK_INITIALIZER, 4566 .edectx = edectx, 4567 }; 4568 isc_mem_attach(fctx->mctx, &resp->mctx); 4569 4570 resp->foundname = dns_fixedname_initname(&resp->fname); 4571 4572 /* 4573 * Store the sigrdataset in the first resp in case it is needed 4574 * by any of the events. 4575 */ 4576 if (resp->sigrdataset != NULL) { 4577 ISC_LIST_PREPEND(fctx->resps, resp, link); 4578 } else { 4579 ISC_LIST_APPEND(fctx->resps, resp, link); 4580 } 4581 } 4582 4583 static void 4584 fctx_join(fetchctx_t *fctx, isc_loop_t *loop, const isc_sockaddr_t *client, 4585 dns_messageid_t id, isc_job_cb cb, void *arg, dns_edectx_t *edectx, 4586 dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset, 4587 dns_fetch_t *fetch) { 4588 FCTXTRACE("join"); 4589 4590 REQUIRE(!SHUTTINGDOWN(fctx)); 4591 4592 fctx_add_event(fctx, loop, client, id, cb, arg, edectx, rdataset, 4593 sigrdataset, fetch); 4594 4595 fetch->magic = DNS_FETCH_MAGIC; 4596 fetchctx_attach(fctx, &fetch->private); 4597 } 4598 4599 static void 4600 log_ns_ttl(fetchctx_t *fctx, const char *where) { 4601 char namebuf[DNS_NAME_FORMATSIZE]; 4602 char domainbuf[DNS_NAME_FORMATSIZE]; 4603 4604 dns_name_format(fctx->name, namebuf, sizeof(namebuf)); 4605 dns_name_format(fctx->domain, domainbuf, sizeof(domainbuf)); 4606 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4607 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(10), 4608 "log_ns_ttl: fctx %p: %s: %s (in '%s'?): %u %u", fctx, 4609 where, namebuf, domainbuf, fctx->ns_ttl_ok, fctx->ns_ttl); 4610 } 4611 4612 static isc_result_t 4613 fctx_create(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name, 4614 dns_rdatatype_t type, const dns_name_t *domain, 4615 dns_rdataset_t *nameservers, const isc_sockaddr_t *client, 4616 unsigned int options, unsigned int depth, isc_counter_t *qc, 4617 isc_counter_t *gqc, fetchctx_t *parent, fetchctx_t **fctxp) { 4618 fetchctx_t *fctx = NULL; 4619 isc_result_t result; 4620 isc_result_t iresult; 4621 isc_interval_t interval; 4622 unsigned int findoptions = 0; 4623 char buf[DNS_NAME_FORMATSIZE + DNS_RDATATYPE_FORMATSIZE + 1]; 4624 isc_mem_t *mctx = isc_loop_getmctx(loop); 4625 size_t p; 4626 uint32_t nvalidations = atomic_load_relaxed(&res->maxvalidations); 4627 uint32_t nfails = atomic_load_relaxed(&res->maxvalidationfails); 4628 4629 /* 4630 * Caller must be holding the lock for 'bucket' 4631 */ 4632 REQUIRE(fctxp != NULL && *fctxp == NULL); 4633 4634 fctx = isc_mem_get(mctx, sizeof(*fctx)); 4635 *fctx = (fetchctx_t){ 4636 .type = type, 4637 .qmintype = type, 4638 .options = options, 4639 .tid = isc_tid(), 4640 .state = fetchstate_active, 4641 .depth = depth, 4642 .qmin_labels = 1, 4643 .fwdpolicy = dns_fwdpolicy_none, 4644 .result = ISC_R_FAILURE, 4645 .loop = loop, 4646 }; 4647 4648 isc_mem_attach(mctx, &fctx->mctx); 4649 dns_resolver_attach(res, &fctx->res); 4650 4651 isc_mutex_init(&fctx->lock); 4652 4653 dns_ede_init(fctx->mctx, &fctx->edectx); 4654 4655 /* 4656 * Make fctx->info point to a copy of a formatted string 4657 * "name/type". FCTXTRACE won't work until this is done. 4658 */ 4659 dns_name_format(name, buf, sizeof(buf)); 4660 p = strlcat(buf, "/", sizeof(buf)); 4661 INSIST(p + DNS_RDATATYPE_FORMATSIZE < sizeof(buf)); 4662 dns_rdatatype_format(type, buf + p, sizeof(buf) - p); 4663 fctx->info = isc_mem_strdup(fctx->mctx, buf); 4664 4665 FCTXTRACE("create"); 4666 4667 if (nfails > 0) { 4668 isc_counter_create(mctx, nfails, &fctx->nfails); 4669 } 4670 4671 if (nvalidations > 0) { 4672 isc_counter_create(mctx, nvalidations, &fctx->nvalidations); 4673 } 4674 4675 if (qc != NULL) { 4676 isc_counter_attach(qc, &fctx->qc); 4677 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4678 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(9), 4679 "fctx %p(%s): attached to counter %p (%d)", fctx, 4680 fctx->info, fctx->qc, isc_counter_used(fctx->qc)); 4681 } else { 4682 result = isc_counter_create(fctx->mctx, res->maxqueries, 4683 &fctx->qc); 4684 if (result != ISC_R_SUCCESS) { 4685 goto cleanup_fetch; 4686 } 4687 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4688 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(9), 4689 "fctx %p(%s): created counter %p", fctx, 4690 fctx->info, fctx->qc); 4691 } 4692 4693 if (gqc != NULL) { 4694 isc_counter_attach(gqc, &fctx->gqc); 4695 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4696 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(9), 4697 "fctx %p(%s): attached to counter %p (%d)", fctx, 4698 fctx->info, fctx->gqc, 4699 isc_counter_used(fctx->gqc)); 4700 } 4701 4702 #if DNS_RESOLVER_TRACE 4703 fprintf(stderr, "fetchctx__init:%s:%s:%d:%p:%p->references = 1\n", 4704 __func__, __FILE__, __LINE__, fctx, fctx); 4705 #endif 4706 isc_refcount_init(&fctx->references, 1); 4707 4708 ISC_LIST_INIT(fctx->queries); 4709 ISC_LIST_INIT(fctx->finds); 4710 ISC_LIST_INIT(fctx->altfinds); 4711 ISC_LIST_INIT(fctx->forwaddrs); 4712 ISC_LIST_INIT(fctx->altaddrs); 4713 ISC_LIST_INIT(fctx->forwarders); 4714 ISC_LIST_INIT(fctx->bad); 4715 ISC_LIST_INIT(fctx->edns); 4716 ISC_LIST_INIT(fctx->validators); 4717 ISC_LIST_INIT(fctx->pending_finds); 4718 4719 atomic_init(&fctx->attributes, 0); 4720 4721 fctx->name = dns_fixedname_initname(&fctx->fname); 4722 fctx->nsname = dns_fixedname_initname(&fctx->nsfname); 4723 fctx->domain = dns_fixedname_initname(&fctx->dfname); 4724 fctx->qminname = dns_fixedname_initname(&fctx->qminfname); 4725 fctx->qmindcname = dns_fixedname_initname(&fctx->qmindcfname); 4726 fctx->fwdname = dns_fixedname_initname(&fctx->fwdfname); 4727 4728 dns_name_copy(name, fctx->name); 4729 dns_name_copy(name, fctx->qminname); 4730 4731 dns_rdataset_init(&fctx->nameservers); 4732 dns_rdataset_init(&fctx->qminrrset); 4733 dns_rdataset_init(&fctx->nsrrset); 4734 4735 fctx->start = isc_time_now(); 4736 fctx->now = (isc_stdtime_t)fctx->start.seconds; 4737 4738 if (parent != NULL) { 4739 fetchctx_attach(parent, &fctx->parent); 4740 } 4741 4742 if (client != NULL) { 4743 isc_sockaddr_format(client, fctx->clientstr, 4744 sizeof(fctx->clientstr)); 4745 } else { 4746 strlcpy(fctx->clientstr, "<unknown>", sizeof(fctx->clientstr)); 4747 } 4748 4749 if (domain == NULL) { 4750 dns_forwarders_t *forwarders = NULL; 4751 unsigned int labels; 4752 const dns_name_t *fwdname = name; 4753 dns_name_t suffix; 4754 4755 /* 4756 * DS records are found in the parent server. Strip one 4757 * leading label from the name (to be used in finding 4758 * the forwarder). 4759 */ 4760 if (dns_rdatatype_atparent(fctx->type) && 4761 dns_name_countlabels(name) > 1) 4762 { 4763 dns_name_init(&suffix, NULL); 4764 labels = dns_name_countlabels(name); 4765 dns_name_getlabelsequence(name, 1, labels - 1, &suffix); 4766 fwdname = &suffix; 4767 } 4768 4769 /* Find the forwarder for this name. */ 4770 result = dns_fwdtable_find(fctx->res->view->fwdtable, fwdname, 4771 &forwarders); 4772 if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { 4773 fctx->fwdpolicy = forwarders->fwdpolicy; 4774 dns_name_copy(&forwarders->name, fctx->fwdname); 4775 dns_forwarders_detach(&forwarders); 4776 } 4777 4778 if (fctx->fwdpolicy == dns_fwdpolicy_only) { 4779 /* 4780 * We're in forward-only mode. Set the query 4781 * domain. 4782 */ 4783 dns_name_copy(fctx->fwdname, fctx->domain); 4784 dns_name_copy(fctx->fwdname, fctx->qmindcname); 4785 /* 4786 * Disable query minimization 4787 */ 4788 options &= ~DNS_FETCHOPT_QMINIMIZE; 4789 } else { 4790 dns_fixedname_t dcfixed; 4791 dns_name_t *dcname = dns_fixedname_initname(&dcfixed); 4792 4793 /* 4794 * The caller didn't supply a query domain and 4795 * nameservers, and we're not in forward-only 4796 * mode, so find the best nameservers to use. 4797 */ 4798 if (dns_rdatatype_atparent(fctx->type)) { 4799 findoptions |= DNS_DBFIND_NOEXACT; 4800 } 4801 result = dns_view_findzonecut( 4802 res->view, name, fctx->fwdname, dcname, 4803 fctx->now, findoptions, true, true, 4804 &fctx->nameservers, NULL); 4805 if (result != ISC_R_SUCCESS) { 4806 goto cleanup_nameservers; 4807 } 4808 4809 dns_name_copy(fctx->fwdname, fctx->domain); 4810 dns_name_copy(dcname, fctx->qmindcname); 4811 fctx->ns_ttl = fctx->nameservers.ttl; 4812 fctx->ns_ttl_ok = true; 4813 } 4814 } else { 4815 dns_name_copy(domain, fctx->domain); 4816 dns_name_copy(domain, fctx->qmindcname); 4817 dns_rdataset_clone(nameservers, &fctx->nameservers); 4818 fctx->ns_ttl = fctx->nameservers.ttl; 4819 fctx->ns_ttl_ok = true; 4820 } 4821 4822 /* 4823 * Exempt prefetch queries from the fetches-per-zone quota check 4824 */ 4825 if ((fctx->options & DNS_FETCHOPT_PREFETCH) == 0) { 4826 /* 4827 * Are there too many simultaneous queries for this domain? 4828 */ 4829 result = fcount_incr(fctx, false); 4830 if (result != ISC_R_SUCCESS) { 4831 result = fctx->res->quotaresp[dns_quotatype_zone]; 4832 inc_stats(res, dns_resstatscounter_zonequota); 4833 goto cleanup_nameservers; 4834 } 4835 } 4836 4837 log_ns_ttl(fctx, "fctx_create"); 4838 4839 if (!dns_name_issubdomain(fctx->name, fctx->domain)) { 4840 dns_name_format(fctx->domain, buf, sizeof(buf)); 4841 UNEXPECTED_ERROR("'%s' is not subdomain of '%s'", fctx->info, 4842 buf); 4843 result = ISC_R_UNEXPECTED; 4844 goto cleanup_fcount; 4845 } 4846 4847 dns_message_create(fctx->mctx, fctx->res->namepools[fctx->tid], 4848 fctx->res->rdspools[fctx->tid], 4849 DNS_MESSAGE_INTENTRENDER, &fctx->qmessage); 4850 4851 /* 4852 * Compute an expiration time for the entire fetch. 4853 */ 4854 isc_interval_set(&interval, res->query_timeout / 1000, 4855 res->query_timeout % 1000 * 1000000); 4856 iresult = isc_time_nowplusinterval(&fctx->expires, &interval); 4857 if (iresult != ISC_R_SUCCESS) { 4858 UNEXPECTED_ERROR("isc_time_nowplusinterval: %s", 4859 isc_result_totext(iresult)); 4860 result = ISC_R_UNEXPECTED; 4861 goto cleanup_qmessage; 4862 } 4863 4864 /* 4865 * Default retry interval initialization. We set the interval 4866 * now mostly so it won't be uninitialized. It will be set to 4867 * the correct value before a query is issued. 4868 */ 4869 isc_interval_set(&fctx->interval, 2, 0); 4870 4871 /* 4872 * Attach to the view's adb, dispatchmgr and cache adb. 4873 */ 4874 dns_view_getadb(res->view, &fctx->adb); 4875 if (fctx->adb == NULL) { 4876 result = ISC_R_SHUTTINGDOWN; 4877 goto cleanup_qmessage; 4878 } 4879 fctx->dispatchmgr = dns_view_getdispatchmgr(res->view); 4880 if (fctx->dispatchmgr == NULL) { 4881 result = ISC_R_SHUTTINGDOWN; 4882 goto cleanup_adb; 4883 } 4884 dns_db_attach(res->view->cachedb, &fctx->cache); 4885 4886 ISC_LIST_INIT(fctx->resps); 4887 ISC_LINK_INIT(fctx, link); 4888 fctx->magic = FCTX_MAGIC; 4889 4890 /* 4891 * If qname minimization is enabled we need to trim 4892 * the name in fctx to proper length. 4893 */ 4894 if ((options & DNS_FETCHOPT_QMINIMIZE) != 0) { 4895 fctx->ip6arpaskip = (options & DNS_FETCHOPT_QMIN_SKIP_IP6A) != 4896 0 && 4897 dns_name_issubdomain(fctx->name, &ip6_arpa); 4898 fctx_minimize_qname(fctx); 4899 } 4900 4901 inc_stats(res, dns_resstatscounter_nfetch); 4902 4903 isc_timer_create(fctx->loop, fctx_expired, fctx, &fctx->timer); 4904 4905 *fctxp = fctx; 4906 4907 return ISC_R_SUCCESS; 4908 4909 cleanup_adb: 4910 dns_adb_detach(&fctx->adb); 4911 4912 cleanup_qmessage: 4913 dns_message_detach(&fctx->qmessage); 4914 4915 cleanup_fcount: 4916 fcount_decr(fctx); 4917 4918 cleanup_nameservers: 4919 if (dns_rdataset_isassociated(&fctx->nameservers)) { 4920 dns_rdataset_disassociate(&fctx->nameservers); 4921 } 4922 isc_mem_free(fctx->mctx, fctx->info); 4923 if (fctx->nfails != NULL) { 4924 isc_counter_detach(&fctx->nfails); 4925 } 4926 if (fctx->nvalidations != NULL) { 4927 isc_counter_detach(&fctx->nvalidations); 4928 } 4929 isc_counter_detach(&fctx->qc); 4930 if (fctx->gqc != NULL) { 4931 isc_counter_detach(&fctx->gqc); 4932 } 4933 if (fctx->parent != NULL) { 4934 fetchctx_detach(&fctx->parent); 4935 } 4936 4937 cleanup_fetch: 4938 4939 dns_ede_invalidate(&fctx->edectx); 4940 isc_mutex_destroy(&fctx->lock); 4941 dns_resolver_detach(&fctx->res); 4942 isc_mem_putanddetach(&fctx->mctx, fctx, sizeof(*fctx)); 4943 4944 return result; 4945 } 4946 4947 /* 4948 * Handle Responses 4949 */ 4950 static bool 4951 is_lame(fetchctx_t *fctx, dns_message_t *message) { 4952 dns_name_t *name; 4953 dns_rdataset_t *rdataset; 4954 isc_result_t result; 4955 4956 if (message->rcode != dns_rcode_noerror && 4957 message->rcode != dns_rcode_yxdomain && 4958 message->rcode != dns_rcode_nxdomain) 4959 { 4960 return false; 4961 } 4962 4963 if (message->counts[DNS_SECTION_ANSWER] != 0) { 4964 return false; 4965 } 4966 4967 if (message->counts[DNS_SECTION_AUTHORITY] == 0) { 4968 return false; 4969 } 4970 4971 result = dns_message_firstname(message, DNS_SECTION_AUTHORITY); 4972 while (result == ISC_R_SUCCESS) { 4973 name = NULL; 4974 dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name); 4975 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 4976 rdataset = ISC_LIST_NEXT(rdataset, link)) 4977 { 4978 dns_namereln_t namereln; 4979 int order; 4980 unsigned int labels; 4981 if (rdataset->type != dns_rdatatype_ns) { 4982 continue; 4983 } 4984 namereln = dns_name_fullcompare(name, fctx->domain, 4985 &order, &labels); 4986 if (namereln == dns_namereln_equal && 4987 (message->flags & DNS_MESSAGEFLAG_AA) != 0) 4988 { 4989 return false; 4990 } 4991 if (namereln == dns_namereln_subdomain) { 4992 return false; 4993 } 4994 return true; 4995 } 4996 result = dns_message_nextname(message, DNS_SECTION_AUTHORITY); 4997 } 4998 4999 return false; 5000 } 5001 5002 static void 5003 log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) { 5004 char namebuf[DNS_NAME_FORMATSIZE]; 5005 char domainbuf[DNS_NAME_FORMATSIZE]; 5006 char addrbuf[ISC_SOCKADDR_FORMATSIZE]; 5007 5008 dns_name_format(fctx->name, namebuf, sizeof(namebuf)); 5009 dns_name_format(fctx->domain, domainbuf, sizeof(domainbuf)); 5010 isc_sockaddr_format(&addrinfo->sockaddr, addrbuf, sizeof(addrbuf)); 5011 isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS, 5012 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 5013 "lame server resolving '%s' (in '%s'?): %s", namebuf, 5014 domainbuf, addrbuf); 5015 } 5016 5017 static void 5018 log_formerr(fetchctx_t *fctx, const char *format, ...) { 5019 char nsbuf[ISC_SOCKADDR_FORMATSIZE]; 5020 char msgbuf[2048]; 5021 va_list args; 5022 5023 va_start(args, format); 5024 vsnprintf(msgbuf, sizeof(msgbuf), format, args); 5025 va_end(args); 5026 5027 isc_sockaddr_format(&fctx->addrinfo->sockaddr, nsbuf, sizeof(nsbuf)); 5028 5029 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 5030 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 5031 "DNS format error from %s resolving %s for %s: %s", nsbuf, 5032 fctx->info, fctx->clientstr, msgbuf); 5033 } 5034 5035 static isc_result_t 5036 same_question(fetchctx_t *fctx, dns_message_t *message) { 5037 isc_result_t result; 5038 dns_name_t *name = NULL; 5039 dns_rdataset_t *rdataset = NULL; 5040 5041 /* 5042 * Caller must be holding the fctx lock. 5043 */ 5044 5045 /* 5046 * XXXRTH Currently we support only one question. 5047 */ 5048 if (message->counts[DNS_SECTION_QUESTION] == 0) { 5049 if ((message->flags & DNS_MESSAGEFLAG_TC) != 0) { 5050 /* 5051 * If TC=1 and the question section is empty, we 5052 * accept the reply message as a truncated 5053 * answer, to be retried over TCP. 5054 * 5055 * It is really a FORMERR condition, but this is 5056 * a workaround to accept replies from some 5057 * implementations. 5058 * 5059 * Because the question section matching is not 5060 * performed, the worst that could happen is 5061 * that an attacker who gets past the ID and 5062 * source port checks can force the use of 5063 * TCP. This is considered an acceptable risk. 5064 */ 5065 log_formerr(fctx, "empty question section, " 5066 "accepting it anyway as TC=1"); 5067 return ISC_R_SUCCESS; 5068 } else { 5069 log_formerr(fctx, "empty question section"); 5070 return DNS_R_FORMERR; 5071 } 5072 } else if (message->counts[DNS_SECTION_QUESTION] > 1) { 5073 log_formerr(fctx, "too many questions"); 5074 return DNS_R_FORMERR; 5075 } 5076 5077 result = dns_message_firstname(message, DNS_SECTION_QUESTION); 5078 if (result != ISC_R_SUCCESS) { 5079 return result; 5080 } 5081 5082 dns_message_currentname(message, DNS_SECTION_QUESTION, &name); 5083 rdataset = ISC_LIST_HEAD(name->list); 5084 INSIST(rdataset != NULL); 5085 INSIST(ISC_LIST_NEXT(rdataset, link) == NULL); 5086 5087 if (fctx->type != rdataset->type || 5088 fctx->res->rdclass != rdataset->rdclass || 5089 !dns_name_equal(fctx->name, name)) 5090 { 5091 char namebuf[DNS_NAME_FORMATSIZE]; 5092 char classbuf[DNS_RDATACLASS_FORMATSIZE]; 5093 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 5094 5095 dns_name_format(name, namebuf, sizeof(namebuf)); 5096 dns_rdataclass_format(rdataset->rdclass, classbuf, 5097 sizeof(classbuf)); 5098 dns_rdatatype_format(rdataset->type, typebuf, sizeof(typebuf)); 5099 log_formerr(fctx, "question section mismatch: got %s/%s/%s", 5100 namebuf, classbuf, typebuf); 5101 return DNS_R_FORMERR; 5102 } 5103 5104 return ISC_R_SUCCESS; 5105 } 5106 5107 static void 5108 clone_results(fetchctx_t *fctx) { 5109 dns_fetchresponse_t *resp = NULL, *hresp = NULL; 5110 5111 FCTXTRACE("clone_results"); 5112 5113 /* 5114 * Set up any other resps to have the same data as the first. 5115 * 5116 * Caller must be holding the appropriate lock. 5117 */ 5118 5119 fctx->cloned = true; 5120 5121 for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL; 5122 resp = ISC_LIST_NEXT(resp, link)) 5123 { 5124 /* This is the head resp; keep a pointer and move on */ 5125 if (hresp == NULL) { 5126 hresp = ISC_LIST_HEAD(fctx->resps); 5127 FCTXTRACEN("clone_results", hresp->foundname, 5128 hresp->result); 5129 continue; 5130 } 5131 5132 resp->result = hresp->result; 5133 dns_name_copy(hresp->foundname, resp->foundname); 5134 dns_db_attach(hresp->db, &resp->db); 5135 dns_db_attachnode(hresp->db, hresp->node, &resp->node); 5136 5137 INSIST(hresp->rdataset != NULL); 5138 INSIST(resp->rdataset != NULL); 5139 if (dns_rdataset_isassociated(hresp->rdataset)) { 5140 dns_rdataset_clone(hresp->rdataset, resp->rdataset); 5141 } 5142 5143 INSIST(!(hresp->sigrdataset == NULL && 5144 resp->sigrdataset != NULL)); 5145 if (hresp->sigrdataset != NULL && 5146 dns_rdataset_isassociated(hresp->sigrdataset) && 5147 resp->sigrdataset != NULL) 5148 { 5149 dns_rdataset_clone(hresp->sigrdataset, 5150 resp->sigrdataset); 5151 } 5152 } 5153 } 5154 5155 #define CACHE(r) (((r)->attributes & DNS_RDATASETATTR_CACHE) != 0) 5156 #define ANSWER(r) (((r)->attributes & DNS_RDATASETATTR_ANSWER) != 0) 5157 #define ANSWERSIG(r) (((r)->attributes & DNS_RDATASETATTR_ANSWERSIG) != 0) 5158 #define EXTERNAL(r) (((r)->attributes & DNS_RDATASETATTR_EXTERNAL) != 0) 5159 #define CHAINING(r) (((r)->attributes & DNS_RDATASETATTR_CHAINING) != 0) 5160 #define CHASE(r) (((r)->attributes & DNS_RDATASETATTR_CHASE) != 0) 5161 #define CHECKNAMES(r) (((r)->attributes & DNS_RDATASETATTR_CHECKNAMES) != 0) 5162 5163 /* 5164 * typemap with just RRSIG(46) and NSEC(47) bits set. 5165 * 5166 * Bitmap calculation from dns_nsec_setbit: 5167 * 5168 * 46 47 5169 * shift = 7 - (type % 8); 0 1 5170 * mask = 1 << shift; 0x02 0x01 5171 * array[type / 8] |= mask; 5172 * 5173 * Window (0), bitmap length (6), and bitmap. 5174 */ 5175 static const unsigned char minimal_typemap[] = { 0, 6, 0, 0, 0, 0, 0, 0x03 }; 5176 5177 static bool 5178 is_minimal_nsec(dns_rdataset_t *nsecset) { 5179 dns_rdataset_t rdataset; 5180 isc_result_t result; 5181 5182 dns_rdataset_init(&rdataset); 5183 dns_rdataset_clone(nsecset, &rdataset); 5184 5185 for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS; 5186 result = dns_rdataset_next(&rdataset)) 5187 { 5188 dns_rdata_t rdata = DNS_RDATA_INIT; 5189 dns_rdata_nsec_t nsec; 5190 dns_rdataset_current(&rdataset, &rdata); 5191 result = dns_rdata_tostruct(&rdata, &nsec, NULL); 5192 RUNTIME_CHECK(result == ISC_R_SUCCESS); 5193 if (nsec.len == sizeof(minimal_typemap) && 5194 memcmp(nsec.typebits, minimal_typemap, nsec.len) == 0) 5195 { 5196 dns_rdataset_disassociate(&rdataset); 5197 return true; 5198 } 5199 } 5200 dns_rdataset_disassociate(&rdataset); 5201 return false; 5202 } 5203 5204 /* 5205 * If there is a SOA record in the type map then there must be a DNSKEY. 5206 */ 5207 static bool 5208 check_soa_and_dnskey(dns_rdataset_t *nsecset) { 5209 dns_rdataset_t rdataset; 5210 isc_result_t result; 5211 5212 dns_rdataset_init(&rdataset); 5213 dns_rdataset_clone(nsecset, &rdataset); 5214 5215 for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS; 5216 result = dns_rdataset_next(&rdataset)) 5217 { 5218 dns_rdata_t rdata = DNS_RDATA_INIT; 5219 dns_rdataset_current(&rdataset, &rdata); 5220 if (dns_nsec_typepresent(&rdata, dns_rdatatype_soa) && 5221 (!dns_nsec_typepresent(&rdata, dns_rdatatype_dnskey) || 5222 !dns_nsec_typepresent(&rdata, dns_rdatatype_ns))) 5223 { 5224 dns_rdataset_disassociate(&rdataset); 5225 return false; 5226 } 5227 } 5228 dns_rdataset_disassociate(&rdataset); 5229 return true; 5230 } 5231 5232 /* 5233 * Look for NSEC next name that starts with the label '\000'. 5234 */ 5235 static bool 5236 has_000_label(dns_rdataset_t *nsecset) { 5237 dns_rdataset_t rdataset; 5238 isc_result_t result; 5239 5240 dns_rdataset_init(&rdataset); 5241 dns_rdataset_clone(nsecset, &rdataset); 5242 5243 for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS; 5244 result = dns_rdataset_next(&rdataset)) 5245 { 5246 dns_rdata_t rdata = DNS_RDATA_INIT; 5247 dns_rdataset_current(&rdataset, &rdata); 5248 if (rdata.length > 1 && rdata.data[0] == 1 && 5249 rdata.data[1] == 0) 5250 { 5251 dns_rdataset_disassociate(&rdataset); 5252 return true; 5253 } 5254 } 5255 dns_rdataset_disassociate(&rdataset); 5256 return false; 5257 } 5258 5259 /* 5260 * The validator has finished. 5261 */ 5262 static void 5263 validated(void *arg) { 5264 dns_validator_t *val = (dns_validator_t *)arg; 5265 dns_adbaddrinfo_t *addrinfo = NULL; 5266 dns_dbnode_t *node = NULL; 5267 dns_dbnode_t *nsnode = NULL; 5268 dns_fetchresponse_t *hresp = NULL; 5269 dns_name_t *name = NULL; 5270 dns_rdataset_t *ardataset = NULL; 5271 dns_rdataset_t *asigrdataset = NULL; 5272 dns_rdataset_t *rdataset = NULL; 5273 dns_rdataset_t *sigrdataset = NULL; 5274 dns_resolver_t *res = NULL; 5275 dns_valarg_t *valarg = NULL; 5276 fetchctx_t *fctx = NULL; 5277 bool chaining; 5278 bool negative; 5279 bool sentresponse; 5280 isc_result_t eresult = ISC_R_SUCCESS; 5281 isc_result_t result = ISC_R_SUCCESS; 5282 isc_stdtime_t now; 5283 uint32_t ttl; 5284 unsigned int options; 5285 dns_fixedname_t fwild; 5286 dns_name_t *wild = NULL; 5287 dns_message_t *message = NULL; 5288 bool done = false; 5289 5290 valarg = val->arg; 5291 5292 REQUIRE(VALID_FCTX(valarg->fctx)); 5293 REQUIRE(!ISC_LIST_EMPTY(valarg->fctx->validators)); 5294 5295 fctx = valarg->fctx; 5296 valarg->fctx = NULL; 5297 5298 REQUIRE(fctx->tid == isc_tid()); 5299 5300 FCTXTRACE("received validation completion event"); 5301 5302 res = fctx->res; 5303 addrinfo = valarg->addrinfo; 5304 5305 message = val->message; 5306 5307 LOCK(&fctx->lock); 5308 fctx->vresult = val->result; 5309 ISC_LIST_UNLINK(fctx->validators, val, link); 5310 fctx->validator = NULL; 5311 UNLOCK(&fctx->lock); 5312 5313 /* 5314 * Destroy the validator early so that we can 5315 * destroy the fctx if necessary. Save the wildcard name. 5316 */ 5317 if (val->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL) { 5318 wild = dns_fixedname_initname(&fwild); 5319 dns_name_copy(dns_fixedname_name(&val->wild), wild); 5320 } 5321 5322 isc_mem_put(fctx->mctx, valarg, sizeof(*valarg)); 5323 5324 negative = (val->rdataset == NULL); 5325 5326 LOCK(&fctx->lock); 5327 sentresponse = ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0); 5328 5329 /* 5330 * If shutting down, ignore the results. Check to see if we're 5331 * done waiting for validator completions and ADB pending 5332 * events; if so, destroy the fctx. 5333 */ 5334 if (SHUTTINGDOWN(fctx) && !sentresponse) { 5335 UNLOCK(&fctx->lock); 5336 goto cleanup_fetchctx; 5337 } 5338 5339 now = isc_stdtime_now(); 5340 5341 /* 5342 * If chaining, we need to make sure that the right result code 5343 * is returned, and that the rdatasets are bound. 5344 */ 5345 if (val->result == ISC_R_SUCCESS && !negative && 5346 val->rdataset != NULL && CHAINING(val->rdataset)) 5347 { 5348 if (val->rdataset->type == dns_rdatatype_cname) { 5349 eresult = DNS_R_CNAME; 5350 } else { 5351 INSIST(val->rdataset->type == dns_rdatatype_dname); 5352 eresult = DNS_R_DNAME; 5353 } 5354 chaining = true; 5355 } else { 5356 chaining = false; 5357 } 5358 5359 /* 5360 * Either we're not shutting down, or we are shutting down but 5361 * want to cache the result anyway (if this was a validation 5362 * started by a query with cd set) 5363 */ 5364 5365 hresp = ISC_LIST_HEAD(fctx->resps); 5366 if (hresp != NULL) { 5367 if (!negative && !chaining && 5368 (fctx->type == dns_rdatatype_any || 5369 fctx->type == dns_rdatatype_rrsig || 5370 fctx->type == dns_rdatatype_sig)) 5371 { 5372 /* 5373 * Don't bind rdatasets; the caller 5374 * will iterate the node. 5375 */ 5376 } else { 5377 ardataset = hresp->rdataset; 5378 asigrdataset = hresp->sigrdataset; 5379 } 5380 } 5381 5382 if (val->result != ISC_R_SUCCESS) { 5383 FCTXTRACE("validation failed"); 5384 inc_stats(res, dns_resstatscounter_valfail); 5385 fctx->valfail++; 5386 fctx->vresult = val->result; 5387 if (fctx->vresult != DNS_R_BROKENCHAIN) { 5388 result = ISC_R_NOTFOUND; 5389 if (val->rdataset != NULL) { 5390 result = dns_db_findnode(fctx->cache, val->name, 5391 false, &node); 5392 } 5393 if (result == ISC_R_SUCCESS) { 5394 (void)dns_db_deleterdataset(fctx->cache, node, 5395 NULL, val->type, 0); 5396 } 5397 if (result == ISC_R_SUCCESS && val->sigrdataset != NULL) 5398 { 5399 (void)dns_db_deleterdataset( 5400 fctx->cache, node, NULL, 5401 dns_rdatatype_rrsig, val->type); 5402 } 5403 if (result == ISC_R_SUCCESS) { 5404 dns_db_detachnode(fctx->cache, &node); 5405 } 5406 } 5407 if (fctx->vresult == DNS_R_BROKENCHAIN && !negative) { 5408 /* 5409 * Cache the data as pending for later 5410 * validation. 5411 */ 5412 result = ISC_R_NOTFOUND; 5413 if (val->rdataset != NULL) { 5414 result = dns_db_findnode(fctx->cache, val->name, 5415 true, &node); 5416 } 5417 if (result == ISC_R_SUCCESS) { 5418 (void)dns_db_addrdataset( 5419 fctx->cache, node, NULL, now, 5420 val->rdataset, 0, NULL); 5421 } 5422 if (result == ISC_R_SUCCESS && val->sigrdataset != NULL) 5423 { 5424 (void)dns_db_addrdataset( 5425 fctx->cache, node, NULL, now, 5426 val->sigrdataset, 0, NULL); 5427 } 5428 if (result == ISC_R_SUCCESS) { 5429 dns_db_detachnode(fctx->cache, &node); 5430 } 5431 } 5432 result = fctx->vresult; 5433 add_bad(fctx, message, addrinfo, result, badns_validation); 5434 5435 UNLOCK(&fctx->lock); 5436 5437 INSIST(fctx->validator == NULL); 5438 5439 fctx->validator = ISC_LIST_HEAD(fctx->validators); 5440 if (fctx->validator != NULL) { 5441 dns_validator_send(fctx->validator); 5442 goto cleanup_fetchctx; 5443 } else if (sentresponse) { 5444 done = true; 5445 goto cleanup_fetchctx; 5446 } else if (result == DNS_R_BROKENCHAIN) { 5447 done = true; 5448 goto cleanup_fetchctx; 5449 } else { 5450 fctx_try(fctx, true); 5451 goto cleanup_fetchctx; 5452 } 5453 UNREACHABLE(); 5454 } 5455 5456 if (negative) { 5457 dns_rdatatype_t covers; 5458 FCTXTRACE("nonexistence validation OK"); 5459 5460 inc_stats(res, dns_resstatscounter_valnegsuccess); 5461 5462 /* 5463 * Cache DS NXDOMAIN separately to other types. 5464 */ 5465 if (message->rcode == dns_rcode_nxdomain && 5466 fctx->type != dns_rdatatype_ds) 5467 { 5468 covers = dns_rdatatype_any; 5469 } else { 5470 covers = fctx->type; 5471 } 5472 5473 /* 5474 * Don't report qname minimisation NXDOMAIN errors 5475 * when the result is NXDOMAIN except we have already 5476 * confirmed a higher error. 5477 */ 5478 if (!fctx->force_qmin_warning && 5479 message->rcode == dns_rcode_nxdomain && 5480 (fctx->qmin_warning == DNS_R_NXDOMAIN || 5481 fctx->qmin_warning == DNS_R_NCACHENXDOMAIN)) 5482 { 5483 fctx->qmin_warning = ISC_R_SUCCESS; 5484 } 5485 5486 result = dns_db_findnode(fctx->cache, val->name, true, &node); 5487 if (result != ISC_R_SUCCESS) { 5488 /* fctx->lock unlocked in noanswer_response */ 5489 goto noanswer_response; 5490 } 5491 5492 /* 5493 * If we are asking for a SOA record set the cache time 5494 * to zero to facilitate locating the containing zone of 5495 * a arbitrary zone. 5496 */ 5497 ttl = res->view->maxncachettl; 5498 if (fctx->type == dns_rdatatype_soa && 5499 covers == dns_rdatatype_any && res->zero_no_soa_ttl) 5500 { 5501 ttl = 0; 5502 } 5503 5504 result = ncache_adderesult(message, fctx->cache, node, covers, 5505 now, fctx->res->view->minncachettl, 5506 ttl, val->optout, val->secure, 5507 ardataset, &eresult); 5508 if (result != ISC_R_SUCCESS) { 5509 goto noanswer_response; 5510 } 5511 goto answer_response; 5512 } else { 5513 inc_stats(res, dns_resstatscounter_valsuccess); 5514 } 5515 5516 FCTXTRACE("validation OK"); 5517 5518 if (val->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL) { 5519 result = dns_rdataset_addnoqname( 5520 val->rdataset, val->proofs[DNS_VALIDATOR_NOQNAMEPROOF]); 5521 RUNTIME_CHECK(result == ISC_R_SUCCESS); 5522 INSIST(val->sigrdataset != NULL); 5523 val->sigrdataset->ttl = val->rdataset->ttl; 5524 if (val->proofs[DNS_VALIDATOR_CLOSESTENCLOSER] != NULL) { 5525 result = dns_rdataset_addclosest( 5526 val->rdataset, 5527 val->proofs[DNS_VALIDATOR_CLOSESTENCLOSER]); 5528 RUNTIME_CHECK(result == ISC_R_SUCCESS); 5529 } 5530 } else if (val->rdataset->trust == dns_trust_answer && 5531 val->rdataset->type != dns_rdatatype_rrsig) 5532 { 5533 isc_result_t tresult; 5534 dns_name_t *noqname = NULL; 5535 tresult = findnoqname(fctx, message, val->name, 5536 val->rdataset->type, &noqname); 5537 if (tresult == ISC_R_SUCCESS && noqname != NULL) { 5538 tresult = dns_rdataset_addnoqname(val->rdataset, 5539 noqname); 5540 RUNTIME_CHECK(tresult == ISC_R_SUCCESS); 5541 } 5542 } 5543 5544 /* 5545 * The data was already cached as pending data. 5546 * Re-cache it as secure and bind the cached 5547 * rdatasets to the first event on the fetch 5548 * event list. 5549 */ 5550 result = dns_db_findnode(fctx->cache, val->name, true, &node); 5551 if (result != ISC_R_SUCCESS) { 5552 goto noanswer_response; 5553 } 5554 5555 options = 0; 5556 if ((fctx->options & DNS_FETCHOPT_PREFETCH) != 0) { 5557 options = DNS_DBADD_PREFETCH; 5558 } 5559 result = dns_db_addrdataset(fctx->cache, node, NULL, now, val->rdataset, 5560 options, ardataset); 5561 if (result != ISC_R_SUCCESS && result != DNS_R_UNCHANGED) { 5562 goto noanswer_response; 5563 } 5564 if (ardataset != NULL && NEGATIVE(ardataset)) { 5565 if (NXDOMAIN(ardataset)) { 5566 eresult = DNS_R_NCACHENXDOMAIN; 5567 } else { 5568 eresult = DNS_R_NCACHENXRRSET; 5569 } 5570 } else if (val->sigrdataset != NULL) { 5571 result = dns_db_addrdataset(fctx->cache, node, NULL, now, 5572 val->sigrdataset, options, 5573 asigrdataset); 5574 if (result != ISC_R_SUCCESS && result != DNS_R_UNCHANGED) { 5575 goto noanswer_response; 5576 } 5577 } 5578 5579 if (sentresponse) { 5580 /* 5581 * If we only deferred the destroy because we wanted to 5582 * cache the data, destroy now. 5583 */ 5584 dns_db_detachnode(fctx->cache, &node); 5585 if (SHUTTINGDOWN(fctx)) { 5586 dns_validator_t *validator = NULL; 5587 for (validator = ISC_LIST_HEAD(fctx->validators); 5588 validator != NULL; 5589 validator = ISC_LIST_NEXT(validator, link)) 5590 { 5591 dns_validator_cancel(validator); 5592 } 5593 } 5594 UNLOCK(&fctx->lock); 5595 goto cleanup_fetchctx; 5596 } 5597 5598 if (!ISC_LIST_EMPTY(fctx->validators)) { 5599 INSIST(!negative); 5600 INSIST(fctx->type == dns_rdatatype_any || 5601 fctx->type == dns_rdatatype_rrsig || 5602 fctx->type == dns_rdatatype_sig); 5603 /* 5604 * Don't send a response yet - we have 5605 * more rdatasets that still need to 5606 * be validated. 5607 */ 5608 dns_db_detachnode(fctx->cache, &node); 5609 UNLOCK(&fctx->lock); 5610 dns_validator_send(ISC_LIST_HEAD(fctx->validators)); 5611 goto cleanup_fetchctx; 5612 } 5613 5614 answer_response: 5615 5616 /* 5617 * Cache any SOA/NS/NSEC records that happened to be validated. 5618 */ 5619 result = dns_message_firstname(message, DNS_SECTION_AUTHORITY); 5620 while (result == ISC_R_SUCCESS) { 5621 name = NULL; 5622 dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name); 5623 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 5624 rdataset = ISC_LIST_NEXT(rdataset, link)) 5625 { 5626 if ((rdataset->type != dns_rdatatype_ns && 5627 rdataset->type != dns_rdatatype_soa && 5628 rdataset->type != dns_rdatatype_nsec) || 5629 rdataset->trust != dns_trust_secure) 5630 { 5631 continue; 5632 } 5633 for (sigrdataset = ISC_LIST_HEAD(name->list); 5634 sigrdataset != NULL; 5635 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 5636 { 5637 if (sigrdataset->type != dns_rdatatype_rrsig || 5638 sigrdataset->covers != rdataset->type) 5639 { 5640 continue; 5641 } 5642 break; 5643 } 5644 if (sigrdataset == NULL || 5645 sigrdataset->trust != dns_trust_secure) 5646 { 5647 continue; 5648 } 5649 5650 /* 5651 * Don't cache NSEC if missing NSEC or RRSIG types. 5652 */ 5653 if (rdataset->type == dns_rdatatype_nsec && 5654 !dns_nsec_requiredtypespresent(rdataset)) 5655 { 5656 continue; 5657 } 5658 5659 /* 5660 * Don't cache "white lies" but do cache 5661 * "black lies". 5662 */ 5663 if (rdataset->type == dns_rdatatype_nsec && 5664 !dns_name_equal(fctx->name, name) && 5665 is_minimal_nsec(rdataset)) 5666 { 5667 continue; 5668 } 5669 5670 /* 5671 * Check SOA and DNSKEY consistency. 5672 */ 5673 if (rdataset->type == dns_rdatatype_nsec && 5674 !check_soa_and_dnskey(rdataset)) 5675 { 5676 continue; 5677 } 5678 5679 /* 5680 * Look for \000 label in next name. 5681 */ 5682 if (rdataset->type == dns_rdatatype_nsec && 5683 has_000_label(rdataset)) 5684 { 5685 continue; 5686 } 5687 5688 result = dns_db_findnode(fctx->cache, name, true, 5689 &nsnode); 5690 if (result != ISC_R_SUCCESS) { 5691 continue; 5692 } 5693 5694 result = dns_db_addrdataset(fctx->cache, nsnode, NULL, 5695 now, rdataset, 0, NULL); 5696 if (result == ISC_R_SUCCESS) { 5697 result = dns_db_addrdataset( 5698 fctx->cache, nsnode, NULL, now, 5699 sigrdataset, 0, NULL); 5700 } 5701 dns_db_detachnode(fctx->cache, &nsnode); 5702 if (result != ISC_R_SUCCESS) { 5703 continue; 5704 } 5705 } 5706 result = dns_message_nextname(message, DNS_SECTION_AUTHORITY); 5707 } 5708 5709 /* 5710 * Add the wild card entry. 5711 */ 5712 if (val->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL && 5713 val->rdataset != NULL && dns_rdataset_isassociated(val->rdataset) && 5714 val->rdataset->trust == dns_trust_secure && 5715 val->sigrdataset != NULL && 5716 dns_rdataset_isassociated(val->sigrdataset) && 5717 val->sigrdataset->trust == dns_trust_secure && wild != NULL) 5718 { 5719 dns_dbnode_t *wnode = NULL; 5720 5721 result = dns_db_findnode(fctx->cache, wild, true, &wnode); 5722 if (result == ISC_R_SUCCESS) { 5723 result = dns_db_addrdataset(fctx->cache, wnode, NULL, 5724 now, val->rdataset, 0, 5725 NULL); 5726 } 5727 if (result == ISC_R_SUCCESS) { 5728 (void)dns_db_addrdataset(fctx->cache, wnode, NULL, now, 5729 val->sigrdataset, 0, NULL); 5730 } 5731 if (wnode != NULL) { 5732 dns_db_detachnode(fctx->cache, &wnode); 5733 } 5734 } 5735 5736 result = ISC_R_SUCCESS; 5737 5738 /* 5739 * Respond with an answer, positive or negative, 5740 * as opposed to an error. 'node' must be non-NULL. 5741 */ 5742 5743 FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER); 5744 5745 if (hresp != NULL) { 5746 /* 5747 * Negative results must be indicated in val->result. 5748 */ 5749 INSIST(hresp->rdataset != NULL); 5750 if (dns_rdataset_isassociated(hresp->rdataset)) { 5751 if (NEGATIVE(hresp->rdataset)) { 5752 INSIST(eresult == DNS_R_NCACHENXDOMAIN || 5753 eresult == DNS_R_NCACHENXRRSET); 5754 } else if (eresult == ISC_R_SUCCESS && 5755 hresp->rdataset->type != fctx->type) 5756 { 5757 switch (hresp->rdataset->type) { 5758 case dns_rdatatype_cname: 5759 eresult = DNS_R_CNAME; 5760 break; 5761 case dns_rdatatype_dname: 5762 eresult = DNS_R_DNAME; 5763 break; 5764 default: 5765 break; 5766 } 5767 } 5768 } 5769 5770 hresp->result = eresult; 5771 dns_name_copy(val->name, hresp->foundname); 5772 dns_db_attach(fctx->cache, &hresp->db); 5773 dns_db_transfernode(fctx->cache, &node, &hresp->node); 5774 clone_results(fctx); 5775 } 5776 5777 noanswer_response: 5778 if (node != NULL) { 5779 dns_db_detachnode(fctx->cache, &node); 5780 } 5781 5782 UNLOCK(&fctx->lock); 5783 done = true; 5784 5785 cleanup_fetchctx: 5786 if (done) { 5787 fctx_done_unref(fctx, result); 5788 } 5789 5790 /* 5791 * val->name points to name on a message on one of the 5792 * queries on the fetch context so the name has to be 5793 * released first with a dns_validator_shutdown() call. 5794 */ 5795 dns_validator_shutdown(val); 5796 dns_validator_detach(&val); 5797 fetchctx_detach(&fctx); 5798 INSIST(node == NULL); 5799 } 5800 5801 static void 5802 fctx_log(void *arg, int level, const char *fmt, ...) { 5803 char msgbuf[2048]; 5804 va_list args; 5805 fetchctx_t *fctx = arg; 5806 5807 va_start(args, fmt); 5808 vsnprintf(msgbuf, sizeof(msgbuf), fmt, args); 5809 va_end(args); 5810 5811 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 5812 DNS_LOGMODULE_RESOLVER, level, "fctx %p(%s): %s", fctx, 5813 fctx->info, msgbuf); 5814 } 5815 5816 static isc_result_t 5817 findnoqname(fetchctx_t *fctx, dns_message_t *message, dns_name_t *name, 5818 dns_rdatatype_t type, dns_name_t **noqnamep) { 5819 dns_rdataset_t *nrdataset, *next, *sigrdataset; 5820 dns_rdata_rrsig_t rrsig; 5821 isc_result_t result; 5822 unsigned int labels; 5823 dns_section_t section; 5824 dns_name_t *zonename; 5825 dns_fixedname_t fzonename; 5826 dns_name_t *closest; 5827 dns_fixedname_t fclosest; 5828 dns_name_t *nearest; 5829 dns_fixedname_t fnearest; 5830 dns_rdatatype_t found = dns_rdatatype_none; 5831 dns_name_t *noqname = NULL; 5832 5833 FCTXTRACE("findnoqname"); 5834 5835 REQUIRE(noqnamep != NULL && *noqnamep == NULL); 5836 5837 /* 5838 * Find the SIG for this rdataset, if we have it. 5839 */ 5840 for (sigrdataset = ISC_LIST_HEAD(name->list); sigrdataset != NULL; 5841 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 5842 { 5843 if (sigrdataset->type == dns_rdatatype_rrsig && 5844 sigrdataset->covers == type) 5845 { 5846 break; 5847 } 5848 } 5849 5850 if (sigrdataset == NULL) { 5851 return ISC_R_NOTFOUND; 5852 } 5853 5854 labels = dns_name_countlabels(name); 5855 5856 for (result = dns_rdataset_first(sigrdataset); result == ISC_R_SUCCESS; 5857 result = dns_rdataset_next(sigrdataset)) 5858 { 5859 dns_rdata_t rdata = DNS_RDATA_INIT; 5860 dns_rdataset_current(sigrdataset, &rdata); 5861 result = dns_rdata_tostruct(&rdata, &rrsig, NULL); 5862 RUNTIME_CHECK(result == ISC_R_SUCCESS); 5863 /* Wildcard has rrsig.labels < labels - 1. */ 5864 if (rrsig.labels + 1U >= labels) { 5865 continue; 5866 } 5867 break; 5868 } 5869 5870 if (result == ISC_R_NOMORE) { 5871 return ISC_R_NOTFOUND; 5872 } 5873 if (result != ISC_R_SUCCESS) { 5874 return result; 5875 } 5876 5877 zonename = dns_fixedname_initname(&fzonename); 5878 closest = dns_fixedname_initname(&fclosest); 5879 nearest = dns_fixedname_initname(&fnearest); 5880 5881 #define NXND(x) ((x) == ISC_R_SUCCESS) 5882 5883 section = DNS_SECTION_AUTHORITY; 5884 for (result = dns_message_firstname(message, section); 5885 result == ISC_R_SUCCESS; 5886 result = dns_message_nextname(message, section)) 5887 { 5888 dns_name_t *nsec = NULL; 5889 dns_message_currentname(message, section, &nsec); 5890 for (nrdataset = ISC_LIST_HEAD(nsec->list); nrdataset != NULL; 5891 nrdataset = next) 5892 { 5893 bool data = false, exists = false; 5894 bool optout = false, unknown = false; 5895 bool setclosest = false; 5896 bool setnearest = false; 5897 5898 next = ISC_LIST_NEXT(nrdataset, link); 5899 if (nrdataset->type != dns_rdatatype_nsec && 5900 nrdataset->type != dns_rdatatype_nsec3) 5901 { 5902 continue; 5903 } 5904 5905 if (nrdataset->type == dns_rdatatype_nsec && 5906 NXND(dns_nsec_noexistnodata( 5907 type, name, nsec, nrdataset, &exists, &data, 5908 NULL, fctx_log, fctx))) 5909 { 5910 if (!exists) { 5911 noqname = nsec; 5912 found = dns_rdatatype_nsec; 5913 } 5914 } 5915 5916 if (nrdataset->type == dns_rdatatype_nsec3 && 5917 NXND(dns_nsec3_noexistnodata( 5918 type, name, nsec, nrdataset, zonename, 5919 &exists, &data, &optout, &unknown, 5920 &setclosest, &setnearest, closest, nearest, 5921 fctx_log, fctx))) 5922 { 5923 if (!exists && setnearest) { 5924 noqname = nsec; 5925 found = dns_rdatatype_nsec3; 5926 } 5927 } 5928 } 5929 } 5930 if (result == ISC_R_NOMORE) { 5931 result = ISC_R_SUCCESS; 5932 } 5933 if (noqname != NULL) { 5934 for (sigrdataset = ISC_LIST_HEAD(noqname->list); 5935 sigrdataset != NULL; 5936 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 5937 { 5938 if (sigrdataset->type == dns_rdatatype_rrsig && 5939 sigrdataset->covers == found) 5940 { 5941 break; 5942 } 5943 } 5944 if (sigrdataset != NULL) { 5945 *noqnamep = noqname; 5946 } 5947 } 5948 return result; 5949 } 5950 5951 static isc_result_t 5952 cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message, 5953 dns_adbaddrinfo_t *addrinfo, isc_stdtime_t now) { 5954 dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL; 5955 dns_rdataset_t *addedrdataset = NULL; 5956 dns_rdataset_t *ardataset = NULL, *asigrdataset = NULL; 5957 dns_rdataset_t *valrdataset = NULL, *valsigrdataset = NULL; 5958 dns_dbnode_t *node = NULL, **anodep = NULL; 5959 dns_db_t **adbp = NULL; 5960 dns_resolver_t *res = fctx->res; 5961 bool need_validation = false; 5962 bool secure_domain = false; 5963 bool have_answer = false; 5964 isc_result_t result, eresult = ISC_R_SUCCESS; 5965 dns_fetchresponse_t *resp = NULL; 5966 unsigned int options = 0, equalok = 0; 5967 bool fail; 5968 unsigned int valoptions = 0; 5969 bool checknta = true; 5970 5971 FCTXTRACE("cache_name"); 5972 5973 /* 5974 * The appropriate bucket lock must be held. 5975 */ 5976 5977 /* 5978 * Is DNSSEC validation required for this name? 5979 */ 5980 if ((fctx->options & DNS_FETCHOPT_NONTA) != 0) { 5981 valoptions |= DNS_VALIDATOR_NONTA; 5982 checknta = false; 5983 } 5984 5985 if (res->view->enablevalidation) { 5986 result = issecuredomain(res->view, name, fctx->type, now, 5987 checknta, NULL, &secure_domain); 5988 if (result != ISC_R_SUCCESS) { 5989 return result; 5990 } 5991 } 5992 5993 if ((fctx->options & DNS_FETCHOPT_NOCDFLAG) != 0) { 5994 valoptions |= DNS_VALIDATOR_NOCDFLAG; 5995 } 5996 5997 if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0) { 5998 need_validation = false; 5999 } else { 6000 need_validation = secure_domain; 6001 } 6002 6003 if (name->attributes.answer && !need_validation) { 6004 have_answer = true; 6005 resp = ISC_LIST_HEAD(fctx->resps); 6006 6007 if (resp != NULL) { 6008 adbp = &resp->db; 6009 dns_name_copy(name, resp->foundname); 6010 anodep = &resp->node; 6011 6012 /* 6013 * If this is an ANY, SIG or RRSIG query, we're 6014 * not going to return any rdatasets, unless we 6015 * encountered a CNAME or DNAME as "the answer". 6016 * In this case, we're going to return 6017 * DNS_R_CNAME or DNS_R_DNAME and we must set up 6018 * the rdatasets. 6019 */ 6020 if ((fctx->type != dns_rdatatype_any && 6021 fctx->type != dns_rdatatype_rrsig && 6022 fctx->type != dns_rdatatype_sig) || 6023 name->attributes.chaining) 6024 { 6025 ardataset = resp->rdataset; 6026 asigrdataset = resp->sigrdataset; 6027 } 6028 } 6029 } 6030 6031 /* 6032 * Find or create the cache node. 6033 */ 6034 result = dns_db_findnode(fctx->cache, name, true, &node); 6035 if (result != ISC_R_SUCCESS) { 6036 return result; 6037 } 6038 6039 /* 6040 * Cache or validate each cacheable rdataset. 6041 */ 6042 fail = ((fctx->res->options & DNS_RESOLVER_CHECKNAMESFAIL) != 0); 6043 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 6044 rdataset = ISC_LIST_NEXT(rdataset, link)) 6045 { 6046 if (!CACHE(rdataset)) { 6047 continue; 6048 } 6049 if (CHECKNAMES(rdataset)) { 6050 char namebuf[DNS_NAME_FORMATSIZE]; 6051 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 6052 char classbuf[DNS_RDATATYPE_FORMATSIZE]; 6053 6054 dns_name_format(name, namebuf, sizeof(namebuf)); 6055 dns_rdatatype_format(rdataset->type, typebuf, 6056 sizeof(typebuf)); 6057 dns_rdataclass_format(rdataset->rdclass, classbuf, 6058 sizeof(classbuf)); 6059 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 6060 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 6061 "check-names %s %s/%s/%s", 6062 fail ? "failure" : "warning", namebuf, 6063 typebuf, classbuf); 6064 if (fail) { 6065 if (ANSWER(rdataset)) { 6066 dns_db_detachnode(fctx->cache, &node); 6067 return DNS_R_BADNAME; 6068 } 6069 continue; 6070 } 6071 } 6072 6073 /* 6074 * Enforce the configure maximum cache TTL. 6075 */ 6076 if (rdataset->ttl > res->view->maxcachettl) { 6077 rdataset->ttl = res->view->maxcachettl; 6078 } 6079 6080 /* 6081 * Enforce configured minimum cache TTL. 6082 */ 6083 if (rdataset->ttl < res->view->mincachettl) { 6084 rdataset->ttl = res->view->mincachettl; 6085 } 6086 6087 /* 6088 * Mark the rdataset as being prefetch eligible. 6089 */ 6090 if (rdataset->ttl >= fctx->res->view->prefetch_eligible) { 6091 rdataset->attributes |= DNS_RDATASETATTR_PREFETCH; 6092 } 6093 6094 /* 6095 * Find the SIG for this rdataset, if we have it. 6096 */ 6097 for (sigrdataset = ISC_LIST_HEAD(name->list); 6098 sigrdataset != NULL; 6099 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 6100 { 6101 if (sigrdataset->type == dns_rdatatype_rrsig && 6102 sigrdataset->covers == rdataset->type) 6103 { 6104 break; 6105 } 6106 } 6107 6108 /* 6109 * If this RRset is in a secure domain, is in bailiwick, 6110 * and is not glue, attempt DNSSEC validation. (We do 6111 * not attempt to validate glue or out-of-bailiwick 6112 * data--even though there might be some performance 6113 * benefit to doing so--because it makes it simpler and 6114 * safer to ensure that records from a secure domain are 6115 * only cached if validated within the context of a 6116 * query to the domain that owns them.) 6117 */ 6118 if (secure_domain && rdataset->trust != dns_trust_glue && 6119 !EXTERNAL(rdataset)) 6120 { 6121 dns_trust_t trust; 6122 6123 /* 6124 * RRSIGs are validated as part of validating 6125 * the type they cover. 6126 */ 6127 if (rdataset->type == dns_rdatatype_rrsig) { 6128 continue; 6129 } 6130 6131 if (sigrdataset == NULL && need_validation && 6132 !ANSWER(rdataset)) 6133 { 6134 /* 6135 * Ignore unrelated non-answer 6136 * rdatasets that are missing 6137 * signatures. 6138 */ 6139 continue; 6140 } 6141 6142 /* 6143 * Normalize the rdataset and sigrdataset TTLs. 6144 */ 6145 if (sigrdataset != NULL) { 6146 rdataset->ttl = ISC_MIN(rdataset->ttl, 6147 sigrdataset->ttl); 6148 sigrdataset->ttl = rdataset->ttl; 6149 } 6150 6151 /* 6152 * Mark the rdataset as being prefetch eligible. 6153 */ 6154 if (rdataset->ttl >= fctx->res->view->prefetch_eligible) 6155 { 6156 rdataset->attributes |= 6157 DNS_RDATASETATTR_PREFETCH; 6158 } 6159 6160 /* 6161 * Cache this rdataset/sigrdataset pair as 6162 * pending data. Track whether it was 6163 * additional or not. If this was a priming 6164 * query, additional should be cached as glue. 6165 */ 6166 if (rdataset->trust == dns_trust_additional) { 6167 trust = dns_trust_pending_additional; 6168 } else { 6169 trust = dns_trust_pending_answer; 6170 } 6171 6172 rdataset->trust = trust; 6173 if (sigrdataset != NULL) { 6174 sigrdataset->trust = trust; 6175 } 6176 if (!need_validation || !ANSWER(rdataset)) { 6177 options = 0; 6178 equalok = 0; 6179 if (ANSWER(rdataset) && 6180 rdataset->type != dns_rdatatype_rrsig) 6181 { 6182 isc_result_t tresult; 6183 dns_name_t *noqname = NULL; 6184 tresult = findnoqname( 6185 fctx, message, name, 6186 rdataset->type, &noqname); 6187 if (tresult == ISC_R_SUCCESS && 6188 noqname != NULL) 6189 { 6190 (void)dns_rdataset_addnoqname( 6191 rdataset, noqname); 6192 } 6193 } 6194 if ((fctx->options & DNS_FETCHOPT_PREFETCH) != 6195 0) 6196 { 6197 options = DNS_DBADD_PREFETCH; 6198 } 6199 if ((fctx->options & DNS_FETCHOPT_NOCACHED) != 6200 0) 6201 { 6202 options |= DNS_DBADD_FORCE; 6203 } 6204 /* 6205 * If we're validating and passing the added 6206 * rdataset back to the caller, then we ask 6207 * dns_db_addrdataset() to compare the old and 6208 * new rdatasets whenever the result would 6209 * normally have been DNS_R_UNCHANGED, and to 6210 * return ISC_R_SUCCESS if they compare equal. 6211 * This allows us to continue and cache RRSIGs 6212 * in that case. 6213 */ 6214 if (!need_validation && ardataset != NULL) { 6215 equalok = DNS_DBADD_EQUALOK; 6216 } 6217 addedrdataset = ardataset; 6218 result = dns_db_addrdataset( 6219 fctx->cache, node, NULL, now, rdataset, 6220 options | equalok, addedrdataset); 6221 if (result == DNS_R_UNCHANGED) { 6222 result = ISC_R_SUCCESS; 6223 if (!need_validation && 6224 ardataset != NULL && 6225 NEGATIVE(ardataset)) 6226 { 6227 /* 6228 * The answer in the 6229 * cache is better than 6230 * the answer we found. 6231 * If it's a negative 6232 * cache entry, we 6233 * must set eresult 6234 * appropriately. 6235 */ 6236 if (NXDOMAIN(ardataset)) { 6237 eresult = 6238 DNS_R_NCACHENXDOMAIN; 6239 } else { 6240 eresult = 6241 DNS_R_NCACHENXRRSET; 6242 } 6243 continue; 6244 } 6245 if (equalok) { 6246 continue; 6247 } 6248 result = ISC_R_SUCCESS; 6249 } 6250 if (result != ISC_R_SUCCESS) { 6251 break; 6252 } 6253 if (sigrdataset != NULL) { 6254 addedrdataset = asigrdataset; 6255 result = dns_db_addrdataset( 6256 fctx->cache, node, NULL, now, 6257 sigrdataset, options, 6258 addedrdataset); 6259 if (result == DNS_R_UNCHANGED) { 6260 result = ISC_R_SUCCESS; 6261 } 6262 if (result != ISC_R_SUCCESS) { 6263 break; 6264 } 6265 } else if (!ANSWER(rdataset)) { 6266 continue; 6267 } 6268 } 6269 6270 if (ANSWER(rdataset) && need_validation) { 6271 if (fctx->type != dns_rdatatype_any && 6272 fctx->type != dns_rdatatype_rrsig && 6273 fctx->type != dns_rdatatype_sig) 6274 { 6275 /* 6276 * This is The Answer. We will 6277 * validate it, but first we 6278 * cache the rest of the 6279 * response - it may contain 6280 * useful keys. 6281 */ 6282 INSIST(valrdataset == NULL && 6283 valsigrdataset == NULL); 6284 valrdataset = rdataset; 6285 valsigrdataset = sigrdataset; 6286 } else { 6287 /* 6288 * This is one of (potentially) 6289 * multiple answers to an ANY 6290 * or SIG query. To keep things 6291 * simple, we just start the 6292 * validator right away rather 6293 * than caching first and 6294 * having to remember which 6295 * rdatasets needed validation. 6296 */ 6297 result = valcreate( 6298 fctx, message, addrinfo, name, 6299 rdataset->type, rdataset, 6300 sigrdataset, valoptions); 6301 } 6302 } else if (CHAINING(rdataset)) { 6303 if (rdataset->type == dns_rdatatype_cname) { 6304 eresult = DNS_R_CNAME; 6305 } else { 6306 INSIST(rdataset->type == 6307 dns_rdatatype_dname); 6308 eresult = DNS_R_DNAME; 6309 } 6310 } 6311 } else if (!EXTERNAL(rdataset)) { 6312 /* 6313 * It's OK to cache this rdataset now. 6314 */ 6315 if (ANSWER(rdataset)) { 6316 addedrdataset = ardataset; 6317 } else if (ANSWERSIG(rdataset)) { 6318 addedrdataset = asigrdataset; 6319 } else { 6320 addedrdataset = NULL; 6321 } 6322 if (CHAINING(rdataset)) { 6323 if (rdataset->type == dns_rdatatype_cname) { 6324 eresult = DNS_R_CNAME; 6325 } else { 6326 INSIST(rdataset->type == 6327 dns_rdatatype_dname); 6328 eresult = DNS_R_DNAME; 6329 } 6330 } 6331 if (rdataset->trust == dns_trust_glue && 6332 (rdataset->type == dns_rdatatype_ns || 6333 (rdataset->type == dns_rdatatype_rrsig && 6334 rdataset->covers == dns_rdatatype_ns))) 6335 { 6336 /* 6337 * If the trust level is 6338 * 'dns_trust_glue' then we are adding 6339 * data from a referral we got while 6340 * executing the search algorithm. New 6341 * referral data always takes precedence 6342 * over the existing cache contents. 6343 */ 6344 options = DNS_DBADD_FORCE; 6345 } else if ((fctx->options & DNS_FETCHOPT_PREFETCH) != 0) 6346 { 6347 options = DNS_DBADD_PREFETCH; 6348 } else { 6349 options = 0; 6350 } 6351 6352 if (ANSWER(rdataset) && 6353 rdataset->type != dns_rdatatype_rrsig) 6354 { 6355 isc_result_t tresult; 6356 dns_name_t *noqname = NULL; 6357 tresult = findnoqname(fctx, message, name, 6358 rdataset->type, &noqname); 6359 if (tresult == ISC_R_SUCCESS && noqname != NULL) 6360 { 6361 (void)dns_rdataset_addnoqname(rdataset, 6362 noqname); 6363 } 6364 } 6365 6366 /* 6367 * Now we can add the rdataset. 6368 */ 6369 result = dns_db_addrdataset(fctx->cache, node, NULL, 6370 now, rdataset, options, 6371 addedrdataset); 6372 6373 if (result == DNS_R_UNCHANGED) { 6374 if (ANSWER(rdataset) && ardataset != NULL && 6375 NEGATIVE(ardataset)) 6376 { 6377 /* 6378 * The answer in the cache is 6379 * better than the answer we 6380 * found, and is a negative 6381 * cache entry, so we must set 6382 * eresult appropriately. 6383 */ 6384 if (NXDOMAIN(ardataset)) { 6385 eresult = DNS_R_NCACHENXDOMAIN; 6386 } else { 6387 eresult = DNS_R_NCACHENXRRSET; 6388 } 6389 } 6390 result = ISC_R_SUCCESS; 6391 } else if (result != ISC_R_SUCCESS) { 6392 break; 6393 } 6394 } 6395 } 6396 6397 if (valrdataset != NULL) { 6398 dns_rdatatype_t vtype = fctx->type; 6399 if (CHAINING(valrdataset)) { 6400 if (valrdataset->type == dns_rdatatype_cname) { 6401 vtype = dns_rdatatype_cname; 6402 } else { 6403 vtype = dns_rdatatype_dname; 6404 } 6405 } 6406 6407 result = valcreate(fctx, message, addrinfo, name, vtype, 6408 valrdataset, valsigrdataset, valoptions); 6409 } 6410 6411 if (result == ISC_R_SUCCESS && have_answer) { 6412 FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER); 6413 if (resp != NULL) { 6414 /* 6415 * Negative results must be indicated in 6416 * resp->result. 6417 */ 6418 if (dns_rdataset_isassociated(resp->rdataset)) { 6419 if (NEGATIVE(resp->rdataset)) { 6420 INSIST(eresult == 6421 DNS_R_NCACHENXDOMAIN || 6422 eresult == DNS_R_NCACHENXRRSET); 6423 } else if (eresult == ISC_R_SUCCESS && 6424 resp->rdataset->type != fctx->type) 6425 { 6426 switch (resp->rdataset->type) { 6427 case dns_rdatatype_cname: 6428 eresult = DNS_R_CNAME; 6429 break; 6430 case dns_rdatatype_dname: 6431 eresult = DNS_R_DNAME; 6432 break; 6433 default: 6434 break; 6435 } 6436 } 6437 } 6438 resp->result = eresult; 6439 if (adbp != NULL && *adbp != NULL) { 6440 if (anodep != NULL && *anodep != NULL) { 6441 dns_db_detachnode(*adbp, anodep); 6442 } 6443 dns_db_detach(adbp); 6444 } 6445 dns_db_attach(fctx->cache, adbp); 6446 dns_db_transfernode(fctx->cache, &node, anodep); 6447 clone_results(fctx); 6448 } 6449 } 6450 6451 if (node != NULL) { 6452 dns_db_detachnode(fctx->cache, &node); 6453 } 6454 6455 return result; 6456 } 6457 6458 static isc_result_t 6459 cache_message(fetchctx_t *fctx, dns_message_t *message, 6460 dns_adbaddrinfo_t *addrinfo, isc_stdtime_t now) { 6461 isc_result_t result; 6462 dns_section_t section; 6463 dns_name_t *name; 6464 6465 FCTXTRACE("cache_message"); 6466 6467 FCTX_ATTR_CLR(fctx, FCTX_ATTR_WANTCACHE); 6468 6469 LOCK(&fctx->lock); 6470 6471 for (section = DNS_SECTION_ANSWER; section <= DNS_SECTION_ADDITIONAL; 6472 section++) 6473 { 6474 result = dns_message_firstname(message, section); 6475 while (result == ISC_R_SUCCESS) { 6476 name = NULL; 6477 dns_message_currentname(message, section, &name); 6478 if (name->attributes.cache) { 6479 result = cache_name(fctx, name, message, 6480 addrinfo, now); 6481 if (result != ISC_R_SUCCESS) { 6482 break; 6483 } 6484 } 6485 result = dns_message_nextname(message, section); 6486 } 6487 if (result != ISC_R_NOMORE) { 6488 break; 6489 } 6490 } 6491 if (result == ISC_R_NOMORE) { 6492 result = ISC_R_SUCCESS; 6493 } 6494 6495 UNLOCK(&fctx->lock); 6496 6497 return result; 6498 } 6499 6500 /* 6501 * Do what dns_ncache_addoptout() does, and then compute an appropriate 6502 * eresult. 6503 */ 6504 static isc_result_t 6505 ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node, 6506 dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl, 6507 dns_ttl_t maxttl, bool optout, bool secure, 6508 dns_rdataset_t *ardataset, isc_result_t *eresultp) { 6509 isc_result_t result; 6510 dns_rdataset_t rdataset; 6511 6512 if (ardataset == NULL) { 6513 dns_rdataset_init(&rdataset); 6514 ardataset = &rdataset; 6515 } 6516 if (secure) { 6517 result = dns_ncache_addoptout(message, cache, node, covers, now, 6518 minttl, maxttl, optout, 6519 ardataset); 6520 } else { 6521 result = dns_ncache_add(message, cache, node, covers, now, 6522 minttl, maxttl, ardataset); 6523 } 6524 if (result == DNS_R_UNCHANGED || result == ISC_R_SUCCESS) { 6525 /* 6526 * If the cache now contains a negative entry and we 6527 * care about whether it is DNS_R_NCACHENXDOMAIN or 6528 * DNS_R_NCACHENXRRSET then extract it. 6529 */ 6530 if (NEGATIVE(ardataset)) { 6531 /* 6532 * The cache data is a negative cache entry. 6533 */ 6534 if (NXDOMAIN(ardataset)) { 6535 *eresultp = DNS_R_NCACHENXDOMAIN; 6536 } else { 6537 *eresultp = DNS_R_NCACHENXRRSET; 6538 } 6539 } else { 6540 /* 6541 * The attempt to add a negative cache entry 6542 * was rejected. Set *eresultp to reflect 6543 * the type of the dataset being returned. 6544 */ 6545 switch (ardataset->type) { 6546 case dns_rdatatype_cname: 6547 *eresultp = DNS_R_CNAME; 6548 break; 6549 case dns_rdatatype_dname: 6550 *eresultp = DNS_R_DNAME; 6551 break; 6552 default: 6553 *eresultp = ISC_R_SUCCESS; 6554 break; 6555 } 6556 } 6557 result = ISC_R_SUCCESS; 6558 } 6559 if (ardataset == &rdataset && dns_rdataset_isassociated(ardataset)) { 6560 dns_rdataset_disassociate(ardataset); 6561 } 6562 6563 return result; 6564 } 6565 6566 static isc_result_t 6567 ncache_message(fetchctx_t *fctx, dns_message_t *message, 6568 dns_adbaddrinfo_t *addrinfo, dns_rdatatype_t covers, 6569 isc_stdtime_t now) { 6570 isc_result_t result, eresult = ISC_R_SUCCESS; 6571 dns_name_t *name = fctx->name; 6572 dns_resolver_t *res = fctx->res; 6573 dns_db_t **adbp = NULL; 6574 dns_dbnode_t *node = NULL, **anodep = NULL; 6575 dns_rdataset_t *ardataset = NULL; 6576 bool need_validation = false, secure_domain = false; 6577 dns_fetchresponse_t *resp = NULL; 6578 uint32_t ttl; 6579 unsigned int valoptions = 0; 6580 bool checknta = true; 6581 6582 FCTXTRACE("ncache_message"); 6583 6584 FCTX_ATTR_CLR(fctx, FCTX_ATTR_WANTNCACHE); 6585 6586 POST(need_validation); 6587 6588 /* 6589 * XXXMPA remove when we follow cnames and adjust the setting 6590 * of FCTX_ATTR_WANTNCACHE in rctx_answer_none(). 6591 */ 6592 INSIST(message->counts[DNS_SECTION_ANSWER] == 0); 6593 6594 /* 6595 * Is DNSSEC validation required for this name? 6596 */ 6597 if ((fctx->options & DNS_FETCHOPT_NONTA) != 0) { 6598 valoptions |= DNS_VALIDATOR_NONTA; 6599 checknta = false; 6600 } 6601 6602 if (fctx->res->view->enablevalidation) { 6603 result = issecuredomain(res->view, name, fctx->type, now, 6604 checknta, NULL, &secure_domain); 6605 if (result != ISC_R_SUCCESS) { 6606 return result; 6607 } 6608 } 6609 6610 if ((fctx->options & DNS_FETCHOPT_NOCDFLAG) != 0) { 6611 valoptions |= DNS_VALIDATOR_NOCDFLAG; 6612 } 6613 6614 if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0) { 6615 need_validation = false; 6616 } else { 6617 need_validation = secure_domain; 6618 } 6619 6620 if (secure_domain) { 6621 /* 6622 * Mark all rdatasets as pending. 6623 */ 6624 result = dns_message_firstname(message, DNS_SECTION_AUTHORITY); 6625 while (result == ISC_R_SUCCESS) { 6626 dns_rdataset_t *trdataset = NULL; 6627 dns_name_t *tname = NULL; 6628 6629 dns_message_currentname(message, DNS_SECTION_AUTHORITY, 6630 &tname); 6631 for (trdataset = ISC_LIST_HEAD(tname->list); 6632 trdataset != NULL; 6633 trdataset = ISC_LIST_NEXT(trdataset, link)) 6634 { 6635 trdataset->trust = dns_trust_pending_answer; 6636 } 6637 result = dns_message_nextname(message, 6638 DNS_SECTION_AUTHORITY); 6639 } 6640 if (result != ISC_R_NOMORE) { 6641 return result; 6642 } 6643 } 6644 6645 if (need_validation) { 6646 /* 6647 * Do negative response validation. 6648 */ 6649 result = valcreate(fctx, message, addrinfo, name, fctx->type, 6650 NULL, NULL, valoptions); 6651 /* 6652 * If validation is necessary, return now. Otherwise 6653 * continue to process the message, letting the 6654 * validation complete in its own good time. 6655 */ 6656 return result; 6657 } 6658 6659 LOCK(&fctx->lock); 6660 6661 if (!HAVE_ANSWER(fctx)) { 6662 resp = ISC_LIST_HEAD(fctx->resps); 6663 if (resp != NULL) { 6664 adbp = &resp->db; 6665 dns_name_copy(name, resp->foundname); 6666 anodep = &resp->node; 6667 ardataset = resp->rdataset; 6668 } 6669 } 6670 6671 result = dns_db_findnode(fctx->cache, name, true, &node); 6672 if (result != ISC_R_SUCCESS) { 6673 goto unlock; 6674 } 6675 6676 /* 6677 * Don't report qname minimisation NXDOMAIN errors 6678 * when the result is NXDOMAIN except we have already 6679 * confirmed a higher error. 6680 */ 6681 if (!fctx->force_qmin_warning && message->rcode == dns_rcode_nxdomain && 6682 (fctx->qmin_warning == DNS_R_NXDOMAIN || 6683 fctx->qmin_warning == DNS_R_NCACHENXDOMAIN)) 6684 { 6685 fctx->qmin_warning = ISC_R_SUCCESS; 6686 } 6687 6688 /* 6689 * If we are asking for a SOA record set the cache time 6690 * to zero to facilitate locating the containing zone of 6691 * a arbitrary zone. 6692 */ 6693 ttl = fctx->res->view->maxncachettl; 6694 if (fctx->type == dns_rdatatype_soa && covers == dns_rdatatype_any && 6695 fctx->res->zero_no_soa_ttl) 6696 { 6697 ttl = 0; 6698 } 6699 6700 result = ncache_adderesult(message, fctx->cache, node, covers, now, 6701 fctx->res->view->minncachettl, ttl, false, 6702 false, ardataset, &eresult); 6703 if (result != ISC_R_SUCCESS) { 6704 goto unlock; 6705 } 6706 6707 if (!HAVE_ANSWER(fctx)) { 6708 FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER); 6709 if (resp != NULL) { 6710 resp->result = eresult; 6711 if (adbp != NULL && *adbp != NULL) { 6712 if (anodep != NULL && *anodep != NULL) { 6713 dns_db_detachnode(*adbp, anodep); 6714 } 6715 dns_db_detach(adbp); 6716 } 6717 dns_db_attach(fctx->cache, adbp); 6718 dns_db_transfernode(fctx->cache, &node, anodep); 6719 clone_results(fctx); 6720 } 6721 } 6722 6723 unlock: 6724 UNLOCK(&fctx->lock); 6725 6726 if (node != NULL) { 6727 dns_db_detachnode(fctx->cache, &node); 6728 } 6729 6730 return result; 6731 } 6732 6733 static void 6734 mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external, 6735 bool gluing) { 6736 name->attributes.cache = true; 6737 if (gluing) { 6738 rdataset->trust = dns_trust_glue; 6739 /* 6740 * Glue with 0 TTL causes problems. We force the TTL to 6741 * 1 second to prevent this. 6742 */ 6743 if (rdataset->ttl == 0) { 6744 rdataset->ttl = 1; 6745 } 6746 } else { 6747 rdataset->trust = dns_trust_additional; 6748 } 6749 /* 6750 * Avoid infinite loops by only marking new rdatasets. 6751 */ 6752 if (!CACHE(rdataset)) { 6753 name->attributes.chase = true; 6754 rdataset->attributes |= DNS_RDATASETATTR_CHASE; 6755 } 6756 rdataset->attributes |= DNS_RDATASETATTR_CACHE; 6757 if (external) { 6758 rdataset->attributes |= DNS_RDATASETATTR_EXTERNAL; 6759 } 6760 } 6761 6762 /* 6763 * Returns true if 'name' is external to the namespace for which 6764 * the server being queried can answer, either because it's not a 6765 * subdomain or because it's below a forward declaration or a 6766 * locally served zone. 6767 */ 6768 static inline bool 6769 name_external(const dns_name_t *name, dns_rdatatype_t type, respctx_t *rctx) { 6770 fetchctx_t *fctx = rctx->fctx; 6771 isc_result_t result; 6772 dns_forwarders_t *forwarders = NULL; 6773 dns_name_t *apex = NULL; 6774 dns_name_t suffix; 6775 dns_zone_t *zone = NULL; 6776 unsigned int labels; 6777 dns_namereln_t rel; 6778 6779 apex = (ISDUALSTACK(fctx->addrinfo) || !ISFORWARDER(fctx->addrinfo)) 6780 ? rctx->ns_name != NULL ? rctx->ns_name : fctx->domain 6781 : fctx->fwdname; 6782 6783 /* 6784 * The name is outside the queried namespace. 6785 */ 6786 rel = dns_name_fullcompare(name, apex, &(int){ 0 }, 6787 &(unsigned int){ 0U }); 6788 if (rel != dns_namereln_subdomain && rel != dns_namereln_equal) { 6789 return true; 6790 } 6791 6792 /* 6793 * If the record lives in the parent zone, adjust the name so we 6794 * look for the correct zone or forward clause. 6795 */ 6796 labels = dns_name_countlabels(name); 6797 if (dns_rdatatype_atparent(type) && labels > 1U) { 6798 dns_name_init(&suffix, NULL); 6799 dns_name_getlabelsequence(name, 1, labels - 1, &suffix); 6800 name = &suffix; 6801 } else if (rel == dns_namereln_equal) { 6802 /* If 'name' is 'apex', no further checking is needed. */ 6803 return false; 6804 } 6805 6806 /* 6807 * If there is a locally served zone between 'apex' and 'name' 6808 * then don't cache. 6809 */ 6810 dns_ztfind_t options = DNS_ZTFIND_NOEXACT | DNS_ZTFIND_MIRROR; 6811 result = dns_view_findzone(fctx->res->view, name, options, &zone); 6812 if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { 6813 dns_name_t *zname = dns_zone_getorigin(zone); 6814 dns_namereln_t reln = dns_name_fullcompare( 6815 zname, apex, &(int){ 0 }, &(unsigned int){ 0U }); 6816 dns_zone_detach(&zone); 6817 if (reln == dns_namereln_subdomain) { 6818 return true; 6819 } 6820 } 6821 6822 /* 6823 * Look for a forward declaration below 'name'. 6824 */ 6825 result = dns_fwdtable_find(fctx->res->view->fwdtable, name, 6826 &forwarders); 6827 6828 if (ISFORWARDER(fctx->addrinfo)) { 6829 /* 6830 * See if the forwarder declaration is better. 6831 */ 6832 if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { 6833 bool better = !dns_name_equal(&forwarders->name, 6834 fctx->fwdname); 6835 dns_forwarders_detach(&forwarders); 6836 return better; 6837 } 6838 6839 /* 6840 * If the lookup failed, the configuration must have 6841 * changed: play it safe and don't cache. 6842 */ 6843 return true; 6844 } else if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { 6845 /* 6846 * If 'name' is covered by a 'forward only' clause then we 6847 * can't cache this response. 6848 */ 6849 bool nocache = (forwarders->fwdpolicy == dns_fwdpolicy_only && 6850 !ISC_LIST_EMPTY(forwarders->fwdrs)); 6851 dns_forwarders_detach(&forwarders); 6852 return nocache; 6853 } 6854 6855 return false; 6856 } 6857 6858 static isc_result_t 6859 check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type, 6860 dns_rdataset_t *found, dns_section_t section) { 6861 respctx_t *rctx = arg; 6862 fetchctx_t *fctx = rctx->fctx; 6863 isc_result_t result; 6864 dns_name_t *name = NULL; 6865 dns_rdataset_t *rdataset = NULL; 6866 bool external; 6867 dns_rdatatype_t rtype; 6868 bool gluing; 6869 6870 REQUIRE(VALID_FCTX(fctx)); 6871 6872 #if CHECK_FOR_GLUE_IN_ANSWER 6873 if (section == DNS_SECTION_ANSWER && type != dns_rdatatype_a) { 6874 return ISC_R_SUCCESS; 6875 } 6876 #endif /* if CHECK_FOR_GLUE_IN_ANSWER */ 6877 6878 gluing = (GLUING(fctx) || (fctx->type == dns_rdatatype_ns && 6879 dns_name_equal(fctx->name, dns_rootname))); 6880 6881 result = dns_message_findname(rctx->query->rmessage, section, addname, 6882 dns_rdatatype_any, 0, &name, NULL); 6883 if (result == ISC_R_SUCCESS) { 6884 external = name_external(name, type, rctx); 6885 if (type == dns_rdatatype_a) { 6886 for (rdataset = ISC_LIST_HEAD(name->list); 6887 rdataset != NULL; 6888 rdataset = ISC_LIST_NEXT(rdataset, link)) 6889 { 6890 if (rdataset->type == dns_rdatatype_rrsig) { 6891 rtype = rdataset->covers; 6892 } else { 6893 rtype = rdataset->type; 6894 } 6895 if (rtype == dns_rdatatype_a || 6896 rtype == dns_rdatatype_aaaa) 6897 { 6898 mark_related(name, rdataset, external, 6899 gluing); 6900 } 6901 } 6902 } else { 6903 result = dns_message_findtype(name, type, 0, &rdataset); 6904 if (result == ISC_R_SUCCESS) { 6905 mark_related(name, rdataset, external, gluing); 6906 if (found != NULL) { 6907 dns_rdataset_clone(rdataset, found); 6908 } 6909 /* 6910 * Do we have its SIG too? 6911 */ 6912 rdataset = NULL; 6913 result = dns_message_findtype( 6914 name, dns_rdatatype_rrsig, type, 6915 &rdataset); 6916 if (result == ISC_R_SUCCESS) { 6917 mark_related(name, rdataset, external, 6918 gluing); 6919 } 6920 } 6921 } 6922 } 6923 6924 return ISC_R_SUCCESS; 6925 } 6926 6927 static isc_result_t 6928 check_related(void *arg, const dns_name_t *addname, dns_rdatatype_t type, 6929 dns_rdataset_t *found DNS__DB_FLARG) { 6930 return check_section(arg, addname, type, found, DNS_SECTION_ADDITIONAL); 6931 } 6932 6933 #ifndef CHECK_FOR_GLUE_IN_ANSWER 6934 #define CHECK_FOR_GLUE_IN_ANSWER 0 6935 #endif /* ifndef CHECK_FOR_GLUE_IN_ANSWER */ 6936 6937 #if CHECK_FOR_GLUE_IN_ANSWER 6938 static isc_result_t 6939 check_answer(void *arg, const dns_name_t *addname, dns_rdatatype_t type, 6940 dns_rdataset_t *found) { 6941 return check_section(arg, addname, type, found, DNS_SECTION_ANSWER); 6942 } 6943 #endif /* if CHECK_FOR_GLUE_IN_ANSWER */ 6944 6945 static bool 6946 is_answeraddress_allowed(dns_view_t *view, dns_name_t *name, 6947 dns_rdataset_t *rdataset) { 6948 isc_result_t result; 6949 dns_rdata_t rdata = DNS_RDATA_INIT; 6950 struct in_addr ina; 6951 struct in6_addr in6a; 6952 isc_netaddr_t netaddr; 6953 char addrbuf[ISC_NETADDR_FORMATSIZE]; 6954 char namebuf[DNS_NAME_FORMATSIZE]; 6955 char classbuf[64]; 6956 char typebuf[64]; 6957 int match; 6958 6959 /* By default, we allow any addresses. */ 6960 if (view->denyansweracl == NULL) { 6961 return true; 6962 } 6963 6964 /* 6965 * If the owner name matches one in the exclusion list, either 6966 * exactly or partially, allow it. 6967 */ 6968 if (dns_nametree_covered(view->answeracl_exclude, name, NULL, 0)) { 6969 return true; 6970 } 6971 6972 /* 6973 * deny-answer-address doesn't apply to non-IN classes. 6974 */ 6975 if (rdataset->rdclass != dns_rdataclass_in) { 6976 return true; 6977 } 6978 6979 /* 6980 * Otherwise, search the filter list for a match for each 6981 * address record. If a match is found, the address should be 6982 * filtered, so should the entire answer. 6983 */ 6984 for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS; 6985 result = dns_rdataset_next(rdataset)) 6986 { 6987 dns_rdata_reset(&rdata); 6988 dns_rdataset_current(rdataset, &rdata); 6989 if (rdataset->type == dns_rdatatype_a) { 6990 INSIST(rdata.length == sizeof(ina.s_addr)); 6991 memmove(&ina.s_addr, rdata.data, sizeof(ina.s_addr)); 6992 isc_netaddr_fromin(&netaddr, &ina); 6993 } else { 6994 INSIST(rdata.length == sizeof(in6a.s6_addr)); 6995 memmove(in6a.s6_addr, rdata.data, sizeof(in6a.s6_addr)); 6996 isc_netaddr_fromin6(&netaddr, &in6a); 6997 } 6998 6999 result = dns_acl_match(&netaddr, NULL, view->denyansweracl, 7000 view->aclenv, &match, NULL); 7001 if (result == ISC_R_SUCCESS && match > 0) { 7002 isc_netaddr_format(&netaddr, addrbuf, sizeof(addrbuf)); 7003 dns_name_format(name, namebuf, sizeof(namebuf)); 7004 dns_rdatatype_format(rdataset->type, typebuf, 7005 sizeof(typebuf)); 7006 dns_rdataclass_format(rdataset->rdclass, classbuf, 7007 sizeof(classbuf)); 7008 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 7009 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 7010 "answer address %s denied for %s/%s/%s", 7011 addrbuf, namebuf, typebuf, classbuf); 7012 return false; 7013 } 7014 } 7015 7016 return true; 7017 } 7018 7019 static bool 7020 is_answertarget_allowed(fetchctx_t *fctx, dns_name_t *qname, dns_name_t *rname, 7021 dns_rdataset_t *rdataset, bool *chainingp) { 7022 isc_result_t result; 7023 dns_name_t *tname = NULL; 7024 dns_rdata_cname_t cname; 7025 dns_rdata_dname_t dname; 7026 dns_view_t *view = fctx->res->view; 7027 dns_rdata_t rdata = DNS_RDATA_INIT; 7028 unsigned int nlabels; 7029 dns_fixedname_t fixed; 7030 dns_name_t prefix; 7031 int order; 7032 7033 REQUIRE(rdataset != NULL); 7034 REQUIRE(rdataset->type == dns_rdatatype_cname || 7035 rdataset->type == dns_rdatatype_dname); 7036 7037 /* 7038 * By default, we allow any target name. 7039 * If newqname != NULL we also need to extract the newqname. 7040 */ 7041 if (chainingp == NULL && view->denyanswernames == NULL) { 7042 return true; 7043 } 7044 7045 result = dns_rdataset_first(rdataset); 7046 RUNTIME_CHECK(result == ISC_R_SUCCESS); 7047 dns_rdataset_current(rdataset, &rdata); 7048 switch (rdataset->type) { 7049 case dns_rdatatype_cname: 7050 result = dns_rdata_tostruct(&rdata, &cname, NULL); 7051 RUNTIME_CHECK(result == ISC_R_SUCCESS); 7052 tname = &cname.cname; 7053 break; 7054 case dns_rdatatype_dname: 7055 if (dns_name_fullcompare(qname, rname, &order, &nlabels) != 7056 dns_namereln_subdomain) 7057 { 7058 return true; 7059 } 7060 result = dns_rdata_tostruct(&rdata, &dname, NULL); 7061 RUNTIME_CHECK(result == ISC_R_SUCCESS); 7062 dns_name_init(&prefix, NULL); 7063 tname = dns_fixedname_initname(&fixed); 7064 nlabels = dns_name_countlabels(rname); 7065 dns_name_split(qname, nlabels, &prefix, NULL); 7066 result = dns_name_concatenate(&prefix, &dname.dname, tname, 7067 NULL); 7068 if (result == DNS_R_NAMETOOLONG) { 7069 SET_IF_NOT_NULL(chainingp, true); 7070 return true; 7071 } 7072 RUNTIME_CHECK(result == ISC_R_SUCCESS); 7073 break; 7074 default: 7075 UNREACHABLE(); 7076 } 7077 7078 SET_IF_NOT_NULL(chainingp, true); 7079 7080 if (view->denyanswernames == NULL) { 7081 return true; 7082 } 7083 7084 /* 7085 * If the owner name matches one in the exclusion list, either 7086 * exactly or partially, allow it. 7087 */ 7088 if (dns_nametree_covered(view->answernames_exclude, qname, NULL, 0)) { 7089 return true; 7090 } 7091 7092 /* 7093 * If the target name is a subdomain of the search domain, allow 7094 * it. 7095 * 7096 * Note that if BIND is configured as a forwarding DNS server, 7097 * the search domain will always match the root domain ("."), so 7098 * we must also check whether forwarding is enabled so that 7099 * filters can be applied; see GL #1574. 7100 */ 7101 if (!fctx->forwarding && dns_name_issubdomain(tname, fctx->domain)) { 7102 return true; 7103 } 7104 7105 /* 7106 * Otherwise, apply filters. 7107 */ 7108 if (dns_nametree_covered(view->denyanswernames, tname, NULL, 0)) { 7109 char qnamebuf[DNS_NAME_FORMATSIZE]; 7110 char tnamebuf[DNS_NAME_FORMATSIZE]; 7111 char classbuf[64]; 7112 char typebuf[64]; 7113 dns_name_format(qname, qnamebuf, sizeof(qnamebuf)); 7114 dns_name_format(tname, tnamebuf, sizeof(tnamebuf)); 7115 dns_rdatatype_format(rdataset->type, typebuf, sizeof(typebuf)); 7116 dns_rdataclass_format(view->rdclass, classbuf, 7117 sizeof(classbuf)); 7118 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 7119 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 7120 "%s target %s denied for %s/%s", typebuf, 7121 tnamebuf, qnamebuf, classbuf); 7122 return false; 7123 } 7124 7125 return true; 7126 } 7127 7128 static void 7129 trim_ns_ttl(fetchctx_t *fctx, dns_name_t *name, dns_rdataset_t *rdataset) { 7130 if (fctx->ns_ttl_ok && rdataset->ttl > fctx->ns_ttl) { 7131 char ns_namebuf[DNS_NAME_FORMATSIZE]; 7132 char namebuf[DNS_NAME_FORMATSIZE]; 7133 char tbuf[DNS_RDATATYPE_FORMATSIZE]; 7134 7135 dns_name_format(name, ns_namebuf, sizeof(ns_namebuf)); 7136 dns_name_format(fctx->name, namebuf, sizeof(namebuf)); 7137 dns_rdatatype_format(fctx->type, tbuf, sizeof(tbuf)); 7138 7139 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 7140 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(10), 7141 "fctx %p: trimming ttl of %s/NS for %s/%s: " 7142 "%u -> %u", 7143 fctx, ns_namebuf, namebuf, tbuf, rdataset->ttl, 7144 fctx->ns_ttl); 7145 rdataset->ttl = fctx->ns_ttl; 7146 } 7147 } 7148 7149 static bool 7150 validinanswer(dns_rdataset_t *rdataset, fetchctx_t *fctx) { 7151 if (rdataset->type == dns_rdatatype_nsec3) { 7152 /* 7153 * NSEC3 records are not allowed to 7154 * appear in the answer section. 7155 */ 7156 log_formerr(fctx, "NSEC3 in answer"); 7157 return false; 7158 } 7159 if (rdataset->type == dns_rdatatype_tkey) { 7160 /* 7161 * TKEY is not a valid record in a 7162 * response to any query we can make. 7163 */ 7164 log_formerr(fctx, "TKEY in answer"); 7165 return false; 7166 } 7167 if (rdataset->rdclass != fctx->res->rdclass) { 7168 log_formerr(fctx, "Mismatched class in answer"); 7169 return false; 7170 } 7171 return true; 7172 } 7173 7174 #if DNS_RESOLVER_TRACE 7175 ISC_REFCOUNT_TRACE_IMPL(fetchctx, fctx_destroy); 7176 #else 7177 ISC_REFCOUNT_IMPL(fetchctx, fctx_destroy); 7178 #endif 7179 7180 static void 7181 resume_dslookup(void *arg) { 7182 dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg; 7183 fetchctx_t *fctx = resp->arg; 7184 isc_loop_t *loop = resp->loop; 7185 isc_result_t result; 7186 dns_resolver_t *res = NULL; 7187 dns_rdataset_t *frdataset = NULL, *nsrdataset = NULL; 7188 dns_rdataset_t nameservers; 7189 dns_fixedname_t fixed; 7190 dns_name_t *domain = NULL; 7191 unsigned int n; 7192 dns_fetch_t *fetch = NULL; 7193 7194 REQUIRE(VALID_FCTX(fctx)); 7195 7196 res = fctx->res; 7197 7198 REQUIRE(fctx->tid == isc_tid()); 7199 7200 FCTXTRACE("resume_dslookup"); 7201 7202 if (resp->node != NULL) { 7203 dns_db_detachnode(resp->db, &resp->node); 7204 } 7205 if (resp->db != NULL) { 7206 dns_db_detach(&resp->db); 7207 } 7208 7209 /* Preserve data from resp before freeing it. */ 7210 frdataset = resp->rdataset; /* a.k.a. fctx->nsrrset */ 7211 result = resp->result; 7212 7213 dns_resolver_freefresp(&resp); 7214 7215 LOCK(&fctx->lock); 7216 if (SHUTTINGDOWN(fctx)) { 7217 result = ISC_R_SHUTTINGDOWN; 7218 } 7219 UNLOCK(&fctx->lock); 7220 7221 fetch = fctx->nsfetch; 7222 fctx->nsfetch = NULL; 7223 7224 FTRACE("resume_dslookup"); 7225 7226 switch (result) { 7227 case ISC_R_SUCCESS: 7228 FCTXTRACE("resuming DS lookup"); 7229 7230 if (dns_rdataset_isassociated(&fctx->nameservers)) { 7231 dns_rdataset_disassociate(&fctx->nameservers); 7232 } 7233 dns_rdataset_clone(frdataset, &fctx->nameservers); 7234 7235 /* 7236 * Disassociate now the NS's are saved. 7237 */ 7238 if (dns_rdataset_isassociated(frdataset)) { 7239 dns_rdataset_disassociate(frdataset); 7240 } 7241 7242 fctx->ns_ttl = fctx->nameservers.ttl; 7243 fctx->ns_ttl_ok = true; 7244 log_ns_ttl(fctx, "resume_dslookup"); 7245 7246 fcount_decr(fctx); 7247 dns_name_copy(fctx->nsname, fctx->domain); 7248 result = fcount_incr(fctx, true); 7249 if (result != ISC_R_SUCCESS) { 7250 goto cleanup; 7251 } 7252 7253 /* Try again. */ 7254 fctx_try(fctx, true); 7255 break; 7256 7257 case ISC_R_SHUTTINGDOWN: 7258 case ISC_R_CANCELED: 7259 /* Don't try anymore. */ 7260 /* Can't be done in cleanup. */ 7261 if (dns_rdataset_isassociated(frdataset)) { 7262 dns_rdataset_disassociate(frdataset); 7263 } 7264 goto cleanup; 7265 7266 default: 7267 /* 7268 * Disassociate for the next dns_resolver_createfetch call. 7269 */ 7270 if (dns_rdataset_isassociated(frdataset)) { 7271 dns_rdataset_disassociate(frdataset); 7272 } 7273 7274 /* 7275 * If the chain of resume_dslookup() invocations managed to 7276 * chop off enough labels from the original DS owner name to 7277 * reach the top of the namespace, no further progress can be 7278 * made. Interrupt the DS chasing process, returning SERVFAIL. 7279 */ 7280 if (dns_name_equal(fctx->nsname, fetch->private->domain)) { 7281 result = DNS_R_SERVFAIL; 7282 goto cleanup; 7283 } 7284 7285 /* Get nameservers from fetch before we destroy it. */ 7286 dns_rdataset_init(&nameservers); 7287 if (dns_rdataset_isassociated(&fetch->private->nameservers)) { 7288 dns_rdataset_clone(&fetch->private->nameservers, 7289 &nameservers); 7290 nsrdataset = &nameservers; 7291 7292 /* Get domain from fetch before we destroy it. */ 7293 domain = dns_fixedname_initname(&fixed); 7294 dns_name_copy(fetch->private->domain, domain); 7295 } 7296 7297 n = dns_name_countlabels(fctx->nsname); 7298 dns_name_getlabelsequence(fctx->nsname, 1, n - 1, fctx->nsname); 7299 7300 FCTXTRACE("continuing to look for parent's NS records"); 7301 7302 fetchctx_ref(fctx); 7303 result = dns_resolver_createfetch( 7304 res, fctx->nsname, dns_rdatatype_ns, domain, nsrdataset, 7305 NULL, NULL, 0, fctx->options, 0, fctx->qc, fctx->gqc, 7306 fctx, loop, resume_dslookup, fctx, &fctx->edectx, 7307 &fctx->nsrrset, NULL, &fctx->nsfetch); 7308 if (result != ISC_R_SUCCESS) { 7309 fetchctx_unref(fctx); 7310 if (result == DNS_R_DUPLICATE) { 7311 result = DNS_R_SERVFAIL; 7312 } 7313 } 7314 7315 if (dns_rdataset_isassociated(&nameservers)) { 7316 dns_rdataset_disassociate(&nameservers); 7317 } 7318 } 7319 7320 cleanup: 7321 dns_resolver_destroyfetch(&fetch); 7322 7323 if (result != ISC_R_SUCCESS) { 7324 /* An error occurred, tear down whole fctx */ 7325 fctx_done_unref(fctx, result); 7326 } 7327 7328 fetchctx_detach(&fctx); 7329 } 7330 7331 static void 7332 checknamessection(dns_message_t *message, dns_section_t section) { 7333 isc_result_t result; 7334 dns_name_t *name; 7335 dns_rdata_t rdata = DNS_RDATA_INIT; 7336 dns_rdataset_t *rdataset; 7337 7338 for (result = dns_message_firstname(message, section); 7339 result == ISC_R_SUCCESS; 7340 result = dns_message_nextname(message, section)) 7341 { 7342 name = NULL; 7343 dns_message_currentname(message, section, &name); 7344 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 7345 rdataset = ISC_LIST_NEXT(rdataset, link)) 7346 { 7347 for (result = dns_rdataset_first(rdataset); 7348 result == ISC_R_SUCCESS; 7349 result = dns_rdataset_next(rdataset)) 7350 { 7351 dns_rdataset_current(rdataset, &rdata); 7352 if (!dns_rdata_checkowner(name, rdata.rdclass, 7353 rdata.type, false) || 7354 !dns_rdata_checknames(&rdata, name, NULL)) 7355 { 7356 rdataset->attributes |= 7357 DNS_RDATASETATTR_CHECKNAMES; 7358 } 7359 dns_rdata_reset(&rdata); 7360 } 7361 } 7362 } 7363 } 7364 7365 static void 7366 checknames(dns_message_t *message) { 7367 checknamessection(message, DNS_SECTION_ANSWER); 7368 checknamessection(message, DNS_SECTION_AUTHORITY); 7369 checknamessection(message, DNS_SECTION_ADDITIONAL); 7370 } 7371 7372 /* 7373 * Log server NSID at log level 'level' 7374 */ 7375 static void 7376 log_nsid(isc_buffer_t *opt, size_t nsid_len, resquery_t *query, int level, 7377 isc_mem_t *mctx) { 7378 static const char hex[17] = "0123456789abcdef"; 7379 char addrbuf[ISC_SOCKADDR_FORMATSIZE]; 7380 size_t buflen; 7381 unsigned char *p, *nsid; 7382 unsigned char *buf = NULL, *pbuf = NULL; 7383 7384 REQUIRE(nsid_len <= UINT16_MAX); 7385 7386 /* Allocate buffer for storing hex version of the NSID */ 7387 buflen = nsid_len * 2 + 1; 7388 buf = isc_mem_get(mctx, buflen); 7389 pbuf = isc_mem_get(mctx, nsid_len + 1); 7390 7391 /* Convert to hex */ 7392 p = buf; 7393 nsid = isc_buffer_current(opt); 7394 for (size_t i = 0; i < nsid_len; i++) { 7395 *p++ = hex[(nsid[i] >> 4) & 0xf]; 7396 *p++ = hex[nsid[i] & 0xf]; 7397 } 7398 *p = '\0'; 7399 7400 /* Make printable version */ 7401 p = pbuf; 7402 for (size_t i = 0; i < nsid_len; i++) { 7403 *p++ = isprint(nsid[i]) ? nsid[i] : '.'; 7404 } 7405 *p = '\0'; 7406 7407 isc_sockaddr_format(&query->addrinfo->sockaddr, addrbuf, 7408 sizeof(addrbuf)); 7409 isc_log_write(dns_lctx, DNS_LOGCATEGORY_NSID, DNS_LOGMODULE_RESOLVER, 7410 level, "received NSID %s (\"%s\") from %s", buf, pbuf, 7411 addrbuf); 7412 7413 isc_mem_put(mctx, pbuf, nsid_len + 1); 7414 isc_mem_put(mctx, buf, buflen); 7415 } 7416 7417 static bool 7418 iscname(dns_message_t *message, dns_name_t *name) { 7419 isc_result_t result; 7420 7421 result = dns_message_findname(message, DNS_SECTION_ANSWER, name, 7422 dns_rdatatype_cname, 0, NULL, NULL); 7423 return result == ISC_R_SUCCESS ? true : false; 7424 } 7425 7426 static bool 7427 betterreferral(respctx_t *rctx) { 7428 isc_result_t result; 7429 dns_name_t *name; 7430 dns_rdataset_t *rdataset; 7431 7432 for (result = dns_message_firstname(rctx->query->rmessage, 7433 DNS_SECTION_AUTHORITY); 7434 result == ISC_R_SUCCESS; 7435 result = dns_message_nextname(rctx->query->rmessage, 7436 DNS_SECTION_AUTHORITY)) 7437 { 7438 name = NULL; 7439 dns_message_currentname(rctx->query->rmessage, 7440 DNS_SECTION_AUTHORITY, &name); 7441 if (!isstrictsubdomain(name, rctx->fctx->domain)) { 7442 continue; 7443 } 7444 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 7445 rdataset = ISC_LIST_NEXT(rdataset, link)) 7446 { 7447 if (rdataset->type == dns_rdatatype_ns) { 7448 return true; 7449 } 7450 } 7451 } 7452 return false; 7453 } 7454 7455 /* 7456 * Handles responses received in response to iterative queries sent by 7457 * resquery_send(). Sets up a response context (respctx_t). 7458 */ 7459 static void 7460 resquery_response(isc_result_t eresult, isc_region_t *region, void *arg) { 7461 isc_result_t result; 7462 resquery_t *query = (resquery_t *)arg; 7463 fetchctx_t *fctx = NULL; 7464 respctx_t *rctx = NULL; 7465 7466 if (eresult == ISC_R_CANCELED) { 7467 return; 7468 } 7469 7470 REQUIRE(VALID_QUERY(query)); 7471 fctx = query->fctx; 7472 REQUIRE(VALID_FCTX(fctx)); 7473 REQUIRE(fctx->tid == isc_tid()); 7474 7475 QTRACE("response"); 7476 7477 if (eresult == ISC_R_SUCCESS) { 7478 if (isc_sockaddr_pf(&query->addrinfo->sockaddr) == PF_INET) { 7479 inc_stats(fctx->res, dns_resstatscounter_responsev4); 7480 } else { 7481 inc_stats(fctx->res, dns_resstatscounter_responsev6); 7482 } 7483 } 7484 7485 rctx = isc_mem_get(fctx->mctx, sizeof(*rctx)); 7486 rctx_respinit(query, fctx, eresult, region, rctx); 7487 7488 if (eresult == ISC_R_SHUTTINGDOWN || 7489 atomic_load_acquire(&fctx->res->exiting)) 7490 { 7491 result = ISC_R_SHUTTINGDOWN; 7492 FCTXTRACE("resolver shutting down"); 7493 rctx->finish = NULL; 7494 rctx_done(rctx, result); 7495 goto cleanup; 7496 } 7497 7498 result = rctx_timedout(rctx); 7499 if (result == ISC_R_COMPLETE) { 7500 goto cleanup; 7501 } 7502 7503 fctx->addrinfo = query->addrinfo; 7504 fctx->timeout = false; 7505 fctx->timeouts = 0; 7506 7507 /* 7508 * Check whether the dispatcher has failed; if so we're done 7509 */ 7510 result = rctx_dispfail(rctx); 7511 if (result == ISC_R_COMPLETE) { 7512 goto cleanup; 7513 } 7514 7515 if (query->tsig != NULL) { 7516 dns_message_setquerytsig(query->rmessage, query->tsig); 7517 } 7518 7519 if (query->tsigkey != NULL) { 7520 result = dns_message_settsigkey(query->rmessage, 7521 query->tsigkey); 7522 if (result != ISC_R_SUCCESS) { 7523 FCTXTRACE3("unable to set tsig key", result); 7524 rctx_done(rctx, result); 7525 goto cleanup; 7526 } 7527 } 7528 7529 dns_message_setclass(query->rmessage, fctx->res->rdclass); 7530 7531 if ((rctx->retryopts & DNS_FETCHOPT_TCP) == 0) { 7532 if ((rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0) { 7533 dns_adb_setudpsize( 7534 fctx->adb, query->addrinfo, 7535 isc_buffer_usedlength(&rctx->buffer)); 7536 } else { 7537 dns_adb_plainresponse(fctx->adb, query->addrinfo); 7538 } 7539 } 7540 7541 /* 7542 * Parse response message. 7543 */ 7544 result = rctx_parse(rctx); 7545 if (result == ISC_R_COMPLETE) { 7546 goto cleanup; 7547 } 7548 7549 /* 7550 * Log the incoming packet. 7551 */ 7552 rctx_logpacket(rctx); 7553 7554 if (query->rmessage->rdclass != fctx->res->rdclass) { 7555 rctx->resend = true; 7556 FCTXTRACE("bad class"); 7557 rctx_done(rctx, result); 7558 goto cleanup; 7559 } 7560 7561 /* 7562 * Process receive opt record. 7563 */ 7564 rctx->opt = dns_message_getopt(query->rmessage); 7565 if (rctx->opt != NULL) { 7566 rctx_opt(rctx); 7567 } 7568 7569 if (query->rmessage->cc_bad && 7570 (rctx->retryopts & DNS_FETCHOPT_TCP) == 0) 7571 { 7572 /* 7573 * If the COOKIE is bad, assume it is an attack and 7574 * keep listening for a good answer. 7575 */ 7576 rctx->nextitem = true; 7577 if (isc_log_wouldlog(dns_lctx, ISC_LOG_INFO)) { 7578 char addrbuf[ISC_SOCKADDR_FORMATSIZE]; 7579 isc_sockaddr_format(&query->addrinfo->sockaddr, addrbuf, 7580 sizeof(addrbuf)); 7581 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 7582 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 7583 "bad cookie from %s", addrbuf); 7584 } 7585 rctx_done(rctx, result); 7586 goto cleanup; 7587 } 7588 7589 /* 7590 * Is the question the same as the one we asked? 7591 * NOERROR/NXDOMAIN/YXDOMAIN/REFUSED/SERVFAIL/BADCOOKIE must 7592 * have the same question. FORMERR/NOTIMP if they have a 7593 * question section then it must match. 7594 */ 7595 switch (query->rmessage->rcode) { 7596 case dns_rcode_notimp: 7597 case dns_rcode_formerr: 7598 if (query->rmessage->counts[DNS_SECTION_QUESTION] == 0) { 7599 break; 7600 } 7601 FALLTHROUGH; 7602 case dns_rcode_nxrrset: /* Not expected. */ 7603 case dns_rcode_badcookie: 7604 case dns_rcode_noerror: 7605 case dns_rcode_nxdomain: 7606 case dns_rcode_yxdomain: 7607 case dns_rcode_refused: 7608 case dns_rcode_servfail: 7609 default: 7610 result = same_question(fctx, query->rmessage); 7611 if (result != ISC_R_SUCCESS) { 7612 FCTXTRACE3("question section invalid", result); 7613 rctx->nextitem = true; 7614 rctx_done(rctx, result); 7615 goto cleanup; 7616 } 7617 break; 7618 } 7619 7620 if (query->rmessage->tsigkey == NULL && query->rmessage->tsig == NULL && 7621 query->rmessage->sig0 != NULL) 7622 { 7623 /* 7624 * If the message is not TSIG-signed (which has priorty) and is 7625 * SIG(0)-signed (which consumes more resources), then run an 7626 * asynchronous check. 7627 */ 7628 result = dns_message_checksig_async( 7629 query->rmessage, fctx->res->view, fctx->loop, 7630 resquery_response_continue, rctx); 7631 INSIST(result == DNS_R_WAIT); 7632 } else { 7633 /* 7634 * If the message is signed, check the signature. If not, this 7635 * returns success anyway. 7636 */ 7637 result = dns_message_checksig(query->rmessage, fctx->res->view); 7638 resquery_response_continue(rctx, result); 7639 } 7640 7641 return; 7642 7643 cleanup: 7644 resquery_detach(&rctx->query); 7645 isc_mem_putanddetach(&rctx->mctx, rctx, sizeof(*rctx)); 7646 } 7647 7648 static isc_result_t 7649 rctx_cookiecheck(respctx_t *rctx) { 7650 fetchctx_t *fctx = rctx->fctx; 7651 resquery_t *query = rctx->query; 7652 7653 /* 7654 * If the message was secured or TCP is already in the 7655 * retry flags, no need to continue. 7656 */ 7657 if (rctx->secured || (rctx->retryopts & DNS_FETCHOPT_TCP) != 0) { 7658 return ISC_R_SUCCESS; 7659 } 7660 7661 /* 7662 * If we've had a cookie from the same server previously, 7663 * retry with TCP. This may be a misconfigured anycast server 7664 * or an attempt to send a spoofed response. 7665 */ 7666 if (dns_adb_getcookie(query->addrinfo, NULL, 0) > CLIENT_COOKIE_SIZE) { 7667 if (isc_log_wouldlog(dns_lctx, ISC_LOG_INFO)) { 7668 char addrbuf[ISC_SOCKADDR_FORMATSIZE]; 7669 isc_sockaddr_format(&query->addrinfo->sockaddr, addrbuf, 7670 sizeof(addrbuf)); 7671 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 7672 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 7673 "missing expected cookie from %s", 7674 addrbuf); 7675 } 7676 rctx->retryopts |= DNS_FETCHOPT_TCP; 7677 rctx->resend = true; 7678 rctx_done(rctx, ISC_R_SUCCESS); 7679 return ISC_R_COMPLETE; 7680 } 7681 7682 /* 7683 * Retry over TCP if require-cookie is true. 7684 */ 7685 if (fctx->res->view->peers != NULL) { 7686 isc_result_t result; 7687 dns_peer_t *peer = NULL; 7688 bool required = false; 7689 isc_netaddr_t netaddr; 7690 7691 isc_netaddr_fromsockaddr(&netaddr, &query->addrinfo->sockaddr); 7692 result = dns_peerlist_peerbyaddr(fctx->res->view->peers, 7693 &netaddr, &peer); 7694 if (result == ISC_R_SUCCESS) { 7695 dns_peer_getrequirecookie(peer, &required); 7696 } 7697 if (!required) { 7698 return ISC_R_SUCCESS; 7699 } 7700 7701 if (isc_log_wouldlog(dns_lctx, ISC_LOG_INFO)) { 7702 char addrbuf[ISC_SOCKADDR_FORMATSIZE]; 7703 isc_sockaddr_format(&query->addrinfo->sockaddr, addrbuf, 7704 sizeof(addrbuf)); 7705 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 7706 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 7707 "missing required cookie from %s", 7708 addrbuf); 7709 } 7710 7711 rctx->retryopts |= DNS_FETCHOPT_TCP; 7712 rctx->resend = true; 7713 rctx_done(rctx, ISC_R_SUCCESS); 7714 return ISC_R_COMPLETE; 7715 } 7716 7717 return ISC_R_SUCCESS; 7718 } 7719 7720 static bool 7721 rctx_need_tcpretry(respctx_t *rctx) { 7722 resquery_t *query = rctx->query; 7723 if ((rctx->retryopts & DNS_FETCHOPT_TCP) != 0) { 7724 /* TCP is already in the retry flags */ 7725 return false; 7726 } 7727 7728 /* 7729 * If the message was secured, no need to continue. 7730 */ 7731 if (rctx->secured) { 7732 return false; 7733 } 7734 7735 /* 7736 * Currently the only extra reason why we might need to 7737 * retry a UDP response over TCP is a DNAME in the message. 7738 */ 7739 if (dns_message_hasdname(query->rmessage)) { 7740 return true; 7741 } 7742 7743 return false; 7744 } 7745 7746 static isc_result_t 7747 rctx_tcpretry(respctx_t *rctx) { 7748 /* 7749 * Do we need to retry a UDP response over TCP? 7750 */ 7751 if (rctx_need_tcpretry(rctx)) { 7752 rctx->retryopts |= DNS_FETCHOPT_TCP; 7753 rctx->resend = true; 7754 rctx_done(rctx, ISC_R_SUCCESS); 7755 return ISC_R_COMPLETE; 7756 } 7757 7758 return ISC_R_SUCCESS; 7759 } 7760 7761 static void 7762 resquery_response_continue(void *arg, isc_result_t result) { 7763 respctx_t *rctx = arg; 7764 fetchctx_t *fctx = rctx->fctx; 7765 resquery_t *query = rctx->query; 7766 7767 if (result != ISC_R_SUCCESS) { 7768 FCTXTRACE3("signature check failed", result); 7769 if (result == DNS_R_UNEXPECTEDTSIG || 7770 result == DNS_R_EXPECTEDTSIG) 7771 { 7772 rctx->nextitem = true; 7773 } 7774 rctx_done(rctx, result); 7775 goto cleanup; 7776 } 7777 7778 /* 7779 * Remember whether this message was signed or had a 7780 * valid client cookie; if not, we may need to retry over 7781 * TCP later. 7782 */ 7783 if (query->rmessage->cc_ok || query->rmessage->tsig != NULL || 7784 query->rmessage->sig0 != NULL) 7785 { 7786 rctx->secured = true; 7787 } 7788 7789 /* 7790 * The dispatcher should ensure we only get responses with QR 7791 * set. 7792 */ 7793 INSIST((query->rmessage->flags & DNS_MESSAGEFLAG_QR) != 0); 7794 7795 /* 7796 * Check for cookie issues; if found, maybe retry over TCP. 7797 */ 7798 result = rctx_cookiecheck(rctx); 7799 if (result == ISC_R_COMPLETE) { 7800 goto cleanup; 7801 } 7802 7803 /* 7804 * Check whether we need to retry over TCP for some other reason. 7805 */ 7806 result = rctx_tcpretry(rctx); 7807 if (result == ISC_R_COMPLETE) { 7808 goto cleanup; 7809 } 7810 7811 /* 7812 * Check for EDNS issues. 7813 */ 7814 rctx_edns(rctx); 7815 7816 /* 7817 * Deal with truncated responses by retrying using TCP. 7818 */ 7819 if ((query->rmessage->flags & DNS_MESSAGEFLAG_TC) != 0) { 7820 rctx->truncated = true; 7821 } 7822 7823 if (rctx->truncated) { 7824 inc_stats(fctx->res, dns_resstatscounter_truncated); 7825 if ((rctx->retryopts & DNS_FETCHOPT_TCP) != 0) { 7826 rctx->broken_server = DNS_R_TRUNCATEDTCP; 7827 rctx->next_server = true; 7828 } else { 7829 rctx->retryopts |= DNS_FETCHOPT_TCP; 7830 rctx->resend = true; 7831 } 7832 FCTXTRACE3("message truncated", result); 7833 rctx_done(rctx, result); 7834 goto cleanup; 7835 } 7836 7837 /* 7838 * Is it a query response? 7839 */ 7840 if (query->rmessage->opcode != dns_opcode_query) { 7841 rctx->broken_server = DNS_R_UNEXPECTEDOPCODE; 7842 rctx->next_server = true; 7843 FCTXTRACE("invalid message opcode"); 7844 rctx_done(rctx, result); 7845 goto cleanup; 7846 } 7847 7848 /* 7849 * Update statistics about erroneous responses. 7850 */ 7851 switch (query->rmessage->rcode) { 7852 case dns_rcode_noerror: 7853 /* no error */ 7854 break; 7855 case dns_rcode_nxdomain: 7856 inc_stats(fctx->res, dns_resstatscounter_nxdomain); 7857 break; 7858 case dns_rcode_servfail: 7859 inc_stats(fctx->res, dns_resstatscounter_servfail); 7860 break; 7861 case dns_rcode_formerr: 7862 inc_stats(fctx->res, dns_resstatscounter_formerr); 7863 break; 7864 case dns_rcode_refused: 7865 inc_stats(fctx->res, dns_resstatscounter_refused); 7866 break; 7867 case dns_rcode_badvers: 7868 inc_stats(fctx->res, dns_resstatscounter_badvers); 7869 break; 7870 case dns_rcode_badcookie: 7871 inc_stats(fctx->res, dns_resstatscounter_badcookie); 7872 break; 7873 default: 7874 inc_stats(fctx->res, dns_resstatscounter_othererror); 7875 break; 7876 } 7877 7878 /* 7879 * Bad server? 7880 */ 7881 result = rctx_badserver(rctx, result); 7882 if (result == ISC_R_COMPLETE) { 7883 goto cleanup; 7884 } 7885 7886 /* 7887 * Lame server? 7888 */ 7889 result = rctx_lameserver(rctx); 7890 if (result == ISC_R_COMPLETE) { 7891 goto cleanup; 7892 } 7893 7894 /* 7895 * Optionally call dns_rdata_checkowner() and 7896 * dns_rdata_checknames() to validate the names in the response 7897 * message. 7898 */ 7899 if ((fctx->res->options & DNS_RESOLVER_CHECKNAMES) != 0) { 7900 checknames(query->rmessage); 7901 } 7902 7903 /* 7904 * Clear cache bits. 7905 */ 7906 FCTX_ATTR_CLR(fctx, FCTX_ATTR_WANTNCACHE | FCTX_ATTR_WANTCACHE); 7907 7908 /* 7909 * Did we get any answers? 7910 */ 7911 if (query->rmessage->counts[DNS_SECTION_ANSWER] > 0 && 7912 (query->rmessage->rcode == dns_rcode_noerror || 7913 query->rmessage->rcode == dns_rcode_yxdomain || 7914 query->rmessage->rcode == dns_rcode_nxdomain)) 7915 { 7916 result = rctx_answer(rctx); 7917 if (result == ISC_R_COMPLETE) { 7918 goto cleanup; 7919 } 7920 } else if (query->rmessage->counts[DNS_SECTION_AUTHORITY] > 0 || 7921 query->rmessage->rcode == dns_rcode_noerror || 7922 query->rmessage->rcode == dns_rcode_nxdomain) 7923 { 7924 /* 7925 * This might be an NXDOMAIN, NXRRSET, or referral. 7926 * Call rctx_answer_none() to determine which it is. 7927 */ 7928 result = rctx_answer_none(rctx); 7929 switch (result) { 7930 case ISC_R_SUCCESS: 7931 case DNS_R_CHASEDSSERVERS: 7932 break; 7933 case DNS_R_DELEGATION: 7934 /* 7935 * With NOFOLLOW we want to pass return 7936 * DNS_R_DELEGATION to resume_qmin. 7937 */ 7938 if ((fctx->options & DNS_FETCHOPT_NOFOLLOW) == 0) { 7939 result = ISC_R_SUCCESS; 7940 } 7941 break; 7942 default: 7943 /* 7944 * Something has gone wrong. 7945 */ 7946 if (result == DNS_R_FORMERR) { 7947 rctx->next_server = true; 7948 } 7949 FCTXTRACE3("rctx_answer_none", result); 7950 rctx_done(rctx, result); 7951 goto cleanup; 7952 } 7953 } else { 7954 /* 7955 * The server is insane. 7956 */ 7957 /* XXXRTH Log */ 7958 rctx->broken_server = DNS_R_UNEXPECTEDRCODE; 7959 rctx->next_server = true; 7960 FCTXTRACE("broken server: unexpected rcode"); 7961 rctx_done(rctx, result); 7962 goto cleanup; 7963 } 7964 7965 /* 7966 * Follow additional section data chains. 7967 */ 7968 rctx_additional(rctx); 7969 7970 /* 7971 * Cache the cacheable parts of the message. This may also 7972 * cause work to be queued to the DNSSEC validator. 7973 */ 7974 if (WANTCACHE(fctx)) { 7975 isc_result_t tresult; 7976 tresult = cache_message(fctx, query->rmessage, query->addrinfo, 7977 rctx->now); 7978 if (tresult != ISC_R_SUCCESS) { 7979 FCTXTRACE3("cache_message complete", tresult); 7980 rctx_done(rctx, tresult); 7981 goto cleanup; 7982 } 7983 } 7984 7985 /* 7986 * Negative caching 7987 */ 7988 rctx_ncache(rctx); 7989 7990 FCTXTRACE("resquery_response done"); 7991 rctx_done(rctx, result); 7992 7993 cleanup: 7994 resquery_detach(&rctx->query); 7995 isc_mem_putanddetach(&rctx->mctx, rctx, sizeof(*rctx)); 7996 } 7997 7998 /* 7999 * rctx_respinit(): 8000 * Initialize the response context structure 'rctx' to all zeroes, then 8001 * set the loop, event, query and fctx information from 8002 * resquery_response(). 8003 */ 8004 static void 8005 rctx_respinit(resquery_t *query, fetchctx_t *fctx, isc_result_t result, 8006 isc_region_t *region, respctx_t *rctx) { 8007 *rctx = (respctx_t){ .result = result, 8008 .query = resquery_ref(query), 8009 .fctx = fctx, 8010 .broken_type = badns_response, 8011 .retryopts = query->options }; 8012 if (result == ISC_R_SUCCESS) { 8013 REQUIRE(region != NULL); 8014 isc_buffer_init(&rctx->buffer, region->base, region->length); 8015 isc_buffer_add(&rctx->buffer, region->length); 8016 } else { 8017 isc_buffer_initnull(&rctx->buffer); 8018 } 8019 rctx->tnow = isc_time_now(); 8020 rctx->finish = &rctx->tnow; 8021 rctx->now = (isc_stdtime_t)isc_time_seconds(&rctx->tnow); 8022 isc_mem_attach(fctx->mctx, &rctx->mctx); 8023 } 8024 8025 /* 8026 * rctx_answer_init(): 8027 * Clear and reinitialize those portions of 'rctx' that will be needed 8028 * when scanning the answer section of the response message. This can be 8029 * called more than once if scanning needs to be restarted (though 8030 * currently there are no cases in which this occurs). 8031 */ 8032 static void 8033 rctx_answer_init(respctx_t *rctx) { 8034 fetchctx_t *fctx = rctx->fctx; 8035 8036 rctx->aa = ((rctx->query->rmessage->flags & DNS_MESSAGEFLAG_AA) != 0); 8037 if (rctx->aa) { 8038 rctx->trust = dns_trust_authanswer; 8039 } else { 8040 rctx->trust = dns_trust_answer; 8041 } 8042 8043 /* 8044 * There can be multiple RRSIG and SIG records at a name so 8045 * we treat these types as a subset of ANY. 8046 */ 8047 rctx->type = fctx->type; 8048 if (rctx->type == dns_rdatatype_rrsig || 8049 rctx->type == dns_rdatatype_sig) 8050 { 8051 rctx->type = dns_rdatatype_any; 8052 } 8053 8054 /* 8055 * Bigger than any valid DNAME label count. 8056 */ 8057 rctx->dname_labels = dns_name_countlabels(fctx->name); 8058 rctx->domain_labels = dns_name_countlabels(fctx->domain); 8059 8060 rctx->found_type = dns_rdatatype_none; 8061 8062 rctx->aname = NULL; 8063 rctx->ardataset = NULL; 8064 8065 rctx->cname = NULL; 8066 rctx->crdataset = NULL; 8067 8068 rctx->dname = NULL; 8069 rctx->drdataset = NULL; 8070 8071 rctx->ns_name = NULL; 8072 rctx->ns_rdataset = NULL; 8073 8074 rctx->soa_name = NULL; 8075 rctx->ds_name = NULL; 8076 rctx->found_name = NULL; 8077 } 8078 8079 /* 8080 * rctx_dispfail(): 8081 * Handle the case where the dispatcher failed 8082 */ 8083 static isc_result_t 8084 rctx_dispfail(respctx_t *rctx) { 8085 fetchctx_t *fctx = rctx->fctx; 8086 8087 if (rctx->result == ISC_R_SUCCESS) { 8088 return ISC_R_SUCCESS; 8089 } 8090 8091 /* 8092 * There's no hope for this response. 8093 */ 8094 rctx->next_server = true; 8095 8096 /* 8097 * If this is a network failure, the operation is cancelled, 8098 * or the network manager is being shut down, we mark the server 8099 * as bad so that we won't try it for this fetch again. Also 8100 * adjust finish and no_response so that we penalize this 8101 * address in SRTT adjustments later. 8102 */ 8103 switch (rctx->result) { 8104 case ISC_R_EOF: 8105 case ISC_R_HOSTDOWN: 8106 case ISC_R_HOSTUNREACH: 8107 case ISC_R_NETDOWN: 8108 case ISC_R_NETUNREACH: 8109 case ISC_R_CONNREFUSED: 8110 case ISC_R_CONNECTIONRESET: 8111 case ISC_R_INVALIDPROTO: 8112 case ISC_R_CANCELED: 8113 case ISC_R_SHUTTINGDOWN: 8114 rctx->broken_server = rctx->result; 8115 rctx->broken_type = badns_unreachable; 8116 rctx->finish = NULL; 8117 rctx->no_response = true; 8118 break; 8119 default: 8120 break; 8121 } 8122 8123 FCTXTRACE3("dispatcher failure", rctx->result); 8124 rctx_done(rctx, ISC_R_SUCCESS); 8125 return ISC_R_COMPLETE; 8126 } 8127 8128 /* 8129 * rctx_timedout(): 8130 * Handle the case where a dispatch read timed out. 8131 */ 8132 static isc_result_t 8133 rctx_timedout(respctx_t *rctx) { 8134 fetchctx_t *fctx = rctx->fctx; 8135 8136 if (rctx->result == ISC_R_TIMEDOUT) { 8137 isc_time_t now; 8138 8139 inc_stats(fctx->res, dns_resstatscounter_querytimeout); 8140 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 8141 fctx->timeout = true; 8142 fctx->timeouts++; 8143 8144 rctx->no_response = true; 8145 rctx->finish = NULL; 8146 8147 now = isc_time_now(); 8148 /* netmgr timeouts are accurate to the millisecond */ 8149 if (isc_time_microdiff(&fctx->expires, &now) < US_PER_MS) { 8150 FCTXTRACE("query timed out; stopped trying to make " 8151 "fetch happen"); 8152 dns_ede_add(&fctx->edectx, DNS_EDE_NOREACHABLEAUTH, 8153 NULL); 8154 } else { 8155 FCTXTRACE("query timed out; trying next server"); 8156 /* try next server */ 8157 rctx->next_server = true; 8158 } 8159 8160 rctx_done(rctx, rctx->result); 8161 return ISC_R_COMPLETE; 8162 } 8163 8164 return ISC_R_SUCCESS; 8165 } 8166 8167 /* 8168 * rctx_parse(): 8169 * Parse the response message. 8170 */ 8171 static isc_result_t 8172 rctx_parse(respctx_t *rctx) { 8173 isc_result_t result; 8174 fetchctx_t *fctx = rctx->fctx; 8175 resquery_t *query = rctx->query; 8176 8177 result = dns_message_parse(query->rmessage, &rctx->buffer, 0); 8178 if (result == ISC_R_SUCCESS) { 8179 return ISC_R_SUCCESS; 8180 } 8181 8182 FCTXTRACE3("message failed to parse", result); 8183 8184 switch (result) { 8185 case ISC_R_UNEXPECTEDEND: 8186 if (query->rmessage->question_ok && 8187 (query->rmessage->flags & DNS_MESSAGEFLAG_TC) != 0 && 8188 (rctx->retryopts & DNS_FETCHOPT_TCP) == 0) 8189 { 8190 /* 8191 * We defer retrying via TCP for a bit so we can 8192 * check out this message further. 8193 */ 8194 rctx->truncated = true; 8195 return ISC_R_SUCCESS; 8196 } 8197 8198 /* 8199 * Either the message ended prematurely, 8200 * and/or wasn't marked as being truncated, 8201 * and/or this is a response to a query we 8202 * sent over TCP. In all of these cases, 8203 * something is wrong with the remote 8204 * server and we don't want to retry using 8205 * TCP. 8206 */ 8207 if ((rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0) { 8208 /* 8209 * The problem might be that they 8210 * don't understand EDNS0. Turn it 8211 * off and try again. 8212 */ 8213 rctx->retryopts |= DNS_FETCHOPT_NOEDNS0; 8214 rctx->resend = true; 8215 inc_stats(fctx->res, dns_resstatscounter_edns0fail); 8216 } else { 8217 rctx->broken_server = result; 8218 rctx->next_server = true; 8219 } 8220 8221 rctx_done(rctx, result); 8222 break; 8223 case DNS_R_FORMERR: 8224 if ((rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0) { 8225 /* 8226 * The problem might be that they 8227 * don't understand EDNS0. Turn it 8228 * off and try again. 8229 */ 8230 rctx->retryopts |= DNS_FETCHOPT_NOEDNS0; 8231 rctx->resend = true; 8232 inc_stats(fctx->res, dns_resstatscounter_edns0fail); 8233 } else { 8234 rctx->broken_server = DNS_R_UNEXPECTEDRCODE; 8235 rctx->next_server = true; 8236 } 8237 8238 rctx_done(rctx, result); 8239 break; 8240 default: 8241 /* 8242 * Something bad has happened. 8243 */ 8244 rctx_done(rctx, result); 8245 break; 8246 } 8247 8248 return ISC_R_COMPLETE; 8249 } 8250 8251 /* 8252 * rctx_opt(): 8253 * Process the OPT record in the response. 8254 */ 8255 static void 8256 rctx_opt(respctx_t *rctx) { 8257 resquery_t *query = rctx->query; 8258 fetchctx_t *fctx = rctx->fctx; 8259 dns_rdata_t rdata; 8260 isc_buffer_t optbuf; 8261 isc_result_t result; 8262 bool seen_cookie = false; 8263 bool seen_nsid = false; 8264 8265 result = dns_rdataset_first(rctx->opt); 8266 if (result != ISC_R_SUCCESS) { 8267 return; 8268 } 8269 8270 dns_rdata_init(&rdata); 8271 dns_rdataset_current(rctx->opt, &rdata); 8272 isc_buffer_init(&optbuf, rdata.data, rdata.length); 8273 isc_buffer_add(&optbuf, rdata.length); 8274 8275 while (isc_buffer_remaininglength(&optbuf) >= 4) { 8276 uint16_t optcode; 8277 uint16_t optlen; 8278 unsigned char *optvalue; 8279 unsigned char cookie[CLIENT_COOKIE_SIZE]; 8280 optcode = isc_buffer_getuint16(&optbuf); 8281 optlen = isc_buffer_getuint16(&optbuf); 8282 INSIST(optlen <= isc_buffer_remaininglength(&optbuf)); 8283 switch (optcode) { 8284 case DNS_OPT_NSID: 8285 if (seen_nsid) { 8286 break; 8287 } 8288 seen_nsid = true; 8289 8290 if ((query->options & DNS_FETCHOPT_WANTNSID) != 0) { 8291 log_nsid(&optbuf, optlen, query, ISC_LOG_INFO, 8292 fctx->mctx); 8293 } 8294 break; 8295 case DNS_OPT_COOKIE: 8296 /* Only process the first cookie option. */ 8297 if (seen_cookie) { 8298 break; 8299 } 8300 seen_cookie = true; 8301 8302 optvalue = isc_buffer_current(&optbuf); 8303 compute_cc(query, cookie, sizeof(cookie)); 8304 INSIST(query->rmessage->cc_bad == 0 && 8305 query->rmessage->cc_ok == 0); 8306 8307 inc_stats(fctx->res, dns_resstatscounter_cookiein); 8308 8309 if (optlen < CLIENT_COOKIE_SIZE || 8310 memcmp(cookie, optvalue, CLIENT_COOKIE_SIZE) != 0) 8311 { 8312 query->rmessage->cc_bad = 1; 8313 break; 8314 } 8315 8316 /* Cookie OK */ 8317 if (optlen == CLIENT_COOKIE_SIZE) { 8318 query->rmessage->cc_echoed = 1; 8319 } else { 8320 query->rmessage->cc_ok = 1; 8321 inc_stats(fctx->res, 8322 dns_resstatscounter_cookieok); 8323 dns_adb_setcookie(fctx->adb, query->addrinfo, 8324 optvalue, optlen); 8325 } 8326 break; 8327 default: 8328 break; 8329 } 8330 isc_buffer_forward(&optbuf, optlen); 8331 } 8332 INSIST(isc_buffer_remaininglength(&optbuf) == 0U); 8333 } 8334 8335 /* 8336 * rctx_edns(): 8337 * Determine whether the remote server is using EDNS correctly or 8338 * incorrectly and record that information if needed. 8339 */ 8340 static void 8341 rctx_edns(respctx_t *rctx) { 8342 resquery_t *query = rctx->query; 8343 fetchctx_t *fctx = rctx->fctx; 8344 8345 /* 8346 * If we get a non error EDNS response record the fact so we 8347 * won't fallback to plain DNS in the future for this server. 8348 */ 8349 if (rctx->opt != NULL && !EDNSOK(query->addrinfo) && 8350 (rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0 && 8351 (query->rmessage->rcode == dns_rcode_noerror || 8352 query->rmessage->rcode == dns_rcode_nxdomain || 8353 query->rmessage->rcode == dns_rcode_refused || 8354 query->rmessage->rcode == dns_rcode_yxdomain)) 8355 { 8356 dns_adb_changeflags(fctx->adb, query->addrinfo, 8357 FCTX_ADDRINFO_EDNSOK, FCTX_ADDRINFO_EDNSOK); 8358 } 8359 } 8360 8361 /* 8362 * rctx_answer(): 8363 * We might have answers, or we might have a malformed delegation with 8364 * records in the answer section. Call rctx_answer_positive() or 8365 * rctx_answer_none() as appropriate. 8366 */ 8367 static isc_result_t 8368 rctx_answer(respctx_t *rctx) { 8369 isc_result_t result; 8370 fetchctx_t *fctx = rctx->fctx; 8371 resquery_t *query = rctx->query; 8372 8373 if ((query->rmessage->flags & DNS_MESSAGEFLAG_AA) != 0 || 8374 ISFORWARDER(query->addrinfo)) 8375 { 8376 result = rctx_answer_positive(rctx); 8377 if (result != ISC_R_SUCCESS) { 8378 FCTXTRACE3("rctx_answer_positive (AA/fwd)", result); 8379 } 8380 } else if (iscname(query->rmessage, fctx->name) && 8381 fctx->type != dns_rdatatype_any && 8382 fctx->type != dns_rdatatype_cname) 8383 { 8384 /* 8385 * A BIND8 server could return a non-authoritative 8386 * answer when a CNAME is followed. We should treat 8387 * it as a valid answer. 8388 */ 8389 result = rctx_answer_positive(rctx); 8390 if (result != ISC_R_SUCCESS) { 8391 FCTXTRACE3("rctx_answer_positive (!ANY/!CNAME)", 8392 result); 8393 } 8394 } else if (fctx->type != dns_rdatatype_ns && !betterreferral(rctx)) { 8395 result = rctx_answer_positive(rctx); 8396 if (result != ISC_R_SUCCESS) { 8397 FCTXTRACE3("rctx_answer_positive (!NS)", result); 8398 } 8399 } else { 8400 /* 8401 * This may be a delegation. First let's check for 8402 */ 8403 8404 if (fctx->type == dns_rdatatype_ns) { 8405 /* 8406 * A BIND 8 server could incorrectly return a 8407 * non-authoritative answer to an NS query 8408 * instead of a referral. Since this answer 8409 * lacks the SIGs necessary to do DNSSEC 8410 * validation, we must invoke the following 8411 * special kludge to treat it as a referral. 8412 */ 8413 rctx->ns_in_answer = true; 8414 result = rctx_answer_none(rctx); 8415 if (result != ISC_R_SUCCESS) { 8416 FCTXTRACE3("rctx_answer_none (NS)", result); 8417 } 8418 } else { 8419 /* 8420 * Some other servers may still somehow include 8421 * an answer when it should return a referral 8422 * with an empty answer. Check to see if we can 8423 * treat this as a referral by ignoring the 8424 * answer. Further more, there may be an 8425 * implementation that moves A/AAAA glue records 8426 * to the answer section for that type of 8427 * delegation when the query is for that glue 8428 * record. glue_in_answer will handle 8429 * such a corner case. 8430 */ 8431 rctx->glue_in_answer = true; 8432 result = rctx_answer_none(rctx); 8433 if (result != ISC_R_SUCCESS) { 8434 FCTXTRACE3("rctx_answer_none", result); 8435 } 8436 } 8437 8438 if (result == DNS_R_DELEGATION) { 8439 /* 8440 * With NOFOLLOW we want to return DNS_R_DELEGATION to 8441 * resume_qmin. 8442 */ 8443 if ((rctx->fctx->options & DNS_FETCHOPT_NOFOLLOW) != 0) 8444 { 8445 return result; 8446 } 8447 result = ISC_R_SUCCESS; 8448 } else { 8449 /* 8450 * At this point, AA is not set, the response 8451 * is not a referral, and the server is not a 8452 * forwarder. It is technically lame and it's 8453 * easier to treat it as such than to figure out 8454 * some more elaborate course of action. 8455 */ 8456 rctx->broken_server = DNS_R_LAME; 8457 rctx->next_server = true; 8458 FCTXTRACE3("rctx_answer lame", result); 8459 rctx_done(rctx, result); 8460 return ISC_R_COMPLETE; 8461 } 8462 } 8463 8464 if (result != ISC_R_SUCCESS) { 8465 if (result == DNS_R_FORMERR) { 8466 rctx->next_server = true; 8467 } 8468 FCTXTRACE3("rctx_answer failed", result); 8469 rctx_done(rctx, result); 8470 return ISC_R_COMPLETE; 8471 } 8472 8473 return ISC_R_SUCCESS; 8474 } 8475 8476 /* 8477 * rctx_answer_positive(): 8478 * Handles positive responses. Depending which type of answer this is 8479 * (matching QNAME/QTYPE, CNAME, DNAME, ANY) calls the proper routine 8480 * to handle it (rctx_answer_match(), rctx_answer_cname(), 8481 * rctx_answer_dname(), rctx_answer_any()). 8482 */ 8483 static isc_result_t 8484 rctx_answer_positive(respctx_t *rctx) { 8485 isc_result_t result; 8486 fetchctx_t *fctx = rctx->fctx; 8487 8488 FCTXTRACE("rctx_answer_positive"); 8489 8490 rctx_answer_init(rctx); 8491 rctx_answer_scan(rctx); 8492 8493 /* 8494 * Determine which type of positive answer this is: 8495 * type ANY, CNAME, DNAME, or an answer matching QNAME/QTYPE. 8496 * Call the appropriate routine to handle the answer type. 8497 */ 8498 if (rctx->aname != NULL && rctx->type == dns_rdatatype_any) { 8499 result = rctx_answer_any(rctx); 8500 if (result == ISC_R_COMPLETE) { 8501 return rctx->result; 8502 } 8503 } else if (rctx->aname != NULL) { 8504 result = rctx_answer_match(rctx); 8505 if (result == ISC_R_COMPLETE) { 8506 return rctx->result; 8507 } 8508 } else if (rctx->cname != NULL) { 8509 result = rctx_answer_cname(rctx); 8510 if (result == ISC_R_COMPLETE) { 8511 return rctx->result; 8512 } 8513 } else if (rctx->dname != NULL) { 8514 result = rctx_answer_dname(rctx); 8515 if (result == ISC_R_COMPLETE) { 8516 return rctx->result; 8517 } 8518 } else { 8519 log_formerr(fctx, "reply has no answer"); 8520 return DNS_R_FORMERR; 8521 } 8522 8523 /* 8524 * This response is now potentially cacheable. 8525 */ 8526 FCTX_ATTR_SET(fctx, FCTX_ATTR_WANTCACHE); 8527 8528 /* 8529 * Did chaining end before we got the final answer? 8530 */ 8531 if (rctx->chaining) { 8532 return ISC_R_SUCCESS; 8533 } 8534 8535 /* 8536 * We didn't end with an incomplete chain, so the rcode should 8537 * be "no error". 8538 */ 8539 if (rctx->query->rmessage->rcode != dns_rcode_noerror) { 8540 log_formerr(fctx, "CNAME/DNAME chain complete, but RCODE " 8541 "indicates error"); 8542 return DNS_R_FORMERR; 8543 } 8544 8545 /* 8546 * Cache records in the authority section, if there are 8547 * any suitable for caching. 8548 */ 8549 rctx_authority_positive(rctx); 8550 8551 log_ns_ttl(fctx, "rctx_answer"); 8552 8553 if (rctx->ns_rdataset != NULL && 8554 dns_name_equal(fctx->domain, rctx->ns_name) && 8555 !dns_name_equal(rctx->ns_name, dns_rootname)) 8556 { 8557 trim_ns_ttl(fctx, rctx->ns_name, rctx->ns_rdataset); 8558 } 8559 8560 return ISC_R_SUCCESS; 8561 } 8562 8563 /* 8564 * rctx_answer_scan(): 8565 * Perform a single pass over the answer section of a response, looking 8566 * for an answer that matches QNAME/QTYPE, or a CNAME matching QNAME, or 8567 * a covering DNAME. If more than one rdataset is found matching these 8568 * criteria, then only one is kept. Order of preference is 1) the 8569 * shortest DNAME, 2) the first matching answer, or 3) the first CNAME. 8570 */ 8571 static void 8572 rctx_answer_scan(respctx_t *rctx) { 8573 isc_result_t result; 8574 fetchctx_t *fctx = rctx->fctx; 8575 dns_rdataset_t *rdataset = NULL; 8576 8577 for (result = dns_message_firstname(rctx->query->rmessage, 8578 DNS_SECTION_ANSWER); 8579 result == ISC_R_SUCCESS; 8580 result = dns_message_nextname(rctx->query->rmessage, 8581 DNS_SECTION_ANSWER)) 8582 { 8583 int order; 8584 unsigned int nlabels; 8585 dns_namereln_t namereln; 8586 dns_name_t *name = NULL; 8587 8588 dns_message_currentname(rctx->query->rmessage, 8589 DNS_SECTION_ANSWER, &name); 8590 namereln = dns_name_fullcompare(fctx->name, name, &order, 8591 &nlabels); 8592 switch (namereln) { 8593 case dns_namereln_equal: 8594 for (rdataset = ISC_LIST_HEAD(name->list); 8595 rdataset != NULL; 8596 rdataset = ISC_LIST_NEXT(rdataset, link)) 8597 { 8598 if (rdataset->type == rctx->type || 8599 rctx->type == dns_rdatatype_any) 8600 { 8601 rctx->aname = name; 8602 if (rctx->type != dns_rdatatype_any) { 8603 rctx->ardataset = rdataset; 8604 } 8605 break; 8606 } 8607 if (rdataset->type == dns_rdatatype_cname) { 8608 rctx->cname = name; 8609 rctx->crdataset = rdataset; 8610 break; 8611 } 8612 } 8613 break; 8614 8615 case dns_namereln_subdomain: 8616 /* 8617 * Don't accept DNAME from parent namespace. 8618 */ 8619 if (name_external(name, dns_rdatatype_dname, rctx)) { 8620 continue; 8621 } 8622 8623 /* 8624 * In-scope DNAME records must have at least 8625 * as many labels as the domain being queried. 8626 * They also must be less that qname's labels 8627 * and any previously found dname. 8628 */ 8629 if (nlabels >= rctx->dname_labels || 8630 nlabels < rctx->domain_labels) 8631 { 8632 continue; 8633 } 8634 8635 /* 8636 * We are looking for the shortest DNAME if 8637 * there are multiple ones (which there 8638 * shouldn't be). 8639 */ 8640 for (rdataset = ISC_LIST_HEAD(name->list); 8641 rdataset != NULL; 8642 rdataset = ISC_LIST_NEXT(rdataset, link)) 8643 { 8644 if (rdataset->type != dns_rdatatype_dname) { 8645 continue; 8646 } 8647 rctx->dname = name; 8648 rctx->drdataset = rdataset; 8649 rctx->dname_labels = nlabels; 8650 break; 8651 } 8652 break; 8653 default: 8654 break; 8655 } 8656 } 8657 8658 /* 8659 * If a DNAME was found, then any CNAME or other answer matching 8660 * QNAME that may also have been found must be ignored. 8661 * Similarly, if a matching answer was found along with a CNAME, 8662 * the CNAME must be ignored. 8663 */ 8664 if (rctx->dname != NULL) { 8665 rctx->aname = NULL; 8666 rctx->ardataset = NULL; 8667 rctx->cname = NULL; 8668 rctx->crdataset = NULL; 8669 } else if (rctx->aname != NULL) { 8670 rctx->cname = NULL; 8671 rctx->crdataset = NULL; 8672 } 8673 } 8674 8675 /* 8676 * rctx_answer_any(): 8677 * Handle responses to queries of type ANY. Scan the answer section, 8678 * and as long as each RRset is of a type that is valid in the answer 8679 * section, and the rdata isn't filtered, cache it. 8680 */ 8681 static isc_result_t 8682 rctx_answer_any(respctx_t *rctx) { 8683 dns_rdataset_t *rdataset = NULL; 8684 fetchctx_t *fctx = rctx->fctx; 8685 8686 for (rdataset = ISC_LIST_HEAD(rctx->aname->list); rdataset != NULL; 8687 rdataset = ISC_LIST_NEXT(rdataset, link)) 8688 { 8689 if (!validinanswer(rdataset, fctx)) { 8690 rctx->result = DNS_R_FORMERR; 8691 return ISC_R_COMPLETE; 8692 } 8693 8694 if ((fctx->type == dns_rdatatype_sig || 8695 fctx->type == dns_rdatatype_rrsig) && 8696 rdataset->type != fctx->type) 8697 { 8698 continue; 8699 } 8700 8701 if ((rdataset->type == dns_rdatatype_a || 8702 rdataset->type == dns_rdatatype_aaaa) && 8703 !is_answeraddress_allowed(fctx->res->view, rctx->aname, 8704 rdataset)) 8705 { 8706 rctx->result = DNS_R_SERVFAIL; 8707 return ISC_R_COMPLETE; 8708 } 8709 8710 if ((rdataset->type == dns_rdatatype_cname || 8711 rdataset->type == dns_rdatatype_dname) && 8712 !is_answertarget_allowed(fctx, fctx->name, rctx->aname, 8713 rdataset, NULL)) 8714 { 8715 rctx->result = DNS_R_SERVFAIL; 8716 return ISC_R_COMPLETE; 8717 } 8718 8719 rctx->aname->attributes.cache = true; 8720 rctx->aname->attributes.answer = true; 8721 rdataset->attributes |= DNS_RDATASETATTR_ANSWER; 8722 rdataset->attributes |= DNS_RDATASETATTR_CACHE; 8723 rdataset->trust = rctx->trust; 8724 8725 (void)dns_rdataset_additionaldata(rdataset, rctx->aname, 8726 check_related, rctx, 0); 8727 } 8728 8729 return ISC_R_SUCCESS; 8730 } 8731 8732 /* 8733 * rctx_answer_match(): 8734 * Handle responses that match the QNAME/QTYPE of the resolver query. 8735 * If QTYPE is valid in the answer section and the rdata isn't filtered, 8736 * the answer can be cached. If there is additional section data related 8737 * to the answer, it can be cached as well. 8738 */ 8739 static isc_result_t 8740 rctx_answer_match(respctx_t *rctx) { 8741 dns_rdataset_t *sigrdataset = NULL; 8742 fetchctx_t *fctx = rctx->fctx; 8743 8744 if (!validinanswer(rctx->ardataset, fctx)) { 8745 rctx->result = DNS_R_FORMERR; 8746 return ISC_R_COMPLETE; 8747 } 8748 8749 if ((rctx->ardataset->type == dns_rdatatype_a || 8750 rctx->ardataset->type == dns_rdatatype_aaaa) && 8751 !is_answeraddress_allowed(fctx->res->view, rctx->aname, 8752 rctx->ardataset)) 8753 { 8754 rctx->result = DNS_R_SERVFAIL; 8755 return ISC_R_COMPLETE; 8756 } 8757 if ((rctx->ardataset->type == dns_rdatatype_cname || 8758 rctx->ardataset->type == dns_rdatatype_dname) && 8759 rctx->type != rctx->ardataset->type && 8760 rctx->type != dns_rdatatype_any && 8761 !is_answertarget_allowed(fctx, fctx->name, rctx->aname, 8762 rctx->ardataset, NULL)) 8763 { 8764 rctx->result = DNS_R_SERVFAIL; 8765 return ISC_R_COMPLETE; 8766 } 8767 8768 rctx->aname->attributes.cache = true; 8769 rctx->aname->attributes.answer = true; 8770 rctx->ardataset->attributes |= DNS_RDATASETATTR_ANSWER; 8771 rctx->ardataset->attributes |= DNS_RDATASETATTR_CACHE; 8772 rctx->ardataset->trust = rctx->trust; 8773 (void)dns_rdataset_additionaldata(rctx->ardataset, rctx->aname, 8774 check_related, rctx, 0); 8775 8776 for (sigrdataset = ISC_LIST_HEAD(rctx->aname->list); 8777 sigrdataset != NULL; 8778 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 8779 { 8780 if (!validinanswer(sigrdataset, fctx)) { 8781 rctx->result = DNS_R_FORMERR; 8782 return ISC_R_COMPLETE; 8783 } 8784 8785 if (sigrdataset->type != dns_rdatatype_rrsig || 8786 sigrdataset->covers != rctx->type) 8787 { 8788 continue; 8789 } 8790 8791 sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG; 8792 sigrdataset->attributes |= DNS_RDATASETATTR_CACHE; 8793 sigrdataset->trust = rctx->trust; 8794 break; 8795 } 8796 8797 return ISC_R_SUCCESS; 8798 } 8799 8800 /* 8801 * rctx_answer_cname(): 8802 * Handle answers containing a CNAME. Cache the CNAME, and flag that 8803 * there may be additional chain answers to find. 8804 */ 8805 static isc_result_t 8806 rctx_answer_cname(respctx_t *rctx) { 8807 dns_rdataset_t *sigrdataset = NULL; 8808 fetchctx_t *fctx = rctx->fctx; 8809 8810 if (!validinanswer(rctx->crdataset, fctx)) { 8811 rctx->result = DNS_R_FORMERR; 8812 return ISC_R_COMPLETE; 8813 } 8814 8815 if (rctx->type == dns_rdatatype_rrsig || 8816 rctx->type == dns_rdatatype_key || rctx->type == dns_rdatatype_nsec) 8817 { 8818 char buf[DNS_RDATATYPE_FORMATSIZE]; 8819 dns_rdatatype_format(rctx->type, buf, sizeof(buf)); 8820 log_formerr(fctx, "CNAME response for %s RR", buf); 8821 rctx->result = DNS_R_FORMERR; 8822 return ISC_R_COMPLETE; 8823 } 8824 8825 if (!is_answertarget_allowed(fctx, fctx->name, rctx->cname, 8826 rctx->crdataset, NULL)) 8827 { 8828 rctx->result = DNS_R_SERVFAIL; 8829 return ISC_R_COMPLETE; 8830 } 8831 8832 rctx->cname->attributes.cache = true; 8833 rctx->cname->attributes.answer = true; 8834 rctx->cname->attributes.chaining = true; 8835 rctx->crdataset->attributes |= DNS_RDATASETATTR_ANSWER; 8836 rctx->crdataset->attributes |= DNS_RDATASETATTR_CACHE; 8837 rctx->crdataset->attributes |= DNS_RDATASETATTR_CHAINING; 8838 rctx->crdataset->trust = rctx->trust; 8839 8840 for (sigrdataset = ISC_LIST_HEAD(rctx->cname->list); 8841 sigrdataset != NULL; 8842 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 8843 { 8844 if (!validinanswer(sigrdataset, fctx)) { 8845 rctx->result = DNS_R_FORMERR; 8846 return ISC_R_COMPLETE; 8847 } 8848 8849 if (sigrdataset->type != dns_rdatatype_rrsig || 8850 sigrdataset->covers != dns_rdatatype_cname) 8851 { 8852 continue; 8853 } 8854 8855 sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG; 8856 sigrdataset->attributes |= DNS_RDATASETATTR_CACHE; 8857 sigrdataset->trust = rctx->trust; 8858 break; 8859 } 8860 8861 rctx->chaining = true; 8862 return ISC_R_SUCCESS; 8863 } 8864 8865 /* 8866 * rctx_answer_dname(): 8867 * Handle responses with covering DNAME records. 8868 */ 8869 static isc_result_t 8870 rctx_answer_dname(respctx_t *rctx) { 8871 dns_rdataset_t *sigrdataset = NULL; 8872 fetchctx_t *fctx = rctx->fctx; 8873 8874 if (!validinanswer(rctx->drdataset, fctx)) { 8875 rctx->result = DNS_R_FORMERR; 8876 return ISC_R_COMPLETE; 8877 } 8878 8879 if (!is_answertarget_allowed(fctx, fctx->name, rctx->dname, 8880 rctx->drdataset, &rctx->chaining)) 8881 { 8882 rctx->result = DNS_R_SERVFAIL; 8883 return ISC_R_COMPLETE; 8884 } 8885 8886 rctx->dname->attributes.cache = true; 8887 rctx->dname->attributes.answer = true; 8888 rctx->dname->attributes.chaining = true; 8889 rctx->drdataset->attributes |= DNS_RDATASETATTR_ANSWER; 8890 rctx->drdataset->attributes |= DNS_RDATASETATTR_CACHE; 8891 rctx->drdataset->attributes |= DNS_RDATASETATTR_CHAINING; 8892 rctx->drdataset->trust = rctx->trust; 8893 8894 for (sigrdataset = ISC_LIST_HEAD(rctx->dname->list); 8895 sigrdataset != NULL; 8896 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 8897 { 8898 if (!validinanswer(sigrdataset, fctx)) { 8899 rctx->result = DNS_R_FORMERR; 8900 return ISC_R_COMPLETE; 8901 } 8902 8903 if (sigrdataset->type != dns_rdatatype_rrsig || 8904 sigrdataset->covers != dns_rdatatype_dname) 8905 { 8906 continue; 8907 } 8908 8909 sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG; 8910 sigrdataset->attributes |= DNS_RDATASETATTR_CACHE; 8911 sigrdataset->trust = rctx->trust; 8912 break; 8913 } 8914 8915 return ISC_R_SUCCESS; 8916 } 8917 8918 /* 8919 * rctx_authority_positive(): 8920 * If a positive answer was received over TCP or secured with a cookie 8921 * or TSIG, examine the authority section. We expect names for all 8922 * rdatasets in this section to be subdomains of the domain being queried; 8923 * any that are not are skipped. We expect to find only *one* owner name; 8924 * any names after the first one processed are ignored. We expect to find 8925 * only rdatasets of type NS; all others are ignored. Whatever remains can 8926 * be cached at trust level authauthority or additional (depending on 8927 * whether the AA bit was set on the answer). 8928 */ 8929 static void 8930 rctx_authority_positive(respctx_t *rctx) { 8931 fetchctx_t *fctx = rctx->fctx; 8932 bool done = false; 8933 isc_result_t result; 8934 8935 /* If it's spoofable, don't cache it. */ 8936 if (!rctx->secured && (rctx->query->options & DNS_FETCHOPT_TCP) == 0) { 8937 return; 8938 } 8939 8940 result = dns_message_firstname(rctx->query->rmessage, 8941 DNS_SECTION_AUTHORITY); 8942 while (!done && result == ISC_R_SUCCESS) { 8943 dns_name_t *name = NULL; 8944 8945 dns_message_currentname(rctx->query->rmessage, 8946 DNS_SECTION_AUTHORITY, &name); 8947 8948 if (!name_external(name, dns_rdatatype_ns, rctx) && 8949 dns_name_issubdomain(fctx->name, name)) 8950 { 8951 dns_rdataset_t *rdataset = NULL; 8952 8953 /* 8954 * We expect to find NS or SIG NS rdatasets, and 8955 * nothing else. 8956 */ 8957 for (rdataset = ISC_LIST_HEAD(name->list); 8958 rdataset != NULL; 8959 rdataset = ISC_LIST_NEXT(rdataset, link)) 8960 { 8961 if (rdataset->type == dns_rdatatype_ns || 8962 (rdataset->type == dns_rdatatype_rrsig && 8963 rdataset->covers == dns_rdatatype_ns)) 8964 { 8965 name->attributes.cache = true; 8966 rdataset->attributes |= 8967 DNS_RDATASETATTR_CACHE; 8968 8969 if (rctx->aa) { 8970 rdataset->trust = 8971 dns_trust_authauthority; 8972 } else { 8973 rdataset->trust = 8974 dns_trust_additional; 8975 } 8976 8977 if (rdataset->type == dns_rdatatype_ns) 8978 { 8979 rctx->ns_name = name; 8980 rctx->ns_rdataset = rdataset; 8981 } 8982 /* 8983 * Mark any additional data 8984 * related to this rdataset. 8985 */ 8986 (void)dns_rdataset_additionaldata( 8987 rdataset, name, check_related, 8988 rctx, 0); 8989 done = true; 8990 } 8991 } 8992 } 8993 8994 result = dns_message_nextname(rctx->query->rmessage, 8995 DNS_SECTION_AUTHORITY); 8996 } 8997 } 8998 8999 /* 9000 * rctx_answer_none(): 9001 * Handles a response without an answer: this is either a negative 9002 * response (NXDOMAIN or NXRRSET) or a referral. Determine which it is, 9003 * then either scan the authority section for negative caching and 9004 * DNSSEC proof of nonexistence, or else call rctx_referral(). 9005 */ 9006 static isc_result_t 9007 rctx_answer_none(respctx_t *rctx) { 9008 isc_result_t result; 9009 fetchctx_t *fctx = rctx->fctx; 9010 9011 FCTXTRACE("rctx_answer_none"); 9012 9013 rctx_answer_init(rctx); 9014 9015 /* 9016 * Sometimes we can tell if its a negative response by looking 9017 * at the message header. 9018 */ 9019 if (rctx->query->rmessage->rcode == dns_rcode_nxdomain || 9020 (rctx->query->rmessage->counts[DNS_SECTION_ANSWER] == 0 && 9021 rctx->query->rmessage->counts[DNS_SECTION_AUTHORITY] == 0)) 9022 { 9023 rctx->negative = true; 9024 } 9025 9026 /* 9027 * Process the authority section 9028 */ 9029 result = rctx_authority_negative(rctx); 9030 if (result == ISC_R_COMPLETE) { 9031 return rctx->result; 9032 } 9033 9034 log_ns_ttl(fctx, "rctx_answer_none"); 9035 9036 if (rctx->ns_rdataset != NULL && 9037 dns_name_equal(fctx->domain, rctx->ns_name) && 9038 !dns_name_equal(rctx->ns_name, dns_rootname)) 9039 { 9040 trim_ns_ttl(fctx, rctx->ns_name, rctx->ns_rdataset); 9041 } 9042 9043 /* 9044 * A negative response has a SOA record (Type 2) 9045 * and a optional NS RRset (Type 1) or it has neither 9046 * a SOA or a NS RRset (Type 3, handled above) or 9047 * rcode is NXDOMAIN (handled above) in which case 9048 * the NS RRset is allowed (Type 4). 9049 */ 9050 if (rctx->soa_name != NULL) { 9051 rctx->negative = true; 9052 } 9053 9054 if (!rctx->ns_in_answer && !rctx->glue_in_answer) { 9055 /* 9056 * Process DNSSEC records in the authority section. 9057 */ 9058 result = rctx_authority_dnssec(rctx); 9059 if (result == ISC_R_COMPLETE) { 9060 return rctx->result; 9061 } 9062 } 9063 9064 /* 9065 * Trigger lookups for DNS nameservers. 9066 */ 9067 if (rctx->negative && 9068 rctx->query->rmessage->rcode == dns_rcode_noerror && 9069 fctx->type == dns_rdatatype_ds && rctx->soa_name != NULL && 9070 dns_name_equal(rctx->soa_name, fctx->name) && 9071 !dns_name_equal(fctx->name, dns_rootname)) 9072 { 9073 return DNS_R_CHASEDSSERVERS; 9074 } 9075 9076 /* 9077 * Did we find anything? 9078 */ 9079 if (!rctx->negative && rctx->ns_name == NULL) { 9080 /* 9081 * The responder is insane. 9082 */ 9083 if (rctx->found_name == NULL) { 9084 log_formerr(fctx, "invalid response"); 9085 return DNS_R_FORMERR; 9086 } 9087 if (!dns_name_issubdomain(rctx->found_name, fctx->domain)) { 9088 char nbuf[DNS_NAME_FORMATSIZE]; 9089 char dbuf[DNS_NAME_FORMATSIZE]; 9090 char tbuf[DNS_RDATATYPE_FORMATSIZE]; 9091 9092 dns_rdatatype_format(rctx->found_type, tbuf, 9093 sizeof(tbuf)); 9094 dns_name_format(rctx->found_name, nbuf, sizeof(nbuf)); 9095 dns_name_format(fctx->domain, dbuf, sizeof(dbuf)); 9096 9097 log_formerr(fctx, 9098 "Name %s (%s) not subdomain" 9099 " of zone %s -- invalid response", 9100 nbuf, tbuf, dbuf); 9101 } else { 9102 log_formerr(fctx, "invalid response"); 9103 } 9104 return DNS_R_FORMERR; 9105 } 9106 9107 /* 9108 * If we found both NS and SOA, they should be the same name. 9109 */ 9110 if (rctx->ns_name != NULL && rctx->soa_name != NULL && 9111 rctx->ns_name != rctx->soa_name) 9112 { 9113 log_formerr(fctx, "NS/SOA mismatch"); 9114 return DNS_R_FORMERR; 9115 } 9116 9117 /* 9118 * Handle a referral. 9119 */ 9120 result = rctx_referral(rctx); 9121 if (result == ISC_R_COMPLETE) { 9122 return rctx->result; 9123 } 9124 9125 /* 9126 * Since we're not doing a referral, we don't want to cache any 9127 * NS RRs we may have found. 9128 */ 9129 if (rctx->ns_name != NULL) { 9130 rctx->ns_name->attributes.cache = false; 9131 } 9132 9133 if (rctx->negative) { 9134 FCTX_ATTR_SET(fctx, FCTX_ATTR_WANTNCACHE); 9135 } 9136 9137 return ISC_R_SUCCESS; 9138 } 9139 9140 /* 9141 * rctx_authority_negative(): 9142 * Scan the authority section of a negative answer, handling 9143 * NS and SOA records. (Note that this function does *not* handle 9144 * DNSSEC records; those are addressed separately in 9145 * rctx_authority_dnssec() below.) 9146 */ 9147 static isc_result_t 9148 rctx_authority_negative(respctx_t *rctx) { 9149 isc_result_t result; 9150 fetchctx_t *fctx = rctx->fctx; 9151 dns_section_t section; 9152 dns_rdataset_t *rdataset = NULL; 9153 bool finished = false; 9154 9155 if (rctx->ns_in_answer) { 9156 INSIST(fctx->type == dns_rdatatype_ns); 9157 section = DNS_SECTION_ANSWER; 9158 } else { 9159 section = DNS_SECTION_AUTHORITY; 9160 } 9161 9162 result = dns_message_firstname(rctx->query->rmessage, section); 9163 if (result != ISC_R_SUCCESS) { 9164 return ISC_R_SUCCESS; 9165 } 9166 9167 while (!finished) { 9168 dns_name_t *name = NULL; 9169 9170 dns_message_currentname(rctx->query->rmessage, section, &name); 9171 result = dns_message_nextname(rctx->query->rmessage, section); 9172 if (result != ISC_R_SUCCESS) { 9173 finished = true; 9174 } 9175 9176 if (!dns_name_issubdomain(name, fctx->domain)) { 9177 continue; 9178 } 9179 9180 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 9181 rdataset = ISC_LIST_NEXT(rdataset, link)) 9182 { 9183 dns_rdatatype_t type = rdataset->type; 9184 if (type == dns_rdatatype_rrsig) { 9185 type = rdataset->covers; 9186 } 9187 if ((type == dns_rdatatype_ns || 9188 type == dns_rdatatype_soa) && 9189 !dns_name_issubdomain(fctx->name, name)) 9190 { 9191 char qbuf[DNS_NAME_FORMATSIZE]; 9192 char nbuf[DNS_NAME_FORMATSIZE]; 9193 char tbuf[DNS_RDATATYPE_FORMATSIZE]; 9194 dns_rdatatype_format(type, tbuf, sizeof(tbuf)); 9195 dns_name_format(name, nbuf, sizeof(nbuf)); 9196 dns_name_format(fctx->name, qbuf, sizeof(qbuf)); 9197 log_formerr(fctx, 9198 "unrelated %s %s in " 9199 "%s authority section", 9200 tbuf, nbuf, qbuf); 9201 break; 9202 } 9203 9204 switch (type) { 9205 case dns_rdatatype_ns: 9206 /* 9207 * NS or RRSIG NS. 9208 * 9209 * Only one set of NS RRs is allowed. 9210 */ 9211 if (rdataset->type == dns_rdatatype_ns) { 9212 if (rctx->ns_name != NULL && 9213 name != rctx->ns_name) 9214 { 9215 log_formerr( 9216 fctx, 9217 "multiple NS RRsets in " 9218 "authority section"); 9219 rctx->result = DNS_R_FORMERR; 9220 return ISC_R_COMPLETE; 9221 } 9222 rctx->ns_name = name; 9223 rctx->ns_rdataset = rdataset; 9224 } 9225 name->attributes.cache = true; 9226 rdataset->attributes |= DNS_RDATASETATTR_CACHE; 9227 rdataset->trust = dns_trust_glue; 9228 break; 9229 case dns_rdatatype_soa: 9230 /* 9231 * SOA, or RRSIG SOA. 9232 * 9233 * Only one SOA is allowed. 9234 */ 9235 if (rdataset->type == dns_rdatatype_soa) { 9236 if (rctx->soa_name != NULL && 9237 name != rctx->soa_name) 9238 { 9239 log_formerr( 9240 fctx, 9241 "multiple SOA RRs in " 9242 "authority section"); 9243 rctx->result = DNS_R_FORMERR; 9244 return ISC_R_COMPLETE; 9245 } 9246 rctx->soa_name = name; 9247 } 9248 name->attributes.ncache = true; 9249 rdataset->attributes |= DNS_RDATASETATTR_NCACHE; 9250 if (rctx->aa) { 9251 rdataset->trust = 9252 dns_trust_authauthority; 9253 } else if (ISFORWARDER(fctx->addrinfo)) { 9254 rdataset->trust = dns_trust_answer; 9255 } else { 9256 rdataset->trust = dns_trust_additional; 9257 } 9258 break; 9259 default: 9260 continue; 9261 } 9262 } 9263 } 9264 9265 return ISC_R_SUCCESS; 9266 } 9267 9268 /* 9269 * rctx_ncache(): 9270 * Cache the negatively cacheable parts of the message. This may 9271 * also cause work to be queued to the DNSSEC validator. 9272 */ 9273 static void 9274 rctx_ncache(respctx_t *rctx) { 9275 isc_result_t result; 9276 dns_rdatatype_t covers; 9277 fetchctx_t *fctx = rctx->fctx; 9278 9279 if (!WANTNCACHE(fctx)) { 9280 return; 9281 } 9282 9283 /* 9284 * Cache DS NXDOMAIN separately to other types. 9285 */ 9286 if (rctx->query->rmessage->rcode == dns_rcode_nxdomain && 9287 fctx->type != dns_rdatatype_ds) 9288 { 9289 covers = dns_rdatatype_any; 9290 } else { 9291 covers = fctx->type; 9292 } 9293 9294 /* 9295 * Cache any negative cache entries in the message. 9296 */ 9297 result = ncache_message(fctx, rctx->query->rmessage, 9298 rctx->query->addrinfo, covers, rctx->now); 9299 if (result != ISC_R_SUCCESS) { 9300 FCTXTRACE3("ncache_message complete", result); 9301 } 9302 } 9303 9304 /* 9305 * rctx_authority_dnssec(): 9306 * 9307 * Scan the authority section of a negative answer or referral, 9308 * handling DNSSEC records (i.e. NSEC, NSEC3, DS). 9309 */ 9310 static isc_result_t 9311 rctx_authority_dnssec(respctx_t *rctx) { 9312 isc_result_t result; 9313 fetchctx_t *fctx = rctx->fctx; 9314 dns_rdataset_t *rdataset = NULL; 9315 bool finished = false; 9316 9317 REQUIRE(!rctx->ns_in_answer && !rctx->glue_in_answer); 9318 9319 result = dns_message_firstname(rctx->query->rmessage, 9320 DNS_SECTION_AUTHORITY); 9321 if (result != ISC_R_SUCCESS) { 9322 return ISC_R_SUCCESS; 9323 } 9324 9325 while (!finished) { 9326 dns_name_t *name = NULL; 9327 9328 dns_message_currentname(rctx->query->rmessage, 9329 DNS_SECTION_AUTHORITY, &name); 9330 result = dns_message_nextname(rctx->query->rmessage, 9331 DNS_SECTION_AUTHORITY); 9332 if (result != ISC_R_SUCCESS) { 9333 finished = true; 9334 } 9335 9336 if (!dns_name_issubdomain(name, fctx->domain)) { 9337 /* 9338 * Invalid name found; preserve it for logging 9339 * later. 9340 */ 9341 rctx->found_name = name; 9342 rctx->found_type = ISC_LIST_HEAD(name->list)->type; 9343 continue; 9344 } 9345 9346 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 9347 rdataset = ISC_LIST_NEXT(rdataset, link)) 9348 { 9349 bool checknta = true; 9350 bool secure_domain = false; 9351 dns_rdatatype_t type = rdataset->type; 9352 9353 if (type == dns_rdatatype_rrsig) { 9354 type = rdataset->covers; 9355 } 9356 9357 switch (type) { 9358 case dns_rdatatype_nsec: 9359 case dns_rdatatype_nsec3: 9360 if (rctx->negative) { 9361 name->attributes.ncache = true; 9362 rdataset->attributes |= 9363 DNS_RDATASETATTR_NCACHE; 9364 } else if (type == dns_rdatatype_nsec) { 9365 name->attributes.cache = true; 9366 rdataset->attributes |= 9367 DNS_RDATASETATTR_CACHE; 9368 } 9369 9370 if (rctx->aa) { 9371 rdataset->trust = 9372 dns_trust_authauthority; 9373 } else if (ISFORWARDER(fctx->addrinfo)) { 9374 rdataset->trust = dns_trust_answer; 9375 } else { 9376 rdataset->trust = dns_trust_additional; 9377 } 9378 /* 9379 * No additional data needs to be 9380 * marked. 9381 */ 9382 break; 9383 case dns_rdatatype_ds: 9384 /* 9385 * DS or SIG DS. 9386 * 9387 * These should only be here if this is 9388 * a referral, and there should only be 9389 * one DS RRset. 9390 */ 9391 if (rctx->ns_name == NULL) { 9392 log_formerr(fctx, 9393 "DS with no referral"); 9394 rctx->result = DNS_R_FORMERR; 9395 return ISC_R_COMPLETE; 9396 } 9397 9398 if (rdataset->type == dns_rdatatype_ds) { 9399 if (rctx->ds_name != NULL && 9400 name != rctx->ds_name) 9401 { 9402 log_formerr(fctx, 9403 "DS doesn't match " 9404 "referral (NS)"); 9405 rctx->result = DNS_R_FORMERR; 9406 return ISC_R_COMPLETE; 9407 } 9408 rctx->ds_name = name; 9409 } 9410 9411 name->attributes.cache = true; 9412 rdataset->attributes |= DNS_RDATASETATTR_CACHE; 9413 9414 if ((fctx->options & DNS_FETCHOPT_NONTA) != 0) { 9415 checknta = false; 9416 } 9417 if (fctx->res->view->enablevalidation) { 9418 result = issecuredomain( 9419 fctx->res->view, name, 9420 dns_rdatatype_ds, fctx->now, 9421 checknta, NULL, &secure_domain); 9422 if (result != ISC_R_SUCCESS) { 9423 return result; 9424 } 9425 } 9426 if (secure_domain) { 9427 rdataset->trust = 9428 dns_trust_pending_answer; 9429 } else if (rctx->aa) { 9430 rdataset->trust = 9431 dns_trust_authauthority; 9432 } else if (ISFORWARDER(fctx->addrinfo)) { 9433 rdataset->trust = dns_trust_answer; 9434 } else { 9435 rdataset->trust = dns_trust_additional; 9436 } 9437 break; 9438 default: 9439 continue; 9440 } 9441 } 9442 } 9443 9444 return ISC_R_SUCCESS; 9445 } 9446 9447 /* 9448 * rctx_referral(): 9449 * Handles referral responses. Check for sanity, find glue as needed, 9450 * and update the fetch context to follow the delegation. 9451 */ 9452 static isc_result_t 9453 rctx_referral(respctx_t *rctx) { 9454 isc_result_t result; 9455 fetchctx_t *fctx = rctx->fctx; 9456 9457 if (rctx->negative || rctx->ns_name == NULL) { 9458 return ISC_R_SUCCESS; 9459 } 9460 9461 /* 9462 * We already know ns_name is a subdomain of fctx->domain. 9463 * If ns_name is equal to fctx->domain, we're not making 9464 * progress. We return DNS_R_FORMERR so that we'll keep 9465 * trying other servers. 9466 */ 9467 if (dns_name_equal(rctx->ns_name, fctx->domain)) { 9468 log_formerr(fctx, "non-improving referral"); 9469 rctx->result = DNS_R_FORMERR; 9470 return ISC_R_COMPLETE; 9471 } 9472 9473 /* 9474 * If the referral name is not a parent of the query 9475 * name, consider the responder insane. 9476 */ 9477 if (!dns_name_issubdomain(fctx->name, rctx->ns_name)) { 9478 /* Logged twice */ 9479 log_formerr(fctx, "referral to non-parent"); 9480 FCTXTRACE("referral to non-parent"); 9481 rctx->result = DNS_R_FORMERR; 9482 return ISC_R_COMPLETE; 9483 } 9484 9485 /* 9486 * Mark any additional data related to this rdataset. 9487 * It's important that we do this before we change the 9488 * query domain. 9489 */ 9490 INSIST(rctx->ns_rdataset != NULL); 9491 FCTX_ATTR_SET(fctx, FCTX_ATTR_GLUING); 9492 9493 /* 9494 * Mark the glue records in the additional section to be cached. 9495 */ 9496 (void)dns_rdataset_additionaldata(rctx->ns_rdataset, rctx->ns_name, 9497 check_related, rctx, 0); 9498 #if CHECK_FOR_GLUE_IN_ANSWER 9499 /* 9500 * Look in the answer section for "glue" that is incorrectly 9501 * returned as a answer. This is needed if the server also 9502 * minimizes the response size by not adding records to the 9503 * additional section that are in the answer section or if 9504 * the record gets dropped due to message size constraints. 9505 */ 9506 if (rctx->glue_in_answer && 9507 (fctx->type == dns_rdatatype_aaaa || fctx->type == dns_rdatatype_a)) 9508 { 9509 (void)dns_rdataset_additionaldata(rctx->ns_rdataset, 9510 rctx->ns_name, check_answer, 9511 fctx, 0); 9512 } 9513 #endif /* if CHECK_FOR_GLUE_IN_ANSWER */ 9514 FCTX_ATTR_CLR(fctx, FCTX_ATTR_GLUING); 9515 9516 /* 9517 * NS rdatasets with 0 TTL cause problems. 9518 * dns_view_findzonecut() will not find them when we 9519 * try to follow the referral, and we'll SERVFAIL 9520 * because the best nameservers are now above QDOMAIN. 9521 * We force the TTL to 1 second to prevent this. 9522 */ 9523 if (rctx->ns_rdataset->ttl == 0) { 9524 rctx->ns_rdataset->ttl = 1; 9525 } 9526 9527 /* 9528 * Set the current query domain to the referral name. 9529 * 9530 * XXXRTH We should check if we're in forward-only mode, and 9531 * if so we should bail out. 9532 */ 9533 INSIST(dns_name_countlabels(fctx->domain) > 0); 9534 fcount_decr(fctx); 9535 9536 if (dns_rdataset_isassociated(&fctx->nameservers)) { 9537 dns_rdataset_disassociate(&fctx->nameservers); 9538 } 9539 9540 dns_name_copy(rctx->ns_name, fctx->domain); 9541 9542 if ((fctx->options & DNS_FETCHOPT_QMINIMIZE) != 0) { 9543 dns_name_copy(rctx->ns_name, fctx->qmindcname); 9544 9545 fctx_minimize_qname(fctx); 9546 } 9547 9548 result = fcount_incr(fctx, true); 9549 if (result != ISC_R_SUCCESS) { 9550 rctx->result = result; 9551 return ISC_R_COMPLETE; 9552 } 9553 9554 FCTX_ATTR_SET(fctx, FCTX_ATTR_WANTCACHE); 9555 fctx->ns_ttl_ok = false; 9556 log_ns_ttl(fctx, "DELEGATION"); 9557 rctx->result = DNS_R_DELEGATION; 9558 9559 /* 9560 * Reinitialize 'rctx' to prepare for following the delegation: 9561 * set the get_nameservers and next_server flags appropriately 9562 * and reset the fetch context counters. 9563 * 9564 */ 9565 if ((rctx->fctx->options & DNS_FETCHOPT_NOFOLLOW) == 0) { 9566 rctx->get_nameservers = true; 9567 rctx->next_server = true; 9568 rctx->fctx->restarts = 0; 9569 rctx->fctx->referrals++; 9570 rctx->fctx->querysent = 0; 9571 rctx->fctx->lamecount = 0; 9572 rctx->fctx->quotacount = 0; 9573 rctx->fctx->neterr = 0; 9574 rctx->fctx->badresp = 0; 9575 rctx->fctx->adberr = 0; 9576 } 9577 9578 return ISC_R_COMPLETE; 9579 } 9580 9581 /* 9582 * rctx_additional(): 9583 * Scan the additional section of a response to find records related 9584 * to answers we were interested in. 9585 */ 9586 static void 9587 rctx_additional(respctx_t *rctx) { 9588 bool rescan; 9589 dns_section_t section = DNS_SECTION_ADDITIONAL; 9590 isc_result_t result; 9591 9592 again: 9593 rescan = false; 9594 9595 for (result = dns_message_firstname(rctx->query->rmessage, section); 9596 result == ISC_R_SUCCESS; 9597 result = dns_message_nextname(rctx->query->rmessage, section)) 9598 { 9599 dns_name_t *name = NULL; 9600 dns_rdataset_t *rdataset; 9601 dns_message_currentname(rctx->query->rmessage, 9602 DNS_SECTION_ADDITIONAL, &name); 9603 if (!name->attributes.chase) { 9604 continue; 9605 } 9606 name->attributes.chase = false; 9607 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 9608 rdataset = ISC_LIST_NEXT(rdataset, link)) 9609 { 9610 if (CHASE(rdataset)) { 9611 rdataset->attributes &= ~DNS_RDATASETATTR_CHASE; 9612 (void)dns_rdataset_additionaldata( 9613 rdataset, name, check_related, rctx, 0); 9614 rescan = true; 9615 } 9616 } 9617 } 9618 if (rescan) { 9619 goto again; 9620 } 9621 } 9622 9623 /* 9624 * rctx_nextserver(): 9625 * We found something wrong with the remote server, but it may be 9626 * useful to try another one. 9627 */ 9628 static void 9629 rctx_nextserver(respctx_t *rctx, dns_message_t *message, 9630 dns_adbaddrinfo_t *addrinfo, isc_result_t result) { 9631 fetchctx_t *fctx = rctx->fctx; 9632 bool retrying = true; 9633 9634 if (result == DNS_R_FORMERR) { 9635 rctx->broken_server = DNS_R_FORMERR; 9636 } 9637 if (rctx->broken_server != ISC_R_SUCCESS) { 9638 /* 9639 * Add this server to the list of bad servers for 9640 * this fctx. 9641 */ 9642 add_bad(fctx, message, addrinfo, rctx->broken_server, 9643 rctx->broken_type); 9644 } 9645 9646 if (rctx->get_nameservers) { 9647 dns_fixedname_t foundname, founddc; 9648 dns_name_t *name, *fname, *dcname; 9649 unsigned int findoptions = 0; 9650 9651 fname = dns_fixedname_initname(&foundname); 9652 dcname = dns_fixedname_initname(&founddc); 9653 9654 if (result != ISC_R_SUCCESS) { 9655 fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL); 9656 return; 9657 } 9658 if (dns_rdatatype_atparent(fctx->type)) { 9659 findoptions |= DNS_DBFIND_NOEXACT; 9660 } 9661 /* FIXME: Why??? */ 9662 if ((rctx->retryopts & DNS_FETCHOPT_UNSHARED) == 0) { 9663 name = fctx->name; 9664 } else { 9665 name = fctx->domain; 9666 } 9667 result = dns_view_findzonecut( 9668 fctx->res->view, name, fname, dcname, fctx->now, 9669 findoptions, true, true, &fctx->nameservers, NULL); 9670 if (result != ISC_R_SUCCESS) { 9671 FCTXTRACE("couldn't find a zonecut"); 9672 fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL); 9673 return; 9674 } 9675 if (!dns_name_issubdomain(fname, fctx->domain)) { 9676 /* 9677 * The best nameservers are now above our 9678 * QDOMAIN. 9679 */ 9680 FCTXTRACE("nameservers now above QDOMAIN"); 9681 fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL); 9682 return; 9683 } 9684 9685 fcount_decr(fctx); 9686 9687 dns_name_copy(fname, fctx->domain); 9688 dns_name_copy(dcname, fctx->qmindcname); 9689 9690 result = fcount_incr(fctx, true); 9691 if (result != ISC_R_SUCCESS) { 9692 fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL); 9693 return; 9694 } 9695 fctx->ns_ttl = fctx->nameservers.ttl; 9696 fctx->ns_ttl_ok = true; 9697 fctx_cancelqueries(fctx, true, false); 9698 fctx_cleanup(fctx); 9699 retrying = false; 9700 } 9701 9702 /* 9703 * Try again. 9704 */ 9705 fctx_try(fctx, retrying); 9706 } 9707 9708 /* 9709 * rctx_resend(): 9710 * 9711 * Resend the query, probably with the options changed. Calls 9712 * fctx_query(), unless query counter limits are hit, passing 9713 * rctx->retryopts (which is based on query->options, but may have 9714 * been updated since the last time fctx_query() was called). 9715 */ 9716 static void 9717 rctx_resend(respctx_t *rctx, dns_adbaddrinfo_t *addrinfo) { 9718 fetchctx_t *fctx = rctx->fctx; 9719 isc_result_t result; 9720 9721 FCTXTRACE("resend"); 9722 9723 CHECK(incr_query_counters(fctx)); 9724 9725 result = fctx_query(fctx, addrinfo, rctx->retryopts); 9726 if (result == ISC_R_SUCCESS) { 9727 inc_stats(fctx->res, dns_resstatscounter_retry); 9728 } 9729 9730 cleanup: 9731 if (result != ISC_R_SUCCESS) { 9732 fctx_done_detach(&rctx->fctx, result); 9733 } 9734 } 9735 9736 /* 9737 * rctx_next(): 9738 * We got what appeared to be a response but it didn't match the 9739 * question or the cookie; it may have been meant for someone else, or 9740 * it may be a spoofing attack. Drop it and continue listening for the 9741 * response we wanted. 9742 */ 9743 static isc_result_t 9744 rctx_next(respctx_t *rctx) { 9745 fetchctx_t *fctx = rctx->fctx; 9746 isc_result_t result; 9747 9748 FCTXTRACE("nextitem"); 9749 inc_stats(rctx->fctx->res, dns_resstatscounter_nextitem); 9750 INSIST(rctx->query->dispentry != NULL); 9751 dns_message_reset(rctx->query->rmessage, DNS_MESSAGE_INTENTPARSE); 9752 result = dns_dispatch_getnext(rctx->query->dispentry); 9753 return result; 9754 } 9755 9756 /* 9757 * rctx_chaseds(): 9758 * Look up the parent zone's NS records so that DS records can be 9759 * fetched. 9760 */ 9761 static void 9762 rctx_chaseds(respctx_t *rctx, dns_message_t *message, 9763 dns_adbaddrinfo_t *addrinfo, isc_result_t result) { 9764 fetchctx_t *fctx = rctx->fctx; 9765 unsigned int n; 9766 9767 add_bad(fctx, message, addrinfo, result, rctx->broken_type); 9768 fctx_cancelqueries(fctx, true, false); 9769 fctx_cleanup(fctx); 9770 9771 n = dns_name_countlabels(fctx->name); 9772 dns_name_getlabelsequence(fctx->name, 1, n - 1, fctx->nsname); 9773 9774 FCTXTRACE("suspending DS lookup to find parent's NS records"); 9775 9776 fetchctx_ref(fctx); 9777 result = dns_resolver_createfetch( 9778 fctx->res, fctx->nsname, dns_rdatatype_ns, NULL, NULL, NULL, 9779 NULL, 0, fctx->options, 0, fctx->qc, fctx->gqc, fctx, 9780 fctx->loop, resume_dslookup, fctx, &fctx->edectx, 9781 &fctx->nsrrset, NULL, &fctx->nsfetch); 9782 if (result != ISC_R_SUCCESS) { 9783 if (result == DNS_R_DUPLICATE) { 9784 result = DNS_R_SERVFAIL; 9785 } 9786 fctx_done_detach(&rctx->fctx, result); 9787 fetchctx_detach(&fctx); 9788 return; 9789 } 9790 } 9791 9792 /* 9793 * rctx_done(): 9794 * This resolver query response is finished, either because we 9795 * encountered a problem or because we've gotten all the information 9796 * from it that we can. We either wait for another response, resend the 9797 * query to the same server, resend to a new server, or clean up and 9798 * shut down the fetch. 9799 */ 9800 static void 9801 rctx_done(respctx_t *rctx, isc_result_t result) { 9802 resquery_t *query = rctx->query; 9803 fetchctx_t *fctx = rctx->fctx; 9804 dns_adbaddrinfo_t *addrinfo = query->addrinfo; 9805 dns_message_t *message = NULL; 9806 9807 /* 9808 * Need to attach to the message until the scope 9809 * of this function ends, since there are many places 9810 * where the message is used and/or may be destroyed 9811 * before this function ends. 9812 */ 9813 dns_message_attach(query->rmessage, &message); 9814 9815 FCTXTRACE4("query canceled in rctx_done();", 9816 rctx->no_response ? "no response" : "responding", result); 9817 9818 #ifdef ENABLE_AFL 9819 if (dns_fuzzing_resolver && 9820 (rctx->next_server || rctx->resend || rctx->nextitem)) 9821 { 9822 fctx_cancelquery(&query, rctx->finish, rctx->no_response, 9823 false); 9824 fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL); 9825 goto detach; 9826 } 9827 #endif /* ifdef ENABLE_AFL */ 9828 9829 if (rctx->nextitem) { 9830 REQUIRE(!rctx->next_server); 9831 REQUIRE(!rctx->resend); 9832 9833 result = rctx_next(rctx); 9834 if (result == ISC_R_SUCCESS) { 9835 goto detach; 9836 } 9837 } 9838 9839 /* Cancel the query */ 9840 fctx_cancelquery(&query, rctx->finish, rctx->no_response, false); 9841 9842 /* 9843 * If nobody's waiting for results, don't resend or try next server. 9844 */ 9845 LOCK(&fctx->lock); 9846 if (ISC_LIST_EMPTY(fctx->resps)) { 9847 rctx->next_server = false; 9848 rctx->resend = false; 9849 } 9850 UNLOCK(&fctx->lock); 9851 9852 if (rctx->next_server) { 9853 rctx_nextserver(rctx, message, addrinfo, result); 9854 } else if (rctx->resend) { 9855 rctx_resend(rctx, addrinfo); 9856 } else if (result == DNS_R_CHASEDSSERVERS) { 9857 rctx_chaseds(rctx, message, addrinfo, result); 9858 } else if (result == ISC_R_SUCCESS && !HAVE_ANSWER(fctx)) { 9859 /* 9860 * All has gone well so far, but we are waiting for the DNSSEC 9861 * validator to validate the answer. 9862 */ 9863 FCTXTRACE("wait for validator"); 9864 fctx_cancelqueries(fctx, true, false); 9865 } else { 9866 /* 9867 * We're done. 9868 */ 9869 fctx_done_detach(&rctx->fctx, result); 9870 } 9871 9872 detach: 9873 dns_message_detach(&message); 9874 } 9875 9876 /* 9877 * rctx_logpacket(): 9878 * Log the incoming packet; also log to DNSTAP if configured. 9879 */ 9880 static void 9881 rctx_logpacket(respctx_t *rctx) { 9882 fetchctx_t *fctx = rctx->fctx; 9883 #ifdef HAVE_DNSTAP 9884 isc_result_t result; 9885 isc_sockaddr_t localaddr, *la = NULL; 9886 unsigned char zone[DNS_NAME_MAXWIRE]; 9887 dns_transport_type_t transport_type; 9888 dns_dtmsgtype_t dtmsgtype; 9889 dns_compress_t cctx; 9890 isc_region_t zr; 9891 isc_buffer_t zb; 9892 #endif /* HAVE_DNSTAP */ 9893 9894 dns_message_logfmtpacket( 9895 rctx->query->rmessage, "received packet from", 9896 &rctx->query->addrinfo->sockaddr, DNS_LOGCATEGORY_RESOLVER, 9897 DNS_LOGMODULE_PACKETS, &dns_master_style_comment, 9898 ISC_LOG_DEBUG(10), fctx->mctx); 9899 9900 #ifdef HAVE_DNSTAP 9901 /* 9902 * Log the response via dnstap. 9903 */ 9904 memset(&zr, 0, sizeof(zr)); 9905 dns_compress_init(&cctx, fctx->mctx, 0); 9906 dns_compress_setpermitted(&cctx, false); 9907 isc_buffer_init(&zb, zone, sizeof(zone)); 9908 result = dns_name_towire(fctx->domain, &cctx, &zb, NULL); 9909 if (result == ISC_R_SUCCESS) { 9910 isc_buffer_usedregion(&zb, &zr); 9911 } 9912 dns_compress_invalidate(&cctx); 9913 9914 /* 9915 * Check if the response came from a forwarder to correctly 9916 * classify as Forward Response (FR) vs Recursive Response (RR) 9917 * for DNSTAP logging. This is more accurate than using the RD 9918 * flag which only indicates the original query intent. 9919 */ 9920 if (ISFORWARDER(rctx->query->addrinfo)) { 9921 dtmsgtype = DNS_DTTYPE_FR; 9922 } else { 9923 dtmsgtype = DNS_DTTYPE_RR; 9924 } 9925 9926 result = dns_dispentry_getlocaladdress(rctx->query->dispentry, 9927 &localaddr); 9928 if (result == ISC_R_SUCCESS) { 9929 la = &localaddr; 9930 } 9931 9932 if (rctx->query->addrinfo->transport != NULL) { 9933 transport_type = dns_transport_get_type( 9934 rctx->query->addrinfo->transport); 9935 } else if ((rctx->query->options & DNS_FETCHOPT_TCP) != 0) { 9936 transport_type = DNS_TRANSPORT_TCP; 9937 } else { 9938 transport_type = DNS_TRANSPORT_UDP; 9939 } 9940 9941 dns_dt_send(fctx->res->view, dtmsgtype, la, 9942 &rctx->query->addrinfo->sockaddr, transport_type, &zr, 9943 &rctx->query->start, NULL, &rctx->buffer); 9944 #endif /* HAVE_DNSTAP */ 9945 } 9946 9947 /* 9948 * rctx_badserver(): 9949 * Is the remote server broken, or does it dislike us? 9950 */ 9951 static isc_result_t 9952 rctx_badserver(respctx_t *rctx, isc_result_t result) { 9953 fetchctx_t *fctx = rctx->fctx; 9954 resquery_t *query = rctx->query; 9955 isc_buffer_t b; 9956 char code[64]; 9957 dns_rcode_t rcode = rctx->query->rmessage->rcode; 9958 9959 if (rcode == dns_rcode_noerror || rcode == dns_rcode_yxdomain || 9960 rcode == dns_rcode_nxdomain) 9961 { 9962 return ISC_R_SUCCESS; 9963 } 9964 9965 if ((rcode == dns_rcode_formerr) && rctx->opt == NULL && 9966 (rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0) 9967 { 9968 /* 9969 * It's very likely they don't like EDNS0. 9970 */ 9971 rctx->retryopts |= DNS_FETCHOPT_NOEDNS0; 9972 rctx->resend = true; 9973 /* 9974 * Remember that they may not like EDNS0. 9975 */ 9976 inc_stats(fctx->res, dns_resstatscounter_edns0fail); 9977 } else if (rcode == dns_rcode_formerr) { 9978 if (query->rmessage->cc_echoed) { 9979 /* 9980 * Retry without DNS COOKIE. 9981 */ 9982 query->addrinfo->flags |= FCTX_ADDRINFO_NOCOOKIE; 9983 rctx->resend = true; 9984 log_formerr(fctx, "server sent FORMERR with echoed DNS " 9985 "COOKIE"); 9986 } else { 9987 /* 9988 * The server (or forwarder) doesn't understand us, 9989 * but others might. 9990 */ 9991 rctx->next_server = true; 9992 rctx->broken_server = DNS_R_REMOTEFORMERR; 9993 log_formerr(fctx, "server sent FORMERR"); 9994 } 9995 } else if (rcode == dns_rcode_badvers) { 9996 unsigned int version; 9997 #if DNS_EDNS_VERSION > 0 9998 unsigned int flags, mask; 9999 #endif /* if DNS_EDNS_VERSION > 0 */ 10000 10001 INSIST(rctx->opt != NULL); 10002 version = (rctx->opt->ttl >> 16) & 0xff; 10003 #if DNS_EDNS_VERSION > 0 10004 flags = (version << DNS_FETCHOPT_EDNSVERSIONSHIFT) | 10005 DNS_FETCHOPT_EDNSVERSIONSET; 10006 mask = DNS_FETCHOPT_EDNSVERSIONMASK | 10007 DNS_FETCHOPT_EDNSVERSIONSET; 10008 #endif /* if DNS_EDNS_VERSION > 0 */ 10009 10010 /* 10011 * Record that we got a good EDNS response. 10012 */ 10013 if (query->ednsversion > (int)version && 10014 !EDNSOK(query->addrinfo)) 10015 { 10016 dns_adb_changeflags(fctx->adb, query->addrinfo, 10017 FCTX_ADDRINFO_EDNSOK, 10018 FCTX_ADDRINFO_EDNSOK); 10019 } 10020 10021 /* 10022 * RFC 2671 was not clear that unknown options should 10023 * be ignored. RFC 6891 is clear that that they 10024 * should be ignored. If we are supporting the 10025 * experimental EDNS > 0 then perform strict 10026 * version checking of badvers responses. We won't 10027 * be sending COOKIE etc. in that case. 10028 */ 10029 #if DNS_EDNS_VERSION > 0 10030 if ((int)version < query->ednsversion) { 10031 dns_adb_changeflags(fctx->adb, query->addrinfo, flags, 10032 mask); 10033 rctx->resend = true; 10034 } else { 10035 rctx->broken_server = DNS_R_BADVERS; 10036 rctx->next_server = true; 10037 } 10038 #else /* if DNS_EDNS_VERSION > 0 */ 10039 rctx->broken_server = DNS_R_BADVERS; 10040 rctx->next_server = true; 10041 #endif /* if DNS_EDNS_VERSION > 0 */ 10042 } else if (rcode == dns_rcode_badcookie && rctx->query->rmessage->cc_ok) 10043 { 10044 /* 10045 * We have recorded the new cookie. 10046 */ 10047 if (BADCOOKIE(query->addrinfo)) { 10048 rctx->retryopts |= DNS_FETCHOPT_TCP; 10049 } 10050 query->addrinfo->flags |= FCTX_ADDRINFO_BADCOOKIE; 10051 rctx->resend = true; 10052 } else { 10053 rctx->broken_server = DNS_R_UNEXPECTEDRCODE; 10054 rctx->next_server = true; 10055 } 10056 10057 isc_buffer_init(&b, code, sizeof(code) - 1); 10058 dns_rcode_totext(rcode, &b); 10059 code[isc_buffer_usedlength(&b)] = '\0'; 10060 FCTXTRACE2("remote server broken: returned ", code); 10061 rctx_done(rctx, result); 10062 10063 return ISC_R_COMPLETE; 10064 } 10065 10066 /* 10067 * rctx_lameserver(): 10068 * Is the server lame? 10069 */ 10070 static isc_result_t 10071 rctx_lameserver(respctx_t *rctx) { 10072 isc_result_t result = ISC_R_SUCCESS; 10073 fetchctx_t *fctx = rctx->fctx; 10074 resquery_t *query = rctx->query; 10075 10076 if (ISFORWARDER(query->addrinfo) || !is_lame(fctx, query->rmessage)) { 10077 return ISC_R_SUCCESS; 10078 } 10079 10080 inc_stats(fctx->res, dns_resstatscounter_lame); 10081 log_lame(fctx, query->addrinfo); 10082 rctx->broken_server = DNS_R_LAME; 10083 rctx->next_server = true; 10084 FCTXTRACE("lame server"); 10085 rctx_done(rctx, result); 10086 10087 return ISC_R_COMPLETE; 10088 } 10089 10090 /*** 10091 *** Resolver Methods 10092 ***/ 10093 static void 10094 dns_resolver__destroy(dns_resolver_t *res) { 10095 alternate_t *a = NULL; 10096 10097 REQUIRE(!atomic_load_acquire(&res->priming)); 10098 REQUIRE(res->primefetch == NULL); 10099 10100 RTRACE("destroy"); 10101 10102 res->magic = 0; 10103 10104 dns_nametree_detach(&res->algorithms); 10105 dns_nametree_detach(&res->digests); 10106 dns_nametree_detach(&res->mustbesecure); 10107 10108 if (res->querystats != NULL) { 10109 dns_stats_detach(&res->querystats); 10110 } 10111 if (res->stats != NULL) { 10112 isc_stats_detach(&res->stats); 10113 } 10114 10115 isc_mutex_destroy(&res->primelock); 10116 isc_mutex_destroy(&res->lock); 10117 10118 INSIST(isc_hashmap_count(res->fctxs) == 0); 10119 isc_hashmap_destroy(&res->fctxs); 10120 isc_rwlock_destroy(&res->fctxs_lock); 10121 10122 INSIST(isc_hashmap_count(res->counters) == 0); 10123 isc_hashmap_destroy(&res->counters); 10124 isc_rwlock_destroy(&res->counters_lock); 10125 10126 isc_tlsctx_cache_detach(&res->tlsctx_cache); 10127 10128 if (res->dispatches4 != NULL) { 10129 dns_dispatchset_destroy(&res->dispatches4); 10130 } 10131 if (res->dispatches6 != NULL) { 10132 dns_dispatchset_destroy(&res->dispatches6); 10133 } 10134 while ((a = ISC_LIST_HEAD(res->alternates)) != NULL) { 10135 ISC_LIST_UNLINK(res->alternates, a, link); 10136 if (!a->isaddress) { 10137 dns_name_free(&a->_u._n.name, res->mctx); 10138 } 10139 isc_mem_put(res->mctx, a, sizeof(*a)); 10140 } 10141 10142 dns_view_weakdetach(&res->view); 10143 10144 for (size_t i = 0; i < res->nloops; i++) { 10145 dns_message_destroypools(&res->namepools[i], &res->rdspools[i]); 10146 } 10147 isc_mem_cput(res->mctx, res->rdspools, res->nloops, 10148 sizeof(res->rdspools[0])); 10149 isc_mem_cput(res->mctx, res->namepools, res->nloops, 10150 sizeof(res->namepools[0])); 10151 10152 isc_mem_putanddetach(&res->mctx, res, sizeof(*res)); 10153 } 10154 10155 static void 10156 spillattimer_countdown(void *arg) { 10157 dns_resolver_t *res = (dns_resolver_t *)arg; 10158 unsigned int spillat = 0; 10159 10160 REQUIRE(VALID_RESOLVER(res)); 10161 10162 if (atomic_load(&res->exiting)) { 10163 isc_timer_destroy(&res->spillattimer); 10164 return; 10165 } 10166 10167 LOCK(&res->lock); 10168 INSIST(!atomic_load_acquire(&res->exiting)); 10169 if (res->spillat > res->spillatmin) { 10170 spillat = --res->spillat; 10171 } 10172 if (res->spillat <= res->spillatmin) { 10173 isc_timer_destroy(&res->spillattimer); 10174 } 10175 UNLOCK(&res->lock); 10176 if (spillat > 0) { 10177 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 10178 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 10179 "clients-per-query decreased to %u", spillat); 10180 } 10181 } 10182 10183 isc_result_t 10184 dns_resolver_create(dns_view_t *view, isc_loopmgr_t *loopmgr, isc_nm_t *nm, 10185 unsigned int options, isc_tlsctx_cache_t *tlsctx_cache, 10186 dns_dispatch_t *dispatchv4, dns_dispatch_t *dispatchv6, 10187 dns_resolver_t **resp) { 10188 dns_resolver_t *res = NULL; 10189 10190 /* 10191 * Create a resolver. 10192 */ 10193 10194 REQUIRE(DNS_VIEW_VALID(view)); 10195 REQUIRE(resp != NULL && *resp == NULL); 10196 REQUIRE(tlsctx_cache != NULL); 10197 REQUIRE(dispatchv4 != NULL || dispatchv6 != NULL); 10198 10199 res = isc_mem_get(view->mctx, sizeof(*res)); 10200 *res = (dns_resolver_t){ 10201 .loopmgr = loopmgr, 10202 .rdclass = view->rdclass, 10203 .nm = nm, 10204 .options = options, 10205 .spillatmin = 10, 10206 .spillat = 10, 10207 .spillatmax = 100, 10208 .retryinterval = 800, 10209 .nonbackofftries = 3, 10210 .query_timeout = DEFAULT_QUERY_TIMEOUT, 10211 .maxdepth = DEFAULT_RECURSION_DEPTH, 10212 .maxqueries = DEFAULT_MAX_QUERIES, 10213 .alternates = ISC_LIST_INITIALIZER, 10214 .nloops = isc_loopmgr_nloops(loopmgr), 10215 .maxvalidations = DEFAULT_MAX_VALIDATIONS, 10216 .maxvalidationfails = DEFAULT_MAX_VALIDATION_FAILURES, 10217 }; 10218 10219 RTRACE("create"); 10220 10221 dns_view_weakattach(view, &res->view); 10222 isc_mem_attach(view->mctx, &res->mctx); 10223 10224 res->quotaresp[dns_quotatype_zone] = DNS_R_DROP; 10225 res->quotaresp[dns_quotatype_server] = DNS_R_SERVFAIL; 10226 10227 #if DNS_RESOLVER_TRACE 10228 fprintf(stderr, "dns_resolver__init:%s:%s:%d:%p->references = 1\n", 10229 __func__, __FILE__, __LINE__, res); 10230 #endif 10231 isc_refcount_init(&res->references, 1); 10232 10233 isc_hashmap_create(view->mctx, RES_DOMAIN_HASH_BITS, &res->fctxs); 10234 isc_rwlock_init(&res->fctxs_lock); 10235 10236 isc_hashmap_create(view->mctx, RES_DOMAIN_HASH_BITS, &res->counters); 10237 isc_rwlock_init(&res->counters_lock); 10238 10239 if (dispatchv4 != NULL) { 10240 dns_dispatchset_create(res->mctx, dispatchv4, &res->dispatches4, 10241 res->nloops); 10242 } 10243 10244 if (dispatchv6 != NULL) { 10245 dns_dispatchset_create(res->mctx, dispatchv6, &res->dispatches6, 10246 res->nloops); 10247 } 10248 10249 isc_tlsctx_cache_attach(tlsctx_cache, &res->tlsctx_cache); 10250 10251 isc_mutex_init(&res->lock); 10252 isc_mutex_init(&res->primelock); 10253 10254 dns_nametree_create(res->mctx, DNS_NAMETREE_BITS, "algorithms", 10255 &res->algorithms); 10256 dns_nametree_create(res->mctx, DNS_NAMETREE_BITS, "ds-digests", 10257 &res->digests); 10258 dns_nametree_create(res->mctx, DNS_NAMETREE_BOOL, 10259 "dnssec-must-be-secure", &res->mustbesecure); 10260 10261 res->namepools = isc_mem_cget(res->mctx, res->nloops, 10262 sizeof(res->namepools[0])); 10263 res->rdspools = isc_mem_cget(res->mctx, res->nloops, 10264 sizeof(res->rdspools[0])); 10265 for (size_t i = 0; i < res->nloops; i++) { 10266 isc_loop_t *loop = isc_loop_get(res->loopmgr, i); 10267 isc_mem_t *pool_mctx = isc_loop_getmctx(loop); 10268 10269 dns_message_createpools(pool_mctx, &res->namepools[i], 10270 &res->rdspools[i]); 10271 } 10272 10273 res->magic = RES_MAGIC; 10274 10275 *resp = res; 10276 10277 return ISC_R_SUCCESS; 10278 } 10279 10280 static void 10281 prime_done(void *arg) { 10282 dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg; 10283 dns_resolver_t *res = resp->arg; 10284 dns_fetch_t *fetch = NULL; 10285 dns_db_t *db = NULL; 10286 10287 REQUIRE(VALID_RESOLVER(res)); 10288 10289 int level = (resp->result == ISC_R_SUCCESS) ? ISC_LOG_DEBUG(1) 10290 : ISC_LOG_NOTICE; 10291 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 10292 DNS_LOGMODULE_RESOLVER, level, 10293 "resolver priming query complete: %s", 10294 isc_result_totext(resp->result)); 10295 10296 LOCK(&res->primelock); 10297 fetch = res->primefetch; 10298 res->primefetch = NULL; 10299 UNLOCK(&res->primelock); 10300 10301 atomic_compare_exchange_enforced(&res->priming, &(bool){ true }, false); 10302 10303 if (resp->result == ISC_R_SUCCESS && res->view->cache != NULL && 10304 res->view->hints != NULL) 10305 { 10306 dns_cache_attachdb(res->view->cache, &db); 10307 dns_root_checkhints(res->view, res->view->hints, db); 10308 dns_db_detach(&db); 10309 } 10310 10311 if (resp->node != NULL) { 10312 dns_db_detachnode(resp->db, &resp->node); 10313 } 10314 if (resp->db != NULL) { 10315 dns_db_detach(&resp->db); 10316 } 10317 if (dns_rdataset_isassociated(resp->rdataset)) { 10318 dns_rdataset_disassociate(resp->rdataset); 10319 } 10320 INSIST(resp->sigrdataset == NULL); 10321 10322 isc_mem_put(res->mctx, resp->rdataset, sizeof(*resp->rdataset)); 10323 dns_resolver_freefresp(&resp); 10324 dns_resolver_destroyfetch(&fetch); 10325 } 10326 10327 void 10328 dns_resolver_prime(dns_resolver_t *res) { 10329 bool want_priming = false; 10330 isc_result_t result; 10331 10332 REQUIRE(VALID_RESOLVER(res)); 10333 REQUIRE(res->frozen); 10334 10335 RTRACE("dns_resolver_prime"); 10336 10337 if (!atomic_load_acquire(&res->exiting)) { 10338 want_priming = atomic_compare_exchange_strong_acq_rel( 10339 &res->priming, &(bool){ false }, true); 10340 } 10341 10342 if (want_priming) { 10343 /* 10344 * To avoid any possible recursive locking problems, we 10345 * start the priming fetch like any other fetch, and 10346 * holding no resolver locks. No one else will try to 10347 * start it because we're the ones who set res->priming 10348 * to true. Any other callers of dns_resolver_prime() 10349 * while we're running will see that res->priming is 10350 * already true and do nothing. 10351 */ 10352 RTRACE("priming"); 10353 10354 dns_rdataset_t *rdataset = isc_mem_get(res->mctx, 10355 sizeof(*rdataset)); 10356 dns_rdataset_init(rdataset); 10357 10358 LOCK(&res->primelock); 10359 result = dns_resolver_createfetch( 10360 res, dns_rootname, dns_rdatatype_ns, NULL, NULL, NULL, 10361 NULL, 0, DNS_FETCHOPT_NOFORWARD, 0, NULL, NULL, NULL, 10362 isc_loop(), prime_done, res, NULL, rdataset, NULL, 10363 &res->primefetch); 10364 UNLOCK(&res->primelock); 10365 10366 if (result != ISC_R_SUCCESS) { 10367 isc_mem_put(res->mctx, rdataset, sizeof(*rdataset)); 10368 atomic_compare_exchange_enforced( 10369 &res->priming, &(bool){ true }, false); 10370 } 10371 inc_stats(res, dns_resstatscounter_priming); 10372 } 10373 } 10374 10375 void 10376 dns_resolver_freeze(dns_resolver_t *res) { 10377 /* 10378 * Freeze resolver. 10379 */ 10380 10381 REQUIRE(VALID_RESOLVER(res)); 10382 10383 res->frozen = true; 10384 } 10385 10386 void 10387 dns_resolver_shutdown(dns_resolver_t *res) { 10388 isc_result_t result; 10389 bool is_false = false; 10390 10391 REQUIRE(VALID_RESOLVER(res)); 10392 10393 RTRACE("shutdown"); 10394 10395 if (atomic_compare_exchange_strong(&res->exiting, &is_false, true)) { 10396 isc_hashmap_iter_t *it = NULL; 10397 10398 RTRACE("exiting"); 10399 10400 RWLOCK(&res->fctxs_lock, isc_rwlocktype_write); 10401 isc_hashmap_iter_create(res->fctxs, &it); 10402 for (result = isc_hashmap_iter_first(it); 10403 result == ISC_R_SUCCESS; 10404 result = isc_hashmap_iter_next(it)) 10405 { 10406 fetchctx_t *fctx = NULL; 10407 10408 isc_hashmap_iter_current(it, (void **)&fctx); 10409 INSIST(fctx != NULL); 10410 10411 fetchctx_ref(fctx); 10412 isc_async_run(fctx->loop, fctx_shutdown, fctx); 10413 } 10414 isc_hashmap_iter_destroy(&it); 10415 RWUNLOCK(&res->fctxs_lock, isc_rwlocktype_write); 10416 10417 LOCK(&res->lock); 10418 if (res->spillattimer != NULL) { 10419 isc_timer_async_destroy(&res->spillattimer); 10420 } 10421 UNLOCK(&res->lock); 10422 } 10423 } 10424 10425 #if DNS_RESOLVER_TRACE 10426 ISC_REFCOUNT_TRACE_IMPL(dns_resolver, dns_resolver__destroy); 10427 #else 10428 ISC_REFCOUNT_IMPL(dns_resolver, dns_resolver__destroy); 10429 #endif 10430 10431 static void 10432 log_fetch(const dns_name_t *name, dns_rdatatype_t type) { 10433 char namebuf[DNS_NAME_FORMATSIZE]; 10434 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 10435 int level = ISC_LOG_DEBUG(1); 10436 10437 /* 10438 * If there's no chance of logging it, don't render (format) the 10439 * name and RDATA type (further below), and return early. 10440 */ 10441 if (!isc_log_wouldlog(dns_lctx, level)) { 10442 return; 10443 } 10444 10445 dns_name_format(name, namebuf, sizeof(namebuf)); 10446 dns_rdatatype_format(type, typebuf, sizeof(typebuf)); 10447 10448 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 10449 DNS_LOGMODULE_RESOLVER, level, "fetch: %s/%s", namebuf, 10450 typebuf); 10451 } 10452 10453 static void 10454 fctx_minimize_qname(fetchctx_t *fctx) { 10455 isc_result_t result; 10456 unsigned int dlabels, nlabels; 10457 dns_name_t name; 10458 10459 REQUIRE(VALID_FCTX(fctx)); 10460 10461 dns_name_init(&name, NULL); 10462 10463 dlabels = dns_name_countlabels(fctx->qmindcname); 10464 nlabels = dns_name_countlabels(fctx->name); 10465 10466 if (dlabels > fctx->qmin_labels) { 10467 fctx->qmin_labels = dlabels + 1; 10468 } else { 10469 fctx->qmin_labels++; 10470 } 10471 10472 if (fctx->ip6arpaskip) { 10473 /* 10474 * For ip6.arpa we want to skip some of the labels, with 10475 * boundaries at /16, /32, /48, /56, /64 and /128 10476 * In 'label count' terms that's equal to 10477 * 7 11 15 17 19 35 10478 * We fix fctx->qmin_labels to point to the nearest 10479 * boundary 10480 */ 10481 if (fctx->qmin_labels < 7) { 10482 fctx->qmin_labels = 7; 10483 } else if (fctx->qmin_labels < 11) { 10484 fctx->qmin_labels = 11; 10485 } else if (fctx->qmin_labels < 15) { 10486 fctx->qmin_labels = 15; 10487 } else if (fctx->qmin_labels < 17) { 10488 fctx->qmin_labels = 17; 10489 } else if (fctx->qmin_labels < 19) { 10490 fctx->qmin_labels = 19; 10491 } else if (fctx->qmin_labels < 35) { 10492 fctx->qmin_labels = 35; 10493 } else { 10494 fctx->qmin_labels = nlabels; 10495 } 10496 } else if (fctx->qmin_labels > DNS_QMIN_MAXLABELS) { 10497 fctx->qmin_labels = DNS_NAME_MAXLABELS; 10498 } 10499 10500 if (fctx->qmin_labels < nlabels) { 10501 dns_rdataset_t rdataset; 10502 dns_fixedname_t fixed; 10503 dns_name_t *fname = dns_fixedname_initname(&fixed); 10504 dns_rdataset_init(&rdataset); 10505 do { 10506 /* 10507 * We want to query for qmin_labels from fctx->name. 10508 */ 10509 dns_name_split(fctx->name, fctx->qmin_labels, NULL, 10510 &name); 10511 /* 10512 * Look to see if we have anything cached about NS 10513 * RRsets at this name and if so skip this name and 10514 * try with an additional label prepended. 10515 */ 10516 result = dns_db_find(fctx->cache, &name, NULL, 10517 dns_rdatatype_ns, 0, 0, NULL, 10518 fname, &rdataset, NULL); 10519 if (dns_rdataset_isassociated(&rdataset)) { 10520 dns_rdataset_disassociate(&rdataset); 10521 } 10522 switch (result) { 10523 case ISC_R_SUCCESS: 10524 case DNS_R_CNAME: 10525 case DNS_R_DNAME: 10526 case DNS_R_NCACHENXDOMAIN: 10527 case DNS_R_NCACHENXRRSET: 10528 fctx->qmin_labels++; 10529 continue; 10530 default: 10531 break; 10532 } 10533 break; 10534 } while (fctx->qmin_labels < nlabels); 10535 } 10536 10537 if (fctx->qmin_labels < nlabels) { 10538 dns_name_copy(&name, fctx->qminname); 10539 fctx->qmintype = dns_rdatatype_ns; 10540 fctx->minimized = true; 10541 } else { 10542 /* Minimization is done, we'll ask for whole qname */ 10543 dns_name_copy(fctx->name, fctx->qminname); 10544 fctx->qmintype = fctx->type; 10545 fctx->minimized = false; 10546 } 10547 10548 char domainbuf[DNS_NAME_FORMATSIZE]; 10549 dns_name_format(fctx->qminname, domainbuf, sizeof(domainbuf)); 10550 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 10551 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(5), 10552 "QNAME minimization - %s minimized, qmintype %d " 10553 "qminname %s", 10554 fctx->minimized ? "" : "not", fctx->qmintype, domainbuf); 10555 } 10556 10557 static isc_result_t 10558 get_attached_fctx(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name, 10559 dns_rdatatype_t type, const dns_name_t *domain, 10560 dns_rdataset_t *nameservers, const isc_sockaddr_t *client, 10561 unsigned int options, unsigned int depth, isc_counter_t *qc, 10562 isc_counter_t *gqc, fetchctx_t *parent, fetchctx_t **fctxp, 10563 bool *new_fctx) { 10564 isc_result_t result; 10565 fetchctx_t key = { 10566 .name = UNCONST(name), 10567 .options = options, 10568 .type = type, 10569 }; 10570 fetchctx_t *fctx = NULL; 10571 isc_rwlocktype_t locktype = isc_rwlocktype_read; 10572 uint32_t hashval = fctx_hash(&key); 10573 10574 again: 10575 RWLOCK(&res->fctxs_lock, locktype); 10576 result = isc_hashmap_find(res->fctxs, hashval, fctx_match, &key, 10577 (void **)&fctx); 10578 switch (result) { 10579 case ISC_R_SUCCESS: 10580 break; 10581 case ISC_R_NOTFOUND: 10582 result = fctx_create(res, loop, name, type, domain, nameservers, 10583 client, options, depth, qc, gqc, parent, 10584 &fctx); 10585 if (result != ISC_R_SUCCESS) { 10586 RWUNLOCK(&res->fctxs_lock, locktype); 10587 return result; 10588 } 10589 10590 UPGRADELOCK(&res->fctxs_lock, locktype); 10591 10592 void *found = NULL; 10593 result = isc_hashmap_add(res->fctxs, hashval, fctx_match, fctx, 10594 fctx, &found); 10595 if (result == ISC_R_SUCCESS) { 10596 *new_fctx = true; 10597 } else { 10598 /* 10599 * The fctx_done() tries to acquire the fctxs_lock. 10600 * Destroy the newly created fetchctx directly. 10601 */ 10602 fctx->state = fetchstate_done; 10603 isc_timer_destroy(&fctx->timer); 10604 10605 fetchctx_detach(&fctx); 10606 fctx = found; 10607 result = ISC_R_SUCCESS; 10608 } 10609 break; 10610 default: 10611 UNREACHABLE(); 10612 } 10613 INSIST(result == ISC_R_SUCCESS); 10614 fetchctx_ref(fctx); 10615 10616 /* 10617 * We need to lock the fetch context before unlocking the hash table to 10618 * prevent other threads from looking up this thread before it has been 10619 * properly initialized and started. 10620 */ 10621 LOCK(&fctx->lock); 10622 RWUNLOCK(&res->fctxs_lock, locktype); 10623 10624 if (SHUTTINGDOWN(fctx) || fctx->cloned) { 10625 /* 10626 * This is the single place where fctx might get 10627 * accesses from a different thread, so we need to 10628 * double check whether fctxs is done (or cloned) and 10629 * help with the release if the fctx has been cloned. 10630 */ 10631 UNLOCK(&fctx->lock); 10632 10633 /* The fctx will get deleted either here or in fctx__done() */ 10634 RWLOCK(&res->fctxs_lock, isc_rwlocktype_write); 10635 (void)isc_hashmap_delete(res->fctxs, fctx_hash(fctx), match_ptr, 10636 fctx); 10637 RWUNLOCK(&res->fctxs_lock, isc_rwlocktype_write); 10638 10639 fetchctx_detach(&fctx); 10640 goto again; 10641 } 10642 10643 /* 10644 * The function returns a locked fetch context, 10645 */ 10646 *fctxp = fctx; 10647 10648 return result; 10649 } 10650 10651 static bool 10652 is_samedomain(const dns_name_t *domain1, const dns_name_t *domain2) { 10653 if (domain1 == NULL && domain2 == NULL) { 10654 return true; 10655 } 10656 10657 if (domain1 == NULL || domain2 == NULL) { 10658 return false; 10659 } 10660 10661 return !dns_name_compare(domain1, domain2); 10662 } 10663 10664 static bool 10665 waiting_for_fetch(fetchctx_t *fctx, const dns_name_t *name, 10666 dns_rdatatype_t type, const dns_name_t *domain) { 10667 while (fctx != NULL) { 10668 if (type == fctx->type && !dns_name_compare(name, fctx->name)) { 10669 if (is_samedomain(domain, fctx->domain)) { 10670 return true; 10671 } 10672 } 10673 fctx = fctx->parent; 10674 } 10675 return false; 10676 } 10677 10678 isc_result_t 10679 dns_resolver_createfetch(dns_resolver_t *res, const dns_name_t *name, 10680 dns_rdatatype_t type, const dns_name_t *domain, 10681 dns_rdataset_t *nameservers, 10682 dns_forwarders_t *forwarders, 10683 const isc_sockaddr_t *client, dns_messageid_t id, 10684 unsigned int options, unsigned int depth, 10685 isc_counter_t *qc, isc_counter_t *gqc, 10686 fetchctx_t *parent, isc_loop_t *loop, isc_job_cb cb, 10687 void *arg, dns_edectx_t *edectx, 10688 dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset, 10689 dns_fetch_t **fetchp) { 10690 dns_fetch_t *fetch = NULL; 10691 fetchctx_t *fctx = NULL; 10692 isc_result_t result = ISC_R_SUCCESS; 10693 bool new_fctx = false; 10694 unsigned int count = 0; 10695 unsigned int spillat; 10696 unsigned int spillatmin; 10697 isc_mem_t *mctx = isc_loop_getmctx(loop); 10698 10699 UNUSED(forwarders); 10700 10701 REQUIRE(VALID_RESOLVER(res)); 10702 REQUIRE(res->frozen); 10703 /* XXXRTH Check for meta type */ 10704 if (domain != NULL) { 10705 REQUIRE(DNS_RDATASET_VALID(nameservers)); 10706 REQUIRE(nameservers->type == dns_rdatatype_ns); 10707 } else { 10708 REQUIRE(nameservers == NULL); 10709 } 10710 REQUIRE(forwarders == NULL); 10711 REQUIRE(!dns_rdataset_isassociated(rdataset)); 10712 REQUIRE(sigrdataset == NULL || !dns_rdataset_isassociated(sigrdataset)); 10713 REQUIRE(fetchp != NULL && *fetchp == NULL); 10714 10715 if (atomic_load_acquire(&res->exiting)) { 10716 return ISC_R_SHUTTINGDOWN; 10717 } 10718 10719 log_fetch(name, type); 10720 10721 /* 10722 * This fetch loop detection enable to guard against loop scenarios 10723 * where the DNSSEC is involved. See 10724 * `4d307ac67a0e3f9831c9a4e66ac481e2f9ceebb5`. This is a complementary 10725 * detection with the ADB lookup loop detection (in `findname()`). 10726 */ 10727 if (waiting_for_fetch(parent, name, type, domain)) { 10728 if (isc_log_wouldlog(dns_lctx, ISC_LOG_INFO)) { 10729 char namebuf[DNS_NAME_FORMATSIZE + 1]; 10730 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 10731 char domainbuf[DNS_NAME_FORMATSIZE + 1] = { 0 }; 10732 10733 dns_name_format(name, namebuf, sizeof(namebuf)); 10734 dns_rdatatype_format(type, typebuf, sizeof(typebuf)); 10735 if (domain != NULL) { 10736 dns_name_format(domain, domainbuf, 10737 sizeof(domainbuf)); 10738 } 10739 10740 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 10741 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(2), 10742 "fetch loop detected resolving '%s/%s " 10743 "(in '%s'?)", 10744 namebuf, typebuf, domainbuf); 10745 } 10746 return DNS_R_LOOPDETECTED; 10747 } 10748 10749 fetch = isc_mem_get(mctx, sizeof(*fetch)); 10750 *fetch = (dns_fetch_t){ 0 }; 10751 10752 dns_resolver_attach(res, &fetch->res); 10753 isc_mem_attach(mctx, &fetch->mctx); 10754 10755 if ((options & DNS_FETCHOPT_UNSHARED) == 0) { 10756 /* 10757 * We don't save the unshared fetch context to a bucket because 10758 * we also would never match it again. 10759 */ 10760 10761 LOCK(&res->lock); 10762 spillat = res->spillat; 10763 spillatmin = res->spillatmin; 10764 UNLOCK(&res->lock); 10765 10766 result = get_attached_fctx(res, loop, name, type, domain, 10767 nameservers, client, options, depth, 10768 qc, gqc, parent, &fctx, &new_fctx); 10769 if (result != ISC_R_SUCCESS) { 10770 goto fail; 10771 } 10772 10773 /* On success, the fctx is locked in get_attached_fctx() */ 10774 INSIST(!SHUTTINGDOWN(fctx)); 10775 10776 /* Is this a duplicate? */ 10777 if (client != NULL) { 10778 dns_fetchresponse_t *resp = NULL; 10779 for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL; 10780 resp = ISC_LIST_NEXT(resp, link)) 10781 { 10782 if (resp->client != NULL && resp->id == id && 10783 isc_sockaddr_equal(resp->client, client)) 10784 { 10785 result = DNS_R_DUPLICATE; 10786 goto unlock; 10787 } 10788 10789 count++; 10790 } 10791 } 10792 if (count >= spillatmin && spillatmin != 0) { 10793 if (count >= spillat) { 10794 fctx->spilled = true; 10795 } 10796 if (fctx->spilled) { 10797 inc_stats(res, dns_resstatscounter_clientquota); 10798 fctx->dropped++; 10799 result = DNS_R_DROP; 10800 goto unlock; 10801 } 10802 } 10803 } else { 10804 result = fctx_create(res, loop, name, type, domain, nameservers, 10805 client, options, depth, qc, gqc, parent, 10806 &fctx); 10807 if (result != ISC_R_SUCCESS) { 10808 goto fail; 10809 } 10810 new_fctx = true; 10811 } 10812 10813 RUNTIME_CHECK(fctx != NULL); 10814 10815 if (fctx->depth > depth) { 10816 fctx->depth = depth; 10817 } 10818 10819 fctx->allowed++; 10820 10821 fctx_join(fctx, loop, client, id, cb, arg, edectx, rdataset, 10822 sigrdataset, fetch); 10823 10824 if (new_fctx) { 10825 fetchctx_ref(fctx); 10826 isc_async_run(fctx->loop, fctx_start, fctx); 10827 } 10828 10829 unlock: 10830 if ((options & DNS_FETCHOPT_UNSHARED) == 0) { 10831 UNLOCK(&fctx->lock); 10832 fetchctx_unref(fctx); 10833 } 10834 10835 fail: 10836 if (result != ISC_R_SUCCESS) { 10837 dns_resolver_detach(&fetch->res); 10838 isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch)); 10839 return result; 10840 } 10841 10842 FTRACE("created"); 10843 *fetchp = fetch; 10844 10845 return ISC_R_SUCCESS; 10846 } 10847 10848 void 10849 dns_resolver_cancelfetch(dns_fetch_t *fetch) { 10850 fetchctx_t *fctx = NULL; 10851 bool last_fetch = false; 10852 10853 REQUIRE(DNS_FETCH_VALID(fetch)); 10854 fctx = fetch->private; 10855 REQUIRE(VALID_FCTX(fctx)); 10856 10857 FTRACE("cancelfetch"); 10858 10859 LOCK(&fctx->lock); 10860 10861 /* 10862 * Find the completion event associated with this fetch (as opposed 10863 * to those for other fetches that have joined the same fctx) and run 10864 * the callback asynchronously with a ISC_R_CANCELED result. 10865 */ 10866 if (fctx->state != fetchstate_done) { 10867 dns_fetchresponse_t *next = NULL; 10868 for (dns_fetchresponse_t *resp = ISC_LIST_HEAD(fctx->resps); 10869 resp != NULL; resp = next) 10870 { 10871 next = ISC_LIST_NEXT(resp, link); 10872 10873 if (resp->fetch == fetch) { 10874 resp->result = ISC_R_CANCELED; 10875 ISC_LIST_UNLINK(fctx->resps, resp, link); 10876 isc_async_run(resp->loop, resp->cb, resp); 10877 break; 10878 } 10879 } 10880 } 10881 10882 if (ISC_LIST_EMPTY(fctx->resps)) { 10883 last_fetch = true; 10884 } 10885 UNLOCK(&fctx->lock); 10886 10887 if (last_fetch) { 10888 fetchctx_ref(fctx); 10889 isc_async_run(fctx->loop, fctx_shutdown, fctx); 10890 } 10891 } 10892 10893 void 10894 dns_resolver_destroyfetch(dns_fetch_t **fetchp) { 10895 dns_fetch_t *fetch = NULL; 10896 dns_resolver_t *res = NULL; 10897 fetchctx_t *fctx = NULL; 10898 10899 REQUIRE(fetchp != NULL); 10900 fetch = *fetchp; 10901 *fetchp = NULL; 10902 REQUIRE(DNS_FETCH_VALID(fetch)); 10903 fctx = fetch->private; 10904 REQUIRE(VALID_FCTX(fctx)); 10905 res = fetch->res; 10906 10907 FTRACE("destroyfetch"); 10908 10909 fetch->magic = 0; 10910 10911 LOCK(&fctx->lock); 10912 /* 10913 * Sanity check: the caller should have gotten its event before 10914 * trying to destroy the fetch. 10915 */ 10916 if (fctx->state != fetchstate_done) { 10917 dns_fetchresponse_t *resp = NULL, *next = NULL; 10918 for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL; 10919 resp = next) 10920 { 10921 next = ISC_LIST_NEXT(resp, link); 10922 RUNTIME_CHECK(resp->fetch != fetch); 10923 } 10924 } 10925 UNLOCK(&fctx->lock); 10926 10927 isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch)); 10928 10929 fetchctx_detach(&fctx); 10930 dns_resolver_detach(&res); 10931 } 10932 10933 void 10934 dns_resolver_logfetch(dns_fetch_t *fetch, isc_log_t *lctx, 10935 isc_logcategory_t *category, isc_logmodule_t *module, 10936 int level, bool duplicateok) { 10937 fetchctx_t *fctx = NULL; 10938 10939 REQUIRE(DNS_FETCH_VALID(fetch)); 10940 fctx = fetch->private; 10941 REQUIRE(VALID_FCTX(fctx)); 10942 10943 LOCK(&fctx->lock); 10944 10945 if (!fctx->logged || duplicateok) { 10946 char domainbuf[DNS_NAME_FORMATSIZE]; 10947 dns_name_format(fctx->domain, domainbuf, sizeof(domainbuf)); 10948 isc_log_write(lctx, category, module, level, 10949 "fetch completed for %s in " 10950 "%" PRIu64 "." 10951 "%06" PRIu64 ": %s/%s " 10952 "[domain:%s,referral:%u,restart:%u,qrysent:%u," 10953 "timeout:%u,lame:%u,quota:%u,neterr:%u," 10954 "badresp:%u,adberr:%u,findfail:%u,valfail:%u]", 10955 fctx->info, fctx->duration / US_PER_SEC, 10956 fctx->duration % US_PER_SEC, 10957 isc_result_totext(fctx->result), 10958 isc_result_totext(fctx->vresult), domainbuf, 10959 fctx->referrals, fctx->restarts, fctx->querysent, 10960 fctx->timeouts, fctx->lamecount, fctx->quotacount, 10961 fctx->neterr, fctx->badresp, fctx->adberr, 10962 fctx->findfail, fctx->valfail); 10963 fctx->logged = true; 10964 } 10965 10966 UNLOCK(&fctx->lock); 10967 } 10968 10969 dns_dispatch_t * 10970 dns_resolver_dispatchv4(dns_resolver_t *resolver) { 10971 REQUIRE(VALID_RESOLVER(resolver)); 10972 return dns_dispatchset_get(resolver->dispatches4); 10973 } 10974 10975 dns_dispatch_t * 10976 dns_resolver_dispatchv6(dns_resolver_t *resolver) { 10977 REQUIRE(VALID_RESOLVER(resolver)); 10978 return dns_dispatchset_get(resolver->dispatches6); 10979 } 10980 10981 void 10982 dns_resolver_addalternate(dns_resolver_t *res, const isc_sockaddr_t *alt, 10983 const dns_name_t *name, in_port_t port) { 10984 alternate_t *a; 10985 10986 REQUIRE(VALID_RESOLVER(res)); 10987 REQUIRE(!res->frozen); 10988 REQUIRE((alt == NULL) ^ (name == NULL)); 10989 10990 a = isc_mem_get(res->mctx, sizeof(*a)); 10991 if (alt != NULL) { 10992 a->isaddress = true; 10993 a->_u.addr = *alt; 10994 } else { 10995 a->isaddress = false; 10996 a->_u._n.port = port; 10997 dns_name_init(&a->_u._n.name, NULL); 10998 dns_name_dup(name, res->mctx, &a->_u._n.name); 10999 } 11000 ISC_LINK_INIT(a, link); 11001 ISC_LIST_APPEND(res->alternates, a, link); 11002 } 11003 11004 isc_result_t 11005 dns_resolver_disable_algorithm(dns_resolver_t *resolver, const dns_name_t *name, 11006 unsigned int alg) { 11007 REQUIRE(VALID_RESOLVER(resolver)); 11008 11009 if (alg > 255) { 11010 return ISC_R_RANGE; 11011 } 11012 11013 return dns_nametree_add(resolver->algorithms, name, alg); 11014 } 11015 11016 isc_result_t 11017 dns_resolver_disable_ds_digest(dns_resolver_t *resolver, const dns_name_t *name, 11018 unsigned int digest_type) { 11019 REQUIRE(VALID_RESOLVER(resolver)); 11020 11021 if (digest_type > 255) { 11022 return ISC_R_RANGE; 11023 } 11024 11025 return dns_nametree_add(resolver->digests, name, digest_type); 11026 } 11027 11028 bool 11029 dns_resolver_algorithm_supported(dns_resolver_t *resolver, 11030 const dns_name_t *name, unsigned int alg) { 11031 REQUIRE(VALID_RESOLVER(resolver)); 11032 11033 if ((alg == DST_ALG_DH) || (alg == DST_ALG_INDIRECT)) { 11034 return false; 11035 } 11036 11037 if (dns_nametree_covered(resolver->algorithms, name, NULL, alg)) { 11038 return false; 11039 } 11040 11041 return dst_algorithm_supported(alg); 11042 } 11043 11044 bool 11045 dns_resolver_ds_digest_supported(dns_resolver_t *resolver, 11046 const dns_name_t *name, 11047 unsigned int digest_type) { 11048 REQUIRE(VALID_RESOLVER(resolver)); 11049 11050 if (dns_nametree_covered(resolver->digests, name, NULL, digest_type)) { 11051 return false; 11052 } 11053 11054 return dst_ds_digest_supported(digest_type); 11055 } 11056 11057 isc_result_t 11058 dns_resolver_setmustbesecure(dns_resolver_t *resolver, const dns_name_t *name, 11059 bool value) { 11060 isc_result_t result; 11061 11062 REQUIRE(VALID_RESOLVER(resolver)); 11063 11064 result = dns_nametree_add(resolver->mustbesecure, name, value); 11065 return result; 11066 } 11067 11068 bool 11069 dns_resolver_getmustbesecure(dns_resolver_t *resolver, const dns_name_t *name) { 11070 REQUIRE(VALID_RESOLVER(resolver)); 11071 11072 return dns_nametree_covered(resolver->mustbesecure, name, NULL, 0); 11073 } 11074 11075 void 11076 dns_resolver_getclientsperquery(dns_resolver_t *resolver, uint32_t *cur, 11077 uint32_t *min, uint32_t *max) { 11078 REQUIRE(VALID_RESOLVER(resolver)); 11079 11080 LOCK(&resolver->lock); 11081 SET_IF_NOT_NULL(cur, resolver->spillat); 11082 SET_IF_NOT_NULL(min, resolver->spillatmin); 11083 SET_IF_NOT_NULL(max, resolver->spillatmax); 11084 UNLOCK(&resolver->lock); 11085 } 11086 11087 void 11088 dns_resolver_setclientsperquery(dns_resolver_t *resolver, uint32_t min, 11089 uint32_t max) { 11090 REQUIRE(VALID_RESOLVER(resolver)); 11091 11092 LOCK(&resolver->lock); 11093 resolver->spillatmin = resolver->spillat = min; 11094 resolver->spillatmax = max; 11095 UNLOCK(&resolver->lock); 11096 } 11097 11098 void 11099 dns_resolver_setfetchesperzone(dns_resolver_t *resolver, uint32_t clients) { 11100 REQUIRE(VALID_RESOLVER(resolver)); 11101 11102 atomic_store_release(&resolver->zspill, clients); 11103 } 11104 11105 uint32_t 11106 dns_resolver_getfetchesperzone(dns_resolver_t *resolver) { 11107 REQUIRE(VALID_RESOLVER(resolver)); 11108 11109 return atomic_load_relaxed(&resolver->zspill); 11110 } 11111 11112 bool 11113 dns_resolver_getzeronosoattl(dns_resolver_t *resolver) { 11114 REQUIRE(VALID_RESOLVER(resolver)); 11115 11116 return resolver->zero_no_soa_ttl; 11117 } 11118 11119 void 11120 dns_resolver_setzeronosoattl(dns_resolver_t *resolver, bool state) { 11121 REQUIRE(VALID_RESOLVER(resolver)); 11122 11123 resolver->zero_no_soa_ttl = state; 11124 } 11125 11126 unsigned int 11127 dns_resolver_getoptions(dns_resolver_t *resolver) { 11128 REQUIRE(VALID_RESOLVER(resolver)); 11129 11130 return resolver->options; 11131 } 11132 11133 unsigned int 11134 dns_resolver_gettimeout(dns_resolver_t *resolver) { 11135 REQUIRE(VALID_RESOLVER(resolver)); 11136 11137 return resolver->query_timeout; 11138 } 11139 11140 void 11141 dns_resolver_settimeout(dns_resolver_t *resolver, unsigned int timeout) { 11142 REQUIRE(VALID_RESOLVER(resolver)); 11143 11144 if (timeout < MINIMUM_QUERY_TIMEOUT) { 11145 timeout *= 1000; 11146 } 11147 11148 if (timeout == 0) { 11149 timeout = DEFAULT_QUERY_TIMEOUT; 11150 } 11151 if (timeout > MAXIMUM_QUERY_TIMEOUT) { 11152 timeout = MAXIMUM_QUERY_TIMEOUT; 11153 } 11154 if (timeout < MINIMUM_QUERY_TIMEOUT) { 11155 timeout = MINIMUM_QUERY_TIMEOUT; 11156 } 11157 11158 resolver->query_timeout = timeout; 11159 } 11160 11161 void 11162 dns_resolver_setmaxvalidations(dns_resolver_t *resolver, uint32_t max) { 11163 REQUIRE(VALID_RESOLVER(resolver)); 11164 atomic_store(&resolver->maxvalidations, max); 11165 } 11166 11167 void 11168 dns_resolver_setmaxvalidationfails(dns_resolver_t *resolver, uint32_t max) { 11169 REQUIRE(VALID_RESOLVER(resolver)); 11170 atomic_store(&resolver->maxvalidationfails, max); 11171 } 11172 11173 void 11174 dns_resolver_setmaxdepth(dns_resolver_t *resolver, unsigned int maxdepth) { 11175 REQUIRE(VALID_RESOLVER(resolver)); 11176 resolver->maxdepth = maxdepth; 11177 } 11178 11179 unsigned int 11180 dns_resolver_getmaxdepth(dns_resolver_t *resolver) { 11181 REQUIRE(VALID_RESOLVER(resolver)); 11182 return resolver->maxdepth; 11183 } 11184 11185 void 11186 dns_resolver_setmaxqueries(dns_resolver_t *resolver, unsigned int queries) { 11187 REQUIRE(VALID_RESOLVER(resolver)); 11188 resolver->maxqueries = queries; 11189 } 11190 11191 unsigned int 11192 dns_resolver_getmaxqueries(dns_resolver_t *resolver) { 11193 REQUIRE(VALID_RESOLVER(resolver)); 11194 return resolver->maxqueries; 11195 } 11196 11197 void 11198 dns_resolver_dumpfetches(dns_resolver_t *res, isc_statsformat_t format, 11199 FILE *fp) { 11200 isc_result_t result; 11201 isc_hashmap_iter_t *it = NULL; 11202 11203 REQUIRE(VALID_RESOLVER(res)); 11204 REQUIRE(fp != NULL); 11205 REQUIRE(format == isc_statsformat_file); 11206 11207 LOCK(&res->lock); 11208 fprintf(fp, "clients-per-query: %u/%u/%u\n", res->spillatmin, 11209 res->spillat, res->spillatmax); 11210 UNLOCK(&res->lock); 11211 11212 RWLOCK(&res->fctxs_lock, isc_rwlocktype_read); 11213 isc_hashmap_iter_create(res->fctxs, &it); 11214 for (result = isc_hashmap_iter_first(it); result == ISC_R_SUCCESS; 11215 result = isc_hashmap_iter_next(it)) 11216 { 11217 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 11218 char timebuf[1024]; 11219 fetchctx_t *fctx = NULL; 11220 dns_fetchresponse_t *resp = NULL; 11221 resquery_t *query = NULL; 11222 unsigned int resp_count = 0, query_count = 0; 11223 11224 isc_hashmap_iter_current(it, (void **)&fctx); 11225 11226 LOCK(&fctx->lock); 11227 dns_name_print(fctx->name, fp); 11228 11229 isc_time_formatISO8601ms(&fctx->start, timebuf, 11230 sizeof(timebuf)); 11231 11232 dns_rdatatype_format(fctx->type, typebuf, sizeof(typebuf)); 11233 11234 fprintf(fp, "/%s (%s), 0x%x: started %s, ", typebuf, 11235 fctx->state == fetchstate_done ? "done" 11236 : fctx->cloned ? "cloned" 11237 : "active", 11238 fctx->options, timebuf); 11239 11240 for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL; 11241 resp = ISC_LIST_NEXT(resp, link)) 11242 { 11243 resp_count++; 11244 } 11245 11246 for (query = ISC_LIST_HEAD(fctx->queries); query != NULL; 11247 query = ISC_LIST_NEXT(query, link)) 11248 { 11249 query_count++; 11250 } 11251 11252 if (isc_timer_running(fctx->timer)) { 11253 strlcpy(timebuf, "expires ", sizeof(timebuf)); 11254 isc_time_formatISO8601ms(&fctx->expires, timebuf + 8, 11255 sizeof(timebuf) - 8); 11256 } else { 11257 strlcpy(timebuf, "not running", sizeof(timebuf)); 11258 } 11259 11260 fprintf(fp, 11261 "fetches: %u active (%" PRIuFAST32 11262 " allowed, %" PRIuFAST32 11263 " dropped%s), queries: %u, timer %s\n", 11264 resp_count, fctx->allowed, fctx->dropped, 11265 fctx->spilled ? ", spilled" : "", query_count, timebuf); 11266 11267 UNLOCK(&fctx->lock); 11268 } 11269 isc_hashmap_iter_destroy(&it); 11270 RWUNLOCK(&res->fctxs_lock, isc_rwlocktype_read); 11271 } 11272 11273 isc_result_t 11274 dns_resolver_dumpquota(dns_resolver_t *res, isc_buffer_t **buf) { 11275 isc_result_t result; 11276 isc_hashmap_iter_t *it = NULL; 11277 uint_fast32_t spill; 11278 11279 REQUIRE(VALID_RESOLVER(res)); 11280 11281 spill = atomic_load_acquire(&res->zspill); 11282 if (spill == 0) { 11283 return ISC_R_SUCCESS; 11284 } 11285 11286 RWLOCK(&res->counters_lock, isc_rwlocktype_read); 11287 isc_hashmap_iter_create(res->counters, &it); 11288 for (result = isc_hashmap_iter_first(it); result == ISC_R_SUCCESS; 11289 result = isc_hashmap_iter_next(it)) 11290 { 11291 fctxcount_t *counter = NULL; 11292 uint_fast32_t count, dropped, allowed; 11293 char nb[DNS_NAME_FORMATSIZE]; 11294 char text[DNS_NAME_FORMATSIZE + BUFSIZ]; 11295 11296 isc_hashmap_iter_current(it, (void **)&counter); 11297 11298 LOCK(&counter->lock); 11299 count = counter->count; 11300 dropped = counter->dropped; 11301 allowed = counter->allowed; 11302 UNLOCK(&counter->lock); 11303 11304 if (count < spill) { 11305 continue; 11306 } 11307 11308 dns_name_format(counter->domain, nb, sizeof(nb)); 11309 snprintf(text, sizeof(text), 11310 "\n- %s: %" PRIuFAST32 " active (allowed %" PRIuFAST32 11311 " spilled %" PRIuFAST32 ")", 11312 nb, count, allowed, dropped); 11313 11314 result = isc_buffer_reserve(*buf, strlen(text)); 11315 if (result != ISC_R_SUCCESS) { 11316 goto cleanup; 11317 } 11318 isc_buffer_putstr(*buf, text); 11319 } 11320 if (result == ISC_R_NOMORE) { 11321 result = ISC_R_SUCCESS; 11322 } 11323 11324 cleanup: 11325 isc_hashmap_iter_destroy(&it); 11326 RWUNLOCK(&res->counters_lock, isc_rwlocktype_read); 11327 return result; 11328 } 11329 11330 void 11331 dns_resolver_setquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which, 11332 isc_result_t resp) { 11333 REQUIRE(VALID_RESOLVER(resolver)); 11334 REQUIRE(which == dns_quotatype_zone || which == dns_quotatype_server); 11335 REQUIRE(resp == DNS_R_DROP || resp == DNS_R_SERVFAIL); 11336 11337 resolver->quotaresp[which] = resp; 11338 } 11339 11340 isc_result_t 11341 dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which) { 11342 REQUIRE(VALID_RESOLVER(resolver)); 11343 REQUIRE(which == dns_quotatype_zone || which == dns_quotatype_server); 11344 11345 return resolver->quotaresp[which]; 11346 } 11347 11348 void 11349 dns_resolver_setstats(dns_resolver_t *res, isc_stats_t *stats) { 11350 REQUIRE(VALID_RESOLVER(res)); 11351 REQUIRE(res->stats == NULL); 11352 11353 isc_stats_attach(stats, &res->stats); 11354 11355 /* initialize the bucket "counter"; it's a static value */ 11356 set_stats(res, dns_resstatscounter_buckets, 11357 isc_loopmgr_nloops(res->loopmgr)); 11358 } 11359 11360 void 11361 dns_resolver_getstats(dns_resolver_t *res, isc_stats_t **statsp) { 11362 REQUIRE(VALID_RESOLVER(res)); 11363 REQUIRE(statsp != NULL && *statsp == NULL); 11364 11365 if (res->stats != NULL) { 11366 isc_stats_attach(res->stats, statsp); 11367 } 11368 } 11369 11370 void 11371 dns_resolver_incstats(dns_resolver_t *res, isc_statscounter_t counter) { 11372 REQUIRE(VALID_RESOLVER(res)); 11373 11374 isc_stats_increment(res->stats, counter); 11375 } 11376 11377 void 11378 dns_resolver_setquerystats(dns_resolver_t *res, dns_stats_t *stats) { 11379 REQUIRE(VALID_RESOLVER(res)); 11380 REQUIRE(res->querystats == NULL); 11381 11382 dns_stats_attach(stats, &res->querystats); 11383 } 11384 11385 void 11386 dns_resolver_getquerystats(dns_resolver_t *res, dns_stats_t **statsp) { 11387 REQUIRE(VALID_RESOLVER(res)); 11388 REQUIRE(statsp != NULL && *statsp == NULL); 11389 11390 if (res->querystats != NULL) { 11391 dns_stats_attach(res->querystats, statsp); 11392 } 11393 } 11394 11395 void 11396 dns_resolver_freefresp(dns_fetchresponse_t **frespp) { 11397 REQUIRE(frespp != NULL); 11398 11399 if (*frespp == NULL) { 11400 return; 11401 } 11402 11403 dns_fetchresponse_t *fresp = *frespp; 11404 11405 *frespp = NULL; 11406 isc_mem_putanddetach(&fresp->mctx, fresp, sizeof(*fresp)); 11407 } 11408
Indexes created Fri Jun 12 00:25:51 UTC 2026