1 /* 2 * services/listen_dnsport.c - listen on port 53 for incoming DNS queries. 3 * 4 * Copyright (c) 2007, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file has functions to get queries from clients. 40 */ 41 #include "config.h" 42 #ifdef HAVE_SYS_TYPES_H 43 # include <sys/types.h> 44 #endif 45 #include <limits.h> 46 #ifdef USE_TCP_FASTOPEN 47 #include <netinet/tcp.h> 48 #endif 49 #include <ctype.h> 50 #include "services/listen_dnsport.h" 51 #include "services/outside_network.h" 52 #include "util/netevent.h" 53 #include "util/log.h" 54 #include "util/config_file.h" 55 #include "util/net_help.h" 56 #include "sldns/sbuffer.h" 57 #include "sldns/parseutil.h" 58 #include "sldns/wire2str.h" 59 #include "services/mesh.h" 60 #include "util/fptr_wlist.h" 61 #include "util/locks.h" 62 #include "util/timeval_func.h" 63 64 #ifdef HAVE_NETDB_H 65 #include <netdb.h> 66 #endif 67 #include <fcntl.h> 68 69 #ifdef HAVE_SYS_UN_H 70 #include <sys/un.h> 71 #endif 72 73 #ifdef HAVE_SYSTEMD 74 #include <systemd/sd-daemon.h> 75 #endif 76 77 #ifdef HAVE_IFADDRS_H 78 #include <ifaddrs.h> 79 #endif 80 #ifdef HAVE_NET_IF_H 81 #include <net/if.h> 82 #endif 83 84 #ifdef HAVE_TIME_H 85 #include <time.h> 86 #endif 87 #include <sys/time.h> 88 89 #ifdef HAVE_NGTCP2 90 #include <ngtcp2/ngtcp2.h> 91 #include <ngtcp2/ngtcp2_crypto.h> 92 #ifdef HAVE_NGTCP2_NGTCP2_CRYPTO_OSSL_H 93 #include <ngtcp2/ngtcp2_crypto_ossl.h> 94 #elif defined(HAVE_NGTCP2_NGTCP2_CRYPTO_QUICTLS_H) 95 #include <ngtcp2/ngtcp2_crypto_quictls.h> 96 #elif defined(HAVE_NGTCP2_NGTCP2_CRYPTO_OPENSSL_H) 97 #include <ngtcp2/ngtcp2_crypto_openssl.h> 98 #define MAKE_QUIC_METHOD 1 99 #endif 100 #endif 101 102 #ifdef HAVE_OPENSSL_SSL_H 103 #include <openssl/ssl.h> 104 #endif 105 106 #ifdef HAVE_LINUX_NET_TSTAMP_H 107 #include <linux/net_tstamp.h> 108 #endif 109 110 /** number of queued TCP connections for listen() */ 111 #define TCP_BACKLOG 256 112 113 #ifndef THREADS_DISABLED 114 /** lock on the counter of stream buffer memory */ 115 static lock_basic_type stream_wait_count_lock; 116 /** lock on the counter of HTTP2 query buffer memory */ 117 static lock_basic_type http2_query_buffer_count_lock; 118 /** lock on the counter of HTTP2 response buffer memory */ 119 static lock_basic_type http2_response_buffer_count_lock; 120 #endif 121 /** size (in bytes) of stream wait buffers */ 122 static size_t stream_wait_count = 0; 123 /** is the lock initialised for stream wait buffers */ 124 static int stream_wait_lock_inited = 0; 125 /** size (in bytes) of HTTP2 query buffers */ 126 static size_t http2_query_buffer_count = 0; 127 /** is the lock initialised for HTTP2 query buffers */ 128 static int http2_query_buffer_lock_inited = 0; 129 /** size (in bytes) of HTTP2 response buffers */ 130 static size_t http2_response_buffer_count = 0; 131 /** is the lock initialised for HTTP2 response buffers */ 132 static int http2_response_buffer_lock_inited = 0; 133 134 /** 135 * Debug print of the getaddrinfo returned address. 136 * @param addr: the address returned. 137 * @param additional: additional text that describes the type of socket, 138 * or NULL for no text. 139 */ 140 static void 141 verbose_print_addr(struct addrinfo *addr, const char* additional) 142 { 143 if(verbosity >= VERB_ALGO) { 144 char buf[100]; 145 void* sinaddr = &((struct sockaddr_in*)addr->ai_addr)->sin_addr; 146 #ifdef INET6 147 if(addr->ai_family == AF_INET6) 148 sinaddr = &((struct sockaddr_in6*)addr->ai_addr)-> 149 sin6_addr; 150 #endif /* INET6 */ 151 if(inet_ntop(addr->ai_family, sinaddr, buf, 152 (socklen_t)sizeof(buf)) == 0) { 153 (void)strlcpy(buf, "(null)", sizeof(buf)); 154 } 155 buf[sizeof(buf)-1] = 0; 156 verbose(VERB_ALGO, "creating %s%s socket %s %d%s%s", 157 addr->ai_socktype==SOCK_DGRAM?"udp": 158 addr->ai_socktype==SOCK_STREAM?"tcp":"otherproto", 159 addr->ai_family==AF_INET?"4": 160 addr->ai_family==AF_INET6?"6": 161 "_otherfam", buf, 162 ntohs(((struct sockaddr_in*)addr->ai_addr)->sin_port), 163 (additional?" ":""), (additional?additional:"")); 164 } 165 } 166 167 void 168 verbose_print_unbound_socket(struct unbound_socket* ub_sock) 169 { 170 if(verbosity >= VERB_ALGO) { 171 char buf[256]; 172 log_info("listing of unbound_socket structure:"); 173 addr_to_str((void*)ub_sock->addr, ub_sock->addrlen, buf, 174 sizeof(buf)); 175 log_info("%s s is: %d, fam is: %s, acl: %s", buf, ub_sock->s, 176 ub_sock->fam == AF_INET?"AF_INET":"AF_INET6", 177 ub_sock->acl?"yes":"no"); 178 } 179 } 180 181 #ifdef HAVE_SYSTEMD 182 static int 183 systemd_get_activated(int family, int socktype, int listen, 184 struct sockaddr *addr, socklen_t addrlen, 185 const char *path) 186 { 187 int i = 0; 188 int r = 0; 189 int s = -1; 190 const char* listen_pid, *listen_fds; 191 192 /* We should use "listen" option only for stream protocols. For UDP it should be -1 */ 193 194 if((r = sd_booted()) < 1) { 195 if(r == 0) 196 log_warn("systemd is not running"); 197 else 198 log_err("systemd sd_booted(): %s", strerror(-r)); 199 return -1; 200 } 201 202 listen_pid = getenv("LISTEN_PID"); 203 listen_fds = getenv("LISTEN_FDS"); 204 205 if (!listen_pid) { 206 log_warn("Systemd mandatory ENV variable is not defined: LISTEN_PID"); 207 return -1; 208 } 209 210 if (!listen_fds) { 211 log_warn("Systemd mandatory ENV variable is not defined: LISTEN_FDS"); 212 return -1; 213 } 214 215 if((r = sd_listen_fds(0)) < 1) { 216 if(r == 0) 217 log_warn("systemd: did not return socket, check unit configuration"); 218 else 219 log_err("systemd sd_listen_fds(): %s", strerror(-r)); 220 return -1; 221 } 222 223 for(i = 0; i < r; i++) { 224 if(sd_is_socket(SD_LISTEN_FDS_START + i, family, socktype, listen)) { 225 s = SD_LISTEN_FDS_START + i; 226 break; 227 } 228 } 229 if (s == -1) { 230 if (addr) 231 log_err_addr("systemd sd_listen_fds()", 232 "no such socket", 233 (struct sockaddr_storage *)addr, addrlen); 234 else 235 log_err("systemd sd_listen_fds(): %s", path); 236 } 237 return s; 238 } 239 #endif 240 241 int 242 create_udp_sock(int family, int socktype, struct sockaddr* addr, 243 socklen_t addrlen, int v6only, int* inuse, int* noproto, 244 int rcv, int snd, int listen, int* reuseport, int transparent, 245 int freebind, int use_systemd, int dscp) 246 { 247 int s; 248 char* err; 249 #if defined(SO_REUSEADDR) || defined(SO_REUSEPORT) || defined(IPV6_USE_MIN_MTU) || defined(IP_TRANSPARENT) || defined(IP_BINDANY) || defined(IP_FREEBIND) || defined (SO_BINDANY) 250 int on=1; 251 #endif 252 #ifdef IPV6_MTU 253 int mtu = IPV6_MIN_MTU; 254 #endif 255 #if !defined(SO_RCVBUFFORCE) && !defined(SO_RCVBUF) 256 (void)rcv; 257 #endif 258 #if !defined(SO_SNDBUFFORCE) && !defined(SO_SNDBUF) 259 (void)snd; 260 #endif 261 #ifndef IPV6_V6ONLY 262 (void)v6only; 263 #endif 264 #if !defined(IP_TRANSPARENT) && !defined(IP_BINDANY) && !defined(SO_BINDANY) 265 (void)transparent; 266 #endif 267 #if !defined(IP_FREEBIND) 268 (void)freebind; 269 #endif 270 #ifdef HAVE_SYSTEMD 271 int got_fd_from_systemd = 0; 272 273 if (!use_systemd 274 || (use_systemd 275 && (s = systemd_get_activated(family, socktype, -1, addr, 276 addrlen, NULL)) == -1)) { 277 #else 278 (void)use_systemd; 279 #endif 280 if((s = socket(family, socktype, 0)) == -1) { 281 *inuse = 0; 282 #ifndef USE_WINSOCK 283 if(errno == EAFNOSUPPORT || errno == EPROTONOSUPPORT) { 284 *noproto = 1; 285 return -1; 286 } 287 #else 288 if(WSAGetLastError() == WSAEAFNOSUPPORT || 289 WSAGetLastError() == WSAEPROTONOSUPPORT) { 290 *noproto = 1; 291 return -1; 292 } 293 #endif 294 log_err("can't create socket: %s", sock_strerror(errno)); 295 *noproto = 0; 296 return -1; 297 } 298 #ifdef HAVE_SYSTEMD 299 } else { 300 got_fd_from_systemd = 1; 301 } 302 #endif 303 if(listen) { 304 #ifdef SO_REUSEADDR 305 if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on, 306 (socklen_t)sizeof(on)) < 0) { 307 log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s", 308 sock_strerror(errno)); 309 #ifndef USE_WINSOCK 310 if(errno != ENOSYS) { 311 close(s); 312 *noproto = 0; 313 *inuse = 0; 314 return -1; 315 } 316 #else 317 closesocket(s); 318 *noproto = 0; 319 *inuse = 0; 320 return -1; 321 #endif 322 } 323 #endif /* SO_REUSEADDR */ 324 #ifdef SO_REUSEPORT 325 # ifdef SO_REUSEPORT_LB 326 /* on FreeBSD 12 we have SO_REUSEPORT_LB that does loadbalance 327 * like SO_REUSEPORT on Linux. This is what the users want 328 * with the config option in unbound.conf; if we actually 329 * need local address and port reuse they'll also need to 330 * have SO_REUSEPORT set for them, assume it was _LB they want. 331 */ 332 if (reuseport && *reuseport && 333 setsockopt(s, SOL_SOCKET, SO_REUSEPORT_LB, (void*)&on, 334 (socklen_t)sizeof(on)) < 0) { 335 #ifdef ENOPROTOOPT 336 if(errno != ENOPROTOOPT || verbosity >= 3) 337 log_warn("setsockopt(.. SO_REUSEPORT_LB ..) failed: %s", 338 strerror(errno)); 339 #endif 340 /* this option is not essential, we can continue */ 341 *reuseport = 0; 342 } 343 # else /* no SO_REUSEPORT_LB */ 344 345 /* try to set SO_REUSEPORT so that incoming 346 * queries are distributed evenly among the receiving threads. 347 * Each thread must have its own socket bound to the same port, 348 * with SO_REUSEPORT set on each socket. 349 */ 350 if (reuseport && *reuseport && 351 setsockopt(s, SOL_SOCKET, SO_REUSEPORT, (void*)&on, 352 (socklen_t)sizeof(on)) < 0) { 353 #ifdef ENOPROTOOPT 354 if(errno != ENOPROTOOPT || verbosity >= 3) 355 log_warn("setsockopt(.. SO_REUSEPORT ..) failed: %s", 356 strerror(errno)); 357 #endif 358 /* this option is not essential, we can continue */ 359 *reuseport = 0; 360 } 361 # endif /* SO_REUSEPORT_LB */ 362 #else 363 (void)reuseport; 364 #endif /* defined(SO_REUSEPORT) */ 365 #ifdef IP_TRANSPARENT 366 if (transparent && 367 setsockopt(s, IPPROTO_IP, IP_TRANSPARENT, (void*)&on, 368 (socklen_t)sizeof(on)) < 0) { 369 log_warn("setsockopt(.. IP_TRANSPARENT ..) failed: %s", 370 strerror(errno)); 371 } 372 #elif defined(IP_BINDANY) 373 if (transparent && 374 setsockopt(s, (family==AF_INET6? IPPROTO_IPV6:IPPROTO_IP), 375 (family == AF_INET6? IPV6_BINDANY:IP_BINDANY), 376 (void*)&on, (socklen_t)sizeof(on)) < 0) { 377 log_warn("setsockopt(.. IP%s_BINDANY ..) failed: %s", 378 (family==AF_INET6?"V6":""), strerror(errno)); 379 } 380 #elif defined(SO_BINDANY) 381 if (transparent && 382 setsockopt(s, SOL_SOCKET, SO_BINDANY, (void*)&on, 383 (socklen_t)sizeof(on)) < 0) { 384 log_warn("setsockopt(.. SO_BINDANY ..) failed: %s", 385 strerror(errno)); 386 } 387 #endif /* IP_TRANSPARENT || IP_BINDANY || SO_BINDANY */ 388 } 389 #ifdef IP_FREEBIND 390 if(freebind && 391 setsockopt(s, IPPROTO_IP, IP_FREEBIND, (void*)&on, 392 (socklen_t)sizeof(on)) < 0) { 393 log_warn("setsockopt(.. IP_FREEBIND ..) failed: %s", 394 strerror(errno)); 395 } 396 #endif /* IP_FREEBIND */ 397 if(rcv) { 398 #ifdef SO_RCVBUF 399 int got; 400 socklen_t slen = (socklen_t)sizeof(got); 401 # ifdef SO_RCVBUFFORCE 402 /* Linux specific: try to use root permission to override 403 * system limits on rcvbuf. The limit is stored in 404 * /proc/sys/net/core/rmem_max or sysctl net.core.rmem_max */ 405 if(setsockopt(s, SOL_SOCKET, SO_RCVBUFFORCE, (void*)&rcv, 406 (socklen_t)sizeof(rcv)) < 0) { 407 if(errno != EPERM) { 408 log_err("setsockopt(..., SO_RCVBUFFORCE, " 409 "...) failed: %s", sock_strerror(errno)); 410 sock_close(s); 411 *noproto = 0; 412 *inuse = 0; 413 return -1; 414 } 415 # endif /* SO_RCVBUFFORCE */ 416 if(setsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&rcv, 417 (socklen_t)sizeof(rcv)) < 0) { 418 log_err("setsockopt(..., SO_RCVBUF, " 419 "...) failed: %s", sock_strerror(errno)); 420 sock_close(s); 421 *noproto = 0; 422 *inuse = 0; 423 return -1; 424 } 425 /* check if we got the right thing or if system 426 * reduced to some system max. Warn if so */ 427 if(getsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&got, 428 &slen) >= 0 && got < rcv/2) { 429 log_warn("so-rcvbuf %u was not granted. " 430 "Got %u. To fix: start with " 431 "root permissions(linux) or sysctl " 432 "bigger net.core.rmem_max(linux) or " 433 "kern.ipc.maxsockbuf(bsd) values.", 434 (unsigned)rcv, (unsigned)got); 435 } 436 # ifdef SO_RCVBUFFORCE 437 } 438 # endif 439 #endif /* SO_RCVBUF */ 440 } 441 /* first do RCVBUF as the receive buffer is more important */ 442 if(snd) { 443 #ifdef SO_SNDBUF 444 int got; 445 socklen_t slen = (socklen_t)sizeof(got); 446 # ifdef SO_SNDBUFFORCE 447 /* Linux specific: try to use root permission to override 448 * system limits on sndbuf. The limit is stored in 449 * /proc/sys/net/core/wmem_max or sysctl net.core.wmem_max */ 450 if(setsockopt(s, SOL_SOCKET, SO_SNDBUFFORCE, (void*)&snd, 451 (socklen_t)sizeof(snd)) < 0) { 452 if(errno != EPERM && errno != ENOBUFS) { 453 log_err("setsockopt(..., SO_SNDBUFFORCE, " 454 "...) failed: %s", sock_strerror(errno)); 455 sock_close(s); 456 *noproto = 0; 457 *inuse = 0; 458 return -1; 459 } 460 if(errno != EPERM) { 461 verbose(VERB_ALGO, "setsockopt(..., SO_SNDBUFFORCE, " 462 "...) was not granted: %s", sock_strerror(errno)); 463 } 464 # endif /* SO_SNDBUFFORCE */ 465 if(setsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&snd, 466 (socklen_t)sizeof(snd)) < 0) { 467 if(errno != ENOSYS && errno != ENOBUFS) { 468 log_err("setsockopt(..., SO_SNDBUF, " 469 "...) failed: %s", sock_strerror(errno)); 470 sock_close(s); 471 *noproto = 0; 472 *inuse = 0; 473 return -1; 474 } 475 log_warn("setsockopt(..., SO_SNDBUF, " 476 "...) was not granted: %s", sock_strerror(errno)); 477 } 478 /* check if we got the right thing or if system 479 * reduced to some system max. Warn if so */ 480 if(getsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&got, 481 &slen) >= 0 && got < snd/2) { 482 log_warn("so-sndbuf %u was not granted. " 483 "Got %u. To fix: start with " 484 "root permissions(linux) or sysctl " 485 "bigger net.core.wmem_max(linux) or " 486 "kern.ipc.maxsockbuf(bsd) values. or " 487 "set so-sndbuf: 0 (use system value).", 488 (unsigned)snd, (unsigned)got); 489 } 490 # ifdef SO_SNDBUFFORCE 491 } 492 # endif 493 #endif /* SO_SNDBUF */ 494 } 495 err = set_ip_dscp(s, family, dscp); 496 if(err != NULL) 497 log_warn("error setting IP DiffServ codepoint %d on UDP socket: %s", dscp, err); 498 if(family == AF_INET6) { 499 # if defined(IPV6_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT) 500 int omit6_set = 0; 501 int action; 502 # endif 503 # if defined(IPV6_V6ONLY) 504 if(v6only 505 # ifdef HAVE_SYSTEMD 506 /* Systemd wants to control if the socket is v6 only 507 * or both, with BindIPv6Only=default, ipv6-only or 508 * both in systemd.socket, so it is not set here. */ 509 && !got_fd_from_systemd 510 # endif 511 ) { 512 int val=(v6only==2)?0:1; 513 if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, 514 (void*)&val, (socklen_t)sizeof(val)) < 0) { 515 log_err("setsockopt(..., IPV6_V6ONLY" 516 ", ...) failed: %s", sock_strerror(errno)); 517 sock_close(s); 518 *noproto = 0; 519 *inuse = 0; 520 return -1; 521 } 522 } 523 # endif 524 # if defined(IPV6_USE_MIN_MTU) 525 /* 526 * There is no fragmentation of IPv6 datagrams 527 * during forwarding in the network. Therefore 528 * we do not send UDP datagrams larger than 529 * the minimum IPv6 MTU of 1280 octets. The 530 * EDNS0 message length can be larger if the 531 * network stack supports IPV6_USE_MIN_MTU. 532 */ 533 if (setsockopt(s, IPPROTO_IPV6, IPV6_USE_MIN_MTU, 534 (void*)&on, (socklen_t)sizeof(on)) < 0) { 535 log_err("setsockopt(..., IPV6_USE_MIN_MTU, " 536 "...) failed: %s", sock_strerror(errno)); 537 sock_close(s); 538 *noproto = 0; 539 *inuse = 0; 540 return -1; 541 } 542 # elif defined(IPV6_MTU) 543 # ifndef USE_WINSOCK 544 /* 545 * On Linux, to send no larger than 1280, the PMTUD is 546 * disabled by default for datagrams anyway, so we set 547 * the MTU to use. 548 */ 549 if (setsockopt(s, IPPROTO_IPV6, IPV6_MTU, 550 (void*)&mtu, (socklen_t)sizeof(mtu)) < 0) { 551 log_err("setsockopt(..., IPV6_MTU, ...) failed: %s", 552 sock_strerror(errno)); 553 sock_close(s); 554 *noproto = 0; 555 *inuse = 0; 556 return -1; 557 } 558 # elif defined(IPV6_USER_MTU) 559 /* As later versions of the mingw crosscompiler define 560 * IPV6_MTU, do the same for windows but use IPV6_USER_MTU 561 * instead which is writable; IPV6_MTU is readonly there. */ 562 if (setsockopt(s, IPPROTO_IPV6, IPV6_USER_MTU, 563 (void*)&mtu, (socklen_t)sizeof(mtu)) < 0) { 564 if (WSAGetLastError() != WSAENOPROTOOPT) { 565 log_err("setsockopt(..., IPV6_USER_MTU, ...) failed: %s", 566 wsa_strerror(WSAGetLastError())); 567 sock_close(s); 568 *noproto = 0; 569 *inuse = 0; 570 return -1; 571 } 572 } 573 # endif /* USE_WINSOCK */ 574 # endif /* IPv6 MTU */ 575 # if defined(IPV6_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT) 576 # if defined(IP_PMTUDISC_OMIT) 577 action = IP_PMTUDISC_OMIT; 578 if (setsockopt(s, IPPROTO_IPV6, IPV6_MTU_DISCOVER, 579 &action, (socklen_t)sizeof(action)) < 0) { 580 581 if (errno != EINVAL) { 582 log_err("setsockopt(..., IPV6_MTU_DISCOVER, IP_PMTUDISC_OMIT...) failed: %s", 583 strerror(errno)); 584 sock_close(s); 585 *noproto = 0; 586 *inuse = 0; 587 return -1; 588 } 589 } 590 else 591 { 592 omit6_set = 1; 593 } 594 # endif 595 if (omit6_set == 0) { 596 action = IP_PMTUDISC_DONT; 597 if (setsockopt(s, IPPROTO_IPV6, IPV6_MTU_DISCOVER, 598 &action, (socklen_t)sizeof(action)) < 0) { 599 log_err("setsockopt(..., IPV6_MTU_DISCOVER, IP_PMTUDISC_DONT...) failed: %s", 600 strerror(errno)); 601 sock_close(s); 602 *noproto = 0; 603 *inuse = 0; 604 return -1; 605 } 606 } 607 # endif /* IPV6_MTU_DISCOVER */ 608 } else if(family == AF_INET) { 609 # if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT) 610 /* linux 3.15 has IP_PMTUDISC_OMIT, Hannes Frederic Sowa made it so that 611 * PMTU information is not accepted, but fragmentation is allowed 612 * if and only if the packet size exceeds the outgoing interface MTU 613 * (and also uses the interface mtu to determine the size of the packets). 614 * So there won't be any EMSGSIZE error. Against DNS fragmentation attacks. 615 * FreeBSD already has same semantics without setting the option. */ 616 int omit_set = 0; 617 int action; 618 # if defined(IP_PMTUDISC_OMIT) 619 action = IP_PMTUDISC_OMIT; 620 if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER, 621 &action, (socklen_t)sizeof(action)) < 0) { 622 623 if (errno != EINVAL) { 624 log_err("setsockopt(..., IP_MTU_DISCOVER, IP_PMTUDISC_OMIT...) failed: %s", 625 strerror(errno)); 626 sock_close(s); 627 *noproto = 0; 628 *inuse = 0; 629 return -1; 630 } 631 } 632 else 633 { 634 omit_set = 1; 635 } 636 # endif 637 if (omit_set == 0) { 638 action = IP_PMTUDISC_DONT; 639 if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER, 640 &action, (socklen_t)sizeof(action)) < 0) { 641 log_err("setsockopt(..., IP_MTU_DISCOVER, IP_PMTUDISC_DONT...) failed: %s", 642 strerror(errno)); 643 sock_close(s); 644 *noproto = 0; 645 *inuse = 0; 646 return -1; 647 } 648 } 649 # elif defined(IP_DONTFRAG) && !defined(__APPLE__) 650 /* the IP_DONTFRAG option if defined in the 11.0 OSX headers, 651 * but does not work on that version, so we exclude it */ 652 /* a nonzero value disables fragmentation, according to 653 * docs.oracle.com for ip(4). */ 654 int off = 1; 655 if (setsockopt(s, IPPROTO_IP, IP_DONTFRAG, 656 &off, (socklen_t)sizeof(off)) < 0) { 657 log_err("setsockopt(..., IP_DONTFRAG, ...) failed: %s", 658 strerror(errno)); 659 sock_close(s); 660 *noproto = 0; 661 *inuse = 0; 662 return -1; 663 } 664 # endif /* IPv4 MTU */ 665 } 666 if( 667 #ifdef HAVE_SYSTEMD 668 !got_fd_from_systemd && 669 #endif 670 bind(s, (struct sockaddr*)addr, addrlen) != 0) { 671 *noproto = 0; 672 *inuse = 0; 673 #ifndef USE_WINSOCK 674 #ifdef EADDRINUSE 675 *inuse = (errno == EADDRINUSE); 676 /* detect freebsd jail with no ipv6 permission */ 677 if(family==AF_INET6 && errno==EINVAL) 678 *noproto = 1; 679 else if(errno != EADDRINUSE && 680 !(errno == EACCES && verbosity < 4 && !listen) 681 #ifdef EADDRNOTAVAIL 682 && !(errno == EADDRNOTAVAIL && verbosity < 4 && !listen) 683 #endif 684 ) { 685 log_err_addr("can't bind socket", strerror(errno), 686 (struct sockaddr_storage*)addr, addrlen); 687 } 688 #endif /* EADDRINUSE */ 689 #else /* USE_WINSOCK */ 690 if(WSAGetLastError() != WSAEADDRINUSE && 691 WSAGetLastError() != WSAEADDRNOTAVAIL && 692 !(WSAGetLastError() == WSAEACCES && verbosity < 4 && !listen)) { 693 log_err_addr("can't bind socket", 694 wsa_strerror(WSAGetLastError()), 695 (struct sockaddr_storage*)addr, addrlen); 696 } 697 #endif /* USE_WINSOCK */ 698 sock_close(s); 699 return -1; 700 } 701 if(!fd_set_nonblock(s)) { 702 *noproto = 0; 703 *inuse = 0; 704 sock_close(s); 705 return -1; 706 } 707 return s; 708 } 709 710 int 711 create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto, 712 int* reuseport, int transparent, int mss, int nodelay, int freebind, 713 int use_systemd, int dscp, const char* additional) 714 { 715 int s = -1; 716 char* err; 717 #if defined(SO_REUSEADDR) || defined(SO_REUSEPORT) \ 718 || defined(IPV6_V6ONLY) || defined(IP_TRANSPARENT) \ 719 || defined(IP_BINDANY) || defined(IP_FREEBIND) \ 720 || defined(SO_BINDANY) || defined(TCP_NODELAY) 721 int on = 1; 722 #endif 723 #ifdef HAVE_SYSTEMD 724 int got_fd_from_systemd = 0; 725 #endif 726 #ifdef USE_TCP_FASTOPEN 727 int qlen; 728 #endif 729 #if !defined(IP_TRANSPARENT) && !defined(IP_BINDANY) && !defined(SO_BINDANY) 730 (void)transparent; 731 #endif 732 #if !defined(IP_FREEBIND) 733 (void)freebind; 734 #endif 735 verbose_print_addr(addr, additional); 736 *noproto = 0; 737 #ifdef HAVE_SYSTEMD 738 if (!use_systemd || 739 (use_systemd 740 && (s = systemd_get_activated(addr->ai_family, addr->ai_socktype, 1, 741 addr->ai_addr, addr->ai_addrlen, 742 NULL)) == -1)) { 743 #else 744 (void)use_systemd; 745 #endif 746 if((s = socket(addr->ai_family, addr->ai_socktype, 0)) == -1) { 747 #ifndef USE_WINSOCK 748 if(errno == EAFNOSUPPORT || errno == EPROTONOSUPPORT) { 749 *noproto = 1; 750 return -1; 751 } 752 #else 753 if(WSAGetLastError() == WSAEAFNOSUPPORT || 754 WSAGetLastError() == WSAEPROTONOSUPPORT) { 755 *noproto = 1; 756 return -1; 757 } 758 #endif 759 log_err("can't create socket: %s", sock_strerror(errno)); 760 return -1; 761 } 762 if(nodelay) { 763 #if defined(IPPROTO_TCP) && defined(TCP_NODELAY) 764 if(setsockopt(s, IPPROTO_TCP, TCP_NODELAY, (void*)&on, 765 (socklen_t)sizeof(on)) < 0) { 766 #ifndef USE_WINSOCK 767 log_err(" setsockopt(.. TCP_NODELAY ..) failed: %s", 768 strerror(errno)); 769 #else 770 log_err(" setsockopt(.. TCP_NODELAY ..) failed: %s", 771 wsa_strerror(WSAGetLastError())); 772 #endif 773 } 774 #else 775 log_warn(" setsockopt(TCP_NODELAY) unsupported"); 776 #endif /* defined(IPPROTO_TCP) && defined(TCP_NODELAY) */ 777 } 778 if (mss > 0) { 779 #if defined(IPPROTO_TCP) && defined(TCP_MAXSEG) 780 if(setsockopt(s, IPPROTO_TCP, TCP_MAXSEG, (void*)&mss, 781 (socklen_t)sizeof(mss)) < 0) { 782 log_err(" setsockopt(.. TCP_MAXSEG ..) failed: %s", 783 sock_strerror(errno)); 784 } else { 785 verbose(VERB_ALGO, 786 " tcp socket mss set to %d", mss); 787 } 788 #else 789 log_warn(" setsockopt(TCP_MAXSEG) unsupported"); 790 #endif /* defined(IPPROTO_TCP) && defined(TCP_MAXSEG) */ 791 } 792 #ifdef HAVE_SYSTEMD 793 } else { 794 got_fd_from_systemd = 1; 795 } 796 #endif 797 #ifdef SO_REUSEADDR 798 if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on, 799 (socklen_t)sizeof(on)) < 0) { 800 log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s", 801 sock_strerror(errno)); 802 sock_close(s); 803 return -1; 804 } 805 #endif /* SO_REUSEADDR */ 806 #ifdef IP_FREEBIND 807 if (freebind && setsockopt(s, IPPROTO_IP, IP_FREEBIND, (void*)&on, 808 (socklen_t)sizeof(on)) < 0) { 809 log_warn("setsockopt(.. IP_FREEBIND ..) failed: %s", 810 strerror(errno)); 811 } 812 #endif /* IP_FREEBIND */ 813 #ifdef SO_REUSEPORT 814 /* try to set SO_REUSEPORT so that incoming 815 * connections are distributed evenly among the receiving threads. 816 * Each thread must have its own socket bound to the same port, 817 * with SO_REUSEPORT set on each socket. 818 */ 819 if (reuseport && *reuseport && 820 setsockopt(s, SOL_SOCKET, SO_REUSEPORT, (void*)&on, 821 (socklen_t)sizeof(on)) < 0) { 822 #ifdef ENOPROTOOPT 823 if(errno != ENOPROTOOPT || verbosity >= 3) 824 log_warn("setsockopt(.. SO_REUSEPORT ..) failed: %s", 825 strerror(errno)); 826 #endif 827 /* this option is not essential, we can continue */ 828 *reuseport = 0; 829 } 830 #else 831 (void)reuseport; 832 #endif /* defined(SO_REUSEPORT) */ 833 #if defined(IPV6_V6ONLY) 834 if(addr->ai_family == AF_INET6 && v6only 835 # ifdef HAVE_SYSTEMD 836 /* Systemd wants to control if the socket is v6 only 837 * or both, with BindIPv6Only=default, ipv6-only or 838 * both in systemd.socket, so it is not set here. */ 839 && !got_fd_from_systemd 840 # endif 841 ) { 842 if(setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, 843 (void*)&on, (socklen_t)sizeof(on)) < 0) { 844 log_err("setsockopt(..., IPV6_V6ONLY, ...) failed: %s", 845 sock_strerror(errno)); 846 sock_close(s); 847 return -1; 848 } 849 } 850 #else 851 (void)v6only; 852 #endif /* IPV6_V6ONLY */ 853 #ifdef IP_TRANSPARENT 854 if (transparent && 855 setsockopt(s, IPPROTO_IP, IP_TRANSPARENT, (void*)&on, 856 (socklen_t)sizeof(on)) < 0) { 857 log_warn("setsockopt(.. IP_TRANSPARENT ..) failed: %s", 858 strerror(errno)); 859 } 860 #elif defined(IP_BINDANY) 861 if (transparent && 862 setsockopt(s, (addr->ai_family==AF_INET6? IPPROTO_IPV6:IPPROTO_IP), 863 (addr->ai_family == AF_INET6? IPV6_BINDANY:IP_BINDANY), 864 (void*)&on, (socklen_t)sizeof(on)) < 0) { 865 log_warn("setsockopt(.. IP%s_BINDANY ..) failed: %s", 866 (addr->ai_family==AF_INET6?"V6":""), strerror(errno)); 867 } 868 #elif defined(SO_BINDANY) 869 if (transparent && 870 setsockopt(s, SOL_SOCKET, SO_BINDANY, (void*)&on, (socklen_t) 871 sizeof(on)) < 0) { 872 log_warn("setsockopt(.. SO_BINDANY ..) failed: %s", 873 strerror(errno)); 874 } 875 #endif /* IP_TRANSPARENT || IP_BINDANY || SO_BINDANY */ 876 err = set_ip_dscp(s, addr->ai_family, dscp); 877 if(err != NULL) 878 log_warn("error setting IP DiffServ codepoint %d on TCP socket: %s", dscp, err); 879 if( 880 #ifdef HAVE_SYSTEMD 881 !got_fd_from_systemd && 882 #endif 883 bind(s, addr->ai_addr, addr->ai_addrlen) != 0) { 884 #ifndef USE_WINSOCK 885 /* detect freebsd jail with no ipv6 permission */ 886 if(addr->ai_family==AF_INET6 && errno==EINVAL) 887 *noproto = 1; 888 else { 889 log_err_addr("can't bind socket", strerror(errno), 890 (struct sockaddr_storage*)addr->ai_addr, 891 addr->ai_addrlen); 892 } 893 #else 894 log_err_addr("can't bind socket", 895 wsa_strerror(WSAGetLastError()), 896 (struct sockaddr_storage*)addr->ai_addr, 897 addr->ai_addrlen); 898 #endif 899 sock_close(s); 900 return -1; 901 } 902 if(!fd_set_nonblock(s)) { 903 sock_close(s); 904 return -1; 905 } 906 if(listen(s, TCP_BACKLOG) == -1) { 907 log_err("can't listen: %s", sock_strerror(errno)); 908 sock_close(s); 909 return -1; 910 } 911 #ifdef USE_TCP_FASTOPEN 912 /* qlen specifies how many outstanding TFO requests to allow. Limit is a defense 913 against IP spoofing attacks as suggested in RFC7413 */ 914 #ifdef __APPLE__ 915 /* OS X implementation only supports qlen of 1 via this call. Actual 916 value is configured by the net.inet.tcp.fastopen_backlog kernel param. */ 917 qlen = 1; 918 #else 919 /* 5 is recommended on linux */ 920 qlen = 5; 921 #endif 922 if ((setsockopt(s, IPPROTO_TCP, TCP_FASTOPEN, &qlen, 923 sizeof(qlen))) == -1 ) { 924 #ifdef ENOPROTOOPT 925 /* squelch ENOPROTOOPT: freebsd server mode with kernel support 926 disabled, except when verbosity enabled for debugging */ 927 if(errno != ENOPROTOOPT || verbosity >= 3) { 928 #endif 929 if(errno == EPERM) { 930 log_warn("Setting TCP Fast Open as server failed: %s ; this could likely be because sysctl net.inet.tcp.fastopen.enabled, net.inet.tcp.fastopen.server_enable, or net.ipv4.tcp_fastopen is disabled", strerror(errno)); 931 } else { 932 log_err("Setting TCP Fast Open as server failed: %s", strerror(errno)); 933 } 934 #ifdef ENOPROTOOPT 935 } 936 #endif 937 } 938 #endif 939 return s; 940 } 941 942 char* 943 set_ip_dscp(int socket, int addrfamily, int dscp) 944 { 945 int ds; 946 947 if(dscp == 0) 948 return NULL; 949 ds = dscp << 2; 950 switch(addrfamily) { 951 case AF_INET6: 952 #ifdef IPV6_TCLASS 953 if(setsockopt(socket, IPPROTO_IPV6, IPV6_TCLASS, (void*)&ds, 954 sizeof(ds)) < 0) 955 return sock_strerror(errno); 956 break; 957 #else 958 return "IPV6_TCLASS not defined on this system"; 959 #endif 960 default: 961 if(setsockopt(socket, IPPROTO_IP, IP_TOS, (void*)&ds, sizeof(ds)) < 0) 962 return sock_strerror(errno); 963 break; 964 } 965 return NULL; 966 } 967 968 int 969 create_local_accept_sock(const char *path, int* noproto, int use_systemd) 970 { 971 #ifdef HAVE_SYSTEMD 972 int ret; 973 974 if (use_systemd && (ret = systemd_get_activated(AF_LOCAL, SOCK_STREAM, 1, NULL, 0, path)) != -1) 975 return ret; 976 else { 977 #endif 978 #ifdef HAVE_SYS_UN_H 979 int s; 980 struct sockaddr_un usock; 981 #ifndef HAVE_SYSTEMD 982 (void)use_systemd; 983 #endif 984 985 verbose(VERB_ALGO, "creating unix socket %s", path); 986 #ifdef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN 987 /* this member exists on BSDs, not Linux */ 988 usock.sun_len = (unsigned)sizeof(usock); 989 #endif 990 usock.sun_family = AF_LOCAL; 991 /* length is 92-108, 104 on FreeBSD */ 992 (void)strlcpy(usock.sun_path, path, sizeof(usock.sun_path)); 993 994 if ((s = socket(AF_LOCAL, SOCK_STREAM, 0)) == -1) { 995 log_err("Cannot create local socket %s (%s)", 996 path, strerror(errno)); 997 return -1; 998 } 999 1000 if (unlink(path) && errno != ENOENT) { 1001 /* The socket already exists and cannot be removed */ 1002 log_err("Cannot remove old local socket %s (%s)", 1003 path, strerror(errno)); 1004 goto err; 1005 } 1006 1007 if (bind(s, (struct sockaddr *)&usock, 1008 (socklen_t)sizeof(struct sockaddr_un)) == -1) { 1009 log_err("Cannot bind local socket %s (%s)", 1010 path, strerror(errno)); 1011 goto err; 1012 } 1013 1014 if (!fd_set_nonblock(s)) { 1015 log_err("Cannot set non-blocking mode"); 1016 goto err; 1017 } 1018 1019 if (listen(s, TCP_BACKLOG) == -1) { 1020 log_err("can't listen: %s", strerror(errno)); 1021 goto err; 1022 } 1023 1024 (void)noproto; /*unused*/ 1025 return s; 1026 1027 err: 1028 sock_close(s); 1029 return -1; 1030 1031 #ifdef HAVE_SYSTEMD 1032 } 1033 #endif 1034 #else 1035 (void)use_systemd; 1036 (void)path; 1037 log_err("Local sockets are not supported"); 1038 *noproto = 1; 1039 return -1; 1040 #endif 1041 } 1042 1043 1044 /** 1045 * Create socket from getaddrinfo results 1046 */ 1047 static int 1048 make_sock(int stype, const char* ifname, int port, 1049 struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd, 1050 int* reuseport, int transparent, int tcp_mss, int nodelay, int freebind, 1051 int use_systemd, int dscp, struct unbound_socket* ub_sock, 1052 const char* additional) 1053 { 1054 struct addrinfo *res = NULL; 1055 int r, s, inuse, noproto; 1056 char portbuf[32]; 1057 snprintf(portbuf, sizeof(portbuf), "%d", port); 1058 hints->ai_socktype = stype; 1059 *noip6 = 0; 1060 if((r=getaddrinfo(ifname, portbuf, hints, &res)) != 0 || !res) { 1061 #ifdef USE_WINSOCK 1062 if(r == EAI_NONAME && hints->ai_family == AF_INET6){ 1063 *noip6 = 1; /* 'Host not found' for IP6 on winXP */ 1064 return -1; 1065 } 1066 #endif 1067 log_err("node %s:%s getaddrinfo: %s %s", 1068 ifname?ifname:"default", portbuf, gai_strerror(r), 1069 #ifdef EAI_SYSTEM 1070 (r==EAI_SYSTEM?(char*)strerror(errno):"") 1071 #else 1072 "" 1073 #endif 1074 ); 1075 return -1; 1076 } 1077 if(stype == SOCK_DGRAM) { 1078 verbose_print_addr(res, additional); 1079 s = create_udp_sock(res->ai_family, res->ai_socktype, 1080 (struct sockaddr*)res->ai_addr, res->ai_addrlen, 1081 v6only, &inuse, &noproto, (int)rcv, (int)snd, 1, 1082 reuseport, transparent, freebind, use_systemd, dscp); 1083 if(s == -1 && inuse) { 1084 log_err("bind: address already in use"); 1085 } else if(s == -1 && noproto && hints->ai_family == AF_INET6){ 1086 *noip6 = 1; 1087 } 1088 } else { 1089 s = create_tcp_accept_sock(res, v6only, &noproto, reuseport, 1090 transparent, tcp_mss, nodelay, freebind, use_systemd, 1091 dscp, additional); 1092 if(s == -1 && noproto && hints->ai_family == AF_INET6){ 1093 *noip6 = 1; 1094 } 1095 } 1096 1097 if(!res->ai_addr) { 1098 log_err("getaddrinfo returned no address"); 1099 freeaddrinfo(res); 1100 sock_close(s); 1101 return -1; 1102 } 1103 ub_sock->addr = memdup(res->ai_addr, res->ai_addrlen); 1104 ub_sock->addrlen = res->ai_addrlen; 1105 if(!ub_sock->addr) { 1106 log_err("out of memory: allocate listening address"); 1107 freeaddrinfo(res); 1108 sock_close(s); 1109 return -1; 1110 } 1111 freeaddrinfo(res); 1112 1113 ub_sock->s = s; 1114 ub_sock->fam = hints->ai_family; 1115 ub_sock->acl = NULL; 1116 1117 return s; 1118 } 1119 1120 /** make socket and first see if ifname contains port override info */ 1121 static int 1122 make_sock_port(int stype, const char* ifname, int port, 1123 struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd, 1124 int* reuseport, int transparent, int tcp_mss, int nodelay, int freebind, 1125 int use_systemd, int dscp, struct unbound_socket* ub_sock, 1126 const char* additional) 1127 { 1128 const char* s = strchr(ifname, '@'); 1129 if(s) { 1130 /* override port with ifspec@port */ 1131 int port; 1132 char newif[128]; 1133 if((size_t)(s-ifname) >= sizeof(newif)) { 1134 log_err("ifname too long: %s", ifname); 1135 *noip6 = 0; 1136 return -1; 1137 } 1138 port = atoi(s+1); 1139 if(port < 0 || 0 == port || port > 65535) { 1140 log_err("invalid portnumber in interface: %s", ifname); 1141 *noip6 = 0; 1142 return -1; 1143 } 1144 (void)strlcpy(newif, ifname, sizeof(newif)); 1145 newif[s-ifname] = 0; 1146 return make_sock(stype, newif, port, hints, v6only, noip6, rcv, 1147 snd, reuseport, transparent, tcp_mss, nodelay, freebind, 1148 use_systemd, dscp, ub_sock, additional); 1149 } 1150 return make_sock(stype, ifname, port, hints, v6only, noip6, rcv, snd, 1151 reuseport, transparent, tcp_mss, nodelay, freebind, use_systemd, 1152 dscp, ub_sock, additional); 1153 } 1154 1155 /** 1156 * Add port to open ports list. 1157 * @param list: list head. changed. 1158 * @param s: fd. 1159 * @param ftype: if fd is UDP. 1160 * @param pp2_enabled: if PROXYv2 is enabled for this port. 1161 * @param ub_sock: socket with address. 1162 * @return false on failure. list in unchanged then. 1163 */ 1164 static int 1165 port_insert(struct listen_port** list, int s, enum listen_type ftype, 1166 int pp2_enabled, struct unbound_socket* ub_sock) 1167 { 1168 struct listen_port* item = (struct listen_port*)malloc( 1169 sizeof(struct listen_port)); 1170 if(!item) 1171 return 0; 1172 item->next = *list; 1173 item->fd = s; 1174 item->ftype = ftype; 1175 item->pp2_enabled = pp2_enabled; 1176 item->socket = ub_sock; 1177 *list = item; 1178 return 1; 1179 } 1180 1181 /** set fd to receive software timestamps */ 1182 static int 1183 set_recvtimestamp(int s) 1184 { 1185 #ifdef HAVE_LINUX_NET_TSTAMP_H 1186 int opt = SOF_TIMESTAMPING_RX_SOFTWARE | SOF_TIMESTAMPING_SOFTWARE; 1187 if (setsockopt(s, SOL_SOCKET, SO_TIMESTAMPNS, (void*)&opt, (socklen_t)sizeof(opt)) < 0) { 1188 log_err("setsockopt(..., SO_TIMESTAMPNS, ...) failed: %s", 1189 strerror(errno)); 1190 return 0; 1191 } 1192 return 1; 1193 #elif defined(SO_TIMESTAMP) && defined(SCM_TIMESTAMP) 1194 int on = 1; 1195 /* FreeBSD and also Linux. */ 1196 if (setsockopt(s, SOL_SOCKET, SO_TIMESTAMP, (void*)&on, (socklen_t)sizeof(on)) < 0) { 1197 log_err("setsockopt(..., SO_TIMESTAMP, ...) failed: %s", 1198 strerror(errno)); 1199 return 0; 1200 } 1201 return 1; 1202 #else 1203 log_err("packets timestamping is not supported on this platform"); 1204 (void)s; 1205 return 0; 1206 #endif 1207 } 1208 1209 /** set fd to receive source address packet info */ 1210 static int 1211 set_recvpktinfo(int s, int family) 1212 { 1213 #if defined(IPV6_RECVPKTINFO) || defined(IPV6_PKTINFO) || (defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR)) || defined(IP_PKTINFO) 1214 int on = 1; 1215 #else 1216 (void)s; 1217 #endif 1218 if(family == AF_INET6) { 1219 # ifdef IPV6_RECVPKTINFO 1220 if(setsockopt(s, IPPROTO_IPV6, IPV6_RECVPKTINFO, 1221 (void*)&on, (socklen_t)sizeof(on)) < 0) { 1222 log_err("setsockopt(..., IPV6_RECVPKTINFO, ...) failed: %s", 1223 strerror(errno)); 1224 return 0; 1225 } 1226 # elif defined(IPV6_PKTINFO) 1227 if(setsockopt(s, IPPROTO_IPV6, IPV6_PKTINFO, 1228 (void*)&on, (socklen_t)sizeof(on)) < 0) { 1229 log_err("setsockopt(..., IPV6_PKTINFO, ...) failed: %s", 1230 strerror(errno)); 1231 return 0; 1232 } 1233 # else 1234 log_err("no IPV6_RECVPKTINFO and IPV6_PKTINFO options, please " 1235 "disable interface-automatic or do-ip6 in config"); 1236 return 0; 1237 # endif /* defined IPV6_RECVPKTINFO */ 1238 1239 } else if(family == AF_INET) { 1240 # ifdef IP_PKTINFO 1241 if(setsockopt(s, IPPROTO_IP, IP_PKTINFO, 1242 (void*)&on, (socklen_t)sizeof(on)) < 0) { 1243 log_err("setsockopt(..., IP_PKTINFO, ...) failed: %s", 1244 strerror(errno)); 1245 return 0; 1246 } 1247 # elif defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR) 1248 if(setsockopt(s, IPPROTO_IP, IP_RECVDSTADDR, 1249 (void*)&on, (socklen_t)sizeof(on)) < 0) { 1250 log_err("setsockopt(..., IP_RECVDSTADDR, ...) failed: %s", 1251 strerror(errno)); 1252 return 0; 1253 } 1254 # else 1255 log_err("no IP_SENDSRCADDR or IP_PKTINFO option, please disable " 1256 "interface-automatic or do-ip4 in config"); 1257 return 0; 1258 # endif /* IP_PKTINFO */ 1259 1260 } 1261 return 1; 1262 } 1263 1264 /** 1265 * Helper for ports_open. Creates one interface (or NULL for default). 1266 * @param ifname: The interface ip address. 1267 * @param do_auto: use automatic interface detection. 1268 * If enabled, then ifname must be the wildcard name. 1269 * @param do_udp: if udp should be used. 1270 * @param do_tcp: if tcp should be used. 1271 * @param hints: for getaddrinfo. family and flags have to be set by caller. 1272 * @param port: Port number to use. 1273 * @param list: list of open ports, appended to, changed to point to list head. 1274 * @param rcv: receive buffer size for UDP 1275 * @param snd: send buffer size for UDP 1276 * @param ssl_port: ssl service port number 1277 * @param tls_additional_port: list of additional ssl service port numbers. 1278 * @param https_port: DoH service port number 1279 * @param proxy_protocol_port: list of PROXYv2 port numbers. 1280 * @param reuseport: try to set SO_REUSEPORT if nonNULL and true. 1281 * set to false on exit if reuseport failed due to no kernel support. 1282 * @param transparent: set IP_TRANSPARENT socket option. 1283 * @param tcp_mss: maximum segment size of tcp socket. default if zero. 1284 * @param freebind: set IP_FREEBIND socket option. 1285 * @param http2_nodelay: set TCP_NODELAY on HTTP/2 connection 1286 * @param use_systemd: if true, fetch sockets from systemd. 1287 * @param dnscrypt_port: dnscrypt service port number 1288 * @param dscp: DSCP to use. 1289 * @param quic_port: dns over quic port number. 1290 * @param http_notls_downstream: if no tls is used for https downstream. 1291 * @param sock_queue_timeout: the sock_queue_timeout from config. Seconds to 1292 * wait to discard if UDP packets have waited for long in the socket 1293 * buffer. 1294 * @return: returns false on error. 1295 */ 1296 static int 1297 ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, 1298 struct addrinfo *hints, int port, struct listen_port** list, 1299 size_t rcv, size_t snd, int ssl_port, 1300 struct config_strlist* tls_additional_port, int https_port, 1301 struct config_strlist* proxy_protocol_port, 1302 int* reuseport, int transparent, int tcp_mss, int freebind, 1303 int http2_nodelay, int use_systemd, int dnscrypt_port, int dscp, 1304 int quic_port, int http_notls_downstream, int sock_queue_timeout) 1305 { 1306 int s, noip6=0; 1307 int is_ssl = if_is_ssl(ifname, port, ssl_port, tls_additional_port); 1308 int is_https = if_is_https(ifname, port, https_port); 1309 int is_dnscrypt = if_is_dnscrypt(ifname, port, dnscrypt_port); 1310 int is_pp2 = if_is_pp2(ifname, port, proxy_protocol_port); 1311 int is_doq = if_is_quic(ifname, port, quic_port); 1312 /* Always set TCP_NODELAY on TLS connection as it speeds up the TLS 1313 * handshake. DoH had already such option so we respect it. 1314 * Otherwise the server waits before sending more handshake data for 1315 * the client ACK (Nagle's algorithm), which is delayed because the 1316 * client waits for more data before ACKing (delayed ACK). */ 1317 int nodelay = is_https?http2_nodelay:is_ssl; 1318 struct unbound_socket* ub_sock; 1319 const char* add = NULL; 1320 1321 if(!do_udp && !do_tcp) 1322 return 0; 1323 1324 if(is_pp2) { 1325 if(is_dnscrypt) { 1326 fatal_exit("PROXYv2 and DNSCrypt combination not " 1327 "supported!"); 1328 } else if(is_https) { 1329 fatal_exit("PROXYv2 and DoH combination not " 1330 "supported!"); 1331 } else if(is_doq) { 1332 fatal_exit("PROXYv2 and DoQ combination not " 1333 "supported!"); 1334 } 1335 } 1336 1337 /* Check if both UDP and TCP ports should be open. 1338 * In the case of encrypted channels, probably an unencrypted channel 1339 * at the same port is not desired. */ 1340 if((is_ssl || is_https) && !is_doq) do_udp = do_auto = 0; 1341 if((is_doq) && !(is_https || is_ssl)) do_tcp = 0; 1342 1343 if(do_auto) { 1344 ub_sock = calloc(1, sizeof(struct unbound_socket)); 1345 if(!ub_sock) 1346 return 0; 1347 if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, 1348 &noip6, rcv, snd, reuseport, transparent, 1349 tcp_mss, nodelay, freebind, use_systemd, dscp, ub_sock, 1350 (is_dnscrypt?"udpancil_dnscrypt":"udpancil"))) == -1) { 1351 free(ub_sock->addr); 1352 free(ub_sock); 1353 if(noip6) { 1354 log_warn("IPv6 protocol not available"); 1355 return 1; 1356 } 1357 return 0; 1358 } 1359 /* getting source addr packet info is highly non-portable */ 1360 if(!set_recvpktinfo(s, hints->ai_family)) { 1361 sock_close(s); 1362 free(ub_sock->addr); 1363 free(ub_sock); 1364 return 0; 1365 } 1366 if (sock_queue_timeout && !set_recvtimestamp(s)) { 1367 log_warn("socket timestamping is not available"); 1368 } 1369 if(!port_insert(list, s, is_dnscrypt 1370 ?listen_type_udpancil_dnscrypt:listen_type_udpancil, 1371 is_pp2, ub_sock)) { 1372 sock_close(s); 1373 free(ub_sock->addr); 1374 free(ub_sock); 1375 return 0; 1376 } 1377 } else if(do_udp) { 1378 enum listen_type udp_port_type; 1379 ub_sock = calloc(1, sizeof(struct unbound_socket)); 1380 if(!ub_sock) 1381 return 0; 1382 if(is_dnscrypt) { 1383 udp_port_type = listen_type_udp_dnscrypt; 1384 add = "dnscrypt"; 1385 } else if(is_doq) { 1386 udp_port_type = listen_type_doq; 1387 add = "doq"; 1388 if(if_listens_on(ifname, port, 53, NULL)) { 1389 log_err("DNS over QUIC is strictly not " 1390 "allowed on port 53 as per RFC 9250. " 1391 "Port 53 is for DNS datagrams. Error " 1392 "for interface '%s'.", ifname); 1393 free(ub_sock->addr); 1394 free(ub_sock); 1395 return 0; 1396 } 1397 } else { 1398 udp_port_type = listen_type_udp; 1399 add = NULL; 1400 } 1401 /* regular udp socket */ 1402 if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, 1403 &noip6, rcv, snd, reuseport, transparent, 1404 tcp_mss, nodelay, freebind, use_systemd, dscp, ub_sock, 1405 add)) == -1) { 1406 free(ub_sock->addr); 1407 free(ub_sock); 1408 if(noip6) { 1409 log_warn("IPv6 protocol not available"); 1410 return 1; 1411 } 1412 return 0; 1413 } 1414 if(udp_port_type == listen_type_doq) { 1415 if(!set_recvpktinfo(s, hints->ai_family)) { 1416 sock_close(s); 1417 free(ub_sock->addr); 1418 free(ub_sock); 1419 return 0; 1420 } 1421 } 1422 if(udp_port_type == listen_type_udp && sock_queue_timeout) 1423 udp_port_type = listen_type_udpancil; 1424 if (sock_queue_timeout) { 1425 if(!set_recvtimestamp(s)) { 1426 log_warn("socket timestamping is not available"); 1427 } else { 1428 if(udp_port_type == listen_type_udp) 1429 udp_port_type = listen_type_udpancil; 1430 } 1431 } 1432 if(!port_insert(list, s, udp_port_type, is_pp2, ub_sock)) { 1433 sock_close(s); 1434 free(ub_sock->addr); 1435 free(ub_sock); 1436 return 0; 1437 } 1438 } 1439 if(do_tcp) { 1440 enum listen_type port_type; 1441 ub_sock = calloc(1, sizeof(struct unbound_socket)); 1442 if(!ub_sock) 1443 return 0; 1444 if(is_ssl) { 1445 port_type = listen_type_ssl; 1446 add = "tls"; 1447 } else if(is_https) { 1448 port_type = listen_type_http; 1449 add = "https"; 1450 if(http_notls_downstream) 1451 add = "http"; 1452 } else if(is_dnscrypt) { 1453 port_type = listen_type_tcp_dnscrypt; 1454 add = "dnscrypt"; 1455 } else { 1456 port_type = listen_type_tcp; 1457 add = NULL; 1458 } 1459 if((s = make_sock_port(SOCK_STREAM, ifname, port, hints, 1, 1460 &noip6, 0, 0, reuseport, transparent, tcp_mss, nodelay, 1461 freebind, use_systemd, dscp, ub_sock, add)) == -1) { 1462 free(ub_sock->addr); 1463 free(ub_sock); 1464 if(noip6) { 1465 /*log_warn("IPv6 protocol not available");*/ 1466 return 1; 1467 } 1468 return 0; 1469 } 1470 if(is_ssl) 1471 verbose(VERB_ALGO, "setup TCP for SSL service"); 1472 if(!port_insert(list, s, port_type, is_pp2, ub_sock)) { 1473 sock_close(s); 1474 free(ub_sock->addr); 1475 free(ub_sock); 1476 return 0; 1477 } 1478 } 1479 return 1; 1480 } 1481 1482 /** 1483 * Add items to commpoint list in front. 1484 * @param c: commpoint to add. 1485 * @param front: listen struct. 1486 * @return: false on failure. 1487 */ 1488 static int 1489 listen_cp_insert(struct comm_point* c, struct listen_dnsport* front) 1490 { 1491 struct listen_list* item = (struct listen_list*)malloc( 1492 sizeof(struct listen_list)); 1493 if(!item) 1494 return 0; 1495 item->com = c; 1496 item->next = front->cps; 1497 front->cps = item; 1498 return 1; 1499 } 1500 1501 void listen_setup_locks(void) 1502 { 1503 if(!stream_wait_lock_inited) { 1504 lock_basic_init(&stream_wait_count_lock); 1505 stream_wait_lock_inited = 1; 1506 } 1507 if(!http2_query_buffer_lock_inited) { 1508 lock_basic_init(&http2_query_buffer_count_lock); 1509 http2_query_buffer_lock_inited = 1; 1510 } 1511 if(!http2_response_buffer_lock_inited) { 1512 lock_basic_init(&http2_response_buffer_count_lock); 1513 http2_response_buffer_lock_inited = 1; 1514 } 1515 } 1516 1517 void listen_desetup_locks(void) 1518 { 1519 if(stream_wait_lock_inited) { 1520 stream_wait_lock_inited = 0; 1521 lock_basic_destroy(&stream_wait_count_lock); 1522 } 1523 if(http2_query_buffer_lock_inited) { 1524 http2_query_buffer_lock_inited = 0; 1525 lock_basic_destroy(&http2_query_buffer_count_lock); 1526 } 1527 if(http2_response_buffer_lock_inited) { 1528 http2_response_buffer_lock_inited = 0; 1529 lock_basic_destroy(&http2_response_buffer_count_lock); 1530 } 1531 } 1532 1533 struct listen_dnsport* 1534 listen_create(struct comm_base* base, struct listen_port* ports, 1535 size_t bufsize, int tcp_accept_count, int tcp_idle_timeout, 1536 int harden_large_queries, uint32_t http_max_streams, 1537 char* http_endpoint, int http_notls, struct tcl_list* tcp_conn_limit, 1538 void* dot_sslctx, void* doh_sslctx, void* quic_sslctx, 1539 struct dt_env* dtenv, 1540 struct doq_table* doq_table, 1541 struct ub_randstate* rnd,struct config_file* cfg, 1542 comm_point_callback_type* cb, void *cb_arg) 1543 { 1544 struct listen_dnsport* front = (struct listen_dnsport*) 1545 malloc(sizeof(struct listen_dnsport)); 1546 if(!front) 1547 return NULL; 1548 front->cps = NULL; 1549 front->udp_buff = sldns_buffer_new(bufsize); 1550 #ifdef USE_DNSCRYPT 1551 front->dnscrypt_udp_buff = NULL; 1552 #endif 1553 if(!front->udp_buff) { 1554 free(front); 1555 return NULL; 1556 } 1557 1558 /* create comm points as needed */ 1559 while(ports) { 1560 struct comm_point* cp = NULL; 1561 if(ports->ftype == listen_type_udp || 1562 ports->ftype == listen_type_udp_dnscrypt) { 1563 cp = comm_point_create_udp(base, ports->fd, 1564 front->udp_buff, ports->pp2_enabled, cb, 1565 cb_arg, ports->socket); 1566 } else if(ports->ftype == listen_type_doq && doq_table) { 1567 #ifndef HAVE_NGTCP2 1568 log_warn("Unbound is not compiled with " 1569 "ngtcp2. This is required to use DNS " 1570 "over QUIC."); 1571 #endif 1572 cp = comm_point_create_doq(base, ports->fd, 1573 front->udp_buff, cb, cb_arg, ports->socket, 1574 doq_table, rnd, quic_sslctx, cfg); 1575 } else if(ports->ftype == listen_type_tcp || 1576 ports->ftype == listen_type_tcp_dnscrypt) { 1577 cp = comm_point_create_tcp(base, ports->fd, 1578 tcp_accept_count, tcp_idle_timeout, 1579 harden_large_queries, 0, NULL, 1580 tcp_conn_limit, bufsize, front->udp_buff, 1581 ports->ftype, ports->pp2_enabled, cb, cb_arg, 1582 ports->socket); 1583 } else if(ports->ftype == listen_type_ssl || 1584 ports->ftype == listen_type_http) { 1585 cp = comm_point_create_tcp(base, ports->fd, 1586 tcp_accept_count, tcp_idle_timeout, 1587 harden_large_queries, 1588 http_max_streams, http_endpoint, 1589 tcp_conn_limit, bufsize, front->udp_buff, 1590 ports->ftype, ports->pp2_enabled, cb, cb_arg, 1591 ports->socket); 1592 if(ports->ftype == listen_type_http) { 1593 if(!doh_sslctx && !http_notls) { 1594 log_warn("HTTPS port configured, but " 1595 "no TLS tls-service-key or " 1596 "tls-service-pem set"); 1597 } 1598 #ifndef HAVE_SSL_CTX_SET_ALPN_SELECT_CB 1599 if(!http_notls) { 1600 log_warn("Unbound is not compiled " 1601 "with an OpenSSL version " 1602 "supporting ALPN " 1603 "(OpenSSL >= 1.0.2). This " 1604 "is required to use " 1605 "DNS-over-HTTPS"); 1606 } 1607 #endif 1608 #ifndef HAVE_NGHTTP2_NGHTTP2_H 1609 log_warn("Unbound is not compiled with " 1610 "nghttp2. This is required to use " 1611 "DNS-over-HTTPS."); 1612 #endif 1613 } 1614 } else if(ports->ftype == listen_type_udpancil || 1615 ports->ftype == listen_type_udpancil_dnscrypt) { 1616 #if defined(AF_INET6) && defined(IPV6_PKTINFO) && defined(HAVE_RECVMSG) 1617 cp = comm_point_create_udp_ancil(base, ports->fd, 1618 front->udp_buff, ports->pp2_enabled, cb, 1619 cb_arg, ports->socket); 1620 #else 1621 log_warn("This system does not support UDP ancillary data."); 1622 #endif 1623 } 1624 if(!cp) { 1625 log_err("can't create commpoint"); 1626 listen_delete(front); 1627 return NULL; 1628 } 1629 if((http_notls && ports->ftype == listen_type_http) || 1630 (ports->ftype == listen_type_tcp) || 1631 (ports->ftype == listen_type_udp) || 1632 (ports->ftype == listen_type_udpancil) || 1633 (ports->ftype == listen_type_tcp_dnscrypt) || 1634 (ports->ftype == listen_type_udp_dnscrypt) || 1635 (ports->ftype == listen_type_udpancil_dnscrypt)) { 1636 cp->ssl = NULL; 1637 } else if(ports->ftype == listen_type_doq) { 1638 cp->ssl = quic_sslctx; 1639 } else if(ports->ftype == listen_type_http) { 1640 cp->ssl = doh_sslctx; 1641 } else { 1642 cp->ssl = dot_sslctx; 1643 } 1644 cp->dtenv = dtenv; 1645 cp->do_not_close = 1; 1646 #ifdef USE_DNSCRYPT 1647 if (ports->ftype == listen_type_udp_dnscrypt || 1648 ports->ftype == listen_type_tcp_dnscrypt || 1649 ports->ftype == listen_type_udpancil_dnscrypt) { 1650 cp->dnscrypt = 1; 1651 cp->dnscrypt_buffer = sldns_buffer_new(bufsize); 1652 if(!cp->dnscrypt_buffer) { 1653 log_err("can't alloc dnscrypt_buffer"); 1654 comm_point_delete(cp); 1655 listen_delete(front); 1656 return NULL; 1657 } 1658 front->dnscrypt_udp_buff = cp->dnscrypt_buffer; 1659 } 1660 #endif 1661 if(!listen_cp_insert(cp, front)) { 1662 log_err("malloc failed"); 1663 comm_point_delete(cp); 1664 listen_delete(front); 1665 return NULL; 1666 } 1667 ports = ports->next; 1668 } 1669 if(!front->cps) { 1670 log_err("Could not open sockets to accept queries."); 1671 listen_delete(front); 1672 return NULL; 1673 } 1674 1675 return front; 1676 } 1677 1678 void 1679 listen_list_delete(struct listen_list* list) 1680 { 1681 struct listen_list *p = list, *pn; 1682 while(p) { 1683 pn = p->next; 1684 comm_point_delete(p->com); 1685 free(p); 1686 p = pn; 1687 } 1688 } 1689 1690 void 1691 listen_delete(struct listen_dnsport* front) 1692 { 1693 if(!front) 1694 return; 1695 listen_list_delete(front->cps); 1696 #ifdef USE_DNSCRYPT 1697 if(front->dnscrypt_udp_buff && 1698 front->udp_buff != front->dnscrypt_udp_buff) { 1699 sldns_buffer_free(front->dnscrypt_udp_buff); 1700 } 1701 #endif 1702 sldns_buffer_free(front->udp_buff); 1703 free(front); 1704 } 1705 1706 #ifdef HAVE_GETIFADDRS 1707 static int 1708 resolve_ifa_name(struct ifaddrs *ifas, const char *search_ifa, char ***ip_addresses, int *ip_addresses_size) 1709 { 1710 struct ifaddrs *ifa; 1711 void *tmpbuf; 1712 int last_ip_addresses_size = *ip_addresses_size; 1713 1714 for(ifa = ifas; ifa != NULL; ifa = ifa->ifa_next) { 1715 sa_family_t family; 1716 const char* atsign; 1717 #ifdef INET6 /* | address ip | % | ifa name | @ | port | nul */ 1718 char addr_buf[INET6_ADDRSTRLEN + 1 + IF_NAMESIZE + 1 + 16 + 1]; 1719 #else 1720 char addr_buf[INET_ADDRSTRLEN + 1 + 16 + 1]; 1721 #endif 1722 1723 if((atsign=strrchr(search_ifa, '@')) != NULL) { 1724 if(strlen(ifa->ifa_name) != (size_t)(atsign-search_ifa) 1725 || strncmp(ifa->ifa_name, search_ifa, 1726 atsign-search_ifa) != 0) 1727 continue; 1728 } else { 1729 if(strcmp(ifa->ifa_name, search_ifa) != 0) 1730 continue; 1731 atsign = ""; 1732 } 1733 1734 if(ifa->ifa_addr == NULL) 1735 continue; 1736 1737 family = ifa->ifa_addr->sa_family; 1738 if(family == AF_INET) { 1739 char a4[INET_ADDRSTRLEN + 1]; 1740 struct sockaddr_in *in4 = (struct sockaddr_in *) 1741 ifa->ifa_addr; 1742 if(!inet_ntop(family, &in4->sin_addr, a4, sizeof(a4))) { 1743 log_err("inet_ntop failed"); 1744 return 0; 1745 } 1746 snprintf(addr_buf, sizeof(addr_buf), "%s%s", 1747 a4, atsign); 1748 } 1749 #ifdef INET6 1750 else if(family == AF_INET6) { 1751 struct sockaddr_in6 *in6 = (struct sockaddr_in6 *) 1752 ifa->ifa_addr; 1753 char a6[INET6_ADDRSTRLEN + 1]; 1754 char if_index_name[IF_NAMESIZE + 1]; 1755 if_index_name[0] = 0; 1756 if(!inet_ntop(family, &in6->sin6_addr, a6, sizeof(a6))) { 1757 log_err("inet_ntop failed"); 1758 return 0; 1759 } 1760 (void)if_indextoname(in6->sin6_scope_id, 1761 (char *)if_index_name); 1762 if (strlen(if_index_name) != 0) { 1763 snprintf(addr_buf, sizeof(addr_buf), 1764 "%s%%%s%s", a6, if_index_name, atsign); 1765 } else { 1766 snprintf(addr_buf, sizeof(addr_buf), "%s%s", 1767 a6, atsign); 1768 } 1769 } 1770 #endif 1771 else { 1772 continue; 1773 } 1774 verbose(4, "interface %s has address %s", search_ifa, addr_buf); 1775 1776 tmpbuf = realloc(*ip_addresses, sizeof(char *) * (*ip_addresses_size + 1)); 1777 if(!tmpbuf) { 1778 log_err("realloc failed: out of memory"); 1779 return 0; 1780 } else { 1781 *ip_addresses = tmpbuf; 1782 } 1783 (*ip_addresses)[*ip_addresses_size] = strdup(addr_buf); 1784 if(!(*ip_addresses)[*ip_addresses_size]) { 1785 log_err("strdup failed: out of memory"); 1786 return 0; 1787 } 1788 (*ip_addresses_size)++; 1789 } 1790 1791 if (*ip_addresses_size == last_ip_addresses_size) { 1792 tmpbuf = realloc(*ip_addresses, sizeof(char *) * (*ip_addresses_size + 1)); 1793 if(!tmpbuf) { 1794 log_err("realloc failed: out of memory"); 1795 return 0; 1796 } else { 1797 *ip_addresses = tmpbuf; 1798 } 1799 (*ip_addresses)[*ip_addresses_size] = strdup(search_ifa); 1800 if(!(*ip_addresses)[*ip_addresses_size]) { 1801 log_err("strdup failed: out of memory"); 1802 return 0; 1803 } 1804 (*ip_addresses_size)++; 1805 } 1806 return 1; 1807 } 1808 #endif /* HAVE_GETIFADDRS */ 1809 1810 int resolve_interface_names(char** ifs, int num_ifs, 1811 struct config_strlist* list, char*** resif, int* num_resif) 1812 { 1813 #ifdef HAVE_GETIFADDRS 1814 struct ifaddrs *addrs = NULL; 1815 if(num_ifs == 0 && list == NULL) { 1816 *resif = NULL; 1817 *num_resif = 0; 1818 return 1; 1819 } 1820 if(getifaddrs(&addrs) == -1) { 1821 log_err("failed to list interfaces: getifaddrs: %s", 1822 strerror(errno)); 1823 freeifaddrs(addrs); 1824 return 0; 1825 } 1826 if(ifs) { 1827 int i; 1828 for(i=0; i<num_ifs; i++) { 1829 if(!resolve_ifa_name(addrs, ifs[i], resif, num_resif)) { 1830 freeifaddrs(addrs); 1831 config_del_strarray(*resif, *num_resif); 1832 *resif = NULL; 1833 *num_resif = 0; 1834 return 0; 1835 } 1836 } 1837 } 1838 if(list) { 1839 struct config_strlist* p; 1840 for(p = list; p; p = p->next) { 1841 if(!resolve_ifa_name(addrs, p->str, resif, num_resif)) { 1842 freeifaddrs(addrs); 1843 config_del_strarray(*resif, *num_resif); 1844 *resif = NULL; 1845 *num_resif = 0; 1846 return 0; 1847 } 1848 } 1849 } 1850 freeifaddrs(addrs); 1851 return 1; 1852 #else 1853 struct config_strlist* p; 1854 if(num_ifs == 0 && list == NULL) { 1855 *resif = NULL; 1856 *num_resif = 0; 1857 return 1; 1858 } 1859 *num_resif = num_ifs; 1860 for(p = list; p; p = p->next) { 1861 (*num_resif)++; 1862 } 1863 *resif = calloc(*num_resif, sizeof(**resif)); 1864 if(!*resif) { 1865 log_err("out of memory"); 1866 return 0; 1867 } 1868 if(ifs) { 1869 int i; 1870 for(i=0; i<num_ifs; i++) { 1871 (*resif)[i] = strdup(ifs[i]); 1872 if(!((*resif)[i])) { 1873 log_err("out of memory"); 1874 config_del_strarray(*resif, *num_resif); 1875 *resif = NULL; 1876 *num_resif = 0; 1877 return 0; 1878 } 1879 } 1880 } 1881 if(list) { 1882 int idx = num_ifs; 1883 for(p = list; p; p = p->next) { 1884 (*resif)[idx] = strdup(p->str); 1885 if(!((*resif)[idx])) { 1886 log_err("out of memory"); 1887 config_del_strarray(*resif, *num_resif); 1888 *resif = NULL; 1889 *num_resif = 0; 1890 return 0; 1891 } 1892 idx++; 1893 } 1894 } 1895 return 1; 1896 #endif /* HAVE_GETIFADDRS */ 1897 } 1898 1899 struct listen_port* 1900 listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs, 1901 int* reuseport) 1902 { 1903 struct listen_port* list = NULL; 1904 struct addrinfo hints; 1905 int i, do_ip4, do_ip6; 1906 int do_tcp, do_auto; 1907 do_ip4 = cfg->do_ip4; 1908 do_ip6 = cfg->do_ip6; 1909 do_tcp = cfg->do_tcp; 1910 do_auto = cfg->if_automatic && cfg->do_udp; 1911 if(cfg->incoming_num_tcp == 0) 1912 do_tcp = 0; 1913 1914 /* getaddrinfo */ 1915 memset(&hints, 0, sizeof(hints)); 1916 hints.ai_flags = AI_PASSIVE; 1917 /* no name lookups on our listening ports */ 1918 if(num_ifs > 0) 1919 hints.ai_flags |= AI_NUMERICHOST; 1920 hints.ai_family = AF_UNSPEC; 1921 #ifndef INET6 1922 do_ip6 = 0; 1923 #endif 1924 if(!do_ip4 && !do_ip6) { 1925 return NULL; 1926 } 1927 /* create ip4 and ip6 ports so that return addresses are nice. */ 1928 if(do_auto || num_ifs == 0) { 1929 if(do_auto && cfg->if_automatic_ports && 1930 cfg->if_automatic_ports[0]!=0) { 1931 char* now = cfg->if_automatic_ports; 1932 while(now && *now) { 1933 char* after; 1934 int extraport; 1935 while(isspace((unsigned char)*now)) 1936 now++; 1937 if(!*now) 1938 break; 1939 after = now; 1940 extraport = (int)strtol(now, &after, 10); 1941 if(extraport < 0 || extraport > 65535) { 1942 log_err("interface-automatic-ports port number out of range, at position %d of '%s'", (int)(now-cfg->if_automatic_ports)+1, cfg->if_automatic_ports); 1943 listening_ports_free(list); 1944 return NULL; 1945 } 1946 if(extraport == 0 && now == after) { 1947 log_err("interface-automatic-ports could not be parsed, at position %d of '%s'", (int)(now-cfg->if_automatic_ports)+1, cfg->if_automatic_ports); 1948 listening_ports_free(list); 1949 return NULL; 1950 } 1951 now = after; 1952 if(do_ip6) { 1953 hints.ai_family = AF_INET6; 1954 if(!ports_create_if("::0", 1955 do_auto, cfg->do_udp, do_tcp, 1956 &hints, extraport, &list, 1957 cfg->so_rcvbuf, cfg->so_sndbuf, 1958 cfg->ssl_port, cfg->tls_additional_port, 1959 cfg->https_port, 1960 cfg->proxy_protocol_port, 1961 reuseport, cfg->ip_transparent, 1962 cfg->tcp_mss, cfg->ip_freebind, 1963 cfg->http_nodelay, cfg->use_systemd, 1964 cfg->dnscrypt_port, cfg->ip_dscp, 1965 cfg->quic_port, cfg->http_notls_downstream, 1966 cfg->sock_queue_timeout)) { 1967 listening_ports_free(list); 1968 return NULL; 1969 } 1970 } 1971 if(do_ip4) { 1972 hints.ai_family = AF_INET; 1973 if(!ports_create_if("0.0.0.0", 1974 do_auto, cfg->do_udp, do_tcp, 1975 &hints, extraport, &list, 1976 cfg->so_rcvbuf, cfg->so_sndbuf, 1977 cfg->ssl_port, cfg->tls_additional_port, 1978 cfg->https_port, 1979 cfg->proxy_protocol_port, 1980 reuseport, cfg->ip_transparent, 1981 cfg->tcp_mss, cfg->ip_freebind, 1982 cfg->http_nodelay, cfg->use_systemd, 1983 cfg->dnscrypt_port, cfg->ip_dscp, 1984 cfg->quic_port, cfg->http_notls_downstream, 1985 cfg->sock_queue_timeout)) { 1986 listening_ports_free(list); 1987 return NULL; 1988 } 1989 } 1990 } 1991 return list; 1992 } 1993 if(do_ip6) { 1994 hints.ai_family = AF_INET6; 1995 if(!ports_create_if(do_auto?"::0":"::1", 1996 do_auto, cfg->do_udp, do_tcp, 1997 &hints, cfg->port, &list, 1998 cfg->so_rcvbuf, cfg->so_sndbuf, 1999 cfg->ssl_port, cfg->tls_additional_port, 2000 cfg->https_port, cfg->proxy_protocol_port, 2001 reuseport, cfg->ip_transparent, 2002 cfg->tcp_mss, cfg->ip_freebind, 2003 cfg->http_nodelay, cfg->use_systemd, 2004 cfg->dnscrypt_port, cfg->ip_dscp, 2005 cfg->quic_port, cfg->http_notls_downstream, 2006 cfg->sock_queue_timeout)) { 2007 listening_ports_free(list); 2008 return NULL; 2009 } 2010 } 2011 if(do_ip4) { 2012 hints.ai_family = AF_INET; 2013 if(!ports_create_if(do_auto?"0.0.0.0":"127.0.0.1", 2014 do_auto, cfg->do_udp, do_tcp, 2015 &hints, cfg->port, &list, 2016 cfg->so_rcvbuf, cfg->so_sndbuf, 2017 cfg->ssl_port, cfg->tls_additional_port, 2018 cfg->https_port, cfg->proxy_protocol_port, 2019 reuseport, cfg->ip_transparent, 2020 cfg->tcp_mss, cfg->ip_freebind, 2021 cfg->http_nodelay, cfg->use_systemd, 2022 cfg->dnscrypt_port, cfg->ip_dscp, 2023 cfg->quic_port, cfg->http_notls_downstream, 2024 cfg->sock_queue_timeout)) { 2025 listening_ports_free(list); 2026 return NULL; 2027 } 2028 } 2029 } else for(i = 0; i<num_ifs; i++) { 2030 if(str_is_ip6(ifs[i])) { 2031 if(!do_ip6) 2032 continue; 2033 hints.ai_family = AF_INET6; 2034 if(!ports_create_if(ifs[i], 0, cfg->do_udp, 2035 do_tcp, &hints, cfg->port, &list, 2036 cfg->so_rcvbuf, cfg->so_sndbuf, 2037 cfg->ssl_port, cfg->tls_additional_port, 2038 cfg->https_port, cfg->proxy_protocol_port, 2039 reuseport, cfg->ip_transparent, 2040 cfg->tcp_mss, cfg->ip_freebind, 2041 cfg->http_nodelay, cfg->use_systemd, 2042 cfg->dnscrypt_port, cfg->ip_dscp, 2043 cfg->quic_port, cfg->http_notls_downstream, 2044 cfg->sock_queue_timeout)) { 2045 listening_ports_free(list); 2046 return NULL; 2047 } 2048 } else { 2049 if(!do_ip4) 2050 continue; 2051 hints.ai_family = AF_INET; 2052 if(!ports_create_if(ifs[i], 0, cfg->do_udp, 2053 do_tcp, &hints, cfg->port, &list, 2054 cfg->so_rcvbuf, cfg->so_sndbuf, 2055 cfg->ssl_port, cfg->tls_additional_port, 2056 cfg->https_port, cfg->proxy_protocol_port, 2057 reuseport, cfg->ip_transparent, 2058 cfg->tcp_mss, cfg->ip_freebind, 2059 cfg->http_nodelay, cfg->use_systemd, 2060 cfg->dnscrypt_port, cfg->ip_dscp, 2061 cfg->quic_port, cfg->http_notls_downstream, 2062 cfg->sock_queue_timeout)) { 2063 listening_ports_free(list); 2064 return NULL; 2065 } 2066 } 2067 } 2068 2069 return list; 2070 } 2071 2072 void listening_ports_free(struct listen_port* list) 2073 { 2074 struct listen_port* nx; 2075 while(list) { 2076 nx = list->next; 2077 if(list->fd != -1) { 2078 sock_close(list->fd); 2079 } 2080 /* rc_ports don't have ub_socket */ 2081 if(list->socket) { 2082 free(list->socket->addr); 2083 free(list->socket); 2084 } 2085 free(list); 2086 list = nx; 2087 } 2088 } 2089 2090 size_t listen_get_mem(struct listen_dnsport* listen) 2091 { 2092 struct listen_list* p; 2093 size_t s = sizeof(*listen) + sizeof(*listen->base) + 2094 sizeof(*listen->udp_buff) + 2095 sldns_buffer_capacity(listen->udp_buff); 2096 #ifdef USE_DNSCRYPT 2097 s += sizeof(*listen->dnscrypt_udp_buff); 2098 if(listen->udp_buff != listen->dnscrypt_udp_buff){ 2099 s += sldns_buffer_capacity(listen->dnscrypt_udp_buff); 2100 } 2101 #endif 2102 for(p = listen->cps; p; p = p->next) { 2103 s += sizeof(*p); 2104 s += comm_point_get_mem(p->com); 2105 } 2106 return s; 2107 } 2108 2109 void listen_stop_accept(struct listen_dnsport* listen) 2110 { 2111 /* do not stop the ones that have no tcp_free list 2112 * (they have already stopped listening) */ 2113 struct listen_list* p; 2114 for(p=listen->cps; p; p=p->next) { 2115 if(p->com->type == comm_tcp_accept && 2116 p->com->tcp_free != NULL) { 2117 comm_point_stop_listening(p->com); 2118 } 2119 } 2120 } 2121 2122 void listen_start_accept(struct listen_dnsport* listen) 2123 { 2124 /* do not start the ones that have no tcp_free list, it is no 2125 * use to listen to them because they have no free tcp handlers */ 2126 struct listen_list* p; 2127 for(p=listen->cps; p; p=p->next) { 2128 if(p->com->type == comm_tcp_accept && 2129 p->com->tcp_free != NULL) { 2130 comm_point_start_listening(p->com, -1, -1); 2131 } 2132 } 2133 } 2134 2135 struct tcp_req_info* 2136 tcp_req_info_create(struct comm_base* base, struct sldns_buffer* spoolbuf) 2137 { 2138 struct tcp_req_info* req = (struct tcp_req_info*)malloc(sizeof(*req)); 2139 if(!req) { 2140 log_err("malloc failure for new stream outoforder processing structure"); 2141 return NULL; 2142 } 2143 memset(req, 0, sizeof(*req)); 2144 req->read_again_timer = comm_timer_create(base, tcp_read_again_cb, req); 2145 if(!req->read_again_timer) { 2146 log_err("malloc failure"); 2147 free(req); 2148 return NULL; 2149 } 2150 req->spool_buffer = spoolbuf; 2151 return req; 2152 } 2153 2154 void 2155 tcp_req_info_delete(struct tcp_req_info* req) 2156 { 2157 if(!req) return; 2158 tcp_req_info_clear(req); 2159 comm_timer_delete(req->read_again_timer); 2160 /* cp is pointer back to commpoint that owns this struct and 2161 * called delete on us */ 2162 /* spool_buffer is shared udp buffer, not deleted here */ 2163 free(req); 2164 } 2165 2166 void tcp_req_info_clear(struct tcp_req_info* req) 2167 { 2168 struct tcp_req_open_item* open, *nopen; 2169 struct tcp_req_done_item* item, *nitem; 2170 if(!req) return; 2171 2172 /* free outstanding request mesh reply entries */ 2173 open = req->open_req_list; 2174 while(open) { 2175 nopen = open->next; 2176 mesh_state_remove_reply(open->mesh, open->mesh_state, req->cp, 2177 NULL, NULL); 2178 free(open); 2179 open = nopen; 2180 } 2181 req->open_req_list = NULL; 2182 req->num_open_req = 0; 2183 2184 /* free pending writable result packets */ 2185 item = req->done_req_list; 2186 while(item) { 2187 nitem = item->next; 2188 lock_basic_lock(&stream_wait_count_lock); 2189 stream_wait_count -= (sizeof(struct tcp_req_done_item) 2190 +item->len); 2191 lock_basic_unlock(&stream_wait_count_lock); 2192 free(item->buf); 2193 free(item); 2194 item = nitem; 2195 } 2196 req->done_req_list = NULL; 2197 req->num_done_req = 0; 2198 req->read_is_closed = 0; 2199 2200 if(comm_timer_is_set(req->read_again_timer)) 2201 comm_timer_disable(req->read_again_timer); 2202 } 2203 2204 void 2205 tcp_req_info_remove_mesh_state(struct tcp_req_info* req, struct mesh_state* m) 2206 { 2207 struct tcp_req_open_item* open, *prev = NULL; 2208 if(!req || !m) return; 2209 open = req->open_req_list; 2210 while(open) { 2211 if(open->mesh_state == m) { 2212 struct tcp_req_open_item* next; 2213 if(prev) prev->next = open->next; 2214 else req->open_req_list = open->next; 2215 /* caller has to manage the mesh state reply entry */ 2216 next = open->next; 2217 free(open); 2218 req->num_open_req --; 2219 2220 /* prev = prev; */ 2221 open = next; 2222 continue; 2223 } 2224 prev = open; 2225 open = open->next; 2226 } 2227 } 2228 2229 /** setup listening for read or write */ 2230 static void 2231 tcp_req_info_setup_listen(struct tcp_req_info* req) 2232 { 2233 int wr = 0; 2234 int rd = 0; 2235 2236 if(req->cp->tcp_byte_count != 0) { 2237 /* cannot change, halfway through */ 2238 return; 2239 } 2240 2241 if(!req->cp->tcp_is_reading) 2242 wr = 1; 2243 if(!req->read_is_closed) 2244 rd = 1; 2245 2246 if(wr) { 2247 req->cp->tcp_is_reading = 0; 2248 comm_point_stop_listening(req->cp); 2249 comm_point_start_listening(req->cp, -1, 2250 adjusted_tcp_timeout(req->cp)); 2251 } else if(rd) { 2252 req->cp->tcp_is_reading = 1; 2253 comm_point_stop_listening(req->cp); 2254 comm_point_start_listening(req->cp, -1, 2255 adjusted_tcp_timeout(req->cp)); 2256 /* and also read it (from SSL stack buffers), so 2257 * no event read event is expected since the remainder of 2258 * the TLS frame is sitting in the buffers. */ 2259 req->read_again = 1; 2260 } else { 2261 comm_point_stop_listening(req->cp); 2262 comm_point_start_listening(req->cp, -1, 2263 adjusted_tcp_timeout(req->cp)); 2264 comm_point_listen_for_rw(req->cp, 0, 0); 2265 } 2266 } 2267 2268 /** remove first item from list of pending results */ 2269 static struct tcp_req_done_item* 2270 tcp_req_info_pop_done(struct tcp_req_info* req) 2271 { 2272 struct tcp_req_done_item* item; 2273 log_assert(req->num_done_req > 0 && req->done_req_list); 2274 item = req->done_req_list; 2275 lock_basic_lock(&stream_wait_count_lock); 2276 stream_wait_count -= (sizeof(struct tcp_req_done_item)+item->len); 2277 lock_basic_unlock(&stream_wait_count_lock); 2278 req->done_req_list = req->done_req_list->next; 2279 req->num_done_req --; 2280 return item; 2281 } 2282 2283 /** Send given buffer and setup to write */ 2284 static void 2285 tcp_req_info_start_write_buf(struct tcp_req_info* req, uint8_t* buf, 2286 size_t len) 2287 { 2288 sldns_buffer_clear(req->cp->buffer); 2289 sldns_buffer_write(req->cp->buffer, buf, len); 2290 sldns_buffer_flip(req->cp->buffer); 2291 2292 req->cp->tcp_is_reading = 0; /* we are now writing */ 2293 } 2294 2295 /** pick up the next result and start writing it to the channel */ 2296 static void 2297 tcp_req_pickup_next_result(struct tcp_req_info* req) 2298 { 2299 if(req->num_done_req > 0) { 2300 /* unlist the done item from the list of pending results */ 2301 struct tcp_req_done_item* item = tcp_req_info_pop_done(req); 2302 tcp_req_info_start_write_buf(req, item->buf, item->len); 2303 free(item->buf); 2304 free(item); 2305 } 2306 } 2307 2308 /** the read channel has closed */ 2309 int 2310 tcp_req_info_handle_read_close(struct tcp_req_info* req) 2311 { 2312 verbose(VERB_ALGO, "tcp channel read side closed %d", req->cp->fd); 2313 /* RFC 7766 6.2.4 says to drop pending replies when client closes. */ 2314 return 0; /* drop connection */ 2315 } 2316 2317 void 2318 tcp_req_info_handle_writedone(struct tcp_req_info* req) 2319 { 2320 /* back to reading state, we finished this write event */ 2321 sldns_buffer_clear(req->cp->buffer); 2322 if(req->num_done_req == 0 && req->read_is_closed) { 2323 /* no more to write and nothing to read, close it */ 2324 comm_point_drop_reply(&req->cp->repinfo); 2325 return; 2326 } 2327 req->cp->tcp_is_reading = 1; 2328 /* see if another result needs writing */ 2329 tcp_req_pickup_next_result(req); 2330 2331 /* see if there is more to write, if not stop_listening for writing */ 2332 /* see if new requests are allowed, if so, start_listening 2333 * for reading */ 2334 tcp_req_info_setup_listen(req); 2335 } 2336 2337 void 2338 tcp_req_info_handle_readdone(struct tcp_req_info* req) 2339 { 2340 struct comm_point* c = req->cp; 2341 2342 /* we want to read up several requests, unless there are 2343 * pending answers */ 2344 2345 req->is_drop = 0; 2346 req->is_reply = 0; 2347 req->in_worker_handle = 1; 2348 sldns_buffer_set_limit(req->spool_buffer, 0); 2349 /* handle the current request */ 2350 /* this calls the worker handle request routine that could give 2351 * a cache response, or localdata response, or drop the reply, 2352 * or schedule a mesh entry for later */ 2353 fptr_ok(fptr_whitelist_comm_point(c->callback)); 2354 if( (*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, &c->repinfo) ) { 2355 req->in_worker_handle = 0; 2356 /* there is an answer, put it up. It is already in the 2357 * c->buffer, just send it. */ 2358 /* since we were just reading a query, the channel is 2359 * clear to write to */ 2360 send_it: 2361 c->tcp_is_reading = 0; 2362 comm_point_stop_listening(c); 2363 comm_point_start_listening(c, -1, adjusted_tcp_timeout(c)); 2364 return; 2365 } 2366 req->in_worker_handle = 0; 2367 /* it should be waiting in the mesh for recursion. 2368 * If mesh failed to add a new entry and called commpoint_drop_reply. 2369 * Then the mesh state has been cleared. */ 2370 if(req->is_drop) { 2371 /* the reply has been dropped, stream has been closed. */ 2372 return; 2373 } 2374 /* If mesh failed(mallocfail) and called commpoint_send_reply with 2375 * something like servfail then we pick up that reply below. */ 2376 if(req->is_reply) { 2377 goto send_it; 2378 } 2379 2380 sldns_buffer_clear(c->buffer); 2381 /* if pending answers, pick up an answer and start sending it */ 2382 tcp_req_pickup_next_result(req); 2383 2384 /* if answers pending, start sending answers */ 2385 /* read more requests if we can have more requests */ 2386 tcp_req_info_setup_listen(req); 2387 } 2388 2389 int 2390 tcp_req_info_add_meshstate(struct tcp_req_info* req, 2391 struct mesh_area* mesh, struct mesh_state* m) 2392 { 2393 struct tcp_req_open_item* item; 2394 log_assert(req && mesh && m); 2395 item = (struct tcp_req_open_item*)malloc(sizeof(*item)); 2396 if(!item) return 0; 2397 item->next = req->open_req_list; 2398 item->mesh = mesh; 2399 item->mesh_state = m; 2400 req->open_req_list = item; 2401 req->num_open_req++; 2402 return 1; 2403 } 2404 2405 /** Add a result to the result list. At the end. */ 2406 static int 2407 tcp_req_info_add_result(struct tcp_req_info* req, uint8_t* buf, size_t len) 2408 { 2409 struct tcp_req_done_item* last = NULL; 2410 struct tcp_req_done_item* item; 2411 size_t space; 2412 2413 /* see if we have space */ 2414 space = sizeof(struct tcp_req_done_item) + len; 2415 lock_basic_lock(&stream_wait_count_lock); 2416 if(stream_wait_count + space > stream_wait_max) { 2417 lock_basic_unlock(&stream_wait_count_lock); 2418 verbose(VERB_ALGO, "drop stream reply, no space left, in stream-wait-size"); 2419 return 0; 2420 } 2421 stream_wait_count += space; 2422 lock_basic_unlock(&stream_wait_count_lock); 2423 2424 /* find last element */ 2425 last = req->done_req_list; 2426 while(last && last->next) 2427 last = last->next; 2428 2429 /* create new element */ 2430 item = (struct tcp_req_done_item*)malloc(sizeof(*item)); 2431 if(!item) { 2432 log_err("malloc failure, for stream result list"); 2433 return 0; 2434 } 2435 item->next = NULL; 2436 item->len = len; 2437 item->buf = memdup(buf, len); 2438 if(!item->buf) { 2439 free(item); 2440 log_err("malloc failure, adding reply to stream result list"); 2441 return 0; 2442 } 2443 2444 /* link in */ 2445 if(last) last->next = item; 2446 else req->done_req_list = item; 2447 req->num_done_req++; 2448 return 1; 2449 } 2450 2451 void 2452 tcp_req_info_send_reply(struct tcp_req_info* req) 2453 { 2454 if(req->in_worker_handle) { 2455 /* reply from mesh is in the spool_buffer */ 2456 /* copy now, so that the spool buffer is free for other tasks 2457 * before the callback is done */ 2458 sldns_buffer_clear(req->cp->buffer); 2459 sldns_buffer_write(req->cp->buffer, 2460 sldns_buffer_begin(req->spool_buffer), 2461 sldns_buffer_limit(req->spool_buffer)); 2462 sldns_buffer_flip(req->cp->buffer); 2463 req->is_reply = 1; 2464 return; 2465 } 2466 /* now that the query has been handled, that mesh_reply entry 2467 * should be removed, from the tcp_req_info list, 2468 * the mesh state cleanup removes then with region_cleanup and 2469 * replies_sent true. */ 2470 /* see if we can send it straight away (we are not doing 2471 * anything else). If so, copy to buffer and start */ 2472 if(req->cp->tcp_is_reading && req->cp->tcp_byte_count == 0) { 2473 /* buffer is free, and was ready to read new query into, 2474 * but we are now going to use it to send this answer */ 2475 tcp_req_info_start_write_buf(req, 2476 sldns_buffer_begin(req->spool_buffer), 2477 sldns_buffer_limit(req->spool_buffer)); 2478 /* switch to listen to write events */ 2479 comm_point_stop_listening(req->cp); 2480 comm_point_start_listening(req->cp, -1, 2481 adjusted_tcp_timeout(req->cp)); 2482 return; 2483 } 2484 /* queue up the answer behind the others already pending */ 2485 if(!tcp_req_info_add_result(req, sldns_buffer_begin(req->spool_buffer), 2486 sldns_buffer_limit(req->spool_buffer))) { 2487 /* drop the connection, we are out of resources */ 2488 comm_point_drop_reply(&req->cp->repinfo); 2489 } 2490 } 2491 2492 size_t tcp_req_info_get_stream_buffer_size(void) 2493 { 2494 size_t s; 2495 if(!stream_wait_lock_inited) 2496 return stream_wait_count; 2497 lock_basic_lock(&stream_wait_count_lock); 2498 s = stream_wait_count; 2499 lock_basic_unlock(&stream_wait_count_lock); 2500 return s; 2501 } 2502 2503 size_t http2_get_query_buffer_size(void) 2504 { 2505 size_t s; 2506 if(!http2_query_buffer_lock_inited) 2507 return http2_query_buffer_count; 2508 lock_basic_lock(&http2_query_buffer_count_lock); 2509 s = http2_query_buffer_count; 2510 lock_basic_unlock(&http2_query_buffer_count_lock); 2511 return s; 2512 } 2513 2514 size_t http2_get_response_buffer_size(void) 2515 { 2516 size_t s; 2517 if(!http2_response_buffer_lock_inited) 2518 return http2_response_buffer_count; 2519 lock_basic_lock(&http2_response_buffer_count_lock); 2520 s = http2_response_buffer_count; 2521 lock_basic_unlock(&http2_response_buffer_count_lock); 2522 return s; 2523 } 2524 2525 #ifdef HAVE_NGHTTP2 2526 /** nghttp2 callback. Used to copy response from rbuffer to nghttp2 session */ 2527 static ssize_t http2_submit_response_read_callback( 2528 nghttp2_session* ATTR_UNUSED(session), 2529 int32_t stream_id, uint8_t* buf, size_t length, uint32_t* data_flags, 2530 nghttp2_data_source* source, void* ATTR_UNUSED(cb_arg)) 2531 { 2532 struct http2_stream* h2_stream; 2533 struct http2_session* h2_session = source->ptr; 2534 size_t copylen = length; 2535 if(!(h2_stream = nghttp2_session_get_stream_user_data( 2536 h2_session->session, stream_id))) { 2537 verbose(VERB_QUERY, "http2: cannot get stream data, closing " 2538 "stream"); 2539 return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE; 2540 } 2541 if(!h2_stream->rbuffer || 2542 sldns_buffer_remaining(h2_stream->rbuffer) == 0) { 2543 verbose(VERB_QUERY, "http2: cannot submit buffer. No data " 2544 "available in rbuffer"); 2545 /* rbuffer will be free'd in frame close cb */ 2546 return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE; 2547 } 2548 2549 if(copylen > sldns_buffer_remaining(h2_stream->rbuffer)) 2550 copylen = sldns_buffer_remaining(h2_stream->rbuffer); 2551 if(copylen > SSIZE_MAX) 2552 copylen = SSIZE_MAX; /* will probably never happen */ 2553 2554 memcpy(buf, sldns_buffer_current(h2_stream->rbuffer), copylen); 2555 sldns_buffer_skip(h2_stream->rbuffer, copylen); 2556 2557 if(sldns_buffer_remaining(h2_stream->rbuffer) == 0) { 2558 *data_flags |= NGHTTP2_DATA_FLAG_EOF; 2559 lock_basic_lock(&http2_response_buffer_count_lock); 2560 http2_response_buffer_count -= 2561 sldns_buffer_capacity(h2_stream->rbuffer); 2562 lock_basic_unlock(&http2_response_buffer_count_lock); 2563 sldns_buffer_free(h2_stream->rbuffer); 2564 h2_stream->rbuffer = NULL; 2565 } 2566 2567 return copylen; 2568 } 2569 2570 /** 2571 * Send RST_STREAM frame for stream. 2572 * @param h2_session: http2 session to submit frame to 2573 * @param h2_stream: http2 stream containing frame ID to use in RST_STREAM 2574 * @return 0 on error, 1 otherwise 2575 */ 2576 static int http2_submit_rst_stream(struct http2_session* h2_session, 2577 struct http2_stream* h2_stream) 2578 { 2579 int ret = nghttp2_submit_rst_stream(h2_session->session, 2580 NGHTTP2_FLAG_NONE, h2_stream->stream_id, 2581 NGHTTP2_INTERNAL_ERROR); 2582 if(ret) { 2583 verbose(VERB_QUERY, "http2: nghttp2_submit_rst_stream failed, " 2584 "error: %s", nghttp2_strerror(ret)); 2585 return 0; 2586 } 2587 return 1; 2588 } 2589 2590 /** 2591 * DNS response ready to be submitted to nghttp2, to be prepared for sending 2592 * out. Response is stored in c->buffer. Copy to rbuffer because the c->buffer 2593 * might be used before this will be sent out. 2594 * @param h2_session: http2 session, containing c->buffer which contains answer 2595 * @return 0 on error, 1 otherwise 2596 */ 2597 int http2_submit_dns_response(struct http2_session* h2_session) 2598 { 2599 int ret; 2600 nghttp2_data_provider data_prd; 2601 char status[4]; 2602 nghttp2_nv headers[3]; 2603 struct http2_stream* h2_stream = h2_session->c->h2_stream; 2604 size_t rlen; 2605 char rlen_str[32]; 2606 2607 if(h2_stream->rbuffer) { 2608 log_err("http2 submit response error: rbuffer already " 2609 "exists"); 2610 return 0; 2611 } 2612 if(sldns_buffer_remaining(h2_session->c->buffer) == 0) { 2613 log_err("http2 submit response error: c->buffer not complete"); 2614 return 0; 2615 } 2616 2617 if(snprintf(status, 4, "%d", h2_stream->status) != 3) { 2618 verbose(VERB_QUERY, "http2: submit response error: " 2619 "invalid status"); 2620 return 0; 2621 } 2622 2623 rlen = sldns_buffer_remaining(h2_session->c->buffer); 2624 snprintf(rlen_str, sizeof(rlen_str), "%u", (unsigned)rlen); 2625 2626 lock_basic_lock(&http2_response_buffer_count_lock); 2627 if(http2_response_buffer_count + rlen > http2_response_buffer_max) { 2628 lock_basic_unlock(&http2_response_buffer_count_lock); 2629 verbose(VERB_ALGO, "reset HTTP2 stream, no space left, " 2630 "in https-response-buffer-size"); 2631 return http2_submit_rst_stream(h2_session, h2_stream); 2632 } 2633 http2_response_buffer_count += rlen; 2634 lock_basic_unlock(&http2_response_buffer_count_lock); 2635 2636 if(!(h2_stream->rbuffer = sldns_buffer_new(rlen))) { 2637 lock_basic_lock(&http2_response_buffer_count_lock); 2638 http2_response_buffer_count -= rlen; 2639 lock_basic_unlock(&http2_response_buffer_count_lock); 2640 log_err("http2 submit response error: malloc failure"); 2641 return 0; 2642 } 2643 2644 headers[0].name = (uint8_t*)":status"; 2645 headers[0].namelen = 7; 2646 headers[0].value = (uint8_t*)status; 2647 headers[0].valuelen = 3; 2648 headers[0].flags = NGHTTP2_NV_FLAG_NONE; 2649 2650 headers[1].name = (uint8_t*)"content-type"; 2651 headers[1].namelen = 12; 2652 headers[1].value = (uint8_t*)"application/dns-message"; 2653 headers[1].valuelen = 23; 2654 headers[1].flags = NGHTTP2_NV_FLAG_NONE; 2655 2656 headers[2].name = (uint8_t*)"content-length"; 2657 headers[2].namelen = 14; 2658 headers[2].value = (uint8_t*)rlen_str; 2659 headers[2].valuelen = strlen(rlen_str); 2660 headers[2].flags = NGHTTP2_NV_FLAG_NONE; 2661 2662 sldns_buffer_write(h2_stream->rbuffer, 2663 sldns_buffer_current(h2_session->c->buffer), 2664 sldns_buffer_remaining(h2_session->c->buffer)); 2665 sldns_buffer_flip(h2_stream->rbuffer); 2666 2667 data_prd.source.ptr = h2_session; 2668 data_prd.read_callback = http2_submit_response_read_callback; 2669 ret = nghttp2_submit_response(h2_session->session, h2_stream->stream_id, 2670 headers, 3, &data_prd); 2671 if(ret) { 2672 verbose(VERB_QUERY, "http2: set_stream_user_data failed, " 2673 "error: %s", nghttp2_strerror(ret)); 2674 return 0; 2675 } 2676 return 1; 2677 } 2678 #else 2679 int http2_submit_dns_response(void* ATTR_UNUSED(v)) 2680 { 2681 return 0; 2682 } 2683 #endif 2684 2685 #ifdef HAVE_NGHTTP2 2686 /** HTTP status to descriptive string */ 2687 static char* http_status_to_str(enum http_status s) 2688 { 2689 switch(s) { 2690 case HTTP_STATUS_OK: 2691 return "OK"; 2692 case HTTP_STATUS_BAD_REQUEST: 2693 return "Bad Request"; 2694 case HTTP_STATUS_NOT_FOUND: 2695 return "Not Found"; 2696 case HTTP_STATUS_PAYLOAD_TOO_LARGE: 2697 return "Payload Too Large"; 2698 case HTTP_STATUS_URI_TOO_LONG: 2699 return "URI Too Long"; 2700 case HTTP_STATUS_UNSUPPORTED_MEDIA_TYPE: 2701 return "Unsupported Media Type"; 2702 case HTTP_STATUS_NOT_IMPLEMENTED: 2703 return "Not Implemented"; 2704 } 2705 return "Status Unknown"; 2706 } 2707 2708 /** nghttp2 callback. Used to copy error message to nghttp2 session */ 2709 static ssize_t http2_submit_error_read_callback( 2710 nghttp2_session* ATTR_UNUSED(session), 2711 int32_t stream_id, uint8_t* buf, size_t length, uint32_t* data_flags, 2712 nghttp2_data_source* source, void* ATTR_UNUSED(cb_arg)) 2713 { 2714 struct http2_stream* h2_stream; 2715 struct http2_session* h2_session = source->ptr; 2716 char* msg; 2717 if(!(h2_stream = nghttp2_session_get_stream_user_data( 2718 h2_session->session, stream_id))) { 2719 verbose(VERB_QUERY, "http2: cannot get stream data, closing " 2720 "stream"); 2721 return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE; 2722 } 2723 *data_flags |= NGHTTP2_DATA_FLAG_EOF; 2724 msg = http_status_to_str(h2_stream->status); 2725 if(length < strlen(msg)) 2726 return 0; /* not worth trying over multiple frames */ 2727 memcpy(buf, msg, strlen(msg)); 2728 return strlen(msg); 2729 2730 } 2731 2732 /** 2733 * HTTP error response ready to be submitted to nghttp2, to be prepared for 2734 * sending out. Message body will contain descriptive string for HTTP status. 2735 * @param h2_session: http2 session to submit to 2736 * @param h2_stream: http2 stream containing HTTP status to use for error 2737 * @return 0 on error, 1 otherwise 2738 */ 2739 static int http2_submit_error(struct http2_session* h2_session, 2740 struct http2_stream* h2_stream) 2741 { 2742 int ret; 2743 char status[4]; 2744 nghttp2_data_provider data_prd; 2745 nghttp2_nv headers[1]; /* will be copied by nghttp */ 2746 if(snprintf(status, 4, "%d", h2_stream->status) != 3) { 2747 verbose(VERB_QUERY, "http2: submit error failed, " 2748 "invalid status"); 2749 return 0; 2750 } 2751 headers[0].name = (uint8_t*)":status"; 2752 headers[0].namelen = 7; 2753 headers[0].value = (uint8_t*)status; 2754 headers[0].valuelen = 3; 2755 headers[0].flags = NGHTTP2_NV_FLAG_NONE; 2756 2757 data_prd.source.ptr = h2_session; 2758 data_prd.read_callback = http2_submit_error_read_callback; 2759 2760 ret = nghttp2_submit_response(h2_session->session, h2_stream->stream_id, 2761 headers, 1, &data_prd); 2762 if(ret) { 2763 verbose(VERB_QUERY, "http2: submit error failed, " 2764 "error: %s", nghttp2_strerror(ret)); 2765 return 0; 2766 } 2767 return 1; 2768 } 2769 2770 /** 2771 * Start query handling. Query is stored in the stream, and will be free'd here. 2772 * @param h2_session: http2 session, containing comm point 2773 * @param h2_stream: stream containing buffered query 2774 * @return: -1 on error, 1 if answer is stored in c->buffer, 0 if there is no 2775 * reply available (yet). 2776 */ 2777 static int http2_query_read_done(struct http2_session* h2_session, 2778 struct http2_stream* h2_stream) 2779 { 2780 log_assert(h2_stream->qbuffer); 2781 2782 if(h2_session->c->h2_stream) { 2783 verbose(VERB_ALGO, "http2_query_read_done failure: shared " 2784 "buffer already assigned to stream"); 2785 return -1; 2786 } 2787 2788 /* the c->buffer might be used by mesh_send_reply and no be cleard 2789 * need to be cleared before use */ 2790 sldns_buffer_clear(h2_session->c->buffer); 2791 if(sldns_buffer_remaining(h2_session->c->buffer) < 2792 sldns_buffer_remaining(h2_stream->qbuffer)) { 2793 /* qbuffer will be free'd in frame close cb */ 2794 sldns_buffer_clear(h2_session->c->buffer); 2795 verbose(VERB_ALGO, "http2_query_read_done failure: can't fit " 2796 "qbuffer in c->buffer"); 2797 return -1; 2798 } 2799 2800 sldns_buffer_write(h2_session->c->buffer, 2801 sldns_buffer_current(h2_stream->qbuffer), 2802 sldns_buffer_remaining(h2_stream->qbuffer)); 2803 2804 lock_basic_lock(&http2_query_buffer_count_lock); 2805 http2_query_buffer_count -= sldns_buffer_capacity(h2_stream->qbuffer); 2806 lock_basic_unlock(&http2_query_buffer_count_lock); 2807 sldns_buffer_free(h2_stream->qbuffer); 2808 h2_stream->qbuffer = NULL; 2809 2810 sldns_buffer_flip(h2_session->c->buffer); 2811 h2_session->c->h2_stream = h2_stream; 2812 fptr_ok(fptr_whitelist_comm_point(h2_session->c->callback)); 2813 if((*h2_session->c->callback)(h2_session->c, h2_session->c->cb_arg, 2814 NETEVENT_NOERROR, &h2_session->c->repinfo)) { 2815 return 1; /* answer in c->buffer */ 2816 } 2817 sldns_buffer_clear(h2_session->c->buffer); 2818 h2_session->c->h2_stream = NULL; 2819 return 0; /* mesh state added, or dropped */ 2820 } 2821 2822 /** nghttp2 callback. Used to check if the received frame indicates the end of a 2823 * stream. Gather collected request data and start query handling. */ 2824 static int http2_req_frame_recv_cb(nghttp2_session* session, 2825 const nghttp2_frame* frame, void* cb_arg) 2826 { 2827 struct http2_session* h2_session = (struct http2_session*)cb_arg; 2828 struct http2_stream* h2_stream; 2829 int query_read_done; 2830 2831 if((frame->hd.type != NGHTTP2_DATA && 2832 frame->hd.type != NGHTTP2_HEADERS) || 2833 !(frame->hd.flags & NGHTTP2_FLAG_END_STREAM)) { 2834 return 0; 2835 } 2836 2837 if(!(h2_stream = nghttp2_session_get_stream_user_data( 2838 session, frame->hd.stream_id))) 2839 return 0; 2840 2841 if(h2_stream->invalid_endpoint) { 2842 h2_stream->status = HTTP_STATUS_NOT_FOUND; 2843 goto submit_http_error; 2844 } 2845 2846 if(h2_stream->invalid_content_type) { 2847 h2_stream->status = HTTP_STATUS_UNSUPPORTED_MEDIA_TYPE; 2848 goto submit_http_error; 2849 } 2850 2851 if(h2_stream->http_method != HTTP_METHOD_GET && 2852 h2_stream->http_method != HTTP_METHOD_POST) { 2853 h2_stream->status = HTTP_STATUS_NOT_IMPLEMENTED; 2854 goto submit_http_error; 2855 } 2856 2857 if(h2_stream->query_too_large) { 2858 if(h2_stream->http_method == HTTP_METHOD_POST) 2859 h2_stream->status = HTTP_STATUS_PAYLOAD_TOO_LARGE; 2860 else 2861 h2_stream->status = HTTP_STATUS_URI_TOO_LONG; 2862 goto submit_http_error; 2863 } 2864 2865 if(!h2_stream->qbuffer) { 2866 h2_stream->status = HTTP_STATUS_BAD_REQUEST; 2867 goto submit_http_error; 2868 } 2869 2870 if(h2_stream->status) { 2871 submit_http_error: 2872 verbose(VERB_QUERY, "http2 request invalid, returning :status=" 2873 "%d", h2_stream->status); 2874 if(!http2_submit_error(h2_session, h2_stream)) { 2875 return NGHTTP2_ERR_CALLBACK_FAILURE; 2876 } 2877 return 0; 2878 } 2879 h2_stream->status = HTTP_STATUS_OK; 2880 2881 sldns_buffer_flip(h2_stream->qbuffer); 2882 h2_session->postpone_drop = 1; 2883 query_read_done = http2_query_read_done(h2_session, h2_stream); 2884 h2_session->postpone_drop = 0; 2885 if(query_read_done < 0) 2886 return NGHTTP2_ERR_CALLBACK_FAILURE; 2887 else if(!query_read_done) { 2888 if(h2_session->is_drop) { 2889 /* connection needs to be closed. Return failure to make 2890 * sure no other action are taken anymore on comm point. 2891 * failure will result in reclaiming (and closing) 2892 * of comm point. */ 2893 verbose(VERB_QUERY, "http2 query dropped in worker cb"); 2894 return NGHTTP2_ERR_CALLBACK_FAILURE; 2895 } 2896 /* nothing to submit right now, query added to mesh. */ 2897 return 0; 2898 } 2899 if(!http2_submit_dns_response(h2_session)) { 2900 sldns_buffer_clear(h2_session->c->buffer); 2901 h2_session->c->h2_stream = NULL; 2902 return NGHTTP2_ERR_CALLBACK_FAILURE; 2903 } 2904 verbose(VERB_QUERY, "http2 query submitted to session"); 2905 sldns_buffer_clear(h2_session->c->buffer); 2906 h2_session->c->h2_stream = NULL; 2907 return 0; 2908 } 2909 2910 /** nghttp2 callback. Used to detect start of new streams. */ 2911 static int http2_req_begin_headers_cb(nghttp2_session* session, 2912 const nghttp2_frame* frame, void* cb_arg) 2913 { 2914 struct http2_session* h2_session = (struct http2_session*)cb_arg; 2915 struct http2_stream* h2_stream; 2916 int ret; 2917 if(frame->hd.type != NGHTTP2_HEADERS || 2918 frame->headers.cat != NGHTTP2_HCAT_REQUEST) { 2919 /* only interested in request headers */ 2920 return 0; 2921 } 2922 if(!(h2_stream = http2_stream_create(frame->hd.stream_id))) { 2923 log_err("malloc failure while creating http2 stream"); 2924 return NGHTTP2_ERR_CALLBACK_FAILURE; 2925 } 2926 http2_session_add_stream(h2_session, h2_stream); 2927 ret = nghttp2_session_set_stream_user_data(session, 2928 frame->hd.stream_id, h2_stream); 2929 if(ret) { 2930 /* stream does not exist */ 2931 verbose(VERB_QUERY, "http2: set_stream_user_data failed, " 2932 "error: %s", nghttp2_strerror(ret)); 2933 return NGHTTP2_ERR_CALLBACK_FAILURE; 2934 } 2935 2936 return 0; 2937 } 2938 2939 /** 2940 * base64url decode, store in qbuffer 2941 * @param h2_session: http2 session 2942 * @param h2_stream: http2 stream 2943 * @param start: start of the base64 string 2944 * @param length: length of the base64 string 2945 * @return: 0 on error, 1 otherwise. query will be stored in h2_stream->qbuffer, 2946 * buffer will be NULL is unparseble. 2947 */ 2948 static int http2_buffer_uri_query(struct http2_session* h2_session, 2949 struct http2_stream* h2_stream, const uint8_t* start, size_t length) 2950 { 2951 size_t expectb64len; 2952 int b64len; 2953 if(h2_stream->http_method == HTTP_METHOD_POST) 2954 return 1; 2955 if(length == 0) 2956 return 1; 2957 if(h2_stream->qbuffer) { 2958 verbose(VERB_ALGO, "http2_req_header fail, " 2959 "qbuffer already set"); 2960 return 0; 2961 } 2962 2963 /* calculate size, might be a bit bigger than the real 2964 * decoded buffer size */ 2965 expectb64len = sldns_b64_pton_calculate_size(length); 2966 log_assert(expectb64len > 0); 2967 if(expectb64len > 2968 h2_session->c->http2_stream_max_qbuffer_size) { 2969 h2_stream->query_too_large = 1; 2970 return 1; 2971 } 2972 2973 lock_basic_lock(&http2_query_buffer_count_lock); 2974 if(http2_query_buffer_count + expectb64len > http2_query_buffer_max) { 2975 lock_basic_unlock(&http2_query_buffer_count_lock); 2976 verbose(VERB_ALGO, "reset HTTP2 stream, no space left, " 2977 "in http2-query-buffer-size"); 2978 return http2_submit_rst_stream(h2_session, h2_stream); 2979 } 2980 http2_query_buffer_count += expectb64len; 2981 lock_basic_unlock(&http2_query_buffer_count_lock); 2982 if(!(h2_stream->qbuffer = sldns_buffer_new(expectb64len))) { 2983 lock_basic_lock(&http2_query_buffer_count_lock); 2984 http2_query_buffer_count -= expectb64len; 2985 lock_basic_unlock(&http2_query_buffer_count_lock); 2986 log_err("http2_req_header fail, qbuffer " 2987 "malloc failure"); 2988 return 0; 2989 } 2990 2991 if(sldns_b64_contains_nonurl((char const*)start, length)) { 2992 char buf[65536+4]; 2993 verbose(VERB_ALGO, "HTTP2 stream contains wrong b64 encoding"); 2994 /* copy to the scratch buffer temporarily to terminate the 2995 * string with a zero */ 2996 if(length+1 > sizeof(buf)) { 2997 /* too long */ 2998 lock_basic_lock(&http2_query_buffer_count_lock); 2999 http2_query_buffer_count -= expectb64len; 3000 lock_basic_unlock(&http2_query_buffer_count_lock); 3001 sldns_buffer_free(h2_stream->qbuffer); 3002 h2_stream->qbuffer = NULL; 3003 return 1; 3004 } 3005 memmove(buf, start, length); 3006 buf[length] = 0; 3007 if(!(b64len = sldns_b64_pton(buf, sldns_buffer_current( 3008 h2_stream->qbuffer), expectb64len)) || b64len < 0) { 3009 lock_basic_lock(&http2_query_buffer_count_lock); 3010 http2_query_buffer_count -= expectb64len; 3011 lock_basic_unlock(&http2_query_buffer_count_lock); 3012 sldns_buffer_free(h2_stream->qbuffer); 3013 h2_stream->qbuffer = NULL; 3014 return 1; 3015 } 3016 } else { 3017 if(!(b64len = sldns_b64url_pton( 3018 (char const *)start, length, 3019 sldns_buffer_current(h2_stream->qbuffer), 3020 expectb64len)) || b64len < 0) { 3021 lock_basic_lock(&http2_query_buffer_count_lock); 3022 http2_query_buffer_count -= expectb64len; 3023 lock_basic_unlock(&http2_query_buffer_count_lock); 3024 sldns_buffer_free(h2_stream->qbuffer); 3025 h2_stream->qbuffer = NULL; 3026 /* return without error, method can be an 3027 * unknown POST */ 3028 return 1; 3029 } 3030 } 3031 sldns_buffer_skip(h2_stream->qbuffer, (size_t)b64len); 3032 return 1; 3033 } 3034 3035 /** nghttp2 callback. Used to parse headers from HEADER frames. */ 3036 static int http2_req_header_cb(nghttp2_session* session, 3037 const nghttp2_frame* frame, const uint8_t* name, size_t namelen, 3038 const uint8_t* value, size_t valuelen, uint8_t ATTR_UNUSED(flags), 3039 void* cb_arg) 3040 { 3041 struct http2_stream* h2_stream = NULL; 3042 struct http2_session* h2_session = (struct http2_session*)cb_arg; 3043 /* nghttp2 deals with CONTINUATION frames and provides them as part of 3044 * the HEADER */ 3045 if(frame->hd.type != NGHTTP2_HEADERS || 3046 frame->headers.cat != NGHTTP2_HCAT_REQUEST) { 3047 /* only interested in request headers */ 3048 return 0; 3049 } 3050 if(!(h2_stream = nghttp2_session_get_stream_user_data(session, 3051 frame->hd.stream_id))) 3052 return 0; 3053 3054 /* earlier checks already indicate we can stop handling this query */ 3055 if(h2_stream->http_method == HTTP_METHOD_UNSUPPORTED || 3056 h2_stream->invalid_content_type || 3057 h2_stream->invalid_endpoint) 3058 return 0; 3059 3060 3061 /* nghttp2 performs some sanity checks in the headers, including: 3062 * name and value are guaranteed to be null terminated 3063 * name is guaranteed to be lowercase 3064 * content-length value is guaranteed to contain digits 3065 */ 3066 3067 if(!h2_stream->http_method && namelen == 7 && 3068 memcmp(":method", name, namelen) == 0) { 3069 /* Case insensitive check on :method value to be on the safe 3070 * side. I failed to find text about case sensitivity in specs. 3071 */ 3072 if(valuelen == 3 && strcasecmp("GET", (const char*)value) == 0) 3073 h2_stream->http_method = HTTP_METHOD_GET; 3074 else if(valuelen == 4 && 3075 strcasecmp("POST", (const char*)value) == 0) { 3076 h2_stream->http_method = HTTP_METHOD_POST; 3077 if(h2_stream->qbuffer) { 3078 /* POST method uses query from DATA frames */ 3079 lock_basic_lock(&http2_query_buffer_count_lock); 3080 http2_query_buffer_count -= 3081 sldns_buffer_capacity(h2_stream->qbuffer); 3082 lock_basic_unlock(&http2_query_buffer_count_lock); 3083 sldns_buffer_free(h2_stream->qbuffer); 3084 h2_stream->qbuffer = NULL; 3085 } 3086 } else 3087 h2_stream->http_method = HTTP_METHOD_UNSUPPORTED; 3088 return 0; 3089 } 3090 if(namelen == 5 && memcmp(":path", name, namelen) == 0) { 3091 /* :path may contain DNS query, depending on method. Method might 3092 * not be known yet here, so check after finishing receiving 3093 * stream. */ 3094 #define HTTP_QUERY_PARAM "?dns=" 3095 size_t el = strlen(h2_session->c->http_endpoint); 3096 size_t qpl = strlen(HTTP_QUERY_PARAM); 3097 3098 if(valuelen < el || memcmp(h2_session->c->http_endpoint, 3099 value, el) != 0) { 3100 h2_stream->invalid_endpoint = 1; 3101 return 0; 3102 } 3103 /* larger than endpoint only allowed if it is for the query 3104 * parameter */ 3105 if(valuelen <= el+qpl || 3106 memcmp(HTTP_QUERY_PARAM, value+el, qpl) != 0) { 3107 if(valuelen != el) 3108 h2_stream->invalid_endpoint = 1; 3109 return 0; 3110 } 3111 3112 if(!http2_buffer_uri_query(h2_session, h2_stream, 3113 value+(el+qpl), valuelen-(el+qpl))) { 3114 return NGHTTP2_ERR_CALLBACK_FAILURE; 3115 } 3116 return 0; 3117 } 3118 /* Content type is a SHOULD (rfc7231#section-3.1.1.5) when using POST, 3119 * and not needed when using GET. Don't enforce. 3120 * If set only allow lowercase "application/dns-message". 3121 * 3122 * Clients SHOULD (rfc8484#section-4.1) set an accept header, but MUST 3123 * be able to handle "application/dns-message". Since that is the only 3124 * content-type supported we can ignore the accept header. 3125 */ 3126 if((namelen == 12 && memcmp("content-type", name, namelen) == 0)) { 3127 if(valuelen != 23 || memcmp("application/dns-message", value, 3128 valuelen) != 0) { 3129 h2_stream->invalid_content_type = 1; 3130 } 3131 } 3132 3133 /* Only interested in content-lentg for POST (on not yet known) method. 3134 */ 3135 if((!h2_stream->http_method || 3136 h2_stream->http_method == HTTP_METHOD_POST) && 3137 !h2_stream->content_length && namelen == 14 && 3138 memcmp("content-length", name, namelen) == 0) { 3139 if(valuelen > 5) { 3140 h2_stream->query_too_large = 1; 3141 return 0; 3142 } 3143 /* guaranteed to only contain digits and be null terminated */ 3144 h2_stream->content_length = atoi((const char*)value); 3145 if(h2_stream->content_length > 3146 h2_session->c->http2_stream_max_qbuffer_size) { 3147 h2_stream->query_too_large = 1; 3148 return 0; 3149 } 3150 } 3151 return 0; 3152 } 3153 3154 /** nghttp2 callback. Used to get data from DATA frames, which can contain 3155 * queries in POST requests. */ 3156 static int http2_req_data_chunk_recv_cb(nghttp2_session* ATTR_UNUSED(session), 3157 uint8_t ATTR_UNUSED(flags), int32_t stream_id, const uint8_t* data, 3158 size_t len, void* cb_arg) 3159 { 3160 struct http2_session* h2_session = (struct http2_session*)cb_arg; 3161 struct http2_stream* h2_stream; 3162 size_t qlen = 0; 3163 3164 if(!(h2_stream = nghttp2_session_get_stream_user_data( 3165 h2_session->session, stream_id))) { 3166 return 0; 3167 } 3168 3169 if(h2_stream->query_too_large) 3170 return 0; 3171 3172 if(!h2_stream->qbuffer) { 3173 if(h2_stream->content_length) { 3174 if(h2_stream->content_length < len) 3175 /* getting more data in DATA frame than 3176 * advertised in content-length header. */ 3177 return NGHTTP2_ERR_CALLBACK_FAILURE; 3178 qlen = h2_stream->content_length; 3179 } else if(len <= h2_session->c->http2_stream_max_qbuffer_size) { 3180 /* setting this to msg-buffer-size can result in a lot 3181 * of memory consumption. Most queries should fit in a 3182 * single DATA frame, and most POST queries will 3183 * contain content-length which does not impose this 3184 * limit. */ 3185 qlen = len; 3186 } 3187 } 3188 if(!h2_stream->qbuffer && qlen) { 3189 lock_basic_lock(&http2_query_buffer_count_lock); 3190 if(http2_query_buffer_count + qlen > http2_query_buffer_max) { 3191 lock_basic_unlock(&http2_query_buffer_count_lock); 3192 verbose(VERB_ALGO, "reset HTTP2 stream, no space left, " 3193 "in http2-query-buffer-size"); 3194 return http2_submit_rst_stream(h2_session, h2_stream); 3195 } 3196 http2_query_buffer_count += qlen; 3197 lock_basic_unlock(&http2_query_buffer_count_lock); 3198 if(!(h2_stream->qbuffer = sldns_buffer_new(qlen))) { 3199 lock_basic_lock(&http2_query_buffer_count_lock); 3200 http2_query_buffer_count -= qlen; 3201 lock_basic_unlock(&http2_query_buffer_count_lock); 3202 } 3203 } 3204 3205 if(!h2_stream->qbuffer || 3206 sldns_buffer_remaining(h2_stream->qbuffer) < len) { 3207 verbose(VERB_ALGO, "http2 data_chunk_recv failed. Not enough " 3208 "buffer space for POST query. Can happen on multi " 3209 "frame requests without content-length header"); 3210 h2_stream->query_too_large = 1; 3211 return 0; 3212 } 3213 3214 sldns_buffer_write(h2_stream->qbuffer, data, len); 3215 3216 return 0; 3217 } 3218 3219 void http2_req_stream_clear(struct http2_stream* h2_stream) 3220 { 3221 if(h2_stream->qbuffer) { 3222 lock_basic_lock(&http2_query_buffer_count_lock); 3223 http2_query_buffer_count -= 3224 sldns_buffer_capacity(h2_stream->qbuffer); 3225 lock_basic_unlock(&http2_query_buffer_count_lock); 3226 sldns_buffer_free(h2_stream->qbuffer); 3227 h2_stream->qbuffer = NULL; 3228 } 3229 if(h2_stream->rbuffer) { 3230 lock_basic_lock(&http2_response_buffer_count_lock); 3231 http2_response_buffer_count -= 3232 sldns_buffer_capacity(h2_stream->rbuffer); 3233 lock_basic_unlock(&http2_response_buffer_count_lock); 3234 sldns_buffer_free(h2_stream->rbuffer); 3235 h2_stream->rbuffer = NULL; 3236 } 3237 } 3238 3239 nghttp2_session_callbacks* http2_req_callbacks_create(void) 3240 { 3241 nghttp2_session_callbacks *callbacks; 3242 if(nghttp2_session_callbacks_new(&callbacks) == NGHTTP2_ERR_NOMEM) { 3243 log_err("failed to initialize nghttp2 callback"); 3244 return NULL; 3245 } 3246 /* reception of header block started, used to create h2_stream */ 3247 nghttp2_session_callbacks_set_on_begin_headers_callback(callbacks, 3248 http2_req_begin_headers_cb); 3249 /* complete frame received, used to get data from stream if frame 3250 * has end stream flag, and start processing query */ 3251 nghttp2_session_callbacks_set_on_frame_recv_callback(callbacks, 3252 http2_req_frame_recv_cb); 3253 /* get request info from headers */ 3254 nghttp2_session_callbacks_set_on_header_callback(callbacks, 3255 http2_req_header_cb); 3256 /* get data from DATA frames, containing POST query */ 3257 nghttp2_session_callbacks_set_on_data_chunk_recv_callback(callbacks, 3258 http2_req_data_chunk_recv_cb); 3259 3260 /* generic HTTP2 callbacks */ 3261 nghttp2_session_callbacks_set_recv_callback(callbacks, http2_recv_cb); 3262 nghttp2_session_callbacks_set_send_callback(callbacks, http2_send_cb); 3263 nghttp2_session_callbacks_set_on_stream_close_callback(callbacks, 3264 http2_stream_close_cb); 3265 3266 return callbacks; 3267 } 3268 #endif /* HAVE_NGHTTP2 */ 3269 3270 #ifdef HAVE_NGTCP2 3271 struct doq_table* 3272 doq_table_create(struct config_file* cfg, struct ub_randstate* rnd) 3273 { 3274 struct doq_table* table; 3275 3276 if (!cfg->quic_port) 3277 return NULL; 3278 table = calloc(1, sizeof(*table)); 3279 if(!table) 3280 return NULL; 3281 #ifdef USE_NGTCP2_CRYPTO_OSSL 3282 /* Initialize the ossl crypto, it is harmless to call twice, 3283 * and this is before use of doq connections. */ 3284 if(ngtcp2_crypto_ossl_init() != 0) { 3285 log_err("ngtcp2_crypto_ossl_init failed"); 3286 free(table); 3287 return NULL; 3288 } 3289 #elif defined(HAVE_NGTCP2_CRYPTO_QUICTLS_INIT) 3290 if(ngtcp2_crypto_quictls_init() != 0) { 3291 log_err("ngtcp2_crypto_quictls_init failed"); 3292 free(table); 3293 return NULL; 3294 } 3295 #endif 3296 table->idle_timeout = ((uint64_t)cfg->tcp_idle_timeout)* 3297 NGTCP2_MILLISECONDS; 3298 table->sv_scidlen = 16; 3299 table->static_secret_len = 16; 3300 table->static_secret = malloc(table->static_secret_len); 3301 if(!table->static_secret) { 3302 free(table); 3303 return NULL; 3304 } 3305 doq_fill_rand(rnd, table->static_secret, table->static_secret_len); 3306 table->conn_tree = rbtree_create(doq_conn_cmp); 3307 if(!table->conn_tree) { 3308 free(table->static_secret); 3309 free(table); 3310 return NULL; 3311 } 3312 table->conid_tree = rbtree_create(doq_conid_cmp); 3313 if(!table->conid_tree) { 3314 free(table->static_secret); 3315 free(table->conn_tree); 3316 free(table); 3317 return NULL; 3318 } 3319 table->timer_tree = rbtree_create(doq_timer_cmp); 3320 if(!table->timer_tree) { 3321 free(table->static_secret); 3322 free(table->conn_tree); 3323 free(table->conid_tree); 3324 free(table); 3325 return NULL; 3326 } 3327 lock_rw_init(&table->lock); 3328 lock_rw_init(&table->conid_lock); 3329 lock_basic_init(&table->size_lock); 3330 lock_protect(&table->lock, &table->static_secret, 3331 sizeof(table->static_secret)); 3332 lock_protect(&table->lock, &table->static_secret_len, 3333 sizeof(table->static_secret_len)); 3334 lock_protect(&table->lock, table->static_secret, 3335 table->static_secret_len); 3336 lock_protect(&table->lock, &table->sv_scidlen, 3337 sizeof(table->sv_scidlen)); 3338 lock_protect(&table->lock, &table->idle_timeout, 3339 sizeof(table->idle_timeout)); 3340 lock_protect(&table->lock, &table->conn_tree, sizeof(table->conn_tree)); 3341 lock_protect(&table->lock, table->conn_tree, sizeof(*table->conn_tree)); 3342 lock_protect(&table->conid_lock, table->conid_tree, 3343 sizeof(*table->conid_tree)); 3344 lock_protect(&table->lock, table->timer_tree, 3345 sizeof(*table->timer_tree)); 3346 lock_protect(&table->size_lock, &table->current_size, 3347 sizeof(table->current_size)); 3348 return table; 3349 } 3350 3351 /** delete elements from the connection tree */ 3352 static void 3353 conn_tree_del(rbnode_type* node, void* arg) 3354 { 3355 struct doq_table* table = (struct doq_table*)arg; 3356 struct doq_conn* conn; 3357 if(!node || !table) 3358 return; 3359 conn = (struct doq_conn*)node->key; 3360 if(conn->timer.timer_in_list) { 3361 /* Remove timer from list first, because finding the rbnode 3362 * element of the setlist of same timeouts needs tree lookup. 3363 * Edit the tree structure after that lookup. */ 3364 doq_timer_list_remove(conn->table, &conn->timer); 3365 } 3366 if(conn->timer.timer_in_tree) 3367 doq_timer_tree_remove(conn->table, &conn->timer); 3368 doq_table_quic_size_subtract(table, sizeof(*conn)+conn->key.dcidlen); 3369 doq_conn_delete(conn, table); 3370 } 3371 3372 /** delete elements from the connection id tree */ 3373 static void 3374 conid_tree_del(rbnode_type* node, void* ATTR_UNUSED(arg)) 3375 { 3376 if(!node) 3377 return; 3378 doq_conid_delete((struct doq_conid*)node->key); 3379 } 3380 3381 void 3382 doq_table_delete(struct doq_table* table) 3383 { 3384 if(!table) 3385 return; 3386 lock_rw_destroy(&table->lock); 3387 free(table->static_secret); 3388 if(table->conn_tree) { 3389 traverse_postorder(table->conn_tree, conn_tree_del, table); 3390 free(table->conn_tree); 3391 } 3392 lock_rw_destroy(&table->conid_lock); 3393 if(table->conid_tree) { 3394 /* The tree should be empty, because the doq_conn_delete calls 3395 * above should have also removed their conid elements. */ 3396 traverse_postorder(table->conid_tree, conid_tree_del, NULL); 3397 free(table->conid_tree); 3398 } 3399 lock_basic_destroy(&table->size_lock); 3400 if(table->timer_tree) { 3401 /* The tree should be empty, because the conn_tree_del calls 3402 * above should also have removed them. Also the doq_timer 3403 * is part of the doq_conn struct, so is already freed. */ 3404 free(table->timer_tree); 3405 } 3406 table->write_list_first = NULL; 3407 table->write_list_last = NULL; 3408 free(table); 3409 } 3410 3411 struct doq_timer* 3412 doq_timer_find_time(struct doq_table* table, ngtcp2_tstamp ts) 3413 { 3414 struct doq_timer key; 3415 struct rbnode_type* node; 3416 log_assert(table != NULL); 3417 memset(&key, 0, sizeof(key)); 3418 key.time_mono = ts; 3419 node = rbtree_search(table->timer_tree, &key); 3420 if(node) 3421 return (struct doq_timer*)node->key; 3422 return NULL; 3423 } 3424 3425 void 3426 doq_timer_tree_remove(struct doq_table* table, struct doq_timer* timer) 3427 { 3428 if(!timer->timer_in_tree) 3429 return; 3430 rbtree_delete(table->timer_tree, timer); 3431 timer->timer_in_tree = 0; 3432 /* This item could have more timers in the same set. */ 3433 if(timer->setlist_first) { 3434 struct doq_timer* rb_timer = timer->setlist_first; 3435 /* del first element from setlist */ 3436 if(rb_timer->setlist_next) 3437 rb_timer->setlist_next->setlist_prev = NULL; 3438 else 3439 timer->setlist_last = NULL; 3440 timer->setlist_first = rb_timer->setlist_next; 3441 rb_timer->setlist_prev = NULL; 3442 rb_timer->setlist_next = NULL; 3443 rb_timer->timer_in_list = 0; 3444 /* insert it into the tree as new rb element */ 3445 memset(&rb_timer->node, 0, sizeof(rb_timer->node)); 3446 rb_timer->node.key = rb_timer; 3447 rbtree_insert(table->timer_tree, &rb_timer->node); 3448 rb_timer->timer_in_tree = 1; 3449 /* the setlist, if any remainder, moves to the rb element */ 3450 rb_timer->setlist_first = timer->setlist_first; 3451 rb_timer->setlist_last = timer->setlist_last; 3452 timer->setlist_first = NULL; 3453 timer->setlist_last = NULL; 3454 rb_timer->worker_doq_socket = timer->worker_doq_socket; 3455 } 3456 timer->worker_doq_socket = NULL; 3457 } 3458 3459 void 3460 doq_timer_list_remove(struct doq_table* table, struct doq_timer* timer) 3461 { 3462 struct doq_timer* rb_timer; 3463 if(!timer->timer_in_list) 3464 return; 3465 /* The item in the rbtree has the list start and end. */ 3466 rb_timer = doq_timer_find_time(table, timer->time_mono); 3467 if(rb_timer) { 3468 if(timer->setlist_prev) 3469 timer->setlist_prev->setlist_next = timer->setlist_next; 3470 else 3471 rb_timer->setlist_first = timer->setlist_next; 3472 if(timer->setlist_next) 3473 timer->setlist_next->setlist_prev = timer->setlist_prev; 3474 else 3475 rb_timer->setlist_last = timer->setlist_prev; 3476 timer->setlist_prev = NULL; 3477 timer->setlist_next = NULL; 3478 } 3479 timer->timer_in_list = 0; 3480 } 3481 3482 /** doq append timer to setlist */ 3483 static void 3484 doq_timer_list_append(struct doq_timer* rb_timer, struct doq_timer* timer) 3485 { 3486 log_assert(timer->timer_in_list == 0); 3487 timer->timer_in_list = 1; 3488 timer->setlist_next = NULL; 3489 timer->setlist_prev = rb_timer->setlist_last; 3490 if(rb_timer->setlist_last) 3491 rb_timer->setlist_last->setlist_next = timer; 3492 else 3493 rb_timer->setlist_first = timer; 3494 rb_timer->setlist_last = timer; 3495 } 3496 3497 void 3498 doq_timer_unset(struct doq_table* table, struct doq_timer* timer) 3499 { 3500 if(timer->timer_in_list) { 3501 /* Remove timer from list first, because finding the rbnode 3502 * element of the setlist of same timeouts needs tree lookup. 3503 * Edit the tree structure after that lookup. */ 3504 doq_timer_list_remove(table, timer); 3505 } 3506 if(timer->timer_in_tree) 3507 doq_timer_tree_remove(table, timer); 3508 timer->worker_doq_socket = NULL; 3509 } 3510 3511 void doq_timer_set(struct doq_table* table, struct doq_timer* timer, 3512 struct doq_server_socket* worker_doq_socket, struct timeval* tv, 3513 ngtcp2_tstamp ts) 3514 { 3515 struct doq_timer* rb_timer; 3516 if(verbosity >= VERB_ALGO && timer->conn) { 3517 char a[256]; 3518 struct timeval rel; 3519 addr_to_str((void*)&timer->conn->key.paddr.addr, 3520 timer->conn->key.paddr.addrlen, a, sizeof(a)); 3521 timeval_subtract(&rel, tv, worker_doq_socket->now_tv); 3522 verbose(VERB_ALGO, "doq %s timer set %d.%6.6d in %d.%6.6d", 3523 a, (int)tv->tv_sec, (int)tv->tv_usec, 3524 (int)rel.tv_sec, (int)rel.tv_usec); 3525 } 3526 if(timer->timer_in_tree || timer->timer_in_list) { 3527 if(timer->time_mono == ts) 3528 return; /* already set on that time */ 3529 doq_timer_unset(table, timer); 3530 } 3531 timer->time_real.tv_sec = tv->tv_sec; 3532 timer->time_real.tv_usec = tv->tv_usec; 3533 timer->time_mono = ts; 3534 rb_timer = doq_timer_find_time(table, ts); 3535 if(rb_timer) { 3536 /* There is a timeout already with this value. Timer is 3537 * added to the setlist. */ 3538 doq_timer_list_append(rb_timer, timer); 3539 } else { 3540 /* There is no timeout with this value. Make timer a new 3541 * tree element. */ 3542 memset(&timer->node, 0, sizeof(timer->node)); 3543 timer->node.key = timer; 3544 rbtree_insert(table->timer_tree, &timer->node); 3545 timer->timer_in_tree = 1; 3546 timer->setlist_first = NULL; 3547 timer->setlist_last = NULL; 3548 timer->worker_doq_socket = worker_doq_socket; 3549 } 3550 } 3551 3552 struct doq_conn* 3553 doq_conn_create(struct comm_point* c, struct doq_pkt_addr* paddr, 3554 const uint8_t* dcid, size_t dcidlen, uint32_t version) 3555 { 3556 struct doq_conn* conn = calloc(1, sizeof(*conn)); 3557 if(!conn) 3558 return NULL; 3559 conn->node.key = conn; 3560 conn->doq_socket = c->doq_socket; 3561 conn->table = c->doq_socket->table; 3562 memmove(&conn->key.paddr.addr, &paddr->addr, paddr->addrlen); 3563 conn->key.paddr.addrlen = paddr->addrlen; 3564 memmove(&conn->key.paddr.localaddr, &paddr->localaddr, 3565 paddr->localaddrlen); 3566 conn->key.paddr.localaddrlen = paddr->localaddrlen; 3567 conn->key.paddr.ifindex = paddr->ifindex; 3568 conn->key.dcid = memdup((void*)dcid, dcidlen); 3569 if(!conn->key.dcid) { 3570 free(conn); 3571 return NULL; 3572 } 3573 conn->key.dcidlen = dcidlen; 3574 conn->version = version; 3575 #ifdef HAVE_NGTCP2_CCERR_DEFAULT 3576 ngtcp2_ccerr_default(&conn->ccerr); 3577 #else 3578 ngtcp2_connection_close_error_default(&conn->last_error); 3579 #endif 3580 rbtree_init(&conn->stream_tree, &doq_stream_cmp); 3581 conn->timer.conn = conn; 3582 lock_basic_init(&conn->lock); 3583 lock_protect(&conn->lock, &conn->key, sizeof(conn->key)); 3584 lock_protect(&conn->lock, &conn->doq_socket, sizeof(conn->doq_socket)); 3585 lock_protect(&conn->lock, &conn->table, sizeof(conn->table)); 3586 lock_protect(&conn->lock, &conn->is_deleted, sizeof(conn->is_deleted)); 3587 lock_protect(&conn->lock, &conn->version, sizeof(conn->version)); 3588 lock_protect(&conn->lock, &conn->conn, sizeof(conn->conn)); 3589 lock_protect(&conn->lock, &conn->conid_list, sizeof(conn->conid_list)); 3590 #ifdef HAVE_NGTCP2_CCERR_DEFAULT 3591 lock_protect(&conn->lock, &conn->ccerr, sizeof(conn->ccerr)); 3592 #else 3593 lock_protect(&conn->lock, &conn->last_error, sizeof(conn->last_error)); 3594 #endif 3595 lock_protect(&conn->lock, &conn->tls_alert, sizeof(conn->tls_alert)); 3596 lock_protect(&conn->lock, &conn->ssl, sizeof(conn->ssl)); 3597 lock_protect(&conn->lock, &conn->close_pkt, sizeof(conn->close_pkt)); 3598 lock_protect(&conn->lock, &conn->close_pkt_len, sizeof(conn->close_pkt_len)); 3599 lock_protect(&conn->lock, &conn->close_ecn, sizeof(conn->close_ecn)); 3600 lock_protect(&conn->lock, &conn->stream_tree, sizeof(conn->stream_tree)); 3601 lock_protect(&conn->lock, &conn->stream_write_first, sizeof(conn->stream_write_first)); 3602 lock_protect(&conn->lock, &conn->stream_write_last, sizeof(conn->stream_write_last)); 3603 lock_protect(&conn->lock, &conn->write_interest, sizeof(conn->write_interest)); 3604 lock_protect(&conn->lock, &conn->on_write_list, sizeof(conn->on_write_list)); 3605 lock_protect(&conn->lock, &conn->write_prev, sizeof(conn->write_prev)); 3606 lock_protect(&conn->lock, &conn->write_next, sizeof(conn->write_next)); 3607 return conn; 3608 } 3609 3610 /** The arguments for doq stream tree del. */ 3611 struct doq_stream_tree_del_args { 3612 /** The doq table. */ 3613 struct doq_table* table; 3614 /** The doq connection for the stream. */ 3615 struct doq_conn* conn; 3616 }; 3617 3618 /** delete stream tree node */ 3619 static void 3620 stream_tree_del(rbnode_type* node, void* arg) 3621 { 3622 struct doq_stream_tree_del_args* args = (struct doq_stream_tree_del_args*)arg; 3623 struct doq_table* table = args->table; 3624 struct doq_stream* stream; 3625 if(!node) 3626 return; 3627 stream = (struct doq_stream*)node; 3628 if(stream->mesh_state) { 3629 mesh_state_remove_reply(stream->mesh, stream->mesh_state, 3630 args->conn->doq_socket->cp, NULL, stream); 3631 stream->mesh_state = NULL; 3632 } 3633 if(stream->in) 3634 doq_table_quic_size_subtract(table, stream->inlen); 3635 if(stream->out) 3636 doq_table_quic_size_subtract(table, stream->outlen); 3637 doq_table_quic_size_subtract(table, sizeof(*stream)); 3638 doq_stream_delete(stream); 3639 } 3640 3641 void 3642 doq_conn_delete(struct doq_conn* conn, struct doq_table* table) 3643 { 3644 if(!conn) 3645 return; 3646 lock_basic_destroy(&conn->lock); 3647 lock_rw_wrlock(&conn->table->conid_lock); 3648 doq_conn_clear_conids(conn); 3649 lock_rw_unlock(&conn->table->conid_lock); 3650 /* Remove the app data from ngtcp2 before SSL_free of conn->ssl, 3651 * because the ngtcp2 conn is deleted. */ 3652 if(conn->ssl) 3653 SSL_set_app_data(conn->ssl, NULL); 3654 if(conn->stream_tree.count != 0) { 3655 struct doq_stream_tree_del_args args; 3656 memset(&args, 0, sizeof(args)); 3657 args.table = table; 3658 args.conn = conn; 3659 traverse_postorder(&conn->stream_tree, stream_tree_del, &args); 3660 } 3661 free(conn->key.dcid); 3662 SSL_free(conn->ssl); 3663 #ifdef USE_NGTCP2_CRYPTO_OSSL 3664 ngtcp2_crypto_ossl_ctx_del(conn->ossl_ctx); 3665 #endif 3666 ngtcp2_conn_del(conn->conn); 3667 free(conn->close_pkt); 3668 free(conn); 3669 } 3670 3671 int 3672 doq_conn_cmp(const void* key1, const void* key2) 3673 { 3674 struct doq_conn* c = (struct doq_conn*)key1; 3675 struct doq_conn* d = (struct doq_conn*)key2; 3676 int r; 3677 /* Compared in the order destination address, then 3678 * local address, ifindex and then dcid. 3679 * So that for a search for findlessorequal for the destination 3680 * address will find connections to that address, with different 3681 * dcids. 3682 * Also a printout in sorted order prints the connections by IP 3683 * address of destination, and then a number of them depending on the 3684 * dcids. */ 3685 if(c->key.paddr.addrlen != d->key.paddr.addrlen) { 3686 if(c->key.paddr.addrlen < d->key.paddr.addrlen) 3687 return -1; 3688 return 1; 3689 } 3690 if((r=memcmp(&c->key.paddr.addr, &d->key.paddr.addr, 3691 c->key.paddr.addrlen))!=0) 3692 return r; 3693 if(c->key.paddr.localaddrlen != d->key.paddr.localaddrlen) { 3694 if(c->key.paddr.localaddrlen < d->key.paddr.localaddrlen) 3695 return -1; 3696 return 1; 3697 } 3698 if((r=memcmp(&c->key.paddr.localaddr, &d->key.paddr.localaddr, 3699 c->key.paddr.localaddrlen))!=0) 3700 return r; 3701 if(c->key.paddr.ifindex != d->key.paddr.ifindex) { 3702 if(c->key.paddr.ifindex < d->key.paddr.ifindex) 3703 return -1; 3704 return 1; 3705 } 3706 if(c->key.dcidlen != d->key.dcidlen) { 3707 if(c->key.dcidlen < d->key.dcidlen) 3708 return -1; 3709 return 1; 3710 } 3711 if((r=memcmp(c->key.dcid, d->key.dcid, c->key.dcidlen))!=0) 3712 return r; 3713 return 0; 3714 } 3715 3716 int doq_conid_cmp(const void* key1, const void* key2) 3717 { 3718 struct doq_conid* c = (struct doq_conid*)key1; 3719 struct doq_conid* d = (struct doq_conid*)key2; 3720 if(c->cidlen != d->cidlen) { 3721 if(c->cidlen < d->cidlen) 3722 return -1; 3723 return 1; 3724 } 3725 return memcmp(c->cid, d->cid, c->cidlen); 3726 } 3727 3728 int doq_timer_cmp(const void* key1, const void* key2) 3729 { 3730 struct doq_timer* e = (struct doq_timer*)key1; 3731 struct doq_timer* f = (struct doq_timer*)key2; 3732 if(e->time_mono < f->time_mono) 3733 return -1; 3734 if(e->time_mono > f->time_mono) 3735 return 1; 3736 return 0; 3737 } 3738 3739 int doq_stream_cmp(const void* key1, const void* key2) 3740 { 3741 struct doq_stream* c = (struct doq_stream*)key1; 3742 struct doq_stream* d = (struct doq_stream*)key2; 3743 if(c->stream_id != d->stream_id) { 3744 if(c->stream_id < d->stream_id) 3745 return -1; 3746 return 1; 3747 } 3748 return 0; 3749 } 3750 3751 /** doq store a local address in repinfo */ 3752 static void 3753 doq_repinfo_store_localaddr(struct comm_reply* repinfo, 3754 struct doq_addr_storage* localaddr, socklen_t localaddrlen) 3755 { 3756 /* use the pktinfo that we have for ancillary udp data otherwise, 3757 * this saves space for a sockaddr */ 3758 memset(&repinfo->pktinfo, 0, sizeof(repinfo->pktinfo)); 3759 if(addr_is_ip6((void*)localaddr, localaddrlen)) { 3760 #ifdef IPV6_PKTINFO 3761 struct sockaddr_in6* sa6 = (struct sockaddr_in6*)localaddr; 3762 memmove(&repinfo->pktinfo.v6info.ipi6_addr, 3763 &sa6->sin6_addr, sizeof(struct in6_addr)); 3764 repinfo->doq_srcport = sa6->sin6_port; 3765 #endif 3766 repinfo->srctype = 6; 3767 } else { 3768 #ifdef IP_PKTINFO 3769 struct sockaddr_in* sa = (struct sockaddr_in*)localaddr; 3770 memmove(&repinfo->pktinfo.v4info.ipi_addr, 3771 &sa->sin_addr, sizeof(struct in_addr)); 3772 repinfo->doq_srcport = sa->sin_port; 3773 #elif defined(IP_RECVDSTADDR) 3774 struct sockaddr_in* sa = (struct sockaddr_in*)localaddr; 3775 memmove(&repinfo->pktinfo.v4addr, &sa->sin_addr, 3776 sizeof(struct in_addr)); 3777 repinfo->doq_srcport = sa->sin_port; 3778 #endif 3779 repinfo->srctype = 4; 3780 } 3781 } 3782 3783 /** doq retrieve localaddr from repinfo */ 3784 static void 3785 doq_repinfo_retrieve_localaddr(struct comm_reply* repinfo, 3786 struct doq_addr_storage* localaddr, socklen_t* localaddrlen) 3787 { 3788 if(repinfo->srctype == 6) { 3789 #ifdef IPV6_PKTINFO 3790 struct sockaddr_in6* sa6 = (struct sockaddr_in6*)localaddr; 3791 *localaddrlen = (socklen_t)sizeof(struct sockaddr_in6); 3792 memset(sa6, 0, *localaddrlen); 3793 sa6->sin6_family = AF_INET6; 3794 memmove(&sa6->sin6_addr, &repinfo->pktinfo.v6info.ipi6_addr, 3795 sizeof(struct in6_addr)); 3796 sa6->sin6_port = repinfo->doq_srcport; 3797 #endif 3798 } else { 3799 #ifdef IP_PKTINFO 3800 struct sockaddr_in* sa = (struct sockaddr_in*)localaddr; 3801 *localaddrlen = (socklen_t)sizeof(struct sockaddr_in); 3802 memset(sa, 0, *localaddrlen); 3803 sa->sin_family = AF_INET; 3804 memmove(&sa->sin_addr, &repinfo->pktinfo.v4info.ipi_addr, 3805 sizeof(struct in_addr)); 3806 sa->sin_port = repinfo->doq_srcport; 3807 #elif defined(IP_RECVDSTADDR) 3808 struct sockaddr_in* sa = (struct sockaddr_in*)localaddr; 3809 *localaddrlen = (socklen_t)sizeof(struct sockaddr_in); 3810 memset(sa, 0, *localaddrlen); 3811 sa->sin_family = AF_INET; 3812 memmove(&sa->sin_addr, &repinfo->pktinfo.v4addr, 3813 sizeof(struct in_addr)); 3814 sa->sin_port = repinfo->doq_srcport; 3815 #endif 3816 } 3817 } 3818 3819 /** doq write a connection key into repinfo, false if it does not fit */ 3820 static int 3821 doq_conn_key_store_repinfo(struct doq_conn_key* key, 3822 struct comm_reply* repinfo) 3823 { 3824 repinfo->is_proxied = 0; 3825 repinfo->doq_ifindex = key->paddr.ifindex; 3826 repinfo->remote_addrlen = key->paddr.addrlen; 3827 memmove(&repinfo->remote_addr, &key->paddr.addr, 3828 repinfo->remote_addrlen); 3829 repinfo->client_addrlen = key->paddr.addrlen; 3830 memmove(&repinfo->client_addr, &key->paddr.addr, 3831 repinfo->client_addrlen); 3832 doq_repinfo_store_localaddr(repinfo, &key->paddr.localaddr, 3833 key->paddr.localaddrlen); 3834 if(key->dcidlen > sizeof(repinfo->doq_dcid)) 3835 return 0; 3836 repinfo->doq_dcidlen = key->dcidlen; 3837 memmove(repinfo->doq_dcid, key->dcid, key->dcidlen); 3838 return 1; 3839 } 3840 3841 void 3842 doq_conn_key_from_repinfo(struct doq_conn_key* key, struct comm_reply* repinfo) 3843 { 3844 key->paddr.ifindex = repinfo->doq_ifindex; 3845 key->paddr.addrlen = repinfo->remote_addrlen; 3846 memmove(&key->paddr.addr, &repinfo->remote_addr, 3847 repinfo->remote_addrlen); 3848 doq_repinfo_retrieve_localaddr(repinfo, &key->paddr.localaddr, 3849 &key->paddr.localaddrlen); 3850 key->dcidlen = repinfo->doq_dcidlen; 3851 key->dcid = repinfo->doq_dcid; 3852 } 3853 3854 /** doq add a stream to the connection */ 3855 static void 3856 doq_conn_add_stream(struct doq_conn* conn, struct doq_stream* stream) 3857 { 3858 (void)rbtree_insert(&conn->stream_tree, &stream->node); 3859 } 3860 3861 /** doq delete a stream from the connection */ 3862 static void 3863 doq_conn_del_stream(struct doq_conn* conn, struct doq_stream* stream) 3864 { 3865 (void)rbtree_delete(&conn->stream_tree, &stream->node); 3866 } 3867 3868 /** doq create new stream */ 3869 static struct doq_stream* 3870 doq_stream_create(int64_t stream_id) 3871 { 3872 struct doq_stream* stream = calloc(1, sizeof(*stream)); 3873 if(!stream) 3874 return NULL; 3875 stream->node.key = stream; 3876 stream->stream_id = stream_id; 3877 return stream; 3878 } 3879 3880 void doq_stream_delete(struct doq_stream* stream) 3881 { 3882 if(!stream) 3883 return; 3884 free(stream->in); 3885 free(stream->out); 3886 free(stream); 3887 } 3888 3889 struct doq_stream* 3890 doq_stream_find(struct doq_conn* conn, int64_t stream_id) 3891 { 3892 rbnode_type* node; 3893 struct doq_stream key; 3894 key.node.key = &key; 3895 key.stream_id = stream_id; 3896 node = rbtree_search(&conn->stream_tree, &key); 3897 if(node) 3898 return (struct doq_stream*)node->key; 3899 return NULL; 3900 } 3901 3902 /** doq put stream on the conn write list */ 3903 static void 3904 doq_stream_on_write_list(struct doq_conn* conn, struct doq_stream* stream) 3905 { 3906 if(stream->on_write_list) 3907 return; 3908 stream->write_prev = conn->stream_write_last; 3909 if(conn->stream_write_last) 3910 conn->stream_write_last->write_next = stream; 3911 else 3912 conn->stream_write_first = stream; 3913 conn->stream_write_last = stream; 3914 stream->write_next = NULL; 3915 stream->on_write_list = 1; 3916 } 3917 3918 /** doq remove stream from the conn write list */ 3919 static void 3920 doq_stream_off_write_list(struct doq_conn* conn, struct doq_stream* stream) 3921 { 3922 if(!stream->on_write_list) 3923 return; 3924 if(stream->write_next) 3925 stream->write_next->write_prev = stream->write_prev; 3926 else conn->stream_write_last = stream->write_prev; 3927 if(stream->write_prev) 3928 stream->write_prev->write_next = stream->write_next; 3929 else conn->stream_write_first = stream->write_next; 3930 stream->write_prev = NULL; 3931 stream->write_next = NULL; 3932 stream->on_write_list = 0; 3933 } 3934 3935 /** doq stream remove in buffer */ 3936 static void 3937 doq_stream_remove_in_buffer(struct doq_stream* stream, struct doq_table* table) 3938 { 3939 if(stream->in) { 3940 doq_table_quic_size_subtract(table, stream->inlen); 3941 free(stream->in); 3942 stream->in = NULL; 3943 stream->inlen = 0; 3944 } 3945 } 3946 3947 /** doq stream remove out buffer */ 3948 static void 3949 doq_stream_remove_out_buffer(struct doq_stream* stream, 3950 struct doq_table* table) 3951 { 3952 if(stream->out) { 3953 doq_table_quic_size_subtract(table, stream->outlen); 3954 free(stream->out); 3955 stream->out = NULL; 3956 stream->outlen = 0; 3957 } 3958 } 3959 3960 int 3961 doq_stream_close(struct doq_conn* conn, struct doq_stream* stream, 3962 int send_shutdown) 3963 { 3964 int ret; 3965 if(stream->is_closed) 3966 return 1; 3967 stream->is_closed = 1; 3968 if(stream->mesh_state) { 3969 mesh_state_remove_reply(stream->mesh, stream->mesh_state, 3970 conn->doq_socket->cp, NULL, stream); 3971 stream->mesh_state = NULL; 3972 } 3973 doq_stream_off_write_list(conn, stream); 3974 if(send_shutdown) { 3975 verbose(VERB_ALGO, "doq: shutdown stream_id %d with app_error_code %d", 3976 (int)stream->stream_id, (int)DOQ_APP_ERROR_CODE); 3977 ret = ngtcp2_conn_shutdown_stream(conn->conn, 3978 #ifdef HAVE_NGTCP2_CONN_SHUTDOWN_STREAM4 3979 0, 3980 #endif 3981 stream->stream_id, DOQ_APP_ERROR_CODE); 3982 if(ret != 0) { 3983 log_err("doq ngtcp2_conn_shutdown_stream %d failed: %s", 3984 (int)stream->stream_id, ngtcp2_strerror(ret)); 3985 return 0; 3986 } 3987 doq_conn_write_enable(conn); 3988 } 3989 verbose(VERB_ALGO, "doq: conn extend max streams bidi by 1"); 3990 ngtcp2_conn_extend_max_streams_bidi(conn->conn, 1); 3991 doq_conn_write_enable(conn); 3992 doq_stream_remove_in_buffer(stream, conn->doq_socket->table); 3993 doq_stream_remove_out_buffer(stream, conn->doq_socket->table); 3994 doq_table_quic_size_subtract(conn->doq_socket->table, sizeof(*stream)); 3995 doq_conn_del_stream(conn, stream); 3996 doq_stream_delete(stream); 3997 return 1; 3998 } 3999 4000 /** doq stream pick up answer data from buffer */ 4001 static int 4002 doq_stream_pickup_answer(struct doq_conn* conn, struct doq_stream* stream, 4003 struct sldns_buffer* buf) 4004 { 4005 stream->is_answer_available = 1; 4006 if(stream->out) { 4007 free(stream->out); 4008 stream->out = NULL; 4009 stream->outlen = 0; 4010 } 4011 stream->nwrite = 0; 4012 stream->outlen = sldns_buffer_limit(buf); 4013 if(!doq_table_quic_size_available(conn->doq_socket->table, 4014 conn->doq_socket->cfg, stream->outlen)) { 4015 verbose(VERB_ALGO, "doq stream: no space for reply length"); 4016 return 0; 4017 } 4018 /* For quic the output bytes have to stay allocated and available, 4019 * for potential resends, until the remote end has acknowledged them. 4020 * This includes the tcplen start uint16_t, in outlen_wire. */ 4021 stream->outlen_wire = htons(stream->outlen); 4022 stream->out = memdup(sldns_buffer_begin(buf), sldns_buffer_limit(buf)); 4023 if(!stream->out) { 4024 log_err("doq could not send answer: out of memory"); 4025 return 0; 4026 } 4027 return 1; 4028 } 4029 4030 int 4031 doq_stream_send_reply(struct doq_conn* conn, struct doq_stream* stream, 4032 struct sldns_buffer* buf) 4033 { 4034 if(verbosity >= VERB_ALGO) { 4035 char* s = sldns_wire2str_pkt(sldns_buffer_begin(buf), 4036 sldns_buffer_limit(buf)); 4037 verbose(VERB_ALGO, "doq stream %d response\n%s", 4038 (int)stream->stream_id, (s?s:"null")); 4039 free(s); 4040 } 4041 if(stream->out) 4042 doq_table_quic_size_subtract(conn->doq_socket->table, 4043 stream->outlen); 4044 if(!doq_stream_pickup_answer(conn, stream, buf)) 4045 return 0; 4046 doq_table_quic_size_add(conn->doq_socket->table, stream->outlen); 4047 doq_stream_on_write_list(conn, stream); 4048 doq_conn_write_enable(conn); 4049 return 1; 4050 } 4051 #endif /* HAVE_NGTCP2 */ 4052 4053 void 4054 doq_stream_add_meshstate(struct doq_stream* stream, 4055 struct mesh_area* mesh, struct mesh_state* m) 4056 { 4057 #ifdef HAVE_NGTCP2 4058 stream->mesh = mesh; 4059 stream->mesh_state = m; 4060 #else 4061 (void)stream; (void)mesh; (void)m; 4062 #endif 4063 } 4064 4065 void 4066 doq_stream_remove_mesh_state(struct doq_stream* stream) 4067 { 4068 #ifdef HAVE_NGTCP2 4069 if(!stream) 4070 return; 4071 stream->mesh_state = NULL; 4072 #else 4073 (void)stream; 4074 #endif 4075 } 4076 4077 #ifdef HAVE_NGTCP2 4078 /** doq stream data length has completed, allocations can be done. False on 4079 * allocation failure. */ 4080 static int 4081 doq_stream_datalen_complete(struct doq_conn* conn, struct doq_stream* stream, 4082 struct doq_table* table) 4083 { 4084 if(stream->inlen > 1024*1024) { 4085 log_err("doq stream in length too large %d", 4086 (int)stream->inlen); 4087 return 0; 4088 } 4089 if(!doq_table_quic_size_available(table, conn->doq_socket->cfg, 4090 stream->inlen)) { 4091 verbose(VERB_ALGO, "doq stream: no space for query length"); 4092 return 0; 4093 } 4094 stream->in = calloc(1, stream->inlen); 4095 if(!stream->in) { 4096 log_err("doq could not read stream, calloc failed: " 4097 "out of memory"); 4098 return 0; 4099 } 4100 doq_table_quic_size_add(table, stream->inlen); 4101 return 1; 4102 } 4103 4104 /** doq stream data is complete, the input data has been received. */ 4105 static int 4106 doq_stream_data_complete(struct doq_conn* conn, struct doq_stream* stream) 4107 { 4108 struct comm_point* c; 4109 if(verbosity >= VERB_ALGO) { 4110 char* s = sldns_wire2str_pkt(stream->in, stream->inlen); 4111 char a[128]; 4112 addr_to_str((void*)&conn->key.paddr.addr, 4113 conn->key.paddr.addrlen, a, sizeof(a)); 4114 verbose(VERB_ALGO, "doq %s stream %d incoming query\n%s", 4115 a, (int)stream->stream_id, (s?s:"null")); 4116 free(s); 4117 } 4118 stream->is_query_complete = 1; 4119 c = conn->doq_socket->cp; 4120 if(!stream->in) { 4121 verbose(VERB_ALGO, "doq_stream_data_complete: no in buffer"); 4122 return 0; 4123 } 4124 if(stream->inlen > sldns_buffer_capacity(c->buffer)) { 4125 verbose(VERB_ALGO, "doq_stream_data_complete: query too long"); 4126 return 0; 4127 } 4128 sldns_buffer_clear(c->buffer); 4129 sldns_buffer_write(c->buffer, stream->in, stream->inlen); 4130 sldns_buffer_flip(c->buffer); 4131 c->repinfo.c = c; 4132 if(!doq_conn_key_store_repinfo(&conn->key, &c->repinfo)) { 4133 verbose(VERB_ALGO, "doq_stream_data_complete: connection " 4134 "DCID too long"); 4135 return 0; 4136 } 4137 c->repinfo.doq_streamid = stream->stream_id; 4138 c->repinfo.doq_stream = stream; 4139 conn->doq_socket->current_conn = conn; 4140 fptr_ok(fptr_whitelist_comm_point(c->callback)); 4141 if( (*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, &c->repinfo)) { 4142 conn->doq_socket->current_conn = NULL; 4143 if(!doq_stream_send_reply(conn, stream, c->buffer)) { 4144 verbose(VERB_ALGO, "doq: failed to send_reply"); 4145 return 0; 4146 } 4147 return 1; 4148 } 4149 conn->doq_socket->current_conn = NULL; 4150 return 1; 4151 } 4152 4153 /** doq receive data for a stream, more bytes of the incoming data */ 4154 static int 4155 doq_stream_recv_data(struct doq_conn* conn, struct doq_stream* stream, 4156 const uint8_t* data, size_t datalen, int* recv_done, 4157 struct doq_table* table) 4158 { 4159 int got_data = 0; 4160 /* read the tcplength uint16_t at the start */ 4161 if(stream->nread < 2) { 4162 uint16_t tcplen = 0; 4163 size_t todolen = 2 - stream->nread; 4164 4165 if(stream->nread > 0) { 4166 /* put in the already read byte if there is one */ 4167 tcplen = stream->inlen; 4168 } 4169 if(datalen < todolen) 4170 todolen = datalen; 4171 memmove(((uint8_t*)&tcplen)+stream->nread, data, todolen); 4172 stream->nread += todolen; 4173 data += todolen; 4174 datalen -= todolen; 4175 if(stream->nread == 2) { 4176 /* the initial length value is completed */ 4177 stream->inlen = ntohs(tcplen); 4178 if(!doq_stream_datalen_complete(conn, stream, table)) 4179 return 0; 4180 } else { 4181 /* store for later */ 4182 stream->inlen = tcplen; 4183 return 1; 4184 } 4185 } 4186 /* if there are more data bytes */ 4187 if(datalen > 0) { 4188 size_t to_write = datalen; 4189 if(stream->nread-2 > stream->inlen) { 4190 verbose(VERB_ALGO, "doq stream buffer too small"); 4191 return 0; 4192 } 4193 if(datalen > stream->inlen - (stream->nread-2)) 4194 to_write = stream->inlen - (stream->nread-2); 4195 if(to_write > 0) { 4196 if(!stream->in) { 4197 verbose(VERB_ALGO, "doq: stream has " 4198 "no buffer"); 4199 return 0; 4200 } 4201 memmove(stream->in+(stream->nread-2), data, to_write); 4202 stream->nread += to_write; 4203 data += to_write; 4204 datalen -= to_write; 4205 got_data = 1; 4206 } 4207 } 4208 /* Are there extra bytes received after the end? If so, log them. */ 4209 if(datalen > 0) { 4210 if(verbosity >= VERB_ALGO) 4211 log_hex("doq stream has extra bytes received after end", 4212 (void*)data, datalen); 4213 } 4214 /* Is the input data complete? */ 4215 if(got_data && stream->nread >= stream->inlen+2) { 4216 if(!stream->in) { 4217 verbose(VERB_ALGO, "doq: completed stream has " 4218 "no buffer"); 4219 return 0; 4220 } 4221 *recv_done = 1; 4222 } 4223 return 1; 4224 } 4225 4226 /** doq receive FIN for a stream. No more bytes are going to arrive. */ 4227 static int 4228 doq_stream_recv_fin(struct doq_conn* conn, struct doq_stream* stream, int 4229 recv_done) 4230 { 4231 if(!stream->is_query_complete && !recv_done) { 4232 verbose(VERB_ALGO, "doq: stream recv FIN, but is " 4233 "not complete, have %d of %d bytes", 4234 ((int)stream->nread)-2, (int)stream->inlen); 4235 if(!doq_stream_close(conn, stream, 1)) 4236 return 0; 4237 } 4238 return 1; 4239 } 4240 4241 void doq_fill_rand(struct ub_randstate* rnd, uint8_t* buf, size_t len) 4242 { 4243 size_t i; 4244 for(i=0; i<len; i++) 4245 buf[i] = ub_random(rnd)&0xff; 4246 } 4247 4248 /** generate new connection id, checks for duplicates. 4249 * caller must hold lock on conid tree. */ 4250 static int 4251 doq_conn_generate_new_conid(struct doq_conn* conn, uint8_t* data, 4252 size_t datalen) 4253 { 4254 int max_try = 100; 4255 int i; 4256 for(i=0; i<max_try; i++) { 4257 doq_fill_rand(conn->doq_socket->rnd, data, datalen); 4258 if(!doq_conid_find(conn->table, data, datalen)) { 4259 /* Found an unused connection id. */ 4260 return 1; 4261 } 4262 } 4263 verbose(VERB_ALGO, "doq_conn_generate_new_conid failed: could not " 4264 "generate random unused connection id value in %d attempts.", 4265 max_try); 4266 return 0; 4267 } 4268 4269 /** ngtcp2 rand callback function */ 4270 static void 4271 doq_rand_cb(uint8_t* dest, size_t destlen, const ngtcp2_rand_ctx* rand_ctx) 4272 { 4273 struct ub_randstate* rnd = (struct ub_randstate*) 4274 rand_ctx->native_handle; 4275 doq_fill_rand(rnd, dest, destlen); 4276 } 4277 4278 /** ngtcp2 get_new_connection_id callback function */ 4279 static int 4280 doq_get_new_connection_id_cb(ngtcp2_conn* ATTR_UNUSED(conn), ngtcp2_cid* cid, 4281 uint8_t* token, size_t cidlen, void* user_data) 4282 { 4283 struct doq_conn* doq_conn = (struct doq_conn*)user_data; 4284 /* Lock the conid tree, so we can check for duplicates while 4285 * generating the id, and then insert it, whilst keeping the tree 4286 * locked against other modifications, guaranteeing uniqueness. */ 4287 lock_rw_wrlock(&doq_conn->table->conid_lock); 4288 if(!doq_conn_generate_new_conid(doq_conn, cid->data, cidlen)) { 4289 lock_rw_unlock(&doq_conn->table->conid_lock); 4290 return NGTCP2_ERR_CALLBACK_FAILURE; 4291 } 4292 cid->datalen = cidlen; 4293 if(ngtcp2_crypto_generate_stateless_reset_token(token, 4294 doq_conn->doq_socket->static_secret, 4295 doq_conn->doq_socket->static_secret_len, cid) != 0) { 4296 lock_rw_unlock(&doq_conn->table->conid_lock); 4297 return NGTCP2_ERR_CALLBACK_FAILURE; 4298 } 4299 if(!doq_conn_associate_conid(doq_conn, cid->data, cid->datalen)) { 4300 lock_rw_unlock(&doq_conn->table->conid_lock); 4301 return NGTCP2_ERR_CALLBACK_FAILURE; 4302 } 4303 lock_rw_unlock(&doq_conn->table->conid_lock); 4304 return 0; 4305 } 4306 4307 /** ngtcp2 remove_connection_id callback function */ 4308 static int 4309 doq_remove_connection_id_cb(ngtcp2_conn* ATTR_UNUSED(conn), 4310 const ngtcp2_cid* cid, void* user_data) 4311 { 4312 struct doq_conn* doq_conn = (struct doq_conn*)user_data; 4313 lock_rw_wrlock(&doq_conn->table->conid_lock); 4314 doq_conn_dissociate_conid(doq_conn, cid->data, cid->datalen); 4315 lock_rw_unlock(&doq_conn->table->conid_lock); 4316 return 0; 4317 } 4318 4319 /** doq submit a new token */ 4320 static int 4321 doq_submit_new_token(struct doq_conn* conn) 4322 { 4323 uint8_t token[NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN]; 4324 ngtcp2_ssize tokenlen; 4325 int ret; 4326 const ngtcp2_path* path = ngtcp2_conn_get_path(conn->conn); 4327 4328 tokenlen = ngtcp2_crypto_generate_regular_token(token, 4329 conn->doq_socket->static_secret, 4330 conn->doq_socket->static_secret_len, path->remote.addr, 4331 path->remote.addrlen, doq_get_timestamp_nanosec()); 4332 if(tokenlen < 0) { 4333 log_err("doq ngtcp2_crypto_generate_regular_token failed"); 4334 return 1; 4335 } 4336 4337 verbose(VERB_ALGO, "doq submit new token"); 4338 ret = ngtcp2_conn_submit_new_token(conn->conn, token, tokenlen); 4339 if(ret != 0) { 4340 log_err("doq ngtcp2_conn_submit_new_token failed: %s", 4341 ngtcp2_strerror(ret)); 4342 return 0; 4343 } 4344 return 1; 4345 } 4346 4347 /** ngtcp2 handshake_completed callback function */ 4348 static int 4349 doq_handshake_completed_cb(ngtcp2_conn* ATTR_UNUSED(conn), void* user_data) 4350 { 4351 struct doq_conn* doq_conn = (struct doq_conn*)user_data; 4352 verbose(VERB_ALGO, "doq handshake_completed callback"); 4353 verbose(VERB_ALGO, "ngtcp2_conn_get_max_data_left is %d", 4354 (int)ngtcp2_conn_get_max_data_left(doq_conn->conn)); 4355 #ifdef HAVE_NGTCP2_CONN_GET_MAX_LOCAL_STREAMS_UNI 4356 verbose(VERB_ALGO, "ngtcp2_conn_get_max_local_streams_uni is %d", 4357 (int)ngtcp2_conn_get_max_local_streams_uni(doq_conn->conn)); 4358 #endif 4359 verbose(VERB_ALGO, "ngtcp2_conn_get_streams_uni_left is %d", 4360 (int)ngtcp2_conn_get_streams_uni_left(doq_conn->conn)); 4361 verbose(VERB_ALGO, "ngtcp2_conn_get_streams_bidi_left is %d", 4362 (int)ngtcp2_conn_get_streams_bidi_left(doq_conn->conn)); 4363 verbose(VERB_ALGO, "negotiated cipher name is %s", 4364 SSL_get_cipher_name(doq_conn->ssl)); 4365 if(verbosity > VERB_ALGO) { 4366 const unsigned char* alpn = NULL; 4367 unsigned int alpnlen = 0; 4368 char alpnstr[128]; 4369 SSL_get0_alpn_selected(doq_conn->ssl, &alpn, &alpnlen); 4370 if(alpnlen > sizeof(alpnstr)-1) 4371 alpnlen = sizeof(alpnstr)-1; 4372 memmove(alpnstr, alpn, alpnlen); 4373 alpnstr[alpnlen]=0; 4374 verbose(VERB_ALGO, "negotiated ALPN is '%s'", alpnstr); 4375 } 4376 4377 if(!doq_submit_new_token(doq_conn)) 4378 return -1; 4379 return 0; 4380 } 4381 4382 /** ngtcp2 stream_open callback function */ 4383 static int 4384 doq_stream_open_cb(ngtcp2_conn* ATTR_UNUSED(conn), int64_t stream_id, 4385 void* user_data) 4386 { 4387 struct doq_conn* doq_conn = (struct doq_conn*)user_data; 4388 struct doq_stream* stream; 4389 verbose(VERB_ALGO, "doq new stream %x", (int)stream_id); 4390 if(doq_stream_find(doq_conn, stream_id)) { 4391 verbose(VERB_ALGO, "doq: stream with this id already exists"); 4392 return 0; 4393 } 4394 if(!doq_table_quic_size_available(doq_conn->doq_socket->table, 4395 doq_conn->doq_socket->cfg, sizeof(*stream) 4396 + 100 /* estimated query in */ 4397 + 512 /* estimated response out */ 4398 )) { 4399 int rv; 4400 verbose(VERB_ALGO, "doq: no mem for new stream"); 4401 rv = ngtcp2_conn_shutdown_stream(doq_conn->conn, 4402 #ifdef HAVE_NGTCP2_CONN_SHUTDOWN_STREAM4 4403 0, 4404 #endif 4405 stream_id, NGTCP2_CONNECTION_REFUSED); 4406 if(rv != 0) { 4407 log_err("ngtcp2_conn_shutdown_stream failed: %s", 4408 ngtcp2_strerror(rv)); 4409 return NGTCP2_ERR_CALLBACK_FAILURE; 4410 } 4411 return 0; 4412 } 4413 stream = doq_stream_create(stream_id); 4414 if(!stream) { 4415 log_err("doq: could not doq_stream_create: out of memory"); 4416 return NGTCP2_ERR_CALLBACK_FAILURE; 4417 } 4418 doq_table_quic_size_add(doq_conn->doq_socket->table, sizeof(*stream)); 4419 doq_conn_add_stream(doq_conn, stream); 4420 return 0; 4421 } 4422 4423 /** ngtcp2 recv_stream_data callback function */ 4424 static int 4425 doq_recv_stream_data_cb(ngtcp2_conn* ATTR_UNUSED(conn), uint32_t flags, 4426 int64_t stream_id, uint64_t offset, const uint8_t* data, 4427 size_t datalen, void* user_data, void* ATTR_UNUSED(stream_user_data)) 4428 { 4429 int recv_done = 0; 4430 struct doq_conn* doq_conn = (struct doq_conn*)user_data; 4431 struct doq_stream* stream; 4432 verbose(VERB_ALGO, "doq recv stream data stream id %d offset %d " 4433 "datalen %d%s%s", (int)stream_id, (int)offset, (int)datalen, 4434 ((flags&NGTCP2_STREAM_DATA_FLAG_FIN)!=0?" FIN":""), 4435 #ifdef NGTCP2_STREAM_DATA_FLAG_0RTT 4436 ((flags&NGTCP2_STREAM_DATA_FLAG_0RTT)!=0?" 0RTT":"") 4437 #else 4438 ((flags&NGTCP2_STREAM_DATA_FLAG_EARLY)!=0?" EARLY":"") 4439 #endif 4440 ); 4441 stream = doq_stream_find(doq_conn, stream_id); 4442 if(!stream) { 4443 verbose(VERB_ALGO, "doq: received stream data for " 4444 "unknown stream %d", (int)stream_id); 4445 return 0; 4446 } 4447 if(stream->is_closed) { 4448 verbose(VERB_ALGO, "doq: stream is closed, ignore recv data"); 4449 return 0; 4450 } 4451 if(datalen != 0) { 4452 if(!doq_stream_recv_data(doq_conn, stream, data, datalen, 4453 &recv_done, doq_conn->doq_socket->table)) 4454 return NGTCP2_ERR_CALLBACK_FAILURE; 4455 } 4456 if((flags&NGTCP2_STREAM_DATA_FLAG_FIN)!=0) { 4457 if(!doq_stream_recv_fin(doq_conn, stream, recv_done)) 4458 return NGTCP2_ERR_CALLBACK_FAILURE; 4459 } 4460 ngtcp2_conn_extend_max_stream_offset(doq_conn->conn, stream_id, 4461 datalen); 4462 ngtcp2_conn_extend_max_offset(doq_conn->conn, datalen); 4463 if(recv_done) { 4464 if(!doq_stream_data_complete(doq_conn, stream)) 4465 return NGTCP2_ERR_CALLBACK_FAILURE; 4466 } 4467 return 0; 4468 } 4469 4470 /** ngtcp2 stream_close callback function */ 4471 static int 4472 doq_stream_close_cb(ngtcp2_conn* ATTR_UNUSED(conn), uint32_t flags, 4473 int64_t stream_id, uint64_t app_error_code, void* user_data, 4474 void* ATTR_UNUSED(stream_user_data)) 4475 { 4476 struct doq_conn* doq_conn = (struct doq_conn*)user_data; 4477 struct doq_stream* stream; 4478 if((flags&NGTCP2_STREAM_CLOSE_FLAG_APP_ERROR_CODE_SET)!=0) 4479 verbose(VERB_ALGO, "doq stream close for stream id %d %sapp_error_code %d", 4480 (int)stream_id, 4481 (((flags&NGTCP2_STREAM_CLOSE_FLAG_APP_ERROR_CODE_SET)!=0)? 4482 "APP_ERROR_CODE_SET ":""), 4483 (int)app_error_code); 4484 else 4485 verbose(VERB_ALGO, "doq stream close for stream id %d", 4486 (int)stream_id); 4487 4488 stream = doq_stream_find(doq_conn, stream_id); 4489 if(!stream) { 4490 verbose(VERB_ALGO, "doq: stream close for " 4491 "unknown stream %d", (int)stream_id); 4492 return 0; 4493 } 4494 if(!doq_stream_close(doq_conn, stream, 0)) 4495 return NGTCP2_ERR_CALLBACK_FAILURE; 4496 return 0; 4497 } 4498 4499 /** ngtcp2 stream_reset callback function */ 4500 static int 4501 doq_stream_reset_cb(ngtcp2_conn* ATTR_UNUSED(conn), int64_t stream_id, 4502 uint64_t final_size, uint64_t app_error_code, void* user_data, 4503 void* ATTR_UNUSED(stream_user_data)) 4504 { 4505 struct doq_conn* doq_conn = (struct doq_conn*)user_data; 4506 struct doq_stream* stream; 4507 verbose(VERB_ALGO, "doq stream reset for stream id %d final_size %d " 4508 "app_error_code %d", (int)stream_id, (int)final_size, 4509 (int)app_error_code); 4510 4511 stream = doq_stream_find(doq_conn, stream_id); 4512 if(!stream) { 4513 verbose(VERB_ALGO, "doq: stream reset for " 4514 "unknown stream %d", (int)stream_id); 4515 return 0; 4516 } 4517 if(!doq_stream_close(doq_conn, stream, 1)) 4518 return NGTCP2_ERR_CALLBACK_FAILURE; 4519 return 0; 4520 } 4521 4522 /** ngtcp2 extend_max_stream_data function */ 4523 int doq_extend_max_stream_data_cb(ngtcp2_conn* ATTR_UNUSED(conn), 4524 int64_t stream_id, uint64_t max_data, void* user_data, 4525 void* ATTR_UNUSED(stream_user_data)) 4526 { 4527 struct doq_conn* doq_conn = (struct doq_conn*)user_data; 4528 struct doq_stream* stream; 4529 verbose(VERB_ALGO, "doq extend_max_stream_data stream id %d " 4530 "max_data %d ", (int)stream_id, (int)max_data); 4531 if(max_data == 0) 4532 return 0; 4533 stream = doq_stream_find(doq_conn, stream_id); 4534 if(!stream) { 4535 verbose(VERB_ALGO, "doq: unknown stream %d", (int)stream_id); 4536 return 0; 4537 } 4538 if(!stream->is_answer_available) 4539 return 0; 4540 doq_stream_on_write_list(doq_conn, stream); 4541 doq_conn_write_enable(doq_conn); 4542 return 0; 4543 } 4544 4545 /** ngtcp2 acked_stream_data_offset callback function */ 4546 static int 4547 doq_acked_stream_data_offset_cb(ngtcp2_conn* ATTR_UNUSED(conn), 4548 int64_t stream_id, uint64_t offset, uint64_t datalen, void* user_data, 4549 void* ATTR_UNUSED(stream_user_data)) 4550 { 4551 struct doq_conn* doq_conn = (struct doq_conn*)user_data; 4552 struct doq_stream* stream; 4553 verbose(VERB_ALGO, "doq stream acked data for stream id %d offset %d " 4554 "datalen %d", (int)stream_id, (int)offset, (int)datalen); 4555 4556 stream = doq_stream_find(doq_conn, stream_id); 4557 if(!stream) { 4558 verbose(VERB_ALGO, "doq: stream acked data for " 4559 "unknown stream %d", (int)stream_id); 4560 return 0; 4561 } 4562 /* Acked the data from [offset .. offset+datalen). */ 4563 if(stream->is_closed) 4564 return 0; 4565 if(offset+datalen >= stream->outlen) { 4566 doq_stream_remove_in_buffer(stream, 4567 doq_conn->doq_socket->table); 4568 doq_stream_remove_out_buffer(stream, 4569 doq_conn->doq_socket->table); 4570 } 4571 return 0; 4572 } 4573 4574 /** ngtc2p log_printf callback function */ 4575 static void 4576 doq_log_printf_cb(void* ATTR_UNUSED(user_data), const char* fmt, ...) 4577 { 4578 char buf[1024]; 4579 va_list ap; 4580 va_start(ap, fmt); 4581 vsnprintf(buf, sizeof(buf), fmt, ap); 4582 verbose(VERB_ALGO, "libngtcp2: %s", buf); 4583 va_end(ap); 4584 } 4585 4586 #ifdef MAKE_QUIC_METHOD 4587 /** the doq application tx key callback, false on failure */ 4588 static int 4589 doq_application_tx_key_cb(struct doq_conn* conn) 4590 { 4591 verbose(VERB_ALGO, "doq application tx key cb"); 4592 /* The server does not want to open streams to the client, 4593 * the client instead initiates by opening bidi streams. */ 4594 verbose(VERB_ALGO, "doq ngtcp2_conn_get_max_data_left is %d", 4595 (int)ngtcp2_conn_get_max_data_left(conn->conn)); 4596 #ifdef HAVE_NGTCP2_CONN_GET_MAX_LOCAL_STREAMS_UNI 4597 verbose(VERB_ALGO, "doq ngtcp2_conn_get_max_local_streams_uni is %d", 4598 (int)ngtcp2_conn_get_max_local_streams_uni(conn->conn)); 4599 #endif 4600 verbose(VERB_ALGO, "doq ngtcp2_conn_get_streams_uni_left is %d", 4601 (int)ngtcp2_conn_get_streams_uni_left(conn->conn)); 4602 verbose(VERB_ALGO, "doq ngtcp2_conn_get_streams_bidi_left is %d", 4603 (int)ngtcp2_conn_get_streams_bidi_left(conn->conn)); 4604 return 1; 4605 } 4606 4607 /** quic_method set_encryption_secrets function */ 4608 static int 4609 doq_set_encryption_secrets(SSL *ssl, OSSL_ENCRYPTION_LEVEL ossl_level, 4610 const uint8_t *read_secret, const uint8_t *write_secret, 4611 size_t secret_len) 4612 { 4613 struct doq_conn* doq_conn = (struct doq_conn*)SSL_get_app_data(ssl); 4614 #ifdef HAVE_NGTCP2_ENCRYPTION_LEVEL 4615 ngtcp2_encryption_level 4616 #else 4617 ngtcp2_crypto_level 4618 #endif 4619 level = 4620 #ifdef USE_NGTCP2_CRYPTO_OSSL 4621 ngtcp2_crypto_ossl_from_ossl_encryption_level(ossl_level); 4622 #elif defined(HAVE_NGTCP2_CRYPTO_QUICTLS_FROM_OSSL_ENCRYPTION_LEVEL) 4623 ngtcp2_crypto_quictls_from_ossl_encryption_level(ossl_level); 4624 #else 4625 ngtcp2_crypto_openssl_from_ossl_encryption_level(ossl_level); 4626 #endif 4627 4628 if(read_secret) { 4629 verbose(VERB_ALGO, "doq: ngtcp2_crypto_derive_and_install_rx_key for level %d ossl %d", (int)level, (int)ossl_level); 4630 if(ngtcp2_crypto_derive_and_install_rx_key(doq_conn->conn, 4631 NULL, NULL, NULL, level, read_secret, secret_len) 4632 != 0) { 4633 log_err("ngtcp2_crypto_derive_and_install_rx_key " 4634 "failed"); 4635 return 0; 4636 } 4637 } 4638 4639 if(write_secret) { 4640 verbose(VERB_ALGO, "doq: ngtcp2_crypto_derive_and_install_tx_key for level %d ossl %d", (int)level, (int)ossl_level); 4641 if(ngtcp2_crypto_derive_and_install_tx_key(doq_conn->conn, 4642 NULL, NULL, NULL, level, write_secret, secret_len) 4643 != 0) { 4644 log_err("ngtcp2_crypto_derive_and_install_tx_key " 4645 "failed"); 4646 return 0; 4647 } 4648 if(level == NGTCP2_CRYPTO_LEVEL_APPLICATION) { 4649 if(!doq_application_tx_key_cb(doq_conn)) 4650 return 0; 4651 } 4652 } 4653 return 1; 4654 } 4655 4656 /** quic_method add_handshake_data function */ 4657 static int 4658 doq_add_handshake_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL ossl_level, 4659 const uint8_t *data, size_t len) 4660 { 4661 struct doq_conn* doq_conn = (struct doq_conn*)SSL_get_app_data(ssl); 4662 #ifdef HAVE_NGTCP2_ENCRYPTION_LEVEL 4663 ngtcp2_encryption_level 4664 #else 4665 ngtcp2_crypto_level 4666 #endif 4667 level = 4668 #ifdef USE_NGTCP2_CRYPTO_OSSL 4669 ngtcp2_crypto_ossl_from_ossl_encryption_level(ossl_level); 4670 #elif defined(HAVE_NGTCP2_CRYPTO_QUICTLS_FROM_OSSL_ENCRYPTION_LEVEL) 4671 ngtcp2_crypto_quictls_from_ossl_encryption_level(ossl_level); 4672 #else 4673 ngtcp2_crypto_openssl_from_ossl_encryption_level(ossl_level); 4674 #endif 4675 int rv; 4676 4677 verbose(VERB_ALGO, "doq_add_handshake_data: " 4678 "ngtcp2_con_submit_crypto_data level %d", (int)level); 4679 rv = ngtcp2_conn_submit_crypto_data(doq_conn->conn, level, data, len); 4680 if(rv != 0) { 4681 log_err("ngtcp2_conn_submit_crypto_data failed: %s", 4682 ngtcp2_strerror(rv)); 4683 ngtcp2_conn_set_tls_error(doq_conn->conn, rv); 4684 return 0; 4685 } 4686 return 1; 4687 } 4688 4689 /** quic_method flush_flight function */ 4690 static int 4691 doq_flush_flight(SSL* ATTR_UNUSED(ssl)) 4692 { 4693 return 1; 4694 } 4695 4696 /** quic_method send_alert function */ 4697 static int 4698 doq_send_alert(SSL *ssl, enum ssl_encryption_level_t ATTR_UNUSED(level), 4699 uint8_t alert) 4700 { 4701 struct doq_conn* doq_conn = (struct doq_conn*)SSL_get_app_data(ssl); 4702 doq_conn->tls_alert = alert; 4703 return 1; 4704 } 4705 #endif /* MAKE_QUIC_METHOD */ 4706 4707 /** ALPN select callback for the doq SSL context */ 4708 static int 4709 doq_alpn_select_cb(SSL* ATTR_UNUSED(ssl), const unsigned char** out, 4710 unsigned char* outlen, const unsigned char* in, unsigned int inlen, 4711 void* ATTR_UNUSED(arg)) 4712 { 4713 /* select "doq" */ 4714 int ret = SSL_select_next_proto((void*)out, outlen, 4715 (const unsigned char*)"\x03""doq", 4, in, inlen); 4716 if(ret == OPENSSL_NPN_NEGOTIATED) 4717 return SSL_TLSEXT_ERR_OK; 4718 verbose(VERB_ALGO, "doq alpn_select_cb: ALPN from client does " 4719 "not have 'doq'"); 4720 return SSL_TLSEXT_ERR_ALERT_FATAL; 4721 } 4722 4723 void* quic_sslctx_create(char* key, char* pem, char* verifypem) 4724 { 4725 #ifdef HAVE_NGTCP2 4726 char* sid_ctx = "unbound server"; 4727 #ifdef MAKE_QUIC_METHOD 4728 SSL_QUIC_METHOD* quic_method; 4729 #endif 4730 SSL_CTX* ctx = SSL_CTX_new(TLS_server_method()); 4731 if(!ctx) { 4732 log_crypto_err("Could not SSL_CTX_new"); 4733 return NULL; 4734 } 4735 if(!key || key[0] == 0) { 4736 log_err("doq: error, no tls-service-key file specified"); 4737 SSL_CTX_free(ctx); 4738 return NULL; 4739 } 4740 if(!pem || pem[0] == 0) { 4741 log_err("doq: error, no tls-service-pem file specified"); 4742 SSL_CTX_free(ctx); 4743 return NULL; 4744 } 4745 SSL_CTX_set_options(ctx, 4746 (SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) | 4747 SSL_OP_SINGLE_ECDH_USE | 4748 SSL_OP_CIPHER_SERVER_PREFERENCE | 4749 SSL_OP_NO_ANTI_REPLAY); 4750 SSL_CTX_set_mode(ctx, SSL_MODE_RELEASE_BUFFERS); 4751 SSL_CTX_set_min_proto_version(ctx, TLS1_3_VERSION); 4752 SSL_CTX_set_max_proto_version(ctx, TLS1_3_VERSION); 4753 #ifdef HAVE_SSL_CTX_SET_ALPN_SELECT_CB 4754 SSL_CTX_set_alpn_select_cb(ctx, doq_alpn_select_cb, NULL); 4755 #endif 4756 SSL_CTX_set_default_verify_paths(ctx); 4757 if(!SSL_CTX_use_certificate_chain_file(ctx, pem)) { 4758 log_err("doq: error for cert file: %s", pem); 4759 log_crypto_err("doq: error in " 4760 "SSL_CTX_use_certificate_chain_file"); 4761 SSL_CTX_free(ctx); 4762 return NULL; 4763 } 4764 if(!SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM)) { 4765 log_err("doq: error for private key file: %s", key); 4766 log_crypto_err("doq: error in SSL_CTX_use_PrivateKey_file"); 4767 SSL_CTX_free(ctx); 4768 return NULL; 4769 } 4770 if(!SSL_CTX_check_private_key(ctx)) { 4771 log_err("doq: error for key file: %s", key); 4772 log_crypto_err("doq: error in SSL_CTX_check_private_key"); 4773 SSL_CTX_free(ctx); 4774 return NULL; 4775 } 4776 SSL_CTX_set_session_id_context(ctx, (void*)sid_ctx, strlen(sid_ctx)); 4777 if(verifypem && verifypem[0]) { 4778 if(!SSL_CTX_load_verify_locations(ctx, verifypem, NULL)) { 4779 log_err("doq: error for verify pem file: %s", 4780 verifypem); 4781 log_crypto_err("doq: error in " 4782 "SSL_CTX_load_verify_locations"); 4783 SSL_CTX_free(ctx); 4784 return NULL; 4785 } 4786 SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file( 4787 verifypem)); 4788 SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER| 4789 SSL_VERIFY_CLIENT_ONCE| 4790 SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL); 4791 } 4792 4793 SSL_CTX_set_max_early_data(ctx, 0xffffffff); 4794 #ifdef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_SERVER_CONTEXT 4795 if(ngtcp2_crypto_quictls_configure_server_context(ctx) != 0) { 4796 log_err("ngtcp2_crypto_quictls_configure_server_context failed"); 4797 SSL_CTX_free(ctx); 4798 return NULL; 4799 } 4800 #elif defined(MAKE_QUIC_METHOD) 4801 /* The quic_method needs to remain valid during the SSL_CTX 4802 * lifetime, so we allocate it. It is freed with the 4803 * doq_server_socket. */ 4804 quic_method = calloc(1, sizeof(SSL_QUIC_METHOD)); 4805 if(!quic_method) { 4806 log_err("calloc failed: out of memory"); 4807 SSL_CTX_free(ctx); 4808 return NULL; 4809 } 4810 doq_socket->quic_method = quic_method; 4811 quic_method->set_encryption_secrets = doq_set_encryption_secrets; 4812 quic_method->add_handshake_data = doq_add_handshake_data; 4813 quic_method->flush_flight = doq_flush_flight; 4814 quic_method->send_alert = doq_send_alert; 4815 SSL_CTX_set_quic_method(ctx, doq_socket->quic_method); 4816 #endif 4817 return ctx; 4818 #else /* HAVE_NGTCP2 */ 4819 (void)key; (void)pem; (void)verifypem; 4820 return NULL; 4821 #endif /* HAVE_NGTCP2 */ 4822 } 4823 4824 /** Get the ngtcp2_conn from ssl userdata of type ngtcp2_conn_ref */ 4825 static ngtcp2_conn* doq_conn_ref_get_conn(ngtcp2_crypto_conn_ref* conn_ref) 4826 { 4827 struct doq_conn* conn = (struct doq_conn*)conn_ref->user_data; 4828 return conn->conn; 4829 } 4830 4831 /** create new SSL session for server connection */ 4832 static SSL* 4833 doq_ssl_server_setup(SSL_CTX* ctx, struct doq_conn* conn) 4834 { 4835 #ifdef USE_NGTCP2_CRYPTO_OSSL 4836 int ret; 4837 #endif 4838 SSL* ssl = SSL_new(ctx); 4839 if(!ssl) { 4840 log_crypto_err("doq: SSL_new failed"); 4841 return NULL; 4842 } 4843 #ifdef USE_NGTCP2_CRYPTO_OSSL 4844 if((ret=ngtcp2_crypto_ossl_ctx_new(&conn->ossl_ctx, NULL)) != 0) { 4845 log_err("doq: ngtcp2_crypto_ossl_ctx_new failed: %s", 4846 ngtcp2_strerror(ret)); 4847 SSL_free(ssl); 4848 return NULL; 4849 } 4850 ngtcp2_crypto_ossl_ctx_set_ssl(conn->ossl_ctx, ssl); 4851 if(ngtcp2_crypto_ossl_configure_server_session(ssl) != 0) { 4852 log_err("doq: ngtcp2_crypto_ossl_configure_server_session failed"); 4853 SSL_free(ssl); 4854 return NULL; 4855 } 4856 #endif 4857 #if defined(USE_NGTCP2_CRYPTO_OSSL) || defined(HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_SERVER_CONTEXT) 4858 conn->conn_ref.get_conn = &doq_conn_ref_get_conn; 4859 conn->conn_ref.user_data = conn; 4860 SSL_set_app_data(ssl, &conn->conn_ref); 4861 #else 4862 SSL_set_app_data(ssl, conn); 4863 #endif 4864 SSL_set_accept_state(ssl); 4865 #ifdef HAVE_SSL_SET_QUIC_TLS_EARLY_DATA_ENABLED 4866 SSL_set_quic_tls_early_data_enabled(ssl, 1); 4867 #else 4868 SSL_set_quic_early_data_enabled(ssl, 1); 4869 #endif 4870 return ssl; 4871 } 4872 4873 int 4874 doq_conn_setup(struct doq_conn* conn, uint8_t* scid, size_t scidlen, 4875 uint8_t* ocid, size_t ocidlen, const uint8_t* token, size_t tokenlen) 4876 { 4877 int rv; 4878 struct ngtcp2_cid dcid, sv_scid, scid_cid; 4879 struct ngtcp2_path path; 4880 struct ngtcp2_callbacks callbacks; 4881 struct ngtcp2_settings settings; 4882 struct ngtcp2_transport_params params; 4883 memset(&dcid, 0, sizeof(dcid)); 4884 memset(&sv_scid, 0, sizeof(sv_scid)); 4885 memset(&scid_cid, 0, sizeof(scid_cid)); 4886 memset(&path, 0, sizeof(path)); 4887 memset(&callbacks, 0, sizeof(callbacks)); 4888 memset(&settings, 0, sizeof(settings)); 4889 memset(¶ms, 0, sizeof(params)); 4890 4891 ngtcp2_cid_init(&scid_cid, scid, scidlen); 4892 ngtcp2_cid_init(&dcid, conn->key.dcid, conn->key.dcidlen); 4893 4894 path.remote.addr = (struct sockaddr*)&conn->key.paddr.addr; 4895 path.remote.addrlen = conn->key.paddr.addrlen; 4896 path.local.addr = (struct sockaddr*)&conn->key.paddr.localaddr; 4897 path.local.addrlen = conn->key.paddr.localaddrlen; 4898 4899 callbacks.recv_client_initial = ngtcp2_crypto_recv_client_initial_cb; 4900 callbacks.recv_crypto_data = ngtcp2_crypto_recv_crypto_data_cb; 4901 callbacks.encrypt = ngtcp2_crypto_encrypt_cb; 4902 callbacks.decrypt = ngtcp2_crypto_decrypt_cb; 4903 callbacks.hp_mask = ngtcp2_crypto_hp_mask; 4904 callbacks.update_key = ngtcp2_crypto_update_key_cb; 4905 callbacks.delete_crypto_aead_ctx = 4906 ngtcp2_crypto_delete_crypto_aead_ctx_cb; 4907 callbacks.delete_crypto_cipher_ctx = 4908 ngtcp2_crypto_delete_crypto_cipher_ctx_cb; 4909 callbacks.get_path_challenge_data = 4910 ngtcp2_crypto_get_path_challenge_data_cb; 4911 callbacks.version_negotiation = ngtcp2_crypto_version_negotiation_cb; 4912 callbacks.rand = doq_rand_cb; 4913 callbacks.get_new_connection_id = doq_get_new_connection_id_cb; 4914 callbacks.remove_connection_id = doq_remove_connection_id_cb; 4915 callbacks.handshake_completed = doq_handshake_completed_cb; 4916 callbacks.stream_open = doq_stream_open_cb; 4917 callbacks.stream_close = doq_stream_close_cb; 4918 callbacks.stream_reset = doq_stream_reset_cb; 4919 callbacks.extend_max_stream_data = doq_extend_max_stream_data_cb; 4920 callbacks.acked_stream_data_offset = doq_acked_stream_data_offset_cb; 4921 callbacks.recv_stream_data = doq_recv_stream_data_cb; 4922 4923 ngtcp2_settings_default(&settings); 4924 if(verbosity >= VERB_ALGO) { 4925 settings.log_printf = doq_log_printf_cb; 4926 } 4927 settings.rand_ctx.native_handle = conn->doq_socket->rnd; 4928 settings.initial_ts = doq_get_timestamp_nanosec(); 4929 settings.max_stream_window = 6*1024*1024; 4930 settings.max_window = 6*1024*1024; 4931 #ifdef HAVE_STRUCT_NGTCP2_SETTINGS_TOKENLEN 4932 settings.token = (void*)token; 4933 settings.tokenlen = tokenlen; 4934 #else 4935 settings.token.base = (void*)token; 4936 settings.token.len = tokenlen; 4937 #endif 4938 4939 ngtcp2_transport_params_default(¶ms); 4940 params.max_idle_timeout = conn->doq_socket->idle_timeout; 4941 params.active_connection_id_limit = 7; 4942 params.initial_max_stream_data_bidi_local = 256*1024; 4943 params.initial_max_stream_data_bidi_remote = 256*1024; 4944 params.initial_max_data = 1024*1024; 4945 /* DoQ uses bidi streams, so we allow 0 uni streams. */ 4946 params.initial_max_streams_uni = 0; 4947 /* Initial max on number of bidi streams the remote end can open. 4948 * That is the number of queries it can make, at first. */ 4949 params.initial_max_streams_bidi = 10; 4950 if(ocid) { 4951 ngtcp2_cid_init(¶ms.original_dcid, ocid, ocidlen); 4952 ngtcp2_cid_init(¶ms.retry_scid, conn->key.dcid, 4953 conn->key.dcidlen); 4954 params.retry_scid_present = 1; 4955 } else { 4956 ngtcp2_cid_init(¶ms.original_dcid, conn->key.dcid, 4957 conn->key.dcidlen); 4958 } 4959 #ifdef HAVE_STRUCT_NGTCP2_TRANSPORT_PARAMS_ORIGINAL_DCID_PRESENT 4960 params.original_dcid_present = 1; 4961 #endif 4962 doq_fill_rand(conn->doq_socket->rnd, params.stateless_reset_token, 4963 sizeof(params.stateless_reset_token)); 4964 sv_scid.datalen = conn->doq_socket->sv_scidlen; 4965 lock_rw_wrlock(&conn->table->conid_lock); 4966 if(!doq_conn_generate_new_conid(conn, sv_scid.data, sv_scid.datalen)) { 4967 lock_rw_unlock(&conn->table->conid_lock); 4968 return 0; 4969 } 4970 4971 rv = ngtcp2_conn_server_new(&conn->conn, &scid_cid, &sv_scid, &path, 4972 conn->version, &callbacks, &settings, ¶ms, NULL, conn); 4973 if(rv != 0) { 4974 conn->conn = NULL; 4975 lock_rw_unlock(&conn->table->conid_lock); 4976 log_err("ngtcp2_conn_server_new failed: %s", 4977 ngtcp2_strerror(rv)); 4978 return 0; 4979 } 4980 if(!doq_conn_setup_conids(conn)) { 4981 lock_rw_unlock(&conn->table->conid_lock); 4982 log_err("doq_conn_setup_conids failed: out of memory"); 4983 return 0; 4984 } 4985 lock_rw_unlock(&conn->table->conid_lock); 4986 conn->ssl = doq_ssl_server_setup((SSL_CTX*)conn->doq_socket->ctx, 4987 conn); 4988 if(!conn->ssl) { 4989 log_err("doq_ssl_server_setup failed"); 4990 return 0; 4991 } 4992 #ifdef USE_NGTCP2_CRYPTO_OSSL 4993 ngtcp2_conn_set_tls_native_handle(conn->conn, conn->ossl_ctx); 4994 #else 4995 ngtcp2_conn_set_tls_native_handle(conn->conn, conn->ssl); 4996 #endif 4997 doq_conn_write_enable(conn); 4998 return 1; 4999 } 5000 5001 struct doq_conid* 5002 doq_conid_find(struct doq_table* table, const uint8_t* data, size_t datalen) 5003 { 5004 struct rbnode_type* node; 5005 struct doq_conid key; 5006 key.node.key = &key; 5007 key.cid = (void*)data; 5008 key.cidlen = datalen; 5009 log_assert(table != NULL); 5010 node = rbtree_search(table->conid_tree, &key); 5011 if(node) 5012 return (struct doq_conid*)node->key; 5013 return NULL; 5014 } 5015 5016 /** insert conid in the conid list */ 5017 static void 5018 doq_conid_list_insert(struct doq_conn* conn, struct doq_conid* conid) 5019 { 5020 conid->prev = NULL; 5021 conid->next = conn->conid_list; 5022 if(conn->conid_list) 5023 conn->conid_list->prev = conid; 5024 conn->conid_list = conid; 5025 } 5026 5027 /** remove conid from the conid list */ 5028 static void 5029 doq_conid_list_remove(struct doq_conn* conn, struct doq_conid* conid) 5030 { 5031 if(conid->prev) 5032 conid->prev->next = conid->next; 5033 else conn->conid_list = conid->next; 5034 if(conid->next) 5035 conid->next->prev = conid->prev; 5036 } 5037 5038 /** create a doq_conid */ 5039 static struct doq_conid* 5040 doq_conid_create(uint8_t* data, size_t datalen, struct doq_conn_key* key) 5041 { 5042 struct doq_conid* conid; 5043 conid = calloc(1, sizeof(*conid)); 5044 if(!conid) 5045 return NULL; 5046 conid->cid = memdup(data, datalen); 5047 if(!conid->cid) { 5048 free(conid); 5049 return NULL; 5050 } 5051 conid->cidlen = datalen; 5052 conid->node.key = conid; 5053 conid->key = *key; 5054 conid->key.dcid = memdup(key->dcid, key->dcidlen); 5055 if(!conid->key.dcid) { 5056 free(conid->cid); 5057 free(conid); 5058 return NULL; 5059 } 5060 return conid; 5061 } 5062 5063 void 5064 doq_conid_delete(struct doq_conid* conid) 5065 { 5066 if(!conid) 5067 return; 5068 free(conid->key.dcid); 5069 free(conid->cid); 5070 free(conid); 5071 } 5072 5073 /** return true if the conid is for the conn. */ 5074 static int 5075 conid_is_for_conn(struct doq_conn* conn, struct doq_conid* conid) 5076 { 5077 if(conid->key.dcidlen == conn->key.dcidlen && 5078 memcmp(conid->key.dcid, conn->key.dcid, conid->key.dcidlen)==0 5079 && conid->key.paddr.addrlen == conn->key.paddr.addrlen && 5080 memcmp(&conid->key.paddr.addr, &conn->key.paddr.addr, 5081 conid->key.paddr.addrlen) == 0 && 5082 conid->key.paddr.localaddrlen == conn->key.paddr.localaddrlen && 5083 memcmp(&conid->key.paddr.localaddr, &conn->key.paddr.localaddr, 5084 conid->key.paddr.localaddrlen) == 0 && 5085 conid->key.paddr.ifindex == conn->key.paddr.ifindex) 5086 return 1; 5087 return 0; 5088 } 5089 5090 int 5091 doq_conn_associate_conid(struct doq_conn* conn, uint8_t* data, size_t datalen) 5092 { 5093 struct doq_conid* conid; 5094 conid = doq_conid_find(conn->table, data, datalen); 5095 if(conid && !conid_is_for_conn(conn, conid)) { 5096 verbose(VERB_ALGO, "doq connection id already exists for " 5097 "another doq_conn. Ignoring second connection id."); 5098 /* Already exists to another conn, ignore it. 5099 * This works, in that the conid is listed in the doq_conn 5100 * conid_list element, and removed from there. So our conid 5101 * tree and list are fine, when created and removed. 5102 * The tree now does not have the lookup element pointing 5103 * to this connection. */ 5104 return 1; 5105 } 5106 if(conid) 5107 return 1; /* already inserted */ 5108 conid = doq_conid_create(data, datalen, &conn->key); 5109 if(!conid) 5110 return 0; 5111 doq_conid_list_insert(conn, conid); 5112 (void)rbtree_insert(conn->table->conid_tree, &conid->node); 5113 return 1; 5114 } 5115 5116 void 5117 doq_conn_dissociate_conid(struct doq_conn* conn, const uint8_t* data, 5118 size_t datalen) 5119 { 5120 struct doq_conid* conid; 5121 conid = doq_conid_find(conn->table, data, datalen); 5122 if(conid && !conid_is_for_conn(conn, conid)) 5123 return; 5124 if(conid) { 5125 (void)rbtree_delete(conn->table->conid_tree, 5126 conid->node.key); 5127 doq_conid_list_remove(conn, conid); 5128 doq_conid_delete(conid); 5129 } 5130 } 5131 5132 /** associate the scid array and also the dcid. 5133 * caller must hold the locks on conn and doq_table.conid_lock. */ 5134 static int 5135 doq_conn_setup_id_array_and_dcid(struct doq_conn* conn, 5136 struct ngtcp2_cid* scids, size_t num_scid) 5137 { 5138 size_t i; 5139 for(i=0; i<num_scid; i++) { 5140 if(!doq_conn_associate_conid(conn, scids[i].data, 5141 scids[i].datalen)) 5142 return 0; 5143 } 5144 if(!doq_conn_associate_conid(conn, conn->key.dcid, conn->key.dcidlen)) 5145 return 0; 5146 return 1; 5147 } 5148 5149 int 5150 doq_conn_setup_conids(struct doq_conn* conn) 5151 { 5152 size_t num_scid = 5153 #ifndef HAVE_NGTCP2_CONN_GET_NUM_SCID 5154 ngtcp2_conn_get_scid(conn->conn, NULL); 5155 #else 5156 ngtcp2_conn_get_num_scid(conn->conn); 5157 #endif 5158 if(num_scid <= 4) { 5159 struct ngtcp2_cid ids[4]; 5160 /* Usually there are not that many scids when just accepted, 5161 * like only 2. */ 5162 ngtcp2_conn_get_scid(conn->conn, ids); 5163 return doq_conn_setup_id_array_and_dcid(conn, ids, num_scid); 5164 } else { 5165 struct ngtcp2_cid *scids = calloc(num_scid, 5166 sizeof(struct ngtcp2_cid)); 5167 if(!scids) 5168 return 0; 5169 ngtcp2_conn_get_scid(conn->conn, scids); 5170 if(!doq_conn_setup_id_array_and_dcid(conn, scids, num_scid)) { 5171 free(scids); 5172 return 0; 5173 } 5174 free(scids); 5175 } 5176 return 1; 5177 } 5178 5179 void 5180 doq_conn_clear_conids(struct doq_conn* conn) 5181 { 5182 struct doq_conid* p, *next; 5183 if(!conn) 5184 return; 5185 p = conn->conid_list; 5186 while(p) { 5187 next = p->next; 5188 (void)rbtree_delete(conn->table->conid_tree, p->node.key); 5189 doq_conid_delete(p); 5190 p = next; 5191 } 5192 conn->conid_list = NULL; 5193 } 5194 5195 ngtcp2_tstamp doq_get_timestamp_nanosec(void) 5196 { 5197 struct timespec tp; 5198 memset(&tp, 0, sizeof(tp)); 5199 #ifdef CLOCK_BOOTTIME 5200 if(clock_gettime(CLOCK_BOOTTIME, &tp) == -1) { 5201 #endif 5202 if(clock_gettime(CLOCK_MONOTONIC, &tp) == -1) { 5203 log_err("clock_gettime failed: %s", strerror(errno)); 5204 } 5205 #ifdef CLOCK_BOOTTIME 5206 } 5207 #endif 5208 return ((uint64_t)tp.tv_sec)*((uint64_t)1000000000) + 5209 ((uint64_t)tp.tv_nsec); 5210 } 5211 5212 static struct timeval doq_get_timevalue(void) 5213 { 5214 struct timeval tv; 5215 memset(&tv, 0, sizeof(tv)); 5216 if(gettimeofday(&tv, NULL) < 0) { 5217 log_err("gettimeofday failed: %s", strerror(errno)); 5218 memset(&tv, 0, sizeof(tv)); 5219 } 5220 return tv; 5221 } 5222 5223 /** doq start the closing period for the connection. */ 5224 static int 5225 doq_conn_start_closing_period(struct comm_point* c, struct doq_conn* conn) 5226 { 5227 struct ngtcp2_path_storage ps; 5228 struct ngtcp2_pkt_info pi; 5229 ngtcp2_ssize ret; 5230 if(!conn) 5231 return 1; 5232 if( 5233 #ifdef HAVE_NGTCP2_CONN_IN_CLOSING_PERIOD 5234 ngtcp2_conn_in_closing_period(conn->conn) 5235 #else 5236 ngtcp2_conn_is_in_closing_period(conn->conn) 5237 #endif 5238 ) 5239 return 1; 5240 if( 5241 #ifdef HAVE_NGTCP2_CONN_IN_DRAINING_PERIOD 5242 ngtcp2_conn_in_draining_period(conn->conn) 5243 #else 5244 ngtcp2_conn_is_in_draining_period(conn->conn) 5245 #endif 5246 ) { 5247 doq_conn_write_disable(conn); 5248 return 1; 5249 } 5250 ngtcp2_path_storage_zero(&ps); 5251 sldns_buffer_clear(c->doq_socket->pkt_buf); 5252 /* the call to ngtcp2_conn_write_connection_close causes the 5253 * conn to be closed. It is now in the closing period. */ 5254 ret = ngtcp2_conn_write_connection_close(conn->conn, &ps.path, 5255 &pi, sldns_buffer_begin(c->doq_socket->pkt_buf), 5256 sldns_buffer_remaining(c->doq_socket->pkt_buf), 5257 #ifdef HAVE_NGTCP2_CCERR_DEFAULT 5258 &conn->ccerr 5259 #else 5260 &conn->last_error 5261 #endif 5262 , doq_get_timestamp_nanosec()); 5263 if(ret < 0) { 5264 log_err("doq ngtcp2_conn_write_connection_close failed: %s", 5265 ngtcp2_strerror(ret)); 5266 return 0; 5267 } 5268 if(ret == 0) { 5269 return 0; 5270 } 5271 sldns_buffer_set_position(c->doq_socket->pkt_buf, ret); 5272 sldns_buffer_flip(c->doq_socket->pkt_buf); 5273 5274 /* The close packet is allocated, because it may have to be repeated. 5275 * When incoming packets have this connection dcid. */ 5276 conn->close_pkt = memdup(sldns_buffer_begin(c->doq_socket->pkt_buf), 5277 sldns_buffer_limit(c->doq_socket->pkt_buf)); 5278 if(!conn->close_pkt) { 5279 log_err("doq: could not allocate close packet: out of memory"); 5280 return 0; 5281 } 5282 conn->close_pkt_len = sldns_buffer_limit(c->doq_socket->pkt_buf); 5283 conn->close_ecn = pi.ecn; 5284 return 1; 5285 } 5286 5287 /** doq send the close packet for the connection, perhaps again. */ 5288 int 5289 doq_conn_send_close(struct comm_point* c, struct doq_conn* conn) 5290 { 5291 if(!conn) 5292 return 0; 5293 if(!conn->close_pkt) 5294 return 0; 5295 if(conn->close_pkt_len > sldns_buffer_capacity(c->doq_socket->pkt_buf)) 5296 return 0; 5297 sldns_buffer_clear(c->doq_socket->pkt_buf); 5298 sldns_buffer_write(c->doq_socket->pkt_buf, conn->close_pkt, conn->close_pkt_len); 5299 sldns_buffer_flip(c->doq_socket->pkt_buf); 5300 verbose(VERB_ALGO, "doq send connection close"); 5301 doq_send_pkt(c, &conn->key.paddr, conn->close_ecn); 5302 doq_conn_write_disable(conn); 5303 return 1; 5304 } 5305 5306 /** doq close the connection on error. If it returns a failure, it 5307 * does not wait to send a close, and the connection can be dropped. */ 5308 static int 5309 doq_conn_close_error(struct comm_point* c, struct doq_conn* conn) 5310 { 5311 #ifdef HAVE_NGTCP2_CCERR_DEFAULT 5312 if(conn->ccerr.type == NGTCP2_CCERR_TYPE_IDLE_CLOSE) 5313 return 0; 5314 #else 5315 if(conn->last_error.type == 5316 NGTCP2_CONNECTION_CLOSE_ERROR_CODE_TYPE_TRANSPORT_IDLE_CLOSE) 5317 return 0; 5318 #endif 5319 if(!doq_conn_start_closing_period(c, conn)) 5320 return 0; 5321 if( 5322 #ifdef HAVE_NGTCP2_CONN_IN_DRAINING_PERIOD 5323 ngtcp2_conn_in_draining_period(conn->conn) 5324 #else 5325 ngtcp2_conn_is_in_draining_period(conn->conn) 5326 #endif 5327 ) { 5328 doq_conn_write_disable(conn); 5329 return 1; 5330 } 5331 doq_conn_write_enable(conn); 5332 if(!doq_conn_send_close(c, conn)) 5333 return 0; 5334 return 1; 5335 } 5336 5337 int 5338 doq_conn_recv(struct comm_point* c, struct doq_pkt_addr* paddr, 5339 struct doq_conn* conn, struct ngtcp2_pkt_info* pi, int* err_retry, 5340 int* err_drop) 5341 { 5342 int ret; 5343 struct ngtcp2_path path; 5344 memset(&path, 0, sizeof(path)); 5345 path.remote.addr = (struct sockaddr*)&paddr->addr; 5346 path.remote.addrlen = paddr->addrlen; 5347 path.local.addr = (struct sockaddr*)&paddr->localaddr; 5348 path.local.addrlen = paddr->localaddrlen; 5349 5350 ret = ngtcp2_conn_read_pkt(conn->conn, &path, pi, 5351 sldns_buffer_begin(c->doq_socket->pkt_buf), 5352 sldns_buffer_limit(c->doq_socket->pkt_buf), 5353 doq_get_timestamp_nanosec()); 5354 if(ret != 0) { 5355 if(err_retry) 5356 *err_retry = 0; 5357 if(err_drop) 5358 *err_drop = 0; 5359 if(ret == NGTCP2_ERR_DRAINING) { 5360 verbose(VERB_ALGO, "ngtcp2_conn_read_pkt returned %s", 5361 ngtcp2_strerror(ret)); 5362 doq_conn_write_disable(conn); 5363 return 0; 5364 } else if(ret == NGTCP2_ERR_DROP_CONN) { 5365 verbose(VERB_ALGO, "ngtcp2_conn_read_pkt returned %s", 5366 ngtcp2_strerror(ret)); 5367 if(err_drop) 5368 *err_drop = 1; 5369 return 0; 5370 } else if(ret == NGTCP2_ERR_RETRY) { 5371 verbose(VERB_ALGO, "ngtcp2_conn_read_pkt returned %s", 5372 ngtcp2_strerror(ret)); 5373 if(err_retry) 5374 *err_retry = 1; 5375 if(err_drop) 5376 *err_drop = 1; 5377 return 0; 5378 } else if(ret == NGTCP2_ERR_CRYPTO) { 5379 if( 5380 #ifdef HAVE_NGTCP2_CCERR_DEFAULT 5381 !conn->ccerr.error_code 5382 #else 5383 !conn->last_error.error_code 5384 #endif 5385 ) { 5386 /* in picotls the tls alert may need to be 5387 * copied, but this is with openssl. And there 5388 * is conn->tls_alert. */ 5389 #ifdef HAVE_NGTCP2_CCERR_DEFAULT 5390 ngtcp2_ccerr_set_tls_alert(&conn->ccerr, 5391 conn->tls_alert, NULL, 0); 5392 #else 5393 ngtcp2_connection_close_error_set_transport_error_tls_alert( 5394 &conn->last_error, conn->tls_alert, 5395 NULL, 0); 5396 #endif 5397 } 5398 } else { 5399 if( 5400 #ifdef HAVE_NGTCP2_CCERR_DEFAULT 5401 !conn->ccerr.error_code 5402 #else 5403 !conn->last_error.error_code 5404 #endif 5405 ) { 5406 #ifdef HAVE_NGTCP2_CCERR_DEFAULT 5407 ngtcp2_ccerr_set_liberr(&conn->ccerr, ret, 5408 NULL, 0); 5409 #else 5410 ngtcp2_connection_close_error_set_transport_error_liberr( 5411 &conn->last_error, ret, NULL, 0); 5412 #endif 5413 } 5414 } 5415 log_err("ngtcp2_conn_read_pkt failed: %s", 5416 ngtcp2_strerror(ret)); 5417 if(!doq_conn_close_error(c, conn)) { 5418 if(err_drop) 5419 *err_drop = 1; 5420 } 5421 return 0; 5422 } 5423 doq_conn_write_enable(conn); 5424 return 1; 5425 } 5426 5427 /** doq stream write is done */ 5428 static void 5429 doq_stream_write_is_done(struct doq_conn* conn, struct doq_stream* stream) 5430 { 5431 /* Cannot deallocate, the buffer may be needed for resends. */ 5432 doq_stream_off_write_list(conn, stream); 5433 } 5434 5435 int 5436 doq_conn_write_streams(struct comm_point* c, struct doq_conn* conn, 5437 int* err_drop) 5438 { 5439 struct doq_stream* stream = conn->stream_write_first; 5440 ngtcp2_path_storage ps; 5441 size_t num_packets = 0, max_packets = 65535; 5442 ngtcp2_path_storage_zero(&ps); 5443 5444 for(;;) { 5445 int64_t stream_id; 5446 uint32_t flags = 0; 5447 ngtcp2_pkt_info pi; 5448 ngtcp2_vec datav[2]; 5449 size_t datav_count = 0; 5450 ngtcp2_ssize ret, ndatalen = 0; 5451 int fin; 5452 5453 if(stream) { 5454 /* data to send */ 5455 verbose(VERB_ALGO, "doq: doq_conn write stream %d", 5456 (int)stream->stream_id); 5457 stream_id = stream->stream_id; 5458 fin = 1; 5459 if(stream->nwrite < 2) { 5460 datav[0].base = ((uint8_t*)&stream-> 5461 outlen_wire) + stream->nwrite; 5462 datav[0].len = 2 - stream->nwrite; 5463 datav[1].base = stream->out; 5464 datav[1].len = stream->outlen; 5465 datav_count = 2; 5466 } else { 5467 datav[0].base = stream->out + 5468 (stream->nwrite-2); 5469 datav[0].len = stream->outlen - 5470 (stream->nwrite-2); 5471 datav_count = 1; 5472 } 5473 } else { 5474 /* no data to send */ 5475 verbose(VERB_ALGO, "doq: doq_conn write stream -1"); 5476 stream_id = -1; 5477 fin = 0; 5478 datav[0].base = NULL; 5479 datav[0].len = 0; 5480 datav_count = 1; 5481 } 5482 5483 /* if more streams, set it to write more */ 5484 if(stream && stream->write_next) 5485 flags |= NGTCP2_WRITE_STREAM_FLAG_MORE; 5486 if(fin) 5487 flags |= NGTCP2_WRITE_STREAM_FLAG_FIN; 5488 5489 sldns_buffer_clear(c->doq_socket->pkt_buf); 5490 ret = ngtcp2_conn_writev_stream(conn->conn, &ps.path, &pi, 5491 sldns_buffer_begin(c->doq_socket->pkt_buf), 5492 sldns_buffer_remaining(c->doq_socket->pkt_buf), 5493 &ndatalen, flags, stream_id, datav, datav_count, 5494 doq_get_timestamp_nanosec()); 5495 if(ret < 0) { 5496 if(ret == NGTCP2_ERR_WRITE_MORE) { 5497 verbose(VERB_ALGO, "doq: write more, ndatalen %d", (int)ndatalen); 5498 if(stream) { 5499 if(ndatalen >= 0) 5500 stream->nwrite += ndatalen; 5501 if(stream->nwrite >= stream->outlen+2) 5502 doq_stream_write_is_done( 5503 conn, stream); 5504 stream = stream->write_next; 5505 } 5506 continue; 5507 } else if(ret == NGTCP2_ERR_STREAM_DATA_BLOCKED) { 5508 verbose(VERB_ALGO, "doq: ngtcp2_conn_writev_stream returned NGTCP2_ERR_STREAM_DATA_BLOCKED"); 5509 if(stream) { 5510 doq_stream_off_write_list(conn, stream); 5511 stream = stream->write_next; 5512 continue; 5513 } else { 5514 break; 5515 } 5516 } else if(ret == NGTCP2_ERR_STREAM_SHUT_WR) { 5517 verbose(VERB_ALGO, "doq: ngtcp2_conn_writev_stream returned NGTCP2_ERR_STREAM_SHUT_WR"); 5518 #ifdef HAVE_NGTCP2_CCERR_DEFAULT 5519 ngtcp2_ccerr_set_application_error( 5520 &conn->ccerr, DOQ_APP_ERROR_CODE, NULL, 0); 5521 #else 5522 ngtcp2_connection_close_error_set_application_error(&conn->last_error, DOQ_APP_ERROR_CODE, NULL, 0); 5523 #endif 5524 if(err_drop) 5525 *err_drop = 0; 5526 if(!doq_conn_close_error(c, conn)) { 5527 if(err_drop) 5528 *err_drop = 1; 5529 } 5530 return 0; 5531 } 5532 5533 log_err("doq: ngtcp2_conn_writev_stream failed: %s", 5534 ngtcp2_strerror(ret)); 5535 #ifdef HAVE_NGTCP2_CCERR_DEFAULT 5536 ngtcp2_ccerr_set_liberr(&conn->ccerr, ret, NULL, 0); 5537 #else 5538 ngtcp2_connection_close_error_set_transport_error_liberr( 5539 &conn->last_error, ret, NULL, 0); 5540 #endif 5541 if(err_drop) 5542 *err_drop = 0; 5543 if(!doq_conn_close_error(c, conn)) { 5544 if(err_drop) 5545 *err_drop = 1; 5546 } 5547 return 0; 5548 } 5549 verbose(VERB_ALGO, "doq: writev_stream pkt size %d ndatawritten %d", 5550 (int)ret, (int)ndatalen); 5551 5552 if(ndatalen >= 0 && stream) { 5553 stream->nwrite += ndatalen; 5554 if(stream->nwrite >= stream->outlen+2) 5555 doq_stream_write_is_done(conn, stream); 5556 } 5557 if(ret == 0) { 5558 /* congestion limited */ 5559 doq_conn_write_disable(conn); 5560 ngtcp2_conn_update_pkt_tx_time(conn->conn, 5561 doq_get_timestamp_nanosec()); 5562 return 1; 5563 } 5564 sldns_buffer_set_position(c->doq_socket->pkt_buf, ret); 5565 sldns_buffer_flip(c->doq_socket->pkt_buf); 5566 doq_send_pkt(c, &conn->key.paddr, pi.ecn); 5567 5568 if(c->doq_socket->have_blocked_pkt) 5569 break; 5570 if(++num_packets == max_packets) 5571 break; 5572 if(stream) 5573 stream = stream->write_next; 5574 } 5575 ngtcp2_conn_update_pkt_tx_time(conn->conn, doq_get_timestamp_nanosec()); 5576 return 1; 5577 } 5578 5579 void 5580 doq_conn_write_enable(struct doq_conn* conn) 5581 { 5582 conn->write_interest = 1; 5583 } 5584 5585 void 5586 doq_conn_write_disable(struct doq_conn* conn) 5587 { 5588 conn->write_interest = 0; 5589 } 5590 5591 /** doq append the connection to the write list */ 5592 static void 5593 doq_conn_write_list_append(struct doq_table* table, struct doq_conn* conn) 5594 { 5595 if(conn->on_write_list) 5596 return; 5597 conn->write_prev = table->write_list_last; 5598 if(table->write_list_last) 5599 table->write_list_last->write_next = conn; 5600 else table->write_list_first = conn; 5601 conn->write_next = NULL; 5602 table->write_list_last = conn; 5603 conn->on_write_list = 1; 5604 } 5605 5606 void 5607 doq_conn_write_list_remove(struct doq_table* table, struct doq_conn* conn) 5608 { 5609 if(!conn->on_write_list) 5610 return; 5611 if(conn->write_next) 5612 conn->write_next->write_prev = conn->write_prev; 5613 else table->write_list_last = conn->write_prev; 5614 if(conn->write_prev) 5615 conn->write_prev->write_next = conn->write_next; 5616 else table->write_list_first = conn->write_next; 5617 conn->write_prev = NULL; 5618 conn->write_next = NULL; 5619 conn->on_write_list = 0; 5620 } 5621 5622 void 5623 doq_conn_set_write_list(struct doq_table* table, struct doq_conn* conn) 5624 { 5625 if(conn->write_interest && conn->on_write_list) 5626 return; 5627 if(!conn->write_interest && !conn->on_write_list) 5628 return; 5629 if(conn->write_interest) 5630 doq_conn_write_list_append(table, conn); 5631 else doq_conn_write_list_remove(table, conn); 5632 } 5633 5634 struct doq_conn* 5635 doq_table_pop_first(struct doq_table* table) 5636 { 5637 struct doq_conn* conn = table->write_list_first; 5638 if(!conn) 5639 return NULL; 5640 lock_basic_lock(&conn->lock); 5641 table->write_list_first = conn->write_next; 5642 if(conn->write_next) 5643 conn->write_next->write_prev = NULL; 5644 else table->write_list_last = NULL; 5645 conn->write_next = NULL; 5646 conn->write_prev = NULL; 5647 conn->on_write_list = 0; 5648 return conn; 5649 } 5650 5651 int 5652 doq_conn_check_timer(struct doq_conn* conn, struct timeval* tv, ngtcp2_tstamp* ts) 5653 { 5654 ngtcp2_tstamp doq_expiry = ngtcp2_conn_get_expiry(conn->conn); 5655 ngtcp2_tstamp doq_now = doq_get_timestamp_nanosec(); 5656 ngtcp2_tstamp t; 5657 struct timeval now = doq_get_timevalue(); 5658 5659 if(doq_expiry <= doq_now || doq_expiry == UINT64_MAX) { 5660 /* UINT64_MAX means there is no next expiry. */ 5661 /* The timer has already expired, add with zero timeout. 5662 * This should call the callback straight away. Calling it 5663 * from the event callbacks is cleaner than calling it here, 5664 * because then it is always called with the same locks and 5665 * so on. This routine only has the conn.lock. */ 5666 t = doq_now; 5667 memcpy(tv, &now, sizeof(*tv)); 5668 } else { 5669 t = doq_expiry; 5670 memset(tv, 0, sizeof(*tv)); 5671 tv->tv_sec = (doq_expiry - doq_now) / NGTCP2_SECONDS; 5672 tv->tv_usec = ((doq_expiry - doq_now) / NGTCP2_MICROSECONDS)%1000000; 5673 timeval_add(tv, &now); 5674 } 5675 5676 *ts = t; 5677 5678 /* If we already have a timer, is it the right value? */ 5679 if(conn->timer.timer_in_tree || conn->timer.timer_in_list) { 5680 if(conn->timer.time_mono == *ts) 5681 return 0; 5682 } 5683 return 1; 5684 } 5685 5686 /* doq print connection log */ 5687 static void 5688 doq_conn_log_line(struct doq_conn* conn, char* s) 5689 { 5690 char remotestr[256], localstr[256]; 5691 addr_to_str((void*)&conn->key.paddr.addr, conn->key.paddr.addrlen, 5692 remotestr, sizeof(remotestr)); 5693 addr_to_str((void*)&conn->key.paddr.localaddr, 5694 conn->key.paddr.localaddrlen, localstr, sizeof(localstr)); 5695 log_info("doq conn %s %s %s", remotestr, localstr, s); 5696 } 5697 5698 int 5699 doq_conn_handle_timeout(struct doq_conn* conn) 5700 { 5701 int rv; 5702 5703 if(verbosity >= VERB_ALGO) 5704 doq_conn_log_line(conn, "timeout"); 5705 5706 rv = ngtcp2_conn_handle_expiry(conn->conn, doq_get_timestamp_nanosec()); 5707 if(rv != 0) { 5708 verbose(VERB_ALGO, "ngtcp2_conn_handle_expiry failed: %s", 5709 ngtcp2_strerror(rv)); 5710 #ifdef HAVE_NGTCP2_CCERR_DEFAULT 5711 ngtcp2_ccerr_set_liberr(&conn->ccerr, rv, NULL, 0); 5712 #else 5713 ngtcp2_connection_close_error_set_transport_error_liberr( 5714 &conn->last_error, rv, NULL, 0); 5715 #endif 5716 if(!doq_conn_close_error(conn->doq_socket->cp, conn)) { 5717 /* failed, return for deletion */ 5718 return 0; 5719 } 5720 return 1; 5721 } 5722 doq_conn_write_enable(conn); 5723 if(!doq_conn_write_streams(conn->doq_socket->cp, conn, NULL)) { 5724 /* failed, return for deletion. */ 5725 return 0; 5726 } 5727 return 1; 5728 } 5729 5730 void 5731 doq_table_quic_size_add(struct doq_table* table, size_t add) 5732 { 5733 lock_basic_lock(&table->size_lock); 5734 table->current_size += add; 5735 lock_basic_unlock(&table->size_lock); 5736 } 5737 5738 void 5739 doq_table_quic_size_subtract(struct doq_table* table, size_t subtract) 5740 { 5741 lock_basic_lock(&table->size_lock); 5742 if(table->current_size < subtract) 5743 table->current_size = 0; 5744 else table->current_size -= subtract; 5745 lock_basic_unlock(&table->size_lock); 5746 } 5747 5748 int 5749 doq_table_quic_size_available(struct doq_table* table, 5750 struct config_file* cfg, size_t mem) 5751 { 5752 size_t cur; 5753 if (!table) 5754 return 0; 5755 lock_basic_lock(&table->size_lock); 5756 cur = table->current_size; 5757 lock_basic_unlock(&table->size_lock); 5758 5759 if(cur + mem > cfg->quic_size) 5760 return 0; 5761 return 1; 5762 } 5763 5764 size_t doq_table_quic_size_get(struct doq_table* table) 5765 { 5766 size_t sz; 5767 if(!table) 5768 return 0; 5769 lock_basic_lock(&table->size_lock); 5770 sz = table->current_size; 5771 lock_basic_unlock(&table->size_lock); 5772 return sz; 5773 } 5774 #endif /* HAVE_NGTCP2 */ 5775
Indexes created Sat Oct 03 00:25:10 UTC 2026