1 /* $NetBSD: resolver.c,v 1.27 2026/06/19 20:10:00 christos Exp $ */ 2 3 /* 4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC") 5 * 6 * SPDX-License-Identifier: MPL-2.0 7 * 8 * This Source Code Form is subject to the terms of the Mozilla Public 9 * License, v. 2.0. If a copy of the MPL was not distributed with this 10 * file, you can obtain one at https://mozilla.org/MPL/2.0/. 11 * 12 * See the COPYRIGHT file distributed with this work for additional 13 * information regarding copyright ownership. 14 */ 15 16 /*! \file */ 17 18 #include <ctype.h> 19 #include <inttypes.h> 20 #include <stdbool.h> 21 #include <stdint.h> 22 23 #include <isc/ascii.h> 24 #include <isc/async.h> 25 #include <isc/atomic.h> 26 #include <isc/counter.h> 27 #include <isc/hash.h> 28 #include <isc/hashmap.h> 29 #include <isc/list.h> 30 #include <isc/log.h> 31 #include <isc/loop.h> 32 #include <isc/mutex.h> 33 #include <isc/random.h> 34 #include <isc/refcount.h> 35 #include <isc/result.h> 36 #include <isc/rwlock.h> 37 #include <isc/siphash.h> 38 #include <isc/stats.h> 39 #include <isc/string.h> 40 #include <isc/tid.h> 41 #include <isc/time.h> 42 #include <isc/timer.h> 43 #include <isc/util.h> 44 45 #include <dns/acl.h> 46 #include <dns/adb.h> 47 #include <dns/cache.h> 48 #include <dns/db.h> 49 #include <dns/dispatch.h> 50 #include <dns/dns64.h> 51 #include <dns/dnstap.h> 52 #include <dns/ds.h> 53 #include <dns/ede.h> 54 #include <dns/edns.h> 55 #include <dns/forward.h> 56 #include <dns/keytable.h> 57 #include <dns/log.h> 58 #include <dns/message.h> 59 #include <dns/name.h> 60 #include <dns/nametree.h> 61 #include <dns/ncache.h> 62 #include <dns/nsec.h> 63 #include <dns/nsec3.h> 64 #include <dns/opcode.h> 65 #include <dns/peer.h> 66 #include <dns/rbt.h> 67 #include <dns/rcode.h> 68 #include <dns/rdata.h> 69 #include <dns/rdataclass.h> 70 #include <dns/rdatalist.h> 71 #include <dns/rdataset.h> 72 #include <dns/rdatasetiter.h> 73 #include <dns/rdatastruct.h> 74 #include <dns/rdatatype.h> 75 #include <dns/resolver.h> 76 #include <dns/rootns.h> 77 #include <dns/stats.h> 78 #include <dns/tsig.h> 79 #include <dns/validator.h> 80 #include <dns/zone.h> 81 82 #ifdef WANT_QUERYTRACE 83 #define RTRACE(m) \ 84 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 85 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), "res %p: %s", \ 86 res, (m)) 87 #define RRTRACE(r, m) \ 88 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 89 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), "res %p: %s", \ 90 (r), (m)) 91 #define FCTXTRACE(m) \ 92 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 93 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 94 "fctx %p(%s): %s", fctx, fctx->info, (m)) 95 #define FCTXTRACE2(m1, m2) \ 96 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 97 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 98 "fctx %p(%s): %s %s", fctx, fctx->info, (m1), (m2)) 99 #define FCTXTRACE3(m, res) \ 100 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 101 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 102 "fctx %p(%s): [result: %s] %s", fctx, fctx->info, \ 103 isc_result_totext(res), (m)) 104 #define FCTXTRACE4(m1, m2, res) \ 105 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 106 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 107 "fctx %p(%s): [result: %s] %s %s", fctx, fctx->info, \ 108 isc_result_totext(res), (m1), (m2)) 109 #define FCTXTRACE5(m1, m2, v) \ 110 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 111 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 112 "fctx %p(%s): %s %s%u", fctx, fctx->info, (m1), (m2), \ 113 (v)) 114 #define FCTXTRACEN(m1, name, res) \ 115 do { \ 116 if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) { \ 117 char dbuf[DNS_NAME_FORMATSIZE]; \ 118 dns_name_format((name), dbuf, sizeof(dbuf)); \ 119 FCTXTRACE4((m1), dbuf, (res)); \ 120 } \ 121 } while (0) 122 #define FTRACE(m) \ 123 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 124 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 125 "fetch %p (fctx %p(%s)): %s", fetch, fetch->private, \ 126 fetch->private->info, (m)) 127 #define QTRACE(m) \ 128 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 129 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 130 "resquery %p (fctx %p(%s)): %s", query, query->fctx, \ 131 query->fctx->info, (m)) 132 #else /* ifdef WANT_QUERYTRACE */ 133 #define RTRACE(m) \ 134 do { \ 135 UNUSED(m); \ 136 } while (0) 137 #define RRTRACE(r, m) \ 138 do { \ 139 UNUSED(r); \ 140 UNUSED(m); \ 141 } while (0) 142 #define FCTXTRACE(m) \ 143 do { \ 144 UNUSED(fctx); \ 145 UNUSED(m); \ 146 } while (0) 147 #define FCTXTRACE2(m1, m2) \ 148 do { \ 149 UNUSED(fctx); \ 150 UNUSED(m1); \ 151 UNUSED(m2); \ 152 } while (0) 153 #define FCTXTRACE3(m1, res) \ 154 do { \ 155 UNUSED(fctx); \ 156 UNUSED(m1); \ 157 UNUSED(res); \ 158 } while (0) 159 #define FCTXTRACE4(m1, m2, res) \ 160 do { \ 161 UNUSED(fctx); \ 162 UNUSED(m1); \ 163 UNUSED(m2); \ 164 UNUSED(res); \ 165 } while (0) 166 #define FCTXTRACE5(m1, m2, v) \ 167 do { \ 168 UNUSED(fctx); \ 169 UNUSED(m1); \ 170 UNUSED(m2); \ 171 UNUSED(v); \ 172 } while (0) 173 #define FCTXTRACEN(m1, name, res) FCTXTRACE4(m1, name, res) 174 #define FTRACE(m) \ 175 do { \ 176 UNUSED(m); \ 177 } while (0) 178 #define QTRACE(m) \ 179 do { \ 180 UNUSED(m); \ 181 } while (0) 182 #endif /* WANT_QUERYTRACE */ 183 184 /* 185 * The maximum time we will wait for a single query. 186 */ 187 #define MAX_SINGLE_QUERY_TIMEOUT 9000U 188 #define MAX_SINGLE_QUERY_TIMEOUT_US (MAX_SINGLE_QUERY_TIMEOUT * US_PER_MS) 189 190 /* 191 * The default maximum number of validations and validation failures per-fetch 192 */ 193 #ifndef DEFAULT_MAX_VALIDATIONS 194 #define DEFAULT_MAX_VALIDATIONS 16 195 #endif 196 #ifndef DEFAULT_MAX_VALIDATION_FAILURES 197 #define DEFAULT_MAX_VALIDATION_FAILURES 1 198 #endif 199 200 /* 201 * A minumum sane timeout value for the whole query to live when e.g. talking to 202 * a backend server and a quick timeout is preferred by the user. 203 * 204 * IMPORTANT: if changing this value, note there is a documented behavior when 205 * values of 'resolver-query-timeout' less than or equal to 300 are treated as 206 * seconds and converted to milliseconds before applying the limits, that's 207 * why the value of 301 was chosen as the absolute minimum in order to not break 208 * backward compatibility. 209 */ 210 #define MINIMUM_QUERY_TIMEOUT 301U 211 212 /* 213 * The default time in seconds for the whole query to live. 214 * We want to allow an individual query time to complete / timeout. 215 */ 216 #ifndef DEFAULT_QUERY_TIMEOUT 217 #define DEFAULT_QUERY_TIMEOUT (MAX_SINGLE_QUERY_TIMEOUT + 1000U) 218 #endif /* ifndef DEFAULT_QUERY_TIMEOUT */ 219 220 /* The maximum time in seconds for the whole query to live. */ 221 #ifndef MAXIMUM_QUERY_TIMEOUT 222 #define MAXIMUM_QUERY_TIMEOUT 30000 223 #endif /* ifndef MAXIMUM_QUERY_TIMEOUT */ 224 225 /* The default maximum number of recursions to follow before giving up. */ 226 #ifndef DEFAULT_RECURSION_DEPTH 227 #define DEFAULT_RECURSION_DEPTH 7 228 #endif /* ifndef DEFAULT_RECURSION_DEPTH */ 229 230 /* The default maximum number of iterative queries to allow before giving up. */ 231 #ifndef DEFAULT_MAX_QUERIES 232 #define DEFAULT_MAX_QUERIES 50 233 #endif /* ifndef DEFAULT_MAX_QUERIES */ 234 235 /* 236 * IP address lookups are performed for at most NS_PROCESSING_LIMIT NS RRs in 237 * any NS RRset encountered, to avoid excessive resource use while processing 238 * large delegations. 239 */ 240 #define NS_PROCESSING_LIMIT 20 241 242 /* 243 * Cap on the number of glue addresses cached per NS owner from a referral. 244 * The resolver only ever tries a handful of addresses per NS, so accepting 245 * more than this from a single referral is wasted memory. Each NS owner 246 * may contribute at most DELEG_MAX_GLUES_PER_NS A and DELEG_MAX_GLUES_PER_NS 247 * AAAA glue records. 248 */ 249 #define DELEG_MAX_GLUES_PER_NS 20 250 251 /* Hash table for zone counters */ 252 #ifndef RES_DOMAIN_HASH_BITS 253 #define RES_DOMAIN_HASH_BITS 12 254 #endif /* ifndef RES_DOMAIN_HASH_BITS */ 255 256 /*% 257 * Maximum EDNS0 input packet size. 258 */ 259 #define RECV_BUFFER_SIZE 4096 /* XXXRTH Constant. */ 260 261 /*% 262 * This defines the maximum number of timeouts we will permit before we 263 * disable EDNS0 on the query. 264 */ 265 #define MAX_EDNS0_TIMEOUTS 3 266 267 typedef struct fetchctx fetchctx_t; 268 269 typedef struct query { 270 /* Locked by loop event serialization. */ 271 unsigned int magic; 272 isc_refcount_t references; 273 fetchctx_t *fctx; 274 dns_message_t *rmessage; 275 dns_dispatch_t *dispatch; 276 dns_adbaddrinfo_t *addrinfo; 277 isc_time_t start; 278 dns_messageid_t id; 279 dns_dispentry_t *dispentry; 280 ISC_LINK(struct query) link; 281 isc_buffer_t buffer; 282 isc_buffer_t *tsig; 283 dns_tsigkey_t *tsigkey; 284 int ednsversion; 285 unsigned int options; 286 unsigned int attributes; 287 unsigned int udpsize; 288 unsigned char data[512]; 289 } resquery_t; 290 291 #if DNS_RESOLVER_TRACE 292 #define resquery_ref(ptr) resquery__ref(ptr, __func__, __FILE__, __LINE__) 293 #define resquery_unref(ptr) resquery__unref(ptr, __func__, __FILE__, __LINE__) 294 #define resquery_attach(ptr, ptrp) \ 295 resquery__attach(ptr, ptrp, __func__, __FILE__, __LINE__) 296 #define resquery_detach(ptrp) \ 297 resquery__detach(ptrp, __func__, __FILE__, __LINE__) 298 ISC_REFCOUNT_TRACE_DECL(resquery); 299 #else 300 ISC_REFCOUNT_DECL(resquery); 301 #endif 302 303 struct tried { 304 isc_sockaddr_t addr; 305 unsigned int count; 306 ISC_LINK(struct tried) link; 307 }; 308 309 #define QUERY_MAGIC ISC_MAGIC('Q', '!', '!', '!') 310 #define VALID_QUERY(query) ISC_MAGIC_VALID(query, QUERY_MAGIC) 311 312 #define RESQUERY_ATTR_CANCELED 0x02 313 314 #define RESQUERY_CONNECTING(q) ((q)->connects > 0) 315 #define RESQUERY_CANCELED(q) (((q)->attributes & RESQUERY_ATTR_CANCELED) != 0) 316 #define RESQUERY_SENDING(q) ((q)->sends > 0) 317 318 typedef enum { 319 fetchstate_active, 320 fetchstate_done /*%< Fetch completion events posted. */ 321 } fetchstate_t; 322 323 typedef enum { 324 badns_unreachable = 0, 325 badns_response, 326 badns_validation, 327 badns_forwarder, 328 } badnstype_t; 329 330 #define FCTXCOUNT_MAGIC ISC_MAGIC('F', 'C', 'n', 't') 331 #define VALID_FCTXCOUNT(counter) ISC_MAGIC_VALID(counter, FCTXCOUNT_MAGIC) 332 333 typedef struct fctxcount fctxcount_t; 334 struct fctxcount { 335 unsigned int magic; 336 isc_mem_t *mctx; 337 isc_mutex_t lock; 338 dns_fixedname_t dfname; 339 dns_name_t *domain; 340 uint_fast32_t count; 341 uint_fast32_t allowed; 342 uint_fast32_t dropped; 343 isc_stdtime_t logged; 344 }; 345 346 struct fetchctx { 347 /*% Not locked. */ 348 unsigned int magic; 349 dns_resolver_t *res; 350 dns_fixedname_t fname; 351 dns_name_t *name; 352 dns_rdatatype_t type; 353 unsigned int options; 354 fctxcount_t *counter; 355 char *info; 356 isc_mem_t *mctx; 357 isc_stdtime_t now; 358 359 isc_loop_t *loop; 360 unsigned int tid; 361 362 dns_edectx_t edectx; 363 364 /* Atomic */ 365 isc_refcount_t references; 366 367 /*% Locked by lock. */ 368 isc_mutex_t lock; 369 fetchstate_t state; 370 bool cloned; 371 bool spilled; 372 uint_fast32_t allowed; 373 uint_fast32_t dropped; 374 ISC_LINK(struct fetchctx) link; 375 ISC_LIST(dns_fetchresponse_t) resps; 376 377 /*% Locked by loop event serialization. */ 378 dns_fixedname_t dfname; 379 dns_name_t *domain; 380 dns_rdataset_t nameservers; 381 atomic_uint_fast32_t attributes; 382 isc_timer_t *timer; 383 isc_time_t expires; 384 isc_time_t next_timeout; 385 isc_interval_t interval; 386 dns_message_t *qmessage; 387 ISC_LIST(resquery_t) queries; 388 dns_adbfindlist_t finds; 389 /* 390 * This is a state to keep track of the latest upstream server which is 391 * being queried. See `nextaddress()`. 392 * 393 * `addrinfo` is basically a copy of `foundaddrinfo` but came from the 394 * response of the query, so fields like the SRTT/timing might have been 395 * altered. So it might be possible (?) to wrap those two in an union 396 * for clarity (and memory saving). 397 */ 398 dns_adbaddrinfo_t *foundaddrinfo; 399 /* 400 * altfinds are names and/or addresses of dual stack servers that 401 * should be used when iterative resolution to a server is not 402 * possible because the address family of that server is not usable. 403 */ 404 dns_adbfindlist_t altfinds; 405 dns_adbfind_t *altfind; 406 dns_adbaddrinfolist_t forwaddrs; 407 dns_adbaddrinfolist_t altaddrs; 408 dns_forwarderlist_t forwarders; 409 dns_fwdpolicy_t fwdpolicy; 410 isc_sockaddrlist_t bad; 411 ISC_LIST(struct tried) edns; 412 dns_validator_t *validator; 413 ISC_LIST(dns_validator_t) validators; 414 dns_db_t *cache; 415 dns_adb_t *adb; 416 dns_dispatchmgr_t *dispatchmgr; 417 bool ns_ttl_ok; 418 uint32_t ns_ttl; 419 isc_counter_t *qc; 420 isc_counter_t *gqc; 421 bool minimized; 422 unsigned int qmin_labels; 423 isc_result_t qmin_warning; 424 bool force_qmin_warning; 425 bool ip6arpaskip; 426 bool forwarding; 427 dns_fixedname_t qminfname; 428 dns_name_t *qminname; 429 dns_rdatatype_t qmintype; 430 dns_fetch_t *qminfetch; 431 dns_rdataset_t qminrrset; 432 dns_fixedname_t qmindcfname; 433 dns_name_t *qmindcname; 434 dns_fixedname_t fwdfname; 435 dns_name_t *fwdname; 436 437 /*% 438 * Used to track started ADB finds with event. 439 */ 440 size_t pending_running; 441 dns_adbfindlist_t pending_finds; 442 443 /*% 444 * The number of times we've "restarted" the current 445 * nameserver set. This acts as a failsafe to prevent 446 * us from pounding constantly on a particular set of 447 * servers that, for whatever reason, are not giving 448 * us useful responses, but are responding in such a 449 * way that they are not marked "bad". 450 */ 451 unsigned int restarts; 452 453 /*% 454 * The number of timeouts that have occurred since we 455 * last successfully received a response packet. This 456 * is used for EDNS0 black hole detection. 457 */ 458 unsigned int timeouts; 459 460 /*% 461 * Look aside state for DS lookups. 462 */ 463 dns_fixedname_t nsfname; 464 dns_name_t *nsname; 465 466 dns_fetch_t *nsfetch; 467 dns_rdataset_t nsrrset; 468 469 /*% 470 * Number of queries that reference this context. 471 */ 472 atomic_uint_fast32_t nqueries; /* Bucket lock. */ 473 474 /*% 475 * Random numbers to use for mixing up server addresses. 476 */ 477 uint32_t rand_buf; 478 uint32_t rand_bits; 479 480 /*% 481 * Fetch-local statistics for detailed logging. 482 */ 483 isc_result_t result; /*%< fetch result */ 484 isc_result_t vresult; /*%< validation result */ 485 isc_time_t start; 486 uint64_t duration; 487 bool logged; 488 unsigned int querysent; 489 unsigned int referrals; 490 unsigned int lamecount; 491 unsigned int quotacount; 492 unsigned int neterr; 493 unsigned int badresp; 494 unsigned int adberr; 495 unsigned int findfail; 496 unsigned int valfail; 497 bool timeout; 498 dns_adbaddrinfo_t *addrinfo; 499 unsigned int depth; 500 char clientstr[ISC_SOCKADDR_FORMATSIZE]; 501 502 isc_counter_t *nvalidations; 503 isc_counter_t *nfails; 504 505 fetchctx_t *parent; 506 }; 507 508 #define FCTX_MAGIC ISC_MAGIC('F', '!', '!', '!') 509 #define VALID_FCTX(fctx) ISC_MAGIC_VALID(fctx, FCTX_MAGIC) 510 511 #define FCTX_ATTR_HAVEANSWER 0x0001 512 #define FCTX_ATTR_GLUING 0x0002 513 #define FCTX_ATTR_ADDRWAIT 0x0004 514 #define FCTX_ATTR_WANTCACHE 0x0010 515 #define FCTX_ATTR_WANTNCACHE 0x0020 516 #define FCTX_ATTR_NEEDEDNS0 0x0040 517 #define FCTX_ATTR_TRIEDFIND 0x0080 518 #define FCTX_ATTR_TRIEDALT 0x0100 519 520 #define HAVE_ANSWER(f) \ 521 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_HAVEANSWER) != 0) 522 #define GLUING(f) \ 523 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_GLUING) != 0) 524 #define ADDRWAIT(f) \ 525 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_ADDRWAIT) != 0) 526 #define SHUTTINGDOWN(f) ((f)->state == fetchstate_done) 527 #define WANTCACHE(f) \ 528 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_WANTCACHE) != 0) 529 #define WANTNCACHE(f) \ 530 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_WANTNCACHE) != 0) 531 #define NEEDEDNS0(f) \ 532 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_NEEDEDNS0) != 0) 533 #define TRIEDFIND(f) \ 534 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_TRIEDFIND) != 0) 535 #define TRIEDALT(f) \ 536 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_TRIEDALT) != 0) 537 538 #define FCTX_ATTR_SET(f, a) atomic_fetch_or_release(&(f)->attributes, (a)) 539 #define FCTX_ATTR_CLR(f, a) atomic_fetch_and_release(&(f)->attributes, ~(a)) 540 541 typedef struct { 542 dns_adbaddrinfo_t *addrinfo; 543 fetchctx_t *fctx; 544 } dns_valarg_t; 545 546 struct dns_fetch { 547 unsigned int magic; 548 isc_mem_t *mctx; 549 dns_resolver_t *res; 550 fetchctx_t *private; 551 }; 552 553 #define DNS_FETCH_MAGIC ISC_MAGIC('F', 't', 'c', 'h') 554 #define DNS_FETCH_VALID(fetch) ISC_MAGIC_VALID(fetch, DNS_FETCH_MAGIC) 555 556 typedef struct alternate { 557 bool isaddress; 558 union { 559 isc_sockaddr_t addr; 560 struct { 561 dns_name_t name; 562 in_port_t port; 563 } _n; 564 } _u; 565 ISC_LINK(struct alternate) link; 566 } alternate_t; 567 568 struct dns_resolver { 569 /* Unlocked. */ 570 unsigned int magic; 571 isc_mem_t *mctx; 572 isc_mutex_t lock; 573 isc_mutex_t primelock; 574 dns_rdataclass_t rdclass; 575 isc_loopmgr_t *loopmgr; 576 isc_nm_t *nm; 577 dns_view_t *view; 578 bool frozen; 579 unsigned int options; 580 isc_tlsctx_cache_t *tlsctx_cache; 581 dns_dispatchset_t *dispatches4; 582 dns_dispatchset_t *dispatches6; 583 584 isc_hashmap_t *fctxs; 585 isc_rwlock_t fctxs_lock; 586 587 isc_hashmap_t *counters; 588 isc_rwlock_t counters_lock; 589 590 uint32_t lame_ttl; 591 ISC_LIST(alternate_t) alternates; 592 dns_nametree_t *algorithms; 593 dns_nametree_t *digests; 594 dns_nametree_t *mustbesecure; 595 unsigned int spillatmax; 596 unsigned int spillatmin; 597 isc_timer_t *spillattimer; 598 bool zero_no_soa_ttl; 599 unsigned int query_timeout; 600 unsigned int maxdepth; 601 unsigned int maxqueries; 602 isc_result_t quotaresp[2]; 603 isc_stats_t *stats; 604 dns_stats_t *querystats; 605 606 /* Additions for serve-stale feature. */ 607 unsigned int retryinterval; /* in milliseconds */ 608 unsigned int nonbackofftries; 609 610 /* Atomic */ 611 isc_refcount_t references; 612 atomic_uint_fast32_t zspill; /* fetches-per-zone */ 613 atomic_bool exiting; 614 atomic_bool priming; 615 616 atomic_uint_fast32_t maxvalidations; 617 atomic_uint_fast32_t maxvalidationfails; 618 619 /* Locked by lock. */ 620 unsigned int spillat; /* clients-per-query */ 621 622 /* Locked by primelock. */ 623 dns_fetch_t *primefetch; 624 625 uint32_t nloops; 626 627 isc_mempool_t **namepools; 628 isc_mempool_t **rdspools; 629 }; 630 631 #define RES_MAGIC ISC_MAGIC('R', 'e', 's', '!') 632 #define VALID_RESOLVER(res) ISC_MAGIC_VALID(res, RES_MAGIC) 633 634 /*% 635 * Private addrinfo flags. 636 */ 637 enum { 638 FCTX_ADDRINFO_MARK = 1 << 0, 639 FCTX_ADDRINFO_FORWARDER = 1 << 1, 640 FCTX_ADDRINFO_EDNSOK = 1 << 2, 641 FCTX_ADDRINFO_NOCOOKIE = 1 << 3, 642 FCTX_ADDRINFO_BADCOOKIE = 1 << 4, 643 FCTX_ADDRINFO_DUALSTACK = 1 << 5, 644 FCTX_ADDRINFO_NOEDNS0 = 1 << 6, 645 }; 646 647 #define UNMARKED(a) (((a)->flags & FCTX_ADDRINFO_MARK) == 0) 648 #define ISFORWARDER(a) (((a)->flags & FCTX_ADDRINFO_FORWARDER) != 0) 649 #define NOCOOKIE(a) (((a)->flags & FCTX_ADDRINFO_NOCOOKIE) != 0) 650 #define EDNSOK(a) (((a)->flags & FCTX_ADDRINFO_EDNSOK) != 0) 651 #define BADCOOKIE(a) (((a)->flags & FCTX_ADDRINFO_BADCOOKIE) != 0) 652 #define ISDUALSTACK(a) (((a)->flags & FCTX_ADDRINFO_DUALSTACK) != 0) 653 654 #define NXDOMAIN(r) (((r)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0) 655 #define NEGATIVE(r) (((r)->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) 656 #define STATICSTUB(r) (((r)->attributes & DNS_RDATASETATTR_STATICSTUB) != 0) 657 658 #ifdef ENABLE_AFL 659 bool dns_fuzzing_resolver = false; 660 void 661 dns_resolver_setfuzzing(void) { 662 dns_fuzzing_resolver = true; 663 } 664 #endif /* ifdef ENABLE_AFL */ 665 666 static unsigned char ip6_arpa_data[] = "\003IP6\004ARPA"; 667 static unsigned char ip6_arpa_offsets[] = { 0, 4, 9 }; 668 static const dns_name_t ip6_arpa = DNS_NAME_INITABSOLUTE(ip6_arpa_data, 669 ip6_arpa_offsets); 670 671 static void 672 dns_resolver__destroy(dns_resolver_t *res); 673 static isc_result_t 674 resquery_send(resquery_t *query); 675 static void 676 resquery_response(isc_result_t eresult, isc_region_t *region, void *arg); 677 static void 678 resquery_response_continue(void *arg, isc_result_t result); 679 static void 680 resquery_connected(isc_result_t eresult, isc_region_t *region, void *arg); 681 static void 682 fctx_try(fetchctx_t *fctx, bool retrying); 683 static void 684 fctx_shutdown(void *arg); 685 static void 686 fctx_minimize_qname(fetchctx_t *fctx); 687 static void 688 fctx_destroy(fetchctx_t *fctx); 689 static isc_result_t 690 ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node, 691 dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl, 692 dns_ttl_t maxttl, bool optout, bool secure, 693 dns_rdataset_t *ardataset, isc_result_t *eresultp); 694 static void 695 validated(void *arg); 696 static void 697 add_bad(fetchctx_t *fctx, dns_message_t *rmessage, dns_adbaddrinfo_t *addrinfo, 698 isc_result_t reason, badnstype_t badtype); 699 static isc_result_t 700 findnoqname(fetchctx_t *fctx, dns_message_t *message, dns_name_t *name, 701 dns_rdatatype_t type, dns_name_t **noqname); 702 703 #define fctx_done_detach(fctxp, result) \ 704 if (fctx__done(*fctxp, result, __func__, __FILE__, __LINE__)) { \ 705 fetchctx_detach(fctxp); \ 706 } 707 708 #define fctx_done_unref(fctx, result) \ 709 if (fctx__done(fctx, result, __func__, __FILE__, __LINE__)) { \ 710 fetchctx_unref(fctx); \ 711 } 712 713 #if DNS_RESOLVER_TRACE 714 #define fetchctx_ref(ptr) fetchctx__ref(ptr, __func__, __FILE__, __LINE__) 715 #define fetchctx_unref(ptr) fetchctx__unref(ptr, __func__, __FILE__, __LINE__) 716 #define fetchctx_attach(ptr, ptrp) \ 717 fetchctx__attach(ptr, ptrp, __func__, __FILE__, __LINE__) 718 #define fetchctx_detach(ptrp) \ 719 fetchctx__detach(ptrp, __func__, __FILE__, __LINE__) 720 ISC_REFCOUNT_TRACE_DECL(fetchctx); 721 #else 722 ISC_REFCOUNT_DECL(fetchctx); 723 #endif 724 725 static bool 726 fctx__done(fetchctx_t *fctx, isc_result_t result, const char *func, 727 const char *file, unsigned int line); 728 729 static void 730 resume_qmin(void *arg); 731 732 static isc_result_t 733 get_attached_fctx(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name, 734 dns_rdatatype_t type, const dns_name_t *domain, 735 dns_rdataset_t *nameservers, const isc_sockaddr_t *client, 736 unsigned int options, unsigned int depth, isc_counter_t *qc, 737 isc_counter_t *gqc, fetchctx_t *parent, fetchctx_t **fctxp, 738 bool *new_fctx); 739 740 /*% 741 * The structure and functions defined below implement the resolver 742 * query (resquery) response handling logic. 743 * 744 * When a resolver query is sent and a response is received, the 745 * resquery_response() event handler is run, which calls the rctx_*() 746 * functions. The respctx_t structure maintains state from function 747 * to function. 748 * 749 * The call flow is described below: 750 * 751 * 1. resquery_response(): 752 * - Initialize a respctx_t structure (rctx_respinit()). 753 * - Check for dispatcher failure (rctx_dispfail()). 754 * - Parse the response (rctx_parse()). 755 * - Log the response (rctx_logpacket()). 756 * - Check the parsed response for an OPT record and handle 757 * EDNS (rctx_opt(), rctx_edns()). 758 * - Check for a bad or lame server (rctx_badserver(), rctx_lameserver()). 759 * - If RCODE and ANCOUNT suggest this is a positive answer, and 760 * if so, call rctx_answer(): go to step 2. 761 * - If RCODE and NSCOUNT suggest this is a negative answer or a 762 * referral, call rctx_answer_none(): go to step 4. 763 * - Check the additional section for data that should be cached 764 * (rctx_additional()). 765 * - Clean up and finish by calling rctx_done(): go to step 5. 766 * 767 * 2. rctx_answer(): 768 * - If the answer appears to be positive, call rctx_answer_positive(): 769 * go to step 3. 770 * - If the response is a malformed delegation (with glue or NS records 771 * in the answer section), call rctx_answer_none(): go to step 4. 772 * 773 * 3. rctx_answer_positive(): 774 * - Initialize the portions of respctx_t needed for processing an answer 775 * (rctx_answer_init()). 776 * - Scan the answer section to find records that are responsive to the 777 * query (rctx_answer_scan()). 778 * - For whichever type of response was found, call a separate routine 779 * to handle it: matching QNAME/QTYPE (rctx_answer_match()), 780 * CNAME (rctx_answer_cname()), covering DNAME (rctx_answer_dname()), 781 * or any records returned in response to a query of type ANY 782 * (rctx_answer_any()). 783 * - Scan the authority section for NS or other records that may be 784 * included with a positive answer (rctx_authority_scan()). 785 * 786 * 4. rctx_answer_none(): 787 * - Determine whether this is an NXDOMAIN, NXRRSET, or referral. 788 * - If referral, set up the resolver to follow the delegation 789 * (rctx_referral()). 790 * - If NXDOMAIN/NXRRSET, scan the authority section for NS and SOA 791 * records included with a negative response (rctx_authority_negative()), 792 * then for DNSSEC proof of nonexistence (rctx_authority_dnssec()). 793 * 794 * 5. rctx_done(): 795 * - Set up chasing of DS records if needed (rctx_chaseds()). 796 * - If the response wasn't intended for us, wait for another response 797 * from the dispatcher (rctx_next()). 798 * - If there is a problem with the responding server, set up another 799 * query to a different server (rctx_nextserver()). 800 * - If there is a problem that might be temporary or dependent on 801 * EDNS options, set up another query to the same server with changed 802 * options (rctx_resend()). 803 * - Shut down the fetch context. 804 */ 805 806 typedef struct respctx { 807 resquery_t *query; 808 fetchctx_t *fctx; 809 isc_mem_t *mctx; 810 isc_result_t result; 811 isc_buffer_t buffer; 812 unsigned int retryopts; /* updated options to pass to 813 * fctx_query() when resending */ 814 815 dns_rdatatype_t type; /* type being sought (set to 816 * ANY if qtype was SIG or RRSIG) */ 817 bool aa; /* authoritative answer? */ 818 dns_trust_t trust; /* answer trust level */ 819 bool chaining; /* CNAME/DNAME processing? */ 820 bool next_server; /* give up, try the next server 821 * */ 822 823 badnstype_t broken_type; /* type of name server problem 824 * */ 825 isc_result_t broken_server; 826 827 bool get_nameservers; /* get a new NS rrset at 828 * zone cut? */ 829 bool resend; /* resend this query? */ 830 bool secured; /* message was signed or had a valid cookie */ 831 bool nextitem; /* invalid response; keep 832 * listening for the correct one */ 833 bool truncated; /* response was truncated */ 834 bool no_response; /* no response was received */ 835 bool glue_in_answer; /* glue may be in the answer 836 * section */ 837 bool ns_in_answer; /* NS may be in the answer 838 * section */ 839 bool negative; /* is this a negative response? */ 840 841 isc_stdtime_t now; /* time info */ 842 isc_time_t tnow; 843 isc_time_t *finish; 844 845 unsigned int dname_labels; 846 unsigned int domain_labels; /* range of permissible number 847 * of 848 * labels in a DNAME */ 849 850 dns_name_t *aname; /* answer name */ 851 dns_rdataset_t *ardataset; /* answer rdataset */ 852 853 dns_name_t *cname; /* CNAME name */ 854 dns_rdataset_t *crdataset; /* CNAME rdataset */ 855 856 dns_name_t *dname; /* DNAME name */ 857 dns_rdataset_t *drdataset; /* DNAME rdataset */ 858 859 dns_name_t *ns_name; /* NS name */ 860 dns_rdataset_t *ns_rdataset; /* NS rdataset */ 861 862 dns_name_t *soa_name; /* SOA name in a negative answer */ 863 dns_name_t *ds_name; /* DS name in a negative answer */ 864 865 dns_name_t *found_name; /* invalid name in negative 866 * response */ 867 dns_rdatatype_t found_type; /* invalid type in negative 868 * response */ 869 870 dns_rdataset_t *opt; /* OPT rdataset */ 871 } respctx_t; 872 873 static void 874 rctx_respinit(resquery_t *query, fetchctx_t *fctx, isc_result_t result, 875 isc_region_t *region, respctx_t *rctx); 876 877 static void 878 rctx_answer_init(respctx_t *rctx); 879 880 static void 881 rctx_answer_scan(respctx_t *rctx); 882 883 static void 884 rctx_authority_positive(respctx_t *rctx); 885 886 static isc_result_t 887 rctx_answer_any(respctx_t *rctx); 888 889 static isc_result_t 890 rctx_answer_match(respctx_t *rctx); 891 892 static isc_result_t 893 rctx_answer_cname(respctx_t *rctx); 894 895 static isc_result_t 896 rctx_answer_dname(respctx_t *rctx); 897 898 static isc_result_t 899 rctx_answer_positive(respctx_t *rctx); 900 901 static isc_result_t 902 rctx_authority_negative(respctx_t *rctx); 903 904 static isc_result_t 905 rctx_authority_dnssec(respctx_t *rctx); 906 907 static void 908 rctx_additional(respctx_t *rctx); 909 910 static isc_result_t 911 rctx_referral(respctx_t *rctx); 912 913 static isc_result_t 914 rctx_answer_none(respctx_t *rctx); 915 916 static void 917 rctx_nextserver(respctx_t *rctx, dns_message_t *message, 918 dns_adbaddrinfo_t *addrinfo, isc_result_t result); 919 920 static void 921 rctx_resend(respctx_t *rctx, dns_adbaddrinfo_t *addrinfo); 922 923 static isc_result_t 924 rctx_next(respctx_t *rctx); 925 926 static void 927 rctx_chaseds(respctx_t *rctx, dns_message_t *message, 928 dns_adbaddrinfo_t *addrinfo, isc_result_t result); 929 930 static void 931 rctx_done(respctx_t *rctx, isc_result_t result); 932 933 static void 934 rctx_logpacket(respctx_t *rctx); 935 936 static void 937 rctx_opt(respctx_t *rctx); 938 939 static void 940 rctx_edns(respctx_t *rctx); 941 942 static isc_result_t 943 rctx_parse(respctx_t *rctx); 944 945 static isc_result_t 946 rctx_badserver(respctx_t *rctx, isc_result_t result); 947 948 static isc_result_t 949 rctx_answer(respctx_t *rctx); 950 951 static isc_result_t 952 rctx_lameserver(respctx_t *rctx); 953 954 static isc_result_t 955 rctx_dispfail(respctx_t *rctx); 956 957 static isc_result_t 958 rctx_timedout(respctx_t *rctx); 959 960 static void 961 rctx_ncache(respctx_t *rctx); 962 963 /*% 964 * Increment resolver-related statistics counters. 965 */ 966 static void 967 inc_stats(dns_resolver_t *res, isc_statscounter_t counter) { 968 if (res->stats != NULL) { 969 isc_stats_increment(res->stats, counter); 970 } 971 } 972 973 static void 974 dec_stats(dns_resolver_t *res, isc_statscounter_t counter) { 975 if (res->stats != NULL) { 976 isc_stats_decrement(res->stats, counter); 977 } 978 } 979 980 static void 981 set_stats(dns_resolver_t *res, isc_statscounter_t counter, uint64_t val) { 982 if (res->stats != NULL) { 983 isc_stats_set(res->stats, val, counter); 984 } 985 } 986 987 static isc_result_t 988 valcreate(fetchctx_t *fctx, dns_message_t *message, dns_adbaddrinfo_t *addrinfo, 989 dns_name_t *name, dns_rdatatype_t type, dns_rdataset_t *rdataset, 990 dns_rdataset_t *sigrdataset, unsigned int valoptions) { 991 dns_validator_t *validator = NULL; 992 dns_valarg_t *valarg = NULL; 993 isc_result_t result; 994 995 valarg = isc_mem_get(fctx->mctx, sizeof(*valarg)); 996 *valarg = (dns_valarg_t){ 997 .addrinfo = addrinfo, 998 }; 999 1000 fetchctx_attach(fctx, &valarg->fctx); 1001 1002 if (!ISC_LIST_EMPTY(fctx->validators)) { 1003 valoptions |= DNS_VALIDATOR_DEFER; 1004 } else { 1005 valoptions &= ~DNS_VALIDATOR_DEFER; 1006 } 1007 1008 result = dns_validator_create( 1009 fctx->res->view, name, type, rdataset, sigrdataset, message, 1010 valoptions, fctx->loop, validated, valarg, fctx->nvalidations, 1011 fctx->nfails, fctx->qc, fctx->gqc, fctx, &fctx->edectx, 1012 &validator); 1013 RUNTIME_CHECK(result == ISC_R_SUCCESS); 1014 inc_stats(fctx->res, dns_resstatscounter_val); 1015 if ((valoptions & DNS_VALIDATOR_DEFER) == 0) { 1016 INSIST(fctx->validator == NULL); 1017 fctx->validator = validator; 1018 } 1019 ISC_LIST_APPEND(fctx->validators, validator, link); 1020 return ISC_R_SUCCESS; 1021 } 1022 1023 static void 1024 resquery_destroy(resquery_t *query) { 1025 fetchctx_t *fctx = query->fctx; 1026 1027 query->magic = 0; 1028 1029 if (ISC_LINK_LINKED(query, link)) { 1030 ISC_LIST_UNLINK(fctx->queries, query, link); 1031 } 1032 1033 if (query->tsig != NULL) { 1034 isc_buffer_free(&query->tsig); 1035 } 1036 1037 if (query->tsigkey != NULL) { 1038 dns_tsigkey_detach(&query->tsigkey); 1039 } 1040 1041 if (query->dispentry != NULL) { 1042 dns_dispatch_done(&query->dispentry); 1043 } 1044 1045 if (query->dispatch != NULL) { 1046 dns_dispatch_detach(&query->dispatch); 1047 } 1048 1049 LOCK(&fctx->lock); 1050 atomic_fetch_sub_release(&fctx->nqueries, 1); 1051 UNLOCK(&fctx->lock); 1052 1053 if (query->rmessage != NULL) { 1054 dns_message_detach(&query->rmessage); 1055 } 1056 1057 isc_mem_put(fctx->mctx, query, sizeof(*query)); 1058 1059 fetchctx_detach(&fctx); 1060 } 1061 1062 #if DNS_RESOLVER_TRACE 1063 ISC_REFCOUNT_TRACE_IMPL(resquery, resquery_destroy); 1064 #else 1065 ISC_REFCOUNT_IMPL(resquery, resquery_destroy); 1066 #endif 1067 1068 /*% 1069 * Update EDNS statistics for a server after not getting a response to a UDP 1070 * query sent to it. 1071 */ 1072 static void 1073 update_edns_stats(resquery_t *query) { 1074 fetchctx_t *fctx = query->fctx; 1075 1076 if ((query->options & DNS_FETCHOPT_TCP) != 0) { 1077 return; 1078 } 1079 1080 if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0) { 1081 dns_adb_ednsto(fctx->adb, query->addrinfo); 1082 } else { 1083 dns_adb_timeout(fctx->adb, query->addrinfo); 1084 } 1085 } 1086 1087 static void 1088 fctx_expired(void *arg); 1089 1090 /* 1091 * Start the maximum lifetime timer for the fetch. This will 1092 * trigger if, for example, some ADB or validator dependency 1093 * loop occurs and causes a fetch to hang. 1094 */ 1095 static void 1096 fctx_starttimer(fetchctx_t *fctx) { 1097 isc_interval_t interval; 1098 isc_time_t now; 1099 isc_time_t expires; 1100 1101 isc_interval_set(&interval, 2, 0); 1102 isc_time_add(&fctx->expires, &interval, &expires); 1103 1104 now = isc_time_now(); 1105 if (isc_time_compare(&expires, &now) <= 0) { 1106 isc_interval_set(&interval, 0, 1); 1107 } else { 1108 isc_time_subtract(&expires, &now, &interval); 1109 } 1110 1111 isc_timer_start(fctx->timer, isc_timertype_once, &interval); 1112 } 1113 1114 static void 1115 fctx_stoptimer(fetchctx_t *fctx) { 1116 isc_timer_stop(fctx->timer); 1117 } 1118 1119 static void 1120 fctx_cancelquery(resquery_t **queryp, isc_time_t *finish, bool no_response, 1121 bool age_untried) { 1122 resquery_t *query = NULL; 1123 fetchctx_t *fctx = NULL; 1124 dns_adbfind_t *find = NULL; 1125 dns_adbaddrinfo_t *addrinfo; 1126 isc_stdtime_t now = isc_stdtime_now(); 1127 1128 REQUIRE(queryp != NULL); 1129 1130 query = *queryp; 1131 fctx = query->fctx; 1132 1133 if (RESQUERY_CANCELED(query)) { 1134 return; 1135 } 1136 1137 FCTXTRACE("cancelquery"); 1138 1139 query->attributes |= RESQUERY_ATTR_CANCELED; 1140 1141 /* 1142 * Should we update the RTT? 1143 */ 1144 if (finish != NULL || no_response) { 1145 unsigned int rtt, factor; 1146 if (finish != NULL) { 1147 /* 1148 * We have both the start and finish times for this 1149 * packet, so we can compute a real RTT. 1150 */ 1151 unsigned int rttms; 1152 1153 rtt = (unsigned int)isc_time_microdiff(finish, 1154 &query->start); 1155 rttms = rtt / US_PER_MS; 1156 factor = DNS_ADB_RTTADJDEFAULT; 1157 1158 if (rttms < DNS_RESOLVER_QRYRTTCLASS0) { 1159 inc_stats(fctx->res, 1160 dns_resstatscounter_queryrtt0); 1161 } else if (rttms < DNS_RESOLVER_QRYRTTCLASS1) { 1162 inc_stats(fctx->res, 1163 dns_resstatscounter_queryrtt1); 1164 } else if (rttms < DNS_RESOLVER_QRYRTTCLASS2) { 1165 inc_stats(fctx->res, 1166 dns_resstatscounter_queryrtt2); 1167 } else if (rttms < DNS_RESOLVER_QRYRTTCLASS3) { 1168 inc_stats(fctx->res, 1169 dns_resstatscounter_queryrtt3); 1170 } else if (rttms < DNS_RESOLVER_QRYRTTCLASS4) { 1171 inc_stats(fctx->res, 1172 dns_resstatscounter_queryrtt4); 1173 } else { 1174 inc_stats(fctx->res, 1175 dns_resstatscounter_queryrtt5); 1176 } 1177 } else { 1178 uint32_t value; 1179 uint32_t mask; 1180 1181 update_edns_stats(query); 1182 1183 /* 1184 * If "forward first;" is used and a forwarder timed 1185 * out, do not attempt to query it again in this fetch 1186 * context. 1187 */ 1188 if (fctx->fwdpolicy == dns_fwdpolicy_first && 1189 ISFORWARDER(query->addrinfo)) 1190 { 1191 add_bad(fctx, query->rmessage, query->addrinfo, 1192 ISC_R_TIMEDOUT, badns_forwarder); 1193 } 1194 1195 /* 1196 * We don't have an RTT for this query. Maybe the 1197 * packet was lost, or maybe this server is very 1198 * slow. We don't know. Increase the RTT. 1199 */ 1200 INSIST(no_response); 1201 value = isc_random32(); 1202 if (query->addrinfo->srtt > 800000) { 1203 mask = 0x3fff; 1204 } else if (query->addrinfo->srtt > 400000) { 1205 mask = 0x7fff; 1206 } else if (query->addrinfo->srtt > 200000) { 1207 mask = 0xffff; 1208 } else if (query->addrinfo->srtt > 100000) { 1209 mask = 0x1ffff; 1210 } else if (query->addrinfo->srtt > 50000) { 1211 mask = 0x3ffff; 1212 } else if (query->addrinfo->srtt > 25000) { 1213 mask = 0x7ffff; 1214 } else { 1215 mask = 0xfffff; 1216 } 1217 1218 /* 1219 * Don't adjust timeout on EDNS queries unless we have 1220 * seen a EDNS response. 1221 */ 1222 if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0 && 1223 !EDNSOK(query->addrinfo)) 1224 { 1225 mask >>= 2; 1226 } 1227 1228 rtt = query->addrinfo->srtt + (value & mask); 1229 if (rtt > MAX_SINGLE_QUERY_TIMEOUT_US) { 1230 rtt = MAX_SINGLE_QUERY_TIMEOUT_US; 1231 } 1232 if (rtt > fctx->res->query_timeout * US_PER_MS) { 1233 rtt = fctx->res->query_timeout * US_PER_MS; 1234 } 1235 1236 /* 1237 * Replace the current RTT with our value. 1238 */ 1239 factor = DNS_ADB_RTTADJREPLACE; 1240 } 1241 1242 dns_adb_adjustsrtt(fctx->adb, query->addrinfo, rtt, factor); 1243 } 1244 1245 if ((query->options & DNS_FETCHOPT_TCP) == 0) { 1246 /* Inform the ADB that we're ending a UDP fetch */ 1247 dns_adb_endudpfetch(fctx->adb, query->addrinfo); 1248 } 1249 1250 /* 1251 * Age RTTs of servers not tried. 1252 */ 1253 if (finish != NULL || age_untried) { 1254 for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs); 1255 addrinfo != NULL; 1256 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 1257 { 1258 if (UNMARKED(addrinfo)) { 1259 dns_adb_agesrtt(fctx->adb, addrinfo, now); 1260 } 1261 } 1262 } 1263 1264 if ((finish != NULL || age_untried) && TRIEDFIND(fctx)) { 1265 for (find = ISC_LIST_HEAD(fctx->finds); find != NULL; 1266 find = ISC_LIST_NEXT(find, publink)) 1267 { 1268 for (addrinfo = ISC_LIST_HEAD(find->list); 1269 addrinfo != NULL; 1270 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 1271 { 1272 if (UNMARKED(addrinfo)) { 1273 dns_adb_agesrtt(fctx->adb, addrinfo, 1274 now); 1275 } 1276 } 1277 } 1278 } 1279 1280 if ((finish != NULL || age_untried) && TRIEDALT(fctx)) { 1281 for (addrinfo = ISC_LIST_HEAD(fctx->altaddrs); addrinfo != NULL; 1282 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 1283 { 1284 if (UNMARKED(addrinfo)) { 1285 dns_adb_agesrtt(fctx->adb, addrinfo, now); 1286 } 1287 } 1288 for (find = ISC_LIST_HEAD(fctx->altfinds); find != NULL; 1289 find = ISC_LIST_NEXT(find, publink)) 1290 { 1291 for (addrinfo = ISC_LIST_HEAD(find->list); 1292 addrinfo != NULL; 1293 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 1294 { 1295 if (UNMARKED(addrinfo)) { 1296 dns_adb_agesrtt(fctx->adb, addrinfo, 1297 now); 1298 } 1299 } 1300 } 1301 } 1302 1303 /* 1304 * Check for any outstanding dispatch responses and if they 1305 * exist, cancel them. 1306 */ 1307 if (query->dispentry != NULL) { 1308 dns_dispatch_done(&query->dispentry); 1309 } 1310 1311 LOCK(&fctx->lock); 1312 if (ISC_LINK_LINKED(query, link)) { 1313 ISC_LIST_UNLINK(fctx->queries, query, link); 1314 } 1315 UNLOCK(&fctx->lock); 1316 1317 resquery_detach(queryp); 1318 } 1319 1320 static void 1321 fctx_cleanup(fetchctx_t *fctx) { 1322 dns_adbfind_t *find = NULL, *next_find = NULL; 1323 dns_adbaddrinfo_t *addr = NULL, *next_addr = NULL; 1324 1325 REQUIRE(ISC_LIST_EMPTY(fctx->queries)); 1326 1327 for (find = ISC_LIST_HEAD(fctx->finds); find != NULL; find = next_find) 1328 { 1329 next_find = ISC_LIST_NEXT(find, publink); 1330 ISC_LIST_UNLINK(fctx->finds, find, publink); 1331 dns_adb_destroyfind(&find); 1332 fetchctx_unref(fctx); 1333 } 1334 fctx->foundaddrinfo = NULL; 1335 1336 for (find = ISC_LIST_HEAD(fctx->altfinds); find != NULL; 1337 find = next_find) 1338 { 1339 next_find = ISC_LIST_NEXT(find, publink); 1340 ISC_LIST_UNLINK(fctx->altfinds, find, publink); 1341 dns_adb_destroyfind(&find); 1342 fetchctx_unref(fctx); 1343 } 1344 fctx->altfind = NULL; 1345 1346 for (addr = ISC_LIST_HEAD(fctx->forwaddrs); addr != NULL; 1347 addr = next_addr) 1348 { 1349 next_addr = ISC_LIST_NEXT(addr, publink); 1350 ISC_LIST_UNLINK(fctx->forwaddrs, addr, publink); 1351 dns_adb_freeaddrinfo(fctx->adb, &addr); 1352 } 1353 1354 for (addr = ISC_LIST_HEAD(fctx->altaddrs); addr != NULL; 1355 addr = next_addr) 1356 { 1357 next_addr = ISC_LIST_NEXT(addr, publink); 1358 ISC_LIST_UNLINK(fctx->altaddrs, addr, publink); 1359 dns_adb_freeaddrinfo(fctx->adb, &addr); 1360 } 1361 } 1362 1363 static void 1364 fctx_cancelqueries(fetchctx_t *fctx, bool no_response, bool age_untried) { 1365 resquery_t *query = NULL, *next_query = NULL; 1366 ISC_LIST(resquery_t) queries; 1367 1368 FCTXTRACE("cancelqueries"); 1369 1370 ISC_LIST_INIT(queries); 1371 1372 /* 1373 * Move the queries to a local list so we can cancel 1374 * them without holding the lock. 1375 */ 1376 LOCK(&fctx->lock); 1377 ISC_LIST_MOVE(queries, fctx->queries); 1378 UNLOCK(&fctx->lock); 1379 1380 for (query = ISC_LIST_HEAD(queries); query != NULL; query = next_query) 1381 { 1382 next_query = ISC_LIST_NEXT(query, link); 1383 1384 /* 1385 * Note that we have to unlink the query here, 1386 * because if it's still linked in fctx_cancelquery(), 1387 * then it will try to unlink it from fctx->queries. 1388 */ 1389 ISC_LIST_UNLINK(queries, query, link); 1390 fctx_cancelquery(&query, NULL, no_response, age_untried); 1391 } 1392 } 1393 1394 static void 1395 fcount_logspill(fetchctx_t *fctx, fctxcount_t *counter, bool final) { 1396 char dbuf[DNS_NAME_FORMATSIZE]; 1397 isc_stdtime_t now; 1398 1399 if (!isc_log_wouldlog(dns_lctx, ISC_LOG_INFO)) { 1400 return; 1401 } 1402 1403 /* Do not log a message if there were no dropped fetches. */ 1404 if (counter->dropped == 0) { 1405 return; 1406 } 1407 1408 /* Do not log the cumulative message if the previous log is recent. */ 1409 now = isc_stdtime_now(); 1410 if (!final && counter->logged > now - 60) { 1411 return; 1412 } 1413 1414 dns_name_format(fctx->domain, dbuf, sizeof(dbuf)); 1415 1416 if (!final) { 1417 isc_log_write(dns_lctx, DNS_LOGCATEGORY_SPILL, 1418 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 1419 "too many simultaneous fetches for %s " 1420 "(allowed %" PRIuFAST32 " spilled %" PRIuFAST32 1421 "; %s)", 1422 dbuf, counter->allowed, counter->dropped, 1423 counter->dropped == 1 ? "initial trigger event" 1424 : "cumulative since " 1425 "initial trigger event"); 1426 } else { 1427 isc_log_write(dns_lctx, DNS_LOGCATEGORY_SPILL, 1428 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 1429 "fetch counters for %s now being discarded " 1430 "(allowed %" PRIuFAST32 " spilled %" PRIuFAST32 1431 "; cumulative since initial trigger event)", 1432 dbuf, counter->allowed, counter->dropped); 1433 } 1434 1435 counter->logged = now; 1436 } 1437 1438 static bool 1439 fcount_match(void *node, const void *key) { 1440 const fctxcount_t *counter = node; 1441 const dns_name_t *domain = key; 1442 1443 return dns_name_equal(counter->domain, domain); 1444 } 1445 1446 static isc_result_t 1447 fcount_incr(fetchctx_t *fctx, bool force) { 1448 isc_result_t result = ISC_R_SUCCESS; 1449 dns_resolver_t *res = NULL; 1450 fctxcount_t *counter = NULL; 1451 uint32_t hashval; 1452 uint_fast32_t spill; 1453 isc_rwlocktype_t locktype = isc_rwlocktype_read; 1454 1455 REQUIRE(fctx != NULL); 1456 res = fctx->res; 1457 REQUIRE(res != NULL); 1458 INSIST(fctx->counter == NULL); 1459 1460 /* Skip any counting if fetches-per-zone is disabled */ 1461 spill = atomic_load_acquire(&res->zspill); 1462 if (spill == 0) { 1463 return ISC_R_SUCCESS; 1464 } 1465 1466 hashval = dns_name_hash(fctx->domain); 1467 1468 RWLOCK(&res->counters_lock, locktype); 1469 result = isc_hashmap_find(res->counters, hashval, fcount_match, 1470 fctx->domain, (void **)&counter); 1471 switch (result) { 1472 case ISC_R_SUCCESS: 1473 break; 1474 case ISC_R_NOTFOUND: 1475 counter = isc_mem_get(fctx->mctx, sizeof(*counter)); 1476 *counter = (fctxcount_t){ 1477 .magic = FCTXCOUNT_MAGIC, 1478 .count = 0, 1479 .allowed = 0, 1480 }; 1481 isc_mem_attach(fctx->mctx, &counter->mctx); 1482 isc_mutex_init(&counter->lock); 1483 counter->domain = dns_fixedname_initname(&counter->dfname); 1484 dns_name_copy(fctx->domain, counter->domain); 1485 1486 UPGRADELOCK(&res->counters_lock, locktype); 1487 1488 void *found = NULL; 1489 result = isc_hashmap_add(res->counters, hashval, fcount_match, 1490 counter->domain, counter, &found); 1491 if (result == ISC_R_EXISTS) { 1492 isc_mutex_destroy(&counter->lock); 1493 isc_mem_putanddetach(&counter->mctx, counter, 1494 sizeof(*counter)); 1495 counter = found; 1496 result = ISC_R_SUCCESS; 1497 } 1498 1499 INSIST(result == ISC_R_SUCCESS); 1500 break; 1501 default: 1502 UNREACHABLE(); 1503 } 1504 INSIST(VALID_FCTXCOUNT(counter)); 1505 1506 INSIST(spill > 0); 1507 LOCK(&counter->lock); 1508 if (++counter->count > spill && !force) { 1509 counter->count--; 1510 INSIST(counter->count > 0); 1511 counter->dropped++; 1512 fcount_logspill(fctx, counter, false); 1513 result = ISC_R_QUOTA; 1514 } else { 1515 counter->allowed++; 1516 fctx->counter = counter; 1517 } 1518 UNLOCK(&counter->lock); 1519 RWUNLOCK(&res->counters_lock, locktype); 1520 1521 return result; 1522 } 1523 1524 static bool 1525 match_ptr(void *node, const void *key) { 1526 return node == key; 1527 } 1528 1529 static void 1530 fcount_decr(fetchctx_t *fctx) { 1531 REQUIRE(fctx != NULL); 1532 1533 fctxcount_t *counter = fctx->counter; 1534 if (counter == NULL) { 1535 return; 1536 } 1537 fctx->counter = NULL; 1538 1539 /* 1540 * FIXME: This should not require a write lock, but should be 1541 * implemented using reference counting later, otherwise we would could 1542 * encounter ABA problem here - the count could go up and down when we 1543 * switch from read to write lock. 1544 */ 1545 RWLOCK(&fctx->res->counters_lock, isc_rwlocktype_write); 1546 1547 LOCK(&counter->lock); 1548 INSIST(VALID_FCTXCOUNT(counter)); 1549 INSIST(counter->count > 0); 1550 if (--counter->count > 0) { 1551 UNLOCK(&counter->lock); 1552 RWUNLOCK(&fctx->res->counters_lock, isc_rwlocktype_write); 1553 return; 1554 } 1555 1556 isc_result_t result = isc_hashmap_delete(fctx->res->counters, 1557 dns_name_hash(counter->domain), 1558 match_ptr, counter); 1559 INSIST(result == ISC_R_SUCCESS); 1560 1561 fcount_logspill(fctx, counter, true); 1562 UNLOCK(&counter->lock); 1563 1564 isc_mutex_destroy(&counter->lock); 1565 isc_mem_putanddetach(&counter->mctx, counter, sizeof(*counter)); 1566 1567 RWUNLOCK(&fctx->res->counters_lock, isc_rwlocktype_write); 1568 } 1569 1570 static void 1571 spillattimer_countdown(void *arg); 1572 1573 static void 1574 fctx_sendevents(fetchctx_t *fctx, isc_result_t result) { 1575 dns_fetchresponse_t *resp = NULL, *next = NULL; 1576 unsigned int count = 0; 1577 bool logit = false; 1578 isc_time_t now; 1579 unsigned int old_spillat; 1580 unsigned int new_spillat = 0; /* initialized to silence 1581 * compiler warnings */ 1582 1583 LOCK(&fctx->lock); 1584 1585 REQUIRE(fctx->state == fetchstate_done); 1586 1587 FCTXTRACE("sendevents"); 1588 1589 /* 1590 * Keep some record of fetch result for logging later (if required). 1591 */ 1592 fctx->result = result; 1593 now = isc_time_now(); 1594 fctx->duration = isc_time_microdiff(&now, &fctx->start); 1595 1596 for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL; resp = next) { 1597 next = ISC_LIST_NEXT(resp, link); 1598 ISC_LIST_UNLINK(fctx->resps, resp, link); 1599 1600 count++; 1601 1602 resp->vresult = fctx->vresult; 1603 if (!HAVE_ANSWER(fctx)) { 1604 resp->result = result; 1605 } 1606 1607 INSIST(resp->result != ISC_R_SUCCESS || 1608 dns_rdataset_isassociated(resp->rdataset) || 1609 fctx->type == dns_rdatatype_any || 1610 fctx->type == dns_rdatatype_rrsig || 1611 fctx->type == dns_rdatatype_sig); 1612 1613 /* 1614 * Negative results must be indicated in resp->result. 1615 */ 1616 if (dns_rdataset_isassociated(resp->rdataset) && 1617 NEGATIVE(resp->rdataset)) 1618 { 1619 INSIST(resp->result == DNS_R_NCACHENXDOMAIN || 1620 resp->result == DNS_R_NCACHENXRRSET); 1621 } 1622 1623 /* 1624 * Finalize the EDE context, so it becomes "constant" and assign 1625 * it to all clients. 1626 */ 1627 if (resp->edectx != NULL) { 1628 dns_ede_copy(resp->edectx, &fctx->edectx); 1629 } 1630 1631 FCTXTRACE("post response event"); 1632 isc_async_run(resp->loop, resp->cb, resp); 1633 } 1634 UNLOCK(&fctx->lock); 1635 1636 if (HAVE_ANSWER(fctx) && fctx->spilled && 1637 (count < fctx->res->spillatmax || fctx->res->spillatmax == 0)) 1638 { 1639 LOCK(&fctx->res->lock); 1640 if (count == fctx->res->spillat && 1641 !atomic_load_acquire(&fctx->res->exiting)) 1642 { 1643 old_spillat = fctx->res->spillat; 1644 fctx->res->spillat += 5; 1645 if (fctx->res->spillat > fctx->res->spillatmax && 1646 fctx->res->spillatmax != 0) 1647 { 1648 fctx->res->spillat = fctx->res->spillatmax; 1649 } 1650 new_spillat = fctx->res->spillat; 1651 if (new_spillat != old_spillat) { 1652 logit = true; 1653 } 1654 1655 /* Timer not running */ 1656 if (fctx->res->spillattimer == NULL) { 1657 isc_interval_t i; 1658 1659 isc_timer_create( 1660 isc_loop(), spillattimer_countdown, 1661 fctx->res, &fctx->res->spillattimer); 1662 1663 isc_interval_set(&i, 20 * 60, 0); 1664 isc_timer_start(fctx->res->spillattimer, 1665 isc_timertype_ticker, &i); 1666 } 1667 } 1668 UNLOCK(&fctx->res->lock); 1669 if (logit) { 1670 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 1671 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 1672 "clients-per-query increased to %u", 1673 new_spillat); 1674 } 1675 } 1676 } 1677 1678 static uint32_t 1679 fctx_hash(fetchctx_t *fctx) { 1680 isc_hash32_t hash32; 1681 isc_hash32_init(&hash32); 1682 isc_hash32_hash(&hash32, fctx->name->ndata, fctx->name->length, false); 1683 isc_hash32_hash(&hash32, &fctx->options, sizeof(fctx->options), true); 1684 isc_hash32_hash(&hash32, &fctx->type, sizeof(fctx->type), true); 1685 return isc_hash32_finalize(&hash32); 1686 } 1687 1688 static bool 1689 fctx_match(void *node, const void *key) { 1690 const fetchctx_t *fctx0 = node; 1691 const fetchctx_t *fctx1 = key; 1692 1693 return fctx0->options == fctx1->options && fctx0->type == fctx1->type && 1694 dns_name_equal(fctx0->name, fctx1->name); 1695 } 1696 1697 static bool 1698 fctx__done(fetchctx_t *fctx, isc_result_t result, const char *func, 1699 const char *file, unsigned int line) { 1700 bool no_response = false; 1701 bool age_untried = false; 1702 1703 REQUIRE(fctx != NULL); 1704 REQUIRE(fctx->tid == isc_tid()); 1705 1706 FCTXTRACE("done"); 1707 1708 #ifdef DNS_RESOLVER_TRACE 1709 fprintf(stderr, "%s:%s:%s:%u:(%p): %s\n", __func__, func, file, line, 1710 fctx, isc_result_totext(result)); 1711 #else 1712 UNUSED(file); 1713 UNUSED(line); 1714 UNUSED(func); 1715 #endif 1716 1717 LOCK(&fctx->lock); 1718 /* We need to do this under the lock for intra-thread synchronization */ 1719 if (fctx->state == fetchstate_done) { 1720 UNLOCK(&fctx->lock); 1721 return false; 1722 } 1723 fctx->state = fetchstate_done; 1724 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 1725 UNLOCK(&fctx->lock); 1726 1727 /* The fctx will get deleted either here or in get_attached_fctx() */ 1728 RWLOCK(&fctx->res->fctxs_lock, isc_rwlocktype_write); 1729 (void)isc_hashmap_delete(fctx->res->fctxs, fctx_hash(fctx), match_ptr, 1730 fctx); 1731 RWUNLOCK(&fctx->res->fctxs_lock, isc_rwlocktype_write); 1732 1733 if (result == ISC_R_SUCCESS) { 1734 if (fctx->qmin_warning != ISC_R_SUCCESS) { 1735 isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS, 1736 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 1737 "success resolving '%s' after disabling " 1738 "qname minimization due to '%s'", 1739 fctx->info, 1740 isc_result_totext(fctx->qmin_warning)); 1741 } 1742 1743 /* 1744 * A success result indicates we got a response to a 1745 * query. That query should be canceled already. If 1746 * there still are any outstanding queries attached to the 1747 * same fctx, then those have *not* gotten a response, 1748 * so we set 'no_response' to true here: that way, when 1749 * we run fctx_cancelqueries() below, the SRTTs will 1750 * be adjusted. 1751 */ 1752 no_response = true; 1753 } else if (result == ISC_R_TIMEDOUT) { 1754 age_untried = true; 1755 } 1756 1757 fctx->qmin_warning = ISC_R_SUCCESS; 1758 1759 /* 1760 * Cancel all pending ADB finds if we have not been successful 1761 * or we are shutting down. 1762 */ 1763 if (result != ISC_R_SUCCESS) { 1764 dns_adbfind_t *find = NULL; 1765 for (find = ISC_LIST_HEAD(fctx->pending_finds); find != NULL; 1766 find = ISC_LIST_NEXT(find, publink)) 1767 { 1768 dns_adb_cancelfind(find); 1769 } 1770 } 1771 1772 fctx_cancelqueries(fctx, no_response, age_untried); 1773 fctx_stoptimer(fctx); 1774 1775 /* 1776 * Cancel all pending validators. 1777 */ 1778 dns_validator_t *validator = NULL; 1779 for (validator = ISC_LIST_HEAD(fctx->validators); validator != NULL; 1780 validator = ISC_LIST_NEXT(validator, link)) 1781 { 1782 dns_validator_cancel(validator); 1783 } 1784 1785 if (fctx->nsfetch != NULL) { 1786 dns_resolver_cancelfetch(fctx->nsfetch); 1787 } 1788 1789 if (fctx->qminfetch != NULL) { 1790 dns_resolver_cancelfetch(fctx->qminfetch); 1791 } 1792 1793 /* 1794 * Shut down anything still running on behalf of this 1795 * fetch, and clean up finds and addresses. 1796 */ 1797 fctx_sendevents(fctx, result); 1798 fctx_cleanup(fctx); 1799 1800 isc_timer_destroy(&fctx->timer); 1801 1802 return true; 1803 } 1804 1805 static void 1806 resquery_senddone(isc_result_t eresult, isc_region_t *region, void *arg) { 1807 resquery_t *query = (resquery_t *)arg; 1808 resquery_t *copy = query; 1809 fetchctx_t *fctx = NULL; 1810 1811 QTRACE("senddone"); 1812 1813 UNUSED(region); 1814 1815 REQUIRE(VALID_QUERY(query)); 1816 fctx = query->fctx; 1817 REQUIRE(VALID_FCTX(fctx)); 1818 REQUIRE(fctx->tid == isc_tid()); 1819 1820 if (RESQUERY_CANCELED(query)) { 1821 goto detach; 1822 } 1823 1824 /* 1825 * See the note in resquery_connected() about reference 1826 * counting on error conditions. 1827 */ 1828 switch (eresult) { 1829 case ISC_R_SUCCESS: 1830 case ISC_R_CANCELED: 1831 case ISC_R_SHUTTINGDOWN: 1832 break; 1833 1834 case ISC_R_HOSTDOWN: 1835 case ISC_R_HOSTUNREACH: 1836 case ISC_R_NETDOWN: 1837 case ISC_R_NETUNREACH: 1838 case ISC_R_NOPERM: 1839 case ISC_R_ADDRNOTAVAIL: 1840 case ISC_R_CONNREFUSED: 1841 case ISC_R_CONNECTIONRESET: 1842 case ISC_R_TIMEDOUT: 1843 /* No route to remote. */ 1844 FCTXTRACE3("query canceled in resquery_senddone(): " 1845 "no route to host; no response", 1846 eresult); 1847 add_bad(fctx, query->rmessage, query->addrinfo, eresult, 1848 badns_unreachable); 1849 fctx_cancelquery(©, NULL, true, false); 1850 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 1851 fctx_try(fctx, true); 1852 break; 1853 1854 default: 1855 FCTXTRACE3("query canceled in resquery_senddone() " 1856 "due to unexpected result; responding", 1857 eresult); 1858 fctx_cancelquery(©, NULL, false, false); 1859 fctx_done_detach(&fctx, eresult); 1860 break; 1861 } 1862 1863 detach: 1864 resquery_detach(&query); 1865 } 1866 1867 static isc_result_t 1868 fctx_addopt(dns_message_t *message, unsigned int version, uint16_t udpsize, 1869 dns_ednsopt_t *ednsopts, size_t count) { 1870 dns_rdataset_t *rdataset = NULL; 1871 isc_result_t result; 1872 1873 result = dns_message_buildopt(message, &rdataset, version, udpsize, 1874 DNS_MESSAGEEXTFLAG_DO, ednsopts, count); 1875 if (result != ISC_R_SUCCESS) { 1876 return result; 1877 } 1878 return dns_message_setopt(message, rdataset); 1879 } 1880 1881 static void 1882 fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) { 1883 unsigned int seconds, us; 1884 uint64_t limit; 1885 isc_time_t now; 1886 1887 /* 1888 * Has this fetch already expired? 1889 */ 1890 now = isc_time_now(); 1891 limit = isc_time_microdiff(&fctx->expires, &now); 1892 if (limit < US_PER_MS) { 1893 FCTXTRACE("fetch already expired"); 1894 isc_interval_set(&fctx->interval, 0, 0); 1895 return; 1896 } 1897 1898 us = fctx->res->retryinterval * US_PER_MS; 1899 1900 /* 1901 * Exponential backoff after the first few tries. 1902 */ 1903 if (fctx->restarts > fctx->res->nonbackofftries) { 1904 int shift = fctx->restarts - fctx->res->nonbackofftries; 1905 if (shift > 6) { 1906 shift = 6; 1907 } 1908 us <<= shift; 1909 } 1910 1911 /* 1912 * Add a fudge factor to the expected rtt based on the current 1913 * estimate. 1914 */ 1915 if (rtt < 50000) { 1916 rtt += 50000; 1917 } else if (rtt < 100000) { 1918 rtt += 100000; 1919 } else { 1920 rtt += 200000; 1921 } 1922 1923 /* 1924 * Always wait for at least the expected rtt. 1925 */ 1926 if (us < rtt) { 1927 us = rtt; 1928 } 1929 1930 /* 1931 * But don't wait past the final expiration of the fetch, 1932 * or for more than 10 seconds total. 1933 */ 1934 if (us > limit) { 1935 us = limit; 1936 } 1937 if (us > MAX_SINGLE_QUERY_TIMEOUT_US) { 1938 us = MAX_SINGLE_QUERY_TIMEOUT_US; 1939 } 1940 if (us > fctx->res->query_timeout * US_PER_MS) { 1941 us = fctx->res->query_timeout * US_PER_MS; 1942 } 1943 1944 seconds = us / US_PER_SEC; 1945 us -= seconds * US_PER_SEC; 1946 isc_interval_set(&fctx->interval, seconds, us * NS_PER_US); 1947 isc_time_nowplusinterval(&fctx->next_timeout, &fctx->interval); 1948 } 1949 1950 static isc_result_t 1951 fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, 1952 unsigned int options) { 1953 isc_result_t result; 1954 dns_resolver_t *res = NULL; 1955 dns_dns64_t *dns64 = NULL; 1956 resquery_t *query = NULL; 1957 isc_sockaddr_t addr, sockaddr; 1958 bool have_addr = false; 1959 unsigned int srtt; 1960 isc_tlsctx_cache_t *tlsctx_cache = NULL; 1961 1962 FCTXTRACE("query"); 1963 1964 res = fctx->res; 1965 1966 srtt = addrinfo->srtt; 1967 1968 if (addrinfo->transport != NULL) { 1969 switch (dns_transport_get_type(addrinfo->transport)) { 1970 case DNS_TRANSPORT_TLS: 1971 options |= DNS_FETCHOPT_TCP; 1972 tlsctx_cache = res->tlsctx_cache; 1973 break; 1974 case DNS_TRANSPORT_TCP: 1975 case DNS_TRANSPORT_HTTP: 1976 options |= DNS_FETCHOPT_TCP; 1977 break; 1978 default: 1979 break; 1980 } 1981 } 1982 1983 /* 1984 * Allow an additional second for the kernel to resend the SYN 1985 * (or SYN without ECN in the case of stupid firewalls blocking 1986 * ECN negotiation) over the current RTT estimate. 1987 */ 1988 if ((options & DNS_FETCHOPT_TCP) != 0) { 1989 srtt += US_PER_SEC; 1990 } 1991 1992 /* 1993 * A forwarder needs to make multiple queries. Give it at least 1994 * a second to do these in. 1995 */ 1996 if (ISFORWARDER(addrinfo) && srtt < US_PER_SEC) { 1997 srtt = US_PER_SEC; 1998 } 1999 2000 fctx_setretryinterval(fctx, srtt); 2001 if (isc_interval_iszero(&fctx->interval)) { 2002 FCTXTRACE("fetch expired"); 2003 dns_ede_add(&fctx->edectx, DNS_EDE_NOREACHABLEAUTH, NULL); 2004 return ISC_R_TIMEDOUT; 2005 } 2006 2007 INSIST(ISC_LIST_EMPTY(fctx->validators)); 2008 2009 query = isc_mem_get(fctx->mctx, sizeof(*query)); 2010 *query = (resquery_t){ 2011 .options = options, 2012 .addrinfo = addrinfo, 2013 .link = ISC_LINK_INITIALIZER, 2014 }; 2015 2016 #if DNS_RESOLVER_TRACE 2017 fprintf(stderr, "rctx_init:%s:%s:%d:%p->references = 1\n", __func__, 2018 __FILE__, __LINE__, query); 2019 #endif 2020 isc_refcount_init(&query->references, 1); 2021 2022 /* 2023 * Note that the caller MUST guarantee that 'addrinfo' will 2024 * remain valid until this query is canceled. 2025 */ 2026 2027 dns_message_create(fctx->mctx, fctx->res->namepools[fctx->tid], 2028 fctx->res->rdspools[fctx->tid], 2029 DNS_MESSAGE_INTENTPARSE, &query->rmessage); 2030 query->start = isc_time_now(); 2031 2032 /* 2033 * Maybe apply DNS64 mappings to IPv4 addresses. 2034 */ 2035 sockaddr = addrinfo->sockaddr; 2036 dns64 = ISC_LIST_HEAD(fctx->res->view->dns64); 2037 if (isc_sockaddr_pf(&sockaddr) == AF_INET && 2038 fctx->res->view->usedns64 && dns64 != NULL) 2039 { 2040 struct in6_addr aaaa; 2041 2042 result = dns_dns64_aaaafroma( 2043 dns64, NULL, NULL, fctx->res->view->aclenv, 0, 2044 (unsigned char *)&sockaddr.type.sin.sin_addr.s_addr, 2045 aaaa.s6_addr); 2046 if (result == ISC_R_SUCCESS) { 2047 char sockaddrbuf1[ISC_SOCKADDR_FORMATSIZE]; 2048 char sockaddrbuf2[ISC_SOCKADDR_FORMATSIZE]; 2049 2050 /* format old address */ 2051 isc_sockaddr_format(&sockaddr, sockaddrbuf1, 2052 sizeof(sockaddrbuf1)); 2053 2054 /* replace address */ 2055 isc_sockaddr_fromin6(&sockaddr, &aaaa, 2056 ntohs(sockaddr.type.sin.sin_port)); 2057 addrinfo->sockaddr = sockaddr; 2058 2059 /* format new address */ 2060 isc_sockaddr_format(&sockaddr, sockaddrbuf2, 2061 sizeof(sockaddrbuf2)); 2062 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 2063 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 2064 "Using DNS64 address %s to talk to %s\n", 2065 sockaddrbuf2, sockaddrbuf1); 2066 } 2067 } 2068 if (res->view->peers != NULL) { 2069 dns_peer_t *peer = NULL; 2070 isc_netaddr_t dstip; 2071 bool usetcp = false; 2072 isc_netaddr_fromsockaddr(&dstip, &sockaddr); 2073 result = dns_peerlist_peerbyaddr(res->view->peers, &dstip, 2074 &peer); 2075 if (result == ISC_R_SUCCESS) { 2076 result = dns_peer_getquerysource(peer, &addr); 2077 if (result == ISC_R_SUCCESS) { 2078 have_addr = true; 2079 } 2080 result = dns_peer_getforcetcp(peer, &usetcp); 2081 if (result == ISC_R_SUCCESS && usetcp) { 2082 query->options |= DNS_FETCHOPT_TCP; 2083 } 2084 } 2085 } 2086 2087 /* 2088 * If this is a TCP query, then we need to make a socket and 2089 * a dispatch for it here. Otherwise we use the resolver's 2090 * shared dispatch. 2091 */ 2092 if ((query->options & DNS_FETCHOPT_TCP) != 0) { 2093 int pf; 2094 2095 pf = isc_sockaddr_pf(&sockaddr); 2096 if (!have_addr) { 2097 switch (pf) { 2098 case PF_INET: 2099 result = dns_dispatch_getlocaladdress( 2100 res->dispatches4->dispatches[0], &addr); 2101 break; 2102 case PF_INET6: 2103 result = dns_dispatch_getlocaladdress( 2104 res->dispatches6->dispatches[0], &addr); 2105 break; 2106 default: 2107 result = ISC_R_NOTIMPLEMENTED; 2108 break; 2109 } 2110 if (result != ISC_R_SUCCESS) { 2111 goto cleanup_query; 2112 } 2113 } 2114 isc_sockaddr_setport(&addr, 0); 2115 2116 result = dns_dispatch_createtcp(fctx->dispatchmgr, &addr, 2117 &sockaddr, addrinfo->transport, 2118 DNS_DISPATCHTYPE_RESOLVER, 0, 2119 &query->dispatch); 2120 if (result != ISC_R_SUCCESS) { 2121 goto cleanup_query; 2122 } 2123 2124 FCTXTRACE("connecting via TCP"); 2125 } else { 2126 if (have_addr) { 2127 result = dns_dispatch_createudp( 2128 fctx->dispatchmgr, &addr, &query->dispatch); 2129 if (result != ISC_R_SUCCESS) { 2130 goto cleanup_query; 2131 } 2132 } else { 2133 switch (isc_sockaddr_pf(&sockaddr)) { 2134 case PF_INET: 2135 dns_dispatch_attach( 2136 dns_resolver_dispatchv4(res), 2137 &query->dispatch); 2138 break; 2139 case PF_INET6: 2140 dns_dispatch_attach( 2141 dns_resolver_dispatchv6(res), 2142 &query->dispatch); 2143 break; 2144 default: 2145 result = ISC_R_NOTIMPLEMENTED; 2146 goto cleanup_query; 2147 } 2148 } 2149 2150 /* 2151 * We should always have a valid dispatcher here. If we 2152 * don't support a protocol family, then its dispatcher 2153 * will be NULL, but we shouldn't be finding addresses 2154 * for protocol types we don't support, so the 2155 * dispatcher we found should never be NULL. 2156 */ 2157 INSIST(query->dispatch != NULL); 2158 } 2159 2160 LOCK(&fctx->lock); 2161 INSIST(!SHUTTINGDOWN(fctx)); 2162 fetchctx_attach(fctx, &query->fctx); 2163 query->magic = QUERY_MAGIC; 2164 2165 if ((query->options & DNS_FETCHOPT_TCP) == 0) { 2166 if (dns_adb_overquota(fctx->adb, addrinfo)) { 2167 UNLOCK(&fctx->lock); 2168 result = ISC_R_QUOTA; 2169 goto cleanup_dispatch; 2170 } 2171 2172 /* Inform the ADB that we're starting a UDP fetch */ 2173 dns_adb_beginudpfetch(fctx->adb, addrinfo); 2174 } 2175 2176 ISC_LIST_APPEND(fctx->queries, query, link); 2177 atomic_fetch_add_relaxed(&fctx->nqueries, 1); 2178 UNLOCK(&fctx->lock); 2179 2180 /* Set up the dispatch and set the query ID */ 2181 result = dns_dispatch_add(query->dispatch, fctx->loop, 0, 2182 isc_interval_ms(&fctx->interval), &sockaddr, 2183 addrinfo->transport, tlsctx_cache, 2184 resquery_connected, resquery_senddone, 2185 resquery_response, query, &query->id, 2186 &query->dispentry); 2187 if (result != ISC_R_SUCCESS) { 2188 goto cleanup_udpfetch; 2189 } 2190 2191 /* Connect the socket */ 2192 resquery_ref(query); 2193 result = dns_dispatch_connect(query->dispentry); 2194 2195 if (result != ISC_R_SUCCESS && (query->options & DNS_FETCHOPT_TCP) != 0) 2196 { 2197 int log_level = ISC_LOG_NOTICE; 2198 if (isc_log_wouldlog(dns_lctx, log_level)) { 2199 char peerbuf[ISC_SOCKADDR_FORMATSIZE]; 2200 2201 isc_sockaddr_format(&sockaddr, peerbuf, 2202 ISC_SOCKADDR_FORMATSIZE); 2203 2204 isc_log_write( 2205 dns_lctx, DNS_LOGCATEGORY_RESOLVER, 2206 DNS_LOGMODULE_RESOLVER, log_level, 2207 "Unable to establish a connection to %s: %s", 2208 peerbuf, isc_result_totext(result)); 2209 } 2210 dns_dispatch_done(&query->dispentry); 2211 resquery_unref(query); 2212 goto cleanup_fetch; 2213 } else { 2214 RUNTIME_CHECK(result == ISC_R_SUCCESS); 2215 } 2216 2217 return result; 2218 2219 cleanup_udpfetch: 2220 if (!RESQUERY_CANCELED(query)) { 2221 if ((query->options & DNS_FETCHOPT_TCP) == 0) { 2222 /* Inform the ADB that we're ending a UDP fetch */ 2223 dns_adb_endudpfetch(fctx->adb, addrinfo); 2224 } 2225 } 2226 2227 cleanup_fetch: 2228 LOCK(&fctx->lock); 2229 if (ISC_LINK_LINKED(query, link)) { 2230 atomic_fetch_sub_release(&fctx->nqueries, 1); 2231 ISC_LIST_UNLINK(fctx->queries, query, link); 2232 } 2233 UNLOCK(&fctx->lock); 2234 2235 cleanup_dispatch: 2236 fetchctx_detach(&query->fctx); 2237 2238 if (query->dispatch != NULL) { 2239 dns_dispatch_detach(&query->dispatch); 2240 } 2241 2242 cleanup_query: 2243 query->magic = 0; 2244 dns_message_detach(&query->rmessage); 2245 isc_mem_put(fctx->mctx, query, sizeof(*query)); 2246 2247 return result; 2248 } 2249 2250 static struct tried * 2251 triededns(fetchctx_t *fctx, isc_sockaddr_t *address) { 2252 struct tried *tried; 2253 2254 for (tried = ISC_LIST_HEAD(fctx->edns); tried != NULL; 2255 tried = ISC_LIST_NEXT(tried, link)) 2256 { 2257 if (isc_sockaddr_equal(&tried->addr, address)) { 2258 return tried; 2259 } 2260 } 2261 2262 return NULL; 2263 } 2264 2265 static void 2266 add_triededns(fetchctx_t *fctx, isc_sockaddr_t *address) { 2267 struct tried *tried; 2268 2269 tried = triededns(fctx, address); 2270 if (tried != NULL) { 2271 tried->count++; 2272 return; 2273 } 2274 2275 tried = isc_mem_get(fctx->mctx, sizeof(*tried)); 2276 2277 tried->addr = *address; 2278 tried->count = 1; 2279 ISC_LIST_INITANDAPPEND(fctx->edns, tried, link); 2280 } 2281 2282 static size_t 2283 addr2buf(void *buf, const size_t bufsize, const isc_sockaddr_t *sockaddr) { 2284 isc_netaddr_t netaddr; 2285 isc_netaddr_fromsockaddr(&netaddr, sockaddr); 2286 switch (netaddr.family) { 2287 case AF_INET: 2288 INSIST(bufsize >= 4); 2289 memmove(buf, &netaddr.type.in, 4); 2290 return 4; 2291 case AF_INET6: 2292 INSIST(bufsize >= 16); 2293 memmove(buf, &netaddr.type.in6, 16); 2294 return 16; 2295 default: 2296 UNREACHABLE(); 2297 } 2298 return 0; 2299 } 2300 2301 static size_t 2302 add_serveraddr(uint8_t *buf, const size_t bufsize, const resquery_t *query) { 2303 return addr2buf(buf, bufsize, &query->addrinfo->sockaddr); 2304 } 2305 2306 /* 2307 * Client cookie is 8 octets. 2308 * Server cookie is [8..32] octets. 2309 */ 2310 #define CLIENT_COOKIE_SIZE 8U 2311 #define COOKIE_BUFFER_SIZE (8U + 32U) 2312 2313 static void 2314 compute_cc(const resquery_t *query, uint8_t *cookie, const size_t len) { 2315 INSIST(len >= CLIENT_COOKIE_SIZE); 2316 STATIC_ASSERT(sizeof(query->fctx->res->view->secret) >= 2317 ISC_SIPHASH24_KEY_LENGTH, 2318 "The view->secret size can't fit SipHash 2-4 key " 2319 "length"); 2320 2321 uint8_t buf[16] ISC_NONSTRING = { 0 }; 2322 size_t buflen = add_serveraddr(buf, sizeof(buf), query); 2323 2324 uint8_t digest[ISC_SIPHASH24_TAG_LENGTH] ISC_NONSTRING = { 0 }; 2325 isc_siphash24(query->fctx->res->view->secret, buf, buflen, true, 2326 digest); 2327 memmove(cookie, digest, CLIENT_COOKIE_SIZE); 2328 } 2329 2330 static isc_result_t 2331 issecuredomain(dns_view_t *view, const dns_name_t *name, dns_rdatatype_t type, 2332 isc_stdtime_t now, bool checknta, bool *ntap, bool *issecure) { 2333 dns_name_t suffix; 2334 unsigned int labels; 2335 2336 /* 2337 * For DS variants we need to check fom the parent domain, 2338 * since there may be a negative trust anchor for the name, 2339 * while the enclosing domain where the DS record lives is 2340 * under a secure entry point. 2341 */ 2342 labels = dns_name_countlabels(name); 2343 if (dns_rdatatype_atparent(type) && labels > 1) { 2344 dns_name_init(&suffix, NULL); 2345 dns_name_getlabelsequence(name, 1, labels - 1, &suffix); 2346 name = &suffix; 2347 } 2348 2349 return dns_view_issecuredomain(view, name, now, checknta, ntap, 2350 issecure); 2351 } 2352 2353 static isc_result_t 2354 resquery_send(resquery_t *query) { 2355 isc_result_t result; 2356 fetchctx_t *fctx = query->fctx; 2357 dns_resolver_t *res = fctx->res; 2358 isc_buffer_t buffer; 2359 dns_name_t *qname = NULL; 2360 dns_rdataset_t *qrdataset = NULL; 2361 isc_region_t r; 2362 isc_netaddr_t ipaddr; 2363 dns_tsigkey_t *tsigkey = NULL; 2364 dns_peer_t *peer = NULL; 2365 dns_compress_t cctx; 2366 bool useedns; 2367 bool secure_domain; 2368 bool tcp = ((query->options & DNS_FETCHOPT_TCP) != 0); 2369 dns_ednsopt_t ednsopts[DNS_EDNSOPTIONS]; 2370 unsigned int ednsopt = 0; 2371 uint16_t hint = 0, udpsize = 0; /* No EDNS */ 2372 #ifdef HAVE_DNSTAP 2373 isc_sockaddr_t localaddr, *la = NULL; 2374 unsigned char zone[DNS_NAME_MAXWIRE]; 2375 dns_transport_type_t transport_type; 2376 dns_dtmsgtype_t dtmsgtype; 2377 isc_region_t zr; 2378 isc_buffer_t zb; 2379 #endif /* HAVE_DNSTAP */ 2380 2381 QTRACE("send"); 2382 2383 if (atomic_load_acquire(&res->exiting)) { 2384 FCTXTRACE("resquery_send: resolver shutting down"); 2385 return ISC_R_SHUTTINGDOWN; 2386 } 2387 2388 dns_message_gettempname(fctx->qmessage, &qname); 2389 dns_message_gettemprdataset(fctx->qmessage, &qrdataset); 2390 2391 fctx->qmessage->opcode = dns_opcode_query; 2392 2393 /* 2394 * Set up question. 2395 */ 2396 dns_name_clone(fctx->name, qname); 2397 dns_rdataset_makequestion(qrdataset, res->rdclass, fctx->type); 2398 ISC_LIST_APPEND(qname->list, qrdataset, link); 2399 dns_message_addname(fctx->qmessage, qname, DNS_SECTION_QUESTION); 2400 2401 /* 2402 * Set RD if the client has requested that we do a recursive 2403 * query, or if we're sending to a forwarder. 2404 */ 2405 if ((query->options & DNS_FETCHOPT_RECURSIVE) != 0 || 2406 ISFORWARDER(query->addrinfo)) 2407 { 2408 fctx->qmessage->flags |= DNS_MESSAGEFLAG_RD; 2409 } 2410 2411 /* 2412 * Set CD if the client says not to validate, or if the 2413 * question is under a secure entry point and this is a 2414 * recursive/forward query -- unless the client said not to. 2415 */ 2416 if ((query->options & DNS_FETCHOPT_NOCDFLAG) != 0) { 2417 /* Do nothing */ 2418 } else if ((query->options & DNS_FETCHOPT_NOVALIDATE) != 0) { 2419 fctx->qmessage->flags |= DNS_MESSAGEFLAG_CD; 2420 } else if (res->view->enablevalidation && 2421 ((fctx->qmessage->flags & DNS_MESSAGEFLAG_RD) != 0)) 2422 { 2423 bool checknta = ((query->options & DNS_FETCHOPT_NONTA) == 0); 2424 bool ntacovered = false; 2425 result = issecuredomain(res->view, fctx->name, fctx->type, 2426 isc_time_seconds(&query->start), 2427 checknta, &ntacovered, &secure_domain); 2428 if (result != ISC_R_SUCCESS) { 2429 secure_domain = false; 2430 } 2431 if (secure_domain || 2432 (ISFORWARDER(query->addrinfo) && ntacovered)) 2433 { 2434 fctx->qmessage->flags |= DNS_MESSAGEFLAG_CD; 2435 } 2436 } 2437 2438 /* 2439 * We don't have to set opcode because it defaults to query. 2440 */ 2441 fctx->qmessage->id = query->id; 2442 2443 /* 2444 * Convert the question to wire format. 2445 */ 2446 dns_compress_init(&cctx, fctx->mctx, 0); 2447 2448 isc_buffer_init(&buffer, query->data, sizeof(query->data)); 2449 result = dns_message_renderbegin(fctx->qmessage, &cctx, &buffer); 2450 if (result != ISC_R_SUCCESS) { 2451 goto cleanup_message; 2452 } 2453 2454 result = dns_message_rendersection(fctx->qmessage, DNS_SECTION_QUESTION, 2455 0); 2456 if (result != ISC_R_SUCCESS) { 2457 goto cleanup_message; 2458 } 2459 2460 isc_netaddr_fromsockaddr(&ipaddr, &query->addrinfo->sockaddr); 2461 (void)dns_peerlist_peerbyaddr(fctx->res->view->peers, &ipaddr, &peer); 2462 2463 /* 2464 * The ADB does not know about servers with "edns no". Check 2465 * this, and then inform the ADB for future use. 2466 */ 2467 if ((query->addrinfo->flags & FCTX_ADDRINFO_NOEDNS0) == 0 && 2468 peer != NULL && 2469 dns_peer_getsupportedns(peer, &useedns) == ISC_R_SUCCESS && 2470 !useedns) 2471 { 2472 query->options |= DNS_FETCHOPT_NOEDNS0; 2473 dns_adb_changeflags(fctx->adb, query->addrinfo, 2474 FCTX_ADDRINFO_NOEDNS0, 2475 FCTX_ADDRINFO_NOEDNS0); 2476 } 2477 2478 /* Sync NOEDNS0 flag in addrinfo->flags and options now. */ 2479 if ((query->addrinfo->flags & FCTX_ADDRINFO_NOEDNS0) != 0) { 2480 query->options |= DNS_FETCHOPT_NOEDNS0; 2481 } 2482 2483 if (fctx->timeout && (query->options & DNS_FETCHOPT_NOEDNS0) == 0) { 2484 isc_sockaddr_t *sockaddr = &query->addrinfo->sockaddr; 2485 struct tried *tried = triededns(fctx, sockaddr); 2486 2487 /* 2488 * If this is the first timeout for this server in this 2489 * fetch context, try setting EDNS UDP buffer size to 2490 * the largest UDP response size we have seen from this 2491 * server so far. 2492 */ 2493 if (tried != NULL && tried->count == 1U) { 2494 hint = dns_adb_getudpsize(fctx->adb, query->addrinfo); 2495 } 2496 } 2497 fctx->timeout = false; 2498 2499 /* 2500 * Use EDNS0, unless the caller doesn't want it, or we know that 2501 * the remote server doesn't like it. 2502 */ 2503 if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0) { 2504 if ((query->addrinfo->flags & FCTX_ADDRINFO_NOEDNS0) == 0) { 2505 uint16_t peerudpsize = 0; 2506 unsigned int version = DNS_EDNS_VERSION; 2507 unsigned int flags = query->addrinfo->flags; 2508 bool reqnsid = res->view->requestnsid; 2509 bool sendcookie = res->view->sendcookie; 2510 bool tcpkeepalive = false; 2511 unsigned char cookie[COOKIE_BUFFER_SIZE]; 2512 uint16_t padding = 0; 2513 2514 /* 2515 * Set the default UDP size to what was 2516 * configured as 'edns-buffer-size' 2517 */ 2518 udpsize = res->view->udpsize; 2519 2520 /* 2521 * This server timed out for the first time in 2522 * this fetch context and we received a response 2523 * from it before (either in this fetch context 2524 * or in a different one). Set 'udpsize' to the 2525 * size of the largest UDP response we have 2526 * received from this server so far. 2527 */ 2528 if (hint != 0U) { 2529 udpsize = hint; 2530 } 2531 2532 /* 2533 * If a fixed EDNS UDP buffer size is configured 2534 * for this server, make sure we obey that. 2535 */ 2536 if (peer != NULL) { 2537 (void)dns_peer_getudpsize(peer, &peerudpsize); 2538 if (peerudpsize != 0) { 2539 udpsize = peerudpsize; 2540 } 2541 } 2542 2543 if ((flags & DNS_FETCHOPT_EDNSVERSIONSET) != 0) { 2544 version = flags & DNS_FETCHOPT_EDNSVERSIONMASK; 2545 version >>= DNS_FETCHOPT_EDNSVERSIONSHIFT; 2546 } 2547 2548 /* Request NSID/COOKIE/VERSION for current peer? 2549 */ 2550 if (peer != NULL) { 2551 uint8_t ednsversion; 2552 (void)dns_peer_getrequestnsid(peer, &reqnsid); 2553 (void)dns_peer_getsendcookie(peer, &sendcookie); 2554 result = dns_peer_getednsversion(peer, 2555 &ednsversion); 2556 if (result == ISC_R_SUCCESS && 2557 ednsversion < version) 2558 { 2559 version = ednsversion; 2560 } 2561 } 2562 if (NOCOOKIE(query->addrinfo)) { 2563 sendcookie = false; 2564 } 2565 if (reqnsid) { 2566 INSIST(ednsopt < DNS_EDNSOPTIONS); 2567 ednsopts[ednsopt].code = DNS_OPT_NSID; 2568 ednsopts[ednsopt].length = 0; 2569 ednsopts[ednsopt].value = NULL; 2570 ednsopt++; 2571 } 2572 if (sendcookie) { 2573 INSIST(ednsopt < DNS_EDNSOPTIONS); 2574 ednsopts[ednsopt].code = DNS_OPT_COOKIE; 2575 ednsopts[ednsopt].length = 2576 (uint16_t)dns_adb_getcookie( 2577 query->addrinfo, cookie, 2578 sizeof(cookie)); 2579 if (ednsopts[ednsopt].length != 0) { 2580 ednsopts[ednsopt].value = cookie; 2581 inc_stats( 2582 fctx->res, 2583 dns_resstatscounter_cookieout); 2584 } else { 2585 compute_cc(query, cookie, 2586 CLIENT_COOKIE_SIZE); 2587 ednsopts[ednsopt].value = cookie; 2588 ednsopts[ednsopt].length = 2589 CLIENT_COOKIE_SIZE; 2590 inc_stats( 2591 fctx->res, 2592 dns_resstatscounter_cookienew); 2593 } 2594 ednsopt++; 2595 } 2596 2597 /* Add TCP keepalive option if appropriate */ 2598 if ((peer != NULL) && tcp) { 2599 (void)dns_peer_gettcpkeepalive(peer, 2600 &tcpkeepalive); 2601 } 2602 if (tcpkeepalive) { 2603 INSIST(ednsopt < DNS_EDNSOPTIONS); 2604 ednsopts[ednsopt].code = DNS_OPT_TCP_KEEPALIVE; 2605 ednsopts[ednsopt].length = 0; 2606 ednsopts[ednsopt].value = NULL; 2607 ednsopt++; 2608 } 2609 2610 /* Add PAD for current peer? Require TCP for now 2611 */ 2612 if ((peer != NULL) && tcp) { 2613 (void)dns_peer_getpadding(peer, &padding); 2614 } 2615 if (padding != 0) { 2616 INSIST(ednsopt < DNS_EDNSOPTIONS); 2617 ednsopts[ednsopt].code = DNS_OPT_PAD; 2618 ednsopts[ednsopt].length = 0; 2619 ednsopt++; 2620 dns_message_setpadding(fctx->qmessage, padding); 2621 } 2622 2623 query->ednsversion = version; 2624 result = fctx_addopt(fctx->qmessage, version, udpsize, 2625 ednsopts, ednsopt); 2626 if (reqnsid && result == ISC_R_SUCCESS) { 2627 query->options |= DNS_FETCHOPT_WANTNSID; 2628 } else if (result != ISC_R_SUCCESS) { 2629 /* 2630 * We couldn't add the OPT, but we'll 2631 * press on. We're not using EDNS0, so 2632 * set the NOEDNS0 bit. 2633 */ 2634 query->options |= DNS_FETCHOPT_NOEDNS0; 2635 query->ednsversion = -1; 2636 udpsize = 0; 2637 } 2638 } else { 2639 /* 2640 * We know this server doesn't like EDNS0, so we 2641 * won't use it. Set the NOEDNS0 bit since 2642 * we're not using EDNS0. 2643 */ 2644 query->options |= DNS_FETCHOPT_NOEDNS0; 2645 query->ednsversion = -1; 2646 } 2647 } else { 2648 query->ednsversion = -1; 2649 } 2650 2651 /* 2652 * Record the UDP EDNS size chosen. 2653 */ 2654 query->udpsize = udpsize; 2655 2656 /* 2657 * If we need EDNS0 to do this query and aren't using it, we 2658 * lose. 2659 */ 2660 if (NEEDEDNS0(fctx) && (query->options & DNS_FETCHOPT_NOEDNS0) != 0) { 2661 result = DNS_R_SERVFAIL; 2662 goto cleanup_message; 2663 } 2664 2665 add_triededns(fctx, &query->addrinfo->sockaddr); 2666 2667 /* 2668 * Clear CD if EDNS is not in use. 2669 */ 2670 if ((query->options & DNS_FETCHOPT_NOEDNS0) != 0) { 2671 fctx->qmessage->flags &= ~DNS_MESSAGEFLAG_CD; 2672 } 2673 2674 /* 2675 * Add TSIG record tailored to the current recipient. 2676 */ 2677 result = dns_view_getpeertsig(fctx->res->view, &ipaddr, &tsigkey); 2678 if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) { 2679 goto cleanup_message; 2680 } 2681 2682 if (tsigkey != NULL) { 2683 result = dns_message_settsigkey(fctx->qmessage, tsigkey); 2684 dns_tsigkey_detach(&tsigkey); 2685 if (result != ISC_R_SUCCESS) { 2686 goto cleanup_message; 2687 } 2688 } 2689 2690 result = dns_message_rendersection(fctx->qmessage, 2691 DNS_SECTION_ADDITIONAL, 0); 2692 if (result != ISC_R_SUCCESS) { 2693 goto cleanup_message; 2694 } 2695 2696 result = dns_message_renderend(fctx->qmessage); 2697 if (result != ISC_R_SUCCESS) { 2698 goto cleanup_message; 2699 } 2700 2701 #ifdef HAVE_DNSTAP 2702 memset(&zr, 0, sizeof(zr)); 2703 isc_buffer_init(&zb, zone, sizeof(zone)); 2704 dns_compress_setpermitted(&cctx, false); 2705 result = dns_name_towire(fctx->domain, &cctx, &zb, NULL); 2706 if (result == ISC_R_SUCCESS) { 2707 isc_buffer_usedregion(&zb, &zr); 2708 } 2709 #endif /* HAVE_DNSTAP */ 2710 2711 if (dns_message_gettsigkey(fctx->qmessage) != NULL) { 2712 dns_tsigkey_attach(dns_message_gettsigkey(fctx->qmessage), 2713 &query->tsigkey); 2714 result = dns_message_getquerytsig(fctx->qmessage, fctx->mctx, 2715 &query->tsig); 2716 if (result != ISC_R_SUCCESS) { 2717 goto cleanup_message; 2718 } 2719 } 2720 2721 /* 2722 * Log the outgoing packet. 2723 */ 2724 dns_message_logfmtpacket( 2725 fctx->qmessage, "sending packet to", &query->addrinfo->sockaddr, 2726 DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_PACKETS, 2727 &dns_master_style_comment, ISC_LOG_DEBUG(11), fctx->mctx); 2728 2729 /* 2730 * We're now done with the query message. 2731 */ 2732 dns_compress_invalidate(&cctx); 2733 dns_message_reset(fctx->qmessage, DNS_MESSAGE_INTENTRENDER); 2734 2735 isc_buffer_usedregion(&buffer, &r); 2736 2737 resquery_ref(query); 2738 dns_dispatch_send(query->dispentry, &r); 2739 2740 QTRACE("sent"); 2741 2742 #ifdef HAVE_DNSTAP 2743 /* 2744 * Log the outgoing query via dnstap. 2745 */ 2746 if (ISFORWARDER(query->addrinfo)) { 2747 dtmsgtype = DNS_DTTYPE_FQ; 2748 } else { 2749 dtmsgtype = DNS_DTTYPE_RQ; 2750 } 2751 2752 result = dns_dispentry_getlocaladdress(query->dispentry, &localaddr); 2753 if (result == ISC_R_SUCCESS) { 2754 la = &localaddr; 2755 } 2756 2757 if (query->addrinfo->transport != NULL) { 2758 transport_type = 2759 dns_transport_get_type(query->addrinfo->transport); 2760 } else if ((query->options & DNS_FETCHOPT_TCP) != 0) { 2761 transport_type = DNS_TRANSPORT_TCP; 2762 } else { 2763 transport_type = DNS_TRANSPORT_UDP; 2764 } 2765 2766 dns_dt_send(fctx->res->view, dtmsgtype, la, &query->addrinfo->sockaddr, 2767 transport_type, &zr, &query->start, NULL, &buffer); 2768 #endif /* HAVE_DNSTAP */ 2769 2770 return ISC_R_SUCCESS; 2771 2772 cleanup_message: 2773 dns_compress_invalidate(&cctx); 2774 2775 dns_message_reset(fctx->qmessage, DNS_MESSAGE_INTENTRENDER); 2776 2777 /* 2778 * Stop the dispatcher from listening. 2779 */ 2780 dns_dispatch_done(&query->dispentry); 2781 2782 return result; 2783 } 2784 2785 static void 2786 resquery_connected(isc_result_t eresult, isc_region_t *region, void *arg) { 2787 resquery_t *query = (resquery_t *)arg; 2788 resquery_t *copy = query; 2789 isc_result_t result; 2790 fetchctx_t *fctx = NULL; 2791 dns_resolver_t *res = NULL; 2792 int pf; 2793 2794 REQUIRE(VALID_QUERY(query)); 2795 2796 QTRACE("connected"); 2797 2798 UNUSED(region); 2799 2800 fctx = query->fctx; 2801 2802 REQUIRE(VALID_FCTX(fctx)); 2803 REQUIRE(fctx->tid == isc_tid()); 2804 2805 res = fctx->res; 2806 2807 if (RESQUERY_CANCELED(query)) { 2808 goto detach; 2809 } 2810 2811 if (atomic_load_acquire(&fctx->res->exiting)) { 2812 eresult = ISC_R_SHUTTINGDOWN; 2813 } 2814 2815 /* 2816 * The reference counting of resquery objects is complex: 2817 * 2818 * 1. attached in fctx_query() 2819 * 2. attached prior to dns_dispatch_connect(), detached in 2820 * resquery_connected() 2821 * 3. attached prior to dns_dispatch_send(), detached in 2822 * resquery_senddone() 2823 * 4. finally detached in fctx_cancelquery() 2824 * 2825 * On error conditions, it's necessary to call fctx_cancelquery() 2826 * from resquery_connected() or _senddone(), detaching twice 2827 * within the same function. To make it clear that's what's 2828 * happening, we cancel-and-detach 'copy' and detach 'query', 2829 * which are both pointing to the same object. 2830 */ 2831 switch (eresult) { 2832 case ISC_R_SUCCESS: 2833 /* 2834 * We are connected. Send the query. 2835 */ 2836 2837 result = resquery_send(query); 2838 if (result != ISC_R_SUCCESS) { 2839 FCTXTRACE("query canceled: resquery_send() failed; " 2840 "responding"); 2841 2842 fctx_cancelquery(©, NULL, false, false); 2843 fctx_done_detach(&fctx, result); 2844 break; 2845 } 2846 2847 fctx->querysent++; 2848 2849 pf = isc_sockaddr_pf(&query->addrinfo->sockaddr); 2850 if (pf == PF_INET) { 2851 inc_stats(res, dns_resstatscounter_queryv4); 2852 } else { 2853 inc_stats(res, dns_resstatscounter_queryv6); 2854 } 2855 if (res->querystats != NULL) { 2856 dns_rdatatypestats_increment(res->querystats, 2857 fctx->type); 2858 } 2859 break; 2860 2861 case ISC_R_CANCELED: 2862 case ISC_R_SHUTTINGDOWN: 2863 FCTXTRACE3("shutdown in resquery_connected()", eresult); 2864 fctx_cancelquery(©, NULL, true, false); 2865 fctx_done_detach(&fctx, eresult); 2866 break; 2867 2868 case ISC_R_HOSTDOWN: 2869 case ISC_R_HOSTUNREACH: 2870 case ISC_R_NETDOWN: 2871 case ISC_R_NETUNREACH: 2872 case ISC_R_CONNREFUSED: 2873 case ISC_R_NOPERM: 2874 case ISC_R_ADDRNOTAVAIL: 2875 case ISC_R_CONNECTIONRESET: 2876 case ISC_R_TIMEDOUT: 2877 /* 2878 * Do not query this server again in this fetch context. 2879 */ 2880 FCTXTRACE3("query failed in resquery_connected(): " 2881 "no response", 2882 eresult); 2883 add_bad(fctx, query->rmessage, query->addrinfo, eresult, 2884 badns_unreachable); 2885 fctx_cancelquery(©, NULL, true, false); 2886 2887 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 2888 fctx_try(fctx, true); 2889 break; 2890 2891 default: 2892 FCTXTRACE3("query canceled in resquery_connected() " 2893 "due to unexpected result; responding", 2894 eresult); 2895 2896 fctx_cancelquery(©, NULL, false, false); 2897 fctx_done_detach(&fctx, eresult); 2898 break; 2899 } 2900 2901 detach: 2902 resquery_detach(&query); 2903 } 2904 2905 static isc_result_t 2906 fctx_finddone_fail(fetchctx_t *fctx) { 2907 fctx->findfail++; 2908 2909 /* 2910 * There are still running ADB finds and these can be more successful. 2911 */ 2912 if (!ISC_LIST_EMPTY(fctx->pending_finds)) { 2913 return DNS_R_WAIT; 2914 } 2915 2916 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 2917 2918 /* 2919 * There's something on the alternate list. Try that. 2920 */ 2921 if (!ISC_LIST_EMPTY(fctx->res->alternates)) { 2922 return DNS_R_CONTINUE; 2923 } 2924 2925 /* 2926 * We've got nothing else to wait for and don't know the answer. 2927 * There's nothing to do but fail the fctx. 2928 */ 2929 return ISC_R_FAILURE; 2930 } 2931 2932 static void 2933 fctx_finddone(void *arg) { 2934 dns_adbfind_t *find = (dns_adbfind_t *)arg; 2935 fetchctx_t *fctx = (fetchctx_t *)find->cbarg; 2936 isc_result_t result = ISC_R_SUCCESS; 2937 2938 REQUIRE(VALID_FCTX(fctx)); 2939 2940 FCTXTRACE("finddone"); 2941 2942 REQUIRE(fctx->tid == isc_tid()); 2943 2944 LOCK(&fctx->lock); 2945 if (ISC_LINK_LINKED(find, publink)) { 2946 /* 2947 * If we canceled the find directly in findname(), 2948 * it won't be linked here as dns_adb_cancelfind() 2949 * is not idempotent. 2950 */ 2951 fctx->pending_running--; 2952 ISC_LIST_UNLINK(fctx->pending_finds, find, publink); 2953 } 2954 2955 if (ADDRWAIT(fctx)) { 2956 /* 2957 * The fetch is waiting for a name to be found. 2958 */ 2959 INSIST(!SHUTTINGDOWN(fctx)); 2960 if (dns_adb_findstatus(find) == DNS_ADB_MOREADDRESSES) { 2961 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 2962 result = DNS_R_CONTINUE; 2963 } else { 2964 result = fctx_finddone_fail(fctx); 2965 } 2966 } 2967 2968 UNLOCK(&fctx->lock); 2969 2970 dns_adb_destroyfind(&find); 2971 2972 switch (result) { 2973 case ISC_R_SUCCESS: 2974 case DNS_R_WAIT: 2975 break; 2976 case DNS_R_CONTINUE: 2977 fctx_try(fctx, true); 2978 break; 2979 default: 2980 FCTXTRACE2("fetch failed in finddone()", 2981 isc_result_totext(result)); 2982 fctx_done_unref(fctx, result); 2983 break; 2984 } 2985 2986 fetchctx_detach(&fctx); 2987 } 2988 2989 static bool 2990 bad_server(fetchctx_t *fctx, isc_sockaddr_t *address) { 2991 isc_sockaddr_t *sa; 2992 2993 for (sa = ISC_LIST_HEAD(fctx->bad); sa != NULL; 2994 sa = ISC_LIST_NEXT(sa, link)) 2995 { 2996 if (isc_sockaddr_equal(sa, address)) { 2997 return true; 2998 } 2999 } 3000 3001 return false; 3002 } 3003 3004 static bool 3005 mark_bad(fetchctx_t *fctx) { 3006 dns_adbfind_t *curr; 3007 dns_adbaddrinfo_t *addrinfo; 3008 bool all_bad = true; 3009 3010 #ifdef ENABLE_AFL 3011 if (dns_fuzzing_resolver) { 3012 return false; 3013 } 3014 #endif /* ifdef ENABLE_AFL */ 3015 3016 /* 3017 * Mark all known bad servers, so we don't try to talk to them 3018 * again. 3019 */ 3020 3021 /* 3022 * Mark any bad nameservers. 3023 */ 3024 for (curr = ISC_LIST_HEAD(fctx->finds); curr != NULL; 3025 curr = ISC_LIST_NEXT(curr, publink)) 3026 { 3027 for (addrinfo = ISC_LIST_HEAD(curr->list); addrinfo != NULL; 3028 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3029 { 3030 if (bad_server(fctx, &addrinfo->sockaddr)) { 3031 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3032 } else { 3033 all_bad = false; 3034 } 3035 } 3036 } 3037 3038 /* 3039 * Mark any bad forwarders. 3040 */ 3041 for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs); addrinfo != NULL; 3042 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3043 { 3044 if (bad_server(fctx, &addrinfo->sockaddr)) { 3045 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3046 } else { 3047 all_bad = false; 3048 } 3049 } 3050 3051 /* 3052 * Mark any bad alternates. 3053 */ 3054 for (curr = ISC_LIST_HEAD(fctx->altfinds); curr != NULL; 3055 curr = ISC_LIST_NEXT(curr, publink)) 3056 { 3057 for (addrinfo = ISC_LIST_HEAD(curr->list); addrinfo != NULL; 3058 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3059 { 3060 if (bad_server(fctx, &addrinfo->sockaddr)) { 3061 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3062 } else { 3063 all_bad = false; 3064 } 3065 } 3066 } 3067 3068 for (addrinfo = ISC_LIST_HEAD(fctx->altaddrs); addrinfo != NULL; 3069 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3070 { 3071 if (bad_server(fctx, &addrinfo->sockaddr)) { 3072 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3073 } else { 3074 all_bad = false; 3075 } 3076 } 3077 3078 return all_bad; 3079 } 3080 3081 static void 3082 add_bad(fetchctx_t *fctx, dns_message_t *rmessage, dns_adbaddrinfo_t *addrinfo, 3083 isc_result_t reason, badnstype_t badtype) { 3084 char namebuf[DNS_NAME_FORMATSIZE]; 3085 char addrbuf[ISC_SOCKADDR_FORMATSIZE]; 3086 char classbuf[64]; 3087 char typebuf[64]; 3088 char code[64]; 3089 isc_buffer_t b; 3090 isc_sockaddr_t *sa; 3091 const char *spc = ""; 3092 isc_sockaddr_t *address = &addrinfo->sockaddr; 3093 3094 #ifdef ENABLE_AFL 3095 if (dns_fuzzing_resolver) { 3096 return; 3097 } 3098 #endif /* ifdef ENABLE_AFL */ 3099 3100 if (reason == DNS_R_LAME) { 3101 fctx->lamecount++; 3102 } else { 3103 switch (badtype) { 3104 case badns_unreachable: 3105 fctx->neterr++; 3106 break; 3107 case badns_response: 3108 fctx->badresp++; 3109 break; 3110 case badns_validation: 3111 break; /* counted as 'valfail' */ 3112 case badns_forwarder: 3113 /* 3114 * We were called to prevent the given forwarder 3115 * from being used again for this fetch context. 3116 */ 3117 break; 3118 } 3119 } 3120 3121 if (bad_server(fctx, address)) { 3122 /* 3123 * We already know this server is bad. 3124 */ 3125 return; 3126 } 3127 3128 FCTXTRACE("add_bad"); 3129 3130 sa = isc_mem_get(fctx->mctx, sizeof(*sa)); 3131 *sa = *address; 3132 ISC_LIST_INITANDAPPEND(fctx->bad, sa, link); 3133 3134 if (reason == DNS_R_LAME) { /* already logged */ 3135 return; 3136 } 3137 3138 if (reason == DNS_R_UNEXPECTEDRCODE && 3139 rmessage->rcode == dns_rcode_servfail && ISFORWARDER(addrinfo)) 3140 { 3141 return; 3142 } 3143 3144 if (reason == DNS_R_UNEXPECTEDRCODE) { 3145 isc_buffer_init(&b, code, sizeof(code) - 1); 3146 dns_rcode_totext(rmessage->rcode, &b); 3147 code[isc_buffer_usedlength(&b)] = '\0'; 3148 spc = " "; 3149 } else if (reason == DNS_R_UNEXPECTEDOPCODE) { 3150 isc_buffer_init(&b, code, sizeof(code) - 1); 3151 dns_opcode_totext((dns_opcode_t)rmessage->opcode, &b); 3152 code[isc_buffer_usedlength(&b)] = '\0'; 3153 spc = " "; 3154 } else { 3155 code[0] = '\0'; 3156 } 3157 dns_name_format(fctx->name, namebuf, sizeof(namebuf)); 3158 dns_rdatatype_format(fctx->type, typebuf, sizeof(typebuf)); 3159 dns_rdataclass_format(fctx->res->rdclass, classbuf, sizeof(classbuf)); 3160 isc_sockaddr_format(address, addrbuf, sizeof(addrbuf)); 3161 isc_log_write( 3162 dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS, DNS_LOGMODULE_RESOLVER, 3163 ISC_LOG_INFO, "%s%s%s resolving '%s/%s/%s': %s", code, spc, 3164 isc_result_totext(reason), namebuf, typebuf, classbuf, addrbuf); 3165 } 3166 3167 /* 3168 * Return true iff the ADB find has an already pending fetch for 'type'. This 3169 * is used to find out whether we're in a loop, where a fetch is waiting for a 3170 * find which is waiting for that same fetch. So if the current find actually 3171 * started the fetch, we know it can't be a loop, so we returns false. 3172 * 3173 * Note: This could be done with either an equivalence check (e.g., 3174 * query_pending == DNS_ADBFIND_INET) or with a bit check, as below. If 3175 * we checked for equivalence, that would mean we could only detect a loop 3176 * when there is exactly one pending fetch, and we're it. If there were 3177 * pending fetches for *both* address families, then a loop would be 3178 * undetected. 3179 * 3180 * However, using a bit check means that in theory, an ADB find might be 3181 * aborted that could have succeeded, if the other fetch had returned an 3182 * answer. 3183 * 3184 * Since there's a good chance the server is broken and won't answer either 3185 * query, and since an ADB find with two pending fetches is a very rare 3186 * occurrence anyway, we regard this theoretical SERVFAIL as the lesser 3187 * evil. 3188 */ 3189 static bool 3190 already_waiting_for(dns_adbfind_t *find, dns_rdatatype_t type) { 3191 if ((find->options & DNS_ADBFIND_STARTEDFETCH) != 0) { 3192 return false; 3193 } 3194 3195 switch (type) { 3196 case dns_rdatatype_a: 3197 return (find->query_pending & DNS_ADBFIND_INET) != 0; 3198 case dns_rdatatype_aaaa: 3199 return (find->query_pending & DNS_ADBFIND_INET6) != 0; 3200 default: 3201 return false; 3202 } 3203 } 3204 3205 static void 3206 findname(fetchctx_t *fctx, const dns_name_t *name, in_port_t port, 3207 unsigned int options, unsigned int flags, isc_stdtime_t now, 3208 bool *overquota, bool *need_alternate, bool *have_address) { 3209 dns_adbaddrinfo_t *ai = NULL; 3210 dns_adbfind_t *find = NULL; 3211 dns_resolver_t *res = fctx->res; 3212 bool unshared = ((fctx->options & DNS_FETCHOPT_UNSHARED) != 0); 3213 isc_result_t result; 3214 3215 FCTXTRACE("FINDNAME"); 3216 3217 /* 3218 * If this name is a subdomain of the query domain, tell 3219 * the ADB to start looking using zone/hint data. This keeps us 3220 * from getting stuck if the nameserver is beneath the zone cut 3221 * and we don't know its address (e.g. because the A record has 3222 * expired). 3223 */ 3224 if (dns_name_issubdomain(name, fctx->domain)) { 3225 options |= DNS_ADBFIND_STARTATZONE; 3226 } 3227 3228 /* 3229 * Exempt prefetches from ADB quota. 3230 */ 3231 if ((fctx->options & DNS_FETCHOPT_PREFETCH) != 0) { 3232 options |= DNS_ADBFIND_QUOTAEXEMPT; 3233 } 3234 3235 /* 3236 * See what we know about this address. 3237 */ 3238 INSIST(!SHUTTINGDOWN(fctx)); 3239 fetchctx_ref(fctx); 3240 result = dns_adb_createfind(fctx->adb, fctx->loop, fctx_finddone, fctx, 3241 name, fctx->name, fctx->type, options, now, 3242 NULL, res->view->dstport, fctx->depth + 1, 3243 fctx->qc, fctx->gqc, fctx, &find); 3244 3245 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 3246 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 3247 "fctx %p(%s): createfind for %s - %s", fctx, fctx->info, 3248 fctx->clientstr, isc_result_totext(result)); 3249 3250 if (result != ISC_R_SUCCESS) { 3251 if (result == DNS_R_ALIAS) { 3252 char namebuf[DNS_NAME_FORMATSIZE]; 3253 3254 /* 3255 * XXXRTH Follow the CNAME/DNAME chain? 3256 */ 3257 dns_adb_destroyfind(&find); 3258 fctx->adberr++; 3259 dns_name_format(name, namebuf, sizeof(namebuf)); 3260 isc_log_write(dns_lctx, DNS_LOGCATEGORY_CNAME, 3261 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 3262 "skipping nameserver '%s' because it " 3263 "is a CNAME, while resolving '%s'", 3264 namebuf, fctx->info); 3265 } 3266 fetchctx_detach(&fctx); 3267 return; 3268 } 3269 3270 if (!ISC_LIST_EMPTY(find->list)) { 3271 /* 3272 * We have at least some of the addresses for the 3273 * name. 3274 */ 3275 INSIST((find->options & DNS_ADBFIND_WANTEVENT) == 0); 3276 if (flags != 0 || port != 0) { 3277 for (ai = ISC_LIST_HEAD(find->list); ai != NULL; 3278 ai = ISC_LIST_NEXT(ai, publink)) 3279 { 3280 ai->flags |= flags; 3281 if (port != 0) { 3282 isc_sockaddr_setport(&ai->sockaddr, 3283 port); 3284 } 3285 } 3286 } 3287 3288 if ((flags & FCTX_ADDRINFO_DUALSTACK) != 0) { 3289 ISC_LIST_APPEND(fctx->altfinds, find, publink); 3290 } else { 3291 ISC_LIST_APPEND(fctx->finds, find, publink); 3292 } 3293 SET_IF_NOT_NULL(have_address, true); 3294 return; 3295 } 3296 3297 /* 3298 * We don't know any of the addresses for this name. 3299 * 3300 * The find may be waiting on a resolver fetch for a server 3301 * address. We need to make sure it isn't waiting before *this* 3302 * fetch, because if it is, we won't be answering it and it 3303 * won't be answering us. 3304 */ 3305 if (already_waiting_for(find, fctx->type) && 3306 dns_name_equal(name, fctx->name)) 3307 { 3308 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 3309 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 3310 "loop detected resolving '%s'", fctx->info); 3311 3312 fctx->adberr++; 3313 if ((find->options & DNS_ADBFIND_WANTEVENT) != 0) { 3314 dns_adb_cancelfind(find); 3315 } else { 3316 dns_adb_destroyfind(&find); 3317 fetchctx_detach(&fctx); 3318 } 3319 3320 return; 3321 } 3322 3323 /* 3324 * We may be waiting for another fetch to complete, and 3325 * we'll get an event later when the find has what it needs. 3326 */ 3327 if ((find->options & DNS_ADBFIND_WANTEVENT) != 0) { 3328 fctx->pending_running++; 3329 ISC_LIST_APPEND(fctx->pending_finds, find, publink); 3330 3331 /* 3332 * Bootstrap. 3333 */ 3334 if (need_alternate != NULL && !*need_alternate && unshared && 3335 ((res->dispatches4 == NULL && 3336 find->result_v6 != DNS_R_NXDOMAIN) || 3337 (res->dispatches6 == NULL && 3338 find->result_v4 != DNS_R_NXDOMAIN))) 3339 { 3340 *need_alternate = true; 3341 } 3342 return; 3343 } 3344 3345 /* 3346 * No addresses and no pending events: the find failed. 3347 */ 3348 if ((find->options & DNS_ADBFIND_OVERQUOTA) != 0) { 3349 if (overquota != NULL) { 3350 *overquota = true; 3351 } 3352 fctx->quotacount++; /* quota exceeded */ 3353 } else { 3354 fctx->adberr++; /* unreachable server, etc. */ 3355 } 3356 3357 /* 3358 * If we know there are no addresses for the family we are using then 3359 * try to add an alternative server. 3360 */ 3361 if (need_alternate != NULL && !*need_alternate && 3362 ((res->dispatches4 == NULL && find->result_v6 == DNS_R_NXRRSET) || 3363 (res->dispatches6 == NULL && find->result_v4 == DNS_R_NXRRSET))) 3364 { 3365 *need_alternate = true; 3366 } 3367 dns_adb_destroyfind(&find); 3368 fetchctx_detach(&fctx); 3369 } 3370 3371 static bool 3372 isstrictsubdomain(const dns_name_t *name1, const dns_name_t *name2) { 3373 int order; 3374 unsigned int nlabels; 3375 dns_namereln_t namereln; 3376 3377 namereln = dns_name_fullcompare(name1, name2, &order, &nlabels); 3378 return namereln == dns_namereln_subdomain; 3379 } 3380 3381 static isc_result_t 3382 fctx_getaddresses(fetchctx_t *fctx) { 3383 isc_result_t result; 3384 dns_resolver_t *res; 3385 isc_stdtime_t now; 3386 unsigned int stdoptions = 0; 3387 dns_forwarder_t *fwd; 3388 dns_adbaddrinfo_t *ai; 3389 bool all_bad; 3390 dns_rdata_ns_t ns; 3391 bool need_alternate = false; 3392 bool all_spilled = false; 3393 bool have_address = false; 3394 unsigned int ns_processed = 0; 3395 size_t fetches_allowed = 0; 3396 dns_rdata_t nameservers_s[NS_PROCESSING_LIMIT]; 3397 dns_rdata_t *nameservers[NS_PROCESSING_LIMIT]; 3398 3399 FCTXTRACE5("getaddresses", "fctx->depth=", fctx->depth); 3400 3401 /* 3402 * Don't pound on remote servers. (Failsafe!) 3403 */ 3404 fctx->restarts++; 3405 if (fctx->restarts > 100) { 3406 FCTXTRACE("too many restarts"); 3407 return DNS_R_SERVFAIL; 3408 } 3409 3410 res = fctx->res; 3411 3412 if (fctx->depth > res->maxdepth) { 3413 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 3414 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 3415 "too much NS indirection resolving '%s' " 3416 "(depth=%u, maxdepth=%u)", 3417 fctx->info, fctx->depth, res->maxdepth); 3418 return DNS_R_SERVFAIL; 3419 } 3420 3421 /* 3422 * Forwarders. 3423 */ 3424 3425 INSIST(ISC_LIST_EMPTY(fctx->forwaddrs)); 3426 INSIST(ISC_LIST_EMPTY(fctx->altaddrs)); 3427 3428 /* 3429 * If we have DNS_FETCHOPT_NOFORWARD set and forwarding policy 3430 * allows us to not forward - skip forwarders and go straight 3431 * to NSes. This is currently used to make sure that priming 3432 * query gets root servers' IP addresses in ADDITIONAL section. 3433 */ 3434 if ((fctx->options & DNS_FETCHOPT_NOFORWARD) != 0 && 3435 (fctx->fwdpolicy != dns_fwdpolicy_only)) 3436 { 3437 goto normal_nses; 3438 } 3439 3440 /* 3441 * If this fctx has forwarders, use them; otherwise use any 3442 * selective forwarders specified in the view; otherwise use the 3443 * resolver's forwarders (if any). 3444 */ 3445 fwd = ISC_LIST_HEAD(fctx->forwarders); 3446 if (fwd == NULL) { 3447 dns_forwarders_t *forwarders = NULL; 3448 dns_name_t *name = fctx->name; 3449 dns_name_t suffix; 3450 3451 /* 3452 * DS records are found in the parent server. 3453 * Strip label to get the correct forwarder (if any). 3454 */ 3455 if (dns_rdatatype_atparent(fctx->type) && 3456 dns_name_countlabels(name) > 1) 3457 { 3458 unsigned int labels; 3459 dns_name_init(&suffix, NULL); 3460 labels = dns_name_countlabels(name); 3461 dns_name_getlabelsequence(name, 1, labels - 1, &suffix); 3462 name = &suffix; 3463 } 3464 3465 result = dns_fwdtable_find(res->view->fwdtable, name, 3466 &forwarders); 3467 if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { 3468 fwd = ISC_LIST_HEAD(forwarders->fwdrs); 3469 fctx->fwdpolicy = forwarders->fwdpolicy; 3470 dns_name_copy(&forwarders->name, fctx->fwdname); 3471 if (fctx->fwdpolicy == dns_fwdpolicy_only && 3472 isstrictsubdomain(&forwarders->name, fctx->domain)) 3473 { 3474 fcount_decr(fctx); 3475 dns_name_copy(&forwarders->name, fctx->domain); 3476 result = fcount_incr(fctx, true); 3477 if (result != ISC_R_SUCCESS) { 3478 dns_forwarders_detach(&forwarders); 3479 return result; 3480 } 3481 } 3482 dns_forwarders_detach(&forwarders); 3483 } 3484 } 3485 3486 while (fwd != NULL) { 3487 if ((isc_sockaddr_pf(&fwd->addr) == AF_INET && 3488 res->dispatches4 == NULL) || 3489 (isc_sockaddr_pf(&fwd->addr) == AF_INET6 && 3490 res->dispatches6 == NULL)) 3491 { 3492 fwd = ISC_LIST_NEXT(fwd, link); 3493 continue; 3494 } 3495 ai = NULL; 3496 result = dns_adb_findaddrinfo(fctx->adb, &fwd->addr, &ai, 0); 3497 if (result == ISC_R_SUCCESS) { 3498 dns_adbaddrinfo_t *cur; 3499 ai->flags |= FCTX_ADDRINFO_FORWARDER; 3500 if (fwd->tlsname != NULL) { 3501 result = dns_view_gettransport( 3502 res->view, DNS_TRANSPORT_TLS, 3503 fwd->tlsname, &ai->transport); 3504 if (result != ISC_R_SUCCESS) { 3505 dns_adb_freeaddrinfo(fctx->adb, &ai); 3506 goto next; 3507 } 3508 } 3509 cur = ISC_LIST_HEAD(fctx->forwaddrs); 3510 while (cur != NULL && cur->srtt < ai->srtt) { 3511 cur = ISC_LIST_NEXT(cur, publink); 3512 } 3513 if (cur != NULL) { 3514 ISC_LIST_INSERTBEFORE(fctx->forwaddrs, cur, ai, 3515 publink); 3516 } else { 3517 ISC_LIST_APPEND(fctx->forwaddrs, ai, publink); 3518 } 3519 } 3520 next: 3521 fwd = ISC_LIST_NEXT(fwd, link); 3522 } 3523 3524 /* 3525 * If the forwarding policy is "only", we don't need the 3526 * addresses of the nameservers. 3527 */ 3528 if (fctx->fwdpolicy == dns_fwdpolicy_only) { 3529 goto out; 3530 } 3531 3532 /* 3533 * Normal nameservers. 3534 */ 3535 normal_nses: 3536 stdoptions = DNS_ADBFIND_WANTEVENT | DNS_ADBFIND_EMPTYEVENT; 3537 if (fctx->restarts == 1) { 3538 /* 3539 * To avoid sending out a flood of queries likely to 3540 * result in NXRRSET, we suppress fetches for address 3541 * families we don't have the first time through, 3542 * provided that we have addresses in some family we 3543 * can use. 3544 * 3545 * We don't want to set this option all the time, since 3546 * if fctx->restarts > 1, we've clearly been having 3547 * trouble with the addresses we had, so getting more 3548 * could help. 3549 */ 3550 stdoptions |= DNS_ADBFIND_AVOIDFETCHES; 3551 } 3552 if (res->dispatches4 != NULL) { 3553 stdoptions |= DNS_ADBFIND_INET; 3554 } 3555 if (res->dispatches6 != NULL) { 3556 stdoptions |= DNS_ADBFIND_INET6; 3557 } 3558 3559 if ((stdoptions & DNS_ADBFIND_ADDRESSMASK) == 0) { 3560 return DNS_R_SERVFAIL; 3561 } 3562 3563 now = isc_stdtime_now(); 3564 all_spilled = true; /* resets to false below after the first success */ 3565 3566 INSIST(ISC_LIST_EMPTY(fctx->finds)); 3567 INSIST(ISC_LIST_EMPTY(fctx->altfinds)); 3568 3569 switch (fctx->depth) { 3570 case 0: 3571 fetches_allowed = 3; 3572 break; 3573 case 1: 3574 fetches_allowed = 2; 3575 break; 3576 default: 3577 fetches_allowed = 1; 3578 break; 3579 } 3580 3581 for (result = dns_rdataset_first(&fctx->nameservers); 3582 result == ISC_R_SUCCESS; 3583 result = dns_rdataset_next(&fctx->nameservers)) 3584 { 3585 dns_rdata_t *rdata = nameservers[ns_processed] = 3586 &nameservers_s[ns_processed]; 3587 3588 dns_rdata_init(rdata); 3589 3590 dns_rdataset_current(&fctx->nameservers, rdata); 3591 3592 if (++ns_processed >= NS_PROCESSING_LIMIT) { 3593 break; 3594 } 3595 } 3596 3597 if (ns_processed > 1 && ns_processed > fetches_allowed) { 3598 /* 3599 * Skip the shuffle if: 3600 * - there's nothing to shuffle (no or one nameserver) 3601 * - there are less nameserver than allowed fetches as 3602 * we are going to start fetches for all of them. 3603 */ 3604 for (size_t i = 0; i < ns_processed - 1; i++) { 3605 size_t j = i + isc_random_uniform(ns_processed - i); 3606 3607 ISC_SWAP(nameservers[i], nameservers[j]); 3608 } 3609 } 3610 3611 for (;;) { 3612 for (size_t i = 0; i < ns_processed; i++) { 3613 bool overquota = false; 3614 unsigned int static_stub = 0; 3615 unsigned int no_fetch = 0; 3616 dns_rdata_t *rdata = nameservers[i]; 3617 3618 /* 3619 * Extract the name from the NS record. 3620 */ 3621 result = dns_rdata_tostruct(rdata, &ns, NULL); 3622 if (result != ISC_R_SUCCESS) { 3623 continue; 3624 } 3625 3626 if (STATICSTUB(&fctx->nameservers) && 3627 dns_name_equal(&ns.name, fctx->domain)) 3628 { 3629 static_stub = DNS_ADBFIND_STATICSTUB; 3630 } 3631 3632 /* 3633 * Make sure we only launch a limited number of 3634 * outgoing fetches. 3635 */ 3636 if (fctx->pending_running >= fetches_allowed) { 3637 no_fetch = DNS_ADBFIND_NOFETCH; 3638 } 3639 3640 findname(fctx, &ns.name, 0, 3641 stdoptions | static_stub | no_fetch, 0, now, 3642 &overquota, &need_alternate, &have_address); 3643 3644 if (!overquota) { 3645 all_spilled = false; 3646 } 3647 3648 dns_rdata_freestruct(&ns); 3649 } 3650 3651 /* 3652 * Don't start alternate fetch if we just started one above. 3653 */ 3654 if (fctx->pending_running > 0) { 3655 stdoptions |= DNS_ADBFIND_NOFETCH; 3656 result = ISC_R_NOMORE; 3657 } else if (have_address || fetches_allowed != 0) { 3658 result = ISC_R_NOMORE; 3659 } 3660 3661 if (result != ISC_R_SUCCESS) { 3662 break; 3663 } 3664 3665 /* 3666 * We have no addresses and we haven't allowed any 3667 * fetches to be started. Allow one extra fetch and try 3668 * again. 3669 */ 3670 fetches_allowed = 1; 3671 } 3672 if (result != ISC_R_NOMORE) { 3673 return result; 3674 } 3675 3676 /* 3677 * Do we need to use 6 to 4? 3678 */ 3679 if (need_alternate) { 3680 int family; 3681 alternate_t *a; 3682 family = (res->dispatches6 != NULL) ? AF_INET6 : AF_INET; 3683 for (a = ISC_LIST_HEAD(res->alternates); a != NULL; 3684 a = ISC_LIST_NEXT(a, link)) 3685 { 3686 if (!a->isaddress) { 3687 findname(fctx, &a->_u._n.name, a->_u._n.port, 3688 stdoptions, FCTX_ADDRINFO_DUALSTACK, 3689 now, NULL, NULL, NULL); 3690 continue; 3691 } 3692 if (isc_sockaddr_pf(&a->_u.addr) != family) { 3693 continue; 3694 } 3695 ai = NULL; 3696 result = dns_adb_findaddrinfo(fctx->adb, &a->_u.addr, 3697 &ai, 0); 3698 if (result == ISC_R_SUCCESS) { 3699 dns_adbaddrinfo_t *cur; 3700 ai->flags |= FCTX_ADDRINFO_FORWARDER; 3701 ai->flags |= FCTX_ADDRINFO_DUALSTACK; 3702 cur = ISC_LIST_HEAD(fctx->altaddrs); 3703 while (cur != NULL && cur->srtt < ai->srtt) { 3704 cur = ISC_LIST_NEXT(cur, publink); 3705 } 3706 if (cur != NULL) { 3707 ISC_LIST_INSERTBEFORE(fctx->altaddrs, 3708 cur, ai, publink); 3709 } else { 3710 ISC_LIST_APPEND(fctx->altaddrs, ai, 3711 publink); 3712 } 3713 } 3714 } 3715 } 3716 3717 out: 3718 /* 3719 * Mark all known bad servers. 3720 */ 3721 all_bad = mark_bad(fctx); 3722 3723 /* 3724 * How are we doing? 3725 */ 3726 if (all_bad) { 3727 /* 3728 * We've got no addresses. 3729 */ 3730 if (fctx->pending_running > 0) { 3731 /* 3732 * We're fetching the addresses, but don't have 3733 * any yet. Tell the caller to wait for an 3734 * answer. 3735 */ 3736 result = DNS_R_WAIT; 3737 } else { 3738 /* 3739 * We've lost completely. We don't know any 3740 * addresses, and the ADB has told us it can't 3741 * get them. 3742 */ 3743 FCTXTRACE("no addresses"); 3744 3745 result = ISC_R_FAILURE; 3746 3747 /* 3748 * If all of the addresses found were over the 3749 * fetches-per-server quota, return the 3750 * configured response. 3751 */ 3752 if (all_spilled) { 3753 result = res->quotaresp[dns_quotatype_server]; 3754 inc_stats(res, dns_resstatscounter_serverquota); 3755 } 3756 } 3757 } else { 3758 /* 3759 * We've found some addresses. We might still be 3760 * looking for more addresses. 3761 */ 3762 result = ISC_R_SUCCESS; 3763 } 3764 3765 return result; 3766 } 3767 3768 static void 3769 possibly_mark(fetchctx_t *fctx, dns_adbaddrinfo_t *addr) { 3770 isc_netaddr_t na; 3771 isc_sockaddr_t *sa = &addr->sockaddr; 3772 bool aborted = false; 3773 bool bogus; 3774 dns_acl_t *blackhole; 3775 isc_netaddr_t ipaddr; 3776 dns_peer_t *peer = NULL; 3777 dns_resolver_t *res = fctx->res; 3778 const char *msg = NULL; 3779 3780 isc_netaddr_fromsockaddr(&ipaddr, sa); 3781 blackhole = dns_dispatchmgr_getblackhole(fctx->dispatchmgr); 3782 (void)dns_peerlist_peerbyaddr(res->view->peers, &ipaddr, &peer); 3783 3784 if (blackhole != NULL) { 3785 int match; 3786 3787 if ((dns_acl_match(&ipaddr, NULL, blackhole, res->view->aclenv, 3788 &match, NULL) == ISC_R_SUCCESS) && 3789 match > 0) 3790 { 3791 aborted = true; 3792 } 3793 } 3794 3795 if (peer != NULL && dns_peer_getbogus(peer, &bogus) == ISC_R_SUCCESS && 3796 bogus) 3797 { 3798 aborted = true; 3799 } 3800 3801 if (aborted) { 3802 addr->flags |= FCTX_ADDRINFO_MARK; 3803 msg = "ignoring blackholed / bogus server: "; 3804 } else if (isc_sockaddr_isnetzero(sa)) { 3805 addr->flags |= FCTX_ADDRINFO_MARK; 3806 msg = "ignoring net zero address: "; 3807 } else if (isc_sockaddr_ismulticast(sa)) { 3808 addr->flags |= FCTX_ADDRINFO_MARK; 3809 msg = "ignoring multicast address: "; 3810 } else if (isc_sockaddr_isexperimental(sa)) { 3811 addr->flags |= FCTX_ADDRINFO_MARK; 3812 msg = "ignoring experimental address: "; 3813 } else if (sa->type.sa.sa_family != AF_INET6) { 3814 return; 3815 } else if (IN6_IS_ADDR_V4MAPPED(&sa->type.sin6.sin6_addr)) { 3816 addr->flags |= FCTX_ADDRINFO_MARK; 3817 msg = "ignoring IPv6 mapped IPV4 address: "; 3818 } else if (IN6_IS_ADDR_V4COMPAT(&sa->type.sin6.sin6_addr)) { 3819 addr->flags |= FCTX_ADDRINFO_MARK; 3820 msg = "ignoring IPv6 compatibility IPV4 address: "; 3821 } else { 3822 return; 3823 } 3824 3825 if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) { 3826 char buf[ISC_NETADDR_FORMATSIZE]; 3827 isc_netaddr_fromsockaddr(&na, sa); 3828 isc_netaddr_format(&na, buf, sizeof(buf)); 3829 FCTXTRACE2(msg, buf); 3830 } 3831 } 3832 3833 static dns_adbaddrinfo_t * 3834 nextaddress(fetchctx_t *fctx) { 3835 dns_adbaddrinfo_t *prevai = fctx->foundaddrinfo, *lowestsrttai = NULL; 3836 unsigned int v6bias = fctx->res->view->v6bias, lowestsrtt = 0; 3837 3838 /* 3839 * Let's walk through the list of dns_adbaddrinfo_t to find the best 3840 * next server address to query. This is linear on the number of 3841 * dns_adbaddrinfo_t which are grouped in find list (for each ADB find). 3842 */ 3843 for (dns_adbfind_t *find = ISC_LIST_HEAD(fctx->finds); find != NULL; 3844 find = ISC_LIST_NEXT(find, publink)) 3845 { 3846 for (dns_adbaddrinfo_t *ai = ISC_LIST_HEAD(find->list); 3847 ai != NULL; ai = ISC_LIST_NEXT(ai, publink)) 3848 { 3849 /* 3850 * This address has been marked already, skip it. 3851 */ 3852 if (!UNMARKED(ai)) { 3853 continue; 3854 } 3855 3856 /* 3857 * This address is the same as the previously used 3858 * address, it's a duplicate, mark it and skip it! 3859 */ 3860 if (prevai != NULL) { 3861 if (prevai->entry == ai->entry) { 3862 ai->flags |= FCTX_ADDRINFO_MARK; 3863 continue; 3864 } 3865 } 3866 3867 /* 3868 * Mark and skip this address if incompatible (i.e. IPv6 3869 * address on a v4 only server, or for ACL reason, etc.) 3870 */ 3871 possibly_mark(fctx, ai); 3872 if (!UNMARKED(ai)) { 3873 continue; 3874 } 3875 3876 /* 3877 * This address hasn't been tried yet and is a 3878 * good candidate. Let's keep track of it if it 3879 * has the lowest SRTT so far (or if there is no 3880 * address with lowest SRTT found yet). 3881 */ 3882 unsigned int aisrtt = ai->srtt; 3883 3884 if (isc_sockaddr_pf(&ai->sockaddr) != AF_INET6) { 3885 aisrtt += v6bias; 3886 } 3887 3888 if (lowestsrttai == NULL || aisrtt < lowestsrtt) { 3889 lowestsrttai = ai; 3890 lowestsrtt = aisrtt; 3891 continue; 3892 } 3893 } 3894 } 3895 3896 /* 3897 * This is the next address to query. If this is NULL, we're done. 3898 */ 3899 if (lowestsrttai != NULL) { 3900 lowestsrttai->flags |= FCTX_ADDRINFO_MARK; 3901 } 3902 fctx->foundaddrinfo = lowestsrttai; 3903 3904 return lowestsrttai; 3905 } 3906 3907 static dns_adbaddrinfo_t * 3908 fctx_nextaddress(fetchctx_t *fctx) { 3909 dns_adbfind_t *find, *start; 3910 dns_adbaddrinfo_t *addrinfo; 3911 dns_adbaddrinfo_t *faddrinfo; 3912 3913 /* 3914 * Return the next untried address, if any. 3915 */ 3916 3917 /* 3918 * Find the first unmarked forwarder (if any). 3919 */ 3920 for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs); addrinfo != NULL; 3921 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3922 { 3923 if (!UNMARKED(addrinfo)) { 3924 continue; 3925 } 3926 possibly_mark(fctx, addrinfo); 3927 if (UNMARKED(addrinfo)) { 3928 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3929 fctx->forwarding = true; 3930 3931 /* 3932 * QNAME minimization is disabled when 3933 * forwarding, and has to remain disabled if 3934 * we switch back to normal recursion; otherwise 3935 * forwarding could leave us in an inconsistent 3936 * state. 3937 */ 3938 fctx->minimized = false; 3939 return addrinfo; 3940 } 3941 } 3942 3943 /* 3944 * No forwarders. Move to the next find. 3945 */ 3946 fctx->forwarding = false; 3947 FCTX_ATTR_SET(fctx, FCTX_ATTR_TRIEDFIND); 3948 3949 faddrinfo = nextaddress(fctx); 3950 if (faddrinfo != NULL) { 3951 return faddrinfo; 3952 } 3953 3954 /* 3955 * No nameservers left. Try alternates. 3956 */ 3957 3958 FCTX_ATTR_SET(fctx, FCTX_ATTR_TRIEDALT); 3959 3960 find = fctx->altfind; 3961 if (find == NULL) { 3962 find = ISC_LIST_HEAD(fctx->altfinds); 3963 } else { 3964 find = ISC_LIST_NEXT(find, publink); 3965 if (find == NULL) { 3966 find = ISC_LIST_HEAD(fctx->altfinds); 3967 } 3968 } 3969 3970 /* 3971 * Find the first unmarked addrinfo. 3972 */ 3973 addrinfo = NULL; 3974 if (find != NULL) { 3975 start = find; 3976 do { 3977 for (addrinfo = ISC_LIST_HEAD(find->list); 3978 addrinfo != NULL; 3979 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3980 { 3981 if (!UNMARKED(addrinfo)) { 3982 continue; 3983 } 3984 possibly_mark(fctx, addrinfo); 3985 if (UNMARKED(addrinfo)) { 3986 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3987 break; 3988 } 3989 } 3990 if (addrinfo != NULL) { 3991 break; 3992 } 3993 find = ISC_LIST_NEXT(find, publink); 3994 if (find == NULL) { 3995 find = ISC_LIST_HEAD(fctx->altfinds); 3996 } 3997 } while (find != start); 3998 } 3999 4000 faddrinfo = addrinfo; 4001 4002 /* 4003 * See if we have a better alternate server by address. 4004 */ 4005 4006 for (addrinfo = ISC_LIST_HEAD(fctx->altaddrs); addrinfo != NULL; 4007 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 4008 { 4009 if (!UNMARKED(addrinfo)) { 4010 continue; 4011 } 4012 possibly_mark(fctx, addrinfo); 4013 if (UNMARKED(addrinfo) && 4014 (faddrinfo == NULL || addrinfo->srtt < faddrinfo->srtt)) 4015 { 4016 if (faddrinfo != NULL) { 4017 faddrinfo->flags &= ~FCTX_ADDRINFO_MARK; 4018 } 4019 addrinfo->flags |= FCTX_ADDRINFO_MARK; 4020 break; 4021 } 4022 } 4023 4024 if (addrinfo == NULL) { 4025 addrinfo = faddrinfo; 4026 fctx->altfind = find; 4027 } 4028 4029 return addrinfo; 4030 } 4031 4032 static isc_result_t 4033 incr_query_counters(fetchctx_t *fctx) { 4034 isc_result_t result; 4035 4036 result = isc_counter_increment(fctx->qc); 4037 #if WANT_QUERYTRACE 4038 FCTXTRACE5("query", "max-recursion-queries, querycount=", 4039 isc_counter_used(fctx->qc)); 4040 #endif 4041 if (result != ISC_R_SUCCESS) { 4042 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4043 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 4044 "exceeded max queries resolving '%s' " 4045 "(max-recursion-queries, querycount=%u)", 4046 fctx->info, isc_counter_used(fctx->qc)); 4047 } else if (fctx->gqc != NULL) { 4048 result = isc_counter_increment(fctx->gqc); 4049 #if WANT_QUERYTRACE 4050 FCTXTRACE5("query", "max-query-count, querycount=", 4051 isc_counter_used(fctx->gqc)); 4052 #endif 4053 if (result != ISC_R_SUCCESS) { 4054 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4055 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 4056 "exceeded global max queries resolving " 4057 "'%s' (max-query-count, querycount=%u)", 4058 fctx->info, isc_counter_used(fctx->gqc)); 4059 } 4060 } 4061 4062 return result; 4063 } 4064 4065 static void 4066 fctx_try(fetchctx_t *fctx, bool retrying) { 4067 isc_result_t result; 4068 dns_adbaddrinfo_t *addrinfo = NULL; 4069 dns_resolver_t *res = NULL; 4070 4071 REQUIRE(!ADDRWAIT(fctx)); 4072 REQUIRE(fctx->tid == isc_tid()); 4073 4074 res = fctx->res; 4075 4076 /* We've already exceeded maximum query count */ 4077 if (isc_counter_used(fctx->qc) > isc_counter_getlimit(fctx->qc)) { 4078 isc_log_write( 4079 dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4080 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 4081 "exceeded max queries resolving '%s' " 4082 "(max-recursion-queries, querycount=%u, maxqueries=%u)", 4083 fctx->info, isc_counter_used(fctx->qc), 4084 isc_counter_getlimit(fctx->qc)); 4085 result = DNS_R_SERVFAIL; 4086 goto done; 4087 } 4088 4089 if (fctx->gqc != NULL && 4090 isc_counter_used(fctx->gqc) > isc_counter_getlimit(fctx->gqc)) 4091 { 4092 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4093 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 4094 "exceeded global max queries resolving '%s' " 4095 "(max-query-count, querycount=%u, maxqueries=%u)", 4096 fctx->info, isc_counter_used(fctx->gqc), 4097 isc_counter_getlimit(fctx->gqc)); 4098 result = DNS_R_SERVFAIL; 4099 goto done; 4100 } 4101 4102 addrinfo = fctx_nextaddress(fctx); 4103 4104 /* Try to find an address that isn't over quota */ 4105 while (addrinfo != NULL && dns_adb_overquota(fctx->adb, addrinfo)) { 4106 addrinfo = fctx_nextaddress(fctx); 4107 } 4108 4109 if (addrinfo == NULL) { 4110 /* We have no more addresses. Start over. */ 4111 fctx_cancelqueries(fctx, true, false); 4112 fctx_cleanup(fctx); 4113 result = fctx_getaddresses(fctx); 4114 switch (result) { 4115 case ISC_R_SUCCESS: 4116 break; 4117 case DNS_R_WAIT: 4118 /* Sleep waiting for addresses. */ 4119 FCTXTRACE("addrwait"); 4120 FCTX_ATTR_SET(fctx, FCTX_ATTR_ADDRWAIT); 4121 return; 4122 default: 4123 goto done; 4124 } 4125 4126 addrinfo = fctx_nextaddress(fctx); 4127 4128 while (addrinfo != NULL && 4129 dns_adb_overquota(fctx->adb, addrinfo)) 4130 { 4131 addrinfo = fctx_nextaddress(fctx); 4132 } 4133 4134 /* 4135 * While we may have addresses from the ADB, they 4136 * might be bad ones. In this case, return SERVFAIL. 4137 */ 4138 if (addrinfo == NULL) { 4139 result = DNS_R_SERVFAIL; 4140 goto done; 4141 } 4142 } 4143 /* 4144 * We're minimizing and we're not yet at the final NS - 4145 * we need to launch a query for NS for 'upper' domain 4146 */ 4147 if (fctx->minimized && !fctx->forwarding) { 4148 unsigned int options = fctx->options; 4149 4150 options &= ~DNS_FETCHOPT_QMINIMIZE; 4151 4152 /* 4153 * Is another QNAME minimization fetch still running? 4154 */ 4155 if (fctx->qminfetch != NULL) { 4156 bool validfctx = (DNS_FETCH_VALID(fctx->qminfetch) && 4157 VALID_FCTX(fctx->qminfetch->private)); 4158 char namebuf[DNS_NAME_FORMATSIZE]; 4159 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 4160 4161 dns_name_format(fctx->qminname, namebuf, 4162 sizeof(namebuf)); 4163 dns_rdatatype_format(fctx->qmintype, typebuf, 4164 sizeof(typebuf)); 4165 4166 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4167 DNS_LOGMODULE_RESOLVER, ISC_LOG_ERROR, 4168 "fctx %p(%s): attempting QNAME " 4169 "minimization fetch for %s/%s but " 4170 "fetch %p(%s) still running", 4171 fctx, fctx->info, namebuf, typebuf, 4172 fctx->qminfetch, 4173 validfctx ? fctx->qminfetch->private->info 4174 : "<invalid>"); 4175 result = DNS_R_SERVFAIL; 4176 goto done; 4177 } 4178 4179 /* 4180 * Turn on NOFOLLOW in relaxed mode so that QNAME minimization 4181 * doesn't cause additional queries to resolve the target of the 4182 * QNAME minimization request when a referral is returned. This 4183 * will also reduce the impact of mis-matched NS RRsets where 4184 * the child's NS RRset is garbage. If a delegation is 4185 * discovered DNS_R_DELEGATION will be returned to resume_qmin. 4186 */ 4187 if ((options & DNS_FETCHOPT_QMIN_STRICT) == 0) { 4188 options |= DNS_FETCHOPT_NOFOLLOW; 4189 } 4190 4191 fetchctx_ref(fctx); 4192 result = dns_resolver_createfetch( 4193 fctx->res, fctx->qminname, fctx->qmintype, fctx->domain, 4194 &fctx->nameservers, NULL, NULL, 0, options, 0, fctx->qc, 4195 fctx->gqc, fctx, fctx->loop, resume_qmin, fctx, 4196 &fctx->edectx, &fctx->qminrrset, NULL, 4197 &fctx->qminfetch); 4198 if (result != ISC_R_SUCCESS) { 4199 fetchctx_unref(fctx); 4200 goto done; 4201 } 4202 return; 4203 } 4204 4205 result = incr_query_counters(fctx); 4206 if (result != ISC_R_SUCCESS) { 4207 goto done; 4208 } 4209 4210 result = fctx_query(fctx, addrinfo, fctx->options); 4211 if (result != ISC_R_SUCCESS) { 4212 goto done; 4213 } 4214 if (retrying) { 4215 inc_stats(res, dns_resstatscounter_retry); 4216 } 4217 4218 done: 4219 if (result != ISC_R_SUCCESS) { 4220 fctx_done_detach(&fctx, result); 4221 } 4222 } 4223 4224 static void 4225 resume_qmin(void *arg) { 4226 dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg; 4227 fetchctx_t *fctx = resp->arg; 4228 dns_resolver_t *res = NULL; 4229 isc_result_t result; 4230 unsigned int findoptions = 0; 4231 dns_name_t *fname = NULL, *dcname = NULL; 4232 dns_fixedname_t ffixed, dcfixed; 4233 4234 REQUIRE(VALID_FCTX(fctx)); 4235 4236 res = fctx->res; 4237 4238 REQUIRE(fctx->tid == isc_tid()); 4239 4240 FCTXTRACE("resume_qmin"); 4241 4242 fname = dns_fixedname_initname(&ffixed); 4243 dcname = dns_fixedname_initname(&dcfixed); 4244 4245 if (resp->node != NULL) { 4246 dns_db_detachnode(resp->db, &resp->node); 4247 } 4248 if (resp->db != NULL) { 4249 dns_db_detach(&resp->db); 4250 } 4251 4252 if (dns_rdataset_isassociated(resp->rdataset)) { 4253 dns_rdataset_disassociate(resp->rdataset); 4254 } 4255 4256 result = resp->result; 4257 4258 dns_resolver_freefresp(&resp); 4259 4260 LOCK(&fctx->lock); 4261 if (SHUTTINGDOWN(fctx)) { 4262 result = ISC_R_SHUTTINGDOWN; 4263 } 4264 UNLOCK(&fctx->lock); 4265 4266 dns_resolver_destroyfetch(&fctx->qminfetch); 4267 4268 /* 4269 * Beware, the switch() below is little bit tricky - the order of the 4270 * branches is important. 4271 */ 4272 switch (result) { 4273 case ISC_R_SHUTTINGDOWN: 4274 case ISC_R_CANCELED: 4275 goto cleanup; 4276 4277 case DNS_R_NXDOMAIN: 4278 case DNS_R_NCACHENXDOMAIN: 4279 case DNS_R_FORMERR: 4280 case DNS_R_REMOTEFORMERR: 4281 case ISC_R_FAILURE: 4282 if ((fctx->options & DNS_FETCHOPT_QMIN_STRICT) != 0) { 4283 /* These results cause a hard fail in strict mode */ 4284 goto cleanup; 4285 } 4286 4287 /* ...or disable minimization in relaxed mode */ 4288 fctx->qmin_labels = DNS_NAME_MAXLABELS; 4289 4290 /* 4291 * We store the result. If we succeed in the end 4292 * we'll issue a warning that the server is 4293 * broken. 4294 */ 4295 fctx->qmin_warning = result; 4296 break; 4297 4298 case ISC_R_SUCCESS: 4299 case DNS_R_DELEGATION: 4300 case DNS_R_NXRRSET: 4301 case DNS_R_NCACHENXRRSET: 4302 case DNS_R_CNAME: 4303 case DNS_R_DNAME: 4304 /* 4305 * We have previously detected a possible error of an 4306 * incorrect NXDOMAIN and now have a response that 4307 * indicates that it was an actual error. 4308 */ 4309 if (fctx->qmin_warning == DNS_R_NCACHENXDOMAIN || 4310 fctx->qmin_warning == DNS_R_NXDOMAIN) 4311 { 4312 fctx->force_qmin_warning = true; 4313 } 4314 /* 4315 * Any other result will *not* cause a failure in strict 4316 * mode, or cause minimization to be disabled in relaxed 4317 * mode. 4318 * 4319 * If DNS_R_DELEGATION is set here, it implies that 4320 * DNS_FETCHOPT_NOFOLLOW was set, and a delegation was 4321 * discovered but not followed; we will do so now. 4322 */ 4323 break; 4324 4325 default: 4326 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4327 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(5), 4328 "QNAME minimization: unexpected result %s", 4329 isc_result_totext(result)); 4330 break; 4331 } 4332 4333 if (dns_rdataset_isassociated(&fctx->nameservers)) { 4334 dns_rdataset_disassociate(&fctx->nameservers); 4335 } 4336 4337 if (dns_rdatatype_atparent(fctx->type)) { 4338 findoptions |= DNS_DBFIND_NOEXACT; 4339 } 4340 result = dns_view_findzonecut(res->view, fctx->name, fname, dcname, 4341 fctx->now, findoptions, true, true, 4342 &fctx->nameservers, NULL); 4343 FCTXTRACEN("resume_qmin findzonecut", fname, result); 4344 4345 /* 4346 * DNS_R_NXDOMAIN here means we have not loaded the root zone 4347 * mirror yet - but DNS_R_NXDOMAIN is not a valid return value 4348 * when doing recursion, we need to patch it. 4349 * 4350 * CNAME or DNAME means zone were added with that record 4351 * after the start of a recursion. It means we do not have 4352 * initialized correct hevent->foundname and have to fail. 4353 */ 4354 if (result == DNS_R_NXDOMAIN || result == DNS_R_CNAME || 4355 result == DNS_R_DNAME) 4356 { 4357 result = DNS_R_SERVFAIL; 4358 } 4359 4360 if (result != ISC_R_SUCCESS) { 4361 goto cleanup; 4362 } 4363 fcount_decr(fctx); 4364 dns_name_copy(fname, fctx->domain); 4365 4366 result = fcount_incr(fctx, true); 4367 if (result != ISC_R_SUCCESS) { 4368 goto cleanup; 4369 } 4370 4371 dns_name_copy(dcname, fctx->qmindcname); 4372 fctx->ns_ttl = fctx->nameservers.ttl; 4373 fctx->ns_ttl_ok = true; 4374 4375 fctx_minimize_qname(fctx); 4376 4377 if (!fctx->minimized) { 4378 /* 4379 * We have finished minimizing, but fctx->finds was 4380 * filled at the beginning of the run - now we need to 4381 * clear it before sending the final query to use proper 4382 * nameservers. 4383 */ 4384 fctx_cancelqueries(fctx, false, false); 4385 fctx_cleanup(fctx); 4386 } 4387 4388 fctx_try(fctx, true); 4389 4390 cleanup: 4391 if (result != ISC_R_SUCCESS) { 4392 /* An error occurred, tear down whole fctx */ 4393 fctx_done_unref(fctx, result); 4394 } 4395 fetchctx_detach(&fctx); 4396 } 4397 4398 static void 4399 fctx_destroy(fetchctx_t *fctx) { 4400 dns_resolver_t *res = NULL; 4401 isc_sockaddr_t *sa = NULL, *next_sa = NULL; 4402 struct tried *tried = NULL; 4403 4404 REQUIRE(VALID_FCTX(fctx)); 4405 REQUIRE(ISC_LIST_EMPTY(fctx->resps)); 4406 REQUIRE(ISC_LIST_EMPTY(fctx->queries)); 4407 REQUIRE(ISC_LIST_EMPTY(fctx->finds)); 4408 REQUIRE(ISC_LIST_EMPTY(fctx->altfinds)); 4409 REQUIRE(ISC_LIST_EMPTY(fctx->pending_finds)); 4410 REQUIRE(ISC_LIST_EMPTY(fctx->validators)); 4411 REQUIRE(fctx->state != fetchstate_active); 4412 REQUIRE(fctx->timer == NULL); 4413 4414 FCTXTRACE("destroy"); 4415 4416 fctx->magic = 0; 4417 4418 res = fctx->res; 4419 4420 dec_stats(res, dns_resstatscounter_nfetch); 4421 4422 /* Free bad */ 4423 for (sa = ISC_LIST_HEAD(fctx->bad); sa != NULL; sa = next_sa) { 4424 next_sa = ISC_LIST_NEXT(sa, link); 4425 ISC_LIST_UNLINK(fctx->bad, sa, link); 4426 isc_mem_put(fctx->mctx, sa, sizeof(*sa)); 4427 } 4428 4429 for (tried = ISC_LIST_HEAD(fctx->edns); tried != NULL; 4430 tried = ISC_LIST_HEAD(fctx->edns)) 4431 { 4432 ISC_LIST_UNLINK(fctx->edns, tried, link); 4433 isc_mem_put(fctx->mctx, tried, sizeof(*tried)); 4434 } 4435 4436 if (fctx->nfails != NULL) { 4437 isc_counter_detach(&fctx->nfails); 4438 } 4439 if (fctx->nvalidations != NULL) { 4440 isc_counter_detach(&fctx->nvalidations); 4441 } 4442 isc_counter_detach(&fctx->qc); 4443 if (fctx->gqc != NULL) { 4444 isc_counter_detach(&fctx->gqc); 4445 } 4446 if (fctx->parent != NULL) { 4447 fetchctx_detach(&fctx->parent); 4448 } 4449 fcount_decr(fctx); 4450 dns_message_detach(&fctx->qmessage); 4451 if (dns_rdataset_isassociated(&fctx->nameservers)) { 4452 dns_rdataset_disassociate(&fctx->nameservers); 4453 } 4454 dns_db_detach(&fctx->cache); 4455 dns_adb_detach(&fctx->adb); 4456 dns_dispatchmgr_detach(&fctx->dispatchmgr); 4457 4458 dns_resolver_detach(&fctx->res); 4459 4460 dns_ede_invalidate(&fctx->edectx); 4461 4462 isc_mutex_destroy(&fctx->lock); 4463 4464 isc_mem_free(fctx->mctx, fctx->info); 4465 isc_mem_putanddetach(&fctx->mctx, fctx, sizeof(*fctx)); 4466 } 4467 4468 static void 4469 fctx_expired(void *arg) { 4470 fetchctx_t *fctx = (fetchctx_t *)arg; 4471 4472 REQUIRE(VALID_FCTX(fctx)); 4473 REQUIRE(fctx->tid == isc_tid()); 4474 4475 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4476 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 4477 "shut down hung fetch while resolving %p(%s)", fctx, 4478 fctx->info); 4479 4480 dns_ede_add(&fctx->edectx, DNS_EDE_NOREACHABLEAUTH, NULL); 4481 4482 fctx_done_detach(&fctx, DNS_R_SERVFAIL); 4483 } 4484 4485 static void 4486 fctx_shutdown(void *arg) { 4487 fetchctx_t *fctx = arg; 4488 4489 REQUIRE(VALID_FCTX(fctx)); 4490 4491 fctx_done_unref(fctx, ISC_R_SHUTTINGDOWN); 4492 fetchctx_detach(&fctx); 4493 } 4494 4495 static void 4496 fctx_start(void *arg) { 4497 fetchctx_t *fctx = (fetchctx_t *)arg; 4498 4499 REQUIRE(VALID_FCTX(fctx)); 4500 4501 FCTXTRACE("start"); 4502 4503 LOCK(&fctx->lock); 4504 if (SHUTTINGDOWN(fctx)) { 4505 UNLOCK(&fctx->lock); 4506 goto detach; 4507 } 4508 4509 /* 4510 * Normal fctx startup. 4511 */ 4512 fctx->state = fetchstate_active; 4513 UNLOCK(&fctx->lock); 4514 4515 /* 4516 * As a backstop, we also set a timer to stop the fetch 4517 * if in-band netmgr timeouts don't work. It will fire two 4518 * seconds after the fetch should have finished. (This 4519 * should be enough of a gap to avoid the timer firing 4520 * while a response is being processed normally.) 4521 */ 4522 fctx_starttimer(fctx); 4523 fctx_try(fctx, false); 4524 4525 detach: 4526 fetchctx_detach(&fctx); 4527 } 4528 4529 /* 4530 * Fetch Creation, Joining, and Cancellation. 4531 */ 4532 4533 static void 4534 fctx_add_event(fetchctx_t *fctx, isc_loop_t *loop, const isc_sockaddr_t *client, 4535 dns_messageid_t id, isc_job_cb cb, void *arg, 4536 dns_edectx_t *edectx, dns_rdataset_t *rdataset, 4537 dns_rdataset_t *sigrdataset, dns_fetch_t *fetch) { 4538 dns_fetchresponse_t *resp = NULL; 4539 4540 FCTXTRACE("addevent"); 4541 4542 resp = isc_mem_get(fctx->mctx, sizeof(*resp)); 4543 *resp = (dns_fetchresponse_t){ 4544 .result = DNS_R_SERVFAIL, 4545 .qtype = fctx->type, 4546 .rdataset = rdataset, 4547 .sigrdataset = sigrdataset, 4548 .fetch = fetch, 4549 .client = client, 4550 .id = id, 4551 .loop = loop, 4552 .cb = cb, 4553 .arg = arg, 4554 .link = ISC_LINK_INITIALIZER, 4555 .edectx = edectx, 4556 }; 4557 isc_mem_attach(fctx->mctx, &resp->mctx); 4558 4559 resp->foundname = dns_fixedname_initname(&resp->fname); 4560 4561 /* 4562 * Store the sigrdataset in the first resp in case it is needed 4563 * by any of the events. 4564 */ 4565 if (resp->sigrdataset != NULL) { 4566 ISC_LIST_PREPEND(fctx->resps, resp, link); 4567 } else { 4568 ISC_LIST_APPEND(fctx->resps, resp, link); 4569 } 4570 } 4571 4572 static void 4573 fctx_join(fetchctx_t *fctx, isc_loop_t *loop, const isc_sockaddr_t *client, 4574 dns_messageid_t id, isc_job_cb cb, void *arg, dns_edectx_t *edectx, 4575 dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset, 4576 dns_fetch_t *fetch) { 4577 FCTXTRACE("join"); 4578 4579 REQUIRE(!SHUTTINGDOWN(fctx)); 4580 4581 fctx_add_event(fctx, loop, client, id, cb, arg, edectx, rdataset, 4582 sigrdataset, fetch); 4583 4584 fetch->magic = DNS_FETCH_MAGIC; 4585 fetchctx_attach(fctx, &fetch->private); 4586 } 4587 4588 static void 4589 log_ns_ttl(fetchctx_t *fctx, const char *where) { 4590 char namebuf[DNS_NAME_FORMATSIZE]; 4591 char domainbuf[DNS_NAME_FORMATSIZE]; 4592 4593 dns_name_format(fctx->name, namebuf, sizeof(namebuf)); 4594 dns_name_format(fctx->domain, domainbuf, sizeof(domainbuf)); 4595 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4596 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(10), 4597 "log_ns_ttl: fctx %p: %s: %s (in '%s'?): %u %u", fctx, 4598 where, namebuf, domainbuf, fctx->ns_ttl_ok, fctx->ns_ttl); 4599 } 4600 4601 static isc_result_t 4602 fctx_create(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name, 4603 dns_rdatatype_t type, const dns_name_t *domain, 4604 dns_rdataset_t *nameservers, const isc_sockaddr_t *client, 4605 unsigned int options, unsigned int depth, isc_counter_t *qc, 4606 isc_counter_t *gqc, fetchctx_t *parent, fetchctx_t **fctxp) { 4607 fetchctx_t *fctx = NULL; 4608 isc_result_t result; 4609 isc_result_t iresult; 4610 isc_interval_t interval; 4611 unsigned int findoptions = 0; 4612 char buf[DNS_NAME_FORMATSIZE + DNS_RDATATYPE_FORMATSIZE + 1]; 4613 isc_mem_t *mctx = isc_loop_getmctx(loop); 4614 size_t p; 4615 uint32_t nvalidations = atomic_load_relaxed(&res->maxvalidations); 4616 uint32_t nfails = atomic_load_relaxed(&res->maxvalidationfails); 4617 4618 /* 4619 * Caller must be holding the lock for 'bucket' 4620 */ 4621 REQUIRE(fctxp != NULL && *fctxp == NULL); 4622 4623 fctx = isc_mem_get(mctx, sizeof(*fctx)); 4624 *fctx = (fetchctx_t){ 4625 .type = type, 4626 .qmintype = type, 4627 .options = options, 4628 .tid = isc_tid(), 4629 .state = fetchstate_active, 4630 .depth = depth, 4631 .qmin_labels = 1, 4632 .fwdpolicy = dns_fwdpolicy_none, 4633 .result = ISC_R_FAILURE, 4634 .loop = loop, 4635 }; 4636 4637 isc_mem_attach(mctx, &fctx->mctx); 4638 dns_resolver_attach(res, &fctx->res); 4639 4640 isc_mutex_init(&fctx->lock); 4641 4642 dns_ede_init(fctx->mctx, &fctx->edectx); 4643 4644 /* 4645 * Make fctx->info point to a copy of a formatted string 4646 * "name/type". FCTXTRACE won't work until this is done. 4647 */ 4648 dns_name_format(name, buf, sizeof(buf)); 4649 p = strlcat(buf, "/", sizeof(buf)); 4650 INSIST(p + DNS_RDATATYPE_FORMATSIZE < sizeof(buf)); 4651 dns_rdatatype_format(type, buf + p, sizeof(buf) - p); 4652 fctx->info = isc_mem_strdup(fctx->mctx, buf); 4653 4654 FCTXTRACE("create"); 4655 4656 if (nfails > 0) { 4657 isc_counter_create(mctx, nfails, &fctx->nfails); 4658 } 4659 4660 if (nvalidations > 0) { 4661 isc_counter_create(mctx, nvalidations, &fctx->nvalidations); 4662 } 4663 4664 if (qc != NULL) { 4665 isc_counter_attach(qc, &fctx->qc); 4666 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4667 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(9), 4668 "fctx %p(%s): attached to counter %p (%d)", fctx, 4669 fctx->info, fctx->qc, isc_counter_used(fctx->qc)); 4670 } else { 4671 result = isc_counter_create(fctx->mctx, res->maxqueries, 4672 &fctx->qc); 4673 if (result != ISC_R_SUCCESS) { 4674 goto cleanup_fetch; 4675 } 4676 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4677 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(9), 4678 "fctx %p(%s): created counter %p", fctx, 4679 fctx->info, fctx->qc); 4680 } 4681 4682 if (gqc != NULL) { 4683 isc_counter_attach(gqc, &fctx->gqc); 4684 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4685 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(9), 4686 "fctx %p(%s): attached to counter %p (%d)", fctx, 4687 fctx->info, fctx->gqc, 4688 isc_counter_used(fctx->gqc)); 4689 } 4690 4691 #if DNS_RESOLVER_TRACE 4692 fprintf(stderr, "fetchctx__init:%s:%s:%d:%p:%p->references = 1\n", 4693 __func__, __FILE__, __LINE__, fctx, fctx); 4694 #endif 4695 isc_refcount_init(&fctx->references, 1); 4696 4697 ISC_LIST_INIT(fctx->queries); 4698 ISC_LIST_INIT(fctx->finds); 4699 ISC_LIST_INIT(fctx->altfinds); 4700 ISC_LIST_INIT(fctx->forwaddrs); 4701 ISC_LIST_INIT(fctx->altaddrs); 4702 ISC_LIST_INIT(fctx->forwarders); 4703 ISC_LIST_INIT(fctx->bad); 4704 ISC_LIST_INIT(fctx->edns); 4705 ISC_LIST_INIT(fctx->validators); 4706 ISC_LIST_INIT(fctx->pending_finds); 4707 4708 atomic_init(&fctx->attributes, 0); 4709 4710 fctx->name = dns_fixedname_initname(&fctx->fname); 4711 fctx->nsname = dns_fixedname_initname(&fctx->nsfname); 4712 fctx->domain = dns_fixedname_initname(&fctx->dfname); 4713 fctx->qminname = dns_fixedname_initname(&fctx->qminfname); 4714 fctx->qmindcname = dns_fixedname_initname(&fctx->qmindcfname); 4715 fctx->fwdname = dns_fixedname_initname(&fctx->fwdfname); 4716 4717 dns_name_copy(name, fctx->name); 4718 dns_name_copy(name, fctx->qminname); 4719 4720 dns_rdataset_init(&fctx->nameservers); 4721 dns_rdataset_init(&fctx->qminrrset); 4722 dns_rdataset_init(&fctx->nsrrset); 4723 4724 fctx->start = isc_time_now(); 4725 fctx->now = (isc_stdtime_t)fctx->start.seconds; 4726 4727 if (parent != NULL) { 4728 fetchctx_attach(parent, &fctx->parent); 4729 } 4730 4731 if (client != NULL) { 4732 isc_sockaddr_format(client, fctx->clientstr, 4733 sizeof(fctx->clientstr)); 4734 } else { 4735 strlcpy(fctx->clientstr, "<unknown>", sizeof(fctx->clientstr)); 4736 } 4737 4738 if (domain == NULL) { 4739 dns_forwarders_t *forwarders = NULL; 4740 unsigned int labels; 4741 const dns_name_t *fwdname = name; 4742 dns_name_t suffix; 4743 4744 /* 4745 * DS records are found in the parent server. Strip one 4746 * leading label from the name (to be used in finding 4747 * the forwarder). 4748 */ 4749 if (dns_rdatatype_atparent(fctx->type) && 4750 dns_name_countlabels(name) > 1) 4751 { 4752 dns_name_init(&suffix, NULL); 4753 labels = dns_name_countlabels(name); 4754 dns_name_getlabelsequence(name, 1, labels - 1, &suffix); 4755 fwdname = &suffix; 4756 } 4757 4758 /* Find the forwarder for this name. */ 4759 result = dns_fwdtable_find(fctx->res->view->fwdtable, fwdname, 4760 &forwarders); 4761 if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { 4762 fctx->fwdpolicy = forwarders->fwdpolicy; 4763 dns_name_copy(&forwarders->name, fctx->fwdname); 4764 dns_forwarders_detach(&forwarders); 4765 } 4766 4767 if (fctx->fwdpolicy == dns_fwdpolicy_only) { 4768 /* 4769 * We're in forward-only mode. Set the query 4770 * domain. 4771 */ 4772 dns_name_copy(fctx->fwdname, fctx->domain); 4773 dns_name_copy(fctx->fwdname, fctx->qmindcname); 4774 /* 4775 * Disable query minimization 4776 */ 4777 options &= ~DNS_FETCHOPT_QMINIMIZE; 4778 } else { 4779 dns_fixedname_t dcfixed; 4780 dns_name_t *dcname = dns_fixedname_initname(&dcfixed); 4781 4782 /* 4783 * The caller didn't supply a query domain and 4784 * nameservers, and we're not in forward-only 4785 * mode, so find the best nameservers to use. 4786 */ 4787 if (dns_rdatatype_atparent(fctx->type)) { 4788 findoptions |= DNS_DBFIND_NOEXACT; 4789 } 4790 result = dns_view_findzonecut( 4791 res->view, name, fctx->fwdname, dcname, 4792 fctx->now, findoptions, true, true, 4793 &fctx->nameservers, NULL); 4794 if (result != ISC_R_SUCCESS) { 4795 goto cleanup_nameservers; 4796 } 4797 4798 dns_name_copy(fctx->fwdname, fctx->domain); 4799 dns_name_copy(dcname, fctx->qmindcname); 4800 fctx->ns_ttl = fctx->nameservers.ttl; 4801 fctx->ns_ttl_ok = true; 4802 } 4803 } else { 4804 dns_name_copy(domain, fctx->domain); 4805 dns_name_copy(domain, fctx->qmindcname); 4806 dns_rdataset_clone(nameservers, &fctx->nameservers); 4807 fctx->ns_ttl = fctx->nameservers.ttl; 4808 fctx->ns_ttl_ok = true; 4809 } 4810 4811 /* 4812 * Exempt prefetch queries from the fetches-per-zone quota check 4813 */ 4814 if ((fctx->options & DNS_FETCHOPT_PREFETCH) == 0) { 4815 /* 4816 * Are there too many simultaneous queries for this domain? 4817 */ 4818 result = fcount_incr(fctx, false); 4819 if (result != ISC_R_SUCCESS) { 4820 result = fctx->res->quotaresp[dns_quotatype_zone]; 4821 inc_stats(res, dns_resstatscounter_zonequota); 4822 goto cleanup_nameservers; 4823 } 4824 } 4825 4826 log_ns_ttl(fctx, "fctx_create"); 4827 4828 if (!dns_name_issubdomain(fctx->name, fctx->domain)) { 4829 dns_name_format(fctx->domain, buf, sizeof(buf)); 4830 UNEXPECTED_ERROR("'%s' is not subdomain of '%s'", fctx->info, 4831 buf); 4832 result = ISC_R_UNEXPECTED; 4833 goto cleanup_fcount; 4834 } 4835 4836 dns_message_create(fctx->mctx, fctx->res->namepools[fctx->tid], 4837 fctx->res->rdspools[fctx->tid], 4838 DNS_MESSAGE_INTENTRENDER, &fctx->qmessage); 4839 4840 /* 4841 * Compute an expiration time for the entire fetch. 4842 */ 4843 isc_interval_set(&interval, res->query_timeout / 1000, 4844 res->query_timeout % 1000 * 1000000); 4845 iresult = isc_time_nowplusinterval(&fctx->expires, &interval); 4846 if (iresult != ISC_R_SUCCESS) { 4847 UNEXPECTED_ERROR("isc_time_nowplusinterval: %s", 4848 isc_result_totext(iresult)); 4849 result = ISC_R_UNEXPECTED; 4850 goto cleanup_qmessage; 4851 } 4852 4853 /* 4854 * Default retry interval initialization. We set the interval 4855 * now mostly so it won't be uninitialized. It will be set to 4856 * the correct value before a query is issued. 4857 */ 4858 isc_interval_set(&fctx->interval, 2, 0); 4859 4860 /* 4861 * Attach to the view's adb, dispatchmgr and cache adb. 4862 */ 4863 dns_view_getadb(res->view, &fctx->adb); 4864 if (fctx->adb == NULL) { 4865 result = ISC_R_SHUTTINGDOWN; 4866 goto cleanup_qmessage; 4867 } 4868 fctx->dispatchmgr = dns_view_getdispatchmgr(res->view); 4869 if (fctx->dispatchmgr == NULL) { 4870 result = ISC_R_SHUTTINGDOWN; 4871 goto cleanup_adb; 4872 } 4873 dns_db_attach(res->view->cachedb, &fctx->cache); 4874 4875 ISC_LIST_INIT(fctx->resps); 4876 ISC_LINK_INIT(fctx, link); 4877 fctx->magic = FCTX_MAGIC; 4878 4879 /* 4880 * If qname minimization is enabled we need to trim 4881 * the name in fctx to proper length. 4882 */ 4883 if ((options & DNS_FETCHOPT_QMINIMIZE) != 0) { 4884 fctx->ip6arpaskip = (options & DNS_FETCHOPT_QMIN_SKIP_IP6A) != 4885 0 && 4886 dns_name_issubdomain(fctx->name, &ip6_arpa); 4887 fctx_minimize_qname(fctx); 4888 } 4889 4890 inc_stats(res, dns_resstatscounter_nfetch); 4891 4892 isc_timer_create(fctx->loop, fctx_expired, fctx, &fctx->timer); 4893 4894 *fctxp = fctx; 4895 4896 return ISC_R_SUCCESS; 4897 4898 cleanup_adb: 4899 dns_adb_detach(&fctx->adb); 4900 4901 cleanup_qmessage: 4902 dns_message_detach(&fctx->qmessage); 4903 4904 cleanup_fcount: 4905 fcount_decr(fctx); 4906 4907 cleanup_nameservers: 4908 if (dns_rdataset_isassociated(&fctx->nameservers)) { 4909 dns_rdataset_disassociate(&fctx->nameservers); 4910 } 4911 isc_mem_free(fctx->mctx, fctx->info); 4912 if (fctx->nfails != NULL) { 4913 isc_counter_detach(&fctx->nfails); 4914 } 4915 if (fctx->nvalidations != NULL) { 4916 isc_counter_detach(&fctx->nvalidations); 4917 } 4918 isc_counter_detach(&fctx->qc); 4919 if (fctx->gqc != NULL) { 4920 isc_counter_detach(&fctx->gqc); 4921 } 4922 if (fctx->parent != NULL) { 4923 fetchctx_detach(&fctx->parent); 4924 } 4925 4926 cleanup_fetch: 4927 4928 dns_ede_invalidate(&fctx->edectx); 4929 isc_mutex_destroy(&fctx->lock); 4930 dns_resolver_detach(&fctx->res); 4931 isc_mem_putanddetach(&fctx->mctx, fctx, sizeof(*fctx)); 4932 4933 return result; 4934 } 4935 4936 /* 4937 * Handle Responses 4938 */ 4939 static bool 4940 is_lame(fetchctx_t *fctx, dns_message_t *message) { 4941 dns_name_t *name; 4942 dns_rdataset_t *rdataset; 4943 isc_result_t result; 4944 4945 if (message->rcode != dns_rcode_noerror && 4946 message->rcode != dns_rcode_yxdomain && 4947 message->rcode != dns_rcode_nxdomain) 4948 { 4949 return false; 4950 } 4951 4952 if (message->counts[DNS_SECTION_ANSWER] != 0) { 4953 return false; 4954 } 4955 4956 if (message->counts[DNS_SECTION_AUTHORITY] == 0) { 4957 return false; 4958 } 4959 4960 result = dns_message_firstname(message, DNS_SECTION_AUTHORITY); 4961 while (result == ISC_R_SUCCESS) { 4962 name = NULL; 4963 dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name); 4964 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 4965 rdataset = ISC_LIST_NEXT(rdataset, link)) 4966 { 4967 dns_namereln_t namereln; 4968 int order; 4969 unsigned int labels; 4970 if (rdataset->type != dns_rdatatype_ns) { 4971 continue; 4972 } 4973 namereln = dns_name_fullcompare(name, fctx->domain, 4974 &order, &labels); 4975 if (namereln == dns_namereln_equal && 4976 (message->flags & DNS_MESSAGEFLAG_AA) != 0) 4977 { 4978 return false; 4979 } 4980 if (namereln == dns_namereln_subdomain) { 4981 return false; 4982 } 4983 return true; 4984 } 4985 result = dns_message_nextname(message, DNS_SECTION_AUTHORITY); 4986 } 4987 4988 return false; 4989 } 4990 4991 static void 4992 log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) { 4993 char namebuf[DNS_NAME_FORMATSIZE]; 4994 char domainbuf[DNS_NAME_FORMATSIZE]; 4995 char addrbuf[ISC_SOCKADDR_FORMATSIZE]; 4996 4997 dns_name_format(fctx->name, namebuf, sizeof(namebuf)); 4998 dns_name_format(fctx->domain, domainbuf, sizeof(domainbuf)); 4999 isc_sockaddr_format(&addrinfo->sockaddr, addrbuf, sizeof(addrbuf)); 5000 isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS, 5001 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 5002 "lame server resolving '%s' (in '%s'?): %s", namebuf, 5003 domainbuf, addrbuf); 5004 } 5005 5006 static void 5007 log_formerr(fetchctx_t *fctx, const char *format, ...) { 5008 char nsbuf[ISC_SOCKADDR_FORMATSIZE]; 5009 char msgbuf[2048]; 5010 va_list args; 5011 5012 va_start(args, format); 5013 vsnprintf(msgbuf, sizeof(msgbuf), format, args); 5014 va_end(args); 5015 5016 isc_sockaddr_format(&fctx->addrinfo->sockaddr, nsbuf, sizeof(nsbuf)); 5017 5018 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 5019 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 5020 "DNS format error from %s resolving %s for %s: %s", nsbuf, 5021 fctx->info, fctx->clientstr, msgbuf); 5022 } 5023 5024 static isc_result_t 5025 same_question(fetchctx_t *fctx, dns_message_t *message) { 5026 isc_result_t result; 5027 dns_name_t *name = NULL; 5028 dns_rdataset_t *rdataset = NULL; 5029 5030 /* 5031 * Caller must be holding the fctx lock. 5032 */ 5033 5034 /* 5035 * XXXRTH Currently we support only one question. 5036 */ 5037 if (message->counts[DNS_SECTION_QUESTION] == 0) { 5038 if ((message->flags & DNS_MESSAGEFLAG_TC) != 0) { 5039 /* 5040 * If TC=1 and the question section is empty, we 5041 * accept the reply message as a truncated 5042 * answer, to be retried over TCP. 5043 * 5044 * It is really a FORMERR condition, but this is 5045 * a workaround to accept replies from some 5046 * implementations. 5047 * 5048 * Because the question section matching is not 5049 * performed, the worst that could happen is 5050 * that an attacker who gets past the ID and 5051 * source port checks can force the use of 5052 * TCP. This is considered an acceptable risk. 5053 */ 5054 log_formerr(fctx, "empty question section, " 5055 "accepting it anyway as TC=1"); 5056 return ISC_R_SUCCESS; 5057 } else { 5058 log_formerr(fctx, "empty question section"); 5059 return DNS_R_FORMERR; 5060 } 5061 } else if (message->counts[DNS_SECTION_QUESTION] > 1) { 5062 log_formerr(fctx, "too many questions"); 5063 return DNS_R_FORMERR; 5064 } 5065 5066 result = dns_message_firstname(message, DNS_SECTION_QUESTION); 5067 if (result != ISC_R_SUCCESS) { 5068 return result; 5069 } 5070 5071 dns_message_currentname(message, DNS_SECTION_QUESTION, &name); 5072 rdataset = ISC_LIST_HEAD(name->list); 5073 INSIST(rdataset != NULL); 5074 INSIST(ISC_LIST_NEXT(rdataset, link) == NULL); 5075 5076 if (fctx->type != rdataset->type || 5077 fctx->res->rdclass != rdataset->rdclass || 5078 !dns_name_equal(fctx->name, name)) 5079 { 5080 char namebuf[DNS_NAME_FORMATSIZE]; 5081 char classbuf[DNS_RDATACLASS_FORMATSIZE]; 5082 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 5083 5084 dns_name_format(name, namebuf, sizeof(namebuf)); 5085 dns_rdataclass_format(rdataset->rdclass, classbuf, 5086 sizeof(classbuf)); 5087 dns_rdatatype_format(rdataset->type, typebuf, sizeof(typebuf)); 5088 log_formerr(fctx, "question section mismatch: got %s/%s/%s", 5089 namebuf, classbuf, typebuf); 5090 return DNS_R_FORMERR; 5091 } 5092 5093 return ISC_R_SUCCESS; 5094 } 5095 5096 static void 5097 clone_results(fetchctx_t *fctx) { 5098 dns_fetchresponse_t *resp = NULL, *hresp = NULL; 5099 5100 FCTXTRACE("clone_results"); 5101 5102 /* 5103 * Set up any other resps to have the same data as the first. 5104 * 5105 * Caller must be holding the appropriate lock. 5106 */ 5107 5108 fctx->cloned = true; 5109 5110 for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL; 5111 resp = ISC_LIST_NEXT(resp, link)) 5112 { 5113 /* This is the head resp; keep a pointer and move on */ 5114 if (hresp == NULL) { 5115 hresp = ISC_LIST_HEAD(fctx->resps); 5116 FCTXTRACEN("clone_results", hresp->foundname, 5117 hresp->result); 5118 continue; 5119 } 5120 5121 resp->result = hresp->result; 5122 dns_name_copy(hresp->foundname, resp->foundname); 5123 dns_db_attach(hresp->db, &resp->db); 5124 dns_db_attachnode(hresp->db, hresp->node, &resp->node); 5125 5126 INSIST(hresp->rdataset != NULL); 5127 INSIST(resp->rdataset != NULL); 5128 if (dns_rdataset_isassociated(hresp->rdataset)) { 5129 dns_rdataset_clone(hresp->rdataset, resp->rdataset); 5130 } 5131 5132 INSIST(!(hresp->sigrdataset == NULL && 5133 resp->sigrdataset != NULL)); 5134 if (hresp->sigrdataset != NULL && 5135 dns_rdataset_isassociated(hresp->sigrdataset) && 5136 resp->sigrdataset != NULL) 5137 { 5138 dns_rdataset_clone(hresp->sigrdataset, 5139 resp->sigrdataset); 5140 } 5141 } 5142 } 5143 5144 #define CACHE(r) (((r)->attributes & DNS_RDATASETATTR_CACHE) != 0) 5145 #define ANSWER(r) (((r)->attributes & DNS_RDATASETATTR_ANSWER) != 0) 5146 #define ANSWERSIG(r) (((r)->attributes & DNS_RDATASETATTR_ANSWERSIG) != 0) 5147 #define EXTERNAL(r) (((r)->attributes & DNS_RDATASETATTR_EXTERNAL) != 0) 5148 #define CHAINING(r) (((r)->attributes & DNS_RDATASETATTR_CHAINING) != 0) 5149 #define CHASE(r) (((r)->attributes & DNS_RDATASETATTR_CHASE) != 0) 5150 #define CHECKNAMES(r) (((r)->attributes & DNS_RDATASETATTR_CHECKNAMES) != 0) 5151 5152 /* 5153 * typemap with just RRSIG(46) and NSEC(47) bits set. 5154 * 5155 * Bitmap calculation from dns_nsec_setbit: 5156 * 5157 * 46 47 5158 * shift = 7 - (type % 8); 0 1 5159 * mask = 1 << shift; 0x02 0x01 5160 * array[type / 8] |= mask; 5161 * 5162 * Window (0), bitmap length (6), and bitmap. 5163 */ 5164 static const unsigned char minimal_typemap[] = { 0, 6, 0, 0, 0, 0, 0, 0x03 }; 5165 5166 static bool 5167 is_minimal_nsec(dns_rdataset_t *nsecset) { 5168 dns_rdataset_t rdataset; 5169 isc_result_t result; 5170 5171 dns_rdataset_init(&rdataset); 5172 dns_rdataset_clone(nsecset, &rdataset); 5173 5174 for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS; 5175 result = dns_rdataset_next(&rdataset)) 5176 { 5177 dns_rdata_t rdata = DNS_RDATA_INIT; 5178 dns_rdata_nsec_t nsec; 5179 dns_rdataset_current(&rdataset, &rdata); 5180 result = dns_rdata_tostruct(&rdata, &nsec, NULL); 5181 RUNTIME_CHECK(result == ISC_R_SUCCESS); 5182 if (nsec.len == sizeof(minimal_typemap) && 5183 memcmp(nsec.typebits, minimal_typemap, nsec.len) == 0) 5184 { 5185 dns_rdataset_disassociate(&rdataset); 5186 return true; 5187 } 5188 } 5189 dns_rdataset_disassociate(&rdataset); 5190 return false; 5191 } 5192 5193 /* 5194 * If there is a SOA record in the type map then there must be a DNSKEY. 5195 */ 5196 static bool 5197 check_soa_and_dnskey(dns_rdataset_t *nsecset) { 5198 dns_rdataset_t rdataset; 5199 isc_result_t result; 5200 5201 dns_rdataset_init(&rdataset); 5202 dns_rdataset_clone(nsecset, &rdataset); 5203 5204 for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS; 5205 result = dns_rdataset_next(&rdataset)) 5206 { 5207 dns_rdata_t rdata = DNS_RDATA_INIT; 5208 dns_rdataset_current(&rdataset, &rdata); 5209 if (dns_nsec_typepresent(&rdata, dns_rdatatype_soa) && 5210 (!dns_nsec_typepresent(&rdata, dns_rdatatype_dnskey) || 5211 !dns_nsec_typepresent(&rdata, dns_rdatatype_ns))) 5212 { 5213 dns_rdataset_disassociate(&rdataset); 5214 return false; 5215 } 5216 } 5217 dns_rdataset_disassociate(&rdataset); 5218 return true; 5219 } 5220 5221 /* 5222 * Look for NSEC next name that starts with the label '\000'. 5223 */ 5224 static bool 5225 has_000_label(dns_rdataset_t *nsecset) { 5226 dns_rdataset_t rdataset; 5227 isc_result_t result; 5228 5229 dns_rdataset_init(&rdataset); 5230 dns_rdataset_clone(nsecset, &rdataset); 5231 5232 for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS; 5233 result = dns_rdataset_next(&rdataset)) 5234 { 5235 dns_rdata_t rdata = DNS_RDATA_INIT; 5236 dns_rdataset_current(&rdataset, &rdata); 5237 if (rdata.length > 1 && rdata.data[0] == 1 && 5238 rdata.data[1] == 0) 5239 { 5240 dns_rdataset_disassociate(&rdataset); 5241 return true; 5242 } 5243 } 5244 dns_rdataset_disassociate(&rdataset); 5245 return false; 5246 } 5247 5248 static void 5249 delete_rrset(fetchctx_t *fctx, dns_dbnode_t *node, dns_rdatatype_t type) { 5250 dns_db_deleterdataset(fctx->cache, node, NULL, type, 0); 5251 dns_db_deleterdataset(fctx->cache, node, NULL, dns_rdatatype_rrsig, 5252 type); 5253 } 5254 5255 /*% 5256 * Returns true if the rdataset is of type 'type', or type RRSIG 5257 * and covers 'type'. 5258 */ 5259 static inline bool 5260 dns_rdataset_matchestype(const dns_rdataset_t *rdataset, 5261 const dns_rdatatype_t type) { 5262 REQUIRE(DNS_RDATASET_VALID(rdataset)); 5263 5264 return rdataset->type == type || 5265 (rdataset->type == dns_rdatatype_rrsig && 5266 rdataset->covers == type); 5267 } 5268 5269 /* 5270 * When caching a CNAME, evict other RRsets at the same owner name, 5271 * according to the RFC specifications. 5272 * 5273 * RFC 1034, 3.6.2: Aliases and canonical names 5274 * If a CNAME RR is present at a node, no other data should be 5275 * present. 5276 * RFC 2181, 10.1: CNAME resource records 5277 * An alias name (label of a CNAME record) may, 5278 * if DNSSEC is in use, have SIG, NXT, and KEY RRs, but may have no 5279 * other data. 5280 * RFC 2535, 2.3.5: Special Considerations with CNAME 5281 * RFC 4034, 3: The RRSIG Resource Record 5282 * Because every authoritative RRset in a zone must be protected by a 5283 * digital signature, RRSIG RRs must be present for names containing a 5284 * CNAME RR. This is a change to the traditional DNS specification 5285 * [RFC1034], which stated that if a CNAME is present for a name, it is 5286 * the only type allowed at that name. 5287 * RFC 4034, 4: The NSEC Resource Record 5288 * Because every authoritative name in a zone must be part of the NSEC 5289 * chain, NSEC RRs must be present for names containing a CNAME RR. 5290 * This is a change to the traditional DNS specification [RFC1034], 5291 * which stated that if a CNAME is present for a name, it is the only 5292 * type allowed at that name. 5293 * 5294 * So types allowed next to CNAME are: KEY, SIG, NXT, RRSIG, and NSEC. 5295 */ 5296 static void 5297 evict_cname_other(fetchctx_t *fctx, dns_dbnode_t *node) { 5298 isc_result_t result; 5299 dns_rdatasetiter_t *rdsiter = NULL; 5300 5301 result = dns_db_allrdatasets(fctx->cache, node, NULL, DNS_DB_STALEOK, 0, 5302 &rdsiter); 5303 if (result != ISC_R_SUCCESS) { 5304 return; 5305 } 5306 5307 result = dns_rdatasetiter_first(rdsiter); 5308 while (result == ISC_R_SUCCESS) { 5309 dns_rdataset_t rdataset = DNS_RDATASET_INIT; 5310 dns_rdatasetiter_current(rdsiter, &rdataset); 5311 5312 if (NEGATIVE(&rdataset)) { 5313 /* Keep all negative entries */ 5314 dns_rdataset_disassociate(&rdataset); 5315 result = dns_rdatasetiter_next(rdsiter); 5316 continue; 5317 } 5318 5319 /* KEY, NSEC and NXT records are allowed */ 5320 if (dns_rdataset_matchestype(&rdataset, dns_rdatatype_key) || 5321 dns_rdataset_matchestype(&rdataset, dns_rdatatype_nsec) || 5322 dns_rdataset_matchestype(&rdataset, dns_rdatatype_nxt)) 5323 { 5324 dns_rdataset_disassociate(&rdataset); 5325 result = dns_rdatasetiter_next(rdsiter); 5326 continue; 5327 } 5328 5329 dns_db_deleterdataset(fctx->cache, node, NULL, rdataset.type, 5330 rdataset.covers); 5331 5332 dns_rdataset_disassociate(&rdataset); 5333 result = dns_rdatasetiter_next(rdsiter); 5334 } 5335 5336 dns_rdatasetiter_destroy(&rdsiter); 5337 } 5338 5339 /* 5340 * The validator has finished. 5341 */ 5342 static void 5343 validated(void *arg) { 5344 dns_validator_t *val = (dns_validator_t *)arg; 5345 dns_adbaddrinfo_t *addrinfo = NULL; 5346 dns_dbnode_t *node = NULL; 5347 dns_dbnode_t *nsnode = NULL; 5348 dns_fetchresponse_t *hresp = NULL; 5349 dns_name_t *name = NULL; 5350 dns_rdataset_t *ardataset = NULL; 5351 dns_rdataset_t *asigrdataset = NULL; 5352 dns_rdataset_t *rdataset = NULL; 5353 dns_rdataset_t *sigrdataset = NULL; 5354 dns_resolver_t *res = NULL; 5355 dns_valarg_t *valarg = NULL; 5356 fetchctx_t *fctx = NULL; 5357 bool chaining; 5358 bool negative; 5359 bool sentresponse; 5360 isc_result_t eresult = ISC_R_SUCCESS; 5361 isc_result_t result = ISC_R_SUCCESS; 5362 isc_stdtime_t now; 5363 uint32_t ttl; 5364 unsigned int options; 5365 dns_fixedname_t fwild; 5366 dns_name_t *wild = NULL; 5367 dns_message_t *message = NULL; 5368 bool done = false; 5369 5370 valarg = val->arg; 5371 5372 REQUIRE(VALID_FCTX(valarg->fctx)); 5373 REQUIRE(!ISC_LIST_EMPTY(valarg->fctx->validators)); 5374 5375 fctx = valarg->fctx; 5376 valarg->fctx = NULL; 5377 5378 REQUIRE(fctx->tid == isc_tid()); 5379 5380 FCTXTRACE("received validation completion event"); 5381 5382 res = fctx->res; 5383 addrinfo = valarg->addrinfo; 5384 5385 message = val->message; 5386 5387 LOCK(&fctx->lock); 5388 fctx->vresult = val->result; 5389 ISC_LIST_UNLINK(fctx->validators, val, link); 5390 fctx->validator = NULL; 5391 UNLOCK(&fctx->lock); 5392 5393 /* 5394 * Destroy the validator early so that we can 5395 * destroy the fctx if necessary. Save the wildcard name. 5396 */ 5397 if (val->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL) { 5398 wild = dns_fixedname_initname(&fwild); 5399 dns_name_copy(dns_fixedname_name(&val->wild), wild); 5400 } 5401 5402 isc_mem_put(fctx->mctx, valarg, sizeof(*valarg)); 5403 5404 negative = (val->rdataset == NULL); 5405 5406 LOCK(&fctx->lock); 5407 sentresponse = ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0); 5408 5409 /* 5410 * If shutting down, ignore the results. Check to see if we're 5411 * done waiting for validator completions and ADB pending 5412 * events; if so, destroy the fctx. 5413 */ 5414 if (SHUTTINGDOWN(fctx) && !sentresponse) { 5415 UNLOCK(&fctx->lock); 5416 goto cleanup_fetchctx; 5417 } 5418 5419 now = isc_stdtime_now(); 5420 5421 /* 5422 * If chaining, we need to make sure that the right result code 5423 * is returned, and that the rdatasets are bound. 5424 */ 5425 if (val->result == ISC_R_SUCCESS && !negative && 5426 val->rdataset != NULL && CHAINING(val->rdataset)) 5427 { 5428 if (val->rdataset->type == dns_rdatatype_cname) { 5429 eresult = DNS_R_CNAME; 5430 } else { 5431 INSIST(val->rdataset->type == dns_rdatatype_dname); 5432 eresult = DNS_R_DNAME; 5433 } 5434 chaining = true; 5435 } else { 5436 chaining = false; 5437 } 5438 5439 /* 5440 * Either we're not shutting down, or we are shutting down but 5441 * want to cache the result anyway (if this was a validation 5442 * started by a query with cd set) 5443 */ 5444 5445 hresp = ISC_LIST_HEAD(fctx->resps); 5446 if (hresp != NULL) { 5447 if (!negative && !chaining && 5448 (fctx->type == dns_rdatatype_any || 5449 fctx->type == dns_rdatatype_rrsig || 5450 fctx->type == dns_rdatatype_sig)) 5451 { 5452 /* 5453 * Don't bind rdatasets; the caller 5454 * will iterate the node. 5455 */ 5456 } else { 5457 ardataset = hresp->rdataset; 5458 asigrdataset = hresp->sigrdataset; 5459 } 5460 } 5461 5462 if (val->result != ISC_R_SUCCESS) { 5463 FCTXTRACE("validation failed"); 5464 inc_stats(res, dns_resstatscounter_valfail); 5465 fctx->valfail++; 5466 fctx->vresult = val->result; 5467 if (fctx->vresult != DNS_R_BROKENCHAIN) { 5468 result = ISC_R_NOTFOUND; 5469 if (val->rdataset != NULL) { 5470 result = dns_db_findnode(fctx->cache, val->name, 5471 false, &node); 5472 } 5473 if (result == ISC_R_SUCCESS) { 5474 (void)dns_db_deleterdataset(fctx->cache, node, 5475 NULL, val->type, 0); 5476 } 5477 if (result == ISC_R_SUCCESS && val->sigrdataset != NULL) 5478 { 5479 (void)dns_db_deleterdataset( 5480 fctx->cache, node, NULL, 5481 dns_rdatatype_rrsig, val->type); 5482 } 5483 if (result == ISC_R_SUCCESS) { 5484 dns_db_detachnode(fctx->cache, &node); 5485 } 5486 } 5487 if (fctx->vresult == DNS_R_BROKENCHAIN && !negative) { 5488 /* 5489 * Cache the data as pending for later 5490 * validation. 5491 */ 5492 result = ISC_R_NOTFOUND; 5493 if (val->rdataset != NULL) { 5494 result = dns_db_findnode(fctx->cache, val->name, 5495 true, &node); 5496 } 5497 if (result == ISC_R_SUCCESS) { 5498 (void)dns_db_addrdataset( 5499 fctx->cache, node, NULL, now, 5500 val->rdataset, 0, NULL); 5501 } 5502 if (result == ISC_R_SUCCESS && val->sigrdataset != NULL) 5503 { 5504 (void)dns_db_addrdataset( 5505 fctx->cache, node, NULL, now, 5506 val->sigrdataset, 0, NULL); 5507 } 5508 if (result == ISC_R_SUCCESS) { 5509 dns_db_detachnode(fctx->cache, &node); 5510 } 5511 } 5512 result = fctx->vresult; 5513 add_bad(fctx, message, addrinfo, result, badns_validation); 5514 5515 UNLOCK(&fctx->lock); 5516 5517 INSIST(fctx->validator == NULL); 5518 5519 fctx->validator = ISC_LIST_HEAD(fctx->validators); 5520 if (fctx->validator != NULL) { 5521 dns_validator_send(fctx->validator); 5522 goto cleanup_fetchctx; 5523 } else if (sentresponse) { 5524 done = true; 5525 goto cleanup_fetchctx; 5526 } else if (result == DNS_R_BROKENCHAIN) { 5527 done = true; 5528 goto cleanup_fetchctx; 5529 } else { 5530 fctx_try(fctx, true); 5531 goto cleanup_fetchctx; 5532 } 5533 UNREACHABLE(); 5534 } 5535 5536 if (negative) { 5537 dns_rdatatype_t covers; 5538 FCTXTRACE("nonexistence validation OK"); 5539 5540 inc_stats(res, dns_resstatscounter_valnegsuccess); 5541 5542 /* 5543 * Cache DS NXDOMAIN separately to other types. 5544 */ 5545 if (message->rcode == dns_rcode_nxdomain && 5546 fctx->type != dns_rdatatype_ds) 5547 { 5548 covers = dns_rdatatype_any; 5549 } else { 5550 covers = fctx->type; 5551 } 5552 5553 /* 5554 * Don't report qname minimisation NXDOMAIN errors 5555 * when the result is NXDOMAIN except we have already 5556 * confirmed a higher error. 5557 */ 5558 if (!fctx->force_qmin_warning && 5559 message->rcode == dns_rcode_nxdomain && 5560 (fctx->qmin_warning == DNS_R_NXDOMAIN || 5561 fctx->qmin_warning == DNS_R_NCACHENXDOMAIN)) 5562 { 5563 fctx->qmin_warning = ISC_R_SUCCESS; 5564 } 5565 5566 result = dns_db_findnode(fctx->cache, val->name, true, &node); 5567 if (result != ISC_R_SUCCESS) { 5568 /* fctx->lock unlocked in noanswer_response */ 5569 goto noanswer_response; 5570 } 5571 5572 /* 5573 * If we are asking for a SOA record set the cache time 5574 * to zero to facilitate locating the containing zone of 5575 * a arbitrary zone. 5576 */ 5577 ttl = res->view->maxncachettl; 5578 if (fctx->type == dns_rdatatype_soa && 5579 covers == dns_rdatatype_any && res->zero_no_soa_ttl) 5580 { 5581 ttl = 0; 5582 } 5583 5584 result = ncache_adderesult(message, fctx->cache, node, covers, 5585 now, fctx->res->view->minncachettl, 5586 ttl, val->optout, val->secure, 5587 ardataset, &eresult); 5588 if (result != ISC_R_SUCCESS) { 5589 goto noanswer_response; 5590 } 5591 goto answer_response; 5592 } else { 5593 inc_stats(res, dns_resstatscounter_valsuccess); 5594 } 5595 5596 FCTXTRACE("validation OK"); 5597 5598 if (val->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL) { 5599 result = dns_rdataset_addnoqname( 5600 val->rdataset, val->proofs[DNS_VALIDATOR_NOQNAMEPROOF]); 5601 RUNTIME_CHECK(result == ISC_R_SUCCESS); 5602 INSIST(val->sigrdataset != NULL); 5603 val->sigrdataset->ttl = val->rdataset->ttl; 5604 if (val->proofs[DNS_VALIDATOR_CLOSESTENCLOSER] != NULL) { 5605 result = dns_rdataset_addclosest( 5606 val->rdataset, 5607 val->proofs[DNS_VALIDATOR_CLOSESTENCLOSER]); 5608 RUNTIME_CHECK(result == ISC_R_SUCCESS); 5609 } 5610 } else if (val->rdataset->trust == dns_trust_answer && 5611 val->rdataset->type != dns_rdatatype_rrsig) 5612 { 5613 isc_result_t tresult; 5614 dns_name_t *noqname = NULL; 5615 tresult = findnoqname(fctx, message, val->name, 5616 val->rdataset->type, &noqname); 5617 if (tresult == ISC_R_SUCCESS && noqname != NULL) { 5618 tresult = dns_rdataset_addnoqname(val->rdataset, 5619 noqname); 5620 RUNTIME_CHECK(tresult == ISC_R_SUCCESS); 5621 } 5622 } 5623 5624 /* 5625 * The data was already cached as pending data. 5626 * Re-cache it as secure and bind the cached 5627 * rdatasets to the first event on the fetch 5628 * event list. 5629 */ 5630 result = dns_db_findnode(fctx->cache, val->name, true, &node); 5631 if (result != ISC_R_SUCCESS) { 5632 goto noanswer_response; 5633 } 5634 5635 options = 0; 5636 if ((fctx->options & DNS_FETCHOPT_PREFETCH) != 0) { 5637 options = DNS_DBADD_PREFETCH; 5638 } 5639 result = dns_db_addrdataset(fctx->cache, node, NULL, now, val->rdataset, 5640 options, ardataset); 5641 if (result != ISC_R_SUCCESS && result != DNS_R_UNCHANGED) { 5642 goto noanswer_response; 5643 } 5644 if (ardataset != NULL && NEGATIVE(ardataset)) { 5645 if (NXDOMAIN(ardataset)) { 5646 eresult = DNS_R_NCACHENXDOMAIN; 5647 } else { 5648 eresult = DNS_R_NCACHENXRRSET; 5649 } 5650 } else if (val->sigrdataset != NULL) { 5651 result = dns_db_addrdataset(fctx->cache, node, NULL, now, 5652 val->sigrdataset, options, 5653 asigrdataset); 5654 if (result != ISC_R_SUCCESS && result != DNS_R_UNCHANGED) { 5655 goto noanswer_response; 5656 } 5657 } 5658 5659 if (sentresponse) { 5660 /* 5661 * If we only deferred the destroy because we wanted to 5662 * cache the data, destroy now. 5663 */ 5664 dns_db_detachnode(fctx->cache, &node); 5665 if (SHUTTINGDOWN(fctx)) { 5666 dns_validator_t *validator = NULL; 5667 for (validator = ISC_LIST_HEAD(fctx->validators); 5668 validator != NULL; 5669 validator = ISC_LIST_NEXT(validator, link)) 5670 { 5671 dns_validator_cancel(validator); 5672 } 5673 } 5674 UNLOCK(&fctx->lock); 5675 goto cleanup_fetchctx; 5676 } 5677 5678 if (!ISC_LIST_EMPTY(fctx->validators)) { 5679 INSIST(!negative); 5680 INSIST(fctx->type == dns_rdatatype_any || 5681 fctx->type == dns_rdatatype_rrsig || 5682 fctx->type == dns_rdatatype_sig); 5683 /* 5684 * Don't send a response yet - we have 5685 * more rdatasets that still need to 5686 * be validated. 5687 */ 5688 dns_db_detachnode(fctx->cache, &node); 5689 UNLOCK(&fctx->lock); 5690 dns_validator_send(ISC_LIST_HEAD(fctx->validators)); 5691 goto cleanup_fetchctx; 5692 } 5693 5694 answer_response: 5695 5696 /* 5697 * Cache any SOA/NS/NSEC records that happened to be validated. 5698 */ 5699 result = dns_message_firstname(message, DNS_SECTION_AUTHORITY); 5700 while (result == ISC_R_SUCCESS) { 5701 name = NULL; 5702 dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name); 5703 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 5704 rdataset = ISC_LIST_NEXT(rdataset, link)) 5705 { 5706 if ((rdataset->type != dns_rdatatype_ns && 5707 rdataset->type != dns_rdatatype_soa && 5708 rdataset->type != dns_rdatatype_nsec) || 5709 rdataset->trust != dns_trust_secure) 5710 { 5711 continue; 5712 } 5713 for (sigrdataset = ISC_LIST_HEAD(name->list); 5714 sigrdataset != NULL; 5715 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 5716 { 5717 if (sigrdataset->type != dns_rdatatype_rrsig || 5718 sigrdataset->covers != rdataset->type) 5719 { 5720 continue; 5721 } 5722 break; 5723 } 5724 if (sigrdataset == NULL || 5725 sigrdataset->trust != dns_trust_secure) 5726 { 5727 continue; 5728 } 5729 5730 /* 5731 * Don't cache NSEC if missing NSEC or RRSIG types. 5732 */ 5733 if (rdataset->type == dns_rdatatype_nsec && 5734 !dns_nsec_requiredtypespresent(rdataset)) 5735 { 5736 continue; 5737 } 5738 5739 /* 5740 * Don't cache "white lies" but do cache 5741 * "black lies". 5742 */ 5743 if (rdataset->type == dns_rdatatype_nsec && 5744 !dns_name_equal(fctx->name, name) && 5745 is_minimal_nsec(rdataset)) 5746 { 5747 continue; 5748 } 5749 5750 /* 5751 * Check SOA and DNSKEY consistency. 5752 */ 5753 if (rdataset->type == dns_rdatatype_nsec && 5754 !check_soa_and_dnskey(rdataset)) 5755 { 5756 continue; 5757 } 5758 5759 /* 5760 * Look for \000 label in next name. 5761 */ 5762 if (rdataset->type == dns_rdatatype_nsec && 5763 has_000_label(rdataset)) 5764 { 5765 continue; 5766 } 5767 5768 result = dns_db_findnode(fctx->cache, name, true, 5769 &nsnode); 5770 if (result != ISC_R_SUCCESS) { 5771 continue; 5772 } 5773 5774 result = dns_db_addrdataset(fctx->cache, nsnode, NULL, 5775 now, rdataset, 0, NULL); 5776 if (result == ISC_R_SUCCESS) { 5777 result = dns_db_addrdataset( 5778 fctx->cache, nsnode, NULL, now, 5779 sigrdataset, 0, NULL); 5780 } 5781 dns_db_detachnode(fctx->cache, &nsnode); 5782 if (result != ISC_R_SUCCESS) { 5783 continue; 5784 } 5785 } 5786 result = dns_message_nextname(message, DNS_SECTION_AUTHORITY); 5787 } 5788 5789 /* 5790 * Add the wild card entry. 5791 */ 5792 if (val->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL && 5793 val->rdataset != NULL && dns_rdataset_isassociated(val->rdataset) && 5794 val->rdataset->trust == dns_trust_secure && 5795 val->sigrdataset != NULL && 5796 dns_rdataset_isassociated(val->sigrdataset) && 5797 val->sigrdataset->trust == dns_trust_secure && wild != NULL) 5798 { 5799 dns_dbnode_t *wnode = NULL; 5800 5801 result = dns_db_findnode(fctx->cache, wild, true, &wnode); 5802 if (result == ISC_R_SUCCESS) { 5803 result = dns_db_addrdataset(fctx->cache, wnode, NULL, 5804 now, val->rdataset, 0, 5805 NULL); 5806 } 5807 if (result == ISC_R_SUCCESS) { 5808 (void)dns_db_addrdataset(fctx->cache, wnode, NULL, now, 5809 val->sigrdataset, 0, NULL); 5810 } 5811 if (wnode != NULL) { 5812 dns_db_detachnode(fctx->cache, &wnode); 5813 } 5814 } 5815 5816 result = ISC_R_SUCCESS; 5817 5818 /* 5819 * Respond with an answer, positive or negative, 5820 * as opposed to an error. 'node' must be non-NULL. 5821 */ 5822 5823 FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER); 5824 5825 if (hresp != NULL) { 5826 /* 5827 * Negative results must be indicated in val->result. 5828 */ 5829 INSIST(hresp->rdataset != NULL); 5830 if (dns_rdataset_isassociated(hresp->rdataset)) { 5831 if (NEGATIVE(hresp->rdataset)) { 5832 INSIST(eresult == DNS_R_NCACHENXDOMAIN || 5833 eresult == DNS_R_NCACHENXRRSET); 5834 } else if (eresult == ISC_R_SUCCESS && 5835 hresp->rdataset->type != fctx->type) 5836 { 5837 switch (hresp->rdataset->type) { 5838 case dns_rdatatype_cname: 5839 eresult = DNS_R_CNAME; 5840 break; 5841 case dns_rdatatype_dname: 5842 eresult = DNS_R_DNAME; 5843 break; 5844 default: 5845 break; 5846 } 5847 } 5848 } 5849 5850 hresp->result = eresult; 5851 dns_name_copy(val->name, hresp->foundname); 5852 dns_db_attach(fctx->cache, &hresp->db); 5853 dns_db_transfernode(fctx->cache, &node, &hresp->node); 5854 clone_results(fctx); 5855 } 5856 5857 noanswer_response: 5858 if (node != NULL) { 5859 dns_db_detachnode(fctx->cache, &node); 5860 } 5861 5862 UNLOCK(&fctx->lock); 5863 done = true; 5864 5865 cleanup_fetchctx: 5866 if (done) { 5867 fctx_done_unref(fctx, result); 5868 } 5869 5870 /* 5871 * val->name points to name on a message on one of the 5872 * queries on the fetch context so the name has to be 5873 * released first with a dns_validator_shutdown() call. 5874 */ 5875 dns_validator_shutdown(val); 5876 dns_validator_detach(&val); 5877 fetchctx_detach(&fctx); 5878 INSIST(node == NULL); 5879 } 5880 5881 static void 5882 fctx_log(void *arg, int level, const char *fmt, ...) { 5883 char msgbuf[2048]; 5884 va_list args; 5885 fetchctx_t *fctx = arg; 5886 5887 va_start(args, fmt); 5888 vsnprintf(msgbuf, sizeof(msgbuf), fmt, args); 5889 va_end(args); 5890 5891 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 5892 DNS_LOGMODULE_RESOLVER, level, "fctx %p(%s): %s", fctx, 5893 fctx->info, msgbuf); 5894 } 5895 5896 static isc_result_t 5897 findnoqname(fetchctx_t *fctx, dns_message_t *message, dns_name_t *name, 5898 dns_rdatatype_t type, dns_name_t **noqnamep) { 5899 dns_rdataset_t *nrdataset, *next, *sigrdataset; 5900 dns_rdata_rrsig_t rrsig; 5901 isc_result_t result; 5902 unsigned int labels; 5903 dns_section_t section; 5904 dns_name_t *zonename; 5905 dns_fixedname_t fzonename; 5906 dns_name_t *closest; 5907 dns_fixedname_t fclosest; 5908 dns_name_t *nearest; 5909 dns_fixedname_t fnearest; 5910 dns_rdatatype_t found = dns_rdatatype_none; 5911 dns_name_t *noqname = NULL; 5912 5913 FCTXTRACE("findnoqname"); 5914 5915 REQUIRE(noqnamep != NULL && *noqnamep == NULL); 5916 5917 /* 5918 * Find the SIG for this rdataset, if we have it. 5919 */ 5920 for (sigrdataset = ISC_LIST_HEAD(name->list); sigrdataset != NULL; 5921 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 5922 { 5923 if (sigrdataset->type == dns_rdatatype_rrsig && 5924 sigrdataset->covers == type) 5925 { 5926 break; 5927 } 5928 } 5929 5930 if (sigrdataset == NULL) { 5931 return ISC_R_NOTFOUND; 5932 } 5933 5934 labels = dns_name_countlabels(name); 5935 5936 for (result = dns_rdataset_first(sigrdataset); result == ISC_R_SUCCESS; 5937 result = dns_rdataset_next(sigrdataset)) 5938 { 5939 dns_rdata_t rdata = DNS_RDATA_INIT; 5940 dns_rdataset_current(sigrdataset, &rdata); 5941 result = dns_rdata_tostruct(&rdata, &rrsig, NULL); 5942 RUNTIME_CHECK(result == ISC_R_SUCCESS); 5943 /* Wildcard has rrsig.labels < labels - 1. */ 5944 if (rrsig.labels + 1U >= labels) { 5945 continue; 5946 } 5947 break; 5948 } 5949 5950 if (result == ISC_R_NOMORE) { 5951 return ISC_R_NOTFOUND; 5952 } 5953 if (result != ISC_R_SUCCESS) { 5954 return result; 5955 } 5956 5957 zonename = dns_fixedname_initname(&fzonename); 5958 closest = dns_fixedname_initname(&fclosest); 5959 nearest = dns_fixedname_initname(&fnearest); 5960 5961 #define NXND(x) ((x) == ISC_R_SUCCESS) 5962 5963 section = DNS_SECTION_AUTHORITY; 5964 for (result = dns_message_firstname(message, section); 5965 result == ISC_R_SUCCESS; 5966 result = dns_message_nextname(message, section)) 5967 { 5968 dns_name_t *nsec = NULL; 5969 dns_message_currentname(message, section, &nsec); 5970 for (nrdataset = ISC_LIST_HEAD(nsec->list); nrdataset != NULL; 5971 nrdataset = next) 5972 { 5973 bool data = false, exists = false; 5974 bool optout = false, unknown = false; 5975 bool setclosest = false; 5976 bool setnearest = false; 5977 5978 next = ISC_LIST_NEXT(nrdataset, link); 5979 if (nrdataset->type != dns_rdatatype_nsec && 5980 nrdataset->type != dns_rdatatype_nsec3) 5981 { 5982 continue; 5983 } 5984 5985 if (nrdataset->type == dns_rdatatype_nsec && 5986 NXND(dns_nsec_noexistnodata( 5987 type, name, nsec, nrdataset, &exists, &data, 5988 NULL, fctx_log, fctx))) 5989 { 5990 if (!exists) { 5991 noqname = nsec; 5992 found = dns_rdatatype_nsec; 5993 } 5994 } 5995 5996 if (nrdataset->type == dns_rdatatype_nsec3 && 5997 NXND(dns_nsec3_noexistnodata( 5998 type, name, nsec, nrdataset, zonename, 5999 &exists, &data, &optout, &unknown, 6000 &setclosest, &setnearest, closest, nearest, 6001 fctx_log, fctx))) 6002 { 6003 if (!exists && setnearest) { 6004 noqname = nsec; 6005 found = dns_rdatatype_nsec3; 6006 } 6007 } 6008 } 6009 } 6010 if (result == ISC_R_NOMORE) { 6011 result = ISC_R_SUCCESS; 6012 } 6013 if (noqname != NULL) { 6014 for (sigrdataset = ISC_LIST_HEAD(noqname->list); 6015 sigrdataset != NULL; 6016 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 6017 { 6018 if (sigrdataset->type == dns_rdatatype_rrsig && 6019 sigrdataset->covers == found) 6020 { 6021 break; 6022 } 6023 } 6024 if (sigrdataset != NULL) { 6025 *noqnamep = noqname; 6026 } 6027 } 6028 return result; 6029 } 6030 6031 static isc_result_t 6032 cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message, 6033 dns_adbaddrinfo_t *addrinfo, isc_stdtime_t now) { 6034 dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL; 6035 dns_rdataset_t *addedrdataset = NULL; 6036 dns_rdataset_t *ardataset = NULL, *asigrdataset = NULL; 6037 dns_rdataset_t *valrdataset = NULL, *valsigrdataset = NULL; 6038 dns_dbnode_t *node = NULL, **anodep = NULL; 6039 dns_db_t **adbp = NULL; 6040 dns_resolver_t *res = fctx->res; 6041 bool need_validation = false; 6042 bool secure_domain = false; 6043 bool have_answer = false; 6044 isc_result_t result, eresult = ISC_R_SUCCESS; 6045 dns_fetchresponse_t *resp = NULL; 6046 unsigned int options = 0, equalok = 0; 6047 bool fail; 6048 unsigned int valoptions = 0; 6049 bool checknta = true; 6050 6051 FCTXTRACE("cache_name"); 6052 6053 /* 6054 * The appropriate bucket lock must be held. 6055 */ 6056 6057 /* 6058 * Is DNSSEC validation required for this name? 6059 */ 6060 if ((fctx->options & DNS_FETCHOPT_NONTA) != 0) { 6061 valoptions |= DNS_VALIDATOR_NONTA; 6062 checknta = false; 6063 } 6064 6065 if (res->view->enablevalidation) { 6066 result = issecuredomain(res->view, name, fctx->type, now, 6067 checknta, NULL, &secure_domain); 6068 if (result != ISC_R_SUCCESS) { 6069 return result; 6070 } 6071 } 6072 6073 if ((fctx->options & DNS_FETCHOPT_NOCDFLAG) != 0) { 6074 valoptions |= DNS_VALIDATOR_NOCDFLAG; 6075 } 6076 6077 if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0) { 6078 need_validation = false; 6079 } else { 6080 need_validation = secure_domain; 6081 } 6082 6083 if (name->attributes.answer && !need_validation) { 6084 have_answer = true; 6085 resp = ISC_LIST_HEAD(fctx->resps); 6086 6087 if (resp != NULL) { 6088 adbp = &resp->db; 6089 dns_name_copy(name, resp->foundname); 6090 anodep = &resp->node; 6091 6092 /* 6093 * If this is an ANY, SIG or RRSIG query, we're 6094 * not going to return any rdatasets, unless we 6095 * encountered a CNAME or DNAME as "the answer". 6096 * In this case, we're going to return 6097 * DNS_R_CNAME or DNS_R_DNAME and we must set up 6098 * the rdatasets. 6099 */ 6100 if ((fctx->type != dns_rdatatype_any && 6101 fctx->type != dns_rdatatype_rrsig && 6102 fctx->type != dns_rdatatype_sig) || 6103 name->attributes.chaining) 6104 { 6105 ardataset = resp->rdataset; 6106 asigrdataset = resp->sigrdataset; 6107 } 6108 } 6109 } 6110 6111 /* 6112 * Find or create the cache node. 6113 */ 6114 result = dns_db_findnode(fctx->cache, name, true, &node); 6115 if (result != ISC_R_SUCCESS) { 6116 return result; 6117 } 6118 6119 /* 6120 * Cache or validate each cacheable rdataset. 6121 */ 6122 fail = ((fctx->res->options & DNS_RESOLVER_CHECKNAMESFAIL) != 0); 6123 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 6124 rdataset = ISC_LIST_NEXT(rdataset, link)) 6125 { 6126 if (!CACHE(rdataset)) { 6127 continue; 6128 } 6129 if (CHECKNAMES(rdataset)) { 6130 char namebuf[DNS_NAME_FORMATSIZE]; 6131 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 6132 char classbuf[DNS_RDATATYPE_FORMATSIZE]; 6133 6134 dns_name_format(name, namebuf, sizeof(namebuf)); 6135 dns_rdatatype_format(rdataset->type, typebuf, 6136 sizeof(typebuf)); 6137 dns_rdataclass_format(rdataset->rdclass, classbuf, 6138 sizeof(classbuf)); 6139 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 6140 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 6141 "check-names %s %s/%s/%s", 6142 fail ? "failure" : "warning", namebuf, 6143 typebuf, classbuf); 6144 if (fail) { 6145 if (ANSWER(rdataset)) { 6146 dns_db_detachnode(fctx->cache, &node); 6147 return DNS_R_BADNAME; 6148 } 6149 continue; 6150 } 6151 } 6152 6153 /* 6154 * If CNAME, delete other RRsets at the same name 6155 * from the cache. 6156 */ 6157 if (rdataset->type == dns_rdatatype_cname) { 6158 evict_cname_other(fctx, node); 6159 } 6160 6161 /* 6162 * Enforce the configure maximum cache TTL. 6163 */ 6164 if (rdataset->ttl > res->view->maxcachettl) { 6165 rdataset->ttl = res->view->maxcachettl; 6166 } 6167 6168 /* 6169 * Enforce configured minimum cache TTL. 6170 */ 6171 if (rdataset->ttl < res->view->mincachettl) { 6172 rdataset->ttl = res->view->mincachettl; 6173 } 6174 6175 /* 6176 * Mark the rdataset as being prefetch eligible. 6177 */ 6178 if (rdataset->ttl >= fctx->res->view->prefetch_eligible) { 6179 rdataset->attributes |= DNS_RDATASETATTR_PREFETCH; 6180 } 6181 6182 /* 6183 * Find the SIG for this rdataset, if we have it. 6184 */ 6185 for (sigrdataset = ISC_LIST_HEAD(name->list); 6186 sigrdataset != NULL; 6187 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 6188 { 6189 if (sigrdataset->type == dns_rdatatype_rrsig && 6190 sigrdataset->covers == rdataset->type) 6191 { 6192 break; 6193 } 6194 } 6195 6196 /* 6197 * If this RRset is in a secure domain, is in bailiwick, 6198 * and is not glue, attempt DNSSEC validation. (We do 6199 * not attempt to validate glue or out-of-bailiwick 6200 * data--even though there might be some performance 6201 * benefit to doing so--because it makes it simpler and 6202 * safer to ensure that records from a secure domain are 6203 * only cached if validated within the context of a 6204 * query to the domain that owns them.) 6205 */ 6206 if (secure_domain && rdataset->trust != dns_trust_glue && 6207 !EXTERNAL(rdataset)) 6208 { 6209 dns_trust_t trust; 6210 6211 /* 6212 * RRSIGs are validated as part of validating 6213 * the type they cover. 6214 */ 6215 if (rdataset->type == dns_rdatatype_rrsig) { 6216 continue; 6217 } 6218 6219 if (sigrdataset == NULL && need_validation && 6220 !ANSWER(rdataset)) 6221 { 6222 /* 6223 * Ignore unrelated non-answer 6224 * rdatasets that are missing 6225 * signatures. 6226 */ 6227 continue; 6228 } 6229 6230 /* 6231 * Normalize the rdataset and sigrdataset TTLs. 6232 */ 6233 if (sigrdataset != NULL) { 6234 rdataset->ttl = ISC_MIN(rdataset->ttl, 6235 sigrdataset->ttl); 6236 sigrdataset->ttl = rdataset->ttl; 6237 } 6238 6239 /* 6240 * Mark the rdataset as being prefetch eligible. 6241 */ 6242 if (rdataset->ttl >= fctx->res->view->prefetch_eligible) 6243 { 6244 rdataset->attributes |= 6245 DNS_RDATASETATTR_PREFETCH; 6246 } 6247 6248 /* 6249 * Cache this rdataset/sigrdataset pair as 6250 * pending data. Track whether it was 6251 * additional or not. If this was a priming 6252 * query, additional should be cached as glue. 6253 */ 6254 if (rdataset->trust == dns_trust_additional) { 6255 trust = dns_trust_pending_additional; 6256 } else { 6257 trust = dns_trust_pending_answer; 6258 } 6259 6260 rdataset->trust = trust; 6261 if (sigrdataset != NULL) { 6262 sigrdataset->trust = trust; 6263 } 6264 if (!need_validation || !ANSWER(rdataset)) { 6265 options = 0; 6266 equalok = 0; 6267 if (ANSWER(rdataset) && 6268 rdataset->type != dns_rdatatype_rrsig) 6269 { 6270 isc_result_t tresult; 6271 dns_name_t *noqname = NULL; 6272 tresult = findnoqname( 6273 fctx, message, name, 6274 rdataset->type, &noqname); 6275 if (tresult == ISC_R_SUCCESS && 6276 noqname != NULL) 6277 { 6278 (void)dns_rdataset_addnoqname( 6279 rdataset, noqname); 6280 } 6281 } 6282 if ((fctx->options & DNS_FETCHOPT_PREFETCH) != 6283 0) 6284 { 6285 options = DNS_DBADD_PREFETCH; 6286 } 6287 if ((fctx->options & DNS_FETCHOPT_NOCACHED) != 6288 0) 6289 { 6290 options |= DNS_DBADD_FORCE; 6291 } 6292 /* 6293 * If we're validating and passing the added 6294 * rdataset back to the caller, then we ask 6295 * dns_db_addrdataset() to compare the old and 6296 * new rdatasets whenever the result would 6297 * normally have been DNS_R_UNCHANGED, and to 6298 * return ISC_R_SUCCESS if they compare equal. 6299 * This allows us to continue and cache RRSIGs 6300 * in that case. 6301 */ 6302 if (!need_validation && ardataset != NULL) { 6303 equalok = DNS_DBADD_EQUALOK; 6304 } 6305 addedrdataset = ardataset; 6306 result = dns_db_addrdataset( 6307 fctx->cache, node, NULL, now, rdataset, 6308 options | equalok, addedrdataset); 6309 if (result == DNS_R_UNCHANGED) { 6310 result = ISC_R_SUCCESS; 6311 if (!need_validation && 6312 ardataset != NULL && 6313 NEGATIVE(ardataset)) 6314 { 6315 /* 6316 * The answer in the 6317 * cache is better than 6318 * the answer we found. 6319 * If it's a negative 6320 * cache entry, we 6321 * must set eresult 6322 * appropriately. 6323 */ 6324 if (NXDOMAIN(ardataset)) { 6325 eresult = 6326 DNS_R_NCACHENXDOMAIN; 6327 } else { 6328 eresult = 6329 DNS_R_NCACHENXRRSET; 6330 } 6331 continue; 6332 } 6333 if (equalok) { 6334 continue; 6335 } 6336 result = ISC_R_SUCCESS; 6337 } 6338 if (result != ISC_R_SUCCESS) { 6339 break; 6340 } 6341 if (sigrdataset != NULL) { 6342 addedrdataset = asigrdataset; 6343 result = dns_db_addrdataset( 6344 fctx->cache, node, NULL, now, 6345 sigrdataset, options, 6346 addedrdataset); 6347 if (result == DNS_R_UNCHANGED) { 6348 result = ISC_R_SUCCESS; 6349 } 6350 if (result != ISC_R_SUCCESS) { 6351 break; 6352 } 6353 } else if (!ANSWER(rdataset)) { 6354 continue; 6355 } 6356 } 6357 6358 if (ANSWER(rdataset) && need_validation) { 6359 if (fctx->type != dns_rdatatype_any && 6360 fctx->type != dns_rdatatype_rrsig && 6361 fctx->type != dns_rdatatype_sig) 6362 { 6363 /* 6364 * This is The Answer. We will 6365 * validate it, but first we 6366 * cache the rest of the 6367 * response - it may contain 6368 * useful keys. 6369 */ 6370 INSIST(valrdataset == NULL && 6371 valsigrdataset == NULL); 6372 valrdataset = rdataset; 6373 valsigrdataset = sigrdataset; 6374 } else { 6375 /* 6376 * This is one of (potentially) 6377 * multiple answers to an ANY 6378 * or SIG query. To keep things 6379 * simple, we just start the 6380 * validator right away rather 6381 * than caching first and 6382 * having to remember which 6383 * rdatasets needed validation. 6384 */ 6385 result = valcreate( 6386 fctx, message, addrinfo, name, 6387 rdataset->type, rdataset, 6388 sigrdataset, valoptions); 6389 } 6390 } else if (CHAINING(rdataset)) { 6391 if (rdataset->type == dns_rdatatype_cname) { 6392 eresult = DNS_R_CNAME; 6393 } else { 6394 INSIST(rdataset->type == 6395 dns_rdatatype_dname); 6396 eresult = DNS_R_DNAME; 6397 } 6398 } 6399 } else if (!EXTERNAL(rdataset)) { 6400 /* 6401 * It's OK to cache this rdataset now. 6402 */ 6403 if (ANSWER(rdataset)) { 6404 addedrdataset = ardataset; 6405 } else if (ANSWERSIG(rdataset)) { 6406 addedrdataset = asigrdataset; 6407 } else { 6408 addedrdataset = NULL; 6409 } 6410 if (CHAINING(rdataset)) { 6411 if (rdataset->type == dns_rdatatype_cname) { 6412 eresult = DNS_R_CNAME; 6413 } else { 6414 INSIST(rdataset->type == 6415 dns_rdatatype_dname); 6416 eresult = DNS_R_DNAME; 6417 } 6418 } 6419 if (rdataset->trust == dns_trust_glue && 6420 (rdataset->type == dns_rdatatype_ns || 6421 (rdataset->type == dns_rdatatype_rrsig && 6422 rdataset->covers == dns_rdatatype_ns))) 6423 { 6424 /* 6425 * If the trust level is 6426 * 'dns_trust_glue' then we are adding 6427 * data from a referral we got while 6428 * executing the search algorithm. New 6429 * referral data always takes precedence 6430 * over the existing cache contents. 6431 */ 6432 options = DNS_DBADD_FORCE; 6433 } else if ((fctx->options & DNS_FETCHOPT_PREFETCH) != 0) 6434 { 6435 options = DNS_DBADD_PREFETCH; 6436 } else { 6437 options = 0; 6438 } 6439 6440 if (ANSWER(rdataset) && 6441 rdataset->type != dns_rdatatype_rrsig) 6442 { 6443 isc_result_t tresult; 6444 dns_name_t *noqname = NULL; 6445 tresult = findnoqname(fctx, message, name, 6446 rdataset->type, &noqname); 6447 if (tresult == ISC_R_SUCCESS && noqname != NULL) 6448 { 6449 (void)dns_rdataset_addnoqname(rdataset, 6450 noqname); 6451 } 6452 } 6453 6454 /* 6455 * Evict CNAME records, according to the RFC rules (see 6456 * evict_cname_other). 6457 * 6458 * Note that a signature is tied to the type it covers 6459 * and is deleted along with the covered RRset in 6460 * 'delete_rrset()'. 6461 */ 6462 if (!dns_rdataset_matchestype(rdataset, 6463 dns_rdatatype_key) && 6464 !dns_rdataset_matchestype(rdataset, 6465 dns_rdatatype_nsec) && 6466 !dns_rdataset_matchestype(rdataset, 6467 dns_rdatatype_nxt)) 6468 { 6469 delete_rrset(fctx, node, dns_rdatatype_cname); 6470 } 6471 6472 /* 6473 * Now we can add the rdataset. 6474 */ 6475 result = dns_db_addrdataset(fctx->cache, node, NULL, 6476 now, rdataset, options, 6477 addedrdataset); 6478 6479 if (result == DNS_R_UNCHANGED) { 6480 if (ANSWER(rdataset) && ardataset != NULL && 6481 NEGATIVE(ardataset)) 6482 { 6483 /* 6484 * The answer in the cache is 6485 * better than the answer we 6486 * found, and is a negative 6487 * cache entry, so we must set 6488 * eresult appropriately. 6489 */ 6490 if (NXDOMAIN(ardataset)) { 6491 eresult = DNS_R_NCACHENXDOMAIN; 6492 } else { 6493 eresult = DNS_R_NCACHENXRRSET; 6494 } 6495 } 6496 result = ISC_R_SUCCESS; 6497 } else if (result != ISC_R_SUCCESS) { 6498 break; 6499 } 6500 } 6501 } 6502 6503 if (valrdataset != NULL) { 6504 dns_rdatatype_t vtype = fctx->type; 6505 if (CHAINING(valrdataset)) { 6506 if (valrdataset->type == dns_rdatatype_cname) { 6507 vtype = dns_rdatatype_cname; 6508 } else { 6509 vtype = dns_rdatatype_dname; 6510 } 6511 } 6512 6513 result = valcreate(fctx, message, addrinfo, name, vtype, 6514 valrdataset, valsigrdataset, valoptions); 6515 } 6516 6517 if (result == ISC_R_SUCCESS && have_answer) { 6518 FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER); 6519 if (resp != NULL) { 6520 /* 6521 * Negative results must be indicated in 6522 * resp->result. 6523 */ 6524 if (dns_rdataset_isassociated(resp->rdataset)) { 6525 if (NEGATIVE(resp->rdataset)) { 6526 INSIST(eresult == 6527 DNS_R_NCACHENXDOMAIN || 6528 eresult == DNS_R_NCACHENXRRSET); 6529 } else if (eresult == ISC_R_SUCCESS && 6530 resp->rdataset->type != fctx->type) 6531 { 6532 switch (resp->rdataset->type) { 6533 case dns_rdatatype_cname: 6534 eresult = DNS_R_CNAME; 6535 break; 6536 case dns_rdatatype_dname: 6537 eresult = DNS_R_DNAME; 6538 break; 6539 default: 6540 break; 6541 } 6542 } 6543 } 6544 resp->result = eresult; 6545 if (adbp != NULL && *adbp != NULL) { 6546 if (anodep != NULL && *anodep != NULL) { 6547 dns_db_detachnode(*adbp, anodep); 6548 } 6549 dns_db_detach(adbp); 6550 } 6551 dns_db_attach(fctx->cache, adbp); 6552 dns_db_transfernode(fctx->cache, &node, anodep); 6553 clone_results(fctx); 6554 } 6555 } 6556 6557 if (node != NULL) { 6558 dns_db_detachnode(fctx->cache, &node); 6559 } 6560 6561 return result; 6562 } 6563 6564 static isc_result_t 6565 cache_message(fetchctx_t *fctx, dns_message_t *message, 6566 dns_adbaddrinfo_t *addrinfo, isc_stdtime_t now) { 6567 isc_result_t result; 6568 dns_section_t section; 6569 dns_name_t *name; 6570 6571 FCTXTRACE("cache_message"); 6572 6573 FCTX_ATTR_CLR(fctx, FCTX_ATTR_WANTCACHE); 6574 6575 LOCK(&fctx->lock); 6576 6577 for (section = DNS_SECTION_ANSWER; section <= DNS_SECTION_ADDITIONAL; 6578 section++) 6579 { 6580 result = dns_message_firstname(message, section); 6581 while (result == ISC_R_SUCCESS) { 6582 name = NULL; 6583 dns_message_currentname(message, section, &name); 6584 if (name->attributes.cache) { 6585 result = cache_name(fctx, name, message, 6586 addrinfo, now); 6587 if (result != ISC_R_SUCCESS) { 6588 break; 6589 } 6590 } 6591 result = dns_message_nextname(message, section); 6592 } 6593 if (result != ISC_R_NOMORE) { 6594 break; 6595 } 6596 } 6597 if (result == ISC_R_NOMORE) { 6598 result = ISC_R_SUCCESS; 6599 } 6600 6601 UNLOCK(&fctx->lock); 6602 6603 return result; 6604 } 6605 6606 /* 6607 * Do what dns_ncache_addoptout() does, and then compute an appropriate 6608 * eresult. 6609 */ 6610 static isc_result_t 6611 ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node, 6612 dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl, 6613 dns_ttl_t maxttl, bool optout, bool secure, 6614 dns_rdataset_t *ardataset, isc_result_t *eresultp) { 6615 isc_result_t result; 6616 dns_rdataset_t rdataset; 6617 6618 if (ardataset == NULL) { 6619 dns_rdataset_init(&rdataset); 6620 ardataset = &rdataset; 6621 } 6622 if (secure) { 6623 result = dns_ncache_addoptout(message, cache, node, covers, now, 6624 minttl, maxttl, optout, 6625 ardataset); 6626 } else { 6627 result = dns_ncache_add(message, cache, node, covers, now, 6628 minttl, maxttl, ardataset); 6629 } 6630 if (result == DNS_R_UNCHANGED || result == ISC_R_SUCCESS) { 6631 /* 6632 * If the cache now contains a negative entry and we 6633 * care about whether it is DNS_R_NCACHENXDOMAIN or 6634 * DNS_R_NCACHENXRRSET then extract it. 6635 */ 6636 if (NEGATIVE(ardataset)) { 6637 /* 6638 * The cache data is a negative cache entry. 6639 */ 6640 if (NXDOMAIN(ardataset)) { 6641 *eresultp = DNS_R_NCACHENXDOMAIN; 6642 } else { 6643 *eresultp = DNS_R_NCACHENXRRSET; 6644 } 6645 } else { 6646 /* 6647 * The attempt to add a negative cache entry 6648 * was rejected. Set *eresultp to reflect 6649 * the type of the dataset being returned. 6650 */ 6651 switch (ardataset->type) { 6652 case dns_rdatatype_cname: 6653 *eresultp = DNS_R_CNAME; 6654 break; 6655 case dns_rdatatype_dname: 6656 *eresultp = DNS_R_DNAME; 6657 break; 6658 default: 6659 *eresultp = ISC_R_SUCCESS; 6660 break; 6661 } 6662 } 6663 result = ISC_R_SUCCESS; 6664 } 6665 if (ardataset == &rdataset && dns_rdataset_isassociated(ardataset)) { 6666 dns_rdataset_disassociate(ardataset); 6667 } 6668 6669 return result; 6670 } 6671 6672 static isc_result_t 6673 ncache_message(fetchctx_t *fctx, dns_message_t *message, 6674 dns_adbaddrinfo_t *addrinfo, dns_rdatatype_t covers, 6675 isc_stdtime_t now) { 6676 isc_result_t result, eresult = ISC_R_SUCCESS; 6677 dns_name_t *name = fctx->name; 6678 dns_resolver_t *res = fctx->res; 6679 dns_db_t **adbp = NULL; 6680 dns_dbnode_t *node = NULL, **anodep = NULL; 6681 dns_rdataset_t *ardataset = NULL; 6682 bool need_validation = false, secure_domain = false; 6683 dns_fetchresponse_t *resp = NULL; 6684 uint32_t ttl; 6685 unsigned int valoptions = 0; 6686 bool checknta = true; 6687 6688 FCTXTRACE("ncache_message"); 6689 6690 FCTX_ATTR_CLR(fctx, FCTX_ATTR_WANTNCACHE); 6691 6692 POST(need_validation); 6693 6694 /* 6695 * XXXMPA remove when we follow cnames and adjust the setting 6696 * of FCTX_ATTR_WANTNCACHE in rctx_answer_none(). 6697 */ 6698 INSIST(message->counts[DNS_SECTION_ANSWER] == 0); 6699 6700 /* 6701 * Is DNSSEC validation required for this name? 6702 */ 6703 if ((fctx->options & DNS_FETCHOPT_NONTA) != 0) { 6704 valoptions |= DNS_VALIDATOR_NONTA; 6705 checknta = false; 6706 } 6707 6708 if (fctx->res->view->enablevalidation) { 6709 result = issecuredomain(res->view, name, fctx->type, now, 6710 checknta, NULL, &secure_domain); 6711 if (result != ISC_R_SUCCESS) { 6712 return result; 6713 } 6714 } 6715 6716 if ((fctx->options & DNS_FETCHOPT_NOCDFLAG) != 0) { 6717 valoptions |= DNS_VALIDATOR_NOCDFLAG; 6718 } 6719 6720 if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0) { 6721 need_validation = false; 6722 } else { 6723 need_validation = secure_domain; 6724 } 6725 6726 if (secure_domain) { 6727 /* 6728 * Mark all rdatasets as pending. 6729 */ 6730 result = dns_message_firstname(message, DNS_SECTION_AUTHORITY); 6731 while (result == ISC_R_SUCCESS) { 6732 dns_rdataset_t *trdataset = NULL; 6733 dns_name_t *tname = NULL; 6734 6735 dns_message_currentname(message, DNS_SECTION_AUTHORITY, 6736 &tname); 6737 for (trdataset = ISC_LIST_HEAD(tname->list); 6738 trdataset != NULL; 6739 trdataset = ISC_LIST_NEXT(trdataset, link)) 6740 { 6741 trdataset->trust = dns_trust_pending_answer; 6742 } 6743 result = dns_message_nextname(message, 6744 DNS_SECTION_AUTHORITY); 6745 } 6746 if (result != ISC_R_NOMORE) { 6747 return result; 6748 } 6749 } 6750 6751 if (need_validation) { 6752 /* 6753 * Do negative response validation. 6754 */ 6755 result = valcreate(fctx, message, addrinfo, name, fctx->type, 6756 NULL, NULL, valoptions); 6757 /* 6758 * If validation is necessary, return now. Otherwise 6759 * continue to process the message, letting the 6760 * validation complete in its own good time. 6761 */ 6762 return result; 6763 } 6764 6765 LOCK(&fctx->lock); 6766 6767 if (!HAVE_ANSWER(fctx)) { 6768 resp = ISC_LIST_HEAD(fctx->resps); 6769 if (resp != NULL) { 6770 adbp = &resp->db; 6771 dns_name_copy(name, resp->foundname); 6772 anodep = &resp->node; 6773 ardataset = resp->rdataset; 6774 } 6775 } 6776 6777 result = dns_db_findnode(fctx->cache, name, true, &node); 6778 if (result != ISC_R_SUCCESS) { 6779 goto unlock; 6780 } 6781 6782 /* 6783 * Don't report qname minimisation NXDOMAIN errors 6784 * when the result is NXDOMAIN except we have already 6785 * confirmed a higher error. 6786 */ 6787 if (!fctx->force_qmin_warning && message->rcode == dns_rcode_nxdomain && 6788 (fctx->qmin_warning == DNS_R_NXDOMAIN || 6789 fctx->qmin_warning == DNS_R_NCACHENXDOMAIN)) 6790 { 6791 fctx->qmin_warning = ISC_R_SUCCESS; 6792 } 6793 6794 /* 6795 * If we are asking for a SOA record set the cache time 6796 * to zero to facilitate locating the containing zone of 6797 * a arbitrary zone. 6798 */ 6799 ttl = fctx->res->view->maxncachettl; 6800 if (fctx->type == dns_rdatatype_soa && covers == dns_rdatatype_any && 6801 fctx->res->zero_no_soa_ttl) 6802 { 6803 ttl = 0; 6804 } 6805 6806 result = ncache_adderesult(message, fctx->cache, node, covers, now, 6807 fctx->res->view->minncachettl, ttl, false, 6808 false, ardataset, &eresult); 6809 if (result != ISC_R_SUCCESS) { 6810 goto unlock; 6811 } 6812 6813 if (!HAVE_ANSWER(fctx)) { 6814 FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER); 6815 if (resp != NULL) { 6816 resp->result = eresult; 6817 if (adbp != NULL && *adbp != NULL) { 6818 if (anodep != NULL && *anodep != NULL) { 6819 dns_db_detachnode(*adbp, anodep); 6820 } 6821 dns_db_detach(adbp); 6822 } 6823 dns_db_attach(fctx->cache, adbp); 6824 dns_db_transfernode(fctx->cache, &node, anodep); 6825 clone_results(fctx); 6826 } 6827 } 6828 6829 unlock: 6830 UNLOCK(&fctx->lock); 6831 6832 if (node != NULL) { 6833 dns_db_detachnode(fctx->cache, &node); 6834 } 6835 6836 return result; 6837 } 6838 6839 /* 6840 * Truncate 'rdataset' to at most 'max' rdata, by unlinking the trailing 6841 * rdata from the underlying rdatalist. The rdataset must be backed by a 6842 * dns_rdatalist, which is the case for rdatasets parsed from a message. 6843 */ 6844 static void 6845 truncate_rdataset(dns_rdataset_t *rdataset, unsigned int max) { 6846 dns_rdatalist_t *rdatalist = NULL; 6847 dns_rdata_t *keep = NULL; 6848 dns_rdata_t *next = NULL; 6849 unsigned int i; 6850 6851 REQUIRE(max > 0); 6852 6853 if (dns_rdataset_count(rdataset) <= max) { 6854 return; 6855 } 6856 6857 dns_rdatalist_fromrdataset(rdataset, &rdatalist); 6858 6859 keep = ISC_LIST_HEAD(rdatalist->rdata); 6860 for (i = 1; i < max && keep != NULL; i++) { 6861 keep = ISC_LIST_NEXT(keep, link); 6862 } 6863 INSIST(keep != NULL); 6864 6865 next = ISC_LIST_NEXT(keep, link); 6866 while (next != NULL) { 6867 dns_rdata_t *unlinked = next; 6868 next = ISC_LIST_NEXT(next, link); 6869 ISC_LIST_UNLINK(rdatalist->rdata, unlinked, link); 6870 } 6871 } 6872 6873 static void 6874 mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external, 6875 bool gluing) { 6876 name->attributes.cache = true; 6877 if (gluing) { 6878 rdataset->trust = dns_trust_glue; 6879 if (rdataset->type == dns_rdatatype_a || 6880 rdataset->type == dns_rdatatype_aaaa) 6881 { 6882 truncate_rdataset(rdataset, DELEG_MAX_GLUES_PER_NS); 6883 } 6884 6885 /* 6886 * Glue with 0 TTL causes problems. We force the TTL to 6887 * 1 second to prevent this. 6888 */ 6889 if (rdataset->ttl == 0) { 6890 rdataset->ttl = 1; 6891 } 6892 } else { 6893 rdataset->trust = dns_trust_additional; 6894 } 6895 /* 6896 * Avoid infinite loops by only marking new rdatasets. 6897 */ 6898 if (!CACHE(rdataset)) { 6899 name->attributes.chase = true; 6900 rdataset->attributes |= DNS_RDATASETATTR_CHASE; 6901 } 6902 rdataset->attributes |= DNS_RDATASETATTR_CACHE; 6903 if (external) { 6904 rdataset->attributes |= DNS_RDATASETATTR_EXTERNAL; 6905 } 6906 } 6907 6908 /* 6909 * Returns true if 'name' is external to the namespace for which 6910 * the server being queried can answer, either because it's not a 6911 * subdomain or because it's below a forward declaration or a 6912 * locally served zone. 6913 */ 6914 static inline bool 6915 name_external(const dns_name_t *name, dns_rdatatype_t type, respctx_t *rctx) { 6916 fetchctx_t *fctx = rctx->fctx; 6917 isc_result_t result; 6918 dns_forwarders_t *forwarders = NULL; 6919 dns_name_t *apex = NULL; 6920 dns_name_t suffix; 6921 dns_zone_t *zone = NULL; 6922 unsigned int labels; 6923 dns_namereln_t rel; 6924 6925 apex = (ISDUALSTACK(fctx->addrinfo) || !ISFORWARDER(fctx->addrinfo)) 6926 ? rctx->ns_name != NULL ? rctx->ns_name : fctx->domain 6927 : fctx->fwdname; 6928 6929 /* 6930 * The name is outside the queried namespace. 6931 */ 6932 rel = dns_name_fullcompare(name, apex, &(int){ 0 }, 6933 &(unsigned int){ 0U }); 6934 if (rel != dns_namereln_subdomain && rel != dns_namereln_equal) { 6935 return true; 6936 } 6937 6938 /* 6939 * If the record lives in the parent zone, adjust the name so we 6940 * look for the correct zone or forward clause. 6941 */ 6942 labels = dns_name_countlabels(name); 6943 if (dns_rdatatype_atparent(type) && labels > 1U) { 6944 dns_name_init(&suffix, NULL); 6945 dns_name_getlabelsequence(name, 1, labels - 1, &suffix); 6946 name = &suffix; 6947 } else if (rel == dns_namereln_equal) { 6948 /* If 'name' is 'apex', no further checking is needed. */ 6949 return false; 6950 } 6951 6952 /* 6953 * If there is a locally served zone between 'apex' and 'name' 6954 * then don't cache. 6955 */ 6956 dns_ztfind_t options = DNS_ZTFIND_NOEXACT | DNS_ZTFIND_MIRROR; 6957 result = dns_view_findzone(fctx->res->view, name, options, &zone); 6958 if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { 6959 dns_name_t *zname = dns_zone_getorigin(zone); 6960 dns_namereln_t reln = dns_name_fullcompare( 6961 zname, apex, &(int){ 0 }, &(unsigned int){ 0U }); 6962 dns_zone_detach(&zone); 6963 if (reln == dns_namereln_subdomain) { 6964 return true; 6965 } 6966 } 6967 6968 /* 6969 * Look for a forward declaration below 'name'. 6970 */ 6971 result = dns_fwdtable_find(fctx->res->view->fwdtable, name, 6972 &forwarders); 6973 6974 if (ISFORWARDER(fctx->addrinfo)) { 6975 /* 6976 * See if the forwarder declaration is better. 6977 */ 6978 if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { 6979 bool better = !dns_name_equal(&forwarders->name, 6980 fctx->fwdname); 6981 dns_forwarders_detach(&forwarders); 6982 return better; 6983 } 6984 6985 /* 6986 * If the lookup failed, the configuration must have 6987 * changed: play it safe and don't cache. 6988 */ 6989 return true; 6990 } else if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { 6991 /* 6992 * If 'name' is covered by a 'forward only' clause then we 6993 * can't cache this response. 6994 */ 6995 bool nocache = (forwarders->fwdpolicy == dns_fwdpolicy_only && 6996 !ISC_LIST_EMPTY(forwarders->fwdrs)); 6997 dns_forwarders_detach(&forwarders); 6998 return nocache; 6999 } 7000 7001 return false; 7002 } 7003 7004 static isc_result_t 7005 check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type, 7006 dns_rdataset_t *found, dns_section_t section) { 7007 respctx_t *rctx = arg; 7008 fetchctx_t *fctx = rctx->fctx; 7009 isc_result_t result; 7010 dns_name_t *name = NULL; 7011 dns_rdataset_t *rdataset = NULL; 7012 bool external; 7013 dns_rdatatype_t rtype; 7014 bool gluing; 7015 7016 REQUIRE(VALID_FCTX(fctx)); 7017 7018 gluing = (GLUING(fctx) || (fctx->type == dns_rdatatype_ns && 7019 dns_name_equal(fctx->name, dns_rootname))); 7020 7021 result = dns_message_findname(rctx->query->rmessage, section, addname, 7022 dns_rdatatype_any, 0, &name, NULL); 7023 if (result == ISC_R_SUCCESS) { 7024 external = name_external(name, type, rctx); 7025 if (type == dns_rdatatype_a) { 7026 for (rdataset = ISC_LIST_HEAD(name->list); 7027 rdataset != NULL; 7028 rdataset = ISC_LIST_NEXT(rdataset, link)) 7029 { 7030 if (rdataset->type == dns_rdatatype_rrsig) { 7031 rtype = rdataset->covers; 7032 } else { 7033 rtype = rdataset->type; 7034 } 7035 if (rtype == dns_rdatatype_a || 7036 rtype == dns_rdatatype_aaaa) 7037 { 7038 mark_related(name, rdataset, external, 7039 gluing); 7040 } 7041 } 7042 } else { 7043 result = dns_message_findtype(name, type, 0, &rdataset); 7044 if (result == ISC_R_SUCCESS) { 7045 mark_related(name, rdataset, external, gluing); 7046 if (found != NULL) { 7047 dns_rdataset_clone(rdataset, found); 7048 } 7049 /* 7050 * Do we have its SIG too? 7051 */ 7052 rdataset = NULL; 7053 result = dns_message_findtype( 7054 name, dns_rdatatype_rrsig, type, 7055 &rdataset); 7056 if (result == ISC_R_SUCCESS) { 7057 mark_related(name, rdataset, external, 7058 gluing); 7059 } 7060 } 7061 } 7062 } 7063 7064 return ISC_R_SUCCESS; 7065 } 7066 7067 static isc_result_t 7068 check_related(void *arg, const dns_name_t *addname, dns_rdatatype_t type, 7069 dns_rdataset_t *found DNS__DB_FLARG) { 7070 return check_section(arg, addname, type, found, DNS_SECTION_ADDITIONAL); 7071 } 7072 7073 static bool 7074 is_answeraddress_allowed(dns_view_t *view, dns_name_t *name, 7075 dns_rdataset_t *rdataset) { 7076 isc_result_t result; 7077 dns_rdata_t rdata = DNS_RDATA_INIT; 7078 struct in_addr ina; 7079 struct in6_addr in6a; 7080 isc_netaddr_t netaddr; 7081 char addrbuf[ISC_NETADDR_FORMATSIZE]; 7082 char namebuf[DNS_NAME_FORMATSIZE]; 7083 char classbuf[64]; 7084 char typebuf[64]; 7085 int match; 7086 7087 /* By default, we allow any addresses. */ 7088 if (view->denyansweracl == NULL) { 7089 return true; 7090 } 7091 7092 /* 7093 * If the owner name matches one in the exclusion list, either 7094 * exactly or partially, allow it. 7095 */ 7096 if (dns_nametree_covered(view->answeracl_exclude, name, NULL, 0)) { 7097 return true; 7098 } 7099 7100 /* 7101 * deny-answer-address doesn't apply to non-IN classes. 7102 */ 7103 if (rdataset->rdclass != dns_rdataclass_in) { 7104 return true; 7105 } 7106 7107 /* 7108 * Otherwise, search the filter list for a match for each 7109 * address record. If a match is found, the address should be 7110 * filtered, so should the entire answer. 7111 */ 7112 for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS; 7113 result = dns_rdataset_next(rdataset)) 7114 { 7115 dns_rdata_reset(&rdata); 7116 dns_rdataset_current(rdataset, &rdata); 7117 if (rdataset->type == dns_rdatatype_a) { 7118 INSIST(rdata.length == sizeof(ina.s_addr)); 7119 memmove(&ina.s_addr, rdata.data, sizeof(ina.s_addr)); 7120 isc_netaddr_fromin(&netaddr, &ina); 7121 } else { 7122 INSIST(rdata.length == sizeof(in6a.s6_addr)); 7123 memmove(in6a.s6_addr, rdata.data, sizeof(in6a.s6_addr)); 7124 isc_netaddr_fromin6(&netaddr, &in6a); 7125 } 7126 7127 result = dns_acl_match(&netaddr, NULL, view->denyansweracl, 7128 view->aclenv, &match, NULL); 7129 if (result == ISC_R_SUCCESS && match > 0) { 7130 isc_netaddr_format(&netaddr, addrbuf, sizeof(addrbuf)); 7131 dns_name_format(name, namebuf, sizeof(namebuf)); 7132 dns_rdatatype_format(rdataset->type, typebuf, 7133 sizeof(typebuf)); 7134 dns_rdataclass_format(rdataset->rdclass, classbuf, 7135 sizeof(classbuf)); 7136 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 7137 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 7138 "answer address %s denied for %s/%s/%s", 7139 addrbuf, namebuf, typebuf, classbuf); 7140 return false; 7141 } 7142 } 7143 7144 return true; 7145 } 7146 7147 static bool 7148 is_answertarget_allowed(fetchctx_t *fctx, dns_name_t *qname, dns_name_t *rname, 7149 dns_rdataset_t *rdataset, bool *chainingp) { 7150 isc_result_t result; 7151 dns_name_t *tname = NULL; 7152 dns_rdata_cname_t cname; 7153 dns_rdata_dname_t dname; 7154 dns_view_t *view = fctx->res->view; 7155 dns_rdata_t rdata = DNS_RDATA_INIT; 7156 unsigned int nlabels; 7157 dns_fixedname_t fixed; 7158 dns_name_t prefix; 7159 int order; 7160 7161 REQUIRE(rdataset != NULL); 7162 REQUIRE(rdataset->type == dns_rdatatype_cname || 7163 rdataset->type == dns_rdatatype_dname); 7164 7165 /* 7166 * By default, we allow any target name. 7167 * If newqname != NULL we also need to extract the newqname. 7168 */ 7169 if (chainingp == NULL && view->denyanswernames == NULL) { 7170 return true; 7171 } 7172 7173 result = dns_rdataset_first(rdataset); 7174 RUNTIME_CHECK(result == ISC_R_SUCCESS); 7175 dns_rdataset_current(rdataset, &rdata); 7176 switch (rdataset->type) { 7177 case dns_rdatatype_cname: 7178 result = dns_rdata_tostruct(&rdata, &cname, NULL); 7179 RUNTIME_CHECK(result == ISC_R_SUCCESS); 7180 tname = &cname.cname; 7181 break; 7182 case dns_rdatatype_dname: 7183 if (dns_name_fullcompare(qname, rname, &order, &nlabels) != 7184 dns_namereln_subdomain) 7185 { 7186 return true; 7187 } 7188 result = dns_rdata_tostruct(&rdata, &dname, NULL); 7189 RUNTIME_CHECK(result == ISC_R_SUCCESS); 7190 dns_name_init(&prefix, NULL); 7191 tname = dns_fixedname_initname(&fixed); 7192 nlabels = dns_name_countlabels(rname); 7193 dns_name_split(qname, nlabels, &prefix, NULL); 7194 result = dns_name_concatenate(&prefix, &dname.dname, tname, 7195 NULL); 7196 if (result == DNS_R_NAMETOOLONG) { 7197 SET_IF_NOT_NULL(chainingp, true); 7198 return true; 7199 } 7200 RUNTIME_CHECK(result == ISC_R_SUCCESS); 7201 break; 7202 default: 7203 UNREACHABLE(); 7204 } 7205 7206 SET_IF_NOT_NULL(chainingp, true); 7207 7208 if (view->denyanswernames == NULL) { 7209 return true; 7210 } 7211 7212 /* 7213 * If the owner name matches one in the exclusion list, either 7214 * exactly or partially, allow it. 7215 */ 7216 if (dns_nametree_covered(view->answernames_exclude, qname, NULL, 0)) { 7217 return true; 7218 } 7219 7220 /* 7221 * If the target name is a subdomain of the search domain, allow 7222 * it. 7223 * 7224 * Note that if BIND is configured as a forwarding DNS server, 7225 * the search domain will always match the root domain ("."), so 7226 * we must also check whether forwarding is enabled so that 7227 * filters can be applied; see GL #1574. 7228 */ 7229 if (!fctx->forwarding && dns_name_issubdomain(tname, fctx->domain)) { 7230 return true; 7231 } 7232 7233 /* 7234 * Otherwise, apply filters. 7235 */ 7236 if (dns_nametree_covered(view->denyanswernames, tname, NULL, 0)) { 7237 char qnamebuf[DNS_NAME_FORMATSIZE]; 7238 char tnamebuf[DNS_NAME_FORMATSIZE]; 7239 char classbuf[64]; 7240 char typebuf[64]; 7241 dns_name_format(qname, qnamebuf, sizeof(qnamebuf)); 7242 dns_name_format(tname, tnamebuf, sizeof(tnamebuf)); 7243 dns_rdatatype_format(rdataset->type, typebuf, sizeof(typebuf)); 7244 dns_rdataclass_format(view->rdclass, classbuf, 7245 sizeof(classbuf)); 7246 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 7247 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 7248 "%s target %s denied for %s/%s", typebuf, 7249 tnamebuf, qnamebuf, classbuf); 7250 return false; 7251 } 7252 7253 return true; 7254 } 7255 7256 static void 7257 trim_ns_ttl(fetchctx_t *fctx, dns_name_t *name, dns_rdataset_t *rdataset) { 7258 if (fctx->ns_ttl_ok && rdataset->ttl > fctx->ns_ttl) { 7259 char ns_namebuf[DNS_NAME_FORMATSIZE]; 7260 char namebuf[DNS_NAME_FORMATSIZE]; 7261 char tbuf[DNS_RDATATYPE_FORMATSIZE]; 7262 7263 dns_name_format(name, ns_namebuf, sizeof(ns_namebuf)); 7264 dns_name_format(fctx->name, namebuf, sizeof(namebuf)); 7265 dns_rdatatype_format(fctx->type, tbuf, sizeof(tbuf)); 7266 7267 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 7268 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(10), 7269 "fctx %p: trimming ttl of %s/NS for %s/%s: " 7270 "%u -> %u", 7271 fctx, ns_namebuf, namebuf, tbuf, rdataset->ttl, 7272 fctx->ns_ttl); 7273 rdataset->ttl = fctx->ns_ttl; 7274 } 7275 } 7276 7277 static bool 7278 validinanswer(dns_rdataset_t *rdataset, fetchctx_t *fctx) { 7279 if (rdataset->type == dns_rdatatype_nsec3) { 7280 /* 7281 * NSEC3 records are not allowed to 7282 * appear in the answer section. 7283 */ 7284 log_formerr(fctx, "NSEC3 in answer"); 7285 return false; 7286 } 7287 if (rdataset->type == dns_rdatatype_tkey) { 7288 /* 7289 * TKEY is not a valid record in a 7290 * response to any query we can make. 7291 */ 7292 log_formerr(fctx, "TKEY in answer"); 7293 return false; 7294 } 7295 if (rdataset->rdclass != fctx->res->rdclass) { 7296 log_formerr(fctx, "Mismatched class in answer"); 7297 return false; 7298 } 7299 return true; 7300 } 7301 7302 #if DNS_RESOLVER_TRACE 7303 ISC_REFCOUNT_TRACE_IMPL(fetchctx, fctx_destroy); 7304 #else 7305 ISC_REFCOUNT_IMPL(fetchctx, fctx_destroy); 7306 #endif 7307 7308 static void 7309 resume_dslookup(void *arg) { 7310 dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg; 7311 fetchctx_t *fctx = resp->arg; 7312 isc_loop_t *loop = resp->loop; 7313 isc_result_t result; 7314 dns_resolver_t *res = NULL; 7315 dns_rdataset_t *frdataset = NULL, *nsrdataset = NULL; 7316 dns_rdataset_t nameservers; 7317 dns_fixedname_t fixed; 7318 dns_name_t *domain = NULL; 7319 unsigned int n; 7320 dns_fetch_t *fetch = NULL; 7321 7322 REQUIRE(VALID_FCTX(fctx)); 7323 7324 res = fctx->res; 7325 7326 REQUIRE(fctx->tid == isc_tid()); 7327 7328 FCTXTRACE("resume_dslookup"); 7329 7330 if (resp->node != NULL) { 7331 dns_db_detachnode(resp->db, &resp->node); 7332 } 7333 if (resp->db != NULL) { 7334 dns_db_detach(&resp->db); 7335 } 7336 7337 /* Preserve data from resp before freeing it. */ 7338 frdataset = resp->rdataset; /* a.k.a. fctx->nsrrset */ 7339 result = resp->result; 7340 7341 dns_resolver_freefresp(&resp); 7342 7343 LOCK(&fctx->lock); 7344 if (SHUTTINGDOWN(fctx)) { 7345 result = ISC_R_SHUTTINGDOWN; 7346 } 7347 UNLOCK(&fctx->lock); 7348 7349 fetch = fctx->nsfetch; 7350 fctx->nsfetch = NULL; 7351 7352 FTRACE("resume_dslookup"); 7353 7354 switch (result) { 7355 case ISC_R_SUCCESS: 7356 FCTXTRACE("resuming DS lookup"); 7357 7358 if (dns_rdataset_isassociated(&fctx->nameservers)) { 7359 dns_rdataset_disassociate(&fctx->nameservers); 7360 } 7361 dns_rdataset_clone(frdataset, &fctx->nameservers); 7362 7363 /* 7364 * Disassociate now the NS's are saved. 7365 */ 7366 if (dns_rdataset_isassociated(frdataset)) { 7367 dns_rdataset_disassociate(frdataset); 7368 } 7369 7370 fctx->ns_ttl = fctx->nameservers.ttl; 7371 fctx->ns_ttl_ok = true; 7372 log_ns_ttl(fctx, "resume_dslookup"); 7373 7374 fcount_decr(fctx); 7375 dns_name_copy(fctx->nsname, fctx->domain); 7376 result = fcount_incr(fctx, true); 7377 if (result != ISC_R_SUCCESS) { 7378 goto cleanup; 7379 } 7380 7381 /* Try again. */ 7382 fctx_try(fctx, true); 7383 break; 7384 7385 case ISC_R_SHUTTINGDOWN: 7386 case ISC_R_CANCELED: 7387 /* Don't try anymore. */ 7388 /* Can't be done in cleanup. */ 7389 if (dns_rdataset_isassociated(frdataset)) { 7390 dns_rdataset_disassociate(frdataset); 7391 } 7392 goto cleanup; 7393 7394 default: 7395 /* 7396 * Disassociate for the next dns_resolver_createfetch call. 7397 */ 7398 if (dns_rdataset_isassociated(frdataset)) { 7399 dns_rdataset_disassociate(frdataset); 7400 } 7401 7402 /* 7403 * If the chain of resume_dslookup() invocations managed to 7404 * chop off enough labels from the original DS owner name to 7405 * reach the top of the namespace, no further progress can be 7406 * made. Interrupt the DS chasing process, returning SERVFAIL. 7407 */ 7408 if (dns_name_equal(fctx->nsname, fetch->private->domain)) { 7409 result = DNS_R_SERVFAIL; 7410 goto cleanup; 7411 } 7412 7413 /* Get nameservers from fetch before we destroy it. */ 7414 dns_rdataset_init(&nameservers); 7415 if (dns_rdataset_isassociated(&fetch->private->nameservers)) { 7416 dns_rdataset_clone(&fetch->private->nameservers, 7417 &nameservers); 7418 nsrdataset = &nameservers; 7419 7420 /* Get domain from fetch before we destroy it. */ 7421 domain = dns_fixedname_initname(&fixed); 7422 dns_name_copy(fetch->private->domain, domain); 7423 } 7424 7425 n = dns_name_countlabels(fctx->nsname); 7426 dns_name_getlabelsequence(fctx->nsname, 1, n - 1, fctx->nsname); 7427 7428 FCTXTRACE("continuing to look for parent's NS records"); 7429 7430 fetchctx_ref(fctx); 7431 result = dns_resolver_createfetch( 7432 res, fctx->nsname, dns_rdatatype_ns, domain, nsrdataset, 7433 NULL, NULL, 0, fctx->options, 0, fctx->qc, fctx->gqc, 7434 fctx, loop, resume_dslookup, fctx, &fctx->edectx, 7435 &fctx->nsrrset, NULL, &fctx->nsfetch); 7436 if (result != ISC_R_SUCCESS) { 7437 fetchctx_unref(fctx); 7438 if (result == DNS_R_DUPLICATE) { 7439 result = DNS_R_SERVFAIL; 7440 } 7441 } 7442 7443 if (dns_rdataset_isassociated(&nameservers)) { 7444 dns_rdataset_disassociate(&nameservers); 7445 } 7446 } 7447 7448 cleanup: 7449 dns_resolver_destroyfetch(&fetch); 7450 7451 if (result != ISC_R_SUCCESS) { 7452 /* An error occurred, tear down whole fctx */ 7453 fctx_done_unref(fctx, result); 7454 } 7455 7456 fetchctx_detach(&fctx); 7457 } 7458 7459 static void 7460 checknamessection(dns_message_t *message, dns_section_t section) { 7461 isc_result_t result; 7462 dns_name_t *name; 7463 dns_rdata_t rdata = DNS_RDATA_INIT; 7464 dns_rdataset_t *rdataset; 7465 7466 for (result = dns_message_firstname(message, section); 7467 result == ISC_R_SUCCESS; 7468 result = dns_message_nextname(message, section)) 7469 { 7470 name = NULL; 7471 dns_message_currentname(message, section, &name); 7472 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 7473 rdataset = ISC_LIST_NEXT(rdataset, link)) 7474 { 7475 for (result = dns_rdataset_first(rdataset); 7476 result == ISC_R_SUCCESS; 7477 result = dns_rdataset_next(rdataset)) 7478 { 7479 dns_rdataset_current(rdataset, &rdata); 7480 if (!dns_rdata_checkowner(name, rdata.rdclass, 7481 rdata.type, false) || 7482 !dns_rdata_checknames(&rdata, name, NULL)) 7483 { 7484 rdataset->attributes |= 7485 DNS_RDATASETATTR_CHECKNAMES; 7486 } 7487 dns_rdata_reset(&rdata); 7488 } 7489 } 7490 } 7491 } 7492 7493 static void 7494 checknames(dns_message_t *message) { 7495 checknamessection(message, DNS_SECTION_ANSWER); 7496 checknamessection(message, DNS_SECTION_AUTHORITY); 7497 checknamessection(message, DNS_SECTION_ADDITIONAL); 7498 } 7499 7500 /* 7501 * Log server NSID at log level 'level' 7502 */ 7503 static void 7504 log_nsid(isc_buffer_t *opt, size_t nsid_len, resquery_t *query, int level, 7505 isc_mem_t *mctx) { 7506 static const char hex[17] = "0123456789abcdef"; 7507 char addrbuf[ISC_SOCKADDR_FORMATSIZE]; 7508 size_t buflen; 7509 unsigned char *p, *nsid; 7510 unsigned char *buf = NULL, *pbuf = NULL; 7511 7512 REQUIRE(nsid_len <= UINT16_MAX); 7513 7514 /* Allocate buffer for storing hex version of the NSID */ 7515 buflen = nsid_len * 2 + 1; 7516 buf = isc_mem_get(mctx, buflen); 7517 pbuf = isc_mem_get(mctx, nsid_len + 1); 7518 7519 /* Convert to hex */ 7520 p = buf; 7521 nsid = isc_buffer_current(opt); 7522 for (size_t i = 0; i < nsid_len; i++) { 7523 *p++ = hex[(nsid[i] >> 4) & 0xf]; 7524 *p++ = hex[nsid[i] & 0xf]; 7525 } 7526 *p = '\0'; 7527 7528 /* Make printable version */ 7529 p = pbuf; 7530 for (size_t i = 0; i < nsid_len; i++) { 7531 *p++ = isprint(nsid[i]) ? nsid[i] : '.'; 7532 } 7533 *p = '\0'; 7534 7535 isc_sockaddr_format(&query->addrinfo->sockaddr, addrbuf, 7536 sizeof(addrbuf)); 7537 isc_log_write(dns_lctx, DNS_LOGCATEGORY_NSID, DNS_LOGMODULE_RESOLVER, 7538 level, "received NSID %s (\"%s\") from %s", buf, pbuf, 7539 addrbuf); 7540 7541 isc_mem_put(mctx, pbuf, nsid_len + 1); 7542 isc_mem_put(mctx, buf, buflen); 7543 } 7544 7545 static bool 7546 iscname(dns_message_t *message, dns_name_t *name) { 7547 isc_result_t result; 7548 7549 result = dns_message_findname(message, DNS_SECTION_ANSWER, name, 7550 dns_rdatatype_cname, 0, NULL, NULL); 7551 return result == ISC_R_SUCCESS ? true : false; 7552 } 7553 7554 static bool 7555 betterreferral(respctx_t *rctx) { 7556 isc_result_t result; 7557 dns_name_t *name; 7558 dns_rdataset_t *rdataset; 7559 7560 for (result = dns_message_firstname(rctx->query->rmessage, 7561 DNS_SECTION_AUTHORITY); 7562 result == ISC_R_SUCCESS; 7563 result = dns_message_nextname(rctx->query->rmessage, 7564 DNS_SECTION_AUTHORITY)) 7565 { 7566 name = NULL; 7567 dns_message_currentname(rctx->query->rmessage, 7568 DNS_SECTION_AUTHORITY, &name); 7569 if (!isstrictsubdomain(name, rctx->fctx->domain)) { 7570 continue; 7571 } 7572 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 7573 rdataset = ISC_LIST_NEXT(rdataset, link)) 7574 { 7575 if (rdataset->type == dns_rdatatype_ns) { 7576 return true; 7577 } 7578 } 7579 } 7580 return false; 7581 } 7582 7583 /* 7584 * Handles responses received in response to iterative queries sent by 7585 * resquery_send(). Sets up a response context (respctx_t). 7586 */ 7587 static void 7588 resquery_response(isc_result_t eresult, isc_region_t *region, void *arg) { 7589 isc_result_t result; 7590 resquery_t *query = (resquery_t *)arg; 7591 fetchctx_t *fctx = NULL; 7592 respctx_t *rctx = NULL; 7593 7594 if (eresult == ISC_R_CANCELED) { 7595 return; 7596 } 7597 7598 REQUIRE(VALID_QUERY(query)); 7599 fctx = query->fctx; 7600 REQUIRE(VALID_FCTX(fctx)); 7601 REQUIRE(fctx->tid == isc_tid()); 7602 7603 QTRACE("response"); 7604 7605 if (eresult == ISC_R_SUCCESS) { 7606 if (isc_sockaddr_pf(&query->addrinfo->sockaddr) == PF_INET) { 7607 inc_stats(fctx->res, dns_resstatscounter_responsev4); 7608 } else { 7609 inc_stats(fctx->res, dns_resstatscounter_responsev6); 7610 } 7611 } 7612 7613 rctx = isc_mem_get(fctx->mctx, sizeof(*rctx)); 7614 rctx_respinit(query, fctx, eresult, region, rctx); 7615 7616 if (eresult == ISC_R_SHUTTINGDOWN || 7617 atomic_load_acquire(&fctx->res->exiting)) 7618 { 7619 result = ISC_R_SHUTTINGDOWN; 7620 FCTXTRACE("resolver shutting down"); 7621 rctx->finish = NULL; 7622 rctx_done(rctx, result); 7623 goto cleanup; 7624 } 7625 7626 result = rctx_timedout(rctx); 7627 if (result == ISC_R_COMPLETE) { 7628 goto cleanup; 7629 } 7630 7631 fctx->addrinfo = query->addrinfo; 7632 fctx->timeout = false; 7633 fctx->timeouts = 0; 7634 7635 /* 7636 * Check whether the dispatcher has failed; if so we're done 7637 */ 7638 result = rctx_dispfail(rctx); 7639 if (result == ISC_R_COMPLETE) { 7640 goto cleanup; 7641 } 7642 7643 if (query->tsig != NULL) { 7644 dns_message_setquerytsig(query->rmessage, query->tsig); 7645 } 7646 7647 if (query->tsigkey != NULL) { 7648 result = dns_message_settsigkey(query->rmessage, 7649 query->tsigkey); 7650 if (result != ISC_R_SUCCESS) { 7651 FCTXTRACE3("unable to set tsig key", result); 7652 rctx_done(rctx, result); 7653 goto cleanup; 7654 } 7655 } 7656 7657 dns_message_setclass(query->rmessage, fctx->res->rdclass); 7658 7659 if ((rctx->retryopts & DNS_FETCHOPT_TCP) == 0) { 7660 if ((rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0) { 7661 dns_adb_setudpsize( 7662 fctx->adb, query->addrinfo, 7663 isc_buffer_usedlength(&rctx->buffer)); 7664 } else { 7665 dns_adb_plainresponse(fctx->adb, query->addrinfo); 7666 } 7667 } 7668 7669 /* 7670 * Parse response message. 7671 */ 7672 result = rctx_parse(rctx); 7673 if (result == ISC_R_COMPLETE) { 7674 goto cleanup; 7675 } 7676 7677 /* 7678 * Log the incoming packet. 7679 */ 7680 rctx_logpacket(rctx); 7681 7682 if (query->rmessage->rdclass != fctx->res->rdclass) { 7683 rctx->resend = true; 7684 FCTXTRACE("bad class"); 7685 rctx_done(rctx, result); 7686 goto cleanup; 7687 } 7688 7689 /* 7690 * Process receive opt record. 7691 */ 7692 rctx->opt = dns_message_getopt(query->rmessage); 7693 if (rctx->opt != NULL) { 7694 rctx_opt(rctx); 7695 } 7696 7697 if (query->rmessage->cc_bad && 7698 (rctx->retryopts & DNS_FETCHOPT_TCP) == 0) 7699 { 7700 /* 7701 * If the COOKIE is bad, assume it is an attack and 7702 * keep listening for a good answer. 7703 */ 7704 rctx->nextitem = true; 7705 if (isc_log_wouldlog(dns_lctx, ISC_LOG_INFO)) { 7706 char addrbuf[ISC_SOCKADDR_FORMATSIZE]; 7707 isc_sockaddr_format(&query->addrinfo->sockaddr, addrbuf, 7708 sizeof(addrbuf)); 7709 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 7710 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 7711 "bad cookie from %s", addrbuf); 7712 } 7713 rctx_done(rctx, result); 7714 goto cleanup; 7715 } 7716 7717 /* 7718 * Is the question the same as the one we asked? 7719 * NOERROR/NXDOMAIN/YXDOMAIN/REFUSED/SERVFAIL/BADCOOKIE must 7720 * have the same question. FORMERR/NOTIMP if they have a 7721 * question section then it must match. 7722 */ 7723 switch (query->rmessage->rcode) { 7724 case dns_rcode_notimp: 7725 case dns_rcode_formerr: 7726 if (query->rmessage->counts[DNS_SECTION_QUESTION] == 0) { 7727 break; 7728 } 7729 FALLTHROUGH; 7730 case dns_rcode_nxrrset: /* Not expected. */ 7731 case dns_rcode_badcookie: 7732 case dns_rcode_noerror: 7733 case dns_rcode_nxdomain: 7734 case dns_rcode_yxdomain: 7735 case dns_rcode_refused: 7736 case dns_rcode_servfail: 7737 default: 7738 result = same_question(fctx, query->rmessage); 7739 if (result != ISC_R_SUCCESS) { 7740 FCTXTRACE3("question section invalid", result); 7741 rctx->nextitem = true; 7742 rctx_done(rctx, result); 7743 goto cleanup; 7744 } 7745 break; 7746 } 7747 7748 if (query->rmessage->tsigkey == NULL && query->rmessage->tsig == NULL && 7749 query->rmessage->sig0 != NULL) 7750 { 7751 /* 7752 * If the message is not TSIG-signed (which has priorty) and is 7753 * SIG(0)-signed (which consumes more resources), then run an 7754 * asynchronous check. 7755 */ 7756 result = dns_message_checksig_async( 7757 query->rmessage, fctx->res->view, fctx->loop, 7758 resquery_response_continue, rctx); 7759 INSIST(result == DNS_R_WAIT); 7760 } else { 7761 /* 7762 * If the message is signed, check the signature. If not, this 7763 * returns success anyway. 7764 */ 7765 result = dns_message_checksig(query->rmessage, fctx->res->view); 7766 resquery_response_continue(rctx, result); 7767 } 7768 7769 return; 7770 7771 cleanup: 7772 resquery_detach(&rctx->query); 7773 isc_mem_putanddetach(&rctx->mctx, rctx, sizeof(*rctx)); 7774 } 7775 7776 static isc_result_t 7777 rctx_cookiecheck(respctx_t *rctx) { 7778 fetchctx_t *fctx = rctx->fctx; 7779 resquery_t *query = rctx->query; 7780 7781 /* 7782 * If the message was secured or TCP is already in the 7783 * retry flags, no need to continue. 7784 */ 7785 if (rctx->secured || (rctx->retryopts & DNS_FETCHOPT_TCP) != 0) { 7786 return ISC_R_SUCCESS; 7787 } 7788 7789 /* 7790 * If we've had a cookie from the same server previously, 7791 * retry with TCP. This may be a misconfigured anycast server 7792 * or an attempt to send a spoofed response. 7793 */ 7794 if (dns_adb_getcookie(query->addrinfo, NULL, 0) > CLIENT_COOKIE_SIZE) { 7795 if (isc_log_wouldlog(dns_lctx, ISC_LOG_INFO)) { 7796 char addrbuf[ISC_SOCKADDR_FORMATSIZE]; 7797 isc_sockaddr_format(&query->addrinfo->sockaddr, addrbuf, 7798 sizeof(addrbuf)); 7799 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 7800 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 7801 "missing expected cookie from %s", 7802 addrbuf); 7803 } 7804 rctx->retryopts |= DNS_FETCHOPT_TCP; 7805 rctx->resend = true; 7806 rctx_done(rctx, ISC_R_SUCCESS); 7807 return ISC_R_COMPLETE; 7808 } 7809 7810 /* 7811 * Retry over TCP if require-cookie is true. 7812 */ 7813 if (fctx->res->view->peers != NULL) { 7814 isc_result_t result; 7815 dns_peer_t *peer = NULL; 7816 bool required = false; 7817 isc_netaddr_t netaddr; 7818 7819 isc_netaddr_fromsockaddr(&netaddr, &query->addrinfo->sockaddr); 7820 result = dns_peerlist_peerbyaddr(fctx->res->view->peers, 7821 &netaddr, &peer); 7822 if (result == ISC_R_SUCCESS) { 7823 dns_peer_getrequirecookie(peer, &required); 7824 } 7825 if (!required) { 7826 return ISC_R_SUCCESS; 7827 } 7828 7829 if (isc_log_wouldlog(dns_lctx, ISC_LOG_INFO)) { 7830 char addrbuf[ISC_SOCKADDR_FORMATSIZE]; 7831 isc_sockaddr_format(&query->addrinfo->sockaddr, addrbuf, 7832 sizeof(addrbuf)); 7833 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 7834 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 7835 "missing required cookie from %s", 7836 addrbuf); 7837 } 7838 7839 rctx->retryopts |= DNS_FETCHOPT_TCP; 7840 rctx->resend = true; 7841 rctx_done(rctx, ISC_R_SUCCESS); 7842 return ISC_R_COMPLETE; 7843 } 7844 7845 return ISC_R_SUCCESS; 7846 } 7847 7848 static bool 7849 rctx_need_tcpretry(respctx_t *rctx) { 7850 resquery_t *query = rctx->query; 7851 if ((rctx->retryopts & DNS_FETCHOPT_TCP) != 0) { 7852 /* TCP is already in the retry flags */ 7853 return false; 7854 } 7855 7856 /* 7857 * If the message was secured, no need to continue. 7858 */ 7859 if (rctx->secured) { 7860 return false; 7861 } 7862 7863 /* 7864 * Currently the only extra reason why we might need to 7865 * retry a UDP response over TCP is a DNAME in the message. 7866 */ 7867 if (dns_message_hasdname(query->rmessage)) { 7868 return true; 7869 } 7870 7871 return false; 7872 } 7873 7874 static isc_result_t 7875 rctx_tcpretry(respctx_t *rctx) { 7876 /* 7877 * Do we need to retry a UDP response over TCP? 7878 */ 7879 if (rctx_need_tcpretry(rctx)) { 7880 rctx->retryopts |= DNS_FETCHOPT_TCP; 7881 rctx->resend = true; 7882 rctx_done(rctx, ISC_R_SUCCESS); 7883 return ISC_R_COMPLETE; 7884 } 7885 7886 return ISC_R_SUCCESS; 7887 } 7888 7889 static void 7890 resquery_response_continue(void *arg, isc_result_t result) { 7891 respctx_t *rctx = arg; 7892 fetchctx_t *fctx = rctx->fctx; 7893 resquery_t *query = rctx->query; 7894 7895 if (result != ISC_R_SUCCESS) { 7896 FCTXTRACE3("signature check failed", result); 7897 if (result == DNS_R_UNEXPECTEDTSIG || 7898 result == DNS_R_EXPECTEDTSIG) 7899 { 7900 rctx->nextitem = true; 7901 } 7902 rctx_done(rctx, result); 7903 goto cleanup; 7904 } 7905 7906 /* 7907 * Remember whether this message was signed or had a 7908 * valid client cookie; if not, we may need to retry over 7909 * TCP later. 7910 */ 7911 if (query->rmessage->cc_ok || query->rmessage->tsig != NULL || 7912 query->rmessage->sig0 != NULL) 7913 { 7914 rctx->secured = true; 7915 } 7916 7917 /* 7918 * The dispatcher should ensure we only get responses with QR 7919 * set. 7920 */ 7921 INSIST((query->rmessage->flags & DNS_MESSAGEFLAG_QR) != 0); 7922 7923 /* 7924 * Check for cookie issues; if found, maybe retry over TCP. 7925 */ 7926 result = rctx_cookiecheck(rctx); 7927 if (result == ISC_R_COMPLETE) { 7928 goto cleanup; 7929 } 7930 7931 /* 7932 * Check whether we need to retry over TCP for some other reason. 7933 */ 7934 result = rctx_tcpretry(rctx); 7935 if (result == ISC_R_COMPLETE) { 7936 goto cleanup; 7937 } 7938 7939 /* 7940 * Check for EDNS issues. 7941 */ 7942 rctx_edns(rctx); 7943 7944 /* 7945 * Deal with truncated responses by retrying using TCP. 7946 */ 7947 if ((query->rmessage->flags & DNS_MESSAGEFLAG_TC) != 0) { 7948 rctx->truncated = true; 7949 } 7950 7951 if (rctx->truncated) { 7952 inc_stats(fctx->res, dns_resstatscounter_truncated); 7953 if ((rctx->retryopts & DNS_FETCHOPT_TCP) != 0) { 7954 rctx->broken_server = DNS_R_TRUNCATEDTCP; 7955 rctx->next_server = true; 7956 } else { 7957 rctx->retryopts |= DNS_FETCHOPT_TCP; 7958 rctx->resend = true; 7959 } 7960 FCTXTRACE3("message truncated", result); 7961 rctx_done(rctx, result); 7962 goto cleanup; 7963 } 7964 7965 /* 7966 * Is it a query response? 7967 */ 7968 if (query->rmessage->opcode != dns_opcode_query) { 7969 rctx->broken_server = DNS_R_UNEXPECTEDOPCODE; 7970 rctx->next_server = true; 7971 FCTXTRACE("invalid message opcode"); 7972 rctx_done(rctx, result); 7973 goto cleanup; 7974 } 7975 7976 /* 7977 * Update statistics about erroneous responses. 7978 */ 7979 switch (query->rmessage->rcode) { 7980 case dns_rcode_noerror: 7981 /* no error */ 7982 break; 7983 case dns_rcode_nxdomain: 7984 inc_stats(fctx->res, dns_resstatscounter_nxdomain); 7985 break; 7986 case dns_rcode_servfail: 7987 inc_stats(fctx->res, dns_resstatscounter_servfail); 7988 break; 7989 case dns_rcode_formerr: 7990 inc_stats(fctx->res, dns_resstatscounter_formerr); 7991 break; 7992 case dns_rcode_refused: 7993 inc_stats(fctx->res, dns_resstatscounter_refused); 7994 break; 7995 case dns_rcode_badvers: 7996 inc_stats(fctx->res, dns_resstatscounter_badvers); 7997 break; 7998 case dns_rcode_badcookie: 7999 inc_stats(fctx->res, dns_resstatscounter_badcookie); 8000 break; 8001 default: 8002 inc_stats(fctx->res, dns_resstatscounter_othererror); 8003 break; 8004 } 8005 8006 /* 8007 * Bad server? 8008 */ 8009 result = rctx_badserver(rctx, result); 8010 if (result == ISC_R_COMPLETE) { 8011 goto cleanup; 8012 } 8013 8014 /* 8015 * Lame server? 8016 */ 8017 result = rctx_lameserver(rctx); 8018 if (result == ISC_R_COMPLETE) { 8019 goto cleanup; 8020 } 8021 8022 /* 8023 * Optionally call dns_rdata_checkowner() and 8024 * dns_rdata_checknames() to validate the names in the response 8025 * message. 8026 */ 8027 if ((fctx->res->options & DNS_RESOLVER_CHECKNAMES) != 0) { 8028 checknames(query->rmessage); 8029 } 8030 8031 /* 8032 * Clear cache bits. 8033 */ 8034 FCTX_ATTR_CLR(fctx, FCTX_ATTR_WANTNCACHE | FCTX_ATTR_WANTCACHE); 8035 8036 /* 8037 * Did we get any answers? 8038 */ 8039 if (query->rmessage->counts[DNS_SECTION_ANSWER] > 0 && 8040 (query->rmessage->rcode == dns_rcode_noerror || 8041 query->rmessage->rcode == dns_rcode_yxdomain || 8042 query->rmessage->rcode == dns_rcode_nxdomain)) 8043 { 8044 result = rctx_answer(rctx); 8045 if (result == ISC_R_COMPLETE) { 8046 goto cleanup; 8047 } 8048 } else if (query->rmessage->counts[DNS_SECTION_AUTHORITY] > 0 || 8049 query->rmessage->rcode == dns_rcode_noerror || 8050 query->rmessage->rcode == dns_rcode_nxdomain) 8051 { 8052 /* 8053 * This might be an NXDOMAIN, NXRRSET, or referral. 8054 * Call rctx_answer_none() to determine which it is. 8055 */ 8056 result = rctx_answer_none(rctx); 8057 switch (result) { 8058 case ISC_R_SUCCESS: 8059 case DNS_R_CHASEDSSERVERS: 8060 break; 8061 case DNS_R_DELEGATION: 8062 /* 8063 * With NOFOLLOW we want to pass return 8064 * DNS_R_DELEGATION to resume_qmin. 8065 */ 8066 if ((fctx->options & DNS_FETCHOPT_NOFOLLOW) == 0) { 8067 result = ISC_R_SUCCESS; 8068 } 8069 break; 8070 default: 8071 /* 8072 * Something has gone wrong. 8073 */ 8074 if (result == DNS_R_FORMERR) { 8075 rctx->next_server = true; 8076 } 8077 FCTXTRACE3("rctx_answer_none", result); 8078 rctx_done(rctx, result); 8079 goto cleanup; 8080 } 8081 } else { 8082 /* 8083 * The server is insane. 8084 */ 8085 /* XXXRTH Log */ 8086 rctx->broken_server = DNS_R_UNEXPECTEDRCODE; 8087 rctx->next_server = true; 8088 FCTXTRACE("broken server: unexpected rcode"); 8089 rctx_done(rctx, result); 8090 goto cleanup; 8091 } 8092 8093 /* 8094 * Follow additional section data chains. 8095 */ 8096 rctx_additional(rctx); 8097 8098 /* 8099 * Cache the cacheable parts of the message. This may also 8100 * cause work to be queued to the DNSSEC validator. 8101 */ 8102 if (WANTCACHE(fctx)) { 8103 isc_result_t tresult; 8104 tresult = cache_message(fctx, query->rmessage, query->addrinfo, 8105 rctx->now); 8106 if (tresult != ISC_R_SUCCESS) { 8107 FCTXTRACE3("cache_message complete", tresult); 8108 rctx_done(rctx, tresult); 8109 goto cleanup; 8110 } 8111 } 8112 8113 /* 8114 * Negative caching 8115 */ 8116 rctx_ncache(rctx); 8117 8118 FCTXTRACE("resquery_response done"); 8119 rctx_done(rctx, result); 8120 8121 cleanup: 8122 resquery_detach(&rctx->query); 8123 isc_mem_putanddetach(&rctx->mctx, rctx, sizeof(*rctx)); 8124 } 8125 8126 /* 8127 * rctx_respinit(): 8128 * Initialize the response context structure 'rctx' to all zeroes, then 8129 * set the loop, event, query and fctx information from 8130 * resquery_response(). 8131 */ 8132 static void 8133 rctx_respinit(resquery_t *query, fetchctx_t *fctx, isc_result_t result, 8134 isc_region_t *region, respctx_t *rctx) { 8135 *rctx = (respctx_t){ .result = result, 8136 .query = resquery_ref(query), 8137 .fctx = fctx, 8138 .broken_type = badns_response, 8139 .retryopts = query->options }; 8140 if (result == ISC_R_SUCCESS) { 8141 REQUIRE(region != NULL); 8142 isc_buffer_init(&rctx->buffer, region->base, region->length); 8143 isc_buffer_add(&rctx->buffer, region->length); 8144 } else { 8145 isc_buffer_initnull(&rctx->buffer); 8146 } 8147 rctx->tnow = isc_time_now(); 8148 rctx->finish = &rctx->tnow; 8149 rctx->now = (isc_stdtime_t)isc_time_seconds(&rctx->tnow); 8150 isc_mem_attach(fctx->mctx, &rctx->mctx); 8151 } 8152 8153 /* 8154 * rctx_answer_init(): 8155 * Clear and reinitialize those portions of 'rctx' that will be needed 8156 * when scanning the answer section of the response message. This can be 8157 * called more than once if scanning needs to be restarted (though 8158 * currently there are no cases in which this occurs). 8159 */ 8160 static void 8161 rctx_answer_init(respctx_t *rctx) { 8162 fetchctx_t *fctx = rctx->fctx; 8163 8164 rctx->aa = ((rctx->query->rmessage->flags & DNS_MESSAGEFLAG_AA) != 0); 8165 if (rctx->aa) { 8166 rctx->trust = dns_trust_authanswer; 8167 } else { 8168 rctx->trust = dns_trust_answer; 8169 } 8170 8171 /* 8172 * There can be multiple RRSIG and SIG records at a name so 8173 * we treat these types as a subset of ANY. 8174 */ 8175 rctx->type = fctx->type; 8176 if (rctx->type == dns_rdatatype_rrsig || 8177 rctx->type == dns_rdatatype_sig) 8178 { 8179 rctx->type = dns_rdatatype_any; 8180 } 8181 8182 /* 8183 * Bigger than any valid DNAME label count. 8184 */ 8185 rctx->dname_labels = dns_name_countlabels(fctx->name); 8186 rctx->domain_labels = dns_name_countlabels(fctx->domain); 8187 8188 rctx->found_type = dns_rdatatype_none; 8189 8190 rctx->aname = NULL; 8191 rctx->ardataset = NULL; 8192 8193 rctx->cname = NULL; 8194 rctx->crdataset = NULL; 8195 8196 rctx->dname = NULL; 8197 rctx->drdataset = NULL; 8198 8199 rctx->ns_name = NULL; 8200 rctx->ns_rdataset = NULL; 8201 8202 rctx->soa_name = NULL; 8203 rctx->ds_name = NULL; 8204 rctx->found_name = NULL; 8205 } 8206 8207 /* 8208 * rctx_dispfail(): 8209 * Handle the case where the dispatcher failed 8210 */ 8211 static isc_result_t 8212 rctx_dispfail(respctx_t *rctx) { 8213 fetchctx_t *fctx = rctx->fctx; 8214 8215 if (rctx->result == ISC_R_SUCCESS) { 8216 return ISC_R_SUCCESS; 8217 } 8218 8219 /* 8220 * There's no hope for this response. 8221 */ 8222 rctx->next_server = true; 8223 8224 /* 8225 * If this is a network failure, the operation is cancelled, 8226 * or the network manager is being shut down, we mark the server 8227 * as bad so that we won't try it for this fetch again. Also 8228 * adjust finish and no_response so that we penalize this 8229 * address in SRTT adjustments later. 8230 */ 8231 switch (rctx->result) { 8232 case ISC_R_EOF: 8233 case ISC_R_HOSTDOWN: 8234 case ISC_R_HOSTUNREACH: 8235 case ISC_R_NETDOWN: 8236 case ISC_R_NETUNREACH: 8237 case ISC_R_CONNREFUSED: 8238 case ISC_R_CONNECTIONRESET: 8239 case ISC_R_INVALIDPROTO: 8240 case ISC_R_CANCELED: 8241 case ISC_R_SHUTTINGDOWN: 8242 rctx->broken_server = rctx->result; 8243 rctx->broken_type = badns_unreachable; 8244 rctx->finish = NULL; 8245 rctx->no_response = true; 8246 break; 8247 case DNS_R_MISMATCH: 8248 /* 8249 * The dispatcher saw a UDP response from the expected peer with 8250 * the wrong DNS message id. Retry the same query over TCP. 8251 */ 8252 if ((rctx->retryopts & DNS_FETCHOPT_TCP) == 0) { 8253 rctx->retryopts |= DNS_FETCHOPT_TCP; 8254 rctx->resend = true; 8255 rctx->next_server = false; 8256 inc_stats(fctx->res, dns_resstatscounter_mismatchtcp); 8257 FCTXTRACE3("mismatched response; retrying over TCP", 8258 rctx->result); 8259 rctx_done(rctx, ISC_R_SUCCESS); 8260 return ISC_R_COMPLETE; 8261 } 8262 break; 8263 default: 8264 break; 8265 } 8266 8267 FCTXTRACE3("dispatcher failure", rctx->result); 8268 rctx_done(rctx, ISC_R_SUCCESS); 8269 return ISC_R_COMPLETE; 8270 } 8271 8272 /* 8273 * rctx_timedout(): 8274 * Handle the case where a dispatch read timed out. 8275 */ 8276 static isc_result_t 8277 rctx_timedout(respctx_t *rctx) { 8278 fetchctx_t *fctx = rctx->fctx; 8279 8280 if (rctx->result == ISC_R_TIMEDOUT) { 8281 isc_time_t now; 8282 8283 inc_stats(fctx->res, dns_resstatscounter_querytimeout); 8284 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 8285 fctx->timeout = true; 8286 fctx->timeouts++; 8287 8288 rctx->no_response = true; 8289 rctx->finish = NULL; 8290 8291 now = isc_time_now(); 8292 /* netmgr timeouts are accurate to the millisecond */ 8293 if (isc_time_microdiff(&fctx->expires, &now) < US_PER_MS) { 8294 FCTXTRACE("query timed out; stopped trying to make " 8295 "fetch happen"); 8296 dns_ede_add(&fctx->edectx, DNS_EDE_NOREACHABLEAUTH, 8297 NULL); 8298 } else { 8299 FCTXTRACE("query timed out; trying next server"); 8300 /* try next server */ 8301 rctx->next_server = true; 8302 } 8303 8304 rctx_done(rctx, rctx->result); 8305 return ISC_R_COMPLETE; 8306 } 8307 8308 return ISC_R_SUCCESS; 8309 } 8310 8311 /* 8312 * rctx_parse(): 8313 * Parse the response message. 8314 */ 8315 static isc_result_t 8316 rctx_parse(respctx_t *rctx) { 8317 isc_result_t result; 8318 fetchctx_t *fctx = rctx->fctx; 8319 resquery_t *query = rctx->query; 8320 8321 result = dns_message_parse(query->rmessage, &rctx->buffer, 0); 8322 if (result == ISC_R_SUCCESS) { 8323 return ISC_R_SUCCESS; 8324 } 8325 8326 FCTXTRACE3("message failed to parse", result); 8327 8328 switch (result) { 8329 case ISC_R_UNEXPECTEDEND: 8330 if (query->rmessage->question_ok && 8331 (query->rmessage->flags & DNS_MESSAGEFLAG_TC) != 0 && 8332 (rctx->retryopts & DNS_FETCHOPT_TCP) == 0) 8333 { 8334 /* 8335 * We defer retrying via TCP for a bit so we can 8336 * check out this message further. 8337 */ 8338 rctx->truncated = true; 8339 return ISC_R_SUCCESS; 8340 } 8341 8342 /* 8343 * Either the message ended prematurely, 8344 * and/or wasn't marked as being truncated, 8345 * and/or this is a response to a query we 8346 * sent over TCP. In all of these cases, 8347 * something is wrong with the remote 8348 * server and we don't want to retry using 8349 * TCP. 8350 */ 8351 if ((rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0) { 8352 /* 8353 * The problem might be that they 8354 * don't understand EDNS0. Turn it 8355 * off and try again. 8356 */ 8357 rctx->retryopts |= DNS_FETCHOPT_NOEDNS0; 8358 rctx->resend = true; 8359 inc_stats(fctx->res, dns_resstatscounter_edns0fail); 8360 } else { 8361 rctx->broken_server = result; 8362 rctx->next_server = true; 8363 } 8364 8365 rctx_done(rctx, result); 8366 break; 8367 case DNS_R_FORMERR: 8368 if ((rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0) { 8369 /* 8370 * The problem might be that they 8371 * don't understand EDNS0. Turn it 8372 * off and try again. 8373 */ 8374 rctx->retryopts |= DNS_FETCHOPT_NOEDNS0; 8375 rctx->resend = true; 8376 inc_stats(fctx->res, dns_resstatscounter_edns0fail); 8377 } else { 8378 rctx->broken_server = DNS_R_UNEXPECTEDRCODE; 8379 rctx->next_server = true; 8380 } 8381 8382 rctx_done(rctx, result); 8383 break; 8384 default: 8385 /* 8386 * Something bad has happened. 8387 */ 8388 rctx_done(rctx, result); 8389 break; 8390 } 8391 8392 return ISC_R_COMPLETE; 8393 } 8394 8395 /* 8396 * rctx_opt(): 8397 * Process the OPT record in the response. 8398 */ 8399 static void 8400 rctx_opt(respctx_t *rctx) { 8401 resquery_t *query = rctx->query; 8402 fetchctx_t *fctx = rctx->fctx; 8403 dns_rdata_t rdata; 8404 isc_buffer_t optbuf; 8405 isc_result_t result; 8406 bool seen_cookie = false; 8407 bool seen_nsid = false; 8408 8409 result = dns_rdataset_first(rctx->opt); 8410 if (result != ISC_R_SUCCESS) { 8411 return; 8412 } 8413 8414 dns_rdata_init(&rdata); 8415 dns_rdataset_current(rctx->opt, &rdata); 8416 isc_buffer_init(&optbuf, rdata.data, rdata.length); 8417 isc_buffer_add(&optbuf, rdata.length); 8418 8419 while (isc_buffer_remaininglength(&optbuf) >= 4) { 8420 uint16_t optcode; 8421 uint16_t optlen; 8422 unsigned char *optvalue; 8423 unsigned char cookie[CLIENT_COOKIE_SIZE]; 8424 optcode = isc_buffer_getuint16(&optbuf); 8425 optlen = isc_buffer_getuint16(&optbuf); 8426 INSIST(optlen <= isc_buffer_remaininglength(&optbuf)); 8427 switch (optcode) { 8428 case DNS_OPT_NSID: 8429 if (seen_nsid) { 8430 break; 8431 } 8432 seen_nsid = true; 8433 8434 if ((query->options & DNS_FETCHOPT_WANTNSID) != 0) { 8435 log_nsid(&optbuf, optlen, query, ISC_LOG_INFO, 8436 fctx->mctx); 8437 } 8438 break; 8439 case DNS_OPT_COOKIE: 8440 /* Only process the first cookie option. */ 8441 if (seen_cookie) { 8442 break; 8443 } 8444 seen_cookie = true; 8445 8446 optvalue = isc_buffer_current(&optbuf); 8447 compute_cc(query, cookie, sizeof(cookie)); 8448 INSIST(query->rmessage->cc_bad == 0 && 8449 query->rmessage->cc_ok == 0); 8450 8451 inc_stats(fctx->res, dns_resstatscounter_cookiein); 8452 8453 if (optlen < CLIENT_COOKIE_SIZE || 8454 memcmp(cookie, optvalue, CLIENT_COOKIE_SIZE) != 0) 8455 { 8456 query->rmessage->cc_bad = 1; 8457 break; 8458 } 8459 8460 /* Cookie OK */ 8461 if (optlen == CLIENT_COOKIE_SIZE) { 8462 query->rmessage->cc_echoed = 1; 8463 } else { 8464 query->rmessage->cc_ok = 1; 8465 inc_stats(fctx->res, 8466 dns_resstatscounter_cookieok); 8467 dns_adb_setcookie(fctx->adb, query->addrinfo, 8468 optvalue, optlen); 8469 } 8470 break; 8471 default: 8472 break; 8473 } 8474 isc_buffer_forward(&optbuf, optlen); 8475 } 8476 INSIST(isc_buffer_remaininglength(&optbuf) == 0U); 8477 } 8478 8479 /* 8480 * rctx_edns(): 8481 * Determine whether the remote server is using EDNS correctly or 8482 * incorrectly and record that information if needed. 8483 */ 8484 static void 8485 rctx_edns(respctx_t *rctx) { 8486 resquery_t *query = rctx->query; 8487 fetchctx_t *fctx = rctx->fctx; 8488 8489 /* 8490 * If we get a non error EDNS response record the fact so we 8491 * won't fallback to plain DNS in the future for this server. 8492 */ 8493 if (rctx->opt != NULL && !EDNSOK(query->addrinfo) && 8494 (rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0 && 8495 (query->rmessage->rcode == dns_rcode_noerror || 8496 query->rmessage->rcode == dns_rcode_nxdomain || 8497 query->rmessage->rcode == dns_rcode_refused || 8498 query->rmessage->rcode == dns_rcode_yxdomain)) 8499 { 8500 dns_adb_changeflags(fctx->adb, query->addrinfo, 8501 FCTX_ADDRINFO_EDNSOK, FCTX_ADDRINFO_EDNSOK); 8502 } 8503 } 8504 8505 /* 8506 * rctx_answer(): 8507 * We might have answers, or we might have a malformed delegation with 8508 * records in the answer section. Call rctx_answer_positive() or 8509 * rctx_answer_none() as appropriate. 8510 */ 8511 static isc_result_t 8512 rctx_answer(respctx_t *rctx) { 8513 isc_result_t result; 8514 fetchctx_t *fctx = rctx->fctx; 8515 resquery_t *query = rctx->query; 8516 8517 if ((query->rmessage->flags & DNS_MESSAGEFLAG_AA) != 0 || 8518 ISFORWARDER(query->addrinfo)) 8519 { 8520 result = rctx_answer_positive(rctx); 8521 if (result != ISC_R_SUCCESS) { 8522 FCTXTRACE3("rctx_answer_positive (AA/fwd)", result); 8523 } 8524 } else if (iscname(query->rmessage, fctx->name) && 8525 fctx->type != dns_rdatatype_any && 8526 fctx->type != dns_rdatatype_cname) 8527 { 8528 /* 8529 * A BIND8 server could return a non-authoritative 8530 * answer when a CNAME is followed. We should treat 8531 * it as a valid answer. 8532 */ 8533 result = rctx_answer_positive(rctx); 8534 if (result != ISC_R_SUCCESS) { 8535 FCTXTRACE3("rctx_answer_positive (!ANY/!CNAME)", 8536 result); 8537 } 8538 } else if (fctx->type != dns_rdatatype_ns && !betterreferral(rctx)) { 8539 result = rctx_answer_positive(rctx); 8540 if (result != ISC_R_SUCCESS) { 8541 FCTXTRACE3("rctx_answer_positive (!NS)", result); 8542 } 8543 } else { 8544 /* 8545 * This may be a delegation. First let's check for 8546 */ 8547 8548 if (fctx->type == dns_rdatatype_ns) { 8549 /* 8550 * A BIND 8 server could incorrectly return a 8551 * non-authoritative answer to an NS query 8552 * instead of a referral. Since this answer 8553 * lacks the SIGs necessary to do DNSSEC 8554 * validation, we must invoke the following 8555 * special kludge to treat it as a referral. 8556 */ 8557 rctx->ns_in_answer = true; 8558 result = rctx_answer_none(rctx); 8559 if (result != ISC_R_SUCCESS) { 8560 FCTXTRACE3("rctx_answer_none (NS)", result); 8561 } 8562 } else { 8563 /* 8564 * Some other servers may still somehow include 8565 * an answer when it should return a referral 8566 * with an empty answer. Check to see if we can 8567 * treat this as a referral by ignoring the 8568 * answer. Further more, there may be an 8569 * implementation that moves A/AAAA glue records 8570 * to the answer section for that type of 8571 * delegation when the query is for that glue 8572 * record. glue_in_answer will handle 8573 * such a corner case. 8574 */ 8575 rctx->glue_in_answer = true; 8576 result = rctx_answer_none(rctx); 8577 if (result != ISC_R_SUCCESS) { 8578 FCTXTRACE3("rctx_answer_none", result); 8579 } 8580 } 8581 8582 if (result == DNS_R_DELEGATION) { 8583 /* 8584 * With NOFOLLOW we want to return DNS_R_DELEGATION to 8585 * resume_qmin. 8586 */ 8587 if ((rctx->fctx->options & DNS_FETCHOPT_NOFOLLOW) != 0) 8588 { 8589 return result; 8590 } 8591 result = ISC_R_SUCCESS; 8592 } else { 8593 /* 8594 * At this point, AA is not set, the response 8595 * is not a referral, and the server is not a 8596 * forwarder. It is technically lame and it's 8597 * easier to treat it as such than to figure out 8598 * some more elaborate course of action. 8599 */ 8600 rctx->broken_server = DNS_R_LAME; 8601 rctx->next_server = true; 8602 FCTXTRACE3("rctx_answer lame", result); 8603 rctx_done(rctx, result); 8604 return ISC_R_COMPLETE; 8605 } 8606 } 8607 8608 if (result != ISC_R_SUCCESS) { 8609 if (result == DNS_R_FORMERR) { 8610 rctx->next_server = true; 8611 } 8612 FCTXTRACE3("rctx_answer failed", result); 8613 rctx_done(rctx, result); 8614 return ISC_R_COMPLETE; 8615 } 8616 8617 return ISC_R_SUCCESS; 8618 } 8619 8620 /* 8621 * rctx_answer_positive(): 8622 * Handles positive responses. Depending which type of answer this is 8623 * (matching QNAME/QTYPE, CNAME, DNAME, ANY) calls the proper routine 8624 * to handle it (rctx_answer_match(), rctx_answer_cname(), 8625 * rctx_answer_dname(), rctx_answer_any()). 8626 */ 8627 static isc_result_t 8628 rctx_answer_positive(respctx_t *rctx) { 8629 isc_result_t result; 8630 fetchctx_t *fctx = rctx->fctx; 8631 8632 FCTXTRACE("rctx_answer_positive"); 8633 8634 rctx_answer_init(rctx); 8635 rctx_answer_scan(rctx); 8636 8637 /* 8638 * Determine which type of positive answer this is: 8639 * type ANY, CNAME, DNAME, or an answer matching QNAME/QTYPE. 8640 * Call the appropriate routine to handle the answer type. 8641 */ 8642 if (rctx->aname != NULL && rctx->type == dns_rdatatype_any) { 8643 result = rctx_answer_any(rctx); 8644 if (result == ISC_R_COMPLETE) { 8645 return rctx->result; 8646 } 8647 } else if (rctx->aname != NULL) { 8648 result = rctx_answer_match(rctx); 8649 if (result == ISC_R_COMPLETE) { 8650 return rctx->result; 8651 } 8652 } else if (rctx->cname != NULL) { 8653 result = rctx_answer_cname(rctx); 8654 if (result == ISC_R_COMPLETE) { 8655 return rctx->result; 8656 } 8657 } else if (rctx->dname != NULL) { 8658 result = rctx_answer_dname(rctx); 8659 if (result == ISC_R_COMPLETE) { 8660 return rctx->result; 8661 } 8662 } else { 8663 log_formerr(fctx, "reply has no answer"); 8664 return DNS_R_FORMERR; 8665 } 8666 8667 /* 8668 * This response is now potentially cacheable. 8669 */ 8670 FCTX_ATTR_SET(fctx, FCTX_ATTR_WANTCACHE); 8671 8672 /* 8673 * Did chaining end before we got the final answer? 8674 */ 8675 if (rctx->chaining) { 8676 return ISC_R_SUCCESS; 8677 } 8678 8679 /* 8680 * We didn't end with an incomplete chain, so the rcode should 8681 * be "no error". 8682 */ 8683 if (rctx->query->rmessage->rcode != dns_rcode_noerror) { 8684 log_formerr(fctx, "CNAME/DNAME chain complete, but RCODE " 8685 "indicates error"); 8686 return DNS_R_FORMERR; 8687 } 8688 8689 /* 8690 * Cache records in the authority section, if there are 8691 * any suitable for caching. 8692 */ 8693 rctx_authority_positive(rctx); 8694 8695 log_ns_ttl(fctx, "rctx_answer"); 8696 8697 if (rctx->ns_rdataset != NULL && 8698 dns_name_equal(fctx->domain, rctx->ns_name) && 8699 !dns_name_equal(rctx->ns_name, dns_rootname)) 8700 { 8701 trim_ns_ttl(fctx, rctx->ns_name, rctx->ns_rdataset); 8702 } 8703 8704 return ISC_R_SUCCESS; 8705 } 8706 8707 /* 8708 * rctx_answer_scan(): 8709 * Perform a single pass over the answer section of a response, looking 8710 * for an answer that matches QNAME/QTYPE, or a CNAME matching QNAME, or 8711 * a covering DNAME. If more than one rdataset is found matching these 8712 * criteria, then only one is kept. Order of preference is 1) the 8713 * shortest DNAME, 2) the first matching answer, or 3) the first CNAME. 8714 */ 8715 static void 8716 rctx_answer_scan(respctx_t *rctx) { 8717 isc_result_t result; 8718 fetchctx_t *fctx = rctx->fctx; 8719 dns_rdataset_t *rdataset = NULL; 8720 8721 for (result = dns_message_firstname(rctx->query->rmessage, 8722 DNS_SECTION_ANSWER); 8723 result == ISC_R_SUCCESS; 8724 result = dns_message_nextname(rctx->query->rmessage, 8725 DNS_SECTION_ANSWER)) 8726 { 8727 int order; 8728 unsigned int nlabels; 8729 dns_namereln_t namereln; 8730 dns_name_t *name = NULL; 8731 8732 dns_message_currentname(rctx->query->rmessage, 8733 DNS_SECTION_ANSWER, &name); 8734 namereln = dns_name_fullcompare(fctx->name, name, &order, 8735 &nlabels); 8736 switch (namereln) { 8737 case dns_namereln_equal: 8738 for (rdataset = ISC_LIST_HEAD(name->list); 8739 rdataset != NULL; 8740 rdataset = ISC_LIST_NEXT(rdataset, link)) 8741 { 8742 if (rdataset->type == rctx->type || 8743 rctx->type == dns_rdatatype_any) 8744 { 8745 rctx->aname = name; 8746 if (rctx->type != dns_rdatatype_any) { 8747 rctx->ardataset = rdataset; 8748 } 8749 break; 8750 } 8751 if (rdataset->type == dns_rdatatype_cname) { 8752 rctx->cname = name; 8753 rctx->crdataset = rdataset; 8754 break; 8755 } 8756 } 8757 break; 8758 8759 case dns_namereln_subdomain: 8760 /* 8761 * Don't accept DNAME from parent namespace. 8762 */ 8763 if (name_external(name, dns_rdatatype_dname, rctx)) { 8764 continue; 8765 } 8766 8767 /* 8768 * In-scope DNAME records must have at least 8769 * as many labels as the domain being queried. 8770 * They also must be less that qname's labels 8771 * and any previously found dname. 8772 */ 8773 if (nlabels >= rctx->dname_labels || 8774 nlabels < rctx->domain_labels) 8775 { 8776 continue; 8777 } 8778 8779 /* 8780 * We are looking for the shortest DNAME if 8781 * there are multiple ones (which there 8782 * shouldn't be). 8783 */ 8784 for (rdataset = ISC_LIST_HEAD(name->list); 8785 rdataset != NULL; 8786 rdataset = ISC_LIST_NEXT(rdataset, link)) 8787 { 8788 if (rdataset->type != dns_rdatatype_dname) { 8789 continue; 8790 } 8791 rctx->dname = name; 8792 rctx->drdataset = rdataset; 8793 rctx->dname_labels = nlabels; 8794 break; 8795 } 8796 break; 8797 default: 8798 break; 8799 } 8800 } 8801 8802 /* 8803 * If a DNAME was found, then any CNAME or other answer matching 8804 * QNAME that may also have been found must be ignored. 8805 * Similarly, if a matching answer was found along with a CNAME, 8806 * the CNAME must be ignored. 8807 */ 8808 if (rctx->dname != NULL) { 8809 rctx->aname = NULL; 8810 rctx->ardataset = NULL; 8811 rctx->cname = NULL; 8812 rctx->crdataset = NULL; 8813 } else if (rctx->aname != NULL) { 8814 rctx->cname = NULL; 8815 rctx->crdataset = NULL; 8816 } 8817 } 8818 8819 /* 8820 * rctx_answer_any(): 8821 * Handle responses to queries of type ANY. Scan the answer section, 8822 * and as long as each RRset is of a type that is valid in the answer 8823 * section, and the rdata isn't filtered, cache it. 8824 */ 8825 static isc_result_t 8826 rctx_answer_any(respctx_t *rctx) { 8827 dns_rdataset_t *rdataset = NULL; 8828 fetchctx_t *fctx = rctx->fctx; 8829 8830 for (rdataset = ISC_LIST_HEAD(rctx->aname->list); rdataset != NULL; 8831 rdataset = ISC_LIST_NEXT(rdataset, link)) 8832 { 8833 if (!validinanswer(rdataset, fctx)) { 8834 rctx->result = DNS_R_FORMERR; 8835 return ISC_R_COMPLETE; 8836 } 8837 8838 if ((fctx->type == dns_rdatatype_sig || 8839 fctx->type == dns_rdatatype_rrsig) && 8840 rdataset->type != fctx->type) 8841 { 8842 continue; 8843 } 8844 8845 if ((rdataset->type == dns_rdatatype_a || 8846 rdataset->type == dns_rdatatype_aaaa) && 8847 !is_answeraddress_allowed(fctx->res->view, rctx->aname, 8848 rdataset)) 8849 { 8850 rctx->result = DNS_R_SERVFAIL; 8851 return ISC_R_COMPLETE; 8852 } 8853 8854 if ((rdataset->type == dns_rdatatype_cname || 8855 rdataset->type == dns_rdatatype_dname) && 8856 !is_answertarget_allowed(fctx, fctx->name, rctx->aname, 8857 rdataset, NULL)) 8858 { 8859 rctx->result = DNS_R_SERVFAIL; 8860 return ISC_R_COMPLETE; 8861 } 8862 8863 rctx->aname->attributes.cache = true; 8864 rctx->aname->attributes.answer = true; 8865 rdataset->attributes |= DNS_RDATASETATTR_ANSWER; 8866 rdataset->attributes |= DNS_RDATASETATTR_CACHE; 8867 rdataset->trust = rctx->trust; 8868 8869 (void)dns_rdataset_additionaldata(rdataset, rctx->aname, 8870 check_related, rctx, 0); 8871 } 8872 8873 /* 8874 * An RRSIG query is handled as a subset of ANY; if every record in 8875 * the answer was filtered out above, nothing was marked cacheable, 8876 * so there is nothing to cache, validate, or chase. Treat that as a 8877 * broken answer instead of returning success with no answer, which 8878 * would leave the fetch waiting for a validator that is never 8879 * started. 8880 */ 8881 if (!rctx->aname->attributes.cache) { 8882 rctx->result = DNS_R_FORMERR; 8883 return ISC_R_COMPLETE; 8884 } 8885 8886 return ISC_R_SUCCESS; 8887 } 8888 8889 /* 8890 * rctx_answer_match(): 8891 * Handle responses that match the QNAME/QTYPE of the resolver query. 8892 * If QTYPE is valid in the answer section and the rdata isn't filtered, 8893 * the answer can be cached. If there is additional section data related 8894 * to the answer, it can be cached as well. 8895 */ 8896 static isc_result_t 8897 rctx_answer_match(respctx_t *rctx) { 8898 dns_rdataset_t *sigrdataset = NULL; 8899 fetchctx_t *fctx = rctx->fctx; 8900 8901 if (!validinanswer(rctx->ardataset, fctx)) { 8902 rctx->result = DNS_R_FORMERR; 8903 return ISC_R_COMPLETE; 8904 } 8905 8906 if ((rctx->ardataset->type == dns_rdatatype_a || 8907 rctx->ardataset->type == dns_rdatatype_aaaa) && 8908 !is_answeraddress_allowed(fctx->res->view, rctx->aname, 8909 rctx->ardataset)) 8910 { 8911 rctx->result = DNS_R_SERVFAIL; 8912 return ISC_R_COMPLETE; 8913 } 8914 if ((rctx->ardataset->type == dns_rdatatype_cname || 8915 rctx->ardataset->type == dns_rdatatype_dname) && 8916 rctx->type != rctx->ardataset->type && 8917 rctx->type != dns_rdatatype_any && 8918 !is_answertarget_allowed(fctx, fctx->name, rctx->aname, 8919 rctx->ardataset, NULL)) 8920 { 8921 rctx->result = DNS_R_SERVFAIL; 8922 return ISC_R_COMPLETE; 8923 } 8924 8925 rctx->aname->attributes.cache = true; 8926 rctx->aname->attributes.answer = true; 8927 rctx->ardataset->attributes |= DNS_RDATASETATTR_ANSWER; 8928 rctx->ardataset->attributes |= DNS_RDATASETATTR_CACHE; 8929 rctx->ardataset->trust = rctx->trust; 8930 (void)dns_rdataset_additionaldata(rctx->ardataset, rctx->aname, 8931 check_related, rctx, 0); 8932 8933 for (sigrdataset = ISC_LIST_HEAD(rctx->aname->list); 8934 sigrdataset != NULL; 8935 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 8936 { 8937 if (!validinanswer(sigrdataset, fctx)) { 8938 rctx->result = DNS_R_FORMERR; 8939 return ISC_R_COMPLETE; 8940 } 8941 8942 if (sigrdataset->type != dns_rdatatype_rrsig || 8943 sigrdataset->covers != rctx->type) 8944 { 8945 continue; 8946 } 8947 8948 sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG; 8949 sigrdataset->attributes |= DNS_RDATASETATTR_CACHE; 8950 sigrdataset->trust = rctx->trust; 8951 break; 8952 } 8953 8954 return ISC_R_SUCCESS; 8955 } 8956 8957 /* 8958 * rctx_answer_cname(): 8959 * Handle answers containing a CNAME. Cache the CNAME, and flag that 8960 * there may be additional chain answers to find. 8961 */ 8962 static isc_result_t 8963 rctx_answer_cname(respctx_t *rctx) { 8964 dns_rdataset_t *sigrdataset = NULL; 8965 fetchctx_t *fctx = rctx->fctx; 8966 8967 if (!validinanswer(rctx->crdataset, fctx)) { 8968 rctx->result = DNS_R_FORMERR; 8969 return ISC_R_COMPLETE; 8970 } 8971 8972 if (!is_answertarget_allowed(fctx, fctx->name, rctx->cname, 8973 rctx->crdataset, NULL)) 8974 { 8975 rctx->result = DNS_R_SERVFAIL; 8976 return ISC_R_COMPLETE; 8977 } 8978 8979 rctx->cname->attributes.cache = true; 8980 rctx->cname->attributes.answer = true; 8981 rctx->cname->attributes.chaining = true; 8982 rctx->crdataset->attributes |= DNS_RDATASETATTR_ANSWER; 8983 rctx->crdataset->attributes |= DNS_RDATASETATTR_CACHE; 8984 rctx->crdataset->attributes |= DNS_RDATASETATTR_CHAINING; 8985 rctx->crdataset->trust = rctx->trust; 8986 8987 for (sigrdataset = ISC_LIST_HEAD(rctx->cname->list); 8988 sigrdataset != NULL; 8989 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 8990 { 8991 if (!validinanswer(sigrdataset, fctx)) { 8992 rctx->result = DNS_R_FORMERR; 8993 return ISC_R_COMPLETE; 8994 } 8995 8996 if (sigrdataset->type != dns_rdatatype_rrsig || 8997 sigrdataset->covers != dns_rdatatype_cname) 8998 { 8999 continue; 9000 } 9001 9002 sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG; 9003 sigrdataset->attributes |= DNS_RDATASETATTR_CACHE; 9004 sigrdataset->trust = rctx->trust; 9005 break; 9006 } 9007 9008 rctx->chaining = true; 9009 return ISC_R_SUCCESS; 9010 } 9011 9012 /* 9013 * rctx_answer_dname(): 9014 * Handle responses with covering DNAME records. 9015 */ 9016 static isc_result_t 9017 rctx_answer_dname(respctx_t *rctx) { 9018 dns_rdataset_t *sigrdataset = NULL; 9019 fetchctx_t *fctx = rctx->fctx; 9020 9021 if (!validinanswer(rctx->drdataset, fctx)) { 9022 rctx->result = DNS_R_FORMERR; 9023 return ISC_R_COMPLETE; 9024 } 9025 9026 if (!is_answertarget_allowed(fctx, fctx->name, rctx->dname, 9027 rctx->drdataset, &rctx->chaining)) 9028 { 9029 rctx->result = DNS_R_SERVFAIL; 9030 return ISC_R_COMPLETE; 9031 } 9032 9033 rctx->dname->attributes.cache = true; 9034 rctx->dname->attributes.answer = true; 9035 rctx->dname->attributes.chaining = true; 9036 rctx->drdataset->attributes |= DNS_RDATASETATTR_ANSWER; 9037 rctx->drdataset->attributes |= DNS_RDATASETATTR_CACHE; 9038 rctx->drdataset->attributes |= DNS_RDATASETATTR_CHAINING; 9039 rctx->drdataset->trust = rctx->trust; 9040 9041 for (sigrdataset = ISC_LIST_HEAD(rctx->dname->list); 9042 sigrdataset != NULL; 9043 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 9044 { 9045 if (!validinanswer(sigrdataset, fctx)) { 9046 rctx->result = DNS_R_FORMERR; 9047 return ISC_R_COMPLETE; 9048 } 9049 9050 if (sigrdataset->type != dns_rdatatype_rrsig || 9051 sigrdataset->covers != dns_rdatatype_dname) 9052 { 9053 continue; 9054 } 9055 9056 sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG; 9057 sigrdataset->attributes |= DNS_RDATASETATTR_CACHE; 9058 sigrdataset->trust = rctx->trust; 9059 break; 9060 } 9061 9062 return ISC_R_SUCCESS; 9063 } 9064 9065 /* 9066 * rctx_authority_positive(): 9067 * If a positive answer was received over TCP or secured with a cookie 9068 * or TSIG, examine the authority section. We expect names for all 9069 * rdatasets in this section to be subdomains of the domain being queried; 9070 * any that are not are skipped. We expect to find only *one* owner name; 9071 * any names after the first one processed are ignored. We expect to find 9072 * only rdatasets of type NS; all others are ignored. Whatever remains can 9073 * be cached at trust level authauthority or additional (depending on 9074 * whether the AA bit was set on the answer). 9075 */ 9076 static void 9077 rctx_authority_positive(respctx_t *rctx) { 9078 fetchctx_t *fctx = rctx->fctx; 9079 bool done = false; 9080 isc_result_t result; 9081 9082 /* If it's spoofable, don't cache it. */ 9083 if (!rctx->secured && (rctx->query->options & DNS_FETCHOPT_TCP) == 0) { 9084 return; 9085 } 9086 9087 result = dns_message_firstname(rctx->query->rmessage, 9088 DNS_SECTION_AUTHORITY); 9089 while (!done && result == ISC_R_SUCCESS) { 9090 dns_name_t *name = NULL; 9091 9092 dns_message_currentname(rctx->query->rmessage, 9093 DNS_SECTION_AUTHORITY, &name); 9094 9095 if (!name_external(name, dns_rdatatype_ns, rctx) && 9096 dns_name_issubdomain(fctx->name, name)) 9097 { 9098 dns_rdataset_t *rdataset = NULL; 9099 9100 /* 9101 * We expect to find NS or SIG NS rdatasets, and 9102 * nothing else. 9103 */ 9104 for (rdataset = ISC_LIST_HEAD(name->list); 9105 rdataset != NULL; 9106 rdataset = ISC_LIST_NEXT(rdataset, link)) 9107 { 9108 if (rdataset->type == dns_rdatatype_ns || 9109 (rdataset->type == dns_rdatatype_rrsig && 9110 rdataset->covers == dns_rdatatype_ns)) 9111 { 9112 name->attributes.cache = true; 9113 rdataset->attributes |= 9114 DNS_RDATASETATTR_CACHE; 9115 9116 if (rctx->aa) { 9117 rdataset->trust = 9118 dns_trust_authauthority; 9119 } else { 9120 rdataset->trust = 9121 dns_trust_additional; 9122 } 9123 9124 if (rdataset->type == dns_rdatatype_ns) 9125 { 9126 rctx->ns_name = name; 9127 rctx->ns_rdataset = rdataset; 9128 } 9129 /* 9130 * Mark any additional data 9131 * related to this rdataset. 9132 */ 9133 (void)dns_rdataset_additionaldata( 9134 rdataset, name, check_related, 9135 rctx, 0); 9136 done = true; 9137 } 9138 } 9139 } 9140 9141 result = dns_message_nextname(rctx->query->rmessage, 9142 DNS_SECTION_AUTHORITY); 9143 } 9144 } 9145 9146 /* 9147 * rctx_answer_none(): 9148 * Handles a response without an answer: this is either a negative 9149 * response (NXDOMAIN or NXRRSET) or a referral. Determine which it is, 9150 * then either scan the authority section for negative caching and 9151 * DNSSEC proof of nonexistence, or else call rctx_referral(). 9152 */ 9153 static isc_result_t 9154 rctx_answer_none(respctx_t *rctx) { 9155 isc_result_t result; 9156 fetchctx_t *fctx = rctx->fctx; 9157 9158 FCTXTRACE("rctx_answer_none"); 9159 9160 rctx_answer_init(rctx); 9161 9162 /* 9163 * Sometimes we can tell if its a negative response by looking 9164 * at the message header. 9165 */ 9166 if (rctx->query->rmessage->rcode == dns_rcode_nxdomain || 9167 (rctx->query->rmessage->counts[DNS_SECTION_ANSWER] == 0 && 9168 rctx->query->rmessage->counts[DNS_SECTION_AUTHORITY] == 0)) 9169 { 9170 rctx->negative = true; 9171 } 9172 9173 /* 9174 * Process the authority section 9175 */ 9176 result = rctx_authority_negative(rctx); 9177 if (result == ISC_R_COMPLETE) { 9178 return rctx->result; 9179 } 9180 9181 log_ns_ttl(fctx, "rctx_answer_none"); 9182 9183 if (rctx->ns_rdataset != NULL && 9184 dns_name_equal(fctx->domain, rctx->ns_name) && 9185 !dns_name_equal(rctx->ns_name, dns_rootname)) 9186 { 9187 trim_ns_ttl(fctx, rctx->ns_name, rctx->ns_rdataset); 9188 } 9189 9190 /* 9191 * A negative response has a SOA record (Type 2) 9192 * and a optional NS RRset (Type 1) or it has neither 9193 * a SOA or a NS RRset (Type 3, handled above) or 9194 * rcode is NXDOMAIN (handled above) in which case 9195 * the NS RRset is allowed (Type 4). 9196 */ 9197 if (rctx->soa_name != NULL) { 9198 rctx->negative = true; 9199 } 9200 9201 if (!rctx->ns_in_answer && !rctx->glue_in_answer) { 9202 /* 9203 * Process DNSSEC records in the authority section. 9204 */ 9205 result = rctx_authority_dnssec(rctx); 9206 if (result == ISC_R_COMPLETE) { 9207 return rctx->result; 9208 } 9209 } 9210 9211 /* 9212 * Trigger lookups for DNS nameservers. 9213 */ 9214 if (rctx->negative && 9215 rctx->query->rmessage->rcode == dns_rcode_noerror && 9216 fctx->type == dns_rdatatype_ds && rctx->soa_name != NULL && 9217 dns_name_equal(rctx->soa_name, fctx->name) && 9218 !dns_name_equal(fctx->name, dns_rootname)) 9219 { 9220 return DNS_R_CHASEDSSERVERS; 9221 } 9222 9223 /* 9224 * Did we find anything? 9225 */ 9226 if (!rctx->negative && rctx->ns_name == NULL) { 9227 /* 9228 * The responder is insane. 9229 */ 9230 if (rctx->found_name == NULL) { 9231 log_formerr(fctx, "invalid response"); 9232 return DNS_R_FORMERR; 9233 } 9234 if (!dns_name_issubdomain(rctx->found_name, fctx->domain)) { 9235 char nbuf[DNS_NAME_FORMATSIZE]; 9236 char dbuf[DNS_NAME_FORMATSIZE]; 9237 char tbuf[DNS_RDATATYPE_FORMATSIZE]; 9238 9239 dns_rdatatype_format(rctx->found_type, tbuf, 9240 sizeof(tbuf)); 9241 dns_name_format(rctx->found_name, nbuf, sizeof(nbuf)); 9242 dns_name_format(fctx->domain, dbuf, sizeof(dbuf)); 9243 9244 log_formerr(fctx, 9245 "Name %s (%s) not subdomain" 9246 " of zone %s -- invalid response", 9247 nbuf, tbuf, dbuf); 9248 } else { 9249 log_formerr(fctx, "invalid response"); 9250 } 9251 return DNS_R_FORMERR; 9252 } 9253 9254 /* 9255 * If we found both NS and SOA, they should be the same name. 9256 */ 9257 if (rctx->ns_name != NULL && rctx->soa_name != NULL && 9258 rctx->ns_name != rctx->soa_name) 9259 { 9260 log_formerr(fctx, "NS/SOA mismatch"); 9261 return DNS_R_FORMERR; 9262 } 9263 9264 /* 9265 * Handle a referral. 9266 */ 9267 result = rctx_referral(rctx); 9268 if (result == ISC_R_COMPLETE) { 9269 return rctx->result; 9270 } 9271 9272 /* 9273 * Since we're not doing a referral, we don't want to cache any 9274 * NS RRs we may have found. 9275 */ 9276 if (rctx->ns_name != NULL) { 9277 rctx->ns_name->attributes.cache = false; 9278 } 9279 9280 if (rctx->negative) { 9281 FCTX_ATTR_SET(fctx, FCTX_ATTR_WANTNCACHE); 9282 } 9283 9284 return ISC_R_SUCCESS; 9285 } 9286 9287 /* 9288 * rctx_authority_negative(): 9289 * Scan the authority section of a negative answer, handling 9290 * NS and SOA records. (Note that this function does *not* handle 9291 * DNSSEC records; those are addressed separately in 9292 * rctx_authority_dnssec() below.) 9293 */ 9294 static isc_result_t 9295 rctx_authority_negative(respctx_t *rctx) { 9296 isc_result_t result; 9297 fetchctx_t *fctx = rctx->fctx; 9298 dns_section_t section; 9299 dns_rdataset_t *rdataset = NULL; 9300 bool finished = false; 9301 9302 if (rctx->ns_in_answer) { 9303 INSIST(fctx->type == dns_rdatatype_ns); 9304 section = DNS_SECTION_ANSWER; 9305 } else { 9306 section = DNS_SECTION_AUTHORITY; 9307 } 9308 9309 result = dns_message_firstname(rctx->query->rmessage, section); 9310 if (result != ISC_R_SUCCESS) { 9311 return ISC_R_SUCCESS; 9312 } 9313 9314 while (!finished) { 9315 dns_name_t *name = NULL; 9316 9317 dns_message_currentname(rctx->query->rmessage, section, &name); 9318 result = dns_message_nextname(rctx->query->rmessage, section); 9319 if (result != ISC_R_SUCCESS) { 9320 finished = true; 9321 } 9322 9323 if (!dns_name_issubdomain(name, fctx->domain)) { 9324 continue; 9325 } 9326 9327 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 9328 rdataset = ISC_LIST_NEXT(rdataset, link)) 9329 { 9330 dns_rdatatype_t type = rdataset->type; 9331 if (type == dns_rdatatype_rrsig) { 9332 type = rdataset->covers; 9333 } 9334 if ((type == dns_rdatatype_ns || 9335 type == dns_rdatatype_soa) && 9336 !dns_name_issubdomain(fctx->name, name)) 9337 { 9338 char qbuf[DNS_NAME_FORMATSIZE]; 9339 char nbuf[DNS_NAME_FORMATSIZE]; 9340 char tbuf[DNS_RDATATYPE_FORMATSIZE]; 9341 dns_rdatatype_format(type, tbuf, sizeof(tbuf)); 9342 dns_name_format(name, nbuf, sizeof(nbuf)); 9343 dns_name_format(fctx->name, qbuf, sizeof(qbuf)); 9344 log_formerr(fctx, 9345 "unrelated %s %s in " 9346 "%s authority section", 9347 tbuf, nbuf, qbuf); 9348 break; 9349 } 9350 9351 switch (type) { 9352 case dns_rdatatype_ns: 9353 /* 9354 * NS or RRSIG NS. 9355 * 9356 * Only one set of NS RRs is allowed. 9357 */ 9358 if (rdataset->type == dns_rdatatype_ns) { 9359 if (rctx->ns_name != NULL && 9360 name != rctx->ns_name) 9361 { 9362 log_formerr( 9363 fctx, 9364 "multiple NS RRsets in " 9365 "authority section"); 9366 rctx->result = DNS_R_FORMERR; 9367 return ISC_R_COMPLETE; 9368 } 9369 rctx->ns_name = name; 9370 rctx->ns_rdataset = rdataset; 9371 } 9372 name->attributes.cache = true; 9373 rdataset->attributes |= DNS_RDATASETATTR_CACHE; 9374 rdataset->trust = dns_trust_glue; 9375 break; 9376 case dns_rdatatype_soa: 9377 /* 9378 * SOA, or RRSIG SOA. 9379 * 9380 * Only one SOA is allowed. 9381 */ 9382 if (rdataset->type == dns_rdatatype_soa) { 9383 if (rctx->soa_name != NULL && 9384 name != rctx->soa_name) 9385 { 9386 log_formerr( 9387 fctx, 9388 "multiple SOA RRs in " 9389 "authority section"); 9390 rctx->result = DNS_R_FORMERR; 9391 return ISC_R_COMPLETE; 9392 } 9393 rctx->soa_name = name; 9394 } 9395 name->attributes.ncache = true; 9396 rdataset->attributes |= DNS_RDATASETATTR_NCACHE; 9397 if (rctx->aa) { 9398 rdataset->trust = 9399 dns_trust_authauthority; 9400 } else if (ISFORWARDER(fctx->addrinfo)) { 9401 rdataset->trust = dns_trust_answer; 9402 } else { 9403 rdataset->trust = dns_trust_additional; 9404 } 9405 break; 9406 default: 9407 continue; 9408 } 9409 } 9410 } 9411 9412 return ISC_R_SUCCESS; 9413 } 9414 9415 /* 9416 * rctx_ncache(): 9417 * Cache the negatively cacheable parts of the message. This may 9418 * also cause work to be queued to the DNSSEC validator. 9419 */ 9420 static void 9421 rctx_ncache(respctx_t *rctx) { 9422 isc_result_t result; 9423 dns_rdatatype_t covers; 9424 fetchctx_t *fctx = rctx->fctx; 9425 9426 if (!WANTNCACHE(fctx)) { 9427 return; 9428 } 9429 9430 /* 9431 * Cache DS NXDOMAIN separately to other types. 9432 */ 9433 if (rctx->query->rmessage->rcode == dns_rcode_nxdomain && 9434 fctx->type != dns_rdatatype_ds) 9435 { 9436 covers = dns_rdatatype_any; 9437 } else { 9438 covers = fctx->type; 9439 } 9440 9441 /* 9442 * Cache any negative cache entries in the message. 9443 */ 9444 result = ncache_message(fctx, rctx->query->rmessage, 9445 rctx->query->addrinfo, covers, rctx->now); 9446 if (result != ISC_R_SUCCESS) { 9447 FCTXTRACE3("ncache_message complete", result); 9448 } 9449 } 9450 9451 /* 9452 * rctx_authority_dnssec(): 9453 * 9454 * Scan the authority section of a negative answer or referral, 9455 * handling DNSSEC records (i.e. NSEC, NSEC3, DS). 9456 */ 9457 static isc_result_t 9458 rctx_authority_dnssec(respctx_t *rctx) { 9459 isc_result_t result; 9460 fetchctx_t *fctx = rctx->fctx; 9461 dns_rdataset_t *rdataset = NULL; 9462 bool finished = false; 9463 9464 REQUIRE(!rctx->ns_in_answer && !rctx->glue_in_answer); 9465 9466 result = dns_message_firstname(rctx->query->rmessage, 9467 DNS_SECTION_AUTHORITY); 9468 if (result != ISC_R_SUCCESS) { 9469 return ISC_R_SUCCESS; 9470 } 9471 9472 while (!finished) { 9473 dns_name_t *name = NULL; 9474 9475 dns_message_currentname(rctx->query->rmessage, 9476 DNS_SECTION_AUTHORITY, &name); 9477 result = dns_message_nextname(rctx->query->rmessage, 9478 DNS_SECTION_AUTHORITY); 9479 if (result != ISC_R_SUCCESS) { 9480 finished = true; 9481 } 9482 9483 if (!dns_name_issubdomain(name, fctx->domain)) { 9484 /* 9485 * Invalid name found; preserve it for logging 9486 * later. 9487 */ 9488 rctx->found_name = name; 9489 rctx->found_type = ISC_LIST_HEAD(name->list)->type; 9490 continue; 9491 } 9492 9493 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 9494 rdataset = ISC_LIST_NEXT(rdataset, link)) 9495 { 9496 bool checknta = true; 9497 bool secure_domain = false; 9498 dns_rdatatype_t type = rdataset->type; 9499 9500 if (type == dns_rdatatype_rrsig) { 9501 type = rdataset->covers; 9502 } 9503 9504 switch (type) { 9505 case dns_rdatatype_nsec: 9506 case dns_rdatatype_nsec3: 9507 if (rctx->negative) { 9508 name->attributes.ncache = true; 9509 rdataset->attributes |= 9510 DNS_RDATASETATTR_NCACHE; 9511 } else if (type == dns_rdatatype_nsec) { 9512 name->attributes.cache = true; 9513 rdataset->attributes |= 9514 DNS_RDATASETATTR_CACHE; 9515 } 9516 9517 if (rctx->aa) { 9518 rdataset->trust = 9519 dns_trust_authauthority; 9520 } else if (ISFORWARDER(fctx->addrinfo)) { 9521 rdataset->trust = dns_trust_answer; 9522 } else { 9523 rdataset->trust = dns_trust_additional; 9524 } 9525 /* 9526 * No additional data needs to be 9527 * marked. 9528 */ 9529 break; 9530 case dns_rdatatype_ds: 9531 /* 9532 * DS or SIG DS. 9533 * 9534 * These should only be here if this is 9535 * a referral, and there should only be 9536 * one DS RRset. 9537 */ 9538 if (rctx->ns_name == NULL) { 9539 log_formerr(fctx, 9540 "DS with no referral"); 9541 rctx->result = DNS_R_FORMERR; 9542 return ISC_R_COMPLETE; 9543 } 9544 9545 if (rdataset->type == dns_rdatatype_ds) { 9546 if (rctx->ds_name != NULL && 9547 name != rctx->ds_name) 9548 { 9549 log_formerr(fctx, 9550 "DS doesn't match " 9551 "referral (NS)"); 9552 rctx->result = DNS_R_FORMERR; 9553 return ISC_R_COMPLETE; 9554 } 9555 rctx->ds_name = name; 9556 } 9557 9558 name->attributes.cache = true; 9559 rdataset->attributes |= DNS_RDATASETATTR_CACHE; 9560 9561 if ((fctx->options & DNS_FETCHOPT_NONTA) != 0) { 9562 checknta = false; 9563 } 9564 if (fctx->res->view->enablevalidation) { 9565 result = issecuredomain( 9566 fctx->res->view, name, 9567 dns_rdatatype_ds, fctx->now, 9568 checknta, NULL, &secure_domain); 9569 if (result != ISC_R_SUCCESS) { 9570 return result; 9571 } 9572 } 9573 if (secure_domain) { 9574 rdataset->trust = 9575 dns_trust_pending_answer; 9576 } else if (rctx->aa) { 9577 rdataset->trust = 9578 dns_trust_authauthority; 9579 } else if (ISFORWARDER(fctx->addrinfo)) { 9580 rdataset->trust = dns_trust_answer; 9581 } else { 9582 rdataset->trust = dns_trust_additional; 9583 } 9584 break; 9585 default: 9586 continue; 9587 } 9588 } 9589 } 9590 9591 return ISC_R_SUCCESS; 9592 } 9593 9594 /* 9595 * rctx_referral(): 9596 * Handles referral responses. Check for sanity, find glue as needed, 9597 * and update the fetch context to follow the delegation. 9598 */ 9599 static isc_result_t 9600 rctx_referral(respctx_t *rctx) { 9601 isc_result_t result; 9602 fetchctx_t *fctx = rctx->fctx; 9603 9604 if (rctx->negative || rctx->ns_name == NULL) { 9605 return ISC_R_SUCCESS; 9606 } 9607 9608 /* 9609 * We already know ns_name is a subdomain of fctx->domain. 9610 * If ns_name is equal to fctx->domain, we're not making 9611 * progress. We return DNS_R_FORMERR so that we'll keep 9612 * trying other servers. 9613 */ 9614 if (dns_name_equal(rctx->ns_name, fctx->domain)) { 9615 log_formerr(fctx, "non-improving referral"); 9616 rctx->result = DNS_R_FORMERR; 9617 return ISC_R_COMPLETE; 9618 } 9619 9620 /* 9621 * If the referral name is not a parent of the query 9622 * name, consider the responder insane. 9623 */ 9624 if (!dns_name_issubdomain(fctx->name, rctx->ns_name)) { 9625 /* Logged twice */ 9626 log_formerr(fctx, "referral to non-parent"); 9627 FCTXTRACE("referral to non-parent"); 9628 rctx->result = DNS_R_FORMERR; 9629 return ISC_R_COMPLETE; 9630 } 9631 9632 /* 9633 * Mark any additional data related to this rdataset. 9634 * It's important that we do this before we change the 9635 * query domain. 9636 */ 9637 INSIST(rctx->ns_rdataset != NULL); 9638 FCTX_ATTR_SET(fctx, FCTX_ATTR_GLUING); 9639 9640 /* 9641 * Mark the glue records in the additional section to be cached. 9642 */ 9643 (void)dns_rdataset_additionaldata(rctx->ns_rdataset, rctx->ns_name, 9644 check_related, rctx, 0); 9645 FCTX_ATTR_CLR(fctx, FCTX_ATTR_GLUING); 9646 9647 /* 9648 * NS rdatasets with 0 TTL cause problems. 9649 * dns_view_findzonecut() will not find them when we 9650 * try to follow the referral, and we'll SERVFAIL 9651 * because the best nameservers are now above QDOMAIN. 9652 * We force the TTL to 1 second to prevent this. 9653 */ 9654 if (rctx->ns_rdataset->ttl == 0) { 9655 rctx->ns_rdataset->ttl = 1; 9656 } 9657 9658 /* 9659 * Set the current query domain to the referral name. 9660 * 9661 * XXXRTH We should check if we're in forward-only mode, and 9662 * if so we should bail out. 9663 */ 9664 INSIST(dns_name_countlabels(fctx->domain) > 0); 9665 fcount_decr(fctx); 9666 9667 if (dns_rdataset_isassociated(&fctx->nameservers)) { 9668 dns_rdataset_disassociate(&fctx->nameservers); 9669 } 9670 9671 dns_name_copy(rctx->ns_name, fctx->domain); 9672 9673 if ((fctx->options & DNS_FETCHOPT_QMINIMIZE) != 0) { 9674 dns_name_copy(rctx->ns_name, fctx->qmindcname); 9675 9676 fctx_minimize_qname(fctx); 9677 } 9678 9679 result = fcount_incr(fctx, true); 9680 if (result != ISC_R_SUCCESS) { 9681 rctx->result = result; 9682 return ISC_R_COMPLETE; 9683 } 9684 9685 FCTX_ATTR_SET(fctx, FCTX_ATTR_WANTCACHE); 9686 fctx->ns_ttl_ok = false; 9687 log_ns_ttl(fctx, "DELEGATION"); 9688 rctx->result = DNS_R_DELEGATION; 9689 9690 /* 9691 * Reinitialize 'rctx' to prepare for following the delegation: 9692 * set the get_nameservers and next_server flags appropriately 9693 * and reset the fetch context counters. 9694 * 9695 */ 9696 if ((rctx->fctx->options & DNS_FETCHOPT_NOFOLLOW) == 0) { 9697 rctx->get_nameservers = true; 9698 rctx->next_server = true; 9699 rctx->fctx->restarts = 0; 9700 rctx->fctx->referrals++; 9701 rctx->fctx->querysent = 0; 9702 rctx->fctx->lamecount = 0; 9703 rctx->fctx->quotacount = 0; 9704 rctx->fctx->neterr = 0; 9705 rctx->fctx->badresp = 0; 9706 rctx->fctx->adberr = 0; 9707 } 9708 9709 return ISC_R_COMPLETE; 9710 } 9711 9712 /* 9713 * rctx_additional(): 9714 * Scan the additional section of a response to find records related 9715 * to answers we were interested in. 9716 */ 9717 static void 9718 rctx_additional(respctx_t *rctx) { 9719 bool rescan; 9720 dns_section_t section = DNS_SECTION_ADDITIONAL; 9721 isc_result_t result; 9722 9723 again: 9724 rescan = false; 9725 9726 for (result = dns_message_firstname(rctx->query->rmessage, section); 9727 result == ISC_R_SUCCESS; 9728 result = dns_message_nextname(rctx->query->rmessage, section)) 9729 { 9730 dns_name_t *name = NULL; 9731 dns_rdataset_t *rdataset; 9732 dns_message_currentname(rctx->query->rmessage, 9733 DNS_SECTION_ADDITIONAL, &name); 9734 if (!name->attributes.chase) { 9735 continue; 9736 } 9737 name->attributes.chase = false; 9738 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 9739 rdataset = ISC_LIST_NEXT(rdataset, link)) 9740 { 9741 if (CHASE(rdataset)) { 9742 rdataset->attributes &= ~DNS_RDATASETATTR_CHASE; 9743 (void)dns_rdataset_additionaldata( 9744 rdataset, name, check_related, rctx, 0); 9745 rescan = true; 9746 } 9747 } 9748 } 9749 if (rescan) { 9750 goto again; 9751 } 9752 } 9753 9754 /* 9755 * rctx_nextserver(): 9756 * We found something wrong with the remote server, but it may be 9757 * useful to try another one. 9758 */ 9759 static void 9760 rctx_nextserver(respctx_t *rctx, dns_message_t *message, 9761 dns_adbaddrinfo_t *addrinfo, isc_result_t result) { 9762 fetchctx_t *fctx = rctx->fctx; 9763 bool retrying = true; 9764 9765 if (result == DNS_R_FORMERR) { 9766 rctx->broken_server = DNS_R_FORMERR; 9767 } 9768 if (rctx->broken_server != ISC_R_SUCCESS) { 9769 /* 9770 * Add this server to the list of bad servers for 9771 * this fctx. 9772 */ 9773 add_bad(fctx, message, addrinfo, rctx->broken_server, 9774 rctx->broken_type); 9775 } 9776 9777 if (rctx->get_nameservers) { 9778 dns_fixedname_t foundname, founddc; 9779 dns_name_t *name, *fname, *dcname; 9780 unsigned int findoptions = 0; 9781 9782 fname = dns_fixedname_initname(&foundname); 9783 dcname = dns_fixedname_initname(&founddc); 9784 9785 if (result != ISC_R_SUCCESS) { 9786 fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL); 9787 return; 9788 } 9789 if (dns_rdatatype_atparent(fctx->type)) { 9790 findoptions |= DNS_DBFIND_NOEXACT; 9791 } 9792 /* FIXME: Why??? */ 9793 if ((rctx->retryopts & DNS_FETCHOPT_UNSHARED) == 0) { 9794 name = fctx->name; 9795 } else { 9796 name = fctx->domain; 9797 } 9798 result = dns_view_findzonecut( 9799 fctx->res->view, name, fname, dcname, fctx->now, 9800 findoptions, true, true, &fctx->nameservers, NULL); 9801 if (result != ISC_R_SUCCESS) { 9802 FCTXTRACE("couldn't find a zonecut"); 9803 fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL); 9804 return; 9805 } 9806 if (!dns_name_issubdomain(fname, fctx->domain)) { 9807 /* 9808 * The best nameservers are now above our 9809 * QDOMAIN. 9810 */ 9811 FCTXTRACE("nameservers now above QDOMAIN"); 9812 fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL); 9813 return; 9814 } 9815 9816 fcount_decr(fctx); 9817 9818 dns_name_copy(fname, fctx->domain); 9819 dns_name_copy(dcname, fctx->qmindcname); 9820 9821 result = fcount_incr(fctx, true); 9822 if (result != ISC_R_SUCCESS) { 9823 fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL); 9824 return; 9825 } 9826 fctx->ns_ttl = fctx->nameservers.ttl; 9827 fctx->ns_ttl_ok = true; 9828 fctx_cancelqueries(fctx, true, false); 9829 fctx_cleanup(fctx); 9830 retrying = false; 9831 } 9832 9833 /* 9834 * Try again. 9835 */ 9836 fctx_try(fctx, retrying); 9837 } 9838 9839 /* 9840 * rctx_resend(): 9841 * 9842 * Resend the query, probably with the options changed. Calls 9843 * fctx_query(), unless query counter limits are hit, passing 9844 * rctx->retryopts (which is based on query->options, but may have 9845 * been updated since the last time fctx_query() was called). 9846 */ 9847 static void 9848 rctx_resend(respctx_t *rctx, dns_adbaddrinfo_t *addrinfo) { 9849 fetchctx_t *fctx = rctx->fctx; 9850 isc_result_t result; 9851 9852 FCTXTRACE("resend"); 9853 9854 CHECK(incr_query_counters(fctx)); 9855 9856 result = fctx_query(fctx, addrinfo, rctx->retryopts); 9857 if (result == ISC_R_SUCCESS) { 9858 inc_stats(fctx->res, dns_resstatscounter_retry); 9859 } 9860 9861 cleanup: 9862 if (result != ISC_R_SUCCESS) { 9863 fctx_done_detach(&rctx->fctx, result); 9864 } 9865 } 9866 9867 /* 9868 * rctx_next(): 9869 * We got what appeared to be a response but it didn't match the 9870 * question or the cookie; it may have been meant for someone else, or 9871 * it may be a spoofing attack. Drop it and continue listening for the 9872 * response we wanted. 9873 */ 9874 static isc_result_t 9875 rctx_next(respctx_t *rctx) { 9876 fetchctx_t *fctx = rctx->fctx; 9877 isc_result_t result; 9878 9879 FCTXTRACE("nextitem"); 9880 inc_stats(rctx->fctx->res, dns_resstatscounter_nextitem); 9881 INSIST(rctx->query->dispentry != NULL); 9882 dns_message_reset(rctx->query->rmessage, DNS_MESSAGE_INTENTPARSE); 9883 result = dns_dispatch_getnext(rctx->query->dispentry); 9884 return result; 9885 } 9886 9887 /* 9888 * rctx_chaseds(): 9889 * Look up the parent zone's NS records so that DS records can be 9890 * fetched. 9891 */ 9892 static void 9893 rctx_chaseds(respctx_t *rctx, dns_message_t *message, 9894 dns_adbaddrinfo_t *addrinfo, isc_result_t result) { 9895 fetchctx_t *fctx = rctx->fctx; 9896 unsigned int n; 9897 9898 add_bad(fctx, message, addrinfo, result, rctx->broken_type); 9899 fctx_cancelqueries(fctx, true, false); 9900 fctx_cleanup(fctx); 9901 9902 n = dns_name_countlabels(fctx->name); 9903 dns_name_getlabelsequence(fctx->name, 1, n - 1, fctx->nsname); 9904 9905 FCTXTRACE("suspending DS lookup to find parent's NS records"); 9906 9907 fetchctx_ref(fctx); 9908 result = dns_resolver_createfetch( 9909 fctx->res, fctx->nsname, dns_rdatatype_ns, NULL, NULL, NULL, 9910 NULL, 0, fctx->options, 0, fctx->qc, fctx->gqc, fctx, 9911 fctx->loop, resume_dslookup, fctx, &fctx->edectx, 9912 &fctx->nsrrset, NULL, &fctx->nsfetch); 9913 if (result != ISC_R_SUCCESS) { 9914 if (result == DNS_R_DUPLICATE) { 9915 result = DNS_R_SERVFAIL; 9916 } 9917 fctx_done_detach(&rctx->fctx, result); 9918 fetchctx_detach(&fctx); 9919 return; 9920 } 9921 } 9922 9923 /* 9924 * rctx_done(): 9925 * This resolver query response is finished, either because we 9926 * encountered a problem or because we've gotten all the information 9927 * from it that we can. We either wait for another response, resend the 9928 * query to the same server, resend to a new server, or clean up and 9929 * shut down the fetch. 9930 */ 9931 static void 9932 rctx_done(respctx_t *rctx, isc_result_t result) { 9933 resquery_t *query = rctx->query; 9934 fetchctx_t *fctx = rctx->fctx; 9935 dns_adbaddrinfo_t *addrinfo = query->addrinfo; 9936 dns_message_t *message = NULL; 9937 9938 /* 9939 * Need to attach to the message until the scope 9940 * of this function ends, since there are many places 9941 * where the message is used and/or may be destroyed 9942 * before this function ends. 9943 */ 9944 dns_message_attach(query->rmessage, &message); 9945 9946 FCTXTRACE4("query canceled in rctx_done();", 9947 rctx->no_response ? "no response" : "responding", result); 9948 9949 #ifdef ENABLE_AFL 9950 if (dns_fuzzing_resolver && 9951 (rctx->next_server || rctx->resend || rctx->nextitem)) 9952 { 9953 fctx_cancelquery(&query, rctx->finish, rctx->no_response, 9954 false); 9955 fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL); 9956 goto detach; 9957 } 9958 #endif /* ifdef ENABLE_AFL */ 9959 9960 if (rctx->nextitem) { 9961 REQUIRE(!rctx->next_server); 9962 REQUIRE(!rctx->resend); 9963 9964 result = rctx_next(rctx); 9965 if (result == ISC_R_SUCCESS) { 9966 goto detach; 9967 } 9968 } 9969 9970 /* Cancel the query */ 9971 fctx_cancelquery(&query, rctx->finish, rctx->no_response, false); 9972 9973 /* 9974 * If nobody's waiting for results, don't resend or try next server. 9975 */ 9976 LOCK(&fctx->lock); 9977 if (ISC_LIST_EMPTY(fctx->resps)) { 9978 rctx->next_server = false; 9979 rctx->resend = false; 9980 } 9981 UNLOCK(&fctx->lock); 9982 9983 if (rctx->next_server) { 9984 rctx_nextserver(rctx, message, addrinfo, result); 9985 } else if (rctx->resend) { 9986 rctx_resend(rctx, addrinfo); 9987 } else if (result == DNS_R_CHASEDSSERVERS) { 9988 rctx_chaseds(rctx, message, addrinfo, result); 9989 } else if (result == ISC_R_SUCCESS && !HAVE_ANSWER(fctx)) { 9990 /* 9991 * All has gone well so far, but we are waiting for the DNSSEC 9992 * validator to validate the answer. 9993 */ 9994 FCTXTRACE("wait for validator"); 9995 fctx_cancelqueries(fctx, true, false); 9996 } else { 9997 /* 9998 * We're done. 9999 */ 10000 fctx_done_detach(&rctx->fctx, result); 10001 } 10002 10003 detach: 10004 dns_message_detach(&message); 10005 } 10006 10007 /* 10008 * rctx_logpacket(): 10009 * Log the incoming packet; also log to DNSTAP if configured. 10010 */ 10011 static void 10012 rctx_logpacket(respctx_t *rctx) { 10013 fetchctx_t *fctx = rctx->fctx; 10014 #ifdef HAVE_DNSTAP 10015 isc_result_t result; 10016 isc_sockaddr_t localaddr, *la = NULL; 10017 unsigned char zone[DNS_NAME_MAXWIRE]; 10018 dns_transport_type_t transport_type; 10019 dns_dtmsgtype_t dtmsgtype; 10020 dns_compress_t cctx; 10021 isc_region_t zr; 10022 isc_buffer_t zb; 10023 #endif /* HAVE_DNSTAP */ 10024 10025 dns_message_logfmtpacket( 10026 rctx->query->rmessage, "received packet from", 10027 &rctx->query->addrinfo->sockaddr, DNS_LOGCATEGORY_RESOLVER, 10028 DNS_LOGMODULE_PACKETS, &dns_master_style_comment, 10029 ISC_LOG_DEBUG(10), fctx->mctx); 10030 10031 #ifdef HAVE_DNSTAP 10032 /* 10033 * Log the response via dnstap. 10034 */ 10035 memset(&zr, 0, sizeof(zr)); 10036 dns_compress_init(&cctx, fctx->mctx, 0); 10037 dns_compress_setpermitted(&cctx, false); 10038 isc_buffer_init(&zb, zone, sizeof(zone)); 10039 result = dns_name_towire(fctx->domain, &cctx, &zb, NULL); 10040 if (result == ISC_R_SUCCESS) { 10041 isc_buffer_usedregion(&zb, &zr); 10042 } 10043 dns_compress_invalidate(&cctx); 10044 10045 /* 10046 * Check if the response came from a forwarder to correctly 10047 * classify as Forward Response (FR) vs Recursive Response (RR) 10048 * for DNSTAP logging. This is more accurate than using the RD 10049 * flag which only indicates the original query intent. 10050 */ 10051 if (ISFORWARDER(rctx->query->addrinfo)) { 10052 dtmsgtype = DNS_DTTYPE_FR; 10053 } else { 10054 dtmsgtype = DNS_DTTYPE_RR; 10055 } 10056 10057 result = dns_dispentry_getlocaladdress(rctx->query->dispentry, 10058 &localaddr); 10059 if (result == ISC_R_SUCCESS) { 10060 la = &localaddr; 10061 } 10062 10063 if (rctx->query->addrinfo->transport != NULL) { 10064 transport_type = dns_transport_get_type( 10065 rctx->query->addrinfo->transport); 10066 } else if ((rctx->query->options & DNS_FETCHOPT_TCP) != 0) { 10067 transport_type = DNS_TRANSPORT_TCP; 10068 } else { 10069 transport_type = DNS_TRANSPORT_UDP; 10070 } 10071 10072 dns_dt_send(fctx->res->view, dtmsgtype, la, 10073 &rctx->query->addrinfo->sockaddr, transport_type, &zr, 10074 &rctx->query->start, NULL, &rctx->buffer); 10075 #endif /* HAVE_DNSTAP */ 10076 } 10077 10078 /* 10079 * rctx_badserver(): 10080 * Is the remote server broken, or does it dislike us? 10081 */ 10082 static isc_result_t 10083 rctx_badserver(respctx_t *rctx, isc_result_t result) { 10084 fetchctx_t *fctx = rctx->fctx; 10085 resquery_t *query = rctx->query; 10086 isc_buffer_t b; 10087 char code[64]; 10088 dns_rcode_t rcode = rctx->query->rmessage->rcode; 10089 10090 if (rcode == dns_rcode_noerror || rcode == dns_rcode_yxdomain || 10091 rcode == dns_rcode_nxdomain) 10092 { 10093 return ISC_R_SUCCESS; 10094 } 10095 10096 if ((rcode == dns_rcode_formerr) && rctx->opt == NULL && 10097 (rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0) 10098 { 10099 /* 10100 * It's very likely they don't like EDNS0. 10101 */ 10102 rctx->retryopts |= DNS_FETCHOPT_NOEDNS0; 10103 rctx->resend = true; 10104 /* 10105 * Remember that they may not like EDNS0. 10106 */ 10107 inc_stats(fctx->res, dns_resstatscounter_edns0fail); 10108 } else if (rcode == dns_rcode_formerr) { 10109 if (query->rmessage->cc_echoed) { 10110 /* 10111 * Retry without DNS COOKIE. 10112 */ 10113 query->addrinfo->flags |= FCTX_ADDRINFO_NOCOOKIE; 10114 rctx->resend = true; 10115 log_formerr(fctx, "server sent FORMERR with echoed DNS " 10116 "COOKIE"); 10117 } else { 10118 /* 10119 * The server (or forwarder) doesn't understand us, 10120 * but others might. 10121 */ 10122 rctx->next_server = true; 10123 rctx->broken_server = DNS_R_REMOTEFORMERR; 10124 log_formerr(fctx, "server sent FORMERR"); 10125 } 10126 } else if (rcode == dns_rcode_badvers) { 10127 unsigned int version; 10128 #if DNS_EDNS_VERSION > 0 10129 unsigned int flags, mask; 10130 #endif /* if DNS_EDNS_VERSION > 0 */ 10131 10132 INSIST(rctx->opt != NULL); 10133 version = (rctx->opt->ttl >> 16) & 0xff; 10134 #if DNS_EDNS_VERSION > 0 10135 flags = (version << DNS_FETCHOPT_EDNSVERSIONSHIFT) | 10136 DNS_FETCHOPT_EDNSVERSIONSET; 10137 mask = DNS_FETCHOPT_EDNSVERSIONMASK | 10138 DNS_FETCHOPT_EDNSVERSIONSET; 10139 #endif /* if DNS_EDNS_VERSION > 0 */ 10140 10141 /* 10142 * Record that we got a good EDNS response. 10143 */ 10144 if (query->ednsversion > (int)version && 10145 !EDNSOK(query->addrinfo)) 10146 { 10147 dns_adb_changeflags(fctx->adb, query->addrinfo, 10148 FCTX_ADDRINFO_EDNSOK, 10149 FCTX_ADDRINFO_EDNSOK); 10150 } 10151 10152 /* 10153 * RFC 2671 was not clear that unknown options should 10154 * be ignored. RFC 6891 is clear that that they 10155 * should be ignored. If we are supporting the 10156 * experimental EDNS > 0 then perform strict 10157 * version checking of badvers responses. We won't 10158 * be sending COOKIE etc. in that case. 10159 */ 10160 #if DNS_EDNS_VERSION > 0 10161 if ((int)version < query->ednsversion) { 10162 dns_adb_changeflags(fctx->adb, query->addrinfo, flags, 10163 mask); 10164 rctx->resend = true; 10165 } else { 10166 rctx->broken_server = DNS_R_BADVERS; 10167 rctx->next_server = true; 10168 } 10169 #else /* if DNS_EDNS_VERSION > 0 */ 10170 rctx->broken_server = DNS_R_BADVERS; 10171 rctx->next_server = true; 10172 #endif /* if DNS_EDNS_VERSION > 0 */ 10173 } else if (rcode == dns_rcode_badcookie && rctx->query->rmessage->cc_ok) 10174 { 10175 /* 10176 * We have recorded the new cookie. 10177 */ 10178 if (BADCOOKIE(query->addrinfo)) { 10179 rctx->retryopts |= DNS_FETCHOPT_TCP; 10180 } 10181 query->addrinfo->flags |= FCTX_ADDRINFO_BADCOOKIE; 10182 rctx->resend = true; 10183 } else { 10184 rctx->broken_server = DNS_R_UNEXPECTEDRCODE; 10185 rctx->next_server = true; 10186 } 10187 10188 isc_buffer_init(&b, code, sizeof(code) - 1); 10189 dns_rcode_totext(rcode, &b); 10190 code[isc_buffer_usedlength(&b)] = '\0'; 10191 FCTXTRACE2("remote server broken: returned ", code); 10192 rctx_done(rctx, result); 10193 10194 return ISC_R_COMPLETE; 10195 } 10196 10197 /* 10198 * rctx_lameserver(): 10199 * Is the server lame? 10200 */ 10201 static isc_result_t 10202 rctx_lameserver(respctx_t *rctx) { 10203 isc_result_t result = ISC_R_SUCCESS; 10204 fetchctx_t *fctx = rctx->fctx; 10205 resquery_t *query = rctx->query; 10206 10207 if (ISFORWARDER(query->addrinfo) || !is_lame(fctx, query->rmessage)) { 10208 return ISC_R_SUCCESS; 10209 } 10210 10211 inc_stats(fctx->res, dns_resstatscounter_lame); 10212 log_lame(fctx, query->addrinfo); 10213 rctx->broken_server = DNS_R_LAME; 10214 rctx->next_server = true; 10215 FCTXTRACE("lame server"); 10216 rctx_done(rctx, result); 10217 10218 return ISC_R_COMPLETE; 10219 } 10220 10221 /*** 10222 *** Resolver Methods 10223 ***/ 10224 static void 10225 dns_resolver__destroy(dns_resolver_t *res) { 10226 alternate_t *a = NULL; 10227 10228 REQUIRE(!atomic_load_acquire(&res->priming)); 10229 REQUIRE(res->primefetch == NULL); 10230 10231 RTRACE("destroy"); 10232 10233 res->magic = 0; 10234 10235 dns_nametree_detach(&res->algorithms); 10236 dns_nametree_detach(&res->digests); 10237 dns_nametree_detach(&res->mustbesecure); 10238 10239 if (res->querystats != NULL) { 10240 dns_stats_detach(&res->querystats); 10241 } 10242 if (res->stats != NULL) { 10243 isc_stats_detach(&res->stats); 10244 } 10245 10246 isc_mutex_destroy(&res->primelock); 10247 isc_mutex_destroy(&res->lock); 10248 10249 INSIST(isc_hashmap_count(res->fctxs) == 0); 10250 isc_hashmap_destroy(&res->fctxs); 10251 isc_rwlock_destroy(&res->fctxs_lock); 10252 10253 INSIST(isc_hashmap_count(res->counters) == 0); 10254 isc_hashmap_destroy(&res->counters); 10255 isc_rwlock_destroy(&res->counters_lock); 10256 10257 isc_tlsctx_cache_detach(&res->tlsctx_cache); 10258 10259 if (res->dispatches4 != NULL) { 10260 dns_dispatchset_destroy(&res->dispatches4); 10261 } 10262 if (res->dispatches6 != NULL) { 10263 dns_dispatchset_destroy(&res->dispatches6); 10264 } 10265 while ((a = ISC_LIST_HEAD(res->alternates)) != NULL) { 10266 ISC_LIST_UNLINK(res->alternates, a, link); 10267 if (!a->isaddress) { 10268 dns_name_free(&a->_u._n.name, res->mctx); 10269 } 10270 isc_mem_put(res->mctx, a, sizeof(*a)); 10271 } 10272 10273 dns_view_weakdetach(&res->view); 10274 10275 for (size_t i = 0; i < res->nloops; i++) { 10276 dns_message_destroypools(&res->namepools[i], &res->rdspools[i]); 10277 } 10278 isc_mem_cput(res->mctx, res->rdspools, res->nloops, 10279 sizeof(res->rdspools[0])); 10280 isc_mem_cput(res->mctx, res->namepools, res->nloops, 10281 sizeof(res->namepools[0])); 10282 10283 isc_mem_putanddetach(&res->mctx, res, sizeof(*res)); 10284 } 10285 10286 static void 10287 spillattimer_countdown(void *arg) { 10288 dns_resolver_t *res = (dns_resolver_t *)arg; 10289 unsigned int spillat = 0; 10290 10291 REQUIRE(VALID_RESOLVER(res)); 10292 10293 if (atomic_load(&res->exiting)) { 10294 isc_timer_destroy(&res->spillattimer); 10295 return; 10296 } 10297 10298 LOCK(&res->lock); 10299 INSIST(!atomic_load_acquire(&res->exiting)); 10300 if (res->spillat > res->spillatmin) { 10301 spillat = --res->spillat; 10302 } 10303 if (res->spillat <= res->spillatmin) { 10304 isc_timer_destroy(&res->spillattimer); 10305 } 10306 UNLOCK(&res->lock); 10307 if (spillat > 0) { 10308 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 10309 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 10310 "clients-per-query decreased to %u", spillat); 10311 } 10312 } 10313 10314 isc_result_t 10315 dns_resolver_create(dns_view_t *view, isc_loopmgr_t *loopmgr, isc_nm_t *nm, 10316 unsigned int options, isc_tlsctx_cache_t *tlsctx_cache, 10317 dns_dispatch_t *dispatchv4, dns_dispatch_t *dispatchv6, 10318 dns_resolver_t **resp) { 10319 dns_resolver_t *res = NULL; 10320 10321 /* 10322 * Create a resolver. 10323 */ 10324 10325 REQUIRE(DNS_VIEW_VALID(view)); 10326 REQUIRE(resp != NULL && *resp == NULL); 10327 REQUIRE(tlsctx_cache != NULL); 10328 REQUIRE(dispatchv4 != NULL || dispatchv6 != NULL); 10329 10330 res = isc_mem_get(view->mctx, sizeof(*res)); 10331 *res = (dns_resolver_t){ 10332 .loopmgr = loopmgr, 10333 .rdclass = view->rdclass, 10334 .nm = nm, 10335 .options = options, 10336 .spillatmin = 10, 10337 .spillat = 10, 10338 .spillatmax = 100, 10339 .retryinterval = 800, 10340 .nonbackofftries = 3, 10341 .query_timeout = DEFAULT_QUERY_TIMEOUT, 10342 .maxdepth = DEFAULT_RECURSION_DEPTH, 10343 .maxqueries = DEFAULT_MAX_QUERIES, 10344 .alternates = ISC_LIST_INITIALIZER, 10345 .nloops = isc_loopmgr_nloops(loopmgr), 10346 .maxvalidations = DEFAULT_MAX_VALIDATIONS, 10347 .maxvalidationfails = DEFAULT_MAX_VALIDATION_FAILURES, 10348 }; 10349 10350 RTRACE("create"); 10351 10352 dns_view_weakattach(view, &res->view); 10353 isc_mem_attach(view->mctx, &res->mctx); 10354 10355 res->quotaresp[dns_quotatype_zone] = DNS_R_DROP; 10356 res->quotaresp[dns_quotatype_server] = DNS_R_SERVFAIL; 10357 10358 #if DNS_RESOLVER_TRACE 10359 fprintf(stderr, "dns_resolver__init:%s:%s:%d:%p->references = 1\n", 10360 __func__, __FILE__, __LINE__, res); 10361 #endif 10362 isc_refcount_init(&res->references, 1); 10363 10364 isc_hashmap_create(view->mctx, RES_DOMAIN_HASH_BITS, &res->fctxs); 10365 isc_rwlock_init(&res->fctxs_lock); 10366 10367 isc_hashmap_create(view->mctx, RES_DOMAIN_HASH_BITS, &res->counters); 10368 isc_rwlock_init(&res->counters_lock); 10369 10370 if (dispatchv4 != NULL) { 10371 dns_dispatchset_create(res->mctx, dispatchv4, &res->dispatches4, 10372 res->nloops); 10373 } 10374 10375 if (dispatchv6 != NULL) { 10376 dns_dispatchset_create(res->mctx, dispatchv6, &res->dispatches6, 10377 res->nloops); 10378 } 10379 10380 isc_tlsctx_cache_attach(tlsctx_cache, &res->tlsctx_cache); 10381 10382 isc_mutex_init(&res->lock); 10383 isc_mutex_init(&res->primelock); 10384 10385 dns_nametree_create(res->mctx, DNS_NAMETREE_BITS, "algorithms", 10386 &res->algorithms); 10387 dns_nametree_create(res->mctx, DNS_NAMETREE_BITS, "ds-digests", 10388 &res->digests); 10389 dns_nametree_create(res->mctx, DNS_NAMETREE_BOOL, 10390 "dnssec-must-be-secure", &res->mustbesecure); 10391 10392 res->namepools = isc_mem_cget(res->mctx, res->nloops, 10393 sizeof(res->namepools[0])); 10394 res->rdspools = isc_mem_cget(res->mctx, res->nloops, 10395 sizeof(res->rdspools[0])); 10396 for (size_t i = 0; i < res->nloops; i++) { 10397 isc_loop_t *loop = isc_loop_get(res->loopmgr, i); 10398 isc_mem_t *pool_mctx = isc_loop_getmctx(loop); 10399 10400 dns_message_createpools(pool_mctx, &res->namepools[i], 10401 &res->rdspools[i]); 10402 } 10403 10404 res->magic = RES_MAGIC; 10405 10406 *resp = res; 10407 10408 return ISC_R_SUCCESS; 10409 } 10410 10411 static void 10412 prime_done(void *arg) { 10413 dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg; 10414 dns_resolver_t *res = resp->arg; 10415 dns_fetch_t *fetch = NULL; 10416 dns_db_t *db = NULL; 10417 10418 REQUIRE(VALID_RESOLVER(res)); 10419 10420 int level = (resp->result == ISC_R_SUCCESS) ? ISC_LOG_DEBUG(1) 10421 : ISC_LOG_NOTICE; 10422 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 10423 DNS_LOGMODULE_RESOLVER, level, 10424 "resolver priming query complete: %s", 10425 isc_result_totext(resp->result)); 10426 10427 LOCK(&res->primelock); 10428 fetch = res->primefetch; 10429 res->primefetch = NULL; 10430 UNLOCK(&res->primelock); 10431 10432 atomic_compare_exchange_enforced(&res->priming, &(bool){ true }, false); 10433 10434 if (resp->result == ISC_R_SUCCESS && res->view->cache != NULL && 10435 res->view->hints != NULL) 10436 { 10437 dns_cache_attachdb(res->view->cache, &db); 10438 dns_root_checkhints(res->view, res->view->hints, db); 10439 dns_db_detach(&db); 10440 } 10441 10442 if (resp->node != NULL) { 10443 dns_db_detachnode(resp->db, &resp->node); 10444 } 10445 if (resp->db != NULL) { 10446 dns_db_detach(&resp->db); 10447 } 10448 if (dns_rdataset_isassociated(resp->rdataset)) { 10449 dns_rdataset_disassociate(resp->rdataset); 10450 } 10451 INSIST(resp->sigrdataset == NULL); 10452 10453 isc_mem_put(res->mctx, resp->rdataset, sizeof(*resp->rdataset)); 10454 dns_resolver_freefresp(&resp); 10455 dns_resolver_destroyfetch(&fetch); 10456 } 10457 10458 void 10459 dns_resolver_prime(dns_resolver_t *res) { 10460 bool want_priming = false; 10461 isc_result_t result; 10462 10463 REQUIRE(VALID_RESOLVER(res)); 10464 REQUIRE(res->frozen); 10465 10466 RTRACE("dns_resolver_prime"); 10467 10468 if (!atomic_load_acquire(&res->exiting)) { 10469 want_priming = atomic_compare_exchange_strong_acq_rel( 10470 &res->priming, &(bool){ false }, true); 10471 } 10472 10473 if (want_priming) { 10474 /* 10475 * To avoid any possible recursive locking problems, we 10476 * start the priming fetch like any other fetch, and 10477 * holding no resolver locks. No one else will try to 10478 * start it because we're the ones who set res->priming 10479 * to true. Any other callers of dns_resolver_prime() 10480 * while we're running will see that res->priming is 10481 * already true and do nothing. 10482 */ 10483 RTRACE("priming"); 10484 10485 dns_rdataset_t *rdataset = isc_mem_get(res->mctx, 10486 sizeof(*rdataset)); 10487 dns_rdataset_init(rdataset); 10488 10489 LOCK(&res->primelock); 10490 result = dns_resolver_createfetch( 10491 res, dns_rootname, dns_rdatatype_ns, NULL, NULL, NULL, 10492 NULL, 0, DNS_FETCHOPT_NOFORWARD, 0, NULL, NULL, NULL, 10493 isc_loop(), prime_done, res, NULL, rdataset, NULL, 10494 &res->primefetch); 10495 UNLOCK(&res->primelock); 10496 10497 if (result != ISC_R_SUCCESS) { 10498 isc_mem_put(res->mctx, rdataset, sizeof(*rdataset)); 10499 atomic_compare_exchange_enforced( 10500 &res->priming, &(bool){ true }, false); 10501 } 10502 inc_stats(res, dns_resstatscounter_priming); 10503 } 10504 } 10505 10506 void 10507 dns_resolver_freeze(dns_resolver_t *res) { 10508 /* 10509 * Freeze resolver. 10510 */ 10511 10512 REQUIRE(VALID_RESOLVER(res)); 10513 10514 res->frozen = true; 10515 } 10516 10517 void 10518 dns_resolver_shutdown(dns_resolver_t *res) { 10519 isc_result_t result; 10520 bool is_false = false; 10521 10522 REQUIRE(VALID_RESOLVER(res)); 10523 10524 RTRACE("shutdown"); 10525 10526 if (atomic_compare_exchange_strong(&res->exiting, &is_false, true)) { 10527 isc_hashmap_iter_t *it = NULL; 10528 10529 RTRACE("exiting"); 10530 10531 RWLOCK(&res->fctxs_lock, isc_rwlocktype_write); 10532 isc_hashmap_iter_create(res->fctxs, &it); 10533 for (result = isc_hashmap_iter_first(it); 10534 result == ISC_R_SUCCESS; 10535 result = isc_hashmap_iter_next(it)) 10536 { 10537 fetchctx_t *fctx = NULL; 10538 10539 isc_hashmap_iter_current(it, (void **)&fctx); 10540 INSIST(fctx != NULL); 10541 10542 fetchctx_ref(fctx); 10543 isc_async_run(fctx->loop, fctx_shutdown, fctx); 10544 } 10545 isc_hashmap_iter_destroy(&it); 10546 RWUNLOCK(&res->fctxs_lock, isc_rwlocktype_write); 10547 10548 LOCK(&res->lock); 10549 if (res->spillattimer != NULL) { 10550 isc_timer_async_destroy(&res->spillattimer); 10551 } 10552 UNLOCK(&res->lock); 10553 } 10554 } 10555 10556 #if DNS_RESOLVER_TRACE 10557 ISC_REFCOUNT_TRACE_IMPL(dns_resolver, dns_resolver__destroy); 10558 #else 10559 ISC_REFCOUNT_IMPL(dns_resolver, dns_resolver__destroy); 10560 #endif 10561 10562 static void 10563 log_fetch(const dns_name_t *name, dns_rdatatype_t type) { 10564 char namebuf[DNS_NAME_FORMATSIZE]; 10565 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 10566 int level = ISC_LOG_DEBUG(1); 10567 10568 /* 10569 * If there's no chance of logging it, don't render (format) the 10570 * name and RDATA type (further below), and return early. 10571 */ 10572 if (!isc_log_wouldlog(dns_lctx, level)) { 10573 return; 10574 } 10575 10576 dns_name_format(name, namebuf, sizeof(namebuf)); 10577 dns_rdatatype_format(type, typebuf, sizeof(typebuf)); 10578 10579 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 10580 DNS_LOGMODULE_RESOLVER, level, "fetch: %s/%s", namebuf, 10581 typebuf); 10582 } 10583 10584 static void 10585 fctx_minimize_qname(fetchctx_t *fctx) { 10586 isc_result_t result; 10587 unsigned int dlabels, nlabels; 10588 dns_name_t name; 10589 10590 REQUIRE(VALID_FCTX(fctx)); 10591 10592 dns_name_init(&name, NULL); 10593 10594 dlabels = dns_name_countlabels(fctx->qmindcname); 10595 nlabels = dns_name_countlabels(fctx->name); 10596 10597 if (dlabels > fctx->qmin_labels) { 10598 fctx->qmin_labels = dlabels + 1; 10599 } else { 10600 fctx->qmin_labels++; 10601 } 10602 10603 if (fctx->ip6arpaskip) { 10604 /* 10605 * For ip6.arpa we want to skip some of the labels, with 10606 * boundaries at /16, /32, /48, /56, /64 and /128 10607 * In 'label count' terms that's equal to 10608 * 7 11 15 17 19 35 10609 * We fix fctx->qmin_labels to point to the nearest 10610 * boundary 10611 */ 10612 if (fctx->qmin_labels < 7) { 10613 fctx->qmin_labels = 7; 10614 } else if (fctx->qmin_labels < 11) { 10615 fctx->qmin_labels = 11; 10616 } else if (fctx->qmin_labels < 15) { 10617 fctx->qmin_labels = 15; 10618 } else if (fctx->qmin_labels < 17) { 10619 fctx->qmin_labels = 17; 10620 } else if (fctx->qmin_labels < 19) { 10621 fctx->qmin_labels = 19; 10622 } else if (fctx->qmin_labels < 35) { 10623 fctx->qmin_labels = 35; 10624 } else { 10625 fctx->qmin_labels = nlabels; 10626 } 10627 } else if (fctx->qmin_labels > DNS_QMIN_MAXLABELS) { 10628 fctx->qmin_labels = DNS_NAME_MAXLABELS; 10629 } 10630 10631 if (fctx->qmin_labels < nlabels) { 10632 dns_rdataset_t rdataset; 10633 dns_fixedname_t fixed; 10634 dns_name_t *fname = dns_fixedname_initname(&fixed); 10635 dns_rdataset_init(&rdataset); 10636 do { 10637 /* 10638 * We want to query for qmin_labels from fctx->name. 10639 */ 10640 dns_name_split(fctx->name, fctx->qmin_labels, NULL, 10641 &name); 10642 /* 10643 * Look to see if we have anything cached about NS 10644 * RRsets at this name and if so skip this name and 10645 * try with an additional label prepended. 10646 */ 10647 result = dns_db_find(fctx->cache, &name, NULL, 10648 dns_rdatatype_ns, 0, 0, NULL, 10649 fname, &rdataset, NULL); 10650 if (dns_rdataset_isassociated(&rdataset)) { 10651 dns_rdataset_disassociate(&rdataset); 10652 } 10653 switch (result) { 10654 case ISC_R_SUCCESS: 10655 case DNS_R_CNAME: 10656 case DNS_R_DNAME: 10657 case DNS_R_NCACHENXDOMAIN: 10658 case DNS_R_NCACHENXRRSET: 10659 fctx->qmin_labels++; 10660 continue; 10661 default: 10662 break; 10663 } 10664 break; 10665 } while (fctx->qmin_labels < nlabels); 10666 } 10667 10668 if (fctx->qmin_labels < nlabels) { 10669 dns_name_copy(&name, fctx->qminname); 10670 fctx->qmintype = dns_rdatatype_ns; 10671 fctx->minimized = true; 10672 } else { 10673 /* Minimization is done, we'll ask for whole qname */ 10674 dns_name_copy(fctx->name, fctx->qminname); 10675 fctx->qmintype = fctx->type; 10676 fctx->minimized = false; 10677 } 10678 10679 char domainbuf[DNS_NAME_FORMATSIZE]; 10680 dns_name_format(fctx->qminname, domainbuf, sizeof(domainbuf)); 10681 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 10682 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(5), 10683 "QNAME minimization - %s minimized, qmintype %d " 10684 "qminname %s", 10685 fctx->minimized ? "" : "not", fctx->qmintype, domainbuf); 10686 } 10687 10688 static isc_result_t 10689 get_attached_fctx(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name, 10690 dns_rdatatype_t type, const dns_name_t *domain, 10691 dns_rdataset_t *nameservers, const isc_sockaddr_t *client, 10692 unsigned int options, unsigned int depth, isc_counter_t *qc, 10693 isc_counter_t *gqc, fetchctx_t *parent, fetchctx_t **fctxp, 10694 bool *new_fctx) { 10695 isc_result_t result; 10696 fetchctx_t key = { 10697 .name = UNCONST(name), 10698 .options = options, 10699 .type = type, 10700 }; 10701 fetchctx_t *fctx = NULL; 10702 isc_rwlocktype_t locktype = isc_rwlocktype_read; 10703 uint32_t hashval = fctx_hash(&key); 10704 10705 again: 10706 RWLOCK(&res->fctxs_lock, locktype); 10707 result = isc_hashmap_find(res->fctxs, hashval, fctx_match, &key, 10708 (void **)&fctx); 10709 switch (result) { 10710 case ISC_R_SUCCESS: 10711 break; 10712 case ISC_R_NOTFOUND: 10713 result = fctx_create(res, loop, name, type, domain, nameservers, 10714 client, options, depth, qc, gqc, parent, 10715 &fctx); 10716 if (result != ISC_R_SUCCESS) { 10717 RWUNLOCK(&res->fctxs_lock, locktype); 10718 return result; 10719 } 10720 10721 UPGRADELOCK(&res->fctxs_lock, locktype); 10722 10723 void *found = NULL; 10724 result = isc_hashmap_add(res->fctxs, hashval, fctx_match, fctx, 10725 fctx, &found); 10726 if (result == ISC_R_SUCCESS) { 10727 *new_fctx = true; 10728 } else { 10729 /* 10730 * The fctx_done() tries to acquire the fctxs_lock. 10731 * Destroy the newly created fetchctx directly. 10732 */ 10733 fctx->state = fetchstate_done; 10734 isc_timer_destroy(&fctx->timer); 10735 10736 fetchctx_detach(&fctx); 10737 fctx = found; 10738 result = ISC_R_SUCCESS; 10739 } 10740 break; 10741 default: 10742 UNREACHABLE(); 10743 } 10744 INSIST(result == ISC_R_SUCCESS); 10745 fetchctx_ref(fctx); 10746 10747 /* 10748 * We need to lock the fetch context before unlocking the hash table to 10749 * prevent other threads from looking up this thread before it has been 10750 * properly initialized and started. 10751 */ 10752 LOCK(&fctx->lock); 10753 RWUNLOCK(&res->fctxs_lock, locktype); 10754 10755 if (SHUTTINGDOWN(fctx) || fctx->cloned) { 10756 /* 10757 * This is the single place where fctx might get 10758 * accesses from a different thread, so we need to 10759 * double check whether fctxs is done (or cloned) and 10760 * help with the release if the fctx has been cloned. 10761 */ 10762 UNLOCK(&fctx->lock); 10763 10764 /* The fctx will get deleted either here or in fctx__done() */ 10765 RWLOCK(&res->fctxs_lock, isc_rwlocktype_write); 10766 (void)isc_hashmap_delete(res->fctxs, fctx_hash(fctx), match_ptr, 10767 fctx); 10768 RWUNLOCK(&res->fctxs_lock, isc_rwlocktype_write); 10769 10770 fetchctx_detach(&fctx); 10771 goto again; 10772 } 10773 10774 /* 10775 * The function returns a locked fetch context, 10776 */ 10777 *fctxp = fctx; 10778 10779 return result; 10780 } 10781 10782 static bool 10783 is_samedomain(const dns_name_t *domain1, const dns_name_t *domain2) { 10784 if (domain1 == NULL && domain2 == NULL) { 10785 return true; 10786 } 10787 10788 if (domain1 == NULL || domain2 == NULL) { 10789 return false; 10790 } 10791 10792 return !dns_name_compare(domain1, domain2); 10793 } 10794 10795 static bool 10796 waiting_for_fetch(const fetchctx_t *parent, const fetchctx_t *cur) { 10797 for (const fetchctx_t *fctx = parent; fctx != NULL; fctx = fctx->parent) 10798 { 10799 if (cur->type == fctx->type && 10800 !dns_name_compare(cur->name, fctx->name) && 10801 is_samedomain(cur->domain, fctx->domain)) 10802 { 10803 return true; 10804 } 10805 } 10806 return false; 10807 } 10808 10809 isc_result_t 10810 dns_resolver_createfetch(dns_resolver_t *res, const dns_name_t *name, 10811 dns_rdatatype_t type, const dns_name_t *domain, 10812 dns_rdataset_t *nameservers, 10813 dns_forwarders_t *forwarders, 10814 const isc_sockaddr_t *client, dns_messageid_t id, 10815 unsigned int options, unsigned int depth, 10816 isc_counter_t *qc, isc_counter_t *gqc, 10817 fetchctx_t *parent, isc_loop_t *loop, isc_job_cb cb, 10818 void *arg, dns_edectx_t *edectx, 10819 dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset, 10820 dns_fetch_t **fetchp) { 10821 dns_fetch_t *fetch = NULL; 10822 fetchctx_t *fctx = NULL; 10823 isc_result_t result = ISC_R_SUCCESS; 10824 bool new_fctx = false; 10825 unsigned int count = 0; 10826 unsigned int spillat; 10827 unsigned int spillatmin; 10828 isc_mem_t *mctx = isc_loop_getmctx(loop); 10829 10830 UNUSED(forwarders); 10831 10832 REQUIRE(VALID_RESOLVER(res)); 10833 REQUIRE(res->frozen); 10834 /* XXXRTH Check for meta type */ 10835 if (domain != NULL) { 10836 REQUIRE(DNS_RDATASET_VALID(nameservers)); 10837 REQUIRE(nameservers->type == dns_rdatatype_ns); 10838 } else { 10839 REQUIRE(nameservers == NULL); 10840 } 10841 REQUIRE(forwarders == NULL); 10842 REQUIRE(!dns_rdataset_isassociated(rdataset)); 10843 REQUIRE(sigrdataset == NULL || !dns_rdataset_isassociated(sigrdataset)); 10844 REQUIRE(fetchp != NULL && *fetchp == NULL); 10845 10846 if (atomic_load_acquire(&res->exiting)) { 10847 return ISC_R_SHUTTINGDOWN; 10848 } 10849 10850 log_fetch(name, type); 10851 10852 fetch = isc_mem_get(mctx, sizeof(*fetch)); 10853 *fetch = (dns_fetch_t){ 0 }; 10854 10855 dns_resolver_attach(res, &fetch->res); 10856 isc_mem_attach(mctx, &fetch->mctx); 10857 10858 if ((options & DNS_FETCHOPT_UNSHARED) == 0) { 10859 /* 10860 * We don't save the unshared fetch context to a bucket because 10861 * we also would never match it again. 10862 */ 10863 10864 LOCK(&res->lock); 10865 spillat = res->spillat; 10866 spillatmin = res->spillatmin; 10867 UNLOCK(&res->lock); 10868 10869 result = get_attached_fctx(res, loop, name, type, domain, 10870 nameservers, client, options, depth, 10871 qc, gqc, parent, &fctx, &new_fctx); 10872 if (result != ISC_R_SUCCESS) { 10873 goto fail; 10874 } 10875 10876 /* On success, the fctx is locked in get_attached_fctx() */ 10877 INSIST(!SHUTTINGDOWN(fctx)); 10878 10879 /* Is this a duplicate? */ 10880 if (client != NULL) { 10881 dns_fetchresponse_t *resp = NULL; 10882 for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL; 10883 resp = ISC_LIST_NEXT(resp, link)) 10884 { 10885 if (resp->client != NULL && resp->id == id && 10886 isc_sockaddr_equal(resp->client, client)) 10887 { 10888 result = DNS_R_DUPLICATE; 10889 goto unlock; 10890 } 10891 10892 count++; 10893 } 10894 } 10895 if (count >= spillatmin && spillatmin != 0) { 10896 if (count >= spillat) { 10897 fctx->spilled = true; 10898 } 10899 if (fctx->spilled) { 10900 inc_stats(res, dns_resstatscounter_clientquota); 10901 fctx->dropped++; 10902 result = DNS_R_DROP; 10903 goto unlock; 10904 } 10905 } 10906 } else { 10907 result = fctx_create(res, loop, name, type, domain, nameservers, 10908 client, options, depth, qc, gqc, parent, 10909 &fctx); 10910 if (result != ISC_R_SUCCESS) { 10911 goto fail; 10912 } 10913 new_fctx = true; 10914 } 10915 10916 RUNTIME_CHECK(fctx != NULL); 10917 10918 /* 10919 * This fetch loop detection enable to guard against loop scenarios 10920 * where the DNSSEC is involved. See 10921 * `4d307ac67a0e3f9831c9a4e66ac481e2f9ceebb5`. This is a complementary 10922 * detection with the ADB lookup loop detection (in `findname()`). 10923 */ 10924 if (!new_fctx && waiting_for_fetch(parent, fctx)) { 10925 if (isc_log_wouldlog(dns_lctx, ISC_LOG_INFO)) { 10926 char namebuf[DNS_NAME_FORMATSIZE + 1]; 10927 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 10928 char domainbuf[DNS_NAME_FORMATSIZE + 1] = { 0 }; 10929 10930 dns_name_format(name, namebuf, sizeof(namebuf)); 10931 dns_rdatatype_format(type, typebuf, sizeof(typebuf)); 10932 if (domain != NULL) { 10933 dns_name_format(domain, domainbuf, 10934 sizeof(domainbuf)); 10935 } 10936 10937 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 10938 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(2), 10939 "fetch loop detected resolving '%s/%s " 10940 "(in '%s'?)", 10941 namebuf, typebuf, domainbuf); 10942 } 10943 10944 result = DNS_R_LOOPDETECTED; 10945 goto unlock; 10946 } 10947 10948 if (fctx->depth > depth) { 10949 fctx->depth = depth; 10950 } 10951 10952 fctx->allowed++; 10953 10954 fctx_join(fctx, loop, client, id, cb, arg, edectx, rdataset, 10955 sigrdataset, fetch); 10956 10957 if (new_fctx) { 10958 fetchctx_ref(fctx); 10959 isc_async_run(fctx->loop, fctx_start, fctx); 10960 } 10961 10962 unlock: 10963 if ((options & DNS_FETCHOPT_UNSHARED) == 0) { 10964 UNLOCK(&fctx->lock); 10965 fetchctx_unref(fctx); 10966 } 10967 10968 fail: 10969 if (result != ISC_R_SUCCESS) { 10970 dns_resolver_detach(&fetch->res); 10971 isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch)); 10972 return result; 10973 } 10974 10975 FTRACE("created"); 10976 *fetchp = fetch; 10977 10978 return ISC_R_SUCCESS; 10979 } 10980 10981 void 10982 dns_resolver_cancelfetch(dns_fetch_t *fetch) { 10983 fetchctx_t *fctx = NULL; 10984 bool last_fetch = false; 10985 10986 REQUIRE(DNS_FETCH_VALID(fetch)); 10987 fctx = fetch->private; 10988 REQUIRE(VALID_FCTX(fctx)); 10989 10990 FTRACE("cancelfetch"); 10991 10992 LOCK(&fctx->lock); 10993 10994 /* 10995 * Find the completion event associated with this fetch (as opposed 10996 * to those for other fetches that have joined the same fctx) and run 10997 * the callback asynchronously with a ISC_R_CANCELED result. 10998 */ 10999 if (fctx->state != fetchstate_done) { 11000 dns_fetchresponse_t *next = NULL; 11001 for (dns_fetchresponse_t *resp = ISC_LIST_HEAD(fctx->resps); 11002 resp != NULL; resp = next) 11003 { 11004 next = ISC_LIST_NEXT(resp, link); 11005 11006 if (resp->fetch == fetch) { 11007 resp->result = ISC_R_CANCELED; 11008 ISC_LIST_UNLINK(fctx->resps, resp, link); 11009 isc_async_run(resp->loop, resp->cb, resp); 11010 break; 11011 } 11012 } 11013 } 11014 11015 if (ISC_LIST_EMPTY(fctx->resps)) { 11016 last_fetch = true; 11017 } 11018 UNLOCK(&fctx->lock); 11019 11020 if (last_fetch) { 11021 fetchctx_ref(fctx); 11022 isc_async_run(fctx->loop, fctx_shutdown, fctx); 11023 } 11024 } 11025 11026 void 11027 dns_resolver_destroyfetch(dns_fetch_t **fetchp) { 11028 dns_fetch_t *fetch = NULL; 11029 dns_resolver_t *res = NULL; 11030 fetchctx_t *fctx = NULL; 11031 11032 REQUIRE(fetchp != NULL); 11033 fetch = *fetchp; 11034 *fetchp = NULL; 11035 REQUIRE(DNS_FETCH_VALID(fetch)); 11036 fctx = fetch->private; 11037 REQUIRE(VALID_FCTX(fctx)); 11038 res = fetch->res; 11039 11040 FTRACE("destroyfetch"); 11041 11042 fetch->magic = 0; 11043 11044 LOCK(&fctx->lock); 11045 /* 11046 * Sanity check: the caller should have gotten its event before 11047 * trying to destroy the fetch. 11048 */ 11049 if (fctx->state != fetchstate_done) { 11050 dns_fetchresponse_t *resp = NULL, *next = NULL; 11051 for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL; 11052 resp = next) 11053 { 11054 next = ISC_LIST_NEXT(resp, link); 11055 RUNTIME_CHECK(resp->fetch != fetch); 11056 } 11057 } 11058 UNLOCK(&fctx->lock); 11059 11060 isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch)); 11061 11062 fetchctx_detach(&fctx); 11063 dns_resolver_detach(&res); 11064 } 11065 11066 void 11067 dns_resolver_logfetch(dns_fetch_t *fetch, isc_log_t *lctx, 11068 isc_logcategory_t *category, isc_logmodule_t *module, 11069 int level, bool duplicateok) { 11070 fetchctx_t *fctx = NULL; 11071 11072 REQUIRE(DNS_FETCH_VALID(fetch)); 11073 fctx = fetch->private; 11074 REQUIRE(VALID_FCTX(fctx)); 11075 11076 LOCK(&fctx->lock); 11077 11078 if (!fctx->logged || duplicateok) { 11079 char domainbuf[DNS_NAME_FORMATSIZE]; 11080 dns_name_format(fctx->domain, domainbuf, sizeof(domainbuf)); 11081 isc_log_write(lctx, category, module, level, 11082 "fetch completed for %s in " 11083 "%" PRIu64 "." 11084 "%06" PRIu64 ": %s/%s " 11085 "[domain:%s,referral:%u,restart:%u,qrysent:%u," 11086 "timeout:%u,lame:%u,quota:%u,neterr:%u," 11087 "badresp:%u,adberr:%u,findfail:%u,valfail:%u]", 11088 fctx->info, fctx->duration / US_PER_SEC, 11089 fctx->duration % US_PER_SEC, 11090 isc_result_totext(fctx->result), 11091 isc_result_totext(fctx->vresult), domainbuf, 11092 fctx->referrals, fctx->restarts, fctx->querysent, 11093 fctx->timeouts, fctx->lamecount, fctx->quotacount, 11094 fctx->neterr, fctx->badresp, fctx->adberr, 11095 fctx->findfail, fctx->valfail); 11096 fctx->logged = true; 11097 } 11098 11099 UNLOCK(&fctx->lock); 11100 } 11101 11102 dns_dispatch_t * 11103 dns_resolver_dispatchv4(dns_resolver_t *resolver) { 11104 REQUIRE(VALID_RESOLVER(resolver)); 11105 return dns_dispatchset_get(resolver->dispatches4); 11106 } 11107 11108 dns_dispatch_t * 11109 dns_resolver_dispatchv6(dns_resolver_t *resolver) { 11110 REQUIRE(VALID_RESOLVER(resolver)); 11111 return dns_dispatchset_get(resolver->dispatches6); 11112 } 11113 11114 void 11115 dns_resolver_addalternate(dns_resolver_t *res, const isc_sockaddr_t *alt, 11116 const dns_name_t *name, in_port_t port) { 11117 alternate_t *a; 11118 11119 REQUIRE(VALID_RESOLVER(res)); 11120 REQUIRE(!res->frozen); 11121 REQUIRE((alt == NULL) ^ (name == NULL)); 11122 11123 a = isc_mem_get(res->mctx, sizeof(*a)); 11124 if (alt != NULL) { 11125 a->isaddress = true; 11126 a->_u.addr = *alt; 11127 } else { 11128 a->isaddress = false; 11129 a->_u._n.port = port; 11130 dns_name_init(&a->_u._n.name, NULL); 11131 dns_name_dup(name, res->mctx, &a->_u._n.name); 11132 } 11133 ISC_LINK_INIT(a, link); 11134 ISC_LIST_APPEND(res->alternates, a, link); 11135 } 11136 11137 isc_result_t 11138 dns_resolver_disable_algorithm(dns_resolver_t *resolver, const dns_name_t *name, 11139 unsigned int alg) { 11140 REQUIRE(VALID_RESOLVER(resolver)); 11141 11142 if (alg > 255) { 11143 return ISC_R_RANGE; 11144 } 11145 11146 return dns_nametree_add(resolver->algorithms, name, alg); 11147 } 11148 11149 isc_result_t 11150 dns_resolver_disable_ds_digest(dns_resolver_t *resolver, const dns_name_t *name, 11151 unsigned int digest_type) { 11152 REQUIRE(VALID_RESOLVER(resolver)); 11153 11154 if (digest_type > 255) { 11155 return ISC_R_RANGE; 11156 } 11157 11158 return dns_nametree_add(resolver->digests, name, digest_type); 11159 } 11160 11161 bool 11162 dns_resolver_algorithm_supported(dns_resolver_t *resolver, 11163 const dns_name_t *name, unsigned int alg) { 11164 REQUIRE(VALID_RESOLVER(resolver)); 11165 11166 if ((alg == DST_ALG_DH) || (alg == DST_ALG_INDIRECT)) { 11167 return false; 11168 } 11169 11170 if (dns_nametree_covered(resolver->algorithms, name, NULL, alg)) { 11171 return false; 11172 } 11173 11174 return dst_algorithm_supported(alg); 11175 } 11176 11177 bool 11178 dns_resolver_ds_digest_supported(dns_resolver_t *resolver, 11179 const dns_name_t *name, 11180 unsigned int digest_type) { 11181 REQUIRE(VALID_RESOLVER(resolver)); 11182 11183 if (dns_nametree_covered(resolver->digests, name, NULL, digest_type)) { 11184 return false; 11185 } 11186 11187 return dst_ds_digest_supported(digest_type); 11188 } 11189 11190 isc_result_t 11191 dns_resolver_setmustbesecure(dns_resolver_t *resolver, const dns_name_t *name, 11192 bool value) { 11193 isc_result_t result; 11194 11195 REQUIRE(VALID_RESOLVER(resolver)); 11196 11197 result = dns_nametree_add(resolver->mustbesecure, name, value); 11198 return result; 11199 } 11200 11201 bool 11202 dns_resolver_getmustbesecure(dns_resolver_t *resolver, const dns_name_t *name) { 11203 REQUIRE(VALID_RESOLVER(resolver)); 11204 11205 return dns_nametree_covered(resolver->mustbesecure, name, NULL, 0); 11206 } 11207 11208 void 11209 dns_resolver_getclientsperquery(dns_resolver_t *resolver, uint32_t *cur, 11210 uint32_t *min, uint32_t *max) { 11211 REQUIRE(VALID_RESOLVER(resolver)); 11212 11213 LOCK(&resolver->lock); 11214 SET_IF_NOT_NULL(cur, resolver->spillat); 11215 SET_IF_NOT_NULL(min, resolver->spillatmin); 11216 SET_IF_NOT_NULL(max, resolver->spillatmax); 11217 UNLOCK(&resolver->lock); 11218 } 11219 11220 void 11221 dns_resolver_setclientsperquery(dns_resolver_t *resolver, uint32_t min, 11222 uint32_t max) { 11223 REQUIRE(VALID_RESOLVER(resolver)); 11224 11225 LOCK(&resolver->lock); 11226 resolver->spillatmin = resolver->spillat = min; 11227 resolver->spillatmax = max; 11228 UNLOCK(&resolver->lock); 11229 } 11230 11231 void 11232 dns_resolver_setfetchesperzone(dns_resolver_t *resolver, uint32_t clients) { 11233 REQUIRE(VALID_RESOLVER(resolver)); 11234 11235 atomic_store_release(&resolver->zspill, clients); 11236 } 11237 11238 uint32_t 11239 dns_resolver_getfetchesperzone(dns_resolver_t *resolver) { 11240 REQUIRE(VALID_RESOLVER(resolver)); 11241 11242 return atomic_load_relaxed(&resolver->zspill); 11243 } 11244 11245 bool 11246 dns_resolver_getzeronosoattl(dns_resolver_t *resolver) { 11247 REQUIRE(VALID_RESOLVER(resolver)); 11248 11249 return resolver->zero_no_soa_ttl; 11250 } 11251 11252 void 11253 dns_resolver_setzeronosoattl(dns_resolver_t *resolver, bool state) { 11254 REQUIRE(VALID_RESOLVER(resolver)); 11255 11256 resolver->zero_no_soa_ttl = state; 11257 } 11258 11259 unsigned int 11260 dns_resolver_getoptions(dns_resolver_t *resolver) { 11261 REQUIRE(VALID_RESOLVER(resolver)); 11262 11263 return resolver->options; 11264 } 11265 11266 unsigned int 11267 dns_resolver_gettimeout(dns_resolver_t *resolver) { 11268 REQUIRE(VALID_RESOLVER(resolver)); 11269 11270 return resolver->query_timeout; 11271 } 11272 11273 void 11274 dns_resolver_settimeout(dns_resolver_t *resolver, unsigned int timeout) { 11275 REQUIRE(VALID_RESOLVER(resolver)); 11276 11277 if (timeout < MINIMUM_QUERY_TIMEOUT) { 11278 timeout *= 1000; 11279 } 11280 11281 if (timeout == 0) { 11282 timeout = DEFAULT_QUERY_TIMEOUT; 11283 } 11284 if (timeout > MAXIMUM_QUERY_TIMEOUT) { 11285 timeout = MAXIMUM_QUERY_TIMEOUT; 11286 } 11287 if (timeout < MINIMUM_QUERY_TIMEOUT) { 11288 timeout = MINIMUM_QUERY_TIMEOUT; 11289 } 11290 11291 resolver->query_timeout = timeout; 11292 } 11293 11294 void 11295 dns_resolver_setmaxvalidations(dns_resolver_t *resolver, uint32_t max) { 11296 REQUIRE(VALID_RESOLVER(resolver)); 11297 atomic_store(&resolver->maxvalidations, max); 11298 } 11299 11300 void 11301 dns_resolver_setmaxvalidationfails(dns_resolver_t *resolver, uint32_t max) { 11302 REQUIRE(VALID_RESOLVER(resolver)); 11303 atomic_store(&resolver->maxvalidationfails, max); 11304 } 11305 11306 void 11307 dns_resolver_setmaxdepth(dns_resolver_t *resolver, unsigned int maxdepth) { 11308 REQUIRE(VALID_RESOLVER(resolver)); 11309 resolver->maxdepth = maxdepth; 11310 } 11311 11312 unsigned int 11313 dns_resolver_getmaxdepth(dns_resolver_t *resolver) { 11314 REQUIRE(VALID_RESOLVER(resolver)); 11315 return resolver->maxdepth; 11316 } 11317 11318 void 11319 dns_resolver_setmaxqueries(dns_resolver_t *resolver, unsigned int queries) { 11320 REQUIRE(VALID_RESOLVER(resolver)); 11321 resolver->maxqueries = queries; 11322 } 11323 11324 unsigned int 11325 dns_resolver_getmaxqueries(dns_resolver_t *resolver) { 11326 REQUIRE(VALID_RESOLVER(resolver)); 11327 return resolver->maxqueries; 11328 } 11329 11330 void 11331 dns_resolver_dumpfetches(dns_resolver_t *res, isc_statsformat_t format, 11332 FILE *fp) { 11333 isc_result_t result; 11334 isc_hashmap_iter_t *it = NULL; 11335 11336 REQUIRE(VALID_RESOLVER(res)); 11337 REQUIRE(fp != NULL); 11338 REQUIRE(format == isc_statsformat_file); 11339 11340 LOCK(&res->lock); 11341 fprintf(fp, "clients-per-query: %u/%u/%u\n", res->spillatmin, 11342 res->spillat, res->spillatmax); 11343 UNLOCK(&res->lock); 11344 11345 RWLOCK(&res->fctxs_lock, isc_rwlocktype_read); 11346 isc_hashmap_iter_create(res->fctxs, &it); 11347 for (result = isc_hashmap_iter_first(it); result == ISC_R_SUCCESS; 11348 result = isc_hashmap_iter_next(it)) 11349 { 11350 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 11351 char timebuf[1024]; 11352 fetchctx_t *fctx = NULL; 11353 dns_fetchresponse_t *resp = NULL; 11354 resquery_t *query = NULL; 11355 unsigned int resp_count = 0, query_count = 0; 11356 11357 isc_hashmap_iter_current(it, (void **)&fctx); 11358 11359 LOCK(&fctx->lock); 11360 dns_name_print(fctx->name, fp); 11361 11362 isc_time_formatISO8601ms(&fctx->start, timebuf, 11363 sizeof(timebuf)); 11364 11365 dns_rdatatype_format(fctx->type, typebuf, sizeof(typebuf)); 11366 11367 fprintf(fp, "/%s (%s), 0x%x: started %s, ", typebuf, 11368 fctx->state == fetchstate_done ? "done" 11369 : fctx->cloned ? "cloned" 11370 : "active", 11371 fctx->options, timebuf); 11372 11373 for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL; 11374 resp = ISC_LIST_NEXT(resp, link)) 11375 { 11376 resp_count++; 11377 } 11378 11379 for (query = ISC_LIST_HEAD(fctx->queries); query != NULL; 11380 query = ISC_LIST_NEXT(query, link)) 11381 { 11382 query_count++; 11383 } 11384 11385 if (isc_timer_running(fctx->timer)) { 11386 strlcpy(timebuf, "expires ", sizeof(timebuf)); 11387 isc_time_formatISO8601ms(&fctx->expires, timebuf + 8, 11388 sizeof(timebuf) - 8); 11389 } else { 11390 strlcpy(timebuf, "not running", sizeof(timebuf)); 11391 } 11392 11393 fprintf(fp, 11394 "fetches: %u active (%" PRIuFAST32 11395 " allowed, %" PRIuFAST32 11396 " dropped%s), queries: %u, timer %s\n", 11397 resp_count, fctx->allowed, fctx->dropped, 11398 fctx->spilled ? ", spilled" : "", query_count, timebuf); 11399 11400 UNLOCK(&fctx->lock); 11401 } 11402 isc_hashmap_iter_destroy(&it); 11403 RWUNLOCK(&res->fctxs_lock, isc_rwlocktype_read); 11404 } 11405 11406 isc_result_t 11407 dns_resolver_dumpquota(dns_resolver_t *res, isc_buffer_t **buf) { 11408 isc_result_t result; 11409 isc_hashmap_iter_t *it = NULL; 11410 uint_fast32_t spill; 11411 11412 REQUIRE(VALID_RESOLVER(res)); 11413 11414 spill = atomic_load_acquire(&res->zspill); 11415 if (spill == 0) { 11416 return ISC_R_SUCCESS; 11417 } 11418 11419 RWLOCK(&res->counters_lock, isc_rwlocktype_read); 11420 isc_hashmap_iter_create(res->counters, &it); 11421 for (result = isc_hashmap_iter_first(it); result == ISC_R_SUCCESS; 11422 result = isc_hashmap_iter_next(it)) 11423 { 11424 fctxcount_t *counter = NULL; 11425 uint_fast32_t count, dropped, allowed; 11426 char nb[DNS_NAME_FORMATSIZE]; 11427 char text[DNS_NAME_FORMATSIZE + BUFSIZ]; 11428 11429 isc_hashmap_iter_current(it, (void **)&counter); 11430 11431 LOCK(&counter->lock); 11432 count = counter->count; 11433 dropped = counter->dropped; 11434 allowed = counter->allowed; 11435 UNLOCK(&counter->lock); 11436 11437 if (count < spill) { 11438 continue; 11439 } 11440 11441 dns_name_format(counter->domain, nb, sizeof(nb)); 11442 snprintf(text, sizeof(text), 11443 "\n- %s: %" PRIuFAST32 " active (allowed %" PRIuFAST32 11444 " spilled %" PRIuFAST32 ")", 11445 nb, count, allowed, dropped); 11446 11447 result = isc_buffer_reserve(*buf, strlen(text)); 11448 if (result != ISC_R_SUCCESS) { 11449 goto cleanup; 11450 } 11451 isc_buffer_putstr(*buf, text); 11452 } 11453 if (result == ISC_R_NOMORE) { 11454 result = ISC_R_SUCCESS; 11455 } 11456 11457 cleanup: 11458 isc_hashmap_iter_destroy(&it); 11459 RWUNLOCK(&res->counters_lock, isc_rwlocktype_read); 11460 return result; 11461 } 11462 11463 void 11464 dns_resolver_setquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which, 11465 isc_result_t resp) { 11466 REQUIRE(VALID_RESOLVER(resolver)); 11467 REQUIRE(which == dns_quotatype_zone || which == dns_quotatype_server); 11468 REQUIRE(resp == DNS_R_DROP || resp == DNS_R_SERVFAIL); 11469 11470 resolver->quotaresp[which] = resp; 11471 } 11472 11473 isc_result_t 11474 dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which) { 11475 REQUIRE(VALID_RESOLVER(resolver)); 11476 REQUIRE(which == dns_quotatype_zone || which == dns_quotatype_server); 11477 11478 return resolver->quotaresp[which]; 11479 } 11480 11481 void 11482 dns_resolver_setstats(dns_resolver_t *res, isc_stats_t *stats) { 11483 REQUIRE(VALID_RESOLVER(res)); 11484 REQUIRE(res->stats == NULL); 11485 11486 isc_stats_attach(stats, &res->stats); 11487 11488 /* initialize the bucket "counter"; it's a static value */ 11489 set_stats(res, dns_resstatscounter_buckets, 11490 isc_loopmgr_nloops(res->loopmgr)); 11491 } 11492 11493 void 11494 dns_resolver_getstats(dns_resolver_t *res, isc_stats_t **statsp) { 11495 REQUIRE(VALID_RESOLVER(res)); 11496 REQUIRE(statsp != NULL && *statsp == NULL); 11497 11498 if (res->stats != NULL) { 11499 isc_stats_attach(res->stats, statsp); 11500 } 11501 } 11502 11503 void 11504 dns_resolver_incstats(dns_resolver_t *res, isc_statscounter_t counter) { 11505 REQUIRE(VALID_RESOLVER(res)); 11506 11507 isc_stats_increment(res->stats, counter); 11508 } 11509 11510 void 11511 dns_resolver_setquerystats(dns_resolver_t *res, dns_stats_t *stats) { 11512 REQUIRE(VALID_RESOLVER(res)); 11513 REQUIRE(res->querystats == NULL); 11514 11515 dns_stats_attach(stats, &res->querystats); 11516 } 11517 11518 void 11519 dns_resolver_getquerystats(dns_resolver_t *res, dns_stats_t **statsp) { 11520 REQUIRE(VALID_RESOLVER(res)); 11521 REQUIRE(statsp != NULL && *statsp == NULL); 11522 11523 if (res->querystats != NULL) { 11524 dns_stats_attach(res->querystats, statsp); 11525 } 11526 } 11527 11528 void 11529 dns_resolver_freefresp(dns_fetchresponse_t **frespp) { 11530 REQUIRE(frespp != NULL); 11531 11532 if (*frespp == NULL) { 11533 return; 11534 } 11535 11536 dns_fetchresponse_t *fresp = *frespp; 11537 11538 *frespp = NULL; 11539 isc_mem_putanddetach(&fresp->mctx, fresp, sizeof(*fresp)); 11540 } 11541
Indexes created Sat Jun 20 00:25:23 UTC 2026