1 /* 2 * services/cache/dns.c - Cache services for DNS using msg and rrset caches. 3 * 4 * Copyright (c) 2007, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains the DNS cache. 40 */ 41 #include "config.h" 42 #include "iterator/iter_delegpt.h" 43 #include "iterator/iter_utils.h" 44 #include "validator/val_nsec.h" 45 #include "validator/val_utils.h" 46 #include "services/cache/dns.h" 47 #include "services/cache/rrset.h" 48 #include "util/data/msgparse.h" 49 #include "util/data/msgreply.h" 50 #include "util/data/packed_rrset.h" 51 #include "util/data/dname.h" 52 #include "util/module.h" 53 #include "util/net_help.h" 54 #include "util/regional.h" 55 #include "util/config_file.h" 56 #include "sldns/sbuffer.h" 57 58 /** store rrsets in the rrset cache. 59 * @param env: module environment with caches. 60 * @param rep: contains list of rrsets to store. 61 * @param now: current time. 62 * @param leeway: during prefetch how much leeway to update TTLs. 63 * This makes rrsets expire sooner so they get updated with a new full 64 * TTL. 65 * Child side type NS does get this but TTL checks are done using the time 66 * the query was created rather than the time the answer was received. 67 * @param pside: if from parentside discovered NS, so that its NS is okay 68 * in a prefetch situation to be updated (without becoming sticky). 69 * @param qrep: update rrsets here if cache is better 70 * @param region: for qrep allocs. 71 * @param qstarttime: time when delegations were looked up, this is perhaps 72 * earlier than the time in now. The time is used to determine if RRsets 73 * of type NS have expired, so that they can only be updated using 74 * lookups of delegation points that did not use them, since they had 75 * expired then. 76 */ 77 static void 78 store_rrsets(struct module_env* env, struct reply_info* rep, time_t now, 79 time_t leeway, int pside, struct reply_info* qrep, 80 struct regional* region, time_t qstarttime) 81 { 82 size_t i; 83 time_t ttl, min_ttl = rep->ttl; 84 /* see if rrset already exists in cache, if not insert it. */ 85 for(i=0; i<rep->rrset_count; i++) { 86 rep->ref[i].key = rep->rrsets[i]; 87 rep->ref[i].id = rep->rrsets[i]->id; 88 /* update ref if it was in the cache */ 89 switch(rrset_cache_update(env->rrset_cache, &rep->ref[i], 90 env->alloc, ((ntohs(rep->ref[i].key->rk.type)== 91 LDNS_RR_TYPE_NS && !pside)?qstarttime:now) + leeway)) { 92 case 0: /* ref unchanged, item inserted */ 93 break; 94 case 2: /* ref updated, cache is superior */ 95 if(region) { 96 struct ub_packed_rrset_key* ck; 97 lock_rw_rdlock(&rep->ref[i].key->entry.lock); 98 /* if deleted rrset, do not copy it */ 99 if(rep->ref[i].key->id == 0 || 100 rep->ref[i].id != rep->ref[i].key->id) 101 ck = NULL; 102 else ck = packed_rrset_copy_region( 103 rep->ref[i].key, region, 104 ((ntohs(rep->ref[i].key->rk.type)== 105 LDNS_RR_TYPE_NS && !pside)?qstarttime:now)); 106 lock_rw_unlock(&rep->ref[i].key->entry.lock); 107 if(ck) { 108 /* use cached copy if memory allows */ 109 qrep->rrsets[i] = ck; 110 ttl = ((struct packed_rrset_data*) 111 ck->entry.data)->ttl; 112 if(ttl < qrep->ttl) { 113 qrep->ttl = ttl; 114 qrep->prefetch_ttl = PREFETCH_TTL_CALC(qrep->ttl); 115 qrep->serve_expired_ttl = qrep->ttl + SERVE_EXPIRED_TTL; 116 } 117 } 118 } 119 /* no break: also copy key item */ 120 /* the line below is matched by gcc regex and silences 121 * the fallthrough warning */ 122 ATTR_FALLTHROUGH 123 /* fallthrough */ 124 case 1: /* ref updated, item inserted */ 125 rep->rrsets[i] = rep->ref[i].key; 126 /* ref was updated; make sure the message ttl is 127 * updated to the minimum of the current rrsets. */ 128 lock_rw_rdlock(&rep->ref[i].key->entry.lock); 129 /* if deleted, skip ttl update. */ 130 if(rep->ref[i].key->id != 0 && 131 rep->ref[i].id == rep->ref[i].key->id) { 132 ttl = ((struct packed_rrset_data*) 133 rep->rrsets[i]->entry.data)->ttl; 134 if(ttl < min_ttl) min_ttl = ttl; 135 } 136 lock_rw_unlock(&rep->ref[i].key->entry.lock); 137 } 138 } 139 if(min_ttl < rep->ttl) { 140 rep->ttl = min_ttl; 141 rep->prefetch_ttl = PREFETCH_TTL_CALC(rep->ttl); 142 rep->serve_expired_ttl = rep->ttl + SERVE_EXPIRED_TTL; 143 } 144 } 145 146 /** delete message from message cache */ 147 void 148 msg_cache_remove(struct module_env* env, uint8_t* qname, size_t qnamelen, 149 uint16_t qtype, uint16_t qclass, uint16_t flags) 150 { 151 struct query_info k; 152 hashvalue_type h; 153 154 k.qname = qname; 155 k.qname_len = qnamelen; 156 k.qtype = qtype; 157 k.qclass = qclass; 158 k.local_alias = NULL; 159 h = query_info_hash(&k, flags); 160 slabhash_remove(env->msg_cache, h, &k); 161 } 162 163 void 164 dns_cache_store_msg(struct module_env* env, struct query_info* qinfo, 165 hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside, 166 struct reply_info* qrep, uint32_t flags, struct regional* region, 167 time_t qstarttime) 168 { 169 struct msgreply_entry* e; 170 time_t ttl = rep->ttl; 171 size_t i; 172 173 /* store RRsets */ 174 for(i=0; i<rep->rrset_count; i++) { 175 rep->ref[i].key = rep->rrsets[i]; 176 rep->ref[i].id = rep->rrsets[i]->id; 177 } 178 179 /* there was a reply_info_sortref(rep) here but it seems to be 180 * unnecessary, because the cache gets locked per rrset. */ 181 if((flags & DNSCACHE_STORE_EXPIRED_MSG_CACHEDB)) { 182 reply_info_absolute_ttls(rep, *env->now, *env->now - ttl); 183 } else reply_info_set_ttls(rep, *env->now); 184 store_rrsets(env, rep, *env->now, leeway, pside, qrep, region, 185 qstarttime); 186 if(ttl == 0) { 187 /* we do not store the message, but we did store the RRs, 188 * which could be useful for delegation information */ 189 verbose(VERB_ALGO, "TTL 0: dropped msg from cache"); 190 reply_info_delete(rep, NULL); 191 /* if the message is in the cache, remove that msg, 192 * so that the TTL 0 response can be returned for future 193 * responses (i.e. don't get answered from 194 * cache, but instead go to recursion to get this TTL0 195 * response). 196 * Possible messages that could be in the cache: 197 * - SERVFAIL 198 * - NXDOMAIN 199 * - NODATA 200 * - an older record that is expired 201 * - an older record that did not yet expire */ 202 msg_cache_remove(env, qinfo->qname, qinfo->qname_len, 203 qinfo->qtype, qinfo->qclass, flags); 204 return; 205 } 206 207 /* store msg in the cache */ 208 reply_info_sortref(rep); 209 if(!(e = query_info_entrysetup(qinfo, rep, hash))) { 210 log_err("store_msg: malloc failed"); 211 reply_info_delete(rep, NULL); 212 return; 213 } 214 slabhash_insert(env->msg_cache, hash, &e->entry, rep, env->alloc); 215 } 216 217 /** find closest NS or DNAME and returns the rrset (locked) */ 218 static struct ub_packed_rrset_key* 219 find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen, 220 uint16_t qclass, time_t now, uint16_t searchtype, int stripfront, 221 int noexpiredabove, uint8_t* expiretop, size_t expiretoplen) 222 { 223 struct ub_packed_rrset_key *rrset; 224 uint8_t lablen; 225 226 if(stripfront) { 227 /* strip off so that DNAMEs have strict subdomain match */ 228 lablen = *qname; 229 qname += lablen + 1; 230 qnamelen -= lablen + 1; 231 } 232 233 /* snip off front part of qname until the type is found */ 234 while(qnamelen > 0) { 235 rrset = rrset_cache_lookup(env->rrset_cache, qname, 236 qnamelen, searchtype, qclass, 0, now, 0); 237 if(!rrset && searchtype == LDNS_RR_TYPE_DNAME) 238 /* If not found, for type DNAME, try 0TTL stored, 239 * for its grace period. */ 240 rrset = rrset_cache_lookup(env->rrset_cache, qname, 241 qnamelen, searchtype, qclass, 242 PACKED_RRSET_UPSTREAM_0TTL, now, 0); 243 if(rrset) { 244 uint8_t* origqname = qname; 245 size_t origqnamelen = qnamelen; 246 if(!noexpiredabove) 247 return rrset; 248 /* if expiretop set, do not look above it, but 249 * qname is equal, so the just found result is also 250 * the nonexpired above part. */ 251 if(expiretop && qnamelen == expiretoplen && 252 query_dname_compare(qname, expiretop)==0) 253 return rrset; 254 /* check for expiry, but we have to let go of the rrset 255 * for the lock ordering */ 256 lock_rw_unlock(&rrset->entry.lock); 257 /* the rrset_cache_expired_above function always takes 258 * off one label (if qnamelen>0) and returns the final 259 * qname where it searched, so we can continue from 260 * there turning the O N*N search into O N. */ 261 if(!rrset_cache_expired_above(env->rrset_cache, &qname, 262 &qnamelen, searchtype, qclass, now, expiretop, 263 expiretoplen)) { 264 /* we want to return rrset, but it may be 265 * gone from cache, if so, just loop like 266 * it was not in the cache in the first place. 267 */ 268 if((rrset = rrset_cache_lookup(env-> 269 rrset_cache, origqname, origqnamelen, 270 searchtype, qclass, 0, now, 0))) { 271 return rrset; 272 } 273 } 274 log_nametypeclass(VERB_ALGO, "ignoring rrset because expired rrsets exist above it", origqname, searchtype, qclass); 275 continue; 276 } 277 278 /* snip off front label */ 279 lablen = *qname; 280 qname += lablen + 1; 281 qnamelen -= lablen + 1; 282 } 283 return NULL; 284 } 285 286 /** add addr to additional section */ 287 static void 288 addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region, 289 struct dns_msg* msg, time_t now) 290 { 291 if((msg->rep->rrsets[msg->rep->rrset_count] = 292 packed_rrset_copy_region(rrset, region, now))) { 293 struct packed_rrset_data* d = rrset->entry.data; 294 msg->rep->ar_numrrsets++; 295 msg->rep->rrset_count++; 296 UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl); 297 } 298 } 299 300 /** lookup message in message cache */ 301 struct msgreply_entry* 302 msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen, 303 uint16_t qtype, uint16_t qclass, uint16_t flags, time_t now, int wr) 304 { 305 struct lruhash_entry* e; 306 struct query_info k; 307 hashvalue_type h; 308 309 k.qname = qname; 310 k.qname_len = qnamelen; 311 k.qtype = qtype; 312 k.qclass = qclass; 313 k.local_alias = NULL; 314 h = query_info_hash(&k, flags); 315 e = slabhash_lookup(env->msg_cache, h, &k, wr); 316 317 if(!e) return NULL; 318 if( now > ((struct reply_info*)e->data)->ttl ) { 319 lock_rw_unlock(&e->lock); 320 return NULL; 321 } 322 return (struct msgreply_entry*)e->key; 323 } 324 325 /** find and add A and AAAA records for nameservers in delegpt */ 326 static int 327 find_add_addrs(struct module_env* env, uint16_t qclass, 328 struct regional* region, struct delegpt* dp, time_t now, 329 struct dns_msg** msg) 330 { 331 struct delegpt_ns* ns; 332 struct msgreply_entry* neg; 333 struct ub_packed_rrset_key* akey; 334 for(ns = dp->nslist; ns; ns = ns->next) { 335 akey = rrset_cache_lookup(env->rrset_cache, ns->name, 336 ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0); 337 if(akey) { 338 if(!delegpt_add_rrset_A(dp, region, akey, 0, NULL)) { 339 lock_rw_unlock(&akey->entry.lock); 340 return 0; 341 } 342 if(msg) 343 addr_to_additional(akey, region, *msg, now); 344 lock_rw_unlock(&akey->entry.lock); 345 } else { 346 /* BIT_CD on false because delegpt lookup does 347 * not use dns64 translation */ 348 neg = msg_cache_lookup(env, ns->name, ns->namelen, 349 LDNS_RR_TYPE_A, qclass, 0, now, 0); 350 if(neg) { 351 delegpt_add_neg_msg(dp, neg); 352 lock_rw_unlock(&neg->entry.lock); 353 } 354 } 355 akey = rrset_cache_lookup(env->rrset_cache, ns->name, 356 ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 357 if(akey) { 358 if(!delegpt_add_rrset_AAAA(dp, region, akey, 0, NULL)) { 359 lock_rw_unlock(&akey->entry.lock); 360 return 0; 361 } 362 if(msg) 363 addr_to_additional(akey, region, *msg, now); 364 lock_rw_unlock(&akey->entry.lock); 365 } else { 366 /* BIT_CD on false because delegpt lookup does 367 * not use dns64 translation */ 368 neg = msg_cache_lookup(env, ns->name, ns->namelen, 369 LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 370 /* Because recursion for lookup uses BIT_CD, check 371 * for that so it stops the recursion lookup, if a 372 * negative answer is cached. Because the cache uses 373 * the CD flag for type AAAA. */ 374 if(!neg) 375 neg = msg_cache_lookup(env, ns->name, ns->namelen, 376 LDNS_RR_TYPE_AAAA, qclass, BIT_CD, now, 0); 377 if(neg) { 378 delegpt_add_neg_msg(dp, neg); 379 lock_rw_unlock(&neg->entry.lock); 380 } 381 } 382 } 383 return 1; 384 } 385 386 /** find and add A and AAAA records for missing nameservers in delegpt */ 387 int 388 cache_fill_missing(struct module_env* env, uint16_t qclass, 389 struct regional* region, struct delegpt* dp, uint32_t flags) 390 { 391 struct delegpt_ns* ns; 392 struct msgreply_entry* neg; 393 struct ub_packed_rrset_key* akey; 394 time_t now = *env->now; 395 for(ns = dp->nslist; ns; ns = ns->next) { 396 if(ns->cache_lookup_count > ITERATOR_NAME_CACHELOOKUP_MAX) 397 continue; 398 ns->cache_lookup_count++; 399 akey = rrset_cache_lookup(env->rrset_cache, ns->name, 400 ns->namelen, LDNS_RR_TYPE_A, qclass, flags, now, 0); 401 if(akey) { 402 if(!delegpt_add_rrset_A(dp, region, akey, ns->lame, 403 NULL)) { 404 lock_rw_unlock(&akey->entry.lock); 405 return 0; 406 } 407 log_nametypeclass(VERB_ALGO, "found in cache", 408 ns->name, LDNS_RR_TYPE_A, qclass); 409 lock_rw_unlock(&akey->entry.lock); 410 } else { 411 /* BIT_CD on false because delegpt lookup does 412 * not use dns64 translation */ 413 neg = msg_cache_lookup(env, ns->name, ns->namelen, 414 LDNS_RR_TYPE_A, qclass, 0, now, 0); 415 if(neg) { 416 delegpt_add_neg_msg(dp, neg); 417 lock_rw_unlock(&neg->entry.lock); 418 } 419 } 420 akey = rrset_cache_lookup(env->rrset_cache, ns->name, 421 ns->namelen, LDNS_RR_TYPE_AAAA, qclass, flags, now, 0); 422 if(akey) { 423 if(!delegpt_add_rrset_AAAA(dp, region, akey, ns->lame, 424 NULL)) { 425 lock_rw_unlock(&akey->entry.lock); 426 return 0; 427 } 428 log_nametypeclass(VERB_ALGO, "found in cache", 429 ns->name, LDNS_RR_TYPE_AAAA, qclass); 430 lock_rw_unlock(&akey->entry.lock); 431 } else { 432 /* BIT_CD on false because delegpt lookup does 433 * not use dns64 translation */ 434 neg = msg_cache_lookup(env, ns->name, ns->namelen, 435 LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 436 /* Because recursion for lookup uses BIT_CD, check 437 * for that so it stops the recursion lookup, if a 438 * negative answer is cached. Because the cache uses 439 * the CD flag for type AAAA. */ 440 if(!neg) 441 neg = msg_cache_lookup(env, ns->name, ns->namelen, 442 LDNS_RR_TYPE_AAAA, qclass, BIT_CD, now, 0); 443 if(neg) { 444 delegpt_add_neg_msg(dp, neg); 445 lock_rw_unlock(&neg->entry.lock); 446 } 447 } 448 } 449 return 1; 450 } 451 452 /** find and add DS or NSEC to delegation msg */ 453 static void 454 find_add_ds(struct module_env* env, struct regional* region, 455 struct dns_msg* msg, struct delegpt* dp, time_t now) 456 { 457 /* Lookup the DS or NSEC at the delegation point. */ 458 struct ub_packed_rrset_key* rrset = rrset_cache_lookup( 459 env->rrset_cache, dp->name, dp->namelen, LDNS_RR_TYPE_DS, 460 msg->qinfo.qclass, 0, now, 0); 461 if(!rrset) { 462 /* NOTE: this won't work for alternate NSEC schemes 463 * (opt-in, NSEC3) */ 464 rrset = rrset_cache_lookup(env->rrset_cache, dp->name, 465 dp->namelen, LDNS_RR_TYPE_NSEC, msg->qinfo.qclass, 466 0, now, 0); 467 /* Note: the PACKED_RRSET_NSEC_AT_APEX flag is not used. 468 * since this is a referral, we need the NSEC at the parent 469 * side of the zone cut, not the NSEC at apex side. */ 470 if(rrset && nsec_has_type(rrset, LDNS_RR_TYPE_DS)) { 471 lock_rw_unlock(&rrset->entry.lock); 472 rrset = NULL; /* discard wrong NSEC */ 473 } 474 } 475 if(rrset) { 476 /* add it to auth section. This is the second rrset. */ 477 if((msg->rep->rrsets[msg->rep->rrset_count] = 478 packed_rrset_copy_region(rrset, region, now))) { 479 struct packed_rrset_data* d = rrset->entry.data; 480 msg->rep->ns_numrrsets++; 481 msg->rep->rrset_count++; 482 UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl); 483 } 484 lock_rw_unlock(&rrset->entry.lock); 485 } 486 } 487 488 struct dns_msg* 489 dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype, 490 uint16_t qclass, struct regional* region, size_t capacity) 491 { 492 struct dns_msg* msg = (struct dns_msg*)regional_alloc(region, 493 sizeof(struct dns_msg)); 494 if(!msg) 495 return NULL; 496 msg->qinfo.qname = regional_alloc_init(region, qname, qnamelen); 497 if(!msg->qinfo.qname) 498 return NULL; 499 msg->qinfo.qname_len = qnamelen; 500 msg->qinfo.qtype = qtype; 501 msg->qinfo.qclass = qclass; 502 msg->qinfo.local_alias = NULL; 503 /* non-packed reply_info, because it needs to grow the array */ 504 msg->rep = (struct reply_info*)regional_alloc_zero(region, 505 sizeof(struct reply_info)-sizeof(struct rrset_ref)); 506 if(!msg->rep) 507 return NULL; 508 if(capacity > RR_COUNT_MAX) 509 return NULL; /* integer overflow protection */ 510 msg->rep->flags = BIT_QR; /* with QR, no AA */ 511 msg->rep->qdcount = 1; 512 msg->rep->ttl = MAX_TTL; /* will be updated (brought down) while we add 513 * rrsets to the message */ 514 msg->rep->reason_bogus = LDNS_EDE_NONE; 515 msg->rep->rrsets = (struct ub_packed_rrset_key**) 516 regional_alloc(region, 517 capacity*sizeof(struct ub_packed_rrset_key*)); 518 if(!msg->rep->rrsets) 519 return NULL; 520 return msg; 521 } 522 523 int 524 dns_msg_authadd(struct dns_msg* msg, struct regional* region, 525 struct ub_packed_rrset_key* rrset, time_t now) 526 { 527 struct packed_rrset_data* d = rrset->entry.data; 528 if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 529 packed_rrset_copy_region(rrset, region, now))) 530 return 0; 531 msg->rep->ns_numrrsets++; 532 UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl); 533 return 1; 534 } 535 536 int 537 dns_msg_ansadd(struct dns_msg* msg, struct regional* region, 538 struct ub_packed_rrset_key* rrset, time_t now) 539 { 540 struct packed_rrset_data* d = rrset->entry.data; 541 if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 542 packed_rrset_copy_region(rrset, region, now))) 543 return 0; 544 msg->rep->an_numrrsets++; 545 UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl); 546 return 1; 547 } 548 549 struct delegpt* 550 dns_cache_find_delegation(struct module_env* env, uint8_t* qname, 551 size_t qnamelen, uint16_t qtype, uint16_t qclass, 552 struct regional* region, struct dns_msg** msg, time_t now, 553 int noexpiredabove, uint8_t* expiretop, size_t expiretoplen) 554 { 555 /* try to find closest NS rrset */ 556 struct ub_packed_rrset_key* nskey; 557 struct packed_rrset_data* nsdata; 558 struct delegpt* dp; 559 560 nskey = find_closest_of_type(env, qname, qnamelen, qclass, now, 561 LDNS_RR_TYPE_NS, 0, noexpiredabove, expiretop, expiretoplen); 562 if(!nskey) /* hope the caller has hints to prime or something */ 563 return NULL; 564 nsdata = (struct packed_rrset_data*)nskey->entry.data; 565 /* got the NS key, create delegation point */ 566 dp = delegpt_create(region); 567 if(!dp || !delegpt_set_name(dp, region, nskey->rk.dname)) { 568 lock_rw_unlock(&nskey->entry.lock); 569 log_err("find_delegation: out of memory"); 570 return NULL; 571 } 572 /* create referral message */ 573 if(msg) { 574 /* allocate the array to as much as we could need: 575 * NS rrset + DS/NSEC rrset + 576 * A rrset for every NS RR 577 * AAAA rrset for every NS RR 578 */ 579 *msg = dns_msg_create(qname, qnamelen, qtype, qclass, region, 580 2 + nsdata->count*2); 581 if(!*msg || !dns_msg_authadd(*msg, region, nskey, now)) { 582 lock_rw_unlock(&nskey->entry.lock); 583 log_err("find_delegation: out of memory"); 584 return NULL; 585 } 586 } 587 if(!delegpt_rrset_add_ns(dp, region, nskey, 0)) 588 log_err("find_delegation: addns out of memory"); 589 lock_rw_unlock(&nskey->entry.lock); /* first unlock before next lookup*/ 590 /* find and add DS/NSEC (if any) */ 591 if(msg) 592 find_add_ds(env, region, *msg, dp, now); 593 /* find and add A entries */ 594 if(!find_add_addrs(env, qclass, region, dp, now, msg)) 595 log_err("find_delegation: addrs out of memory"); 596 return dp; 597 } 598 599 /** allocate dns_msg from query_info and reply_info */ 600 static struct dns_msg* 601 gen_dns_msg(struct regional* region, struct query_info* q, size_t num) 602 { 603 struct dns_msg* msg = (struct dns_msg*)regional_alloc(region, 604 sizeof(struct dns_msg)); 605 if(!msg) 606 return NULL; 607 memcpy(&msg->qinfo, q, sizeof(struct query_info)); 608 msg->qinfo.qname = regional_alloc_init(region, q->qname, q->qname_len); 609 if(!msg->qinfo.qname) 610 return NULL; 611 /* allocate replyinfo struct and rrset key array separately */ 612 msg->rep = (struct reply_info*)regional_alloc(region, 613 sizeof(struct reply_info) - sizeof(struct rrset_ref)); 614 if(!msg->rep) 615 return NULL; 616 msg->rep->ttl = MAX_TTL; 617 msg->rep->reason_bogus = LDNS_EDE_NONE; 618 msg->rep->reason_bogus_str = NULL; 619 if(num > RR_COUNT_MAX) 620 return NULL; /* integer overflow protection */ 621 msg->rep->rrsets = (struct ub_packed_rrset_key**) 622 regional_alloc(region, 623 num * sizeof(struct ub_packed_rrset_key*)); 624 if(!msg->rep->rrsets) 625 return NULL; 626 return msg; 627 } 628 629 struct dns_msg* 630 tomsg(struct module_env* env, struct query_info* q, struct reply_info* r, 631 struct regional* region, time_t now, int allow_expired, 632 struct regional* scratch) 633 { 634 struct dns_msg* msg; 635 size_t i; 636 int is_expired = 0; 637 time_t now_control = now; 638 if(TTL_IS_EXPIRED(r->ttl, now)) { 639 /* Check if we are allowed to serve expired */ 640 if(!allow_expired || !reply_info_can_answer_expired(r, now)) 641 return NULL; 642 /* Change the current time so we can pass the below TTL checks 643 * when serving expired data. */ 644 now_control = 0; 645 is_expired = 1; 646 } 647 648 msg = gen_dns_msg(region, q, r->rrset_count); 649 if(!msg) return NULL; 650 msg->rep->flags = r->flags; 651 msg->rep->qdcount = r->qdcount; 652 msg->rep->security = r->security; 653 msg->rep->an_numrrsets = r->an_numrrsets; 654 msg->rep->ns_numrrsets = r->ns_numrrsets; 655 msg->rep->ar_numrrsets = r->ar_numrrsets; 656 msg->rep->rrset_count = r->rrset_count; 657 msg->rep->authoritative = r->authoritative; 658 msg->rep->reason_bogus = r->reason_bogus; 659 if(r->reason_bogus_str) { 660 msg->rep->reason_bogus_str = regional_strdup(region, r->reason_bogus_str); 661 } 662 663 if(!rrset_array_lock(r->ref, r->rrset_count, now_control)) { 664 return NULL; 665 } 666 if(r->an_numrrsets > 0 && (r->rrsets[0]->rk.type == htons( 667 LDNS_RR_TYPE_CNAME) || r->rrsets[0]->rk.type == htons( 668 LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(q, r)) { 669 /* cname chain is now invalid, reconstruct msg */ 670 rrset_array_unlock(r->ref, r->rrset_count); 671 return NULL; 672 } 673 if(r->security == sec_status_secure && !reply_all_rrsets_secure(r)) { 674 /* message rrsets have changed status, revalidate */ 675 rrset_array_unlock(r->ref, r->rrset_count); 676 return NULL; 677 } 678 for(i=0; i<msg->rep->rrset_count; i++) { 679 struct packed_rrset_data* d; 680 msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i], 681 region, now); 682 if(!msg->rep->rrsets[i]) { 683 rrset_array_unlock(r->ref, r->rrset_count); 684 return NULL; 685 } 686 d = msg->rep->rrsets[i]->entry.data; 687 UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl); 688 } 689 if(msg->rep->rrset_count < 1) { 690 msg->rep->ttl = is_expired 691 ?SERVE_EXPIRED_REPLY_TTL 692 :r->ttl - now; 693 if(r->prefetch_ttl > now) 694 msg->rep->prefetch_ttl = r->prefetch_ttl - now; 695 else 696 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 697 } else { 698 /* msg->rep->ttl has been updated through the RRSets above */ 699 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 700 } 701 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 702 msg->rep->serve_expired_norec_ttl = 0; 703 if(env) 704 rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref, 705 r->rrset_count); 706 else 707 rrset_array_unlock(r->ref, r->rrset_count); 708 return msg; 709 } 710 711 struct dns_msg* 712 dns_msg_deepcopy_region(struct dns_msg* origin, struct regional* region) 713 { 714 size_t i; 715 struct ub_packed_rrset_key** saved_rrsets; 716 struct dns_msg* res = NULL; 717 size_t rep_alloc_size = sizeof(struct reply_info) 718 - sizeof(struct rrset_ref); /* this is the size of res->rep 719 allocated in gen_dns_msg() */ 720 res = gen_dns_msg(region, &origin->qinfo, origin->rep->rrset_count); 721 if(!res) return NULL; 722 saved_rrsets = res->rep->rrsets; /* save rrsets alloc by gen_dns_msg */ 723 memcpy(res->rep, origin->rep, rep_alloc_size); 724 res->rep->rrsets = saved_rrsets; 725 if(origin->rep->reason_bogus_str) { 726 res->rep->reason_bogus_str = regional_strdup(region, 727 origin->rep->reason_bogus_str); 728 } 729 for(i=0; i<res->rep->rrset_count; i++) { 730 res->rep->rrsets[i] = packed_rrset_copy_region( 731 origin->rep->rrsets[i], region, 0); 732 if(!res->rep->rrsets[i]) { 733 return NULL; 734 } 735 } 736 return res; 737 } 738 739 /** synthesize RRset-only response from cached RRset item */ 740 static struct dns_msg* 741 rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region, 742 time_t now, struct query_info* q) 743 { 744 struct dns_msg* msg; 745 struct packed_rrset_data* d = (struct packed_rrset_data*) 746 rrset->entry.data; 747 if(TTL_IS_EXPIRED(d->ttl, now)) 748 return NULL; 749 msg = gen_dns_msg(region, q, 1); /* only the CNAME (or other) RRset */ 750 if(!msg) 751 return NULL; 752 msg->rep->flags = BIT_QR; /* reply, no AA, no error */ 753 msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */ 754 msg->rep->qdcount = 1; 755 msg->rep->ttl = d->ttl - now; 756 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 757 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 758 msg->rep->serve_expired_norec_ttl = 0; 759 msg->rep->security = sec_status_unchecked; 760 msg->rep->an_numrrsets = 1; 761 msg->rep->ns_numrrsets = 0; 762 msg->rep->ar_numrrsets = 0; 763 msg->rep->rrset_count = 1; 764 msg->rep->reason_bogus = LDNS_EDE_NONE; 765 msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now); 766 if(!msg->rep->rrsets[0]) /* copy CNAME */ 767 return NULL; 768 return msg; 769 } 770 771 /** synthesize DNAME+CNAME response from cached DNAME item */ 772 static struct dns_msg* 773 synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region, 774 time_t now, struct query_info* q, enum sec_status* sec_status) 775 { 776 struct dns_msg* msg; 777 struct ub_packed_rrset_key* ck; 778 struct packed_rrset_data* newd, *d = (struct packed_rrset_data*) 779 rrset->entry.data; 780 uint8_t* newname, *dtarg = NULL; 781 size_t newlen, dtarglen; 782 time_t rr_ttl; 783 if(TTL_IS_EXPIRED(d->ttl, now)) { 784 /* Allow TTL=0 DNAME from upstream within grace period */ 785 if(!(rrset->rk.flags & PACKED_RRSET_UPSTREAM_0TTL)) 786 return NULL; 787 rr_ttl = 0; 788 } else { 789 rr_ttl = d->ttl - now; 790 } 791 /* only allow validated (with DNSSEC) DNAMEs used from cache 792 * for insecure DNAMEs, query again. */ 793 *sec_status = d->security; 794 /* return sec status, so the status of the CNAME can be checked 795 * by the calling routine. */ 796 msg = gen_dns_msg(region, q, 2); /* DNAME + CNAME RRset */ 797 if(!msg) 798 return NULL; 799 msg->rep->flags = BIT_QR; /* reply, no AA, no error */ 800 msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */ 801 msg->rep->qdcount = 1; 802 msg->rep->ttl = rr_ttl; 803 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 804 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 805 msg->rep->serve_expired_norec_ttl = 0; 806 msg->rep->security = sec_status_unchecked; 807 msg->rep->an_numrrsets = 1; 808 msg->rep->ns_numrrsets = 0; 809 msg->rep->ar_numrrsets = 0; 810 msg->rep->rrset_count = 1; 811 msg->rep->reason_bogus = LDNS_EDE_NONE; 812 msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now); 813 if(!msg->rep->rrsets[0]) /* copy DNAME */ 814 return NULL; 815 /* synth CNAME rrset */ 816 get_cname_target(rrset, &dtarg, &dtarglen); 817 if(!dtarg) 818 return NULL; 819 newlen = q->qname_len + dtarglen - rrset->rk.dname_len; 820 if(newlen > LDNS_MAX_DOMAINLEN) { 821 msg->rep->flags |= LDNS_RCODE_YXDOMAIN; 822 return msg; 823 } 824 newname = (uint8_t*)regional_alloc(region, newlen); 825 if(!newname) 826 return NULL; 827 /* new name is concatenation of qname front (without DNAME owner) 828 * and DNAME target name */ 829 memcpy(newname, q->qname, q->qname_len-rrset->rk.dname_len); 830 memmove(newname+(q->qname_len-rrset->rk.dname_len), dtarg, dtarglen); 831 /* create rest of CNAME rrset */ 832 ck = (struct ub_packed_rrset_key*)regional_alloc(region, 833 sizeof(struct ub_packed_rrset_key)); 834 if(!ck) 835 return NULL; 836 memset(&ck->entry, 0, sizeof(ck->entry)); 837 msg->rep->rrsets[1] = ck; 838 ck->entry.key = ck; 839 ck->rk.type = htons(LDNS_RR_TYPE_CNAME); 840 ck->rk.rrset_class = rrset->rk.rrset_class; 841 ck->rk.flags = 0; 842 ck->rk.dname = regional_alloc_init(region, q->qname, q->qname_len); 843 if(!ck->rk.dname) 844 return NULL; 845 ck->rk.dname_len = q->qname_len; 846 ck->entry.hash = rrset_key_hash(&ck->rk); 847 newd = (struct packed_rrset_data*)regional_alloc_zero(region, 848 sizeof(struct packed_rrset_data) + sizeof(size_t) + 849 sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t) 850 + newlen); 851 if(!newd) 852 return NULL; 853 ck->entry.data = newd; 854 newd->ttl = rr_ttl; /* RFC6672: synth CNAME TTL == DNAME TTL */ 855 newd->count = 1; 856 newd->rrsig_count = 0; 857 newd->trust = rrset_trust_ans_noAA; 858 newd->rr_len = (size_t*)((uint8_t*)newd + 859 sizeof(struct packed_rrset_data)); 860 newd->rr_len[0] = newlen + sizeof(uint16_t); 861 packed_rrset_ptr_fixup(newd); 862 newd->rr_ttl[0] = newd->ttl; 863 msg->rep->ttl = newd->ttl; 864 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(newd->ttl); 865 msg->rep->serve_expired_ttl = newd->ttl + SERVE_EXPIRED_TTL; 866 sldns_write_uint16(newd->rr_data[0], newlen); 867 memmove(newd->rr_data[0] + sizeof(uint16_t), newname, newlen); 868 msg->rep->an_numrrsets ++; 869 msg->rep->rrset_count ++; 870 return msg; 871 } 872 873 /** Fill TYPE_ANY response with some data from cache */ 874 static struct dns_msg* 875 fill_any(struct module_env* env, 876 uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass, 877 struct regional* region) 878 { 879 time_t now = *env->now; 880 struct dns_msg* msg = NULL; 881 uint16_t lookup[] = {LDNS_RR_TYPE_A, LDNS_RR_TYPE_AAAA, 882 LDNS_RR_TYPE_MX, LDNS_RR_TYPE_SOA, LDNS_RR_TYPE_NS, 883 LDNS_RR_TYPE_DNAME, 0}; 884 int i, num=6; /* number of RR types to look up */ 885 log_assert(lookup[num] == 0); 886 887 if(env->cfg->deny_any) { 888 /* return empty message */ 889 msg = dns_msg_create(qname, qnamelen, qtype, qclass, 890 region, 0); 891 if(!msg) { 892 return NULL; 893 } 894 /* set NOTIMPL for RFC 8482 */ 895 msg->rep->flags |= LDNS_RCODE_NOTIMPL; 896 msg->rep->security = sec_status_indeterminate; 897 msg->rep->ttl = 1; /* empty NOTIMPL response will never be 898 * updated with rrsets, set TTL to 1 */ 899 return msg; 900 } 901 902 for(i=0; i<num; i++) { 903 /* look up this RR for inclusion in type ANY response */ 904 struct ub_packed_rrset_key* rrset = rrset_cache_lookup( 905 env->rrset_cache, qname, qnamelen, lookup[i], 906 qclass, 0, now, 0); 907 struct packed_rrset_data *d; 908 if(!rrset) 909 continue; 910 911 /* only if rrset from answer section */ 912 d = (struct packed_rrset_data*)rrset->entry.data; 913 if(d->trust == rrset_trust_add_noAA || 914 d->trust == rrset_trust_auth_noAA || 915 d->trust == rrset_trust_add_AA || 916 d->trust == rrset_trust_auth_AA) { 917 lock_rw_unlock(&rrset->entry.lock); 918 continue; 919 } 920 921 /* create msg if none */ 922 if(!msg) { 923 msg = dns_msg_create(qname, qnamelen, qtype, qclass, 924 region, (size_t)(num-i)); 925 if(!msg) { 926 lock_rw_unlock(&rrset->entry.lock); 927 return NULL; 928 } 929 } 930 931 /* add RRset to response */ 932 if(!dns_msg_ansadd(msg, region, rrset, now)) { 933 lock_rw_unlock(&rrset->entry.lock); 934 return NULL; 935 } 936 lock_rw_unlock(&rrset->entry.lock); 937 } 938 return msg; 939 } 940 941 struct dns_msg* 942 dns_cache_lookup(struct module_env* env, 943 uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass, 944 uint16_t flags, struct regional* region, struct regional* scratch, 945 int no_partial, uint8_t* dpname, size_t dpnamelen) 946 { 947 struct lruhash_entry* e; 948 struct query_info k; 949 hashvalue_type h; 950 time_t now = *env->now; 951 struct ub_packed_rrset_key* rrset; 952 953 /* lookup first, this has both NXdomains and ANSWER responses */ 954 k.qname = qname; 955 k.qname_len = qnamelen; 956 k.qtype = qtype; 957 k.qclass = qclass; 958 k.local_alias = NULL; 959 h = query_info_hash(&k, flags); 960 e = slabhash_lookup(env->msg_cache, h, &k, 0); 961 if(e) { 962 struct msgreply_entry* key = (struct msgreply_entry*)e->key; 963 struct reply_info* data = (struct reply_info*)e->data; 964 struct dns_msg* msg = tomsg(env, &key->key, data, region, now, 0, 965 scratch); 966 if(msg) { 967 lock_rw_unlock(&e->lock); 968 return msg; 969 } 970 /* could be msg==NULL; due to TTL or not all rrsets available */ 971 lock_rw_unlock(&e->lock); 972 } 973 974 /* see if a DNAME exists. Checked for first, to enforce that DNAMEs 975 * are more important, the CNAME is resynthesized and thus 976 * consistent with the DNAME */ 977 if(!no_partial && 978 (rrset=find_closest_of_type(env, qname, qnamelen, qclass, now, 979 LDNS_RR_TYPE_DNAME, 1, 0, NULL, 0))) { 980 /* synthesize a DNAME+CNAME message based on this */ 981 enum sec_status sec_status = sec_status_unchecked; 982 struct dns_msg* msg = synth_dname_msg(rrset, region, now, &k, 983 &sec_status); 984 if(msg) { 985 struct ub_packed_rrset_key* cname_rrset; 986 lock_rw_unlock(&rrset->entry.lock); 987 /* now, after unlocking the DNAME rrset lock, 988 * check the sec_status, and see if we need to look 989 * up the CNAME record associated before it can 990 * be used */ 991 /* normally, only secure DNAMEs allowed from cache*/ 992 if(sec_status == sec_status_secure) 993 return msg; 994 /* but if we have a CNAME cached with this name, then we 995 * have previously already allowed this name to pass. 996 * the next cache lookup is going to fetch that CNAME itself, 997 * but it is better to have the (unsigned)DNAME + CNAME in 998 * that case */ 999 cname_rrset = rrset_cache_lookup( 1000 env->rrset_cache, qname, qnamelen, 1001 LDNS_RR_TYPE_CNAME, qclass, 0, now, 0); 1002 if(cname_rrset) { 1003 /* CNAME already synthesized by 1004 * synth_dname_msg routine, so we can 1005 * straight up return the msg */ 1006 lock_rw_unlock(&cname_rrset->entry.lock); 1007 return msg; 1008 } 1009 } else { 1010 lock_rw_unlock(&rrset->entry.lock); 1011 } 1012 } 1013 1014 /* see if we have CNAME for this domain, 1015 * but not for DS records (which are part of the parent) */ 1016 if(!no_partial && qtype != LDNS_RR_TYPE_DS && 1017 (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen, 1018 LDNS_RR_TYPE_CNAME, qclass, 0, now, 0))) { 1019 uint8_t* wc = NULL; 1020 size_t wl; 1021 /* if the rrset is not a wildcard expansion, with wcname */ 1022 /* because, if we return that CNAME rrset on its own, it is 1023 * missing the NSEC or NSEC3 proof */ 1024 if(!(val_rrset_wildcard(rrset, &wc, &wl) && wc != NULL)) { 1025 struct dns_msg* msg = rrset_msg(rrset, region, now, &k); 1026 if(msg) { 1027 lock_rw_unlock(&rrset->entry.lock); 1028 return msg; 1029 } 1030 } 1031 lock_rw_unlock(&rrset->entry.lock); 1032 } 1033 1034 /* construct DS, DNSKEY messages from rrset cache. */ 1035 if((qtype == LDNS_RR_TYPE_DS || qtype == LDNS_RR_TYPE_DNSKEY) && 1036 (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen, 1037 qtype, qclass, 0, now, 0))) { 1038 /* if the rrset is from the additional section, and the 1039 * signatures have fallen off, then do not synthesize a msg 1040 * instead, allow a full query for signed results to happen. 1041 * Forego all rrset data from additional section, because 1042 * some signatures may not be present and cause validation 1043 * failure. 1044 */ 1045 struct packed_rrset_data *d = (struct packed_rrset_data*) 1046 rrset->entry.data; 1047 if(d->trust != rrset_trust_add_noAA && 1048 d->trust != rrset_trust_add_AA && 1049 (qtype == LDNS_RR_TYPE_DS || 1050 (d->trust != rrset_trust_auth_noAA 1051 && d->trust != rrset_trust_auth_AA) )) { 1052 struct dns_msg* msg = rrset_msg(rrset, region, now, &k); 1053 if(msg) { 1054 lock_rw_unlock(&rrset->entry.lock); 1055 return msg; 1056 } 1057 } 1058 lock_rw_unlock(&rrset->entry.lock); 1059 } 1060 1061 /* stop downwards cache search on NXDOMAIN. 1062 * Empty nonterminals are NOERROR, so an NXDOMAIN for foo 1063 * means bla.foo also does not exist. The DNSSEC proofs are 1064 * the same. We search upwards for NXDOMAINs. */ 1065 if(env->cfg->harden_below_nxdomain) { 1066 while(!dname_is_root(k.qname)) { 1067 if(dpname && dpnamelen 1068 && !dname_subdomain_c(k.qname, dpname)) 1069 break; /* no synth nxdomain above the stub */ 1070 dname_remove_label(&k.qname, &k.qname_len); 1071 h = query_info_hash(&k, flags); 1072 e = slabhash_lookup(env->msg_cache, h, &k, 0); 1073 if(!e && k.qtype != LDNS_RR_TYPE_A && 1074 env->cfg->qname_minimisation) { 1075 k.qtype = LDNS_RR_TYPE_A; 1076 h = query_info_hash(&k, flags); 1077 e = slabhash_lookup(env->msg_cache, h, &k, 0); 1078 } 1079 if(e) { 1080 struct reply_info* data = (struct reply_info*)e->data; 1081 struct dns_msg* msg; 1082 if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN 1083 && data->security == sec_status_secure 1084 && (data->an_numrrsets == 0 || 1085 ntohs(data->rrsets[0]->rk.type) != LDNS_RR_TYPE_CNAME) 1086 && (msg=tomsg(env, &k, data, region, now, 0, scratch))) { 1087 lock_rw_unlock(&e->lock); 1088 msg->qinfo.qname=qname; 1089 msg->qinfo.qname_len=qnamelen; 1090 /* check that DNSSEC really works out */ 1091 msg->rep->security = sec_status_unchecked; 1092 iter_scrub_nxdomain(msg); 1093 return msg; 1094 } 1095 lock_rw_unlock(&e->lock); 1096 } 1097 k.qtype = qtype; 1098 } 1099 } 1100 1101 /* fill common RR types for ANY response to avoid requery */ 1102 if(qtype == LDNS_RR_TYPE_ANY) { 1103 return fill_any(env, qname, qnamelen, qtype, qclass, region); 1104 } 1105 1106 return NULL; 1107 } 1108 1109 int 1110 dns_cache_store(struct module_env* env, struct query_info* msgqinf, 1111 struct reply_info* msgrep, int is_referral, time_t leeway, int pside, 1112 struct regional* region, uint32_t flags, time_t qstarttime, 1113 int is_valrec) 1114 { 1115 struct reply_info* rep = NULL; 1116 if(SERVE_EXPIRED) { 1117 /* We are serving expired records. Before caching, check if a 1118 * useful expired record exists. */ 1119 struct msgreply_entry* e = msg_cache_lookup(env, 1120 msgqinf->qname, msgqinf->qname_len, msgqinf->qtype, 1121 msgqinf->qclass, flags, 0, 1); 1122 if(e) { 1123 struct reply_info* cached = e->entry.data; 1124 if(TTL_IS_EXPIRED(cached->ttl, *env->now) 1125 && reply_info_could_use_expired(cached, *env->now) 1126 /* If we are validating make sure only 1127 * validating modules can update such messages. 1128 * In that case don't cache it and let a 1129 * subsequent module handle the caching. For 1130 * example, the iterator should not replace an 1131 * expired secure answer with a fresh unchecked 1132 * one and let the validator manage caching. */ 1133 && cached->security != sec_status_bogus 1134 && (env->need_to_validate && 1135 msgrep->security == sec_status_unchecked) 1136 /* Exceptions to that rule are: 1137 * o recursions that don't need validation but 1138 * need to update the cache for coherence 1139 * (delegation information while iterating, 1140 * DNSKEY and DS lookups from validator) 1141 * o explicit RRSIG queries that are not 1142 * validated. */ 1143 && !is_valrec 1144 && msgqinf->qtype != LDNS_RR_TYPE_RRSIG) { 1145 if((int)FLAGS_GET_RCODE(msgrep->flags) != 1146 LDNS_RCODE_NOERROR && 1147 (int)FLAGS_GET_RCODE(msgrep->flags) != 1148 LDNS_RCODE_NXDOMAIN) { 1149 /* The current response has an 1150 * erroneous rcode. Adjust norec time 1151 * so that additional lookups are not 1152 * performed for some time. */ 1153 verbose(VERB_ALGO, "set " 1154 "serve-expired-norec-ttl for " 1155 "response in cache"); 1156 cached->serve_expired_norec_ttl = 1157 NORR_TTL + *env->now; 1158 if(env->cfg->serve_expired_ttl_reset && 1159 cached->serve_expired_ttl 1160 < *env->now + 1161 env->cfg->serve_expired_ttl) { 1162 /* Reset serve-expired-ttl for 1163 * valid response in cache. */ 1164 verbose(VERB_ALGO, "reset " 1165 "serve-expired-ttl " 1166 "for response in cache"); 1167 cached->serve_expired_ttl = 1168 *env->now + 1169 env->cfg->serve_expired_ttl; 1170 } 1171 } 1172 verbose(VERB_ALGO, "a validated expired entry " 1173 "could be overwritten, skip caching " 1174 "the new message at this stage"); 1175 lock_rw_unlock(&e->entry.lock); 1176 return 1; 1177 } 1178 lock_rw_unlock(&e->entry.lock); 1179 } 1180 } 1181 /* alloc, malloc properly (not in region, like msg is) */ 1182 rep = reply_info_copy(msgrep, env->alloc, NULL); 1183 if(!rep) 1184 return 0; 1185 /* ttl must be relative ;i.e. 0..86400 not time(0)+86400. 1186 * the env->now is added to message and RRsets in this routine. */ 1187 /* the leeway is used to invalidate other rrsets earlier */ 1188 if(is_referral) { 1189 /* store rrsets */ 1190 struct rrset_ref ref; 1191 size_t i; 1192 for(i=0; i<rep->rrset_count; i++) { 1193 packed_rrset_ttl_add((struct packed_rrset_data*) 1194 rep->rrsets[i]->entry.data, *env->now); 1195 ref.key = rep->rrsets[i]; 1196 ref.id = rep->rrsets[i]->id; 1197 /*ignore ret: it was in the cache, ref updated */ 1198 /* no leeway for typeNS */ 1199 (void)rrset_cache_update(env->rrset_cache, &ref, 1200 env->alloc, 1201 ((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS 1202 && !pside) ? qstarttime:*env->now + leeway)); 1203 } 1204 reply_info_delete(rep, NULL); 1205 return 1; 1206 } else { 1207 /* store msg, and rrsets */ 1208 struct query_info qinf; 1209 hashvalue_type h; 1210 1211 qinf = *msgqinf; 1212 qinf.qname = memdup(msgqinf->qname, msgqinf->qname_len); 1213 if(!qinf.qname) { 1214 reply_info_parsedelete(rep, env->alloc); 1215 return 0; 1216 } 1217 /* fixup flags to be sensible for a reply based on the cache */ 1218 /* this module means that RA is available. It is an answer QR. 1219 * Not AA from cache. Not CD in cache (depends on client bit). */ 1220 rep->flags |= (BIT_RA | BIT_QR); 1221 rep->flags &= ~(BIT_AA | BIT_CD); 1222 h = query_info_hash(&qinf, (uint16_t)flags); 1223 dns_cache_store_msg(env, &qinf, h, rep, leeway, pside, msgrep, 1224 flags, region, qstarttime); 1225 /* qname is used inside query_info_entrysetup, and set to 1226 * NULL. If it has not been used, free it. free(0) is safe. */ 1227 free(qinf.qname); 1228 } 1229 return 1; 1230 } 1231 1232 int 1233 dns_cache_prefetch_adjust(struct module_env* env, struct query_info* qinfo, 1234 time_t adjust, uint16_t flags) 1235 { 1236 struct msgreply_entry* msg; 1237 msg = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len, 1238 qinfo->qtype, qinfo->qclass, flags, *env->now, 1); 1239 if(msg) { 1240 struct reply_info* rep = (struct reply_info*)msg->entry.data; 1241 if(rep) { 1242 rep->prefetch_ttl += adjust; 1243 lock_rw_unlock(&msg->entry.lock); 1244 return 1; 1245 } 1246 lock_rw_unlock(&msg->entry.lock); 1247 } 1248 return 0; 1249 } 1250
Indexes created Wed Jun 17 00:25:26 UTC 2026