1 /* $NetBSD: resolver.c,v 1.21 2025/01/26 16:25:25 christos Exp $ */ 2 3 /* 4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC") 5 * 6 * SPDX-License-Identifier: MPL-2.0 7 * 8 * This Source Code Form is subject to the terms of the Mozilla Public 9 * License, v. 2.0. If a copy of the MPL was not distributed with this 10 * file, you can obtain one at https://mozilla.org/MPL/2.0/. 11 * 12 * See the COPYRIGHT file distributed with this work for additional 13 * information regarding copyright ownership. 14 */ 15 16 /*! \file */ 17 18 #include <ctype.h> 19 #include <inttypes.h> 20 #include <stdbool.h> 21 22 #include <isc/ascii.h> 23 #include <isc/async.h> 24 #include <isc/atomic.h> 25 #include <isc/counter.h> 26 #include <isc/hash.h> 27 #include <isc/hashmap.h> 28 #include <isc/log.h> 29 #include <isc/loop.h> 30 #include <isc/mutex.h> 31 #include <isc/random.h> 32 #include <isc/refcount.h> 33 #include <isc/result.h> 34 #include <isc/rwlock.h> 35 #include <isc/siphash.h> 36 #include <isc/stats.h> 37 #include <isc/string.h> 38 #include <isc/tid.h> 39 #include <isc/time.h> 40 #include <isc/timer.h> 41 #include <isc/util.h> 42 43 #include <dns/acl.h> 44 #include <dns/adb.h> 45 #include <dns/cache.h> 46 #include <dns/db.h> 47 #include <dns/dispatch.h> 48 #include <dns/dns64.h> 49 #include <dns/dnstap.h> 50 #include <dns/ds.h> 51 #include <dns/edns.h> 52 #include <dns/forward.h> 53 #include <dns/keytable.h> 54 #include <dns/log.h> 55 #include <dns/message.h> 56 #include <dns/name.h> 57 #include <dns/nametree.h> 58 #include <dns/ncache.h> 59 #include <dns/nsec.h> 60 #include <dns/nsec3.h> 61 #include <dns/opcode.h> 62 #include <dns/peer.h> 63 #include <dns/rbt.h> 64 #include <dns/rcode.h> 65 #include <dns/rdata.h> 66 #include <dns/rdataclass.h> 67 #include <dns/rdatalist.h> 68 #include <dns/rdataset.h> 69 #include <dns/rdatastruct.h> 70 #include <dns/rdatatype.h> 71 #include <dns/resolver.h> 72 #include <dns/rootns.h> 73 #include <dns/stats.h> 74 #include <dns/tsig.h> 75 #include <dns/validator.h> 76 #include <dns/zone.h> 77 78 #ifdef WANT_QUERYTRACE 79 #define RTRACE(m) \ 80 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 81 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), "res %p: %s", \ 82 res, (m)) 83 #define RRTRACE(r, m) \ 84 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 85 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), "res %p: %s", \ 86 (r), (m)) 87 #define FCTXTRACE(m) \ 88 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 89 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 90 "fctx %p(%s): %s", fctx, fctx->info, (m)) 91 #define FCTXTRACE2(m1, m2) \ 92 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 93 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 94 "fctx %p(%s): %s %s", fctx, fctx->info, (m1), (m2)) 95 #define FCTXTRACE3(m, res) \ 96 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 97 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 98 "fctx %p(%s): [result: %s] %s", fctx, fctx->info, \ 99 isc_result_totext(res), (m)) 100 #define FCTXTRACE4(m1, m2, res) \ 101 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 102 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 103 "fctx %p(%s): [result: %s] %s %s", fctx, fctx->info, \ 104 isc_result_totext(res), (m1), (m2)) 105 #define FCTXTRACE5(m1, m2, v) \ 106 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 107 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 108 "fctx %p(%s): %s %s%u", fctx, fctx->info, (m1), (m2), \ 109 (v)) 110 #define FTRACE(m) \ 111 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 112 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 113 "fetch %p (fctx %p(%s)): %s", fetch, fetch->private, \ 114 fetch->private->info, (m)) 115 #define QTRACE(m) \ 116 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ 117 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ 118 "resquery %p (fctx %p(%s)): %s", query, query->fctx, \ 119 query->fctx->info, (m)) 120 #else /* ifdef WANT_QUERYTRACE */ 121 #define RTRACE(m) \ 122 do { \ 123 UNUSED(m); \ 124 } while (0) 125 #define RRTRACE(r, m) \ 126 do { \ 127 UNUSED(r); \ 128 UNUSED(m); \ 129 } while (0) 130 #define FCTXTRACE(m) \ 131 do { \ 132 UNUSED(fctx); \ 133 UNUSED(m); \ 134 } while (0) 135 #define FCTXTRACE2(m1, m2) \ 136 do { \ 137 UNUSED(fctx); \ 138 UNUSED(m1); \ 139 UNUSED(m2); \ 140 } while (0) 141 #define FCTXTRACE3(m1, res) \ 142 do { \ 143 UNUSED(fctx); \ 144 UNUSED(m1); \ 145 UNUSED(res); \ 146 } while (0) 147 #define FCTXTRACE4(m1, m2, res) \ 148 do { \ 149 UNUSED(fctx); \ 150 UNUSED(m1); \ 151 UNUSED(m2); \ 152 UNUSED(res); \ 153 } while (0) 154 #define FCTXTRACE5(m1, m2, v) \ 155 do { \ 156 UNUSED(fctx); \ 157 UNUSED(m1); \ 158 UNUSED(m2); \ 159 UNUSED(v); \ 160 } while (0) 161 #define FTRACE(m) \ 162 do { \ 163 UNUSED(m); \ 164 } while (0) 165 #define QTRACE(m) \ 166 do { \ 167 UNUSED(m); \ 168 } while (0) 169 #endif /* WANT_QUERYTRACE */ 170 171 /* 172 * The maximum time we will wait for a single query. 173 */ 174 #define MAX_SINGLE_QUERY_TIMEOUT 9000U 175 #define MAX_SINGLE_QUERY_TIMEOUT_US (MAX_SINGLE_QUERY_TIMEOUT * US_PER_MS) 176 177 /* 178 * The default maximum number of validations and validation failures per-fetch 179 */ 180 #ifndef DEFAULT_MAX_VALIDATIONS 181 #define DEFAULT_MAX_VALIDATIONS 16 182 #endif 183 #ifndef DEFAULT_MAX_VALIDATION_FAILURES 184 #define DEFAULT_MAX_VALIDATION_FAILURES 1 185 #endif 186 187 /* 188 * A minumum sane timeout value for the whole query to live when e.g. talking to 189 * a backend server and a quick timeout is preferred by the user. 190 * 191 * IMPORTANT: if changing this value, note there is a documented behavior when 192 * values of 'resolver-query-timeout' less than or equal to 300 are treated as 193 * seconds and converted to milliseconds before applying the limits, that's 194 * why the value of 301 was chosen as the absolute minimum in order to not break 195 * backward compatibility. 196 */ 197 #define MINIMUM_QUERY_TIMEOUT 301U 198 199 /* 200 * The default time in seconds for the whole query to live. 201 * We want to allow an individual query time to complete / timeout. 202 */ 203 #ifndef DEFAULT_QUERY_TIMEOUT 204 #define DEFAULT_QUERY_TIMEOUT (MAX_SINGLE_QUERY_TIMEOUT + 1000U) 205 #endif /* ifndef DEFAULT_QUERY_TIMEOUT */ 206 207 /* The maximum time in seconds for the whole query to live. */ 208 #ifndef MAXIMUM_QUERY_TIMEOUT 209 #define MAXIMUM_QUERY_TIMEOUT 30000 210 #endif /* ifndef MAXIMUM_QUERY_TIMEOUT */ 211 212 /* The default maximum number of recursions to follow before giving up. */ 213 #ifndef DEFAULT_RECURSION_DEPTH 214 #define DEFAULT_RECURSION_DEPTH 7 215 #endif /* ifndef DEFAULT_RECURSION_DEPTH */ 216 217 /* The default maximum number of iterative queries to allow before giving up. */ 218 #ifndef DEFAULT_MAX_QUERIES 219 #define DEFAULT_MAX_QUERIES 50 220 #endif /* ifndef DEFAULT_MAX_QUERIES */ 221 222 /* 223 * After NS_FAIL_LIMIT attempts to fetch a name server address, 224 * if the number of addresses in the NS RRset exceeds NS_RR_LIMIT, 225 * stop trying to fetch, in order to avoid wasting resources. 226 */ 227 #define NS_FAIL_LIMIT 4 228 #define NS_RR_LIMIT 5 229 /* 230 * IP address lookups are performed for at most NS_PROCESSING_LIMIT NS RRs in 231 * any NS RRset encountered, to avoid excessive resource use while processing 232 * large delegations. 233 */ 234 #define NS_PROCESSING_LIMIT 20 235 236 STATIC_ASSERT(NS_PROCESSING_LIMIT > NS_RR_LIMIT, 237 "The maximum number of NS RRs processed for each delegation " 238 "(NS_PROCESSING_LIMIT) must be larger than the large delegation " 239 "threshold (NS_RR_LIMIT)."); 240 241 /* Hash table for zone counters */ 242 #ifndef RES_DOMAIN_HASH_BITS 243 #define RES_DOMAIN_HASH_BITS 12 244 #endif /* ifndef RES_DOMAIN_HASH_BITS */ 245 246 /*% 247 * Maximum EDNS0 input packet size. 248 */ 249 #define RECV_BUFFER_SIZE 4096 /* XXXRTH Constant. */ 250 251 /*% 252 * This defines the maximum number of timeouts we will permit before we 253 * disable EDNS0 on the query. 254 */ 255 #define MAX_EDNS0_TIMEOUTS 3 256 257 typedef struct fetchctx fetchctx_t; 258 259 typedef struct query { 260 /* Locked by loop event serialization. */ 261 unsigned int magic; 262 isc_refcount_t references; 263 fetchctx_t *fctx; 264 dns_message_t *rmessage; 265 dns_dispatchmgr_t *dispatchmgr; 266 dns_dispatch_t *dispatch; 267 dns_adbaddrinfo_t *addrinfo; 268 isc_time_t start; 269 dns_messageid_t id; 270 dns_dispentry_t *dispentry; 271 ISC_LINK(struct query) link; 272 isc_buffer_t buffer; 273 isc_buffer_t *tsig; 274 dns_tsigkey_t *tsigkey; 275 int ednsversion; 276 unsigned int options; 277 unsigned int attributes; 278 unsigned int udpsize; 279 unsigned char data[512]; 280 } resquery_t; 281 282 #if DNS_RESOLVER_TRACE 283 #define resquery_ref(ptr) resquery__ref(ptr, __func__, __FILE__, __LINE__) 284 #define resquery_unref(ptr) resquery__unref(ptr, __func__, __FILE__, __LINE__) 285 #define resquery_attach(ptr, ptrp) \ 286 resquery__attach(ptr, ptrp, __func__, __FILE__, __LINE__) 287 #define resquery_detach(ptrp) \ 288 resquery__detach(ptrp, __func__, __FILE__, __LINE__) 289 ISC_REFCOUNT_TRACE_DECL(resquery); 290 #else 291 ISC_REFCOUNT_DECL(resquery); 292 #endif 293 294 struct tried { 295 isc_sockaddr_t addr; 296 unsigned int count; 297 ISC_LINK(struct tried) link; 298 }; 299 300 #define QUERY_MAGIC ISC_MAGIC('Q', '!', '!', '!') 301 #define VALID_QUERY(query) ISC_MAGIC_VALID(query, QUERY_MAGIC) 302 303 #define RESQUERY_ATTR_CANCELED 0x02 304 305 #define RESQUERY_CONNECTING(q) ((q)->connects > 0) 306 #define RESQUERY_CANCELED(q) (((q)->attributes & RESQUERY_ATTR_CANCELED) != 0) 307 #define RESQUERY_SENDING(q) ((q)->sends > 0) 308 309 typedef enum { 310 fetchstate_active, 311 fetchstate_done /*%< Fetch completion events posted. */ 312 } fetchstate_t; 313 314 typedef enum { 315 badns_unreachable = 0, 316 badns_response, 317 badns_validation, 318 badns_forwarder, 319 } badnstype_t; 320 321 #define FCTXCOUNT_MAGIC ISC_MAGIC('F', 'C', 'n', 't') 322 #define VALID_FCTXCOUNT(counter) ISC_MAGIC_VALID(counter, FCTXCOUNT_MAGIC) 323 324 typedef struct fctxcount fctxcount_t; 325 struct fctxcount { 326 unsigned int magic; 327 isc_mem_t *mctx; 328 isc_mutex_t lock; 329 dns_fixedname_t dfname; 330 dns_name_t *domain; 331 uint_fast32_t count; 332 uint_fast32_t allowed; 333 uint_fast32_t dropped; 334 isc_stdtime_t logged; 335 }; 336 337 struct fetchctx { 338 /*% Not locked. */ 339 unsigned int magic; 340 dns_resolver_t *res; 341 dns_fixedname_t fname; 342 dns_name_t *name; 343 dns_rdatatype_t type; 344 unsigned int options; 345 fctxcount_t *counter; 346 char *info; 347 isc_mem_t *mctx; 348 isc_stdtime_t now; 349 350 isc_loop_t *loop; 351 unsigned int tid; 352 353 /* Atomic */ 354 isc_refcount_t references; 355 356 /*% Locked by lock. */ 357 isc_mutex_t lock; 358 fetchstate_t state; 359 bool hashed; 360 bool cloned; 361 bool spilled; 362 ISC_LINK(struct fetchctx) link; 363 ISC_LIST(dns_fetchresponse_t) resps; 364 365 /*% Locked by loop event serialization. */ 366 dns_fixedname_t dfname; 367 dns_name_t *domain; 368 dns_rdataset_t nameservers; 369 atomic_uint_fast32_t attributes; 370 isc_timer_t *timer; 371 isc_time_t expires; 372 isc_time_t next_timeout; 373 isc_interval_t interval; 374 dns_message_t *qmessage; 375 ISC_LIST(resquery_t) queries; 376 dns_adbfindlist_t finds; 377 dns_adbfind_t *find; 378 /* 379 * altfinds are names and/or addresses of dual stack servers that 380 * should be used when iterative resolution to a server is not 381 * possible because the address family of that server is not usable. 382 */ 383 dns_adbfindlist_t altfinds; 384 dns_adbfind_t *altfind; 385 dns_adbaddrinfolist_t forwaddrs; 386 dns_adbaddrinfolist_t altaddrs; 387 dns_forwarderlist_t forwarders; 388 dns_fwdpolicy_t fwdpolicy; 389 isc_sockaddrlist_t bad; 390 ISC_LIST(struct tried) edns; 391 isc_sockaddrlist_t bad_edns; 392 dns_validator_t *validator; 393 ISC_LIST(dns_validator_t) validators; 394 dns_db_t *cache; 395 dns_adb_t *adb; 396 bool ns_ttl_ok; 397 uint32_t ns_ttl; 398 isc_counter_t *qc; 399 bool minimized; 400 unsigned int qmin_labels; 401 isc_result_t qmin_warning; 402 bool force_qmin_warning; 403 bool ip6arpaskip; 404 bool forwarding; 405 dns_fixedname_t qminfname; 406 dns_name_t *qminname; 407 dns_rdatatype_t qmintype; 408 dns_fetch_t *qminfetch; 409 dns_rdataset_t qminrrset; 410 dns_fixedname_t qmindcfname; 411 dns_name_t *qmindcname; 412 dns_fixedname_t fwdfname; 413 dns_name_t *fwdname; 414 415 /*% 416 * The number of events we're waiting for. 417 */ 418 atomic_uint_fast32_t pending; 419 420 /*% 421 * The number of times we've "restarted" the current 422 * nameserver set. This acts as a failsafe to prevent 423 * us from pounding constantly on a particular set of 424 * servers that, for whatever reason, are not giving 425 * us useful responses, but are responding in such a 426 * way that they are not marked "bad". 427 */ 428 unsigned int restarts; 429 430 /*% 431 * The number of timeouts that have occurred since we 432 * last successfully received a response packet. This 433 * is used for EDNS0 black hole detection. 434 */ 435 unsigned int timeouts; 436 437 /*% 438 * Look aside state for DS lookups. 439 */ 440 dns_fixedname_t nsfname; 441 dns_name_t *nsname; 442 443 dns_fetch_t *nsfetch; 444 dns_rdataset_t nsrrset; 445 446 /*% 447 * Number of queries that reference this context. 448 */ 449 atomic_uint_fast32_t nqueries; /* Bucket lock. */ 450 451 /*% 452 * Random numbers to use for mixing up server addresses. 453 */ 454 uint32_t rand_buf; 455 uint32_t rand_bits; 456 457 /*% 458 * Fetch-local statistics for detailed logging. 459 */ 460 isc_result_t result; /*%< fetch result */ 461 isc_result_t vresult; /*%< validation result */ 462 isc_time_t start; 463 uint64_t duration; 464 bool logged; 465 unsigned int querysent; 466 unsigned int referrals; 467 unsigned int lamecount; 468 unsigned int quotacount; 469 unsigned int neterr; 470 unsigned int badresp; 471 unsigned int adberr; 472 unsigned int findfail; 473 unsigned int valfail; 474 bool timeout; 475 dns_adbaddrinfo_t *addrinfo; 476 unsigned int depth; 477 char clientstr[ISC_SOCKADDR_FORMATSIZE]; 478 479 uint32_t nvalidations; 480 uint32_t nfails; 481 }; 482 483 #define FCTX_MAGIC ISC_MAGIC('F', '!', '!', '!') 484 #define VALID_FCTX(fctx) ISC_MAGIC_VALID(fctx, FCTX_MAGIC) 485 486 #define FCTX_ATTR_HAVEANSWER 0x0001 487 #define FCTX_ATTR_GLUING 0x0002 488 #define FCTX_ATTR_ADDRWAIT 0x0004 489 #define FCTX_ATTR_WANTCACHE 0x0010 490 #define FCTX_ATTR_WANTNCACHE 0x0020 491 #define FCTX_ATTR_NEEDEDNS0 0x0040 492 #define FCTX_ATTR_TRIEDFIND 0x0080 493 #define FCTX_ATTR_TRIEDALT 0x0100 494 495 #define HAVE_ANSWER(f) \ 496 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_HAVEANSWER) != 0) 497 #define GLUING(f) \ 498 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_GLUING) != 0) 499 #define ADDRWAIT(f) \ 500 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_ADDRWAIT) != 0) 501 #define SHUTTINGDOWN(f) ((f)->state == fetchstate_done) 502 #define WANTCACHE(f) \ 503 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_WANTCACHE) != 0) 504 #define WANTNCACHE(f) \ 505 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_WANTNCACHE) != 0) 506 #define NEEDEDNS0(f) \ 507 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_NEEDEDNS0) != 0) 508 #define TRIEDFIND(f) \ 509 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_TRIEDFIND) != 0) 510 #define TRIEDALT(f) \ 511 ((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_TRIEDALT) != 0) 512 513 #define FCTX_ATTR_SET(f, a) atomic_fetch_or_release(&(f)->attributes, (a)) 514 #define FCTX_ATTR_CLR(f, a) atomic_fetch_and_release(&(f)->attributes, ~(a)) 515 516 typedef struct { 517 dns_adbaddrinfo_t *addrinfo; 518 fetchctx_t *fctx; 519 } dns_valarg_t; 520 521 struct dns_fetch { 522 unsigned int magic; 523 isc_mem_t *mctx; 524 dns_resolver_t *res; 525 fetchctx_t *private; 526 }; 527 528 #define DNS_FETCH_MAGIC ISC_MAGIC('F', 't', 'c', 'h') 529 #define DNS_FETCH_VALID(fetch) ISC_MAGIC_VALID(fetch, DNS_FETCH_MAGIC) 530 531 typedef struct alternate { 532 bool isaddress; 533 union { 534 isc_sockaddr_t addr; 535 struct { 536 dns_name_t name; 537 in_port_t port; 538 } _n; 539 } _u; 540 ISC_LINK(struct alternate) link; 541 } alternate_t; 542 543 struct dns_resolver { 544 /* Unlocked. */ 545 unsigned int magic; 546 isc_mem_t *mctx; 547 isc_mutex_t lock; 548 isc_mutex_t primelock; 549 dns_rdataclass_t rdclass; 550 isc_loopmgr_t *loopmgr; 551 isc_nm_t *nm; 552 dns_view_t *view; 553 bool frozen; 554 unsigned int options; 555 isc_tlsctx_cache_t *tlsctx_cache; 556 dns_dispatchset_t *dispatches4; 557 dns_dispatchset_t *dispatches6; 558 559 isc_hashmap_t *fctxs; 560 isc_rwlock_t fctxs_lock; 561 562 isc_hashmap_t *counters; 563 isc_rwlock_t counters_lock; 564 565 uint32_t lame_ttl; 566 ISC_LIST(alternate_t) alternates; 567 dns_nametree_t *algorithms; 568 dns_nametree_t *digests; 569 dns_nametree_t *mustbesecure; 570 unsigned int spillatmax; 571 unsigned int spillatmin; 572 isc_timer_t *spillattimer; 573 bool zero_no_soa_ttl; 574 unsigned int query_timeout; 575 unsigned int maxdepth; 576 unsigned int maxqueries; 577 isc_result_t quotaresp[2]; 578 isc_stats_t *stats; 579 dns_stats_t *querystats; 580 581 /* Additions for serve-stale feature. */ 582 unsigned int retryinterval; /* in milliseconds */ 583 unsigned int nonbackofftries; 584 585 /* Atomic */ 586 isc_refcount_t references; 587 atomic_uint_fast32_t zspill; /* fetches-per-zone */ 588 atomic_bool exiting; 589 atomic_bool priming; 590 591 atomic_uint_fast32_t maxvalidations; 592 atomic_uint_fast32_t maxvalidationfails; 593 594 /* Locked by lock. */ 595 unsigned int spillat; /* clients-per-query */ 596 597 /* Locked by primelock. */ 598 dns_fetch_t *primefetch; 599 600 /* Atomic. */ 601 atomic_uint_fast32_t nfctx; 602 603 uint32_t nloops; 604 605 isc_mempool_t **namepools; 606 isc_mempool_t **rdspools; 607 }; 608 609 #define RES_MAGIC ISC_MAGIC('R', 'e', 's', '!') 610 #define VALID_RESOLVER(res) ISC_MAGIC_VALID(res, RES_MAGIC) 611 612 /*% 613 * Private addrinfo flags. 614 */ 615 enum { 616 FCTX_ADDRINFO_MARK = 1 << 0, 617 FCTX_ADDRINFO_FORWARDER = 1 << 1, 618 FCTX_ADDRINFO_EDNSOK = 1 << 2, 619 FCTX_ADDRINFO_NOCOOKIE = 1 << 3, 620 FCTX_ADDRINFO_BADCOOKIE = 1 << 4, 621 FCTX_ADDRINFO_DUALSTACK = 1 << 5, 622 FCTX_ADDRINFO_NOEDNS0 = 1 << 6, 623 }; 624 625 #define UNMARKED(a) (((a)->flags & FCTX_ADDRINFO_MARK) == 0) 626 #define ISFORWARDER(a) (((a)->flags & FCTX_ADDRINFO_FORWARDER) != 0) 627 #define NOCOOKIE(a) (((a)->flags & FCTX_ADDRINFO_NOCOOKIE) != 0) 628 #define EDNSOK(a) (((a)->flags & FCTX_ADDRINFO_EDNSOK) != 0) 629 #define BADCOOKIE(a) (((a)->flags & FCTX_ADDRINFO_BADCOOKIE) != 0) 630 #define ISDUALSTACK(a) (((a)->flags & FCTX_ADDRINFO_DUALSTACK) != 0) 631 632 #define NXDOMAIN(r) (((r)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0) 633 #define NEGATIVE(r) (((r)->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) 634 #define STATICSTUB(r) (((r)->attributes & DNS_RDATASETATTR_STATICSTUB) != 0) 635 636 #ifdef ENABLE_AFL 637 bool dns_fuzzing_resolver = false; 638 void 639 dns_resolver_setfuzzing(void) { 640 dns_fuzzing_resolver = true; 641 } 642 #endif /* ifdef ENABLE_AFL */ 643 644 static unsigned char ip6_arpa_data[] = "\003IP6\004ARPA"; 645 static unsigned char ip6_arpa_offsets[] = { 0, 4, 9 }; 646 static const dns_name_t ip6_arpa = DNS_NAME_INITABSOLUTE(ip6_arpa_data, 647 ip6_arpa_offsets); 648 649 static void 650 dns_resolver__destroy(dns_resolver_t *res); 651 static isc_result_t 652 resquery_send(resquery_t *query); 653 static void 654 resquery_response(isc_result_t eresult, isc_region_t *region, void *arg); 655 static void 656 resquery_response_continue(void *arg, isc_result_t result); 657 static void 658 resquery_connected(isc_result_t eresult, isc_region_t *region, void *arg); 659 static void 660 fctx_try(fetchctx_t *fctx, bool retrying); 661 static void 662 fctx_shutdown(void *arg); 663 static void 664 fctx_minimize_qname(fetchctx_t *fctx); 665 static void 666 fctx_destroy(fetchctx_t *fctx); 667 static isc_result_t 668 ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node, 669 dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl, 670 dns_ttl_t maxttl, bool optout, bool secure, 671 dns_rdataset_t *ardataset, isc_result_t *eresultp); 672 static void 673 validated(void *arg); 674 static void 675 maybe_cancel_validators(fetchctx_t *fctx); 676 static void 677 add_bad(fetchctx_t *fctx, dns_message_t *rmessage, dns_adbaddrinfo_t *addrinfo, 678 isc_result_t reason, badnstype_t badtype); 679 static isc_result_t 680 findnoqname(fetchctx_t *fctx, dns_message_t *message, dns_name_t *name, 681 dns_rdatatype_t type, dns_name_t **noqname); 682 683 #define fctx_done_detach(fctxp, result) \ 684 if (fctx__done(*fctxp, result, __func__, __FILE__, __LINE__)) { \ 685 fetchctx_detach(fctxp); \ 686 } 687 688 #define fctx_done_unref(fctx, result) \ 689 if (fctx__done(fctx, result, __func__, __FILE__, __LINE__)) { \ 690 fetchctx_unref(fctx); \ 691 } 692 693 #if DNS_RESOLVER_TRACE 694 #define fetchctx_ref(ptr) fetchctx__ref(ptr, __func__, __FILE__, __LINE__) 695 #define fetchctx_unref(ptr) fetchctx__unref(ptr, __func__, __FILE__, __LINE__) 696 #define fetchctx_attach(ptr, ptrp) \ 697 fetchctx__attach(ptr, ptrp, __func__, __FILE__, __LINE__) 698 #define fetchctx_detach(ptrp) \ 699 fetchctx__detach(ptrp, __func__, __FILE__, __LINE__) 700 ISC_REFCOUNT_TRACE_DECL(fetchctx); 701 #else 702 ISC_REFCOUNT_DECL(fetchctx); 703 #endif 704 705 static bool 706 fctx__done(fetchctx_t *fctx, isc_result_t result, const char *func, 707 const char *file, unsigned int line); 708 709 static void 710 resume_qmin(void *arg); 711 712 static isc_result_t 713 get_attached_fctx(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name, 714 dns_rdatatype_t type, const dns_name_t *domain, 715 dns_rdataset_t *nameservers, const isc_sockaddr_t *client, 716 unsigned int options, unsigned int depth, isc_counter_t *qc, 717 fetchctx_t **fctxp, bool *new_fctx); 718 static void 719 release_fctx(fetchctx_t *fctx); 720 721 /*% 722 * The structure and functions defined below implement the resolver 723 * query (resquery) response handling logic. 724 * 725 * When a resolver query is sent and a response is received, the 726 * resquery_response() event handler is run, which calls the rctx_*() 727 * functions. The respctx_t structure maintains state from function 728 * to function. 729 * 730 * The call flow is described below: 731 * 732 * 1. resquery_response(): 733 * - Initialize a respctx_t structure (rctx_respinit()). 734 * - Check for dispatcher failure (rctx_dispfail()). 735 * - Parse the response (rctx_parse()). 736 * - Log the response (rctx_logpacket()). 737 * - Check the parsed response for an OPT record and handle 738 * EDNS (rctx_opt(), rctx_edns()). 739 * - Check for a bad or lame server (rctx_badserver(), rctx_lameserver()). 740 * - If RCODE and ANCOUNT suggest this is a positive answer, and 741 * if so, call rctx_answer(): go to step 2. 742 * - If RCODE and NSCOUNT suggest this is a negative answer or a 743 * referral, call rctx_answer_none(): go to step 4. 744 * - Check the additional section for data that should be cached 745 * (rctx_additional()). 746 * - Clean up and finish by calling rctx_done(): go to step 5. 747 * 748 * 2. rctx_answer(): 749 * - If the answer appears to be positive, call rctx_answer_positive(): 750 * go to step 3. 751 * - If the response is a malformed delegation (with glue or NS records 752 * in the answer section), call rctx_answer_none(): go to step 4. 753 * 754 * 3. rctx_answer_positive(): 755 * - Initialize the portions of respctx_t needed for processing an answer 756 * (rctx_answer_init()). 757 * - Scan the answer section to find records that are responsive to the 758 * query (rctx_answer_scan()). 759 * - For whichever type of response was found, call a separate routine 760 * to handle it: matching QNAME/QTYPE (rctx_answer_match()), 761 * CNAME (rctx_answer_cname()), covering DNAME (rctx_answer_dname()), 762 * or any records returned in response to a query of type ANY 763 * (rctx_answer_any()). 764 * - Scan the authority section for NS or other records that may be 765 * included with a positive answer (rctx_authority_scan()). 766 * 767 * 4. rctx_answer_none(): 768 * - Determine whether this is an NXDOMAIN, NXRRSET, or referral. 769 * - If referral, set up the resolver to follow the delegation 770 * (rctx_referral()). 771 * - If NXDOMAIN/NXRRSET, scan the authority section for NS and SOA 772 * records included with a negative response (rctx_authority_negative()), 773 * then for DNSSEC proof of nonexistence (rctx_authority_dnssec()). 774 * 775 * 5. rctx_done(): 776 * - Set up chasing of DS records if needed (rctx_chaseds()). 777 * - If the response wasn't intended for us, wait for another response 778 * from the dispatcher (rctx_next()). 779 * - If there is a problem with the responding server, set up another 780 * query to a different server (rctx_nextserver()). 781 * - If there is a problem that might be temporary or dependent on 782 * EDNS options, set up another query to the same server with changed 783 * options (rctx_resend()). 784 * - Shut down the fetch context. 785 */ 786 787 typedef struct respctx { 788 resquery_t *query; 789 fetchctx_t *fctx; 790 isc_mem_t *mctx; 791 isc_result_t result; 792 isc_buffer_t buffer; 793 unsigned int retryopts; /* updated options to pass to 794 * fctx_query() when resending */ 795 796 dns_rdatatype_t type; /* type being sought (set to 797 * ANY if qtype was SIG or RRSIG) */ 798 bool aa; /* authoritative answer? */ 799 dns_trust_t trust; /* answer trust level */ 800 bool chaining; /* CNAME/DNAME processing? */ 801 bool next_server; /* give up, try the next server 802 * */ 803 804 badnstype_t broken_type; /* type of name server problem 805 * */ 806 isc_result_t broken_server; 807 808 bool get_nameservers; /* get a new NS rrset at 809 * zone cut? */ 810 bool resend; /* resend this query? */ 811 bool nextitem; /* invalid response; keep 812 * listening for the correct one */ 813 bool truncated; /* response was truncated */ 814 bool no_response; /* no response was received */ 815 bool glue_in_answer; /* glue may be in the answer 816 * section */ 817 bool ns_in_answer; /* NS may be in the answer 818 * section */ 819 bool negative; /* is this a negative response? */ 820 821 isc_stdtime_t now; /* time info */ 822 isc_time_t tnow; 823 isc_time_t *finish; 824 825 unsigned int dname_labels; 826 unsigned int domain_labels; /* range of permissible number 827 * of 828 * labels in a DNAME */ 829 830 dns_name_t *aname; /* answer name */ 831 dns_rdataset_t *ardataset; /* answer rdataset */ 832 833 dns_name_t *cname; /* CNAME name */ 834 dns_rdataset_t *crdataset; /* CNAME rdataset */ 835 836 dns_name_t *dname; /* DNAME name */ 837 dns_rdataset_t *drdataset; /* DNAME rdataset */ 838 839 dns_name_t *ns_name; /* NS name */ 840 dns_rdataset_t *ns_rdataset; /* NS rdataset */ 841 842 dns_name_t *soa_name; /* SOA name in a negative answer */ 843 dns_name_t *ds_name; /* DS name in a negative answer */ 844 845 dns_name_t *found_name; /* invalid name in negative 846 * response */ 847 dns_rdatatype_t found_type; /* invalid type in negative 848 * response */ 849 850 dns_rdataset_t *opt; /* OPT rdataset */ 851 } respctx_t; 852 853 static void 854 rctx_respinit(resquery_t *query, fetchctx_t *fctx, isc_result_t result, 855 isc_region_t *region, respctx_t *rctx); 856 857 static void 858 rctx_answer_init(respctx_t *rctx); 859 860 static void 861 rctx_answer_scan(respctx_t *rctx); 862 863 static void 864 rctx_authority_positive(respctx_t *rctx); 865 866 static isc_result_t 867 rctx_answer_any(respctx_t *rctx); 868 869 static isc_result_t 870 rctx_answer_match(respctx_t *rctx); 871 872 static isc_result_t 873 rctx_answer_cname(respctx_t *rctx); 874 875 static isc_result_t 876 rctx_answer_dname(respctx_t *rctx); 877 878 static isc_result_t 879 rctx_answer_positive(respctx_t *rctx); 880 881 static isc_result_t 882 rctx_authority_negative(respctx_t *rctx); 883 884 static isc_result_t 885 rctx_authority_dnssec(respctx_t *rctx); 886 887 static void 888 rctx_additional(respctx_t *rctx); 889 890 static isc_result_t 891 rctx_referral(respctx_t *rctx); 892 893 static isc_result_t 894 rctx_answer_none(respctx_t *rctx); 895 896 static void 897 rctx_nextserver(respctx_t *rctx, dns_message_t *message, 898 dns_adbaddrinfo_t *addrinfo, isc_result_t result); 899 900 static void 901 rctx_resend(respctx_t *rctx, dns_adbaddrinfo_t *addrinfo); 902 903 static isc_result_t 904 rctx_next(respctx_t *rctx); 905 906 static void 907 rctx_chaseds(respctx_t *rctx, dns_message_t *message, 908 dns_adbaddrinfo_t *addrinfo, isc_result_t result); 909 910 static void 911 rctx_done(respctx_t *rctx, isc_result_t result); 912 913 static void 914 rctx_logpacket(respctx_t *rctx); 915 916 static void 917 rctx_opt(respctx_t *rctx); 918 919 static void 920 rctx_edns(respctx_t *rctx); 921 922 static isc_result_t 923 rctx_parse(respctx_t *rctx); 924 925 static isc_result_t 926 rctx_badserver(respctx_t *rctx, isc_result_t result); 927 928 static isc_result_t 929 rctx_answer(respctx_t *rctx); 930 931 static isc_result_t 932 rctx_lameserver(respctx_t *rctx); 933 934 static isc_result_t 935 rctx_dispfail(respctx_t *rctx); 936 937 static isc_result_t 938 rctx_timedout(respctx_t *rctx); 939 940 static void 941 rctx_ncache(respctx_t *rctx); 942 943 /*% 944 * Increment resolver-related statistics counters. 945 */ 946 static void 947 inc_stats(dns_resolver_t *res, isc_statscounter_t counter) { 948 if (res->stats != NULL) { 949 isc_stats_increment(res->stats, counter); 950 } 951 } 952 953 static void 954 dec_stats(dns_resolver_t *res, isc_statscounter_t counter) { 955 if (res->stats != NULL) { 956 isc_stats_decrement(res->stats, counter); 957 } 958 } 959 960 static void 961 set_stats(dns_resolver_t *res, isc_statscounter_t counter, uint64_t val) { 962 if (res->stats != NULL) { 963 isc_stats_set(res->stats, val, counter); 964 } 965 } 966 967 static isc_result_t 968 valcreate(fetchctx_t *fctx, dns_message_t *message, dns_adbaddrinfo_t *addrinfo, 969 dns_name_t *name, dns_rdatatype_t type, dns_rdataset_t *rdataset, 970 dns_rdataset_t *sigrdataset, unsigned int valoptions) { 971 dns_validator_t *validator = NULL; 972 dns_valarg_t *valarg = NULL; 973 isc_result_t result; 974 975 valarg = isc_mem_get(fctx->mctx, sizeof(*valarg)); 976 *valarg = (dns_valarg_t){ 977 .addrinfo = addrinfo, 978 }; 979 980 fetchctx_attach(fctx, &valarg->fctx); 981 982 if (!ISC_LIST_EMPTY(fctx->validators)) { 983 valoptions |= DNS_VALIDATOR_DEFER; 984 } else { 985 valoptions &= ~DNS_VALIDATOR_DEFER; 986 } 987 988 result = dns_validator_create( 989 fctx->res->view, name, type, rdataset, sigrdataset, message, 990 valoptions, fctx->loop, validated, valarg, &fctx->nvalidations, 991 &fctx->nfails, fctx->qc, &validator); 992 RUNTIME_CHECK(result == ISC_R_SUCCESS); 993 inc_stats(fctx->res, dns_resstatscounter_val); 994 if ((valoptions & DNS_VALIDATOR_DEFER) == 0) { 995 INSIST(fctx->validator == NULL); 996 fctx->validator = validator; 997 } 998 ISC_LIST_APPEND(fctx->validators, validator, link); 999 return ISC_R_SUCCESS; 1000 } 1001 1002 static void 1003 resquery_destroy(resquery_t *query) { 1004 fetchctx_t *fctx = query->fctx; 1005 1006 query->magic = 0; 1007 1008 if (ISC_LINK_LINKED(query, link)) { 1009 ISC_LIST_UNLINK(fctx->queries, query, link); 1010 } 1011 1012 if (query->tsig != NULL) { 1013 isc_buffer_free(&query->tsig); 1014 } 1015 1016 if (query->tsigkey != NULL) { 1017 dns_tsigkey_detach(&query->tsigkey); 1018 } 1019 1020 if (query->dispentry != NULL) { 1021 dns_dispatch_done(&query->dispentry); 1022 } 1023 1024 if (query->dispatch != NULL) { 1025 dns_dispatch_detach(&query->dispatch); 1026 } 1027 1028 LOCK(&fctx->lock); 1029 atomic_fetch_sub_release(&fctx->nqueries, 1); 1030 UNLOCK(&fctx->lock); 1031 1032 if (query->rmessage != NULL) { 1033 dns_message_detach(&query->rmessage); 1034 } 1035 1036 isc_mem_put(fctx->mctx, query, sizeof(*query)); 1037 1038 fetchctx_detach(&fctx); 1039 } 1040 1041 #if DNS_RESOLVER_TRACE 1042 ISC_REFCOUNT_TRACE_IMPL(resquery, resquery_destroy); 1043 #else 1044 ISC_REFCOUNT_IMPL(resquery, resquery_destroy); 1045 #endif 1046 1047 /*% 1048 * Update EDNS statistics for a server after not getting a response to a UDP 1049 * query sent to it. 1050 */ 1051 static void 1052 update_edns_stats(resquery_t *query) { 1053 fetchctx_t *fctx = query->fctx; 1054 1055 if ((query->options & DNS_FETCHOPT_TCP) != 0) { 1056 return; 1057 } 1058 1059 if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0) { 1060 dns_adb_ednsto(fctx->adb, query->addrinfo); 1061 } else { 1062 dns_adb_timeout(fctx->adb, query->addrinfo); 1063 } 1064 } 1065 1066 static void 1067 fctx_expired(void *arg); 1068 1069 /* 1070 * Start the maximum lifetime timer for the fetch. This will 1071 * trigger if, for example, some ADB or validator dependency 1072 * loop occurs and causes a fetch to hang. 1073 */ 1074 static void 1075 fctx_starttimer(fetchctx_t *fctx) { 1076 isc_interval_t interval; 1077 isc_time_t now; 1078 isc_time_t expires; 1079 1080 isc_interval_set(&interval, 2, 0); 1081 isc_time_add(&fctx->expires, &interval, &expires); 1082 1083 now = isc_time_now(); 1084 if (isc_time_compare(&expires, &now) <= 0) { 1085 isc_interval_set(&interval, 0, 1); 1086 } else { 1087 isc_time_subtract(&expires, &now, &interval); 1088 } 1089 1090 isc_timer_start(fctx->timer, isc_timertype_once, &interval); 1091 } 1092 1093 static void 1094 fctx_stoptimer(fetchctx_t *fctx) { 1095 isc_timer_stop(fctx->timer); 1096 } 1097 1098 static void 1099 fctx_cancelquery(resquery_t **queryp, isc_time_t *finish, bool no_response, 1100 bool age_untried) { 1101 resquery_t *query = NULL; 1102 fetchctx_t *fctx = NULL; 1103 dns_adbfind_t *find = NULL; 1104 dns_adbaddrinfo_t *addrinfo; 1105 isc_stdtime_t now = isc_stdtime_now(); 1106 1107 REQUIRE(queryp != NULL); 1108 1109 query = *queryp; 1110 fctx = query->fctx; 1111 1112 if (RESQUERY_CANCELED(query)) { 1113 return; 1114 } 1115 1116 FCTXTRACE("cancelquery"); 1117 1118 query->attributes |= RESQUERY_ATTR_CANCELED; 1119 1120 /* 1121 * Should we update the RTT? 1122 */ 1123 if (finish != NULL || no_response) { 1124 unsigned int rtt, factor; 1125 if (finish != NULL) { 1126 /* 1127 * We have both the start and finish times for this 1128 * packet, so we can compute a real RTT. 1129 */ 1130 unsigned int rttms; 1131 1132 rtt = (unsigned int)isc_time_microdiff(finish, 1133 &query->start); 1134 rttms = rtt / US_PER_MS; 1135 factor = DNS_ADB_RTTADJDEFAULT; 1136 1137 if (rttms < DNS_RESOLVER_QRYRTTCLASS0) { 1138 inc_stats(fctx->res, 1139 dns_resstatscounter_queryrtt0); 1140 } else if (rttms < DNS_RESOLVER_QRYRTTCLASS1) { 1141 inc_stats(fctx->res, 1142 dns_resstatscounter_queryrtt1); 1143 } else if (rttms < DNS_RESOLVER_QRYRTTCLASS2) { 1144 inc_stats(fctx->res, 1145 dns_resstatscounter_queryrtt2); 1146 } else if (rttms < DNS_RESOLVER_QRYRTTCLASS3) { 1147 inc_stats(fctx->res, 1148 dns_resstatscounter_queryrtt3); 1149 } else if (rttms < DNS_RESOLVER_QRYRTTCLASS4) { 1150 inc_stats(fctx->res, 1151 dns_resstatscounter_queryrtt4); 1152 } else { 1153 inc_stats(fctx->res, 1154 dns_resstatscounter_queryrtt5); 1155 } 1156 } else { 1157 uint32_t value; 1158 uint32_t mask; 1159 1160 update_edns_stats(query); 1161 1162 /* 1163 * If "forward first;" is used and a forwarder timed 1164 * out, do not attempt to query it again in this fetch 1165 * context. 1166 */ 1167 if (fctx->fwdpolicy == dns_fwdpolicy_first && 1168 ISFORWARDER(query->addrinfo)) 1169 { 1170 add_bad(fctx, query->rmessage, query->addrinfo, 1171 ISC_R_TIMEDOUT, badns_forwarder); 1172 } 1173 1174 /* 1175 * We don't have an RTT for this query. Maybe the 1176 * packet was lost, or maybe this server is very 1177 * slow. We don't know. Increase the RTT. 1178 */ 1179 INSIST(no_response); 1180 value = isc_random32(); 1181 if (query->addrinfo->srtt > 800000) { 1182 mask = 0x3fff; 1183 } else if (query->addrinfo->srtt > 400000) { 1184 mask = 0x7fff; 1185 } else if (query->addrinfo->srtt > 200000) { 1186 mask = 0xffff; 1187 } else if (query->addrinfo->srtt > 100000) { 1188 mask = 0x1ffff; 1189 } else if (query->addrinfo->srtt > 50000) { 1190 mask = 0x3ffff; 1191 } else if (query->addrinfo->srtt > 25000) { 1192 mask = 0x7ffff; 1193 } else { 1194 mask = 0xfffff; 1195 } 1196 1197 /* 1198 * Don't adjust timeout on EDNS queries unless we have 1199 * seen a EDNS response. 1200 */ 1201 if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0 && 1202 !EDNSOK(query->addrinfo)) 1203 { 1204 mask >>= 2; 1205 } 1206 1207 rtt = query->addrinfo->srtt + (value & mask); 1208 if (rtt > MAX_SINGLE_QUERY_TIMEOUT_US) { 1209 rtt = MAX_SINGLE_QUERY_TIMEOUT_US; 1210 } 1211 if (rtt > fctx->res->query_timeout * US_PER_MS) { 1212 rtt = fctx->res->query_timeout * US_PER_MS; 1213 } 1214 1215 /* 1216 * Replace the current RTT with our value. 1217 */ 1218 factor = DNS_ADB_RTTADJREPLACE; 1219 } 1220 1221 dns_adb_adjustsrtt(fctx->adb, query->addrinfo, rtt, factor); 1222 } 1223 1224 if ((query->options & DNS_FETCHOPT_TCP) == 0) { 1225 /* Inform the ADB that we're ending a UDP fetch */ 1226 dns_adb_endudpfetch(fctx->adb, query->addrinfo); 1227 } 1228 1229 /* 1230 * Age RTTs of servers not tried. 1231 */ 1232 if (finish != NULL || age_untried) { 1233 for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs); 1234 addrinfo != NULL; 1235 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 1236 { 1237 if (UNMARKED(addrinfo)) { 1238 dns_adb_agesrtt(fctx->adb, addrinfo, now); 1239 } 1240 } 1241 } 1242 1243 if ((finish != NULL || age_untried) && TRIEDFIND(fctx)) { 1244 for (find = ISC_LIST_HEAD(fctx->finds); find != NULL; 1245 find = ISC_LIST_NEXT(find, publink)) 1246 { 1247 for (addrinfo = ISC_LIST_HEAD(find->list); 1248 addrinfo != NULL; 1249 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 1250 { 1251 if (UNMARKED(addrinfo)) { 1252 dns_adb_agesrtt(fctx->adb, addrinfo, 1253 now); 1254 } 1255 } 1256 } 1257 } 1258 1259 if ((finish != NULL || age_untried) && TRIEDALT(fctx)) { 1260 for (addrinfo = ISC_LIST_HEAD(fctx->altaddrs); addrinfo != NULL; 1261 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 1262 { 1263 if (UNMARKED(addrinfo)) { 1264 dns_adb_agesrtt(fctx->adb, addrinfo, now); 1265 } 1266 } 1267 for (find = ISC_LIST_HEAD(fctx->altfinds); find != NULL; 1268 find = ISC_LIST_NEXT(find, publink)) 1269 { 1270 for (addrinfo = ISC_LIST_HEAD(find->list); 1271 addrinfo != NULL; 1272 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 1273 { 1274 if (UNMARKED(addrinfo)) { 1275 dns_adb_agesrtt(fctx->adb, addrinfo, 1276 now); 1277 } 1278 } 1279 } 1280 } 1281 1282 /* 1283 * Check for any outstanding dispatch responses and if they 1284 * exist, cancel them. 1285 */ 1286 if (query->dispentry != NULL) { 1287 dns_dispatch_done(&query->dispentry); 1288 } 1289 1290 LOCK(&fctx->lock); 1291 if (ISC_LINK_LINKED(query, link)) { 1292 ISC_LIST_UNLINK(fctx->queries, query, link); 1293 } 1294 UNLOCK(&fctx->lock); 1295 1296 resquery_detach(queryp); 1297 } 1298 1299 static void 1300 fctx_cleanup(fetchctx_t *fctx) { 1301 dns_adbfind_t *find = NULL, *next_find = NULL; 1302 dns_adbaddrinfo_t *addr = NULL, *next_addr = NULL; 1303 1304 REQUIRE(ISC_LIST_EMPTY(fctx->queries)); 1305 1306 for (find = ISC_LIST_HEAD(fctx->finds); find != NULL; find = next_find) 1307 { 1308 next_find = ISC_LIST_NEXT(find, publink); 1309 ISC_LIST_UNLINK(fctx->finds, find, publink); 1310 dns_adb_destroyfind(&find); 1311 fetchctx_unref(fctx); 1312 } 1313 fctx->find = NULL; 1314 1315 for (find = ISC_LIST_HEAD(fctx->altfinds); find != NULL; 1316 find = next_find) 1317 { 1318 next_find = ISC_LIST_NEXT(find, publink); 1319 ISC_LIST_UNLINK(fctx->altfinds, find, publink); 1320 dns_adb_destroyfind(&find); 1321 fetchctx_unref(fctx); 1322 } 1323 fctx->altfind = NULL; 1324 1325 for (addr = ISC_LIST_HEAD(fctx->forwaddrs); addr != NULL; 1326 addr = next_addr) 1327 { 1328 next_addr = ISC_LIST_NEXT(addr, publink); 1329 ISC_LIST_UNLINK(fctx->forwaddrs, addr, publink); 1330 dns_adb_freeaddrinfo(fctx->adb, &addr); 1331 } 1332 1333 for (addr = ISC_LIST_HEAD(fctx->altaddrs); addr != NULL; 1334 addr = next_addr) 1335 { 1336 next_addr = ISC_LIST_NEXT(addr, publink); 1337 ISC_LIST_UNLINK(fctx->altaddrs, addr, publink); 1338 dns_adb_freeaddrinfo(fctx->adb, &addr); 1339 } 1340 } 1341 1342 static void 1343 fctx_cancelqueries(fetchctx_t *fctx, bool no_response, bool age_untried) { 1344 resquery_t *query = NULL, *next_query = NULL; 1345 ISC_LIST(resquery_t) queries; 1346 1347 FCTXTRACE("cancelqueries"); 1348 1349 ISC_LIST_INIT(queries); 1350 1351 /* 1352 * Move the queries to a local list so we can cancel 1353 * them without holding the lock. 1354 */ 1355 LOCK(&fctx->lock); 1356 ISC_LIST_MOVE(queries, fctx->queries); 1357 UNLOCK(&fctx->lock); 1358 1359 for (query = ISC_LIST_HEAD(queries); query != NULL; query = next_query) 1360 { 1361 next_query = ISC_LIST_NEXT(query, link); 1362 1363 /* 1364 * Note that we have to unlink the query here, 1365 * because if it's still linked in fctx_cancelquery(), 1366 * then it will try to unlink it from fctx->queries. 1367 */ 1368 ISC_LIST_UNLINK(queries, query, link); 1369 fctx_cancelquery(&query, NULL, no_response, age_untried); 1370 } 1371 } 1372 1373 static void 1374 fcount_logspill(fetchctx_t *fctx, fctxcount_t *counter, bool final) { 1375 char dbuf[DNS_NAME_FORMATSIZE]; 1376 isc_stdtime_t now; 1377 1378 if (!isc_log_wouldlog(dns_lctx, ISC_LOG_INFO)) { 1379 return; 1380 } 1381 1382 /* Do not log a message if there were no dropped fetches. */ 1383 if (counter->dropped == 0) { 1384 return; 1385 } 1386 1387 /* Do not log the cumulative message if the previous log is recent. */ 1388 now = isc_stdtime_now(); 1389 if (!final && counter->logged > now - 60) { 1390 return; 1391 } 1392 1393 dns_name_format(fctx->domain, dbuf, sizeof(dbuf)); 1394 1395 if (!final) { 1396 isc_log_write(dns_lctx, DNS_LOGCATEGORY_SPILL, 1397 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 1398 "too many simultaneous fetches for %s " 1399 "(allowed %" PRIuFAST32 " spilled %" PRIuFAST32 1400 "; %s)", 1401 dbuf, counter->allowed, counter->dropped, 1402 counter->dropped == 1 ? "initial trigger event" 1403 : "cumulative since " 1404 "initial trigger event"); 1405 } else { 1406 isc_log_write(dns_lctx, DNS_LOGCATEGORY_SPILL, 1407 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 1408 "fetch counters for %s now being discarded " 1409 "(allowed %" PRIuFAST32 " spilled %" PRIuFAST32 1410 "; cumulative since initial trigger event)", 1411 dbuf, counter->allowed, counter->dropped); 1412 } 1413 1414 counter->logged = now; 1415 } 1416 1417 static bool 1418 fcount_match(void *node, const void *key) { 1419 const fctxcount_t *counter = node; 1420 const dns_name_t *domain = key; 1421 1422 return dns_name_equal(counter->domain, domain); 1423 } 1424 1425 static isc_result_t 1426 fcount_incr(fetchctx_t *fctx, bool force) { 1427 isc_result_t result = ISC_R_SUCCESS; 1428 dns_resolver_t *res = NULL; 1429 fctxcount_t *counter = NULL; 1430 uint32_t hashval; 1431 uint_fast32_t spill; 1432 isc_rwlocktype_t locktype = isc_rwlocktype_read; 1433 1434 REQUIRE(fctx != NULL); 1435 res = fctx->res; 1436 REQUIRE(res != NULL); 1437 INSIST(fctx->counter == NULL); 1438 1439 /* Skip any counting if fetches-per-zone is disabled */ 1440 spill = atomic_load_acquire(&res->zspill); 1441 if (spill == 0) { 1442 return ISC_R_SUCCESS; 1443 } 1444 1445 hashval = dns_name_hash(fctx->domain); 1446 1447 RWLOCK(&res->counters_lock, locktype); 1448 result = isc_hashmap_find(res->counters, hashval, fcount_match, 1449 fctx->domain, (void **)&counter); 1450 switch (result) { 1451 case ISC_R_SUCCESS: 1452 break; 1453 case ISC_R_NOTFOUND: 1454 counter = isc_mem_get(fctx->mctx, sizeof(*counter)); 1455 *counter = (fctxcount_t){ 1456 .magic = FCTXCOUNT_MAGIC, 1457 .count = 0, 1458 .allowed = 0, 1459 }; 1460 isc_mem_attach(fctx->mctx, &counter->mctx); 1461 isc_mutex_init(&counter->lock); 1462 counter->domain = dns_fixedname_initname(&counter->dfname); 1463 dns_name_copy(fctx->domain, counter->domain); 1464 1465 UPGRADELOCK(&res->counters_lock, locktype); 1466 1467 void *found = NULL; 1468 result = isc_hashmap_add(res->counters, hashval, fcount_match, 1469 counter->domain, counter, &found); 1470 if (result == ISC_R_EXISTS) { 1471 isc_mutex_destroy(&counter->lock); 1472 isc_mem_putanddetach(&counter->mctx, counter, 1473 sizeof(*counter)); 1474 counter = found; 1475 result = ISC_R_SUCCESS; 1476 } 1477 1478 INSIST(result == ISC_R_SUCCESS); 1479 break; 1480 default: 1481 UNREACHABLE(); 1482 } 1483 INSIST(VALID_FCTXCOUNT(counter)); 1484 1485 INSIST(spill > 0); 1486 LOCK(&counter->lock); 1487 if (++counter->count > spill && !force) { 1488 counter->count--; 1489 INSIST(counter->count > 0); 1490 counter->dropped++; 1491 fcount_logspill(fctx, counter, false); 1492 result = ISC_R_QUOTA; 1493 } else { 1494 counter->allowed++; 1495 fctx->counter = counter; 1496 } 1497 UNLOCK(&counter->lock); 1498 RWUNLOCK(&res->counters_lock, locktype); 1499 1500 return result; 1501 } 1502 1503 static bool 1504 match_ptr(void *node, const void *key) { 1505 return node == key; 1506 } 1507 1508 static void 1509 fcount_decr(fetchctx_t *fctx) { 1510 REQUIRE(fctx != NULL); 1511 1512 fctxcount_t *counter = fctx->counter; 1513 if (counter == NULL) { 1514 return; 1515 } 1516 fctx->counter = NULL; 1517 1518 /* 1519 * FIXME: This should not require a write lock, but should be 1520 * implemented using reference counting later, otherwise we would could 1521 * encounter ABA problem here - the count could go up and down when we 1522 * switch from read to write lock. 1523 */ 1524 RWLOCK(&fctx->res->counters_lock, isc_rwlocktype_write); 1525 1526 LOCK(&counter->lock); 1527 INSIST(VALID_FCTXCOUNT(counter)); 1528 INSIST(counter->count > 0); 1529 if (--counter->count > 0) { 1530 UNLOCK(&counter->lock); 1531 RWUNLOCK(&fctx->res->counters_lock, isc_rwlocktype_write); 1532 return; 1533 } 1534 1535 isc_result_t result = isc_hashmap_delete(fctx->res->counters, 1536 dns_name_hash(counter->domain), 1537 match_ptr, counter); 1538 INSIST(result == ISC_R_SUCCESS); 1539 1540 fcount_logspill(fctx, counter, true); 1541 UNLOCK(&counter->lock); 1542 1543 isc_mutex_destroy(&counter->lock); 1544 isc_mem_putanddetach(&counter->mctx, counter, sizeof(*counter)); 1545 1546 RWUNLOCK(&fctx->res->counters_lock, isc_rwlocktype_write); 1547 } 1548 1549 static void 1550 spillattimer_countdown(void *arg); 1551 1552 static void 1553 fctx_sendevents(fetchctx_t *fctx, isc_result_t result) { 1554 dns_fetchresponse_t *resp = NULL, *next = NULL; 1555 unsigned int count = 0; 1556 bool logit = false; 1557 isc_time_t now; 1558 unsigned int old_spillat; 1559 unsigned int new_spillat = 0; /* initialized to silence 1560 * compiler warnings */ 1561 1562 LOCK(&fctx->lock); 1563 1564 REQUIRE(fctx->state == fetchstate_done); 1565 1566 FCTXTRACE("sendevents"); 1567 1568 /* 1569 * Keep some record of fetch result for logging later (if required). 1570 */ 1571 fctx->result = result; 1572 now = isc_time_now(); 1573 fctx->duration = isc_time_microdiff(&now, &fctx->start); 1574 1575 for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL; resp = next) { 1576 next = ISC_LIST_NEXT(resp, link); 1577 ISC_LIST_UNLINK(fctx->resps, resp, link); 1578 1579 count++; 1580 1581 resp->vresult = fctx->vresult; 1582 if (!HAVE_ANSWER(fctx)) { 1583 resp->result = result; 1584 } 1585 1586 INSIST(resp->result != ISC_R_SUCCESS || 1587 dns_rdataset_isassociated(resp->rdataset) || 1588 fctx->type == dns_rdatatype_any || 1589 fctx->type == dns_rdatatype_rrsig || 1590 fctx->type == dns_rdatatype_sig); 1591 1592 /* 1593 * Negative results must be indicated in resp->result. 1594 */ 1595 if (dns_rdataset_isassociated(resp->rdataset) && 1596 NEGATIVE(resp->rdataset)) 1597 { 1598 INSIST(resp->result == DNS_R_NCACHENXDOMAIN || 1599 resp->result == DNS_R_NCACHENXRRSET); 1600 } 1601 1602 FCTXTRACE("post response event"); 1603 isc_async_run(resp->loop, resp->cb, resp); 1604 } 1605 UNLOCK(&fctx->lock); 1606 1607 if (HAVE_ANSWER(fctx) && fctx->spilled && 1608 (count < fctx->res->spillatmax || fctx->res->spillatmax == 0)) 1609 { 1610 LOCK(&fctx->res->lock); 1611 if (count == fctx->res->spillat && 1612 !atomic_load_acquire(&fctx->res->exiting)) 1613 { 1614 old_spillat = fctx->res->spillat; 1615 fctx->res->spillat += 5; 1616 if (fctx->res->spillat > fctx->res->spillatmax && 1617 fctx->res->spillatmax != 0) 1618 { 1619 fctx->res->spillat = fctx->res->spillatmax; 1620 } 1621 new_spillat = fctx->res->spillat; 1622 if (new_spillat != old_spillat) { 1623 logit = true; 1624 } 1625 1626 /* Timer not running */ 1627 if (fctx->res->spillattimer == NULL) { 1628 isc_interval_t i; 1629 1630 isc_timer_create( 1631 isc_loop(), spillattimer_countdown, 1632 fctx->res, &fctx->res->spillattimer); 1633 1634 isc_interval_set(&i, 20 * 60, 0); 1635 isc_timer_start(fctx->res->spillattimer, 1636 isc_timertype_ticker, &i); 1637 } 1638 } 1639 UNLOCK(&fctx->res->lock); 1640 if (logit) { 1641 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 1642 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 1643 "clients-per-query increased to %u", 1644 new_spillat); 1645 } 1646 } 1647 } 1648 1649 static bool 1650 fctx__done(fetchctx_t *fctx, isc_result_t result, const char *func, 1651 const char *file, unsigned int line) { 1652 bool no_response = false; 1653 bool age_untried = false; 1654 1655 REQUIRE(fctx != NULL); 1656 REQUIRE(fctx->tid == isc_tid()); 1657 1658 FCTXTRACE("done"); 1659 1660 #ifdef DNS_RESOLVER_TRACE 1661 fprintf(stderr, "%s:%s:%s:%u:(%p): %s\n", __func__, func, file, line, 1662 fctx, isc_result_totext(result)); 1663 #else 1664 UNUSED(file); 1665 UNUSED(line); 1666 UNUSED(func); 1667 #endif 1668 1669 LOCK(&fctx->lock); 1670 /* We need to do this under the lock for intra-thread synchronization */ 1671 if (fctx->state == fetchstate_done) { 1672 UNLOCK(&fctx->lock); 1673 return false; 1674 } 1675 fctx->state = fetchstate_done; 1676 release_fctx(fctx); 1677 1678 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 1679 UNLOCK(&fctx->lock); 1680 1681 if (result == ISC_R_SUCCESS) { 1682 if (fctx->qmin_warning != ISC_R_SUCCESS) { 1683 isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS, 1684 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 1685 "success resolving '%s' after disabling " 1686 "qname minimization due to '%s'", 1687 fctx->info, 1688 isc_result_totext(fctx->qmin_warning)); 1689 } 1690 1691 /* 1692 * A success result indicates we got a response to a 1693 * query. That query should be canceled already. If 1694 * there still are any outstanding queries attached to the 1695 * same fctx, then those have *not* gotten a response, 1696 * so we set 'no_response' to true here: that way, when 1697 * we run fctx_cancelqueries() below, the SRTTs will 1698 * be adjusted. 1699 */ 1700 no_response = true; 1701 } else if (result == ISC_R_TIMEDOUT) { 1702 age_untried = true; 1703 } 1704 1705 fctx->qmin_warning = ISC_R_SUCCESS; 1706 1707 fctx_cancelqueries(fctx, no_response, age_untried); 1708 fctx_stoptimer(fctx); 1709 1710 /* 1711 * Cancel all pending validators. Note that this must be done 1712 * without the fctx lock held, since that could cause 1713 * deadlock. 1714 */ 1715 maybe_cancel_validators(fctx); 1716 1717 if (fctx->nsfetch != NULL) { 1718 dns_resolver_cancelfetch(fctx->nsfetch); 1719 } 1720 1721 if (fctx->qminfetch != NULL) { 1722 dns_resolver_cancelfetch(fctx->qminfetch); 1723 } 1724 1725 /* 1726 * Shut down anything still running on behalf of this 1727 * fetch, and clean up finds and addresses. 1728 */ 1729 fctx_sendevents(fctx, result); 1730 fctx_cleanup(fctx); 1731 1732 isc_timer_destroy(&fctx->timer); 1733 1734 return true; 1735 } 1736 1737 static void 1738 resquery_senddone(isc_result_t eresult, isc_region_t *region, void *arg) { 1739 resquery_t *query = (resquery_t *)arg; 1740 resquery_t *copy = query; 1741 fetchctx_t *fctx = NULL; 1742 1743 QTRACE("senddone"); 1744 1745 UNUSED(region); 1746 1747 REQUIRE(VALID_QUERY(query)); 1748 fctx = query->fctx; 1749 REQUIRE(VALID_FCTX(fctx)); 1750 REQUIRE(fctx->tid == isc_tid()); 1751 1752 if (RESQUERY_CANCELED(query)) { 1753 goto detach; 1754 } 1755 1756 /* 1757 * See the note in resquery_connected() about reference 1758 * counting on error conditions. 1759 */ 1760 switch (eresult) { 1761 case ISC_R_SUCCESS: 1762 case ISC_R_CANCELED: 1763 case ISC_R_SHUTTINGDOWN: 1764 break; 1765 1766 case ISC_R_HOSTDOWN: 1767 case ISC_R_HOSTUNREACH: 1768 case ISC_R_NETDOWN: 1769 case ISC_R_NETUNREACH: 1770 case ISC_R_NOPERM: 1771 case ISC_R_ADDRNOTAVAIL: 1772 case ISC_R_CONNREFUSED: 1773 case ISC_R_CONNECTIONRESET: 1774 case ISC_R_TIMEDOUT: 1775 /* No route to remote. */ 1776 FCTXTRACE3("query canceled in resquery_senddone(): " 1777 "no route to host; no response", 1778 eresult); 1779 add_bad(fctx, query->rmessage, query->addrinfo, eresult, 1780 badns_unreachable); 1781 fctx_cancelquery(©, NULL, true, false); 1782 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 1783 fctx_try(fctx, true); 1784 break; 1785 1786 default: 1787 FCTXTRACE3("query canceled in resquery_senddone() " 1788 "due to unexpected result; responding", 1789 eresult); 1790 fctx_cancelquery(©, NULL, false, false); 1791 fctx_done_detach(&fctx, eresult); 1792 break; 1793 } 1794 1795 detach: 1796 resquery_detach(&query); 1797 } 1798 1799 static isc_result_t 1800 fctx_addopt(dns_message_t *message, unsigned int version, uint16_t udpsize, 1801 dns_ednsopt_t *ednsopts, size_t count) { 1802 dns_rdataset_t *rdataset = NULL; 1803 isc_result_t result; 1804 1805 result = dns_message_buildopt(message, &rdataset, version, udpsize, 1806 DNS_MESSAGEEXTFLAG_DO, ednsopts, count); 1807 if (result != ISC_R_SUCCESS) { 1808 return result; 1809 } 1810 return dns_message_setopt(message, rdataset); 1811 } 1812 1813 static void 1814 fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) { 1815 unsigned int seconds, us; 1816 uint64_t limit; 1817 isc_time_t now; 1818 1819 /* 1820 * Has this fetch already expired? 1821 */ 1822 now = isc_time_now(); 1823 limit = isc_time_microdiff(&fctx->expires, &now); 1824 if (limit < US_PER_MS) { 1825 FCTXTRACE("fetch already expired"); 1826 isc_interval_set(&fctx->interval, 0, 0); 1827 return; 1828 } 1829 1830 us = fctx->res->retryinterval * US_PER_MS; 1831 1832 /* 1833 * Exponential backoff after the first few tries. 1834 */ 1835 if (fctx->restarts > fctx->res->nonbackofftries) { 1836 int shift = fctx->restarts - fctx->res->nonbackofftries; 1837 if (shift > 6) { 1838 shift = 6; 1839 } 1840 us <<= shift; 1841 } 1842 1843 /* 1844 * Add a fudge factor to the expected rtt based on the current 1845 * estimate. 1846 */ 1847 if (rtt < 50000) { 1848 rtt += 50000; 1849 } else if (rtt < 100000) { 1850 rtt += 100000; 1851 } else { 1852 rtt += 200000; 1853 } 1854 1855 /* 1856 * Always wait for at least the expected rtt. 1857 */ 1858 if (us < rtt) { 1859 us = rtt; 1860 } 1861 1862 /* 1863 * But don't wait past the the final expiration of the fetch, 1864 * or for more than 10 seconds total. 1865 */ 1866 if (us > limit) { 1867 us = limit; 1868 } 1869 if (us > MAX_SINGLE_QUERY_TIMEOUT_US) { 1870 us = MAX_SINGLE_QUERY_TIMEOUT_US; 1871 } 1872 if (us > fctx->res->query_timeout * US_PER_MS) { 1873 us = fctx->res->query_timeout * US_PER_MS; 1874 } 1875 1876 seconds = us / US_PER_SEC; 1877 us -= seconds * US_PER_SEC; 1878 isc_interval_set(&fctx->interval, seconds, us * NS_PER_US); 1879 isc_time_nowplusinterval(&fctx->next_timeout, &fctx->interval); 1880 } 1881 1882 static isc_result_t 1883 fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, 1884 unsigned int options) { 1885 isc_result_t result; 1886 dns_resolver_t *res = NULL; 1887 dns_dns64_t *dns64 = NULL; 1888 resquery_t *query = NULL; 1889 isc_sockaddr_t addr, sockaddr; 1890 bool have_addr = false; 1891 unsigned int srtt; 1892 isc_tlsctx_cache_t *tlsctx_cache = NULL; 1893 1894 FCTXTRACE("query"); 1895 1896 res = fctx->res; 1897 1898 srtt = addrinfo->srtt; 1899 1900 if (addrinfo->transport != NULL) { 1901 switch (dns_transport_get_type(addrinfo->transport)) { 1902 case DNS_TRANSPORT_TLS: 1903 options |= DNS_FETCHOPT_TCP; 1904 tlsctx_cache = res->tlsctx_cache; 1905 break; 1906 case DNS_TRANSPORT_TCP: 1907 case DNS_TRANSPORT_HTTP: 1908 options |= DNS_FETCHOPT_TCP; 1909 break; 1910 default: 1911 break; 1912 } 1913 } 1914 1915 /* 1916 * Allow an additional second for the kernel to resend the SYN 1917 * (or SYN without ECN in the case of stupid firewalls blocking 1918 * ECN negotiation) over the current RTT estimate. 1919 */ 1920 if ((options & DNS_FETCHOPT_TCP) != 0) { 1921 srtt += US_PER_SEC; 1922 } 1923 1924 /* 1925 * A forwarder needs to make multiple queries. Give it at least 1926 * a second to do these in. 1927 */ 1928 if (ISFORWARDER(addrinfo) && srtt < US_PER_SEC) { 1929 srtt = US_PER_SEC; 1930 } 1931 1932 fctx_setretryinterval(fctx, srtt); 1933 if (isc_interval_iszero(&fctx->interval)) { 1934 FCTXTRACE("fetch expired"); 1935 return ISC_R_TIMEDOUT; 1936 } 1937 1938 INSIST(ISC_LIST_EMPTY(fctx->validators)); 1939 1940 query = isc_mem_get(fctx->mctx, sizeof(*query)); 1941 *query = (resquery_t){ 1942 .options = options, 1943 .addrinfo = addrinfo, 1944 .dispatchmgr = res->view->dispatchmgr, 1945 .link = ISC_LINK_INITIALIZER, 1946 }; 1947 1948 #if DNS_RESOLVER_TRACE 1949 fprintf(stderr, "rctx_init:%s:%s:%d:%p->references = 1\n", __func__, 1950 __FILE__, __LINE__, query); 1951 #endif 1952 isc_refcount_init(&query->references, 1); 1953 1954 /* 1955 * Note that the caller MUST guarantee that 'addrinfo' will 1956 * remain valid until this query is canceled. 1957 */ 1958 1959 dns_message_create(fctx->mctx, fctx->res->namepools[fctx->tid], 1960 fctx->res->rdspools[fctx->tid], 1961 DNS_MESSAGE_INTENTPARSE, &query->rmessage); 1962 query->start = isc_time_now(); 1963 1964 /* 1965 * Maybe apply DNS64 mappings to IPv4 addresses. 1966 */ 1967 sockaddr = addrinfo->sockaddr; 1968 dns64 = ISC_LIST_HEAD(fctx->res->view->dns64); 1969 if (isc_sockaddr_pf(&sockaddr) == AF_INET && 1970 fctx->res->view->usedns64 && dns64 != NULL) 1971 { 1972 struct in6_addr aaaa; 1973 1974 result = dns_dns64_aaaafroma( 1975 dns64, NULL, NULL, fctx->res->view->aclenv, 0, 1976 (unsigned char *)&sockaddr.type.sin.sin_addr.s_addr, 1977 aaaa.s6_addr); 1978 if (result == ISC_R_SUCCESS) { 1979 char sockaddrbuf1[ISC_SOCKADDR_FORMATSIZE]; 1980 char sockaddrbuf2[ISC_SOCKADDR_FORMATSIZE]; 1981 1982 /* format old address */ 1983 isc_sockaddr_format(&sockaddr, sockaddrbuf1, 1984 sizeof(sockaddrbuf1)); 1985 1986 /* replace address */ 1987 isc_sockaddr_fromin6(&sockaddr, &aaaa, 1988 ntohs(sockaddr.type.sin.sin_port)); 1989 addrinfo->sockaddr = sockaddr; 1990 1991 /* format new address */ 1992 isc_sockaddr_format(&sockaddr, sockaddrbuf2, 1993 sizeof(sockaddrbuf2)); 1994 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 1995 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 1996 "Using DNS64 address %s to talk to %s\n", 1997 sockaddrbuf2, sockaddrbuf1); 1998 } 1999 } 2000 if (res->view->peers != NULL) { 2001 dns_peer_t *peer = NULL; 2002 isc_netaddr_t dstip; 2003 bool usetcp = false; 2004 isc_netaddr_fromsockaddr(&dstip, &sockaddr); 2005 result = dns_peerlist_peerbyaddr(res->view->peers, &dstip, 2006 &peer); 2007 if (result == ISC_R_SUCCESS) { 2008 result = dns_peer_getquerysource(peer, &addr); 2009 if (result == ISC_R_SUCCESS) { 2010 have_addr = true; 2011 } 2012 result = dns_peer_getforcetcp(peer, &usetcp); 2013 if (result == ISC_R_SUCCESS && usetcp) { 2014 query->options |= DNS_FETCHOPT_TCP; 2015 } 2016 } 2017 } 2018 2019 /* 2020 * If this is a TCP query, then we need to make a socket and 2021 * a dispatch for it here. Otherwise we use the resolver's 2022 * shared dispatch. 2023 */ 2024 if ((query->options & DNS_FETCHOPT_TCP) != 0) { 2025 int pf; 2026 2027 pf = isc_sockaddr_pf(&sockaddr); 2028 if (!have_addr) { 2029 switch (pf) { 2030 case PF_INET: 2031 result = dns_dispatch_getlocaladdress( 2032 res->dispatches4->dispatches[0], &addr); 2033 break; 2034 case PF_INET6: 2035 result = dns_dispatch_getlocaladdress( 2036 res->dispatches6->dispatches[0], &addr); 2037 break; 2038 default: 2039 result = ISC_R_NOTIMPLEMENTED; 2040 break; 2041 } 2042 if (result != ISC_R_SUCCESS) { 2043 goto cleanup_query; 2044 } 2045 } 2046 isc_sockaddr_setport(&addr, 0); 2047 2048 result = dns_dispatch_createtcp(res->view->dispatchmgr, &addr, 2049 &sockaddr, addrinfo->transport, 2050 DNS_DISPATCHOPT_UNSHARED, 2051 &query->dispatch); 2052 if (result != ISC_R_SUCCESS) { 2053 goto cleanup_query; 2054 } 2055 2056 FCTXTRACE("connecting via TCP"); 2057 } else { 2058 if (have_addr) { 2059 result = dns_dispatch_createudp(res->view->dispatchmgr, 2060 &addr, 2061 &query->dispatch); 2062 if (result != ISC_R_SUCCESS) { 2063 goto cleanup_query; 2064 } 2065 } else { 2066 switch (isc_sockaddr_pf(&sockaddr)) { 2067 case PF_INET: 2068 dns_dispatch_attach( 2069 dns_resolver_dispatchv4(res), 2070 &query->dispatch); 2071 break; 2072 case PF_INET6: 2073 dns_dispatch_attach( 2074 dns_resolver_dispatchv6(res), 2075 &query->dispatch); 2076 break; 2077 default: 2078 result = ISC_R_NOTIMPLEMENTED; 2079 goto cleanup_query; 2080 } 2081 } 2082 2083 /* 2084 * We should always have a valid dispatcher here. If we 2085 * don't support a protocol family, then its dispatcher 2086 * will be NULL, but we shouldn't be finding addresses 2087 * for protocol types we don't support, so the 2088 * dispatcher we found should never be NULL. 2089 */ 2090 INSIST(query->dispatch != NULL); 2091 } 2092 2093 LOCK(&fctx->lock); 2094 INSIST(!SHUTTINGDOWN(fctx)); 2095 fetchctx_attach(fctx, &query->fctx); 2096 query->magic = QUERY_MAGIC; 2097 2098 if ((query->options & DNS_FETCHOPT_TCP) == 0) { 2099 if (dns_adb_overquota(fctx->adb, addrinfo)) { 2100 UNLOCK(&fctx->lock); 2101 result = ISC_R_QUOTA; 2102 goto cleanup_dispatch; 2103 } 2104 2105 /* Inform the ADB that we're starting a UDP fetch */ 2106 dns_adb_beginudpfetch(fctx->adb, addrinfo); 2107 } 2108 2109 ISC_LIST_APPEND(fctx->queries, query, link); 2110 atomic_fetch_add_relaxed(&fctx->nqueries, 1); 2111 UNLOCK(&fctx->lock); 2112 2113 /* Set up the dispatch and set the query ID */ 2114 result = dns_dispatch_add(query->dispatch, fctx->loop, 0, 2115 isc_interval_ms(&fctx->interval), &sockaddr, 2116 addrinfo->transport, tlsctx_cache, 2117 resquery_connected, resquery_senddone, 2118 resquery_response, query, &query->id, 2119 &query->dispentry); 2120 if (result != ISC_R_SUCCESS) { 2121 goto cleanup_udpfetch; 2122 } 2123 2124 /* Connect the socket */ 2125 resquery_ref(query); 2126 result = dns_dispatch_connect(query->dispentry); 2127 2128 if (result != ISC_R_SUCCESS && (query->options & DNS_FETCHOPT_TCP) != 0) 2129 { 2130 int log_level = ISC_LOG_NOTICE; 2131 if (isc_log_wouldlog(dns_lctx, log_level)) { 2132 char peerbuf[ISC_SOCKADDR_FORMATSIZE]; 2133 2134 isc_sockaddr_format(&sockaddr, peerbuf, 2135 ISC_SOCKADDR_FORMATSIZE); 2136 2137 isc_log_write( 2138 dns_lctx, DNS_LOGCATEGORY_RESOLVER, 2139 DNS_LOGMODULE_RESOLVER, log_level, 2140 "Unable to establish a connection to %s: %s\n", 2141 peerbuf, isc_result_totext(result)); 2142 } 2143 dns_dispatch_done(&query->dispentry); 2144 goto cleanup_fetch; 2145 } else { 2146 RUNTIME_CHECK(result == ISC_R_SUCCESS); 2147 } 2148 2149 return result; 2150 2151 cleanup_udpfetch: 2152 if (!RESQUERY_CANCELED(query)) { 2153 if ((query->options & DNS_FETCHOPT_TCP) == 0) { 2154 /* Inform the ADB that we're ending a UDP fetch */ 2155 dns_adb_endudpfetch(fctx->adb, addrinfo); 2156 } 2157 } 2158 2159 cleanup_fetch: 2160 LOCK(&fctx->lock); 2161 if (ISC_LINK_LINKED(query, link)) { 2162 atomic_fetch_sub_release(&fctx->nqueries, 1); 2163 ISC_LIST_UNLINK(fctx->queries, query, link); 2164 } 2165 UNLOCK(&fctx->lock); 2166 2167 cleanup_dispatch: 2168 fetchctx_detach(&query->fctx); 2169 2170 if (query->dispatch != NULL) { 2171 dns_dispatch_detach(&query->dispatch); 2172 } 2173 2174 cleanup_query: 2175 query->magic = 0; 2176 dns_message_detach(&query->rmessage); 2177 isc_mem_put(fctx->mctx, query, sizeof(*query)); 2178 2179 return result; 2180 } 2181 2182 static bool 2183 bad_edns(fetchctx_t *fctx, isc_sockaddr_t *address) { 2184 isc_sockaddr_t *sa; 2185 2186 for (sa = ISC_LIST_HEAD(fctx->bad_edns); sa != NULL; 2187 sa = ISC_LIST_NEXT(sa, link)) 2188 { 2189 if (isc_sockaddr_equal(sa, address)) { 2190 return true; 2191 } 2192 } 2193 2194 return false; 2195 } 2196 2197 static void 2198 add_bad_edns(fetchctx_t *fctx, isc_sockaddr_t *address) { 2199 isc_sockaddr_t *sa; 2200 2201 #ifdef ENABLE_AFL 2202 if (dns_fuzzing_resolver) { 2203 return; 2204 } 2205 #endif /* ifdef ENABLE_AFL */ 2206 if (bad_edns(fctx, address)) { 2207 return; 2208 } 2209 2210 sa = isc_mem_get(fctx->mctx, sizeof(*sa)); 2211 2212 *sa = *address; 2213 ISC_LIST_INITANDAPPEND(fctx->bad_edns, sa, link); 2214 } 2215 2216 static struct tried * 2217 triededns(fetchctx_t *fctx, isc_sockaddr_t *address) { 2218 struct tried *tried; 2219 2220 for (tried = ISC_LIST_HEAD(fctx->edns); tried != NULL; 2221 tried = ISC_LIST_NEXT(tried, link)) 2222 { 2223 if (isc_sockaddr_equal(&tried->addr, address)) { 2224 return tried; 2225 } 2226 } 2227 2228 return NULL; 2229 } 2230 2231 static void 2232 add_triededns(fetchctx_t *fctx, isc_sockaddr_t *address) { 2233 struct tried *tried; 2234 2235 tried = triededns(fctx, address); 2236 if (tried != NULL) { 2237 tried->count++; 2238 return; 2239 } 2240 2241 tried = isc_mem_get(fctx->mctx, sizeof(*tried)); 2242 2243 tried->addr = *address; 2244 tried->count = 1; 2245 ISC_LIST_INITANDAPPEND(fctx->edns, tried, link); 2246 } 2247 2248 static size_t 2249 addr2buf(void *buf, const size_t bufsize, const isc_sockaddr_t *sockaddr) { 2250 isc_netaddr_t netaddr; 2251 isc_netaddr_fromsockaddr(&netaddr, sockaddr); 2252 switch (netaddr.family) { 2253 case AF_INET: 2254 INSIST(bufsize >= 4); 2255 memmove(buf, &netaddr.type.in, 4); 2256 return 4; 2257 case AF_INET6: 2258 INSIST(bufsize >= 16); 2259 memmove(buf, &netaddr.type.in6, 16); 2260 return 16; 2261 default: 2262 UNREACHABLE(); 2263 } 2264 return 0; 2265 } 2266 2267 static size_t 2268 add_serveraddr(uint8_t *buf, const size_t bufsize, const resquery_t *query) { 2269 return addr2buf(buf, bufsize, &query->addrinfo->sockaddr); 2270 } 2271 2272 /* 2273 * Client cookie is 8 octets. 2274 * Server cookie is [8..32] octets. 2275 */ 2276 #define CLIENT_COOKIE_SIZE 8U 2277 #define COOKIE_BUFFER_SIZE (8U + 32U) 2278 2279 static void 2280 compute_cc(const resquery_t *query, uint8_t *cookie, const size_t len) { 2281 INSIST(len >= CLIENT_COOKIE_SIZE); 2282 STATIC_ASSERT(sizeof(query->fctx->res->view->secret) >= 2283 ISC_SIPHASH24_KEY_LENGTH, 2284 "The view->secret size can't fit SipHash 2-4 key " 2285 "length"); 2286 2287 uint8_t buf[16] ISC_NONSTRING = { 0 }; 2288 size_t buflen = add_serveraddr(buf, sizeof(buf), query); 2289 2290 uint8_t digest[ISC_SIPHASH24_TAG_LENGTH] ISC_NONSTRING = { 0 }; 2291 isc_siphash24(query->fctx->res->view->secret, buf, buflen, true, 2292 digest); 2293 memmove(cookie, digest, CLIENT_COOKIE_SIZE); 2294 } 2295 2296 static isc_result_t 2297 issecuredomain(dns_view_t *view, const dns_name_t *name, dns_rdatatype_t type, 2298 isc_stdtime_t now, bool checknta, bool *ntap, bool *issecure) { 2299 dns_name_t suffix; 2300 unsigned int labels; 2301 2302 /* 2303 * For DS variants we need to check fom the parent domain, 2304 * since there may be a negative trust anchor for the name, 2305 * while the enclosing domain where the DS record lives is 2306 * under a secure entry point. 2307 */ 2308 labels = dns_name_countlabels(name); 2309 if (dns_rdatatype_atparent(type) && labels > 1) { 2310 dns_name_init(&suffix, NULL); 2311 dns_name_getlabelsequence(name, 1, labels - 1, &suffix); 2312 name = &suffix; 2313 } 2314 2315 return dns_view_issecuredomain(view, name, now, checknta, ntap, 2316 issecure); 2317 } 2318 2319 static isc_result_t 2320 resquery_send(resquery_t *query) { 2321 isc_result_t result; 2322 fetchctx_t *fctx = query->fctx; 2323 dns_resolver_t *res = fctx->res; 2324 isc_buffer_t buffer; 2325 dns_name_t *qname = NULL; 2326 dns_rdataset_t *qrdataset = NULL; 2327 isc_region_t r; 2328 isc_netaddr_t ipaddr; 2329 dns_tsigkey_t *tsigkey = NULL; 2330 dns_peer_t *peer = NULL; 2331 dns_compress_t cctx; 2332 bool useedns; 2333 bool secure_domain; 2334 bool tcp = ((query->options & DNS_FETCHOPT_TCP) != 0); 2335 dns_ednsopt_t ednsopts[DNS_EDNSOPTIONS]; 2336 unsigned int ednsopt = 0; 2337 uint16_t hint = 0, udpsize = 0; /* No EDNS */ 2338 #ifdef HAVE_DNSTAP 2339 isc_sockaddr_t localaddr, *la = NULL; 2340 unsigned char zone[DNS_NAME_MAXWIRE]; 2341 dns_transport_type_t transport_type; 2342 dns_dtmsgtype_t dtmsgtype; 2343 isc_region_t zr; 2344 isc_buffer_t zb; 2345 #endif /* HAVE_DNSTAP */ 2346 2347 QTRACE("send"); 2348 2349 if (atomic_load_acquire(&res->exiting)) { 2350 FCTXTRACE("resquery_send: resolver shutting down"); 2351 return ISC_R_SHUTTINGDOWN; 2352 } 2353 2354 dns_message_gettempname(fctx->qmessage, &qname); 2355 dns_message_gettemprdataset(fctx->qmessage, &qrdataset); 2356 2357 fctx->qmessage->opcode = dns_opcode_query; 2358 2359 /* 2360 * Set up question. 2361 */ 2362 dns_name_clone(fctx->name, qname); 2363 dns_rdataset_makequestion(qrdataset, res->rdclass, fctx->type); 2364 ISC_LIST_APPEND(qname->list, qrdataset, link); 2365 dns_message_addname(fctx->qmessage, qname, DNS_SECTION_QUESTION); 2366 2367 /* 2368 * Set RD if the client has requested that we do a recursive 2369 * query, or if we're sending to a forwarder. 2370 */ 2371 if ((query->options & DNS_FETCHOPT_RECURSIVE) != 0 || 2372 ISFORWARDER(query->addrinfo)) 2373 { 2374 fctx->qmessage->flags |= DNS_MESSAGEFLAG_RD; 2375 } 2376 2377 /* 2378 * Set CD if the client says not to validate, or if the 2379 * question is under a secure entry point and this is a 2380 * recursive/forward query -- unless the client said not to. 2381 */ 2382 if ((query->options & DNS_FETCHOPT_NOCDFLAG) != 0) { 2383 /* Do nothing */ 2384 } else if ((query->options & DNS_FETCHOPT_NOVALIDATE) != 0) { 2385 fctx->qmessage->flags |= DNS_MESSAGEFLAG_CD; 2386 } else if (res->view->enablevalidation && 2387 ((fctx->qmessage->flags & DNS_MESSAGEFLAG_RD) != 0)) 2388 { 2389 bool checknta = ((query->options & DNS_FETCHOPT_NONTA) == 0); 2390 bool ntacovered = false; 2391 result = issecuredomain(res->view, fctx->name, fctx->type, 2392 isc_time_seconds(&query->start), 2393 checknta, &ntacovered, &secure_domain); 2394 if (result != ISC_R_SUCCESS) { 2395 secure_domain = false; 2396 } 2397 if (secure_domain || 2398 (ISFORWARDER(query->addrinfo) && ntacovered)) 2399 { 2400 fctx->qmessage->flags |= DNS_MESSAGEFLAG_CD; 2401 } 2402 } 2403 2404 /* 2405 * We don't have to set opcode because it defaults to query. 2406 */ 2407 fctx->qmessage->id = query->id; 2408 2409 /* 2410 * Convert the question to wire format. 2411 */ 2412 dns_compress_init(&cctx, fctx->mctx, 0); 2413 2414 isc_buffer_init(&buffer, query->data, sizeof(query->data)); 2415 result = dns_message_renderbegin(fctx->qmessage, &cctx, &buffer); 2416 if (result != ISC_R_SUCCESS) { 2417 goto cleanup_message; 2418 } 2419 2420 result = dns_message_rendersection(fctx->qmessage, DNS_SECTION_QUESTION, 2421 0); 2422 if (result != ISC_R_SUCCESS) { 2423 goto cleanup_message; 2424 } 2425 2426 isc_netaddr_fromsockaddr(&ipaddr, &query->addrinfo->sockaddr); 2427 (void)dns_peerlist_peerbyaddr(fctx->res->view->peers, &ipaddr, &peer); 2428 2429 /* 2430 * The ADB does not know about servers with "edns no". Check 2431 * this, and then inform the ADB for future use. 2432 */ 2433 if ((query->addrinfo->flags & FCTX_ADDRINFO_NOEDNS0) == 0 && 2434 peer != NULL && 2435 dns_peer_getsupportedns(peer, &useedns) == ISC_R_SUCCESS && 2436 !useedns) 2437 { 2438 query->options |= DNS_FETCHOPT_NOEDNS0; 2439 dns_adb_changeflags(fctx->adb, query->addrinfo, 2440 FCTX_ADDRINFO_NOEDNS0, 2441 FCTX_ADDRINFO_NOEDNS0); 2442 } 2443 2444 /* Sync NOEDNS0 flag in addrinfo->flags and options now. */ 2445 if ((query->addrinfo->flags & FCTX_ADDRINFO_NOEDNS0) != 0) { 2446 query->options |= DNS_FETCHOPT_NOEDNS0; 2447 } 2448 2449 if (fctx->timeout && (query->options & DNS_FETCHOPT_NOEDNS0) == 0) { 2450 isc_sockaddr_t *sockaddr = &query->addrinfo->sockaddr; 2451 struct tried *tried; 2452 2453 /* 2454 * If this is the first timeout for this server in this 2455 * fetch context, try setting EDNS UDP buffer size to 2456 * the largest UDP response size we have seen from this 2457 * server so far. 2458 * 2459 * If this server has already timed out twice or more in 2460 * this fetch context, force TCP. 2461 */ 2462 if ((tried = triededns(fctx, sockaddr)) != NULL) { 2463 if (tried->count == 1U) { 2464 hint = dns_adb_getudpsize(fctx->adb, 2465 query->addrinfo); 2466 } else if (tried->count >= 2U) { 2467 if ((query->options & DNS_FETCHOPT_TCP) == 0) { 2468 /* 2469 * Inform the ADB that we're ending a 2470 * UDP fetch, and turn the query into 2471 * a TCP query. 2472 */ 2473 dns_adb_endudpfetch(fctx->adb, 2474 query->addrinfo); 2475 query->options |= DNS_FETCHOPT_TCP; 2476 } 2477 } 2478 } 2479 } 2480 fctx->timeout = false; 2481 2482 /* 2483 * Use EDNS0, unless the caller doesn't want it, or we know that 2484 * the remote server doesn't like it. 2485 */ 2486 if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0) { 2487 if ((query->addrinfo->flags & FCTX_ADDRINFO_NOEDNS0) == 0) { 2488 uint16_t peerudpsize = 0; 2489 unsigned int version = DNS_EDNS_VERSION; 2490 unsigned int flags = query->addrinfo->flags; 2491 bool reqnsid = res->view->requestnsid; 2492 bool sendcookie = res->view->sendcookie; 2493 bool tcpkeepalive = false; 2494 unsigned char cookie[COOKIE_BUFFER_SIZE]; 2495 uint16_t padding = 0; 2496 2497 /* 2498 * Set the default UDP size to what was 2499 * configured as 'edns-buffer-size' 2500 */ 2501 udpsize = res->view->udpsize; 2502 2503 /* 2504 * This server timed out for the first time in 2505 * this fetch context and we received a response 2506 * from it before (either in this fetch context 2507 * or in a different one). Set 'udpsize' to the 2508 * size of the largest UDP response we have 2509 * received from this server so far. 2510 */ 2511 if (hint != 0U) { 2512 udpsize = hint; 2513 } 2514 2515 /* 2516 * If a fixed EDNS UDP buffer size is configured 2517 * for this server, make sure we obey that. 2518 */ 2519 if (peer != NULL) { 2520 (void)dns_peer_getudpsize(peer, &peerudpsize); 2521 if (peerudpsize != 0) { 2522 udpsize = peerudpsize; 2523 } 2524 } 2525 2526 if ((flags & DNS_FETCHOPT_EDNSVERSIONSET) != 0) { 2527 version = flags & DNS_FETCHOPT_EDNSVERSIONMASK; 2528 version >>= DNS_FETCHOPT_EDNSVERSIONSHIFT; 2529 } 2530 2531 /* Request NSID/COOKIE/VERSION for current peer? 2532 */ 2533 if (peer != NULL) { 2534 uint8_t ednsversion; 2535 (void)dns_peer_getrequestnsid(peer, &reqnsid); 2536 (void)dns_peer_getsendcookie(peer, &sendcookie); 2537 result = dns_peer_getednsversion(peer, 2538 &ednsversion); 2539 if (result == ISC_R_SUCCESS && 2540 ednsversion < version) 2541 { 2542 version = ednsversion; 2543 } 2544 } 2545 if (NOCOOKIE(query->addrinfo)) { 2546 sendcookie = false; 2547 } 2548 if (reqnsid) { 2549 INSIST(ednsopt < DNS_EDNSOPTIONS); 2550 ednsopts[ednsopt].code = DNS_OPT_NSID; 2551 ednsopts[ednsopt].length = 0; 2552 ednsopts[ednsopt].value = NULL; 2553 ednsopt++; 2554 } 2555 if (sendcookie) { 2556 INSIST(ednsopt < DNS_EDNSOPTIONS); 2557 ednsopts[ednsopt].code = DNS_OPT_COOKIE; 2558 ednsopts[ednsopt].length = 2559 (uint16_t)dns_adb_getcookie( 2560 query->addrinfo, cookie, 2561 sizeof(cookie)); 2562 if (ednsopts[ednsopt].length != 0) { 2563 ednsopts[ednsopt].value = cookie; 2564 inc_stats( 2565 fctx->res, 2566 dns_resstatscounter_cookieout); 2567 } else { 2568 compute_cc(query, cookie, 2569 CLIENT_COOKIE_SIZE); 2570 ednsopts[ednsopt].value = cookie; 2571 ednsopts[ednsopt].length = 2572 CLIENT_COOKIE_SIZE; 2573 inc_stats( 2574 fctx->res, 2575 dns_resstatscounter_cookienew); 2576 } 2577 ednsopt++; 2578 } 2579 2580 /* Add TCP keepalive option if appropriate */ 2581 if ((peer != NULL) && tcp) { 2582 (void)dns_peer_gettcpkeepalive(peer, 2583 &tcpkeepalive); 2584 } 2585 if (tcpkeepalive) { 2586 INSIST(ednsopt < DNS_EDNSOPTIONS); 2587 ednsopts[ednsopt].code = DNS_OPT_TCP_KEEPALIVE; 2588 ednsopts[ednsopt].length = 0; 2589 ednsopts[ednsopt].value = NULL; 2590 ednsopt++; 2591 } 2592 2593 /* Add PAD for current peer? Require TCP for now 2594 */ 2595 if ((peer != NULL) && tcp) { 2596 (void)dns_peer_getpadding(peer, &padding); 2597 } 2598 if (padding != 0) { 2599 INSIST(ednsopt < DNS_EDNSOPTIONS); 2600 ednsopts[ednsopt].code = DNS_OPT_PAD; 2601 ednsopts[ednsopt].length = 0; 2602 ednsopt++; 2603 dns_message_setpadding(fctx->qmessage, padding); 2604 } 2605 2606 query->ednsversion = version; 2607 result = fctx_addopt(fctx->qmessage, version, udpsize, 2608 ednsopts, ednsopt); 2609 if (reqnsid && result == ISC_R_SUCCESS) { 2610 query->options |= DNS_FETCHOPT_WANTNSID; 2611 } else if (result != ISC_R_SUCCESS) { 2612 /* 2613 * We couldn't add the OPT, but we'll 2614 * press on. We're not using EDNS0, so 2615 * set the NOEDNS0 bit. 2616 */ 2617 query->options |= DNS_FETCHOPT_NOEDNS0; 2618 query->ednsversion = -1; 2619 udpsize = 0; 2620 } 2621 } else { 2622 /* 2623 * We know this server doesn't like EDNS0, so we 2624 * won't use it. Set the NOEDNS0 bit since 2625 * we're not using EDNS0. 2626 */ 2627 query->options |= DNS_FETCHOPT_NOEDNS0; 2628 query->ednsversion = -1; 2629 } 2630 } else { 2631 query->ednsversion = -1; 2632 } 2633 2634 /* 2635 * Record the UDP EDNS size chosen. 2636 */ 2637 query->udpsize = udpsize; 2638 2639 /* 2640 * If we need EDNS0 to do this query and aren't using it, we 2641 * lose. 2642 */ 2643 if (NEEDEDNS0(fctx) && (query->options & DNS_FETCHOPT_NOEDNS0) != 0) { 2644 result = DNS_R_SERVFAIL; 2645 goto cleanup_message; 2646 } 2647 2648 add_triededns(fctx, &query->addrinfo->sockaddr); 2649 2650 /* 2651 * Clear CD if EDNS is not in use. 2652 */ 2653 if ((query->options & DNS_FETCHOPT_NOEDNS0) != 0) { 2654 fctx->qmessage->flags &= ~DNS_MESSAGEFLAG_CD; 2655 } 2656 2657 /* 2658 * Add TSIG record tailored to the current recipient. 2659 */ 2660 result = dns_view_getpeertsig(fctx->res->view, &ipaddr, &tsigkey); 2661 if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) { 2662 goto cleanup_message; 2663 } 2664 2665 if (tsigkey != NULL) { 2666 result = dns_message_settsigkey(fctx->qmessage, tsigkey); 2667 dns_tsigkey_detach(&tsigkey); 2668 if (result != ISC_R_SUCCESS) { 2669 goto cleanup_message; 2670 } 2671 } 2672 2673 result = dns_message_rendersection(fctx->qmessage, 2674 DNS_SECTION_ADDITIONAL, 0); 2675 if (result != ISC_R_SUCCESS) { 2676 goto cleanup_message; 2677 } 2678 2679 result = dns_message_renderend(fctx->qmessage); 2680 if (result != ISC_R_SUCCESS) { 2681 goto cleanup_message; 2682 } 2683 2684 #ifdef HAVE_DNSTAP 2685 memset(&zr, 0, sizeof(zr)); 2686 isc_buffer_init(&zb, zone, sizeof(zone)); 2687 dns_compress_setpermitted(&cctx, false); 2688 result = dns_name_towire(fctx->domain, &cctx, &zb, NULL); 2689 if (result == ISC_R_SUCCESS) { 2690 isc_buffer_usedregion(&zb, &zr); 2691 } 2692 #endif /* HAVE_DNSTAP */ 2693 2694 if (dns_message_gettsigkey(fctx->qmessage) != NULL) { 2695 dns_tsigkey_attach(dns_message_gettsigkey(fctx->qmessage), 2696 &query->tsigkey); 2697 result = dns_message_getquerytsig(fctx->qmessage, fctx->mctx, 2698 &query->tsig); 2699 if (result != ISC_R_SUCCESS) { 2700 goto cleanup_message; 2701 } 2702 } 2703 2704 /* 2705 * Log the outgoing packet. 2706 */ 2707 dns_message_logfmtpacket( 2708 fctx->qmessage, "sending packet to", &query->addrinfo->sockaddr, 2709 DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_PACKETS, 2710 &dns_master_style_comment, ISC_LOG_DEBUG(11), fctx->mctx); 2711 2712 /* 2713 * We're now done with the query message. 2714 */ 2715 dns_compress_invalidate(&cctx); 2716 dns_message_reset(fctx->qmessage, DNS_MESSAGE_INTENTRENDER); 2717 2718 isc_buffer_usedregion(&buffer, &r); 2719 2720 resquery_ref(query); 2721 dns_dispatch_send(query->dispentry, &r); 2722 2723 QTRACE("sent"); 2724 2725 #ifdef HAVE_DNSTAP 2726 /* 2727 * Log the outgoing query via dnstap. 2728 */ 2729 if ((fctx->qmessage->flags & DNS_MESSAGEFLAG_RD) != 0) { 2730 dtmsgtype = DNS_DTTYPE_FQ; 2731 } else { 2732 dtmsgtype = DNS_DTTYPE_RQ; 2733 } 2734 2735 result = dns_dispentry_getlocaladdress(query->dispentry, &localaddr); 2736 if (result == ISC_R_SUCCESS) { 2737 la = &localaddr; 2738 } 2739 2740 if (query->addrinfo->transport != NULL) { 2741 transport_type = 2742 dns_transport_get_type(query->addrinfo->transport); 2743 } else if ((query->options & DNS_FETCHOPT_TCP) != 0) { 2744 transport_type = DNS_TRANSPORT_TCP; 2745 } else { 2746 transport_type = DNS_TRANSPORT_UDP; 2747 } 2748 2749 dns_dt_send(fctx->res->view, dtmsgtype, la, &query->addrinfo->sockaddr, 2750 transport_type, &zr, &query->start, NULL, &buffer); 2751 #endif /* HAVE_DNSTAP */ 2752 2753 return ISC_R_SUCCESS; 2754 2755 cleanup_message: 2756 dns_compress_invalidate(&cctx); 2757 2758 dns_message_reset(fctx->qmessage, DNS_MESSAGE_INTENTRENDER); 2759 2760 /* 2761 * Stop the dispatcher from listening. 2762 */ 2763 dns_dispatch_done(&query->dispentry); 2764 2765 return result; 2766 } 2767 2768 static void 2769 resquery_connected(isc_result_t eresult, isc_region_t *region, void *arg) { 2770 resquery_t *query = (resquery_t *)arg; 2771 resquery_t *copy = query; 2772 isc_result_t result; 2773 fetchctx_t *fctx = NULL; 2774 dns_resolver_t *res = NULL; 2775 int pf; 2776 2777 REQUIRE(VALID_QUERY(query)); 2778 2779 QTRACE("connected"); 2780 2781 UNUSED(region); 2782 2783 fctx = query->fctx; 2784 2785 REQUIRE(VALID_FCTX(fctx)); 2786 REQUIRE(fctx->tid == isc_tid()); 2787 2788 res = fctx->res; 2789 2790 if (RESQUERY_CANCELED(query)) { 2791 goto detach; 2792 } 2793 2794 if (atomic_load_acquire(&fctx->res->exiting)) { 2795 eresult = ISC_R_SHUTTINGDOWN; 2796 } 2797 2798 /* 2799 * The reference counting of resquery objects is complex: 2800 * 2801 * 1. attached in fctx_query() 2802 * 2. attached prior to dns_dispatch_connect(), detached in 2803 * resquery_connected() 2804 * 3. attached prior to dns_dispatch_send(), detached in 2805 * resquery_senddone() 2806 * 4. finally detached in fctx_cancelquery() 2807 * 2808 * On error conditions, it's necessary to call fctx_cancelquery() 2809 * from resquery_connected() or _senddone(), detaching twice 2810 * within the same function. To make it clear that's what's 2811 * happening, we cancel-and-detach 'copy' and detach 'query', 2812 * which are both pointing to the same object. 2813 */ 2814 switch (eresult) { 2815 case ISC_R_SUCCESS: 2816 /* 2817 * We are connected. Send the query. 2818 */ 2819 2820 result = resquery_send(query); 2821 if (result != ISC_R_SUCCESS) { 2822 FCTXTRACE("query canceled: resquery_send() failed; " 2823 "responding"); 2824 2825 fctx_cancelquery(©, NULL, false, false); 2826 fctx_done_detach(&fctx, result); 2827 break; 2828 } 2829 2830 fctx->querysent++; 2831 2832 pf = isc_sockaddr_pf(&query->addrinfo->sockaddr); 2833 if (pf == PF_INET) { 2834 inc_stats(res, dns_resstatscounter_queryv4); 2835 } else { 2836 inc_stats(res, dns_resstatscounter_queryv6); 2837 } 2838 if (res->querystats != NULL) { 2839 dns_rdatatypestats_increment(res->querystats, 2840 fctx->type); 2841 } 2842 break; 2843 2844 case ISC_R_CANCELED: 2845 case ISC_R_SHUTTINGDOWN: 2846 FCTXTRACE3("shutdown in resquery_connected()", eresult); 2847 fctx_cancelquery(©, NULL, true, false); 2848 fctx_done_detach(&fctx, eresult); 2849 break; 2850 2851 case ISC_R_HOSTDOWN: 2852 case ISC_R_HOSTUNREACH: 2853 case ISC_R_NETDOWN: 2854 case ISC_R_NETUNREACH: 2855 case ISC_R_CONNREFUSED: 2856 case ISC_R_NOPERM: 2857 case ISC_R_ADDRNOTAVAIL: 2858 case ISC_R_CONNECTIONRESET: 2859 case ISC_R_TIMEDOUT: 2860 /* 2861 * Do not query this server again in this fetch context. 2862 */ 2863 FCTXTRACE3("query failed in resquery_connected(): " 2864 "no response", 2865 eresult); 2866 add_bad(fctx, query->rmessage, query->addrinfo, eresult, 2867 badns_unreachable); 2868 fctx_cancelquery(©, NULL, true, false); 2869 2870 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 2871 fctx_try(fctx, true); 2872 break; 2873 2874 default: 2875 FCTXTRACE3("query canceled in resquery_connected() " 2876 "due to unexpected result; responding", 2877 eresult); 2878 2879 fctx_cancelquery(©, NULL, false, false); 2880 fctx_done_detach(&fctx, eresult); 2881 break; 2882 } 2883 2884 detach: 2885 resquery_detach(&query); 2886 } 2887 2888 static void 2889 fctx_finddone(void *arg) { 2890 dns_adbfind_t *find = (dns_adbfind_t *)arg; 2891 fetchctx_t *fctx = (fetchctx_t *)find->cbarg; 2892 bool want_try = false; 2893 bool want_done = false; 2894 uint_fast32_t pending; 2895 2896 REQUIRE(VALID_FCTX(fctx)); 2897 2898 FCTXTRACE("finddone"); 2899 2900 REQUIRE(fctx->tid == isc_tid()); 2901 2902 LOCK(&fctx->lock); 2903 pending = atomic_fetch_sub_release(&fctx->pending, 1); 2904 INSIST(pending > 0); 2905 2906 if (ADDRWAIT(fctx)) { 2907 /* 2908 * The fetch is waiting for a name to be found. 2909 */ 2910 INSIST(!SHUTTINGDOWN(fctx)); 2911 if (dns_adb_findstatus(find) == DNS_ADB_MOREADDRESSES) { 2912 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 2913 want_try = true; 2914 } else { 2915 fctx->findfail++; 2916 if (atomic_load_acquire(&fctx->pending) == 0) { 2917 /* 2918 * We've got nothing else to wait for 2919 * and don't know the answer. There's 2920 * nothing to do but fail the fctx. 2921 */ 2922 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 2923 want_done = true; 2924 } 2925 } 2926 } 2927 2928 UNLOCK(&fctx->lock); 2929 2930 dns_adb_destroyfind(&find); 2931 2932 if (want_done) { 2933 FCTXTRACE("fetch failed in finddone(); return " 2934 "ISC_R_FAILURE"); 2935 2936 fctx_done_unref(fctx, ISC_R_FAILURE); 2937 } else if (want_try) { 2938 fctx_try(fctx, true); 2939 } 2940 2941 fetchctx_detach(&fctx); 2942 } 2943 2944 static bool 2945 bad_server(fetchctx_t *fctx, isc_sockaddr_t *address) { 2946 isc_sockaddr_t *sa; 2947 2948 for (sa = ISC_LIST_HEAD(fctx->bad); sa != NULL; 2949 sa = ISC_LIST_NEXT(sa, link)) 2950 { 2951 if (isc_sockaddr_equal(sa, address)) { 2952 return true; 2953 } 2954 } 2955 2956 return false; 2957 } 2958 2959 static bool 2960 mark_bad(fetchctx_t *fctx) { 2961 dns_adbfind_t *curr; 2962 dns_adbaddrinfo_t *addrinfo; 2963 bool all_bad = true; 2964 2965 #ifdef ENABLE_AFL 2966 if (dns_fuzzing_resolver) { 2967 return false; 2968 } 2969 #endif /* ifdef ENABLE_AFL */ 2970 2971 /* 2972 * Mark all known bad servers, so we don't try to talk to them 2973 * again. 2974 */ 2975 2976 /* 2977 * Mark any bad nameservers. 2978 */ 2979 for (curr = ISC_LIST_HEAD(fctx->finds); curr != NULL; 2980 curr = ISC_LIST_NEXT(curr, publink)) 2981 { 2982 for (addrinfo = ISC_LIST_HEAD(curr->list); addrinfo != NULL; 2983 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 2984 { 2985 if (bad_server(fctx, &addrinfo->sockaddr)) { 2986 addrinfo->flags |= FCTX_ADDRINFO_MARK; 2987 } else { 2988 all_bad = false; 2989 } 2990 } 2991 } 2992 2993 /* 2994 * Mark any bad forwarders. 2995 */ 2996 for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs); addrinfo != NULL; 2997 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 2998 { 2999 if (bad_server(fctx, &addrinfo->sockaddr)) { 3000 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3001 } else { 3002 all_bad = false; 3003 } 3004 } 3005 3006 /* 3007 * Mark any bad alternates. 3008 */ 3009 for (curr = ISC_LIST_HEAD(fctx->altfinds); curr != NULL; 3010 curr = ISC_LIST_NEXT(curr, publink)) 3011 { 3012 for (addrinfo = ISC_LIST_HEAD(curr->list); addrinfo != NULL; 3013 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3014 { 3015 if (bad_server(fctx, &addrinfo->sockaddr)) { 3016 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3017 } else { 3018 all_bad = false; 3019 } 3020 } 3021 } 3022 3023 for (addrinfo = ISC_LIST_HEAD(fctx->altaddrs); addrinfo != NULL; 3024 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3025 { 3026 if (bad_server(fctx, &addrinfo->sockaddr)) { 3027 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3028 } else { 3029 all_bad = false; 3030 } 3031 } 3032 3033 return all_bad; 3034 } 3035 3036 static void 3037 add_bad(fetchctx_t *fctx, dns_message_t *rmessage, dns_adbaddrinfo_t *addrinfo, 3038 isc_result_t reason, badnstype_t badtype) { 3039 char namebuf[DNS_NAME_FORMATSIZE]; 3040 char addrbuf[ISC_SOCKADDR_FORMATSIZE]; 3041 char classbuf[64]; 3042 char typebuf[64]; 3043 char code[64]; 3044 isc_buffer_t b; 3045 isc_sockaddr_t *sa; 3046 const char *spc = ""; 3047 isc_sockaddr_t *address = &addrinfo->sockaddr; 3048 3049 #ifdef ENABLE_AFL 3050 if (dns_fuzzing_resolver) { 3051 return; 3052 } 3053 #endif /* ifdef ENABLE_AFL */ 3054 3055 if (reason == DNS_R_LAME) { 3056 fctx->lamecount++; 3057 } else { 3058 switch (badtype) { 3059 case badns_unreachable: 3060 fctx->neterr++; 3061 break; 3062 case badns_response: 3063 fctx->badresp++; 3064 break; 3065 case badns_validation: 3066 break; /* counted as 'valfail' */ 3067 case badns_forwarder: 3068 /* 3069 * We were called to prevent the given forwarder 3070 * from being used again for this fetch context. 3071 */ 3072 break; 3073 } 3074 } 3075 3076 if (bad_server(fctx, address)) { 3077 /* 3078 * We already know this server is bad. 3079 */ 3080 return; 3081 } 3082 3083 FCTXTRACE("add_bad"); 3084 3085 sa = isc_mem_get(fctx->mctx, sizeof(*sa)); 3086 *sa = *address; 3087 ISC_LIST_INITANDAPPEND(fctx->bad, sa, link); 3088 3089 if (reason == DNS_R_LAME) { /* already logged */ 3090 return; 3091 } 3092 3093 if (reason == DNS_R_UNEXPECTEDRCODE && 3094 rmessage->rcode == dns_rcode_servfail && ISFORWARDER(addrinfo)) 3095 { 3096 return; 3097 } 3098 3099 if (reason == DNS_R_UNEXPECTEDRCODE) { 3100 isc_buffer_init(&b, code, sizeof(code) - 1); 3101 dns_rcode_totext(rmessage->rcode, &b); 3102 code[isc_buffer_usedlength(&b)] = '\0'; 3103 spc = " "; 3104 } else if (reason == DNS_R_UNEXPECTEDOPCODE) { 3105 isc_buffer_init(&b, code, sizeof(code) - 1); 3106 dns_opcode_totext((dns_opcode_t)rmessage->opcode, &b); 3107 code[isc_buffer_usedlength(&b)] = '\0'; 3108 spc = " "; 3109 } else { 3110 code[0] = '\0'; 3111 } 3112 dns_name_format(fctx->name, namebuf, sizeof(namebuf)); 3113 dns_rdatatype_format(fctx->type, typebuf, sizeof(typebuf)); 3114 dns_rdataclass_format(fctx->res->rdclass, classbuf, sizeof(classbuf)); 3115 isc_sockaddr_format(address, addrbuf, sizeof(addrbuf)); 3116 isc_log_write( 3117 dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS, DNS_LOGMODULE_RESOLVER, 3118 ISC_LOG_INFO, "%s%s%s resolving '%s/%s/%s': %s", code, spc, 3119 isc_result_totext(reason), namebuf, typebuf, classbuf, addrbuf); 3120 } 3121 3122 /* 3123 * Sort addrinfo list by RTT. 3124 */ 3125 static void 3126 sort_adbfind(dns_adbfind_t *find, unsigned int bias) { 3127 dns_adbaddrinfo_t *best, *curr; 3128 dns_adbaddrinfolist_t sorted; 3129 3130 /* Lame N^2 bubble sort. */ 3131 ISC_LIST_INIT(sorted); 3132 while (!ISC_LIST_EMPTY(find->list)) { 3133 unsigned int best_srtt; 3134 best = ISC_LIST_HEAD(find->list); 3135 best_srtt = best->srtt; 3136 if (isc_sockaddr_pf(&best->sockaddr) != AF_INET6) { 3137 best_srtt += bias; 3138 } 3139 curr = ISC_LIST_NEXT(best, publink); 3140 while (curr != NULL) { 3141 unsigned int curr_srtt = curr->srtt; 3142 if (isc_sockaddr_pf(&curr->sockaddr) != AF_INET6) { 3143 curr_srtt += bias; 3144 } 3145 if (curr_srtt < best_srtt) { 3146 best = curr; 3147 best_srtt = curr_srtt; 3148 } 3149 curr = ISC_LIST_NEXT(curr, publink); 3150 } 3151 ISC_LIST_UNLINK(find->list, best, publink); 3152 ISC_LIST_APPEND(sorted, best, publink); 3153 } 3154 find->list = sorted; 3155 } 3156 3157 /* 3158 * Sort a list of finds by server RTT. 3159 */ 3160 static void 3161 sort_finds(dns_adbfindlist_t *findlist, unsigned int bias) { 3162 dns_adbfind_t *best, *curr; 3163 dns_adbfindlist_t sorted; 3164 dns_adbaddrinfo_t *addrinfo, *bestaddrinfo; 3165 3166 /* Sort each find's addrinfo list by SRTT. */ 3167 for (curr = ISC_LIST_HEAD(*findlist); curr != NULL; 3168 curr = ISC_LIST_NEXT(curr, publink)) 3169 { 3170 sort_adbfind(curr, bias); 3171 } 3172 3173 /* Lame N^2 bubble sort. */ 3174 ISC_LIST_INIT(sorted); 3175 while (!ISC_LIST_EMPTY(*findlist)) { 3176 unsigned int best_srtt; 3177 best = ISC_LIST_HEAD(*findlist); 3178 bestaddrinfo = ISC_LIST_HEAD(best->list); 3179 INSIST(bestaddrinfo != NULL); 3180 best_srtt = bestaddrinfo->srtt; 3181 if (isc_sockaddr_pf(&bestaddrinfo->sockaddr) != AF_INET6) { 3182 best_srtt += bias; 3183 } 3184 curr = ISC_LIST_NEXT(best, publink); 3185 while (curr != NULL) { 3186 unsigned int curr_srtt; 3187 addrinfo = ISC_LIST_HEAD(curr->list); 3188 INSIST(addrinfo != NULL); 3189 curr_srtt = addrinfo->srtt; 3190 if (isc_sockaddr_pf(&addrinfo->sockaddr) != AF_INET6) { 3191 curr_srtt += bias; 3192 } 3193 if (curr_srtt < best_srtt) { 3194 best = curr; 3195 best_srtt = curr_srtt; 3196 } 3197 curr = ISC_LIST_NEXT(curr, publink); 3198 } 3199 ISC_LIST_UNLINK(*findlist, best, publink); 3200 ISC_LIST_APPEND(sorted, best, publink); 3201 } 3202 *findlist = sorted; 3203 } 3204 3205 /* 3206 * Return true iff the ADB find has a pending fetch for 'type'. This is 3207 * used to find out whether we're in a loop, where a fetch is waiting for a 3208 * find which is waiting for that same fetch. 3209 * 3210 * Note: This could be done with either an equivalence check (e.g., 3211 * query_pending == DNS_ADBFIND_INET) or with a bit check, as below. If 3212 * we checked for equivalence, that would mean we could only detect a loop 3213 * when there is exactly one pending fetch, and we're it. If there were 3214 * pending fetches for *both* address families, then a loop would be 3215 * undetected. 3216 * 3217 * However, using a bit check means that in theory, an ADB find might be 3218 * aborted that could have succeeded, if the other fetch had returned an 3219 * answer. 3220 * 3221 * Since there's a good chance the server is broken and won't answer either 3222 * query, and since an ADB find with two pending fetches is a very rare 3223 * occurrance anyway, we regard this theoretical SERVFAIL as the lesser 3224 * evil. 3225 */ 3226 static bool 3227 waiting_for(dns_adbfind_t *find, dns_rdatatype_t type) { 3228 switch (type) { 3229 case dns_rdatatype_a: 3230 return (find->query_pending & DNS_ADBFIND_INET) != 0; 3231 case dns_rdatatype_aaaa: 3232 return (find->query_pending & DNS_ADBFIND_INET6) != 0; 3233 default: 3234 return false; 3235 } 3236 } 3237 3238 static void 3239 findname(fetchctx_t *fctx, const dns_name_t *name, in_port_t port, 3240 unsigned int options, unsigned int flags, isc_stdtime_t now, 3241 bool *overquota, bool *need_alternate, unsigned int *no_addresses) { 3242 dns_adbaddrinfo_t *ai = NULL; 3243 dns_adbfind_t *find = NULL; 3244 dns_resolver_t *res = fctx->res; 3245 bool unshared = ((fctx->options & DNS_FETCHOPT_UNSHARED) != 0); 3246 isc_result_t result; 3247 3248 FCTXTRACE("FINDNAME"); 3249 3250 /* 3251 * If this name is a subdomain of the query domain, tell 3252 * the ADB to start looking using zone/hint data. This keeps us 3253 * from getting stuck if the nameserver is beneath the zone cut 3254 * and we don't know its address (e.g. because the A record has 3255 * expired). 3256 */ 3257 if (dns_name_issubdomain(name, fctx->domain)) { 3258 options |= DNS_ADBFIND_STARTATZONE; 3259 } 3260 3261 /* 3262 * Exempt prefetches from ADB quota. 3263 */ 3264 if ((fctx->options & DNS_FETCHOPT_PREFETCH) != 0) { 3265 options |= DNS_ADBFIND_QUOTAEXEMPT; 3266 } 3267 3268 /* 3269 * See what we know about this address. 3270 */ 3271 INSIST(!SHUTTINGDOWN(fctx)); 3272 fetchctx_ref(fctx); 3273 result = dns_adb_createfind(fctx->adb, fctx->loop, fctx_finddone, fctx, 3274 name, fctx->name, fctx->type, options, now, 3275 NULL, res->view->dstport, fctx->depth + 1, 3276 fctx->qc, &find); 3277 3278 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 3279 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 3280 "fctx %p(%s): createfind for %s - %s", fctx, fctx->info, 3281 fctx->clientstr, isc_result_totext(result)); 3282 3283 if (result != ISC_R_SUCCESS) { 3284 if (result == DNS_R_ALIAS) { 3285 char namebuf[DNS_NAME_FORMATSIZE]; 3286 3287 /* 3288 * XXXRTH Follow the CNAME/DNAME chain? 3289 */ 3290 dns_adb_destroyfind(&find); 3291 fctx->adberr++; 3292 dns_name_format(name, namebuf, sizeof(namebuf)); 3293 isc_log_write(dns_lctx, DNS_LOGCATEGORY_CNAME, 3294 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 3295 "skipping nameserver '%s' because it " 3296 "is a CNAME, while resolving '%s'", 3297 namebuf, fctx->info); 3298 } 3299 fetchctx_detach(&fctx); 3300 return; 3301 } 3302 3303 if (!ISC_LIST_EMPTY(find->list)) { 3304 /* 3305 * We have at least some of the addresses for the 3306 * name. 3307 */ 3308 INSIST((find->options & DNS_ADBFIND_WANTEVENT) == 0); 3309 if (flags != 0 || port != 0) { 3310 for (ai = ISC_LIST_HEAD(find->list); ai != NULL; 3311 ai = ISC_LIST_NEXT(ai, publink)) 3312 { 3313 ai->flags |= flags; 3314 if (port != 0) { 3315 isc_sockaddr_setport(&ai->sockaddr, 3316 port); 3317 } 3318 } 3319 } 3320 if ((flags & FCTX_ADDRINFO_DUALSTACK) != 0) { 3321 ISC_LIST_APPEND(fctx->altfinds, find, publink); 3322 } else { 3323 ISC_LIST_APPEND(fctx->finds, find, publink); 3324 } 3325 return; 3326 } 3327 3328 /* 3329 * We don't know any of the addresses for this name. 3330 * 3331 * The find may be waiting on a resolver fetch for a server 3332 * address. We need to make sure it isn't waiting on *this* 3333 * fetch, because if it is, we won't be answering it and it 3334 * won't be answering us. 3335 */ 3336 if (waiting_for(find, fctx->type) && dns_name_equal(name, fctx->name)) { 3337 fctx->adberr++; 3338 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 3339 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 3340 "loop detected resolving '%s'", fctx->info); 3341 3342 if ((find->options & DNS_ADBFIND_WANTEVENT) != 0) { 3343 atomic_fetch_add_relaxed(&fctx->pending, 1); 3344 dns_adb_cancelfind(find); 3345 } else { 3346 dns_adb_destroyfind(&find); 3347 fetchctx_detach(&fctx); 3348 } 3349 return; 3350 } 3351 3352 /* 3353 * We may be waiting for another fetch to complete, and 3354 * we'll get an event later when the find has what it needs. 3355 */ 3356 if ((find->options & DNS_ADBFIND_WANTEVENT) != 0) { 3357 atomic_fetch_add_relaxed(&fctx->pending, 1); 3358 3359 /* 3360 * Bootstrap. 3361 */ 3362 if (need_alternate != NULL && !*need_alternate && unshared && 3363 ((res->dispatches4 == NULL && 3364 find->result_v6 != DNS_R_NXDOMAIN) || 3365 (res->dispatches6 == NULL && 3366 find->result_v4 != DNS_R_NXDOMAIN))) 3367 { 3368 *need_alternate = true; 3369 } 3370 if (no_addresses != NULL) { 3371 (*no_addresses)++; 3372 } 3373 return; 3374 } 3375 3376 /* 3377 * No addresses and no pending events: the find failed. 3378 */ 3379 if ((find->options & DNS_ADBFIND_OVERQUOTA) != 0) { 3380 if (overquota != NULL) { 3381 *overquota = true; 3382 } 3383 fctx->quotacount++; /* quota exceeded */ 3384 } else { 3385 fctx->adberr++; /* unreachable server, etc. */ 3386 } 3387 3388 /* 3389 * If we know there are no addresses for the family we are using then 3390 * try to add an alternative server. 3391 */ 3392 if (need_alternate != NULL && !*need_alternate && 3393 ((res->dispatches4 == NULL && find->result_v6 == DNS_R_NXRRSET) || 3394 (res->dispatches6 == NULL && find->result_v4 == DNS_R_NXRRSET))) 3395 { 3396 *need_alternate = true; 3397 } 3398 dns_adb_destroyfind(&find); 3399 fetchctx_detach(&fctx); 3400 } 3401 3402 static bool 3403 isstrictsubdomain(const dns_name_t *name1, const dns_name_t *name2) { 3404 int order; 3405 unsigned int nlabels; 3406 dns_namereln_t namereln; 3407 3408 namereln = dns_name_fullcompare(name1, name2, &order, &nlabels); 3409 return namereln == dns_namereln_subdomain; 3410 } 3411 3412 static isc_result_t 3413 fctx_getaddresses(fetchctx_t *fctx) { 3414 dns_rdata_t rdata = DNS_RDATA_INIT; 3415 isc_result_t result; 3416 dns_resolver_t *res; 3417 isc_stdtime_t now; 3418 unsigned int stdoptions = 0; 3419 dns_forwarder_t *fwd; 3420 dns_adbaddrinfo_t *ai; 3421 bool all_bad; 3422 dns_rdata_ns_t ns; 3423 bool need_alternate = false; 3424 bool all_spilled = false; 3425 unsigned int no_addresses = 0; 3426 unsigned int ns_processed = 0; 3427 3428 FCTXTRACE5("getaddresses", "fctx->depth=", fctx->depth); 3429 3430 /* 3431 * Don't pound on remote servers. (Failsafe!) 3432 */ 3433 fctx->restarts++; 3434 if (fctx->restarts > 100) { 3435 FCTXTRACE("too many restarts"); 3436 return DNS_R_SERVFAIL; 3437 } 3438 3439 res = fctx->res; 3440 3441 if (fctx->depth > res->maxdepth) { 3442 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 3443 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 3444 "too much NS indirection resolving '%s' " 3445 "(depth=%u, maxdepth=%u)", 3446 fctx->info, fctx->depth, res->maxdepth); 3447 return DNS_R_SERVFAIL; 3448 } 3449 3450 /* 3451 * Forwarders. 3452 */ 3453 3454 INSIST(ISC_LIST_EMPTY(fctx->forwaddrs)); 3455 INSIST(ISC_LIST_EMPTY(fctx->altaddrs)); 3456 3457 /* 3458 * If we have DNS_FETCHOPT_NOFORWARD set and forwarding policy 3459 * allows us to not forward - skip forwarders and go straight 3460 * to NSes. This is currently used to make sure that priming 3461 * query gets root servers' IP addresses in ADDITIONAL section. 3462 */ 3463 if ((fctx->options & DNS_FETCHOPT_NOFORWARD) != 0 && 3464 (fctx->fwdpolicy != dns_fwdpolicy_only)) 3465 { 3466 goto normal_nses; 3467 } 3468 3469 /* 3470 * If this fctx has forwarders, use them; otherwise use any 3471 * selective forwarders specified in the view; otherwise use the 3472 * resolver's forwarders (if any). 3473 */ 3474 fwd = ISC_LIST_HEAD(fctx->forwarders); 3475 if (fwd == NULL) { 3476 dns_forwarders_t *forwarders = NULL; 3477 dns_name_t *name = fctx->name; 3478 dns_name_t suffix; 3479 3480 /* 3481 * DS records are found in the parent server. 3482 * Strip label to get the correct forwarder (if any). 3483 */ 3484 if (dns_rdatatype_atparent(fctx->type) && 3485 dns_name_countlabels(name) > 1) 3486 { 3487 unsigned int labels; 3488 dns_name_init(&suffix, NULL); 3489 labels = dns_name_countlabels(name); 3490 dns_name_getlabelsequence(name, 1, labels - 1, &suffix); 3491 name = &suffix; 3492 } 3493 3494 result = dns_fwdtable_find(res->view->fwdtable, name, 3495 &forwarders); 3496 if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { 3497 fwd = ISC_LIST_HEAD(forwarders->fwdrs); 3498 fctx->fwdpolicy = forwarders->fwdpolicy; 3499 dns_name_copy(&forwarders->name, fctx->fwdname); 3500 if (fctx->fwdpolicy == dns_fwdpolicy_only && 3501 isstrictsubdomain(&forwarders->name, fctx->domain)) 3502 { 3503 fcount_decr(fctx); 3504 dns_name_copy(&forwarders->name, fctx->domain); 3505 result = fcount_incr(fctx, true); 3506 if (result != ISC_R_SUCCESS) { 3507 dns_forwarders_detach(&forwarders); 3508 return result; 3509 } 3510 } 3511 dns_forwarders_detach(&forwarders); 3512 } 3513 } 3514 3515 while (fwd != NULL) { 3516 if ((isc_sockaddr_pf(&fwd->addr) == AF_INET && 3517 res->dispatches4 == NULL) || 3518 (isc_sockaddr_pf(&fwd->addr) == AF_INET6 && 3519 res->dispatches6 == NULL)) 3520 { 3521 fwd = ISC_LIST_NEXT(fwd, link); 3522 continue; 3523 } 3524 ai = NULL; 3525 result = dns_adb_findaddrinfo(fctx->adb, &fwd->addr, &ai, 0); 3526 if (result == ISC_R_SUCCESS) { 3527 dns_adbaddrinfo_t *cur; 3528 ai->flags |= FCTX_ADDRINFO_FORWARDER; 3529 if (fwd->tlsname != NULL) { 3530 result = dns_view_gettransport( 3531 res->view, DNS_TRANSPORT_TLS, 3532 fwd->tlsname, &ai->transport); 3533 if (result != ISC_R_SUCCESS) { 3534 dns_adb_freeaddrinfo(fctx->adb, &ai); 3535 goto next; 3536 } 3537 } 3538 cur = ISC_LIST_HEAD(fctx->forwaddrs); 3539 while (cur != NULL && cur->srtt < ai->srtt) { 3540 cur = ISC_LIST_NEXT(cur, publink); 3541 } 3542 if (cur != NULL) { 3543 ISC_LIST_INSERTBEFORE(fctx->forwaddrs, cur, ai, 3544 publink); 3545 } else { 3546 ISC_LIST_APPEND(fctx->forwaddrs, ai, publink); 3547 } 3548 } 3549 next: 3550 fwd = ISC_LIST_NEXT(fwd, link); 3551 } 3552 3553 /* 3554 * If the forwarding policy is "only", we don't need the 3555 * addresses of the nameservers. 3556 */ 3557 if (fctx->fwdpolicy == dns_fwdpolicy_only) { 3558 goto out; 3559 } 3560 3561 /* 3562 * Normal nameservers. 3563 */ 3564 normal_nses: 3565 stdoptions = DNS_ADBFIND_WANTEVENT | DNS_ADBFIND_EMPTYEVENT; 3566 if (fctx->restarts == 1) { 3567 /* 3568 * To avoid sending out a flood of queries likely to 3569 * result in NXRRSET, we suppress fetches for address 3570 * families we don't have the first time through, 3571 * provided that we have addresses in some family we 3572 * can use. 3573 * 3574 * We don't want to set this option all the time, since 3575 * if fctx->restarts > 1, we've clearly been having 3576 * trouble with the addresses we had, so getting more 3577 * could help. 3578 */ 3579 stdoptions |= DNS_ADBFIND_AVOIDFETCHES; 3580 } 3581 if (res->dispatches4 != NULL) { 3582 stdoptions |= DNS_ADBFIND_INET; 3583 } 3584 if (res->dispatches6 != NULL) { 3585 stdoptions |= DNS_ADBFIND_INET6; 3586 } 3587 3588 if ((stdoptions & DNS_ADBFIND_ADDRESSMASK) == 0) { 3589 return DNS_R_SERVFAIL; 3590 } 3591 3592 now = isc_stdtime_now(); 3593 all_spilled = true; /* resets to false below after the first success */ 3594 3595 INSIST(ISC_LIST_EMPTY(fctx->finds)); 3596 INSIST(ISC_LIST_EMPTY(fctx->altfinds)); 3597 3598 for (result = dns_rdataset_first(&fctx->nameservers); 3599 result == ISC_R_SUCCESS; 3600 result = dns_rdataset_next(&fctx->nameservers)) 3601 { 3602 bool overquota = false; 3603 unsigned int static_stub = 0; 3604 3605 dns_rdataset_current(&fctx->nameservers, &rdata); 3606 /* 3607 * Extract the name from the NS record. 3608 */ 3609 result = dns_rdata_tostruct(&rdata, &ns, NULL); 3610 if (result != ISC_R_SUCCESS) { 3611 continue; 3612 } 3613 3614 if (STATICSTUB(&fctx->nameservers) && 3615 dns_name_equal(&ns.name, fctx->domain)) 3616 { 3617 static_stub = DNS_ADBFIND_STATICSTUB; 3618 } 3619 3620 if (no_addresses > NS_FAIL_LIMIT && 3621 dns_rdataset_count(&fctx->nameservers) > NS_RR_LIMIT) 3622 { 3623 stdoptions |= DNS_ADBFIND_NOFETCH; 3624 } 3625 findname(fctx, &ns.name, 0, stdoptions | static_stub, 0, now, 3626 &overquota, &need_alternate, &no_addresses); 3627 3628 if (!overquota) { 3629 all_spilled = false; 3630 } 3631 3632 dns_rdata_reset(&rdata); 3633 dns_rdata_freestruct(&ns); 3634 3635 if (++ns_processed >= NS_PROCESSING_LIMIT) { 3636 result = ISC_R_NOMORE; 3637 break; 3638 } 3639 } 3640 if (result != ISC_R_NOMORE) { 3641 return result; 3642 } 3643 3644 /* 3645 * Do we need to use 6 to 4? 3646 */ 3647 if (need_alternate) { 3648 int family; 3649 alternate_t *a; 3650 family = (res->dispatches6 != NULL) ? AF_INET6 : AF_INET; 3651 for (a = ISC_LIST_HEAD(res->alternates); a != NULL; 3652 a = ISC_LIST_NEXT(a, link)) 3653 { 3654 if (!a->isaddress) { 3655 findname(fctx, &a->_u._n.name, a->_u._n.port, 3656 stdoptions, FCTX_ADDRINFO_DUALSTACK, 3657 now, NULL, NULL, NULL); 3658 continue; 3659 } 3660 if (isc_sockaddr_pf(&a->_u.addr) != family) { 3661 continue; 3662 } 3663 ai = NULL; 3664 result = dns_adb_findaddrinfo(fctx->adb, &a->_u.addr, 3665 &ai, 0); 3666 if (result == ISC_R_SUCCESS) { 3667 dns_adbaddrinfo_t *cur; 3668 ai->flags |= FCTX_ADDRINFO_FORWARDER; 3669 ai->flags |= FCTX_ADDRINFO_DUALSTACK; 3670 cur = ISC_LIST_HEAD(fctx->altaddrs); 3671 while (cur != NULL && cur->srtt < ai->srtt) { 3672 cur = ISC_LIST_NEXT(cur, publink); 3673 } 3674 if (cur != NULL) { 3675 ISC_LIST_INSERTBEFORE(fctx->altaddrs, 3676 cur, ai, publink); 3677 } else { 3678 ISC_LIST_APPEND(fctx->altaddrs, ai, 3679 publink); 3680 } 3681 } 3682 } 3683 } 3684 3685 out: 3686 /* 3687 * Mark all known bad servers. 3688 */ 3689 all_bad = mark_bad(fctx); 3690 3691 /* 3692 * How are we doing? 3693 */ 3694 if (all_bad) { 3695 /* 3696 * We've got no addresses. 3697 */ 3698 if (atomic_load_acquire(&fctx->pending) > 0) { 3699 /* 3700 * We're fetching the addresses, but don't have 3701 * any yet. Tell the caller to wait for an 3702 * answer. 3703 */ 3704 result = DNS_R_WAIT; 3705 } else { 3706 /* 3707 * We've lost completely. We don't know any 3708 * addresses, and the ADB has told us it can't 3709 * get them. 3710 */ 3711 FCTXTRACE("no addresses"); 3712 3713 result = ISC_R_FAILURE; 3714 3715 /* 3716 * If all of the addresses found were over the 3717 * fetches-per-server quota, return the 3718 * configured response. 3719 */ 3720 if (all_spilled) { 3721 result = res->quotaresp[dns_quotatype_server]; 3722 inc_stats(res, dns_resstatscounter_serverquota); 3723 } 3724 } 3725 } else { 3726 /* 3727 * We've found some addresses. We might still be 3728 * looking for more addresses. 3729 */ 3730 sort_finds(&fctx->finds, res->view->v6bias); 3731 sort_finds(&fctx->altfinds, 0); 3732 result = ISC_R_SUCCESS; 3733 } 3734 3735 return result; 3736 } 3737 3738 static void 3739 possibly_mark(fetchctx_t *fctx, dns_adbaddrinfo_t *addr) { 3740 isc_netaddr_t na; 3741 isc_sockaddr_t *sa = &addr->sockaddr; 3742 bool aborted = false; 3743 bool bogus; 3744 dns_acl_t *blackhole; 3745 isc_netaddr_t ipaddr; 3746 dns_peer_t *peer = NULL; 3747 dns_resolver_t *res = fctx->res; 3748 const char *msg = NULL; 3749 3750 isc_netaddr_fromsockaddr(&ipaddr, sa); 3751 blackhole = dns_dispatchmgr_getblackhole(res->view->dispatchmgr); 3752 (void)dns_peerlist_peerbyaddr(res->view->peers, &ipaddr, &peer); 3753 3754 if (blackhole != NULL) { 3755 int match; 3756 3757 if ((dns_acl_match(&ipaddr, NULL, blackhole, res->view->aclenv, 3758 &match, NULL) == ISC_R_SUCCESS) && 3759 match > 0) 3760 { 3761 aborted = true; 3762 } 3763 } 3764 3765 if (peer != NULL && dns_peer_getbogus(peer, &bogus) == ISC_R_SUCCESS && 3766 bogus) 3767 { 3768 aborted = true; 3769 } 3770 3771 if (aborted) { 3772 addr->flags |= FCTX_ADDRINFO_MARK; 3773 msg = "ignoring blackholed / bogus server: "; 3774 } else if (isc_sockaddr_isnetzero(sa)) { 3775 addr->flags |= FCTX_ADDRINFO_MARK; 3776 msg = "ignoring net zero address: "; 3777 } else if (isc_sockaddr_ismulticast(sa)) { 3778 addr->flags |= FCTX_ADDRINFO_MARK; 3779 msg = "ignoring multicast address: "; 3780 } else if (isc_sockaddr_isexperimental(sa)) { 3781 addr->flags |= FCTX_ADDRINFO_MARK; 3782 msg = "ignoring experimental address: "; 3783 } else if (sa->type.sa.sa_family != AF_INET6) { 3784 return; 3785 } else if (IN6_IS_ADDR_V4MAPPED(&sa->type.sin6.sin6_addr)) { 3786 addr->flags |= FCTX_ADDRINFO_MARK; 3787 msg = "ignoring IPv6 mapped IPV4 address: "; 3788 } else if (IN6_IS_ADDR_V4COMPAT(&sa->type.sin6.sin6_addr)) { 3789 addr->flags |= FCTX_ADDRINFO_MARK; 3790 msg = "ignoring IPv6 compatibility IPV4 address: "; 3791 } else { 3792 return; 3793 } 3794 3795 if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) { 3796 char buf[ISC_NETADDR_FORMATSIZE]; 3797 isc_netaddr_fromsockaddr(&na, sa); 3798 isc_netaddr_format(&na, buf, sizeof(buf)); 3799 FCTXTRACE2(msg, buf); 3800 } 3801 } 3802 3803 static dns_adbaddrinfo_t * 3804 fctx_nextaddress(fetchctx_t *fctx) { 3805 dns_adbfind_t *find, *start; 3806 dns_adbaddrinfo_t *addrinfo; 3807 dns_adbaddrinfo_t *faddrinfo; 3808 3809 /* 3810 * Return the next untried address, if any. 3811 */ 3812 3813 /* 3814 * Find the first unmarked forwarder (if any). 3815 */ 3816 for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs); addrinfo != NULL; 3817 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3818 { 3819 if (!UNMARKED(addrinfo)) { 3820 continue; 3821 } 3822 possibly_mark(fctx, addrinfo); 3823 if (UNMARKED(addrinfo)) { 3824 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3825 fctx->find = NULL; 3826 fctx->forwarding = true; 3827 3828 /* 3829 * QNAME minimization is disabled when 3830 * forwarding, and has to remain disabled if 3831 * we switch back to normal recursion; otherwise 3832 * forwarding could leave us in an inconsistent 3833 * state. 3834 */ 3835 fctx->minimized = false; 3836 return addrinfo; 3837 } 3838 } 3839 3840 /* 3841 * No forwarders. Move to the next find. 3842 */ 3843 fctx->forwarding = false; 3844 FCTX_ATTR_SET(fctx, FCTX_ATTR_TRIEDFIND); 3845 3846 find = fctx->find; 3847 if (find == NULL) { 3848 find = ISC_LIST_HEAD(fctx->finds); 3849 } else { 3850 find = ISC_LIST_NEXT(find, publink); 3851 if (find == NULL) { 3852 find = ISC_LIST_HEAD(fctx->finds); 3853 } 3854 } 3855 3856 /* 3857 * Find the first unmarked addrinfo. 3858 */ 3859 addrinfo = NULL; 3860 if (find != NULL) { 3861 start = find; 3862 do { 3863 for (addrinfo = ISC_LIST_HEAD(find->list); 3864 addrinfo != NULL; 3865 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3866 { 3867 if (!UNMARKED(addrinfo)) { 3868 continue; 3869 } 3870 possibly_mark(fctx, addrinfo); 3871 if (UNMARKED(addrinfo)) { 3872 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3873 break; 3874 } 3875 } 3876 if (addrinfo != NULL) { 3877 break; 3878 } 3879 find = ISC_LIST_NEXT(find, publink); 3880 if (find == NULL) { 3881 find = ISC_LIST_HEAD(fctx->finds); 3882 } 3883 } while (find != start); 3884 } 3885 3886 fctx->find = find; 3887 if (addrinfo != NULL) { 3888 return addrinfo; 3889 } 3890 3891 /* 3892 * No nameservers left. Try alternates. 3893 */ 3894 3895 FCTX_ATTR_SET(fctx, FCTX_ATTR_TRIEDALT); 3896 3897 find = fctx->altfind; 3898 if (find == NULL) { 3899 find = ISC_LIST_HEAD(fctx->altfinds); 3900 } else { 3901 find = ISC_LIST_NEXT(find, publink); 3902 if (find == NULL) { 3903 find = ISC_LIST_HEAD(fctx->altfinds); 3904 } 3905 } 3906 3907 /* 3908 * Find the first unmarked addrinfo. 3909 */ 3910 addrinfo = NULL; 3911 if (find != NULL) { 3912 start = find; 3913 do { 3914 for (addrinfo = ISC_LIST_HEAD(find->list); 3915 addrinfo != NULL; 3916 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3917 { 3918 if (!UNMARKED(addrinfo)) { 3919 continue; 3920 } 3921 possibly_mark(fctx, addrinfo); 3922 if (UNMARKED(addrinfo)) { 3923 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3924 break; 3925 } 3926 } 3927 if (addrinfo != NULL) { 3928 break; 3929 } 3930 find = ISC_LIST_NEXT(find, publink); 3931 if (find == NULL) { 3932 find = ISC_LIST_HEAD(fctx->altfinds); 3933 } 3934 } while (find != start); 3935 } 3936 3937 faddrinfo = addrinfo; 3938 3939 /* 3940 * See if we have a better alternate server by address. 3941 */ 3942 3943 for (addrinfo = ISC_LIST_HEAD(fctx->altaddrs); addrinfo != NULL; 3944 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) 3945 { 3946 if (!UNMARKED(addrinfo)) { 3947 continue; 3948 } 3949 possibly_mark(fctx, addrinfo); 3950 if (UNMARKED(addrinfo) && 3951 (faddrinfo == NULL || addrinfo->srtt < faddrinfo->srtt)) 3952 { 3953 if (faddrinfo != NULL) { 3954 faddrinfo->flags &= ~FCTX_ADDRINFO_MARK; 3955 } 3956 addrinfo->flags |= FCTX_ADDRINFO_MARK; 3957 break; 3958 } 3959 } 3960 3961 if (addrinfo == NULL) { 3962 addrinfo = faddrinfo; 3963 fctx->altfind = find; 3964 } 3965 3966 return addrinfo; 3967 } 3968 3969 static void 3970 fctx_try(fetchctx_t *fctx, bool retrying) { 3971 isc_result_t result; 3972 dns_adbaddrinfo_t *addrinfo = NULL; 3973 dns_resolver_t *res = NULL; 3974 3975 FCTXTRACE5("try", "fctx->qc=", isc_counter_used(fctx->qc)); 3976 3977 REQUIRE(!ADDRWAIT(fctx)); 3978 REQUIRE(fctx->tid == isc_tid()); 3979 3980 res = fctx->res; 3981 3982 /* We've already exceeded maximum query count */ 3983 if (isc_counter_used(fctx->qc) > res->maxqueries) { 3984 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 3985 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 3986 "exceeded max queries resolving '%s' " 3987 "(querycount=%u, maxqueries=%u)", 3988 fctx->info, isc_counter_used(fctx->qc), 3989 res->maxqueries); 3990 result = DNS_R_SERVFAIL; 3991 goto done; 3992 } 3993 3994 addrinfo = fctx_nextaddress(fctx); 3995 3996 /* Try to find an address that isn't over quota */ 3997 while (addrinfo != NULL && dns_adb_overquota(fctx->adb, addrinfo)) { 3998 addrinfo = fctx_nextaddress(fctx); 3999 } 4000 4001 if (addrinfo == NULL) { 4002 /* We have no more addresses. Start over. */ 4003 fctx_cancelqueries(fctx, true, false); 4004 fctx_cleanup(fctx); 4005 result = fctx_getaddresses(fctx); 4006 switch (result) { 4007 case ISC_R_SUCCESS: 4008 break; 4009 case DNS_R_WAIT: 4010 /* Sleep waiting for addresses. */ 4011 FCTXTRACE("addrwait"); 4012 FCTX_ATTR_SET(fctx, FCTX_ATTR_ADDRWAIT); 4013 return; 4014 default: 4015 goto done; 4016 } 4017 4018 addrinfo = fctx_nextaddress(fctx); 4019 4020 while (addrinfo != NULL && 4021 dns_adb_overquota(fctx->adb, addrinfo)) 4022 { 4023 addrinfo = fctx_nextaddress(fctx); 4024 } 4025 4026 /* 4027 * While we may have addresses from the ADB, they 4028 * might be bad ones. In this case, return SERVFAIL. 4029 */ 4030 if (addrinfo == NULL) { 4031 result = DNS_R_SERVFAIL; 4032 goto done; 4033 } 4034 } 4035 /* 4036 * We're minimizing and we're not yet at the final NS - 4037 * we need to launch a query for NS for 'upper' domain 4038 */ 4039 if (fctx->minimized && !fctx->forwarding) { 4040 unsigned int options = fctx->options; 4041 4042 options &= ~DNS_FETCHOPT_QMINIMIZE; 4043 4044 /* 4045 * Is another QNAME minimization fetch still running? 4046 */ 4047 if (fctx->qminfetch != NULL) { 4048 bool validfctx = (DNS_FETCH_VALID(fctx->qminfetch) && 4049 VALID_FCTX(fctx->qminfetch->private)); 4050 char namebuf[DNS_NAME_FORMATSIZE]; 4051 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 4052 4053 dns_name_format(fctx->qminname, namebuf, 4054 sizeof(namebuf)); 4055 dns_rdatatype_format(fctx->qmintype, typebuf, 4056 sizeof(typebuf)); 4057 4058 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4059 DNS_LOGMODULE_RESOLVER, ISC_LOG_ERROR, 4060 "fctx %p(%s): attempting QNAME " 4061 "minimization fetch for %s/%s but " 4062 "fetch %p(%s) still running", 4063 fctx, fctx->info, namebuf, typebuf, 4064 fctx->qminfetch, 4065 validfctx ? fctx->qminfetch->private->info 4066 : "<invalid>"); 4067 result = DNS_R_SERVFAIL; 4068 goto done; 4069 } 4070 4071 /* 4072 * Turn on NOFOLLOW in relaxed mode so that QNAME minimization 4073 * doesn't cause additional queries to resolve the target of the 4074 * QNAME minimization request when a referral is returned. This 4075 * will also reduce the impact of mis-matched NS RRsets where 4076 * the child's NS RRset is garbage. If a delegation is 4077 * discovered DNS_R_DELEGATION will be returned to resume_qmin. 4078 */ 4079 if ((options & DNS_FETCHOPT_QMIN_STRICT) == 0) { 4080 options |= DNS_FETCHOPT_NOFOLLOW; 4081 } 4082 4083 fetchctx_ref(fctx); 4084 result = dns_resolver_createfetch( 4085 fctx->res, fctx->qminname, fctx->qmintype, fctx->domain, 4086 &fctx->nameservers, NULL, NULL, 0, options, 0, fctx->qc, 4087 fctx->loop, resume_qmin, fctx, &fctx->qminrrset, NULL, 4088 &fctx->qminfetch); 4089 if (result != ISC_R_SUCCESS) { 4090 fetchctx_unref(fctx); 4091 goto done; 4092 } 4093 return; 4094 } 4095 4096 result = isc_counter_increment(fctx->qc); 4097 if (result != ISC_R_SUCCESS) { 4098 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4099 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), 4100 "exceeded max queries resolving '%s'", 4101 fctx->info); 4102 goto done; 4103 } 4104 4105 result = fctx_query(fctx, addrinfo, fctx->options); 4106 if (result != ISC_R_SUCCESS) { 4107 goto done; 4108 } 4109 if (retrying) { 4110 inc_stats(res, dns_resstatscounter_retry); 4111 } 4112 4113 done: 4114 if (result != ISC_R_SUCCESS) { 4115 fctx_done_detach(&fctx, result); 4116 } 4117 } 4118 4119 static void 4120 resume_qmin(void *arg) { 4121 dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg; 4122 fetchctx_t *fctx = resp->arg; 4123 dns_resolver_t *res = NULL; 4124 isc_result_t result; 4125 unsigned int findoptions = 0; 4126 dns_name_t *fname = NULL, *dcname = NULL; 4127 dns_fixedname_t ffixed, dcfixed; 4128 4129 REQUIRE(VALID_FCTX(fctx)); 4130 4131 res = fctx->res; 4132 4133 REQUIRE(fctx->tid == isc_tid()); 4134 4135 FCTXTRACE("resume_qmin"); 4136 4137 fname = dns_fixedname_initname(&ffixed); 4138 dcname = dns_fixedname_initname(&dcfixed); 4139 4140 if (resp->node != NULL) { 4141 dns_db_detachnode(resp->db, &resp->node); 4142 } 4143 if (resp->db != NULL) { 4144 dns_db_detach(&resp->db); 4145 } 4146 4147 if (dns_rdataset_isassociated(resp->rdataset)) { 4148 dns_rdataset_disassociate(resp->rdataset); 4149 } 4150 4151 result = resp->result; 4152 isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp)); 4153 4154 LOCK(&fctx->lock); 4155 if (SHUTTINGDOWN(fctx)) { 4156 result = ISC_R_SHUTTINGDOWN; 4157 } 4158 UNLOCK(&fctx->lock); 4159 4160 dns_resolver_destroyfetch(&fctx->qminfetch); 4161 4162 /* 4163 * Beware, the switch() below is little bit tricky - the order of the 4164 * branches is important. 4165 */ 4166 switch (result) { 4167 case ISC_R_SHUTTINGDOWN: 4168 case ISC_R_CANCELED: 4169 goto cleanup; 4170 4171 case DNS_R_NXDOMAIN: 4172 case DNS_R_NCACHENXDOMAIN: 4173 case DNS_R_FORMERR: 4174 case DNS_R_REMOTEFORMERR: 4175 case ISC_R_FAILURE: 4176 if ((fctx->options & DNS_FETCHOPT_QMIN_STRICT) != 0) { 4177 /* These results cause a hard fail in strict mode */ 4178 goto cleanup; 4179 } 4180 4181 /* ...or disable minimization in relaxed mode */ 4182 fctx->qmin_labels = DNS_NAME_MAXLABELS; 4183 4184 /* 4185 * We store the result. If we succeed in the end 4186 * we'll issue a warning that the server is 4187 * broken. 4188 */ 4189 fctx->qmin_warning = result; 4190 break; 4191 4192 case ISC_R_SUCCESS: 4193 case DNS_R_DELEGATION: 4194 case DNS_R_NXRRSET: 4195 case DNS_R_NCACHENXRRSET: 4196 case DNS_R_CNAME: 4197 case DNS_R_DNAME: 4198 /* 4199 * We have previously detected a possible error of an 4200 * incorrect NXDOMAIN and now have a response that 4201 * indicates that it was an actual error. 4202 */ 4203 if (fctx->qmin_warning == DNS_R_NCACHENXDOMAIN || 4204 fctx->qmin_warning == DNS_R_NXDOMAIN) 4205 { 4206 fctx->force_qmin_warning = true; 4207 } 4208 /* 4209 * Any other result will *not* cause a failure in strict 4210 * mode, or cause minimization to be disabled in relaxed 4211 * mode. 4212 * 4213 * If DNS_R_DELEGATION is set here, it implies that 4214 * DNS_FETCHOPT_NOFOLLOW was set, and a delegation was 4215 * discovered but not followed; we will do so now. 4216 */ 4217 break; 4218 4219 default: 4220 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4221 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(5), 4222 "QNAME minimization: unexpected result %s", 4223 isc_result_totext(result)); 4224 break; 4225 } 4226 4227 if (dns_rdataset_isassociated(&fctx->nameservers)) { 4228 dns_rdataset_disassociate(&fctx->nameservers); 4229 } 4230 4231 if (dns_rdatatype_atparent(fctx->type)) { 4232 findoptions |= DNS_DBFIND_NOEXACT; 4233 } 4234 result = dns_view_findzonecut(res->view, fctx->name, fname, dcname, 4235 fctx->now, findoptions, true, true, 4236 &fctx->nameservers, NULL); 4237 4238 /* 4239 * DNS_R_NXDOMAIN here means we have not loaded the root zone 4240 * mirror yet - but DNS_R_NXDOMAIN is not a valid return value 4241 * when doing recursion, we need to patch it. 4242 */ 4243 if (result == DNS_R_NXDOMAIN) { 4244 result = DNS_R_SERVFAIL; 4245 } 4246 4247 if (result != ISC_R_SUCCESS) { 4248 goto cleanup; 4249 } 4250 fcount_decr(fctx); 4251 4252 dns_name_copy(fname, fctx->domain); 4253 4254 result = fcount_incr(fctx, true); 4255 if (result != ISC_R_SUCCESS) { 4256 goto cleanup; 4257 } 4258 4259 dns_name_copy(dcname, fctx->qmindcname); 4260 fctx->ns_ttl = fctx->nameservers.ttl; 4261 fctx->ns_ttl_ok = true; 4262 4263 fctx_minimize_qname(fctx); 4264 4265 if (!fctx->minimized) { 4266 /* 4267 * We have finished minimizing, but fctx->finds was 4268 * filled at the beginning of the run - now we need to 4269 * clear it before sending the final query to use proper 4270 * nameservers. 4271 */ 4272 fctx_cancelqueries(fctx, false, false); 4273 fctx_cleanup(fctx); 4274 } 4275 4276 fctx_try(fctx, true); 4277 4278 cleanup: 4279 if (result != ISC_R_SUCCESS) { 4280 /* An error occurred, tear down whole fctx */ 4281 fctx_done_unref(fctx, result); 4282 } 4283 fetchctx_detach(&fctx); 4284 } 4285 4286 static void 4287 fctx_destroy(fetchctx_t *fctx) { 4288 dns_resolver_t *res = NULL; 4289 isc_sockaddr_t *sa = NULL, *next_sa = NULL; 4290 struct tried *tried = NULL; 4291 uint_fast32_t nfctx; 4292 4293 REQUIRE(VALID_FCTX(fctx)); 4294 REQUIRE(ISC_LIST_EMPTY(fctx->resps)); 4295 REQUIRE(ISC_LIST_EMPTY(fctx->queries)); 4296 REQUIRE(ISC_LIST_EMPTY(fctx->finds)); 4297 REQUIRE(ISC_LIST_EMPTY(fctx->altfinds)); 4298 REQUIRE(atomic_load_acquire(&fctx->pending) == 0); 4299 REQUIRE(ISC_LIST_EMPTY(fctx->validators)); 4300 REQUIRE(fctx->state != fetchstate_active); 4301 4302 FCTXTRACE("destroy"); 4303 4304 fctx->magic = 0; 4305 4306 res = fctx->res; 4307 4308 dec_stats(res, dns_resstatscounter_nfetch); 4309 4310 nfctx = atomic_fetch_sub_release(&res->nfctx, 1); 4311 INSIST(nfctx > 0); 4312 4313 /* Free bad */ 4314 for (sa = ISC_LIST_HEAD(fctx->bad); sa != NULL; sa = next_sa) { 4315 next_sa = ISC_LIST_NEXT(sa, link); 4316 ISC_LIST_UNLINK(fctx->bad, sa, link); 4317 isc_mem_put(fctx->mctx, sa, sizeof(*sa)); 4318 } 4319 4320 for (tried = ISC_LIST_HEAD(fctx->edns); tried != NULL; 4321 tried = ISC_LIST_HEAD(fctx->edns)) 4322 { 4323 ISC_LIST_UNLINK(fctx->edns, tried, link); 4324 isc_mem_put(fctx->mctx, tried, sizeof(*tried)); 4325 } 4326 4327 for (sa = ISC_LIST_HEAD(fctx->bad_edns); sa != NULL; sa = next_sa) { 4328 next_sa = ISC_LIST_NEXT(sa, link); 4329 ISC_LIST_UNLINK(fctx->bad_edns, sa, link); 4330 isc_mem_put(fctx->mctx, sa, sizeof(*sa)); 4331 } 4332 4333 isc_counter_detach(&fctx->qc); 4334 fcount_decr(fctx); 4335 dns_message_detach(&fctx->qmessage); 4336 if (dns_rdataset_isassociated(&fctx->nameservers)) { 4337 dns_rdataset_disassociate(&fctx->nameservers); 4338 } 4339 dns_db_detach(&fctx->cache); 4340 dns_adb_detach(&fctx->adb); 4341 4342 dns_resolver_detach(&fctx->res); 4343 4344 isc_mutex_destroy(&fctx->lock); 4345 4346 isc_mem_free(fctx->mctx, fctx->info); 4347 isc_mem_putanddetach(&fctx->mctx, fctx, sizeof(*fctx)); 4348 } 4349 4350 static void 4351 fctx_expired(void *arg) { 4352 fetchctx_t *fctx = (fetchctx_t *)arg; 4353 4354 REQUIRE(VALID_FCTX(fctx)); 4355 REQUIRE(fctx->tid == isc_tid()); 4356 4357 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4358 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 4359 "shut down hung fetch while resolving %p(%s)", fctx, 4360 fctx->info); 4361 fctx_done_detach(&fctx, DNS_R_SERVFAIL); 4362 } 4363 4364 static void 4365 fctx_shutdown(void *arg) { 4366 fetchctx_t *fctx = arg; 4367 4368 REQUIRE(VALID_FCTX(fctx)); 4369 4370 fctx_done_unref(fctx, ISC_R_SHUTTINGDOWN); 4371 fetchctx_detach(&fctx); 4372 } 4373 4374 static void 4375 fctx_start(void *arg) { 4376 fetchctx_t *fctx = (fetchctx_t *)arg; 4377 4378 REQUIRE(VALID_FCTX(fctx)); 4379 4380 FCTXTRACE("start"); 4381 4382 LOCK(&fctx->lock); 4383 if (SHUTTINGDOWN(fctx)) { 4384 UNLOCK(&fctx->lock); 4385 goto detach; 4386 } 4387 4388 /* 4389 * Normal fctx startup. 4390 */ 4391 fctx->state = fetchstate_active; 4392 UNLOCK(&fctx->lock); 4393 4394 /* 4395 * As a backstop, we also set a timer to stop the fetch 4396 * if in-band netmgr timeouts don't work. It will fire two 4397 * seconds after the fetch should have finished. (This 4398 * should be enough of a gap to avoid the timer firing 4399 * while a response is being processed normally.) 4400 */ 4401 fctx_starttimer(fctx); 4402 fctx_try(fctx, false); 4403 4404 detach: 4405 fetchctx_detach(&fctx); 4406 } 4407 4408 /* 4409 * Fetch Creation, Joining, and Cancellation. 4410 */ 4411 4412 static void 4413 fctx_add_event(fetchctx_t *fctx, isc_loop_t *loop, const isc_sockaddr_t *client, 4414 dns_messageid_t id, isc_job_cb cb, void *arg, 4415 dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset, 4416 dns_fetch_t *fetch) { 4417 dns_fetchresponse_t *resp = NULL; 4418 4419 FCTXTRACE("addevent"); 4420 4421 resp = isc_mem_get(fctx->mctx, sizeof(*resp)); 4422 *resp = (dns_fetchresponse_t){ 4423 .result = DNS_R_SERVFAIL, 4424 .qtype = fctx->type, 4425 .rdataset = rdataset, 4426 .sigrdataset = sigrdataset, 4427 .fetch = fetch, 4428 .client = client, 4429 .id = id, 4430 .loop = loop, 4431 .cb = cb, 4432 .arg = arg, 4433 .link = ISC_LINK_INITIALIZER, 4434 }; 4435 isc_mem_attach(fctx->mctx, &resp->mctx); 4436 4437 resp->foundname = dns_fixedname_initname(&resp->fname); 4438 4439 /* 4440 * Store the sigrdataset in the first resp in case it is needed 4441 * by any of the events. 4442 */ 4443 if (resp->sigrdataset != NULL) { 4444 ISC_LIST_PREPEND(fctx->resps, resp, link); 4445 } else { 4446 ISC_LIST_APPEND(fctx->resps, resp, link); 4447 } 4448 } 4449 4450 static void 4451 fctx_join(fetchctx_t *fctx, isc_loop_t *loop, const isc_sockaddr_t *client, 4452 dns_messageid_t id, isc_job_cb cb, void *arg, 4453 dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset, 4454 dns_fetch_t *fetch) { 4455 FCTXTRACE("join"); 4456 4457 REQUIRE(!SHUTTINGDOWN(fctx)); 4458 4459 fctx_add_event(fctx, loop, client, id, cb, arg, rdataset, sigrdataset, 4460 fetch); 4461 4462 fetch->magic = DNS_FETCH_MAGIC; 4463 fetchctx_attach(fctx, &fetch->private); 4464 } 4465 4466 static void 4467 log_ns_ttl(fetchctx_t *fctx, const char *where) { 4468 char namebuf[DNS_NAME_FORMATSIZE]; 4469 char domainbuf[DNS_NAME_FORMATSIZE]; 4470 4471 dns_name_format(fctx->name, namebuf, sizeof(namebuf)); 4472 dns_name_format(fctx->domain, domainbuf, sizeof(domainbuf)); 4473 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4474 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(10), 4475 "log_ns_ttl: fctx %p: %s: %s (in '%s'?): %u %u", fctx, 4476 where, namebuf, domainbuf, fctx->ns_ttl_ok, fctx->ns_ttl); 4477 } 4478 4479 static isc_result_t 4480 fctx_create(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name, 4481 dns_rdatatype_t type, const dns_name_t *domain, 4482 dns_rdataset_t *nameservers, const isc_sockaddr_t *client, 4483 unsigned int options, unsigned int depth, isc_counter_t *qc, 4484 fetchctx_t **fctxp) { 4485 fetchctx_t *fctx = NULL; 4486 isc_result_t result; 4487 isc_result_t iresult; 4488 isc_interval_t interval; 4489 unsigned int findoptions = 0; 4490 char buf[DNS_NAME_FORMATSIZE + DNS_RDATATYPE_FORMATSIZE + 1]; 4491 uint_fast32_t nfctx; 4492 isc_mem_t *mctx = isc_loop_getmctx(loop); 4493 size_t p; 4494 4495 /* 4496 * Caller must be holding the lock for 'bucket' 4497 */ 4498 REQUIRE(fctxp != NULL && *fctxp == NULL); 4499 4500 fctx = isc_mem_get(mctx, sizeof(*fctx)); 4501 *fctx = (fetchctx_t){ 4502 .type = type, 4503 .qmintype = type, 4504 .options = options, 4505 .tid = isc_tid(), 4506 .state = fetchstate_active, 4507 .depth = depth, 4508 .qmin_labels = 1, 4509 .fwdpolicy = dns_fwdpolicy_none, 4510 .result = ISC_R_FAILURE, 4511 .loop = loop, 4512 .nvalidations = atomic_load_relaxed(&res->maxvalidations), 4513 .nfails = atomic_load_relaxed(&res->maxvalidationfails), 4514 }; 4515 4516 isc_mem_attach(mctx, &fctx->mctx); 4517 dns_resolver_attach(res, &fctx->res); 4518 4519 isc_mutex_init(&fctx->lock); 4520 4521 /* 4522 * Make fctx->info point to a copy of a formatted string 4523 * "name/type". FCTXTRACE won't work until this is done. 4524 */ 4525 dns_name_format(name, buf, sizeof(buf)); 4526 p = strlcat(buf, "/", sizeof(buf)); 4527 INSIST(p + DNS_RDATATYPE_FORMATSIZE < sizeof(buf)); 4528 dns_rdatatype_format(type, buf + p, sizeof(buf) - p); 4529 fctx->info = isc_mem_strdup(fctx->mctx, buf); 4530 4531 FCTXTRACE("create"); 4532 4533 if (qc != NULL) { 4534 isc_counter_attach(qc, &fctx->qc); 4535 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4536 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(9), 4537 "fctx %p(%s): attached to counter %p (%d)", fctx, 4538 fctx->info, fctx->qc, isc_counter_used(fctx->qc)); 4539 } else { 4540 result = isc_counter_create(fctx->mctx, res->maxqueries, 4541 &fctx->qc); 4542 if (result != ISC_R_SUCCESS) { 4543 goto cleanup_fetch; 4544 } 4545 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4546 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(9), 4547 "fctx %p(%s): created counter %p", fctx, 4548 fctx->info, fctx->qc); 4549 } 4550 4551 #if DNS_RESOLVER_TRACE 4552 fprintf(stderr, "fetchctx__init:%s:%s:%d:%p:%p->references = 1\n", 4553 __func__, __FILE__, __LINE__, fctx, fctx); 4554 #endif 4555 isc_refcount_init(&fctx->references, 1); 4556 4557 ISC_LIST_INIT(fctx->queries); 4558 ISC_LIST_INIT(fctx->finds); 4559 ISC_LIST_INIT(fctx->altfinds); 4560 ISC_LIST_INIT(fctx->forwaddrs); 4561 ISC_LIST_INIT(fctx->altaddrs); 4562 ISC_LIST_INIT(fctx->forwarders); 4563 ISC_LIST_INIT(fctx->bad); 4564 ISC_LIST_INIT(fctx->edns); 4565 ISC_LIST_INIT(fctx->bad_edns); 4566 ISC_LIST_INIT(fctx->validators); 4567 4568 atomic_init(&fctx->attributes, 0); 4569 4570 fctx->name = dns_fixedname_initname(&fctx->fname); 4571 fctx->nsname = dns_fixedname_initname(&fctx->nsfname); 4572 fctx->domain = dns_fixedname_initname(&fctx->dfname); 4573 fctx->qminname = dns_fixedname_initname(&fctx->qminfname); 4574 fctx->qmindcname = dns_fixedname_initname(&fctx->qmindcfname); 4575 fctx->fwdname = dns_fixedname_initname(&fctx->fwdfname); 4576 4577 dns_name_copy(name, fctx->name); 4578 dns_name_copy(name, fctx->qminname); 4579 4580 dns_rdataset_init(&fctx->nameservers); 4581 dns_rdataset_init(&fctx->qminrrset); 4582 dns_rdataset_init(&fctx->nsrrset); 4583 4584 fctx->start = isc_time_now(); 4585 fctx->now = (isc_stdtime_t)fctx->start.seconds; 4586 4587 if (client != NULL) { 4588 isc_sockaddr_format(client, fctx->clientstr, 4589 sizeof(fctx->clientstr)); 4590 } else { 4591 strlcpy(fctx->clientstr, "<unknown>", sizeof(fctx->clientstr)); 4592 } 4593 4594 if (domain == NULL) { 4595 dns_forwarders_t *forwarders = NULL; 4596 unsigned int labels; 4597 const dns_name_t *fwdname = name; 4598 dns_name_t suffix; 4599 4600 /* 4601 * DS records are found in the parent server. Strip one 4602 * leading label from the name (to be used in finding 4603 * the forwarder). 4604 */ 4605 if (dns_rdatatype_atparent(fctx->type) && 4606 dns_name_countlabels(name) > 1) 4607 { 4608 dns_name_init(&suffix, NULL); 4609 labels = dns_name_countlabels(name); 4610 dns_name_getlabelsequence(name, 1, labels - 1, &suffix); 4611 fwdname = &suffix; 4612 } 4613 4614 /* Find the forwarder for this name. */ 4615 result = dns_fwdtable_find(fctx->res->view->fwdtable, fwdname, 4616 &forwarders); 4617 if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { 4618 fctx->fwdpolicy = forwarders->fwdpolicy; 4619 dns_name_copy(&forwarders->name, fctx->fwdname); 4620 dns_forwarders_detach(&forwarders); 4621 } 4622 4623 if (fctx->fwdpolicy == dns_fwdpolicy_only) { 4624 /* 4625 * We're in forward-only mode. Set the query 4626 * domain. 4627 */ 4628 dns_name_copy(fctx->fwdname, fctx->domain); 4629 dns_name_copy(fctx->fwdname, fctx->qmindcname); 4630 /* 4631 * Disable query minimization 4632 */ 4633 options &= ~DNS_FETCHOPT_QMINIMIZE; 4634 } else { 4635 dns_fixedname_t dcfixed; 4636 dns_name_t *dcname = dns_fixedname_initname(&dcfixed); 4637 4638 /* 4639 * The caller didn't supply a query domain and 4640 * nameservers, and we're not in forward-only 4641 * mode, so find the best nameservers to use. 4642 */ 4643 if (dns_rdatatype_atparent(fctx->type)) { 4644 findoptions |= DNS_DBFIND_NOEXACT; 4645 } 4646 result = dns_view_findzonecut( 4647 res->view, name, fctx->fwdname, dcname, 4648 fctx->now, findoptions, true, true, 4649 &fctx->nameservers, NULL); 4650 if (result != ISC_R_SUCCESS) { 4651 goto cleanup_nameservers; 4652 } 4653 4654 dns_name_copy(fctx->fwdname, fctx->domain); 4655 dns_name_copy(dcname, fctx->qmindcname); 4656 fctx->ns_ttl = fctx->nameservers.ttl; 4657 fctx->ns_ttl_ok = true; 4658 } 4659 } else { 4660 dns_name_copy(domain, fctx->domain); 4661 dns_name_copy(domain, fctx->qmindcname); 4662 dns_rdataset_clone(nameservers, &fctx->nameservers); 4663 fctx->ns_ttl = fctx->nameservers.ttl; 4664 fctx->ns_ttl_ok = true; 4665 } 4666 4667 /* 4668 * Exempt prefetch queries from the fetches-per-zone quota check 4669 */ 4670 if ((fctx->options & DNS_FETCHOPT_PREFETCH) == 0) { 4671 /* 4672 * Are there too many simultaneous queries for this domain? 4673 */ 4674 result = fcount_incr(fctx, false); 4675 if (result != ISC_R_SUCCESS) { 4676 result = fctx->res->quotaresp[dns_quotatype_zone]; 4677 inc_stats(res, dns_resstatscounter_zonequota); 4678 goto cleanup_nameservers; 4679 } 4680 } 4681 4682 log_ns_ttl(fctx, "fctx_create"); 4683 4684 if (!dns_name_issubdomain(fctx->name, fctx->domain)) { 4685 dns_name_format(fctx->domain, buf, sizeof(buf)); 4686 UNEXPECTED_ERROR("'%s' is not subdomain of '%s'", fctx->info, 4687 buf); 4688 result = ISC_R_UNEXPECTED; 4689 goto cleanup_fcount; 4690 } 4691 4692 dns_message_create(fctx->mctx, fctx->res->namepools[fctx->tid], 4693 fctx->res->rdspools[fctx->tid], 4694 DNS_MESSAGE_INTENTRENDER, &fctx->qmessage); 4695 4696 /* 4697 * Compute an expiration time for the entire fetch. 4698 */ 4699 isc_interval_set(&interval, res->query_timeout / 1000, 4700 res->query_timeout % 1000 * 1000000); 4701 iresult = isc_time_nowplusinterval(&fctx->expires, &interval); 4702 if (iresult != ISC_R_SUCCESS) { 4703 UNEXPECTED_ERROR("isc_time_nowplusinterval: %s", 4704 isc_result_totext(iresult)); 4705 result = ISC_R_UNEXPECTED; 4706 goto cleanup_qmessage; 4707 } 4708 4709 /* 4710 * Default retry interval initialization. We set the interval 4711 * now mostly so it won't be uninitialized. It will be set to 4712 * the correct value before a query is issued. 4713 */ 4714 isc_interval_set(&fctx->interval, 2, 0); 4715 4716 /* 4717 * Attach to the view's cache and adb. 4718 */ 4719 dns_db_attach(res->view->cachedb, &fctx->cache); 4720 dns_view_getadb(res->view, &fctx->adb); 4721 4722 ISC_LIST_INIT(fctx->resps); 4723 ISC_LINK_INIT(fctx, link); 4724 fctx->magic = FCTX_MAGIC; 4725 4726 /* 4727 * If qname minimization is enabled we need to trim 4728 * the name in fctx to proper length. 4729 */ 4730 if ((options & DNS_FETCHOPT_QMINIMIZE) != 0) { 4731 fctx->ip6arpaskip = (options & DNS_FETCHOPT_QMIN_SKIP_IP6A) != 4732 0 && 4733 dns_name_issubdomain(fctx->name, &ip6_arpa); 4734 fctx_minimize_qname(fctx); 4735 } 4736 4737 nfctx = atomic_fetch_add_relaxed(&res->nfctx, 1); 4738 INSIST(nfctx < UINT32_MAX); 4739 4740 inc_stats(res, dns_resstatscounter_nfetch); 4741 4742 isc_timer_create(fctx->loop, fctx_expired, fctx, &fctx->timer); 4743 4744 *fctxp = fctx; 4745 4746 return ISC_R_SUCCESS; 4747 4748 cleanup_qmessage: 4749 dns_message_detach(&fctx->qmessage); 4750 4751 cleanup_fcount: 4752 fcount_decr(fctx); 4753 4754 cleanup_nameservers: 4755 if (dns_rdataset_isassociated(&fctx->nameservers)) { 4756 dns_rdataset_disassociate(&fctx->nameservers); 4757 } 4758 isc_mem_free(fctx->mctx, fctx->info); 4759 isc_counter_detach(&fctx->qc); 4760 4761 cleanup_fetch: 4762 dns_resolver_detach(&fctx->res); 4763 isc_mem_putanddetach(&fctx->mctx, fctx, sizeof(*fctx)); 4764 4765 return result; 4766 } 4767 4768 /* 4769 * Handle Responses 4770 */ 4771 static bool 4772 is_lame(fetchctx_t *fctx, dns_message_t *message) { 4773 dns_name_t *name; 4774 dns_rdataset_t *rdataset; 4775 isc_result_t result; 4776 4777 if (message->rcode != dns_rcode_noerror && 4778 message->rcode != dns_rcode_yxdomain && 4779 message->rcode != dns_rcode_nxdomain) 4780 { 4781 return false; 4782 } 4783 4784 if (message->counts[DNS_SECTION_ANSWER] != 0) { 4785 return false; 4786 } 4787 4788 if (message->counts[DNS_SECTION_AUTHORITY] == 0) { 4789 return false; 4790 } 4791 4792 result = dns_message_firstname(message, DNS_SECTION_AUTHORITY); 4793 while (result == ISC_R_SUCCESS) { 4794 name = NULL; 4795 dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name); 4796 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 4797 rdataset = ISC_LIST_NEXT(rdataset, link)) 4798 { 4799 dns_namereln_t namereln; 4800 int order; 4801 unsigned int labels; 4802 if (rdataset->type != dns_rdatatype_ns) { 4803 continue; 4804 } 4805 namereln = dns_name_fullcompare(name, fctx->domain, 4806 &order, &labels); 4807 if (namereln == dns_namereln_equal && 4808 (message->flags & DNS_MESSAGEFLAG_AA) != 0) 4809 { 4810 return false; 4811 } 4812 if (namereln == dns_namereln_subdomain) { 4813 return false; 4814 } 4815 return true; 4816 } 4817 result = dns_message_nextname(message, DNS_SECTION_AUTHORITY); 4818 } 4819 4820 return false; 4821 } 4822 4823 static void 4824 log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) { 4825 char namebuf[DNS_NAME_FORMATSIZE]; 4826 char domainbuf[DNS_NAME_FORMATSIZE]; 4827 char addrbuf[ISC_SOCKADDR_FORMATSIZE]; 4828 4829 dns_name_format(fctx->name, namebuf, sizeof(namebuf)); 4830 dns_name_format(fctx->domain, domainbuf, sizeof(domainbuf)); 4831 isc_sockaddr_format(&addrinfo->sockaddr, addrbuf, sizeof(addrbuf)); 4832 isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS, 4833 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 4834 "lame server resolving '%s' (in '%s'?): %s", namebuf, 4835 domainbuf, addrbuf); 4836 } 4837 4838 static void 4839 log_formerr(fetchctx_t *fctx, const char *format, ...) { 4840 char nsbuf[ISC_SOCKADDR_FORMATSIZE]; 4841 char msgbuf[2048]; 4842 va_list args; 4843 4844 va_start(args, format); 4845 vsnprintf(msgbuf, sizeof(msgbuf), format, args); 4846 va_end(args); 4847 4848 isc_sockaddr_format(&fctx->addrinfo->sockaddr, nsbuf, sizeof(nsbuf)); 4849 4850 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 4851 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 4852 "DNS format error from %s resolving %s for %s: %s", nsbuf, 4853 fctx->info, fctx->clientstr, msgbuf); 4854 } 4855 4856 static isc_result_t 4857 same_question(fetchctx_t *fctx, dns_message_t *message) { 4858 isc_result_t result; 4859 dns_name_t *name = NULL; 4860 dns_rdataset_t *rdataset = NULL; 4861 4862 /* 4863 * Caller must be holding the fctx lock. 4864 */ 4865 4866 /* 4867 * XXXRTH Currently we support only one question. 4868 */ 4869 if (message->counts[DNS_SECTION_QUESTION] == 0) { 4870 if ((message->flags & DNS_MESSAGEFLAG_TC) != 0) { 4871 /* 4872 * If TC=1 and the question section is empty, we 4873 * accept the reply message as a truncated 4874 * answer, to be retried over TCP. 4875 * 4876 * It is really a FORMERR condition, but this is 4877 * a workaround to accept replies from some 4878 * implementations. 4879 * 4880 * Because the question section matching is not 4881 * performed, the worst that could happen is 4882 * that an attacker who gets past the ID and 4883 * source port checks can force the use of 4884 * TCP. This is considered an acceptable risk. 4885 */ 4886 log_formerr(fctx, "empty question section, " 4887 "accepting it anyway as TC=1"); 4888 return ISC_R_SUCCESS; 4889 } else { 4890 log_formerr(fctx, "empty question section"); 4891 return DNS_R_FORMERR; 4892 } 4893 } else if (message->counts[DNS_SECTION_QUESTION] > 1) { 4894 log_formerr(fctx, "too many questions"); 4895 return DNS_R_FORMERR; 4896 } 4897 4898 result = dns_message_firstname(message, DNS_SECTION_QUESTION); 4899 if (result != ISC_R_SUCCESS) { 4900 return result; 4901 } 4902 4903 dns_message_currentname(message, DNS_SECTION_QUESTION, &name); 4904 rdataset = ISC_LIST_HEAD(name->list); 4905 INSIST(rdataset != NULL); 4906 INSIST(ISC_LIST_NEXT(rdataset, link) == NULL); 4907 4908 if (fctx->type != rdataset->type || 4909 fctx->res->rdclass != rdataset->rdclass || 4910 !dns_name_equal(fctx->name, name)) 4911 { 4912 char namebuf[DNS_NAME_FORMATSIZE]; 4913 char classbuf[DNS_RDATACLASS_FORMATSIZE]; 4914 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 4915 4916 dns_name_format(name, namebuf, sizeof(namebuf)); 4917 dns_rdataclass_format(rdataset->rdclass, classbuf, 4918 sizeof(classbuf)); 4919 dns_rdatatype_format(rdataset->type, typebuf, sizeof(typebuf)); 4920 log_formerr(fctx, "question section mismatch: got %s/%s/%s", 4921 namebuf, classbuf, typebuf); 4922 return DNS_R_FORMERR; 4923 } 4924 4925 return ISC_R_SUCCESS; 4926 } 4927 4928 static void 4929 clone_results(fetchctx_t *fctx) { 4930 dns_fetchresponse_t *resp = NULL, *hresp = NULL; 4931 4932 FCTXTRACE("clone_results"); 4933 4934 /* 4935 * Set up any other resps to have the same data as the first. 4936 * 4937 * Caller must be holding the appropriate lock. 4938 */ 4939 4940 fctx->cloned = true; 4941 4942 for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL; 4943 resp = ISC_LIST_NEXT(resp, link)) 4944 { 4945 /* This is the head resp; keep a pointer and move on */ 4946 if (hresp == NULL) { 4947 hresp = ISC_LIST_HEAD(fctx->resps); 4948 continue; 4949 } 4950 4951 resp->result = hresp->result; 4952 dns_name_copy(hresp->foundname, resp->foundname); 4953 dns_db_attach(hresp->db, &resp->db); 4954 dns_db_attachnode(hresp->db, hresp->node, &resp->node); 4955 4956 INSIST(hresp->rdataset != NULL); 4957 INSIST(resp->rdataset != NULL); 4958 if (dns_rdataset_isassociated(hresp->rdataset)) { 4959 dns_rdataset_clone(hresp->rdataset, resp->rdataset); 4960 } 4961 4962 INSIST(!(hresp->sigrdataset == NULL && 4963 resp->sigrdataset != NULL)); 4964 if (hresp->sigrdataset != NULL && 4965 dns_rdataset_isassociated(hresp->sigrdataset) && 4966 resp->sigrdataset != NULL) 4967 { 4968 dns_rdataset_clone(hresp->sigrdataset, 4969 resp->sigrdataset); 4970 } 4971 } 4972 } 4973 4974 #define CACHE(r) (((r)->attributes & DNS_RDATASETATTR_CACHE) != 0) 4975 #define ANSWER(r) (((r)->attributes & DNS_RDATASETATTR_ANSWER) != 0) 4976 #define ANSWERSIG(r) (((r)->attributes & DNS_RDATASETATTR_ANSWERSIG) != 0) 4977 #define EXTERNAL(r) (((r)->attributes & DNS_RDATASETATTR_EXTERNAL) != 0) 4978 #define CHAINING(r) (((r)->attributes & DNS_RDATASETATTR_CHAINING) != 0) 4979 #define CHASE(r) (((r)->attributes & DNS_RDATASETATTR_CHASE) != 0) 4980 #define CHECKNAMES(r) (((r)->attributes & DNS_RDATASETATTR_CHECKNAMES) != 0) 4981 4982 /* 4983 * Cancel validators associated with '*fctx' if it is ready to be 4984 * destroyed (i.e., no queries waiting for it and no pending ADB finds). 4985 * Caller must hold fctx bucket lock. 4986 * 4987 * Requires: 4988 * '*fctx' is shutting down. 4989 */ 4990 static void 4991 maybe_cancel_validators(fetchctx_t *fctx) { 4992 if (atomic_load_acquire(&fctx->pending) != 0 || 4993 atomic_load_acquire(&fctx->nqueries) != 0) 4994 { 4995 return; 4996 } 4997 4998 REQUIRE(SHUTTINGDOWN(fctx)); 4999 for (dns_validator_t *validator = ISC_LIST_HEAD(fctx->validators); 5000 validator != NULL; validator = ISC_LIST_NEXT(validator, link)) 5001 { 5002 dns_validator_cancel(validator); 5003 } 5004 } 5005 5006 /* 5007 * typemap with just RRSIG(46) and NSEC(47) bits set. 5008 * 5009 * Bitmap calculation from dns_nsec_setbit: 5010 * 5011 * 46 47 5012 * shift = 7 - (type % 8); 0 1 5013 * mask = 1 << shift; 0x02 0x01 5014 * array[type / 8] |= mask; 5015 * 5016 * Window (0), bitmap length (6), and bitmap. 5017 */ 5018 static const unsigned char minimal_typemap[] = { 0, 6, 0, 0, 0, 0, 0, 0x03 }; 5019 5020 static bool 5021 is_minimal_nsec(dns_rdataset_t *nsecset) { 5022 dns_rdataset_t rdataset; 5023 isc_result_t result; 5024 5025 dns_rdataset_init(&rdataset); 5026 dns_rdataset_clone(nsecset, &rdataset); 5027 5028 for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS; 5029 result = dns_rdataset_next(&rdataset)) 5030 { 5031 dns_rdata_t rdata = DNS_RDATA_INIT; 5032 dns_rdata_nsec_t nsec; 5033 dns_rdataset_current(&rdataset, &rdata); 5034 result = dns_rdata_tostruct(&rdata, &nsec, NULL); 5035 RUNTIME_CHECK(result == ISC_R_SUCCESS); 5036 if (nsec.len == sizeof(minimal_typemap) && 5037 memcmp(nsec.typebits, minimal_typemap, nsec.len) == 0) 5038 { 5039 dns_rdataset_disassociate(&rdataset); 5040 return true; 5041 } 5042 } 5043 dns_rdataset_disassociate(&rdataset); 5044 return false; 5045 } 5046 5047 /* 5048 * If there is a SOA record in the type map then there must be a DNSKEY. 5049 */ 5050 static bool 5051 check_soa_and_dnskey(dns_rdataset_t *nsecset) { 5052 dns_rdataset_t rdataset; 5053 isc_result_t result; 5054 5055 dns_rdataset_init(&rdataset); 5056 dns_rdataset_clone(nsecset, &rdataset); 5057 5058 for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS; 5059 result = dns_rdataset_next(&rdataset)) 5060 { 5061 dns_rdata_t rdata = DNS_RDATA_INIT; 5062 dns_rdataset_current(&rdataset, &rdata); 5063 if (dns_nsec_typepresent(&rdata, dns_rdatatype_soa) && 5064 (!dns_nsec_typepresent(&rdata, dns_rdatatype_dnskey) || 5065 !dns_nsec_typepresent(&rdata, dns_rdatatype_ns))) 5066 { 5067 dns_rdataset_disassociate(&rdataset); 5068 return false; 5069 } 5070 } 5071 dns_rdataset_disassociate(&rdataset); 5072 return true; 5073 } 5074 5075 /* 5076 * Look for NSEC next name that starts with the label '\000'. 5077 */ 5078 static bool 5079 has_000_label(dns_rdataset_t *nsecset) { 5080 dns_rdataset_t rdataset; 5081 isc_result_t result; 5082 5083 dns_rdataset_init(&rdataset); 5084 dns_rdataset_clone(nsecset, &rdataset); 5085 5086 for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS; 5087 result = dns_rdataset_next(&rdataset)) 5088 { 5089 dns_rdata_t rdata = DNS_RDATA_INIT; 5090 dns_rdataset_current(&rdataset, &rdata); 5091 if (rdata.length > 1 && rdata.data[0] == 1 && 5092 rdata.data[1] == 0) 5093 { 5094 dns_rdataset_disassociate(&rdataset); 5095 return true; 5096 } 5097 } 5098 dns_rdataset_disassociate(&rdataset); 5099 return false; 5100 } 5101 5102 /* 5103 * The validator has finished. 5104 */ 5105 static void 5106 validated(void *arg) { 5107 dns_validator_t *val = (dns_validator_t *)arg; 5108 dns_adbaddrinfo_t *addrinfo = NULL; 5109 dns_dbnode_t *node = NULL; 5110 dns_dbnode_t *nsnode = NULL; 5111 dns_fetchresponse_t *hresp = NULL; 5112 dns_name_t *name = NULL; 5113 dns_rdataset_t *ardataset = NULL; 5114 dns_rdataset_t *asigrdataset = NULL; 5115 dns_rdataset_t *rdataset = NULL; 5116 dns_rdataset_t *sigrdataset = NULL; 5117 dns_resolver_t *res = NULL; 5118 dns_valarg_t *valarg = NULL; 5119 fetchctx_t *fctx = NULL; 5120 bool chaining; 5121 bool negative; 5122 bool sentresponse; 5123 isc_result_t eresult = ISC_R_SUCCESS; 5124 isc_result_t result = ISC_R_SUCCESS; 5125 isc_stdtime_t now; 5126 uint32_t ttl; 5127 unsigned int options; 5128 dns_fixedname_t fwild; 5129 dns_name_t *wild = NULL; 5130 dns_message_t *message = NULL; 5131 bool done = false; 5132 5133 valarg = val->arg; 5134 5135 REQUIRE(VALID_FCTX(valarg->fctx)); 5136 REQUIRE(!ISC_LIST_EMPTY(valarg->fctx->validators)); 5137 5138 fctx = valarg->fctx; 5139 valarg->fctx = NULL; 5140 5141 REQUIRE(fctx->tid == isc_tid()); 5142 5143 FCTXTRACE("received validation completion event"); 5144 5145 res = fctx->res; 5146 addrinfo = valarg->addrinfo; 5147 5148 message = val->message; 5149 fctx->vresult = val->result; 5150 5151 LOCK(&fctx->lock); 5152 ISC_LIST_UNLINK(fctx->validators, val, link); 5153 fctx->validator = NULL; 5154 UNLOCK(&fctx->lock); 5155 5156 /* 5157 * Destroy the validator early so that we can 5158 * destroy the fctx if necessary. Save the wildcard name. 5159 */ 5160 if (val->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL) { 5161 wild = dns_fixedname_initname(&fwild); 5162 dns_name_copy(dns_fixedname_name(&val->wild), wild); 5163 } 5164 5165 isc_mem_put(fctx->mctx, valarg, sizeof(*valarg)); 5166 5167 negative = (val->rdataset == NULL); 5168 5169 LOCK(&fctx->lock); 5170 sentresponse = ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0); 5171 5172 /* 5173 * If shutting down, ignore the results. Check to see if we're 5174 * done waiting for validator completions and ADB pending 5175 * events; if so, destroy the fctx. 5176 */ 5177 if (SHUTTINGDOWN(fctx) && !sentresponse) { 5178 UNLOCK(&fctx->lock); 5179 goto cleanup_fetchctx; 5180 } 5181 5182 now = isc_stdtime_now(); 5183 5184 /* 5185 * If chaining, we need to make sure that the right result code 5186 * is returned, and that the rdatasets are bound. 5187 */ 5188 if (val->result == ISC_R_SUCCESS && !negative && 5189 val->rdataset != NULL && CHAINING(val->rdataset)) 5190 { 5191 if (val->rdataset->type == dns_rdatatype_cname) { 5192 eresult = DNS_R_CNAME; 5193 } else { 5194 INSIST(val->rdataset->type == dns_rdatatype_dname); 5195 eresult = DNS_R_DNAME; 5196 } 5197 chaining = true; 5198 } else { 5199 chaining = false; 5200 } 5201 5202 /* 5203 * Either we're not shutting down, or we are shutting down but 5204 * want to cache the result anyway (if this was a validation 5205 * started by a query with cd set) 5206 */ 5207 5208 hresp = ISC_LIST_HEAD(fctx->resps); 5209 if (hresp != NULL) { 5210 if (!negative && !chaining && 5211 (fctx->type == dns_rdatatype_any || 5212 fctx->type == dns_rdatatype_rrsig || 5213 fctx->type == dns_rdatatype_sig)) 5214 { 5215 /* 5216 * Don't bind rdatasets; the caller 5217 * will iterate the node. 5218 */ 5219 } else { 5220 ardataset = hresp->rdataset; 5221 asigrdataset = hresp->sigrdataset; 5222 } 5223 } 5224 5225 if (val->result != ISC_R_SUCCESS) { 5226 FCTXTRACE("validation failed"); 5227 inc_stats(res, dns_resstatscounter_valfail); 5228 fctx->valfail++; 5229 fctx->vresult = val->result; 5230 if (fctx->vresult != DNS_R_BROKENCHAIN) { 5231 result = ISC_R_NOTFOUND; 5232 if (val->rdataset != NULL) { 5233 result = dns_db_findnode(fctx->cache, val->name, 5234 false, &node); 5235 } 5236 if (result == ISC_R_SUCCESS) { 5237 (void)dns_db_deleterdataset(fctx->cache, node, 5238 NULL, val->type, 0); 5239 } 5240 if (result == ISC_R_SUCCESS && val->sigrdataset != NULL) 5241 { 5242 (void)dns_db_deleterdataset( 5243 fctx->cache, node, NULL, 5244 dns_rdatatype_rrsig, val->type); 5245 } 5246 if (result == ISC_R_SUCCESS) { 5247 dns_db_detachnode(fctx->cache, &node); 5248 } 5249 } 5250 if (fctx->vresult == DNS_R_BROKENCHAIN && !negative) { 5251 /* 5252 * Cache the data as pending for later 5253 * validation. 5254 */ 5255 result = ISC_R_NOTFOUND; 5256 if (val->rdataset != NULL) { 5257 result = dns_db_findnode(fctx->cache, val->name, 5258 true, &node); 5259 } 5260 if (result == ISC_R_SUCCESS) { 5261 (void)dns_db_addrdataset( 5262 fctx->cache, node, NULL, now, 5263 val->rdataset, 0, NULL); 5264 } 5265 if (result == ISC_R_SUCCESS && val->sigrdataset != NULL) 5266 { 5267 (void)dns_db_addrdataset( 5268 fctx->cache, node, NULL, now, 5269 val->sigrdataset, 0, NULL); 5270 } 5271 if (result == ISC_R_SUCCESS) { 5272 dns_db_detachnode(fctx->cache, &node); 5273 } 5274 } 5275 result = fctx->vresult; 5276 add_bad(fctx, message, addrinfo, result, badns_validation); 5277 5278 UNLOCK(&fctx->lock); 5279 5280 INSIST(fctx->validator == NULL); 5281 5282 fctx->validator = ISC_LIST_HEAD(fctx->validators); 5283 if (fctx->validator != NULL) { 5284 dns_validator_send(fctx->validator); 5285 goto cleanup_fetchctx; 5286 } else if (sentresponse) { 5287 done = true; 5288 goto cleanup_fetchctx; 5289 } else if (result == DNS_R_BROKENCHAIN) { 5290 done = true; 5291 goto cleanup_fetchctx; 5292 } else { 5293 fctx_try(fctx, true); 5294 goto cleanup_fetchctx; 5295 } 5296 UNREACHABLE(); 5297 } 5298 5299 if (negative) { 5300 dns_rdatatype_t covers; 5301 FCTXTRACE("nonexistence validation OK"); 5302 5303 inc_stats(res, dns_resstatscounter_valnegsuccess); 5304 5305 /* 5306 * Cache DS NXDOMAIN separately to other types. 5307 */ 5308 if (message->rcode == dns_rcode_nxdomain && 5309 fctx->type != dns_rdatatype_ds) 5310 { 5311 covers = dns_rdatatype_any; 5312 } else { 5313 covers = fctx->type; 5314 } 5315 5316 /* 5317 * Don't report qname minimisation NXDOMAIN errors 5318 * when the result is NXDOMAIN except we have already 5319 * confirmed a higher error. 5320 */ 5321 if (!fctx->force_qmin_warning && 5322 message->rcode == dns_rcode_nxdomain && 5323 (fctx->qmin_warning == DNS_R_NXDOMAIN || 5324 fctx->qmin_warning == DNS_R_NCACHENXDOMAIN)) 5325 { 5326 fctx->qmin_warning = ISC_R_SUCCESS; 5327 } 5328 5329 result = dns_db_findnode(fctx->cache, val->name, true, &node); 5330 if (result != ISC_R_SUCCESS) { 5331 /* fctx->lock unlocked in noanswer_response */ 5332 goto noanswer_response; 5333 } 5334 5335 /* 5336 * If we are asking for a SOA record set the cache time 5337 * to zero to facilitate locating the containing zone of 5338 * a arbitrary zone. 5339 */ 5340 ttl = res->view->maxncachettl; 5341 if (fctx->type == dns_rdatatype_soa && 5342 covers == dns_rdatatype_any && res->zero_no_soa_ttl) 5343 { 5344 ttl = 0; 5345 } 5346 5347 result = ncache_adderesult(message, fctx->cache, node, covers, 5348 now, fctx->res->view->minncachettl, 5349 ttl, val->optout, val->secure, 5350 ardataset, &eresult); 5351 if (result != ISC_R_SUCCESS) { 5352 goto noanswer_response; 5353 } 5354 goto answer_response; 5355 } else { 5356 inc_stats(res, dns_resstatscounter_valsuccess); 5357 } 5358 5359 FCTXTRACE("validation OK"); 5360 5361 if (val->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL) { 5362 result = dns_rdataset_addnoqname( 5363 val->rdataset, val->proofs[DNS_VALIDATOR_NOQNAMEPROOF]); 5364 RUNTIME_CHECK(result == ISC_R_SUCCESS); 5365 INSIST(val->sigrdataset != NULL); 5366 val->sigrdataset->ttl = val->rdataset->ttl; 5367 if (val->proofs[DNS_VALIDATOR_CLOSESTENCLOSER] != NULL) { 5368 result = dns_rdataset_addclosest( 5369 val->rdataset, 5370 val->proofs[DNS_VALIDATOR_CLOSESTENCLOSER]); 5371 RUNTIME_CHECK(result == ISC_R_SUCCESS); 5372 } 5373 } else if (val->rdataset->trust == dns_trust_answer && 5374 val->rdataset->type != dns_rdatatype_rrsig) 5375 { 5376 isc_result_t tresult; 5377 dns_name_t *noqname = NULL; 5378 tresult = findnoqname(fctx, message, val->name, 5379 val->rdataset->type, &noqname); 5380 if (tresult == ISC_R_SUCCESS && noqname != NULL) { 5381 tresult = dns_rdataset_addnoqname(val->rdataset, 5382 noqname); 5383 RUNTIME_CHECK(tresult == ISC_R_SUCCESS); 5384 } 5385 } 5386 5387 /* 5388 * The data was already cached as pending data. 5389 * Re-cache it as secure and bind the cached 5390 * rdatasets to the first event on the fetch 5391 * event list. 5392 */ 5393 result = dns_db_findnode(fctx->cache, val->name, true, &node); 5394 if (result != ISC_R_SUCCESS) { 5395 goto noanswer_response; 5396 } 5397 5398 options = 0; 5399 if ((fctx->options & DNS_FETCHOPT_PREFETCH) != 0) { 5400 options = DNS_DBADD_PREFETCH; 5401 } 5402 result = dns_db_addrdataset(fctx->cache, node, NULL, now, val->rdataset, 5403 options, ardataset); 5404 if (result != ISC_R_SUCCESS && result != DNS_R_UNCHANGED) { 5405 goto noanswer_response; 5406 } 5407 if (ardataset != NULL && NEGATIVE(ardataset)) { 5408 if (NXDOMAIN(ardataset)) { 5409 eresult = DNS_R_NCACHENXDOMAIN; 5410 } else { 5411 eresult = DNS_R_NCACHENXRRSET; 5412 } 5413 } else if (val->sigrdataset != NULL) { 5414 result = dns_db_addrdataset(fctx->cache, node, NULL, now, 5415 val->sigrdataset, options, 5416 asigrdataset); 5417 if (result != ISC_R_SUCCESS && result != DNS_R_UNCHANGED) { 5418 goto noanswer_response; 5419 } 5420 } 5421 5422 if (sentresponse) { 5423 /* 5424 * If we only deferred the destroy because we wanted to 5425 * cache the data, destroy now. 5426 */ 5427 dns_db_detachnode(fctx->cache, &node); 5428 if (SHUTTINGDOWN(fctx)) { 5429 maybe_cancel_validators(fctx); 5430 } 5431 UNLOCK(&fctx->lock); 5432 goto cleanup_fetchctx; 5433 } 5434 5435 if (!ISC_LIST_EMPTY(fctx->validators)) { 5436 INSIST(!negative); 5437 INSIST(fctx->type == dns_rdatatype_any || 5438 fctx->type == dns_rdatatype_rrsig || 5439 fctx->type == dns_rdatatype_sig); 5440 /* 5441 * Don't send a response yet - we have 5442 * more rdatasets that still need to 5443 * be validated. 5444 */ 5445 dns_db_detachnode(fctx->cache, &node); 5446 UNLOCK(&fctx->lock); 5447 dns_validator_send(ISC_LIST_HEAD(fctx->validators)); 5448 goto cleanup_fetchctx; 5449 } 5450 5451 answer_response: 5452 5453 /* 5454 * Cache any SOA/NS/NSEC records that happened to be validated. 5455 */ 5456 result = dns_message_firstname(message, DNS_SECTION_AUTHORITY); 5457 while (result == ISC_R_SUCCESS) { 5458 name = NULL; 5459 dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name); 5460 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 5461 rdataset = ISC_LIST_NEXT(rdataset, link)) 5462 { 5463 if ((rdataset->type != dns_rdatatype_ns && 5464 rdataset->type != dns_rdatatype_soa && 5465 rdataset->type != dns_rdatatype_nsec) || 5466 rdataset->trust != dns_trust_secure) 5467 { 5468 continue; 5469 } 5470 for (sigrdataset = ISC_LIST_HEAD(name->list); 5471 sigrdataset != NULL; 5472 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 5473 { 5474 if (sigrdataset->type != dns_rdatatype_rrsig || 5475 sigrdataset->covers != rdataset->type) 5476 { 5477 continue; 5478 } 5479 break; 5480 } 5481 if (sigrdataset == NULL || 5482 sigrdataset->trust != dns_trust_secure) 5483 { 5484 continue; 5485 } 5486 5487 /* 5488 * Don't cache NSEC if missing NSEC or RRSIG types. 5489 */ 5490 if (rdataset->type == dns_rdatatype_nsec && 5491 !dns_nsec_requiredtypespresent(rdataset)) 5492 { 5493 continue; 5494 } 5495 5496 /* 5497 * Don't cache "white lies" but do cache 5498 * "black lies". 5499 */ 5500 if (rdataset->type == dns_rdatatype_nsec && 5501 !dns_name_equal(fctx->name, name) && 5502 is_minimal_nsec(rdataset)) 5503 { 5504 continue; 5505 } 5506 5507 /* 5508 * Check SOA and DNSKEY consistency. 5509 */ 5510 if (rdataset->type == dns_rdatatype_nsec && 5511 !check_soa_and_dnskey(rdataset)) 5512 { 5513 continue; 5514 } 5515 5516 /* 5517 * Look for \000 label in next name. 5518 */ 5519 if (rdataset->type == dns_rdatatype_nsec && 5520 has_000_label(rdataset)) 5521 { 5522 continue; 5523 } 5524 5525 result = dns_db_findnode(fctx->cache, name, true, 5526 &nsnode); 5527 if (result != ISC_R_SUCCESS) { 5528 continue; 5529 } 5530 5531 result = dns_db_addrdataset(fctx->cache, nsnode, NULL, 5532 now, rdataset, 0, NULL); 5533 if (result == ISC_R_SUCCESS) { 5534 result = dns_db_addrdataset( 5535 fctx->cache, nsnode, NULL, now, 5536 sigrdataset, 0, NULL); 5537 } 5538 dns_db_detachnode(fctx->cache, &nsnode); 5539 if (result != ISC_R_SUCCESS) { 5540 continue; 5541 } 5542 } 5543 result = dns_message_nextname(message, DNS_SECTION_AUTHORITY); 5544 } 5545 5546 /* 5547 * Add the wild card entry. 5548 */ 5549 if (val->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL && 5550 val->rdataset != NULL && dns_rdataset_isassociated(val->rdataset) && 5551 val->rdataset->trust == dns_trust_secure && 5552 val->sigrdataset != NULL && 5553 dns_rdataset_isassociated(val->sigrdataset) && 5554 val->sigrdataset->trust == dns_trust_secure && wild != NULL) 5555 { 5556 dns_dbnode_t *wnode = NULL; 5557 5558 result = dns_db_findnode(fctx->cache, wild, true, &wnode); 5559 if (result == ISC_R_SUCCESS) { 5560 result = dns_db_addrdataset(fctx->cache, wnode, NULL, 5561 now, val->rdataset, 0, 5562 NULL); 5563 } 5564 if (result == ISC_R_SUCCESS) { 5565 (void)dns_db_addrdataset(fctx->cache, wnode, NULL, now, 5566 val->sigrdataset, 0, NULL); 5567 } 5568 if (wnode != NULL) { 5569 dns_db_detachnode(fctx->cache, &wnode); 5570 } 5571 } 5572 5573 result = ISC_R_SUCCESS; 5574 5575 /* 5576 * Respond with an answer, positive or negative, 5577 * as opposed to an error. 'node' must be non-NULL. 5578 */ 5579 5580 FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER); 5581 5582 if (hresp != NULL) { 5583 /* 5584 * Negative results must be indicated in val->result. 5585 */ 5586 INSIST(hresp->rdataset != NULL); 5587 if (dns_rdataset_isassociated(hresp->rdataset) && 5588 NEGATIVE(hresp->rdataset)) 5589 { 5590 INSIST(eresult == DNS_R_NCACHENXDOMAIN || 5591 eresult == DNS_R_NCACHENXRRSET); 5592 } 5593 5594 hresp->result = eresult; 5595 dns_name_copy(val->name, hresp->foundname); 5596 dns_db_attach(fctx->cache, &hresp->db); 5597 dns_db_transfernode(fctx->cache, &node, &hresp->node); 5598 clone_results(fctx); 5599 } 5600 5601 noanswer_response: 5602 if (node != NULL) { 5603 dns_db_detachnode(fctx->cache, &node); 5604 } 5605 5606 UNLOCK(&fctx->lock); 5607 done = true; 5608 5609 cleanup_fetchctx: 5610 if (done) { 5611 fctx_done_unref(fctx, result); 5612 } 5613 5614 /* 5615 * val->name points to name on a message on one of the 5616 * queries on the fetch context so the name has to be 5617 * released first with a dns_validator_shutdown() call. 5618 */ 5619 dns_validator_shutdown(val); 5620 dns_validator_detach(&val); 5621 fetchctx_detach(&fctx); 5622 INSIST(node == NULL); 5623 } 5624 5625 static void 5626 fctx_log(void *arg, int level, const char *fmt, ...) { 5627 char msgbuf[2048]; 5628 va_list args; 5629 fetchctx_t *fctx = arg; 5630 5631 va_start(args, fmt); 5632 vsnprintf(msgbuf, sizeof(msgbuf), fmt, args); 5633 va_end(args); 5634 5635 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 5636 DNS_LOGMODULE_RESOLVER, level, "fctx %p(%s): %s", fctx, 5637 fctx->info, msgbuf); 5638 } 5639 5640 static isc_result_t 5641 findnoqname(fetchctx_t *fctx, dns_message_t *message, dns_name_t *name, 5642 dns_rdatatype_t type, dns_name_t **noqnamep) { 5643 dns_rdataset_t *nrdataset, *next, *sigrdataset; 5644 dns_rdata_rrsig_t rrsig; 5645 isc_result_t result; 5646 unsigned int labels; 5647 dns_section_t section; 5648 dns_name_t *zonename; 5649 dns_fixedname_t fzonename; 5650 dns_name_t *closest; 5651 dns_fixedname_t fclosest; 5652 dns_name_t *nearest; 5653 dns_fixedname_t fnearest; 5654 dns_rdatatype_t found = dns_rdatatype_none; 5655 dns_name_t *noqname = NULL; 5656 5657 FCTXTRACE("findnoqname"); 5658 5659 REQUIRE(noqnamep != NULL && *noqnamep == NULL); 5660 5661 /* 5662 * Find the SIG for this rdataset, if we have it. 5663 */ 5664 for (sigrdataset = ISC_LIST_HEAD(name->list); sigrdataset != NULL; 5665 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 5666 { 5667 if (sigrdataset->type == dns_rdatatype_rrsig && 5668 sigrdataset->covers == type) 5669 { 5670 break; 5671 } 5672 } 5673 5674 if (sigrdataset == NULL) { 5675 return ISC_R_NOTFOUND; 5676 } 5677 5678 labels = dns_name_countlabels(name); 5679 5680 for (result = dns_rdataset_first(sigrdataset); result == ISC_R_SUCCESS; 5681 result = dns_rdataset_next(sigrdataset)) 5682 { 5683 dns_rdata_t rdata = DNS_RDATA_INIT; 5684 dns_rdataset_current(sigrdataset, &rdata); 5685 result = dns_rdata_tostruct(&rdata, &rrsig, NULL); 5686 RUNTIME_CHECK(result == ISC_R_SUCCESS); 5687 /* Wildcard has rrsig.labels < labels - 1. */ 5688 if (rrsig.labels + 1U >= labels) { 5689 continue; 5690 } 5691 break; 5692 } 5693 5694 if (result == ISC_R_NOMORE) { 5695 return ISC_R_NOTFOUND; 5696 } 5697 if (result != ISC_R_SUCCESS) { 5698 return result; 5699 } 5700 5701 zonename = dns_fixedname_initname(&fzonename); 5702 closest = dns_fixedname_initname(&fclosest); 5703 nearest = dns_fixedname_initname(&fnearest); 5704 5705 #define NXND(x) ((x) == ISC_R_SUCCESS) 5706 5707 section = DNS_SECTION_AUTHORITY; 5708 for (result = dns_message_firstname(message, section); 5709 result == ISC_R_SUCCESS; 5710 result = dns_message_nextname(message, section)) 5711 { 5712 dns_name_t *nsec = NULL; 5713 dns_message_currentname(message, section, &nsec); 5714 for (nrdataset = ISC_LIST_HEAD(nsec->list); nrdataset != NULL; 5715 nrdataset = next) 5716 { 5717 bool data = false, exists = false; 5718 bool optout = false, unknown = false; 5719 bool setclosest = false; 5720 bool setnearest = false; 5721 5722 next = ISC_LIST_NEXT(nrdataset, link); 5723 if (nrdataset->type != dns_rdatatype_nsec && 5724 nrdataset->type != dns_rdatatype_nsec3) 5725 { 5726 continue; 5727 } 5728 5729 if (nrdataset->type == dns_rdatatype_nsec && 5730 NXND(dns_nsec_noexistnodata( 5731 type, name, nsec, nrdataset, &exists, &data, 5732 NULL, fctx_log, fctx))) 5733 { 5734 if (!exists) { 5735 noqname = nsec; 5736 found = dns_rdatatype_nsec; 5737 } 5738 } 5739 5740 if (nrdataset->type == dns_rdatatype_nsec3 && 5741 NXND(dns_nsec3_noexistnodata( 5742 type, name, nsec, nrdataset, zonename, 5743 &exists, &data, &optout, &unknown, 5744 &setclosest, &setnearest, closest, nearest, 5745 fctx_log, fctx))) 5746 { 5747 if (!exists && setnearest) { 5748 noqname = nsec; 5749 found = dns_rdatatype_nsec3; 5750 } 5751 } 5752 } 5753 } 5754 if (result == ISC_R_NOMORE) { 5755 result = ISC_R_SUCCESS; 5756 } 5757 if (noqname != NULL) { 5758 for (sigrdataset = ISC_LIST_HEAD(noqname->list); 5759 sigrdataset != NULL; 5760 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 5761 { 5762 if (sigrdataset->type == dns_rdatatype_rrsig && 5763 sigrdataset->covers == found) 5764 { 5765 break; 5766 } 5767 } 5768 if (sigrdataset != NULL) { 5769 *noqnamep = noqname; 5770 } 5771 } 5772 return result; 5773 } 5774 5775 static isc_result_t 5776 cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message, 5777 dns_adbaddrinfo_t *addrinfo, isc_stdtime_t now) { 5778 dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL; 5779 dns_rdataset_t *addedrdataset = NULL; 5780 dns_rdataset_t *ardataset = NULL, *asigrdataset = NULL; 5781 dns_rdataset_t *valrdataset = NULL, *valsigrdataset = NULL; 5782 dns_dbnode_t *node = NULL, **anodep = NULL; 5783 dns_db_t **adbp = NULL; 5784 dns_resolver_t *res = fctx->res; 5785 bool need_validation = false; 5786 bool secure_domain = false; 5787 bool have_answer = false; 5788 isc_result_t result, eresult = ISC_R_SUCCESS; 5789 dns_fetchresponse_t *resp = NULL; 5790 unsigned int options; 5791 bool fail; 5792 unsigned int valoptions = 0; 5793 bool checknta = true; 5794 5795 FCTXTRACE("cache_name"); 5796 5797 /* 5798 * The appropriate bucket lock must be held. 5799 */ 5800 5801 /* 5802 * Is DNSSEC validation required for this name? 5803 */ 5804 if ((fctx->options & DNS_FETCHOPT_NONTA) != 0) { 5805 valoptions |= DNS_VALIDATOR_NONTA; 5806 checknta = false; 5807 } 5808 5809 if (res->view->enablevalidation) { 5810 result = issecuredomain(res->view, name, fctx->type, now, 5811 checknta, NULL, &secure_domain); 5812 if (result != ISC_R_SUCCESS) { 5813 return result; 5814 } 5815 } 5816 5817 if ((fctx->options & DNS_FETCHOPT_NOCDFLAG) != 0) { 5818 valoptions |= DNS_VALIDATOR_NOCDFLAG; 5819 } 5820 5821 if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0) { 5822 need_validation = false; 5823 } else { 5824 need_validation = secure_domain; 5825 } 5826 5827 if (name->attributes.answer && !need_validation) { 5828 have_answer = true; 5829 resp = ISC_LIST_HEAD(fctx->resps); 5830 5831 if (resp != NULL) { 5832 adbp = &resp->db; 5833 dns_name_copy(name, resp->foundname); 5834 anodep = &resp->node; 5835 5836 /* 5837 * If this is an ANY, SIG or RRSIG query, we're 5838 * not going to return any rdatasets, unless we 5839 * encountered a CNAME or DNAME as "the answer". 5840 * In this case, we're going to return 5841 * DNS_R_CNAME or DNS_R_DNAME and we must set up 5842 * the rdatasets. 5843 */ 5844 if ((fctx->type != dns_rdatatype_any && 5845 fctx->type != dns_rdatatype_rrsig && 5846 fctx->type != dns_rdatatype_sig) || 5847 name->attributes.chaining) 5848 { 5849 ardataset = resp->rdataset; 5850 asigrdataset = resp->sigrdataset; 5851 } 5852 } 5853 } 5854 5855 /* 5856 * Find or create the cache node. 5857 */ 5858 result = dns_db_findnode(fctx->cache, name, true, &node); 5859 if (result != ISC_R_SUCCESS) { 5860 return result; 5861 } 5862 5863 /* 5864 * Cache or validate each cacheable rdataset. 5865 */ 5866 fail = ((fctx->res->options & DNS_RESOLVER_CHECKNAMESFAIL) != 0); 5867 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 5868 rdataset = ISC_LIST_NEXT(rdataset, link)) 5869 { 5870 if (!CACHE(rdataset)) { 5871 continue; 5872 } 5873 if (CHECKNAMES(rdataset)) { 5874 char namebuf[DNS_NAME_FORMATSIZE]; 5875 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 5876 char classbuf[DNS_RDATATYPE_FORMATSIZE]; 5877 5878 dns_name_format(name, namebuf, sizeof(namebuf)); 5879 dns_rdatatype_format(rdataset->type, typebuf, 5880 sizeof(typebuf)); 5881 dns_rdataclass_format(rdataset->rdclass, classbuf, 5882 sizeof(classbuf)); 5883 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 5884 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 5885 "check-names %s %s/%s/%s", 5886 fail ? "failure" : "warning", namebuf, 5887 typebuf, classbuf); 5888 if (fail) { 5889 if (ANSWER(rdataset)) { 5890 dns_db_detachnode(fctx->cache, &node); 5891 return DNS_R_BADNAME; 5892 } 5893 continue; 5894 } 5895 } 5896 5897 /* 5898 * Enforce the configure maximum cache TTL. 5899 */ 5900 if (rdataset->ttl > res->view->maxcachettl) { 5901 rdataset->ttl = res->view->maxcachettl; 5902 } 5903 5904 /* 5905 * Enforce configured minimum cache TTL. 5906 */ 5907 if (rdataset->ttl < res->view->mincachettl) { 5908 rdataset->ttl = res->view->mincachettl; 5909 } 5910 5911 /* 5912 * Mark the rdataset as being prefetch eligible. 5913 */ 5914 if (rdataset->ttl >= fctx->res->view->prefetch_eligible) { 5915 rdataset->attributes |= DNS_RDATASETATTR_PREFETCH; 5916 } 5917 5918 /* 5919 * Find the SIG for this rdataset, if we have it. 5920 */ 5921 for (sigrdataset = ISC_LIST_HEAD(name->list); 5922 sigrdataset != NULL; 5923 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 5924 { 5925 if (sigrdataset->type == dns_rdatatype_rrsig && 5926 sigrdataset->covers == rdataset->type) 5927 { 5928 break; 5929 } 5930 } 5931 5932 /* 5933 * If this RRset is in a secure domain, is in bailiwick, 5934 * and is not glue, attempt DNSSEC validation. (We do 5935 * not attempt to validate glue or out-of-bailiwick 5936 * data--even though there might be some performance 5937 * benefit to doing so--because it makes it simpler and 5938 * safer to ensure that records from a secure domain are 5939 * only cached if validated within the context of a 5940 * query to the domain that owns them.) 5941 */ 5942 if (secure_domain && rdataset->trust != dns_trust_glue && 5943 !EXTERNAL(rdataset)) 5944 { 5945 dns_trust_t trust; 5946 5947 /* 5948 * RRSIGs are validated as part of validating 5949 * the type they cover. 5950 */ 5951 if (rdataset->type == dns_rdatatype_rrsig) { 5952 continue; 5953 } 5954 5955 if (sigrdataset == NULL && need_validation && 5956 !ANSWER(rdataset)) 5957 { 5958 /* 5959 * Ignore unrelated non-answer 5960 * rdatasets that are missing 5961 * signatures. 5962 */ 5963 continue; 5964 } 5965 5966 /* 5967 * Normalize the rdataset and sigrdataset TTLs. 5968 */ 5969 if (sigrdataset != NULL) { 5970 rdataset->ttl = ISC_MIN(rdataset->ttl, 5971 sigrdataset->ttl); 5972 sigrdataset->ttl = rdataset->ttl; 5973 } 5974 5975 /* 5976 * Mark the rdataset as being prefetch eligible. 5977 */ 5978 if (rdataset->ttl >= fctx->res->view->prefetch_eligible) 5979 { 5980 rdataset->attributes |= 5981 DNS_RDATASETATTR_PREFETCH; 5982 } 5983 5984 /* 5985 * Cache this rdataset/sigrdataset pair as 5986 * pending data. Track whether it was 5987 * additional or not. If this was a priming 5988 * query, additional should be cached as glue. 5989 */ 5990 if (rdataset->trust == dns_trust_additional) { 5991 trust = dns_trust_pending_additional; 5992 } else { 5993 trust = dns_trust_pending_answer; 5994 } 5995 5996 rdataset->trust = trust; 5997 if (sigrdataset != NULL) { 5998 sigrdataset->trust = trust; 5999 } 6000 if (!need_validation || !ANSWER(rdataset)) { 6001 options = 0; 6002 if (ANSWER(rdataset) && 6003 rdataset->type != dns_rdatatype_rrsig) 6004 { 6005 isc_result_t tresult; 6006 dns_name_t *noqname = NULL; 6007 tresult = findnoqname( 6008 fctx, message, name, 6009 rdataset->type, &noqname); 6010 if (tresult == ISC_R_SUCCESS && 6011 noqname != NULL) 6012 { 6013 (void)dns_rdataset_addnoqname( 6014 rdataset, noqname); 6015 } 6016 } 6017 if ((fctx->options & DNS_FETCHOPT_PREFETCH) != 6018 0) 6019 { 6020 options = DNS_DBADD_PREFETCH; 6021 } 6022 if ((fctx->options & DNS_FETCHOPT_NOCACHED) != 6023 0) 6024 { 6025 options |= DNS_DBADD_FORCE; 6026 } 6027 addedrdataset = ardataset; 6028 result = dns_db_addrdataset( 6029 fctx->cache, node, NULL, now, rdataset, 6030 options, addedrdataset); 6031 if (result == DNS_R_UNCHANGED) { 6032 result = ISC_R_SUCCESS; 6033 if (!need_validation && 6034 ardataset != NULL && 6035 NEGATIVE(ardataset)) 6036 { 6037 /* 6038 * The answer in the 6039 * cache is better than 6040 * the answer we found, 6041 * and is a negative 6042 * cache entry, so we 6043 * must set eresult 6044 * appropriately. 6045 */ 6046 if (NXDOMAIN(ardataset)) { 6047 eresult = 6048 DNS_R_NCACHENXDOMAIN; 6049 } else { 6050 eresult = 6051 DNS_R_NCACHENXRRSET; 6052 } 6053 /* 6054 * We have a negative 6055 * response from the 6056 * cache so don't 6057 * attempt to add the 6058 * RRSIG rrset. 6059 */ 6060 continue; 6061 } 6062 } 6063 if (result != ISC_R_SUCCESS) { 6064 break; 6065 } 6066 if (sigrdataset != NULL) { 6067 addedrdataset = asigrdataset; 6068 result = dns_db_addrdataset( 6069 fctx->cache, node, NULL, now, 6070 sigrdataset, options, 6071 addedrdataset); 6072 if (result == DNS_R_UNCHANGED) { 6073 result = ISC_R_SUCCESS; 6074 } 6075 if (result != ISC_R_SUCCESS) { 6076 break; 6077 } 6078 } else if (!ANSWER(rdataset)) { 6079 continue; 6080 } 6081 } 6082 6083 if (ANSWER(rdataset) && need_validation) { 6084 if (fctx->type != dns_rdatatype_any && 6085 fctx->type != dns_rdatatype_rrsig && 6086 fctx->type != dns_rdatatype_sig) 6087 { 6088 /* 6089 * This is The Answer. We will 6090 * validate it, but first we 6091 * cache the rest of the 6092 * response - it may contain 6093 * useful keys. 6094 */ 6095 INSIST(valrdataset == NULL && 6096 valsigrdataset == NULL); 6097 valrdataset = rdataset; 6098 valsigrdataset = sigrdataset; 6099 } else { 6100 /* 6101 * This is one of (potentially) 6102 * multiple answers to an ANY 6103 * or SIG query. To keep things 6104 * simple, we just start the 6105 * validator right away rather 6106 * than caching first and 6107 * having to remember which 6108 * rdatasets needed validation. 6109 */ 6110 result = valcreate( 6111 fctx, message, addrinfo, name, 6112 rdataset->type, rdataset, 6113 sigrdataset, valoptions); 6114 } 6115 } else if (CHAINING(rdataset)) { 6116 if (rdataset->type == dns_rdatatype_cname) { 6117 eresult = DNS_R_CNAME; 6118 } else { 6119 INSIST(rdataset->type == 6120 dns_rdatatype_dname); 6121 eresult = DNS_R_DNAME; 6122 } 6123 } 6124 } else if (!EXTERNAL(rdataset)) { 6125 /* 6126 * It's OK to cache this rdataset now. 6127 */ 6128 if (ANSWER(rdataset)) { 6129 addedrdataset = ardataset; 6130 } else if (ANSWERSIG(rdataset)) { 6131 addedrdataset = asigrdataset; 6132 } else { 6133 addedrdataset = NULL; 6134 } 6135 if (CHAINING(rdataset)) { 6136 if (rdataset->type == dns_rdatatype_cname) { 6137 eresult = DNS_R_CNAME; 6138 } else { 6139 INSIST(rdataset->type == 6140 dns_rdatatype_dname); 6141 eresult = DNS_R_DNAME; 6142 } 6143 } 6144 if (rdataset->trust == dns_trust_glue && 6145 (rdataset->type == dns_rdatatype_ns || 6146 (rdataset->type == dns_rdatatype_rrsig && 6147 rdataset->covers == dns_rdatatype_ns))) 6148 { 6149 /* 6150 * If the trust level is 6151 * 'dns_trust_glue' then we are adding 6152 * data from a referral we got while 6153 * executing the search algorithm. New 6154 * referral data always takes precedence 6155 * over the existing cache contents. 6156 */ 6157 options = DNS_DBADD_FORCE; 6158 } else if ((fctx->options & DNS_FETCHOPT_PREFETCH) != 0) 6159 { 6160 options = DNS_DBADD_PREFETCH; 6161 } else { 6162 options = 0; 6163 } 6164 6165 if (ANSWER(rdataset) && 6166 rdataset->type != dns_rdatatype_rrsig) 6167 { 6168 isc_result_t tresult; 6169 dns_name_t *noqname = NULL; 6170 tresult = findnoqname(fctx, message, name, 6171 rdataset->type, &noqname); 6172 if (tresult == ISC_R_SUCCESS && noqname != NULL) 6173 { 6174 (void)dns_rdataset_addnoqname(rdataset, 6175 noqname); 6176 } 6177 } 6178 6179 /* 6180 * Now we can add the rdataset. 6181 */ 6182 result = dns_db_addrdataset(fctx->cache, node, NULL, 6183 now, rdataset, options, 6184 addedrdataset); 6185 6186 if (result == DNS_R_UNCHANGED) { 6187 if (ANSWER(rdataset) && ardataset != NULL && 6188 NEGATIVE(ardataset)) 6189 { 6190 /* 6191 * The answer in the cache is 6192 * better than the answer we 6193 * found, and is a negative 6194 * cache entry, so we must set 6195 * eresult appropriately. 6196 */ 6197 if (NXDOMAIN(ardataset)) { 6198 eresult = DNS_R_NCACHENXDOMAIN; 6199 } else { 6200 eresult = DNS_R_NCACHENXRRSET; 6201 } 6202 } 6203 result = ISC_R_SUCCESS; 6204 } else if (result != ISC_R_SUCCESS) { 6205 break; 6206 } 6207 } 6208 } 6209 6210 if (valrdataset != NULL) { 6211 dns_rdatatype_t vtype = fctx->type; 6212 if (CHAINING(valrdataset)) { 6213 if (valrdataset->type == dns_rdatatype_cname) { 6214 vtype = dns_rdatatype_cname; 6215 } else { 6216 vtype = dns_rdatatype_dname; 6217 } 6218 } 6219 6220 result = valcreate(fctx, message, addrinfo, name, vtype, 6221 valrdataset, valsigrdataset, valoptions); 6222 } 6223 6224 if (result == ISC_R_SUCCESS && have_answer) { 6225 FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER); 6226 if (resp != NULL) { 6227 /* 6228 * Negative results must be indicated in 6229 * resp->result. 6230 */ 6231 if (dns_rdataset_isassociated(resp->rdataset) && 6232 NEGATIVE(resp->rdataset)) 6233 { 6234 INSIST(eresult == DNS_R_NCACHENXDOMAIN || 6235 eresult == DNS_R_NCACHENXRRSET); 6236 } 6237 resp->result = eresult; 6238 if (adbp != NULL && *adbp != NULL) { 6239 if (anodep != NULL && *anodep != NULL) { 6240 dns_db_detachnode(*adbp, anodep); 6241 } 6242 dns_db_detach(adbp); 6243 } 6244 dns_db_attach(fctx->cache, adbp); 6245 dns_db_transfernode(fctx->cache, &node, anodep); 6246 clone_results(fctx); 6247 } 6248 } 6249 6250 if (node != NULL) { 6251 dns_db_detachnode(fctx->cache, &node); 6252 } 6253 6254 return result; 6255 } 6256 6257 static isc_result_t 6258 cache_message(fetchctx_t *fctx, dns_message_t *message, 6259 dns_adbaddrinfo_t *addrinfo, isc_stdtime_t now) { 6260 isc_result_t result; 6261 dns_section_t section; 6262 dns_name_t *name; 6263 6264 FCTXTRACE("cache_message"); 6265 6266 FCTX_ATTR_CLR(fctx, FCTX_ATTR_WANTCACHE); 6267 6268 LOCK(&fctx->lock); 6269 6270 for (section = DNS_SECTION_ANSWER; section <= DNS_SECTION_ADDITIONAL; 6271 section++) 6272 { 6273 result = dns_message_firstname(message, section); 6274 while (result == ISC_R_SUCCESS) { 6275 name = NULL; 6276 dns_message_currentname(message, section, &name); 6277 if (name->attributes.cache) { 6278 result = cache_name(fctx, name, message, 6279 addrinfo, now); 6280 if (result != ISC_R_SUCCESS) { 6281 break; 6282 } 6283 } 6284 result = dns_message_nextname(message, section); 6285 } 6286 if (result != ISC_R_NOMORE) { 6287 break; 6288 } 6289 } 6290 if (result == ISC_R_NOMORE) { 6291 result = ISC_R_SUCCESS; 6292 } 6293 6294 UNLOCK(&fctx->lock); 6295 6296 return result; 6297 } 6298 6299 /* 6300 * Do what dns_ncache_addoptout() does, and then compute an appropriate 6301 * eresult. 6302 */ 6303 static isc_result_t 6304 ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node, 6305 dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl, 6306 dns_ttl_t maxttl, bool optout, bool secure, 6307 dns_rdataset_t *ardataset, isc_result_t *eresultp) { 6308 isc_result_t result; 6309 dns_rdataset_t rdataset; 6310 6311 if (ardataset == NULL) { 6312 dns_rdataset_init(&rdataset); 6313 ardataset = &rdataset; 6314 } 6315 if (secure) { 6316 result = dns_ncache_addoptout(message, cache, node, covers, now, 6317 minttl, maxttl, optout, 6318 ardataset); 6319 } else { 6320 result = dns_ncache_add(message, cache, node, covers, now, 6321 minttl, maxttl, ardataset); 6322 } 6323 if (result == DNS_R_UNCHANGED || result == ISC_R_SUCCESS) { 6324 /* 6325 * If the cache now contains a negative entry and we 6326 * care about whether it is DNS_R_NCACHENXDOMAIN or 6327 * DNS_R_NCACHENXRRSET then extract it. 6328 */ 6329 if (NEGATIVE(ardataset)) { 6330 /* 6331 * The cache data is a negative cache entry. 6332 */ 6333 if (NXDOMAIN(ardataset)) { 6334 *eresultp = DNS_R_NCACHENXDOMAIN; 6335 } else { 6336 *eresultp = DNS_R_NCACHENXRRSET; 6337 } 6338 } else { 6339 /* 6340 * Either we don't care about the nature of the 6341 * cache rdataset (because no fetch is 6342 * interested in the outcome), or the cache 6343 * rdataset is not a negative cache entry. 6344 * Whichever case it is, we can return success. 6345 * 6346 * XXXRTH There's a CNAME/DNAME problem here. 6347 */ 6348 *eresultp = ISC_R_SUCCESS; 6349 } 6350 result = ISC_R_SUCCESS; 6351 } 6352 if (ardataset == &rdataset && dns_rdataset_isassociated(ardataset)) { 6353 dns_rdataset_disassociate(ardataset); 6354 } 6355 6356 return result; 6357 } 6358 6359 static isc_result_t 6360 ncache_message(fetchctx_t *fctx, dns_message_t *message, 6361 dns_adbaddrinfo_t *addrinfo, dns_rdatatype_t covers, 6362 isc_stdtime_t now) { 6363 isc_result_t result, eresult = ISC_R_SUCCESS; 6364 dns_name_t *name = fctx->name; 6365 dns_resolver_t *res = fctx->res; 6366 dns_db_t **adbp = NULL; 6367 dns_dbnode_t *node = NULL, **anodep = NULL; 6368 dns_rdataset_t *ardataset = NULL; 6369 bool need_validation = false, secure_domain = false; 6370 dns_fetchresponse_t *resp = NULL; 6371 uint32_t ttl; 6372 unsigned int valoptions = 0; 6373 bool checknta = true; 6374 6375 FCTXTRACE("ncache_message"); 6376 6377 FCTX_ATTR_CLR(fctx, FCTX_ATTR_WANTNCACHE); 6378 6379 POST(need_validation); 6380 6381 /* 6382 * XXXMPA remove when we follow cnames and adjust the setting 6383 * of FCTX_ATTR_WANTNCACHE in rctx_answer_none(). 6384 */ 6385 INSIST(message->counts[DNS_SECTION_ANSWER] == 0); 6386 6387 /* 6388 * Is DNSSEC validation required for this name? 6389 */ 6390 if ((fctx->options & DNS_FETCHOPT_NONTA) != 0) { 6391 valoptions |= DNS_VALIDATOR_NONTA; 6392 checknta = false; 6393 } 6394 6395 if (fctx->res->view->enablevalidation) { 6396 result = issecuredomain(res->view, name, fctx->type, now, 6397 checknta, NULL, &secure_domain); 6398 if (result != ISC_R_SUCCESS) { 6399 return result; 6400 } 6401 } 6402 6403 if ((fctx->options & DNS_FETCHOPT_NOCDFLAG) != 0) { 6404 valoptions |= DNS_VALIDATOR_NOCDFLAG; 6405 } 6406 6407 if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0) { 6408 need_validation = false; 6409 } else { 6410 need_validation = secure_domain; 6411 } 6412 6413 if (secure_domain) { 6414 /* 6415 * Mark all rdatasets as pending. 6416 */ 6417 result = dns_message_firstname(message, DNS_SECTION_AUTHORITY); 6418 while (result == ISC_R_SUCCESS) { 6419 dns_rdataset_t *trdataset = NULL; 6420 dns_name_t *tname = NULL; 6421 6422 dns_message_currentname(message, DNS_SECTION_AUTHORITY, 6423 &tname); 6424 for (trdataset = ISC_LIST_HEAD(tname->list); 6425 trdataset != NULL; 6426 trdataset = ISC_LIST_NEXT(trdataset, link)) 6427 { 6428 trdataset->trust = dns_trust_pending_answer; 6429 } 6430 result = dns_message_nextname(message, 6431 DNS_SECTION_AUTHORITY); 6432 } 6433 if (result != ISC_R_NOMORE) { 6434 return result; 6435 } 6436 } 6437 6438 if (need_validation) { 6439 /* 6440 * Do negative response validation. 6441 */ 6442 result = valcreate(fctx, message, addrinfo, name, fctx->type, 6443 NULL, NULL, valoptions); 6444 /* 6445 * If validation is necessary, return now. Otherwise 6446 * continue to process the message, letting the 6447 * validation complete in its own good time. 6448 */ 6449 return result; 6450 } 6451 6452 LOCK(&fctx->lock); 6453 6454 if (!HAVE_ANSWER(fctx)) { 6455 resp = ISC_LIST_HEAD(fctx->resps); 6456 if (resp != NULL) { 6457 adbp = &resp->db; 6458 dns_name_copy(name, resp->foundname); 6459 anodep = &resp->node; 6460 ardataset = resp->rdataset; 6461 } 6462 } 6463 6464 result = dns_db_findnode(fctx->cache, name, true, &node); 6465 if (result != ISC_R_SUCCESS) { 6466 goto unlock; 6467 } 6468 6469 /* 6470 * Don't report qname minimisation NXDOMAIN errors 6471 * when the result is NXDOMAIN except we have already 6472 * confirmed a higher error. 6473 */ 6474 if (!fctx->force_qmin_warning && message->rcode == dns_rcode_nxdomain && 6475 (fctx->qmin_warning == DNS_R_NXDOMAIN || 6476 fctx->qmin_warning == DNS_R_NCACHENXDOMAIN)) 6477 { 6478 fctx->qmin_warning = ISC_R_SUCCESS; 6479 } 6480 6481 /* 6482 * If we are asking for a SOA record set the cache time 6483 * to zero to facilitate locating the containing zone of 6484 * a arbitrary zone. 6485 */ 6486 ttl = fctx->res->view->maxncachettl; 6487 if (fctx->type == dns_rdatatype_soa && covers == dns_rdatatype_any && 6488 fctx->res->zero_no_soa_ttl) 6489 { 6490 ttl = 0; 6491 } 6492 6493 result = ncache_adderesult(message, fctx->cache, node, covers, now, 6494 fctx->res->view->minncachettl, ttl, false, 6495 false, ardataset, &eresult); 6496 if (result != ISC_R_SUCCESS) { 6497 goto unlock; 6498 } 6499 6500 if (!HAVE_ANSWER(fctx)) { 6501 FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER); 6502 if (resp != NULL) { 6503 resp->result = eresult; 6504 if (adbp != NULL && *adbp != NULL) { 6505 if (anodep != NULL && *anodep != NULL) { 6506 dns_db_detachnode(*adbp, anodep); 6507 } 6508 dns_db_detach(adbp); 6509 } 6510 dns_db_attach(fctx->cache, adbp); 6511 dns_db_transfernode(fctx->cache, &node, anodep); 6512 clone_results(fctx); 6513 } 6514 } 6515 6516 unlock: 6517 UNLOCK(&fctx->lock); 6518 6519 if (node != NULL) { 6520 dns_db_detachnode(fctx->cache, &node); 6521 } 6522 6523 return result; 6524 } 6525 6526 static void 6527 mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external, 6528 bool gluing) { 6529 name->attributes.cache = true; 6530 if (gluing) { 6531 rdataset->trust = dns_trust_glue; 6532 /* 6533 * Glue with 0 TTL causes problems. We force the TTL to 6534 * 1 second to prevent this. 6535 */ 6536 if (rdataset->ttl == 0) { 6537 rdataset->ttl = 1; 6538 } 6539 } else { 6540 rdataset->trust = dns_trust_additional; 6541 } 6542 /* 6543 * Avoid infinite loops by only marking new rdatasets. 6544 */ 6545 if (!CACHE(rdataset)) { 6546 name->attributes.chase = true; 6547 rdataset->attributes |= DNS_RDATASETATTR_CHASE; 6548 } 6549 rdataset->attributes |= DNS_RDATASETATTR_CACHE; 6550 if (external) { 6551 rdataset->attributes |= DNS_RDATASETATTR_EXTERNAL; 6552 } 6553 } 6554 6555 /* 6556 * Returns true if 'name' is external to the namespace for which 6557 * the server being queried can answer, either because it's not a 6558 * subdomain or because it's below a forward declaration or a 6559 * locally served zone. 6560 */ 6561 static inline bool 6562 name_external(const dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) { 6563 isc_result_t result; 6564 dns_forwarders_t *forwarders = NULL; 6565 dns_name_t *apex = NULL; 6566 dns_name_t suffix; 6567 dns_zone_t *zone = NULL; 6568 unsigned int labels; 6569 dns_namereln_t rel; 6570 6571 apex = (ISDUALSTACK(fctx->addrinfo) || !ISFORWARDER(fctx->addrinfo)) 6572 ? fctx->domain 6573 : fctx->fwdname; 6574 6575 /* 6576 * The name is outside the queried namespace. 6577 */ 6578 rel = dns_name_fullcompare(name, apex, &(int){ 0 }, 6579 &(unsigned int){ 0U }); 6580 if (rel != dns_namereln_subdomain && rel != dns_namereln_equal) { 6581 return true; 6582 } 6583 6584 /* 6585 * If the record lives in the parent zone, adjust the name so we 6586 * look for the correct zone or forward clause. 6587 */ 6588 labels = dns_name_countlabels(name); 6589 if (dns_rdatatype_atparent(type) && labels > 1U) { 6590 dns_name_init(&suffix, NULL); 6591 dns_name_getlabelsequence(name, 1, labels - 1, &suffix); 6592 name = &suffix; 6593 } else if (rel == dns_namereln_equal) { 6594 /* If 'name' is 'apex', no further checking is needed. */ 6595 return false; 6596 } 6597 6598 /* 6599 * If there is a locally served zone between 'apex' and 'name' 6600 * then don't cache. 6601 */ 6602 dns_ztfind_t options = DNS_ZTFIND_NOEXACT | DNS_ZTFIND_MIRROR; 6603 result = dns_view_findzone(fctx->res->view, name, options, &zone); 6604 if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { 6605 dns_name_t *zname = dns_zone_getorigin(zone); 6606 dns_namereln_t reln = dns_name_fullcompare( 6607 zname, apex, &(int){ 0 }, &(unsigned int){ 0U }); 6608 dns_zone_detach(&zone); 6609 if (reln == dns_namereln_subdomain) { 6610 return true; 6611 } 6612 } 6613 6614 /* 6615 * Look for a forward declaration below 'name'. 6616 */ 6617 result = dns_fwdtable_find(fctx->res->view->fwdtable, name, 6618 &forwarders); 6619 6620 if (ISFORWARDER(fctx->addrinfo)) { 6621 /* 6622 * See if the forwarder declaration is better. 6623 */ 6624 if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { 6625 bool better = !dns_name_equal(&forwarders->name, 6626 fctx->fwdname); 6627 dns_forwarders_detach(&forwarders); 6628 return better; 6629 } 6630 6631 /* 6632 * If the lookup failed, the configuration must have 6633 * changed: play it safe and don't cache. 6634 */ 6635 return true; 6636 } else if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { 6637 /* 6638 * If 'name' is covered by a 'forward only' clause then we 6639 * can't cache this response. 6640 */ 6641 bool nocache = (forwarders->fwdpolicy == dns_fwdpolicy_only && 6642 !ISC_LIST_EMPTY(forwarders->fwdrs)); 6643 dns_forwarders_detach(&forwarders); 6644 return nocache; 6645 } 6646 6647 return false; 6648 } 6649 6650 static isc_result_t 6651 check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type, 6652 dns_rdataset_t *found, dns_section_t section) { 6653 respctx_t *rctx = arg; 6654 fetchctx_t *fctx = rctx->fctx; 6655 isc_result_t result; 6656 dns_name_t *name = NULL; 6657 dns_rdataset_t *rdataset = NULL; 6658 bool external; 6659 dns_rdatatype_t rtype; 6660 bool gluing; 6661 6662 REQUIRE(VALID_FCTX(fctx)); 6663 6664 #if CHECK_FOR_GLUE_IN_ANSWER 6665 if (section == DNS_SECTION_ANSWER && type != dns_rdatatype_a) { 6666 return ISC_R_SUCCESS; 6667 } 6668 #endif /* if CHECK_FOR_GLUE_IN_ANSWER */ 6669 6670 gluing = (GLUING(fctx) || (fctx->type == dns_rdatatype_ns && 6671 dns_name_equal(fctx->name, dns_rootname))); 6672 6673 result = dns_message_findname(rctx->query->rmessage, section, addname, 6674 dns_rdatatype_any, 0, &name, NULL); 6675 if (result == ISC_R_SUCCESS) { 6676 external = name_external(name, type, fctx); 6677 if (type == dns_rdatatype_a) { 6678 for (rdataset = ISC_LIST_HEAD(name->list); 6679 rdataset != NULL; 6680 rdataset = ISC_LIST_NEXT(rdataset, link)) 6681 { 6682 if (rdataset->type == dns_rdatatype_rrsig) { 6683 rtype = rdataset->covers; 6684 } else { 6685 rtype = rdataset->type; 6686 } 6687 if (rtype == dns_rdatatype_a || 6688 rtype == dns_rdatatype_aaaa) 6689 { 6690 mark_related(name, rdataset, external, 6691 gluing); 6692 } 6693 } 6694 } else { 6695 result = dns_message_findtype(name, type, 0, &rdataset); 6696 if (result == ISC_R_SUCCESS) { 6697 mark_related(name, rdataset, external, gluing); 6698 if (found != NULL) { 6699 dns_rdataset_clone(rdataset, found); 6700 } 6701 /* 6702 * Do we have its SIG too? 6703 */ 6704 rdataset = NULL; 6705 result = dns_message_findtype( 6706 name, dns_rdatatype_rrsig, type, 6707 &rdataset); 6708 if (result == ISC_R_SUCCESS) { 6709 mark_related(name, rdataset, external, 6710 gluing); 6711 } 6712 } 6713 } 6714 } 6715 6716 return ISC_R_SUCCESS; 6717 } 6718 6719 static isc_result_t 6720 check_related(void *arg, const dns_name_t *addname, dns_rdatatype_t type, 6721 dns_rdataset_t *found DNS__DB_FLARG) { 6722 return check_section(arg, addname, type, found, DNS_SECTION_ADDITIONAL); 6723 } 6724 6725 #ifndef CHECK_FOR_GLUE_IN_ANSWER 6726 #define CHECK_FOR_GLUE_IN_ANSWER 0 6727 #endif /* ifndef CHECK_FOR_GLUE_IN_ANSWER */ 6728 6729 #if CHECK_FOR_GLUE_IN_ANSWER 6730 static isc_result_t 6731 check_answer(void *arg, const dns_name_t *addname, dns_rdatatype_t type, 6732 dns_rdataset_t *found) { 6733 return check_section(arg, addname, type, found, DNS_SECTION_ANSWER); 6734 } 6735 #endif /* if CHECK_FOR_GLUE_IN_ANSWER */ 6736 6737 static bool 6738 is_answeraddress_allowed(dns_view_t *view, dns_name_t *name, 6739 dns_rdataset_t *rdataset) { 6740 isc_result_t result; 6741 dns_rdata_t rdata = DNS_RDATA_INIT; 6742 struct in_addr ina; 6743 struct in6_addr in6a; 6744 isc_netaddr_t netaddr; 6745 char addrbuf[ISC_NETADDR_FORMATSIZE]; 6746 char namebuf[DNS_NAME_FORMATSIZE]; 6747 char classbuf[64]; 6748 char typebuf[64]; 6749 int match; 6750 6751 /* By default, we allow any addresses. */ 6752 if (view->denyansweracl == NULL) { 6753 return true; 6754 } 6755 6756 /* 6757 * If the owner name matches one in the exclusion list, either 6758 * exactly or partially, allow it. 6759 */ 6760 if (dns_nametree_covered(view->answeracl_exclude, name, NULL, 0)) { 6761 return true; 6762 } 6763 6764 /* 6765 * Otherwise, search the filter list for a match for each 6766 * address record. If a match is found, the address should be 6767 * filtered, so should the entire answer. 6768 */ 6769 for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS; 6770 result = dns_rdataset_next(rdataset)) 6771 { 6772 dns_rdata_reset(&rdata); 6773 dns_rdataset_current(rdataset, &rdata); 6774 if (rdataset->type == dns_rdatatype_a) { 6775 INSIST(rdata.length == sizeof(ina.s_addr)); 6776 memmove(&ina.s_addr, rdata.data, sizeof(ina.s_addr)); 6777 isc_netaddr_fromin(&netaddr, &ina); 6778 } else { 6779 INSIST(rdata.length == sizeof(in6a.s6_addr)); 6780 memmove(in6a.s6_addr, rdata.data, sizeof(in6a.s6_addr)); 6781 isc_netaddr_fromin6(&netaddr, &in6a); 6782 } 6783 6784 result = dns_acl_match(&netaddr, NULL, view->denyansweracl, 6785 view->aclenv, &match, NULL); 6786 if (result == ISC_R_SUCCESS && match > 0) { 6787 isc_netaddr_format(&netaddr, addrbuf, sizeof(addrbuf)); 6788 dns_name_format(name, namebuf, sizeof(namebuf)); 6789 dns_rdatatype_format(rdataset->type, typebuf, 6790 sizeof(typebuf)); 6791 dns_rdataclass_format(rdataset->rdclass, classbuf, 6792 sizeof(classbuf)); 6793 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 6794 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 6795 "answer address %s denied for %s/%s/%s", 6796 addrbuf, namebuf, typebuf, classbuf); 6797 return false; 6798 } 6799 } 6800 6801 return true; 6802 } 6803 6804 static bool 6805 is_answertarget_allowed(fetchctx_t *fctx, dns_name_t *qname, dns_name_t *rname, 6806 dns_rdataset_t *rdataset, bool *chainingp) { 6807 isc_result_t result; 6808 dns_name_t *tname = NULL; 6809 dns_rdata_cname_t cname; 6810 dns_rdata_dname_t dname; 6811 dns_view_t *view = fctx->res->view; 6812 dns_rdata_t rdata = DNS_RDATA_INIT; 6813 unsigned int nlabels; 6814 dns_fixedname_t fixed; 6815 dns_name_t prefix; 6816 int order; 6817 6818 REQUIRE(rdataset != NULL); 6819 REQUIRE(rdataset->type == dns_rdatatype_cname || 6820 rdataset->type == dns_rdatatype_dname); 6821 6822 /* 6823 * By default, we allow any target name. 6824 * If newqname != NULL we also need to extract the newqname. 6825 */ 6826 if (chainingp == NULL && view->denyanswernames == NULL) { 6827 return true; 6828 } 6829 6830 result = dns_rdataset_first(rdataset); 6831 RUNTIME_CHECK(result == ISC_R_SUCCESS); 6832 dns_rdataset_current(rdataset, &rdata); 6833 switch (rdataset->type) { 6834 case dns_rdatatype_cname: 6835 result = dns_rdata_tostruct(&rdata, &cname, NULL); 6836 RUNTIME_CHECK(result == ISC_R_SUCCESS); 6837 tname = &cname.cname; 6838 break; 6839 case dns_rdatatype_dname: 6840 if (dns_name_fullcompare(qname, rname, &order, &nlabels) != 6841 dns_namereln_subdomain) 6842 { 6843 return true; 6844 } 6845 result = dns_rdata_tostruct(&rdata, &dname, NULL); 6846 RUNTIME_CHECK(result == ISC_R_SUCCESS); 6847 dns_name_init(&prefix, NULL); 6848 tname = dns_fixedname_initname(&fixed); 6849 nlabels = dns_name_countlabels(rname); 6850 dns_name_split(qname, nlabels, &prefix, NULL); 6851 result = dns_name_concatenate(&prefix, &dname.dname, tname, 6852 NULL); 6853 if (result == DNS_R_NAMETOOLONG) { 6854 SET_IF_NOT_NULL(chainingp, true); 6855 return true; 6856 } 6857 RUNTIME_CHECK(result == ISC_R_SUCCESS); 6858 break; 6859 default: 6860 UNREACHABLE(); 6861 } 6862 6863 SET_IF_NOT_NULL(chainingp, true); 6864 6865 if (view->denyanswernames == NULL) { 6866 return true; 6867 } 6868 6869 /* 6870 * If the owner name matches one in the exclusion list, either 6871 * exactly or partially, allow it. 6872 */ 6873 if (dns_nametree_covered(view->answernames_exclude, qname, NULL, 0)) { 6874 return true; 6875 } 6876 6877 /* 6878 * If the target name is a subdomain of the search domain, allow 6879 * it. 6880 * 6881 * Note that if BIND is configured as a forwarding DNS server, 6882 * the search domain will always match the root domain ("."), so 6883 * we must also check whether forwarding is enabled so that 6884 * filters can be applied; see GL #1574. 6885 */ 6886 if (!fctx->forwarding && dns_name_issubdomain(tname, fctx->domain)) { 6887 return true; 6888 } 6889 6890 /* 6891 * Otherwise, apply filters. 6892 */ 6893 if (dns_nametree_covered(view->denyanswernames, tname, NULL, 0)) { 6894 char qnamebuf[DNS_NAME_FORMATSIZE]; 6895 char tnamebuf[DNS_NAME_FORMATSIZE]; 6896 char classbuf[64]; 6897 char typebuf[64]; 6898 dns_name_format(qname, qnamebuf, sizeof(qnamebuf)); 6899 dns_name_format(tname, tnamebuf, sizeof(tnamebuf)); 6900 dns_rdatatype_format(rdataset->type, typebuf, sizeof(typebuf)); 6901 dns_rdataclass_format(view->rdclass, classbuf, 6902 sizeof(classbuf)); 6903 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 6904 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 6905 "%s target %s denied for %s/%s", typebuf, 6906 tnamebuf, qnamebuf, classbuf); 6907 return false; 6908 } 6909 6910 return true; 6911 } 6912 6913 static void 6914 trim_ns_ttl(fetchctx_t *fctx, dns_name_t *name, dns_rdataset_t *rdataset) { 6915 if (fctx->ns_ttl_ok && rdataset->ttl > fctx->ns_ttl) { 6916 char ns_namebuf[DNS_NAME_FORMATSIZE]; 6917 char namebuf[DNS_NAME_FORMATSIZE]; 6918 char tbuf[DNS_RDATATYPE_FORMATSIZE]; 6919 6920 dns_name_format(name, ns_namebuf, sizeof(ns_namebuf)); 6921 dns_name_format(fctx->name, namebuf, sizeof(namebuf)); 6922 dns_rdatatype_format(fctx->type, tbuf, sizeof(tbuf)); 6923 6924 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 6925 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(10), 6926 "fctx %p: trimming ttl of %s/NS for %s/%s: " 6927 "%u -> %u", 6928 fctx, ns_namebuf, namebuf, tbuf, rdataset->ttl, 6929 fctx->ns_ttl); 6930 rdataset->ttl = fctx->ns_ttl; 6931 } 6932 } 6933 6934 static bool 6935 validinanswer(dns_rdataset_t *rdataset, fetchctx_t *fctx) { 6936 if (rdataset->type == dns_rdatatype_nsec3) { 6937 /* 6938 * NSEC3 records are not allowed to 6939 * appear in the answer section. 6940 */ 6941 log_formerr(fctx, "NSEC3 in answer"); 6942 return false; 6943 } 6944 if (rdataset->type == dns_rdatatype_tkey) { 6945 /* 6946 * TKEY is not a valid record in a 6947 * response to any query we can make. 6948 */ 6949 log_formerr(fctx, "TKEY in answer"); 6950 return false; 6951 } 6952 if (rdataset->rdclass != fctx->res->rdclass) { 6953 log_formerr(fctx, "Mismatched class in answer"); 6954 return false; 6955 } 6956 return true; 6957 } 6958 6959 #if DNS_RESOLVER_TRACE 6960 ISC_REFCOUNT_TRACE_IMPL(fetchctx, fctx_destroy); 6961 #else 6962 ISC_REFCOUNT_IMPL(fetchctx, fctx_destroy); 6963 #endif 6964 6965 static uint32_t 6966 fctx_hash(fetchctx_t *fctx) { 6967 isc_hash32_t hash32; 6968 isc_hash32_init(&hash32); 6969 isc_hash32_hash(&hash32, fctx->name->ndata, fctx->name->length, false); 6970 isc_hash32_hash(&hash32, &fctx->options, sizeof(fctx->options), true); 6971 isc_hash32_hash(&hash32, &fctx->type, sizeof(fctx->type), true); 6972 return isc_hash32_finalize(&hash32); 6973 } 6974 6975 static bool 6976 fctx_match(void *node, const void *key) { 6977 const fetchctx_t *fctx0 = node; 6978 const fetchctx_t *fctx1 = key; 6979 6980 return fctx0->options == fctx1->options && fctx0->type == fctx1->type && 6981 dns_name_equal(fctx0->name, fctx1->name); 6982 } 6983 6984 /* Must be fctx locked */ 6985 static void 6986 release_fctx(fetchctx_t *fctx) { 6987 isc_result_t result; 6988 dns_resolver_t *res = fctx->res; 6989 6990 if (!fctx->hashed) { 6991 return; 6992 } 6993 6994 RWLOCK(&res->fctxs_lock, isc_rwlocktype_write); 6995 result = isc_hashmap_delete(res->fctxs, fctx_hash(fctx), match_ptr, 6996 fctx); 6997 INSIST(result == ISC_R_SUCCESS); 6998 fctx->hashed = false; 6999 RWUNLOCK(&res->fctxs_lock, isc_rwlocktype_write); 7000 } 7001 7002 static void 7003 resume_dslookup(void *arg) { 7004 dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg; 7005 fetchctx_t *fctx = resp->arg; 7006 isc_loop_t *loop = resp->loop; 7007 isc_result_t result; 7008 dns_resolver_t *res = NULL; 7009 dns_rdataset_t *frdataset = NULL, *nsrdataset = NULL; 7010 dns_rdataset_t nameservers; 7011 dns_fixedname_t fixed; 7012 dns_name_t *domain = NULL; 7013 unsigned int n; 7014 dns_fetch_t *fetch = NULL; 7015 7016 REQUIRE(VALID_FCTX(fctx)); 7017 7018 res = fctx->res; 7019 7020 REQUIRE(fctx->tid == isc_tid()); 7021 7022 FCTXTRACE("resume_dslookup"); 7023 7024 if (resp->node != NULL) { 7025 dns_db_detachnode(resp->db, &resp->node); 7026 } 7027 if (resp->db != NULL) { 7028 dns_db_detach(&resp->db); 7029 } 7030 7031 /* Preserve data from resp before freeing it. */ 7032 frdataset = resp->rdataset; /* a.k.a. fctx->nsrrset */ 7033 result = resp->result; 7034 isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp)); 7035 7036 LOCK(&fctx->lock); 7037 if (SHUTTINGDOWN(fctx)) { 7038 result = ISC_R_SHUTTINGDOWN; 7039 } 7040 UNLOCK(&fctx->lock); 7041 7042 fetch = fctx->nsfetch; 7043 fctx->nsfetch = NULL; 7044 7045 FTRACE("resume_dslookup"); 7046 7047 switch (result) { 7048 case ISC_R_SUCCESS: 7049 FCTXTRACE("resuming DS lookup"); 7050 7051 if (dns_rdataset_isassociated(&fctx->nameservers)) { 7052 dns_rdataset_disassociate(&fctx->nameservers); 7053 } 7054 dns_rdataset_clone(frdataset, &fctx->nameservers); 7055 7056 /* 7057 * Disassociate now the NS's are saved. 7058 */ 7059 if (dns_rdataset_isassociated(frdataset)) { 7060 dns_rdataset_disassociate(frdataset); 7061 } 7062 7063 fctx->ns_ttl = fctx->nameservers.ttl; 7064 fctx->ns_ttl_ok = true; 7065 log_ns_ttl(fctx, "resume_dslookup"); 7066 7067 fcount_decr(fctx); 7068 dns_name_copy(fctx->nsname, fctx->domain); 7069 result = fcount_incr(fctx, true); 7070 if (result != ISC_R_SUCCESS) { 7071 goto cleanup; 7072 } 7073 7074 /* Try again. */ 7075 fctx_try(fctx, true); 7076 break; 7077 7078 case ISC_R_SHUTTINGDOWN: 7079 case ISC_R_CANCELED: 7080 /* Don't try anymore. */ 7081 /* Can't be done in cleanup. */ 7082 if (dns_rdataset_isassociated(frdataset)) { 7083 dns_rdataset_disassociate(frdataset); 7084 } 7085 goto cleanup; 7086 7087 default: 7088 /* 7089 * Disassociate for the next dns_resolver_createfetch call. 7090 */ 7091 if (dns_rdataset_isassociated(frdataset)) { 7092 dns_rdataset_disassociate(frdataset); 7093 } 7094 7095 /* 7096 * If the chain of resume_dslookup() invocations managed to 7097 * chop off enough labels from the original DS owner name to 7098 * reach the top of the namespace, no further progress can be 7099 * made. Interrupt the DS chasing process, returning SERVFAIL. 7100 */ 7101 if (dns_name_equal(fctx->nsname, fetch->private->domain)) { 7102 result = DNS_R_SERVFAIL; 7103 goto cleanup; 7104 } 7105 7106 /* Get nameservers from fetch before we destroy it. */ 7107 dns_rdataset_init(&nameservers); 7108 if (dns_rdataset_isassociated(&fetch->private->nameservers)) { 7109 dns_rdataset_clone(&fetch->private->nameservers, 7110 &nameservers); 7111 nsrdataset = &nameservers; 7112 7113 /* Get domain from fetch before we destroy it. */ 7114 domain = dns_fixedname_initname(&fixed); 7115 dns_name_copy(fetch->private->domain, domain); 7116 } 7117 7118 n = dns_name_countlabels(fctx->nsname); 7119 dns_name_getlabelsequence(fctx->nsname, 1, n - 1, fctx->nsname); 7120 7121 FCTXTRACE("continuing to look for parent's NS records"); 7122 7123 fetchctx_ref(fctx); 7124 result = dns_resolver_createfetch( 7125 res, fctx->nsname, dns_rdatatype_ns, domain, nsrdataset, 7126 NULL, NULL, 0, fctx->options, 0, fctx->qc, loop, 7127 resume_dslookup, fctx, &fctx->nsrrset, NULL, 7128 &fctx->nsfetch); 7129 if (result != ISC_R_SUCCESS) { 7130 fetchctx_unref(fctx); 7131 if (result == DNS_R_DUPLICATE) { 7132 result = DNS_R_SERVFAIL; 7133 } 7134 } 7135 7136 if (dns_rdataset_isassociated(&nameservers)) { 7137 dns_rdataset_disassociate(&nameservers); 7138 } 7139 } 7140 7141 cleanup: 7142 dns_resolver_destroyfetch(&fetch); 7143 7144 if (result != ISC_R_SUCCESS) { 7145 /* An error occurred, tear down whole fctx */ 7146 fctx_done_unref(fctx, result); 7147 } 7148 7149 fetchctx_detach(&fctx); 7150 } 7151 7152 static void 7153 checknamessection(dns_message_t *message, dns_section_t section) { 7154 isc_result_t result; 7155 dns_name_t *name; 7156 dns_rdata_t rdata = DNS_RDATA_INIT; 7157 dns_rdataset_t *rdataset; 7158 7159 for (result = dns_message_firstname(message, section); 7160 result == ISC_R_SUCCESS; 7161 result = dns_message_nextname(message, section)) 7162 { 7163 name = NULL; 7164 dns_message_currentname(message, section, &name); 7165 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 7166 rdataset = ISC_LIST_NEXT(rdataset, link)) 7167 { 7168 for (result = dns_rdataset_first(rdataset); 7169 result == ISC_R_SUCCESS; 7170 result = dns_rdataset_next(rdataset)) 7171 { 7172 dns_rdataset_current(rdataset, &rdata); 7173 if (!dns_rdata_checkowner(name, rdata.rdclass, 7174 rdata.type, false) || 7175 !dns_rdata_checknames(&rdata, name, NULL)) 7176 { 7177 rdataset->attributes |= 7178 DNS_RDATASETATTR_CHECKNAMES; 7179 } 7180 dns_rdata_reset(&rdata); 7181 } 7182 } 7183 } 7184 } 7185 7186 static void 7187 checknames(dns_message_t *message) { 7188 checknamessection(message, DNS_SECTION_ANSWER); 7189 checknamessection(message, DNS_SECTION_AUTHORITY); 7190 checknamessection(message, DNS_SECTION_ADDITIONAL); 7191 } 7192 7193 /* 7194 * Log server NSID at log level 'level' 7195 */ 7196 static void 7197 log_nsid(isc_buffer_t *opt, size_t nsid_len, resquery_t *query, int level, 7198 isc_mem_t *mctx) { 7199 static const char hex[17] = "0123456789abcdef"; 7200 char addrbuf[ISC_SOCKADDR_FORMATSIZE]; 7201 size_t buflen; 7202 unsigned char *p, *nsid; 7203 unsigned char *buf = NULL, *pbuf = NULL; 7204 7205 REQUIRE(nsid_len <= UINT16_MAX); 7206 7207 /* Allocate buffer for storing hex version of the NSID */ 7208 buflen = nsid_len * 2 + 1; 7209 buf = isc_mem_get(mctx, buflen); 7210 pbuf = isc_mem_get(mctx, nsid_len + 1); 7211 7212 /* Convert to hex */ 7213 p = buf; 7214 nsid = isc_buffer_current(opt); 7215 for (size_t i = 0; i < nsid_len; i++) { 7216 *p++ = hex[(nsid[i] >> 4) & 0xf]; 7217 *p++ = hex[nsid[i] & 0xf]; 7218 } 7219 *p = '\0'; 7220 7221 /* Make printable version */ 7222 p = pbuf; 7223 for (size_t i = 0; i < nsid_len; i++) { 7224 *p++ = isprint(nsid[i]) ? nsid[i] : '.'; 7225 } 7226 *p = '\0'; 7227 7228 isc_sockaddr_format(&query->addrinfo->sockaddr, addrbuf, 7229 sizeof(addrbuf)); 7230 isc_log_write(dns_lctx, DNS_LOGCATEGORY_NSID, DNS_LOGMODULE_RESOLVER, 7231 level, "received NSID %s (\"%s\") from %s", buf, pbuf, 7232 addrbuf); 7233 7234 isc_mem_put(mctx, pbuf, nsid_len + 1); 7235 isc_mem_put(mctx, buf, buflen); 7236 } 7237 7238 static bool 7239 iscname(dns_message_t *message, dns_name_t *name) { 7240 isc_result_t result; 7241 7242 result = dns_message_findname(message, DNS_SECTION_ANSWER, name, 7243 dns_rdatatype_cname, 0, NULL, NULL); 7244 return result == ISC_R_SUCCESS ? true : false; 7245 } 7246 7247 static bool 7248 betterreferral(respctx_t *rctx) { 7249 isc_result_t result; 7250 dns_name_t *name; 7251 dns_rdataset_t *rdataset; 7252 7253 for (result = dns_message_firstname(rctx->query->rmessage, 7254 DNS_SECTION_AUTHORITY); 7255 result == ISC_R_SUCCESS; 7256 result = dns_message_nextname(rctx->query->rmessage, 7257 DNS_SECTION_AUTHORITY)) 7258 { 7259 name = NULL; 7260 dns_message_currentname(rctx->query->rmessage, 7261 DNS_SECTION_AUTHORITY, &name); 7262 if (!isstrictsubdomain(name, rctx->fctx->domain)) { 7263 continue; 7264 } 7265 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 7266 rdataset = ISC_LIST_NEXT(rdataset, link)) 7267 { 7268 if (rdataset->type == dns_rdatatype_ns) { 7269 return true; 7270 } 7271 } 7272 } 7273 return false; 7274 } 7275 7276 /* 7277 * Handles responses received in response to iterative queries sent by 7278 * resquery_send(). Sets up a response context (respctx_t). 7279 */ 7280 static void 7281 resquery_response(isc_result_t eresult, isc_region_t *region, void *arg) { 7282 isc_result_t result; 7283 resquery_t *query = (resquery_t *)arg; 7284 fetchctx_t *fctx = NULL; 7285 respctx_t *rctx = NULL; 7286 7287 if (eresult == ISC_R_CANCELED) { 7288 return; 7289 } 7290 7291 REQUIRE(VALID_QUERY(query)); 7292 fctx = query->fctx; 7293 REQUIRE(VALID_FCTX(fctx)); 7294 REQUIRE(fctx->tid == isc_tid()); 7295 7296 QTRACE("response"); 7297 7298 if (isc_sockaddr_pf(&query->addrinfo->sockaddr) == PF_INET) { 7299 inc_stats(fctx->res, dns_resstatscounter_responsev4); 7300 } else { 7301 inc_stats(fctx->res, dns_resstatscounter_responsev6); 7302 } 7303 7304 rctx = isc_mem_get(fctx->mctx, sizeof(*rctx)); 7305 rctx_respinit(query, fctx, eresult, region, rctx); 7306 7307 if (eresult == ISC_R_SHUTTINGDOWN || 7308 atomic_load_acquire(&fctx->res->exiting)) 7309 { 7310 result = ISC_R_SHUTTINGDOWN; 7311 FCTXTRACE("resolver shutting down"); 7312 rctx->finish = NULL; 7313 rctx_done(rctx, result); 7314 goto cleanup; 7315 } 7316 7317 result = rctx_timedout(rctx); 7318 if (result == ISC_R_COMPLETE) { 7319 goto cleanup; 7320 } 7321 7322 fctx->addrinfo = query->addrinfo; 7323 fctx->timeout = false; 7324 fctx->timeouts = 0; 7325 7326 /* 7327 * Check whether the dispatcher has failed; if so we're done 7328 */ 7329 result = rctx_dispfail(rctx); 7330 if (result == ISC_R_COMPLETE) { 7331 goto cleanup; 7332 } 7333 7334 if (query->tsig != NULL) { 7335 dns_message_setquerytsig(query->rmessage, query->tsig); 7336 } 7337 7338 if (query->tsigkey != NULL) { 7339 result = dns_message_settsigkey(query->rmessage, 7340 query->tsigkey); 7341 if (result != ISC_R_SUCCESS) { 7342 FCTXTRACE3("unable to set tsig key", result); 7343 rctx_done(rctx, result); 7344 goto cleanup; 7345 } 7346 } 7347 7348 dns_message_setclass(query->rmessage, fctx->res->rdclass); 7349 7350 if ((rctx->retryopts & DNS_FETCHOPT_TCP) == 0) { 7351 if ((rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0) { 7352 dns_adb_setudpsize( 7353 fctx->adb, query->addrinfo, 7354 isc_buffer_usedlength(&rctx->buffer)); 7355 } else { 7356 dns_adb_plainresponse(fctx->adb, query->addrinfo); 7357 } 7358 } 7359 7360 /* 7361 * Parse response message. 7362 */ 7363 result = rctx_parse(rctx); 7364 if (result == ISC_R_COMPLETE) { 7365 goto cleanup; 7366 } 7367 7368 /* 7369 * Log the incoming packet. 7370 */ 7371 rctx_logpacket(rctx); 7372 7373 if (query->rmessage->rdclass != fctx->res->rdclass) { 7374 rctx->resend = true; 7375 FCTXTRACE("bad class"); 7376 rctx_done(rctx, result); 7377 goto cleanup; 7378 } 7379 7380 /* 7381 * Process receive opt record. 7382 */ 7383 rctx->opt = dns_message_getopt(query->rmessage); 7384 if (rctx->opt != NULL) { 7385 rctx_opt(rctx); 7386 } 7387 7388 if (query->rmessage->cc_bad && 7389 (rctx->retryopts & DNS_FETCHOPT_TCP) == 0) 7390 { 7391 /* 7392 * If the COOKIE is bad, assume it is an attack and 7393 * keep listening for a good answer. 7394 */ 7395 rctx->nextitem = true; 7396 if (isc_log_wouldlog(dns_lctx, ISC_LOG_INFO)) { 7397 char addrbuf[ISC_SOCKADDR_FORMATSIZE]; 7398 isc_sockaddr_format(&query->addrinfo->sockaddr, addrbuf, 7399 sizeof(addrbuf)); 7400 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 7401 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 7402 "bad cookie from %s", addrbuf); 7403 } 7404 rctx_done(rctx, result); 7405 goto cleanup; 7406 } 7407 7408 /* 7409 * Is the question the same as the one we asked? 7410 * NOERROR/NXDOMAIN/YXDOMAIN/REFUSED/SERVFAIL/BADCOOKIE must 7411 * have the same question. FORMERR/NOTIMP if they have a 7412 * question section then it must match. 7413 */ 7414 switch (query->rmessage->rcode) { 7415 case dns_rcode_notimp: 7416 case dns_rcode_formerr: 7417 if (query->rmessage->counts[DNS_SECTION_QUESTION] == 0) { 7418 break; 7419 } 7420 FALLTHROUGH; 7421 case dns_rcode_nxrrset: /* Not expected. */ 7422 case dns_rcode_badcookie: 7423 case dns_rcode_noerror: 7424 case dns_rcode_nxdomain: 7425 case dns_rcode_yxdomain: 7426 case dns_rcode_refused: 7427 case dns_rcode_servfail: 7428 default: 7429 result = same_question(fctx, query->rmessage); 7430 if (result != ISC_R_SUCCESS) { 7431 FCTXTRACE3("question section invalid", result); 7432 rctx->nextitem = true; 7433 rctx_done(rctx, result); 7434 goto cleanup; 7435 } 7436 break; 7437 } 7438 7439 if (query->rmessage->tsigkey == NULL && query->rmessage->tsig == NULL && 7440 query->rmessage->sig0 != NULL) 7441 { 7442 /* 7443 * If the message is not TSIG-signed (which has priorty) and is 7444 * SIG(0)-signed (which consumes more resources), then run an 7445 * asynchronous check. 7446 */ 7447 result = dns_message_checksig_async( 7448 query->rmessage, fctx->res->view, fctx->loop, 7449 resquery_response_continue, rctx); 7450 INSIST(result == DNS_R_WAIT); 7451 } else { 7452 /* 7453 * If the message is signed, check the signature. If not, this 7454 * returns success anyway. 7455 */ 7456 result = dns_message_checksig(query->rmessage, fctx->res->view); 7457 resquery_response_continue(rctx, result); 7458 } 7459 7460 return; 7461 7462 cleanup: 7463 isc_mem_putanddetach(&rctx->mctx, rctx, sizeof(*rctx)); 7464 } 7465 7466 static void 7467 resquery_response_continue(void *arg, isc_result_t result) { 7468 respctx_t *rctx = arg; 7469 fetchctx_t *fctx = rctx->fctx; 7470 resquery_t *query = rctx->query; 7471 7472 if (result != ISC_R_SUCCESS) { 7473 FCTXTRACE3("signature check failed", result); 7474 if (result == DNS_R_UNEXPECTEDTSIG || 7475 result == DNS_R_EXPECTEDTSIG) 7476 { 7477 rctx->nextitem = true; 7478 } 7479 rctx_done(rctx, result); 7480 goto cleanup; 7481 } 7482 7483 /* 7484 * The dispatcher should ensure we only get responses with QR 7485 * set. 7486 */ 7487 INSIST((query->rmessage->flags & DNS_MESSAGEFLAG_QR) != 0); 7488 7489 /* 7490 * If we have had a server cookie and don't get one retry over 7491 * TCP. This may be a misconfigured anycast server or an attempt 7492 * to send a spoofed response. Additionally retry over TCP if 7493 * require-cookie is true and we don't have a got client cookie. 7494 * Skip if we have a valid TSIG. 7495 */ 7496 if (dns_message_gettsig(query->rmessage, NULL) == NULL && 7497 !query->rmessage->cc_ok && !query->rmessage->cc_bad && 7498 (rctx->retryopts & DNS_FETCHOPT_TCP) == 0) 7499 { 7500 if (dns_adb_getcookie(query->addrinfo, NULL, 0) > 7501 CLIENT_COOKIE_SIZE) 7502 { 7503 if (isc_log_wouldlog(dns_lctx, ISC_LOG_INFO)) { 7504 char addrbuf[ISC_SOCKADDR_FORMATSIZE]; 7505 isc_sockaddr_format(&query->addrinfo->sockaddr, 7506 addrbuf, sizeof(addrbuf)); 7507 isc_log_write( 7508 dns_lctx, DNS_LOGCATEGORY_RESOLVER, 7509 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, 7510 "missing expected cookie " 7511 "from %s", 7512 addrbuf); 7513 } 7514 rctx->retryopts |= DNS_FETCHOPT_TCP; 7515 rctx->resend = true; 7516 rctx_done(rctx, result); 7517 goto cleanup; 7518 } else if (fctx->res->view->peers != NULL) { 7519 dns_peer_t *peer = NULL; 7520 isc_netaddr_t netaddr; 7521 isc_netaddr_fromsockaddr(&netaddr, 7522 &query->addrinfo->sockaddr); 7523 result = dns_peerlist_peerbyaddr(fctx->res->view->peers, 7524 &netaddr, &peer); 7525 if (result == ISC_R_SUCCESS) { 7526 bool required = false; 7527 result = dns_peer_getrequirecookie(peer, 7528 &required); 7529 if (result == ISC_R_SUCCESS && required) { 7530 if (isc_log_wouldlog(dns_lctx, 7531 ISC_LOG_INFO)) 7532 { 7533 char addrbuf 7534 [ISC_SOCKADDR_FORMATSIZE]; 7535 isc_sockaddr_format( 7536 &query->addrinfo 7537 ->sockaddr, 7538 addrbuf, 7539 sizeof(addrbuf)); 7540 isc_log_write( 7541 dns_lctx, 7542 DNS_LOGCATEGORY_RESOLVER, 7543 DNS_LOGMODULE_RESOLVER, 7544 ISC_LOG_INFO, 7545 "missing required " 7546 "cookie " 7547 "from %s", 7548 addrbuf); 7549 } 7550 rctx->retryopts |= DNS_FETCHOPT_TCP; 7551 rctx->resend = true; 7552 rctx_done(rctx, result); 7553 goto cleanup; 7554 } 7555 } 7556 } 7557 } 7558 7559 rctx_edns(rctx); 7560 7561 /* 7562 * Deal with truncated responses by retrying using TCP. 7563 */ 7564 if ((query->rmessage->flags & DNS_MESSAGEFLAG_TC) != 0) { 7565 rctx->truncated = true; 7566 } 7567 7568 if (rctx->truncated) { 7569 inc_stats(fctx->res, dns_resstatscounter_truncated); 7570 if ((rctx->retryopts & DNS_FETCHOPT_TCP) != 0) { 7571 rctx->broken_server = DNS_R_TRUNCATEDTCP; 7572 rctx->next_server = true; 7573 } else { 7574 rctx->retryopts |= DNS_FETCHOPT_TCP; 7575 rctx->resend = true; 7576 } 7577 FCTXTRACE3("message truncated", result); 7578 rctx_done(rctx, result); 7579 goto cleanup; 7580 } 7581 7582 /* 7583 * Is it a query response? 7584 */ 7585 if (query->rmessage->opcode != dns_opcode_query) { 7586 rctx->broken_server = DNS_R_UNEXPECTEDOPCODE; 7587 rctx->next_server = true; 7588 FCTXTRACE("invalid message opcode"); 7589 rctx_done(rctx, result); 7590 goto cleanup; 7591 } 7592 7593 /* 7594 * Update statistics about erroneous responses. 7595 */ 7596 switch (query->rmessage->rcode) { 7597 case dns_rcode_noerror: 7598 /* no error */ 7599 break; 7600 case dns_rcode_nxdomain: 7601 inc_stats(fctx->res, dns_resstatscounter_nxdomain); 7602 break; 7603 case dns_rcode_servfail: 7604 inc_stats(fctx->res, dns_resstatscounter_servfail); 7605 break; 7606 case dns_rcode_formerr: 7607 inc_stats(fctx->res, dns_resstatscounter_formerr); 7608 break; 7609 case dns_rcode_refused: 7610 inc_stats(fctx->res, dns_resstatscounter_refused); 7611 break; 7612 case dns_rcode_badvers: 7613 inc_stats(fctx->res, dns_resstatscounter_badvers); 7614 break; 7615 case dns_rcode_badcookie: 7616 inc_stats(fctx->res, dns_resstatscounter_badcookie); 7617 break; 7618 default: 7619 inc_stats(fctx->res, dns_resstatscounter_othererror); 7620 break; 7621 } 7622 7623 /* 7624 * Bad server? 7625 */ 7626 result = rctx_badserver(rctx, result); 7627 if (result == ISC_R_COMPLETE) { 7628 goto cleanup; 7629 } 7630 7631 /* 7632 * Lame server? 7633 */ 7634 result = rctx_lameserver(rctx); 7635 if (result == ISC_R_COMPLETE) { 7636 goto cleanup; 7637 } 7638 7639 /* 7640 * Optionally call dns_rdata_checkowner() and 7641 * dns_rdata_checknames() to validate the names in the response 7642 * message. 7643 */ 7644 if ((fctx->res->options & DNS_RESOLVER_CHECKNAMES) != 0) { 7645 checknames(query->rmessage); 7646 } 7647 7648 /* 7649 * Clear cache bits. 7650 */ 7651 FCTX_ATTR_CLR(fctx, (FCTX_ATTR_WANTNCACHE | FCTX_ATTR_WANTCACHE)); 7652 7653 /* 7654 * Did we get any answers? 7655 */ 7656 if (query->rmessage->counts[DNS_SECTION_ANSWER] > 0 && 7657 (query->rmessage->rcode == dns_rcode_noerror || 7658 query->rmessage->rcode == dns_rcode_yxdomain || 7659 query->rmessage->rcode == dns_rcode_nxdomain)) 7660 { 7661 result = rctx_answer(rctx); 7662 if (result == ISC_R_COMPLETE) { 7663 goto cleanup; 7664 } 7665 } else if (query->rmessage->counts[DNS_SECTION_AUTHORITY] > 0 || 7666 query->rmessage->rcode == dns_rcode_noerror || 7667 query->rmessage->rcode == dns_rcode_nxdomain) 7668 { 7669 /* 7670 * This might be an NXDOMAIN, NXRRSET, or referral. 7671 * Call rctx_answer_none() to determine which it is. 7672 */ 7673 result = rctx_answer_none(rctx); 7674 switch (result) { 7675 case ISC_R_SUCCESS: 7676 case DNS_R_CHASEDSSERVERS: 7677 break; 7678 case DNS_R_DELEGATION: 7679 /* 7680 * With NOFOLLOW we want to pass return 7681 * DNS_R_DELEGATION to resume_qmin. 7682 */ 7683 if ((fctx->options & DNS_FETCHOPT_NOFOLLOW) == 0) { 7684 result = ISC_R_SUCCESS; 7685 } 7686 break; 7687 default: 7688 /* 7689 * Something has gone wrong. 7690 */ 7691 if (result == DNS_R_FORMERR) { 7692 rctx->next_server = true; 7693 } 7694 FCTXTRACE3("rctx_answer_none", result); 7695 rctx_done(rctx, result); 7696 goto cleanup; 7697 } 7698 } else { 7699 /* 7700 * The server is insane. 7701 */ 7702 /* XXXRTH Log */ 7703 rctx->broken_server = DNS_R_UNEXPECTEDRCODE; 7704 rctx->next_server = true; 7705 FCTXTRACE("broken server: unexpected rcode"); 7706 rctx_done(rctx, result); 7707 goto cleanup; 7708 } 7709 7710 /* 7711 * Follow additional section data chains. 7712 */ 7713 rctx_additional(rctx); 7714 7715 /* 7716 * Cache the cacheable parts of the message. This may also 7717 * cause work to be queued to the DNSSEC validator. 7718 */ 7719 if (WANTCACHE(fctx)) { 7720 isc_result_t tresult; 7721 tresult = cache_message(fctx, query->rmessage, query->addrinfo, 7722 rctx->now); 7723 if (tresult != ISC_R_SUCCESS) { 7724 FCTXTRACE3("cache_message complete", tresult); 7725 rctx_done(rctx, tresult); 7726 goto cleanup; 7727 } 7728 } 7729 7730 /* 7731 * Negative caching 7732 */ 7733 rctx_ncache(rctx); 7734 7735 FCTXTRACE("resquery_response done"); 7736 rctx_done(rctx, result); 7737 7738 cleanup: 7739 isc_mem_putanddetach(&rctx->mctx, rctx, sizeof(*rctx)); 7740 } 7741 7742 /* 7743 * rctx_respinit(): 7744 * Initialize the response context structure 'rctx' to all zeroes, then 7745 * set the loop, event, query and fctx information from 7746 * resquery_response(). 7747 */ 7748 static void 7749 rctx_respinit(resquery_t *query, fetchctx_t *fctx, isc_result_t result, 7750 isc_region_t *region, respctx_t *rctx) { 7751 *rctx = (respctx_t){ .result = result, 7752 .query = query, 7753 .fctx = fctx, 7754 .broken_type = badns_response, 7755 .retryopts = query->options }; 7756 if (result == ISC_R_SUCCESS) { 7757 REQUIRE(region != NULL); 7758 isc_buffer_init(&rctx->buffer, region->base, region->length); 7759 isc_buffer_add(&rctx->buffer, region->length); 7760 } else { 7761 isc_buffer_initnull(&rctx->buffer); 7762 } 7763 rctx->tnow = isc_time_now(); 7764 rctx->finish = &rctx->tnow; 7765 rctx->now = (isc_stdtime_t)isc_time_seconds(&rctx->tnow); 7766 isc_mem_attach(fctx->mctx, &rctx->mctx); 7767 } 7768 7769 /* 7770 * rctx_answer_init(): 7771 * Clear and reinitialize those portions of 'rctx' that will be needed 7772 * when scanning the answer section of the response message. This can be 7773 * called more than once if scanning needs to be restarted (though 7774 * currently there are no cases in which this occurs). 7775 */ 7776 static void 7777 rctx_answer_init(respctx_t *rctx) { 7778 fetchctx_t *fctx = rctx->fctx; 7779 7780 rctx->aa = ((rctx->query->rmessage->flags & DNS_MESSAGEFLAG_AA) != 0); 7781 if (rctx->aa) { 7782 rctx->trust = dns_trust_authanswer; 7783 } else { 7784 rctx->trust = dns_trust_answer; 7785 } 7786 7787 /* 7788 * There can be multiple RRSIG and SIG records at a name so 7789 * we treat these types as a subset of ANY. 7790 */ 7791 rctx->type = fctx->type; 7792 if (rctx->type == dns_rdatatype_rrsig || 7793 rctx->type == dns_rdatatype_sig) 7794 { 7795 rctx->type = dns_rdatatype_any; 7796 } 7797 7798 /* 7799 * Bigger than any valid DNAME label count. 7800 */ 7801 rctx->dname_labels = dns_name_countlabels(fctx->name); 7802 rctx->domain_labels = dns_name_countlabels(fctx->domain); 7803 7804 rctx->found_type = dns_rdatatype_none; 7805 7806 rctx->aname = NULL; 7807 rctx->ardataset = NULL; 7808 7809 rctx->cname = NULL; 7810 rctx->crdataset = NULL; 7811 7812 rctx->dname = NULL; 7813 rctx->drdataset = NULL; 7814 7815 rctx->ns_name = NULL; 7816 rctx->ns_rdataset = NULL; 7817 7818 rctx->soa_name = NULL; 7819 rctx->ds_name = NULL; 7820 rctx->found_name = NULL; 7821 } 7822 7823 /* 7824 * rctx_dispfail(): 7825 * Handle the case where the dispatcher failed 7826 */ 7827 static isc_result_t 7828 rctx_dispfail(respctx_t *rctx) { 7829 fetchctx_t *fctx = rctx->fctx; 7830 7831 if (rctx->result == ISC_R_SUCCESS) { 7832 return ISC_R_SUCCESS; 7833 } 7834 7835 /* 7836 * There's no hope for this response. 7837 */ 7838 rctx->next_server = true; 7839 7840 /* 7841 * If this is a network failure, the operation is cancelled, 7842 * or the network manager is being shut down, we mark the server 7843 * as bad so that we won't try it for this fetch again. Also 7844 * adjust finish and no_response so that we penalize this 7845 * address in SRTT adjustments later. 7846 */ 7847 switch (rctx->result) { 7848 case ISC_R_EOF: 7849 case ISC_R_HOSTDOWN: 7850 case ISC_R_HOSTUNREACH: 7851 case ISC_R_NETDOWN: 7852 case ISC_R_NETUNREACH: 7853 case ISC_R_CONNREFUSED: 7854 case ISC_R_CONNECTIONRESET: 7855 case ISC_R_INVALIDPROTO: 7856 case ISC_R_CANCELED: 7857 case ISC_R_SHUTTINGDOWN: 7858 rctx->broken_server = rctx->result; 7859 rctx->broken_type = badns_unreachable; 7860 rctx->finish = NULL; 7861 rctx->no_response = true; 7862 break; 7863 default: 7864 break; 7865 } 7866 7867 FCTXTRACE3("dispatcher failure", rctx->result); 7868 rctx_done(rctx, ISC_R_SUCCESS); 7869 return ISC_R_COMPLETE; 7870 } 7871 7872 /* 7873 * rctx_timedout(): 7874 * Handle the case where a dispatch read timed out. 7875 */ 7876 static isc_result_t 7877 rctx_timedout(respctx_t *rctx) { 7878 fetchctx_t *fctx = rctx->fctx; 7879 7880 if (rctx->result == ISC_R_TIMEDOUT) { 7881 isc_time_t now; 7882 7883 inc_stats(fctx->res, dns_resstatscounter_querytimeout); 7884 FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT); 7885 fctx->timeout = true; 7886 fctx->timeouts++; 7887 7888 now = isc_time_now(); 7889 /* netmgr timeouts are accurate to the millisecond */ 7890 if (isc_time_microdiff(&fctx->expires, &now) < US_PER_MS) { 7891 FCTXTRACE("query timed out; stopped trying to make " 7892 "fetch happen"); 7893 } else { 7894 FCTXTRACE("query timed out; trying next server"); 7895 /* try next server */ 7896 rctx->no_response = true; 7897 rctx->finish = NULL; 7898 rctx->next_server = true; 7899 } 7900 7901 rctx_done(rctx, rctx->result); 7902 return ISC_R_COMPLETE; 7903 } 7904 7905 return ISC_R_SUCCESS; 7906 } 7907 7908 /* 7909 * rctx_parse(): 7910 * Parse the response message. 7911 */ 7912 static isc_result_t 7913 rctx_parse(respctx_t *rctx) { 7914 isc_result_t result; 7915 fetchctx_t *fctx = rctx->fctx; 7916 resquery_t *query = rctx->query; 7917 7918 result = dns_message_parse(query->rmessage, &rctx->buffer, 0); 7919 if (result == ISC_R_SUCCESS) { 7920 return ISC_R_SUCCESS; 7921 } 7922 7923 FCTXTRACE3("message failed to parse", result); 7924 7925 switch (result) { 7926 case ISC_R_UNEXPECTEDEND: 7927 if (query->rmessage->question_ok && 7928 (query->rmessage->flags & DNS_MESSAGEFLAG_TC) != 0 && 7929 (rctx->retryopts & DNS_FETCHOPT_TCP) == 0) 7930 { 7931 /* 7932 * We defer retrying via TCP for a bit so we can 7933 * check out this message further. 7934 */ 7935 rctx->truncated = true; 7936 return ISC_R_SUCCESS; 7937 } 7938 7939 /* 7940 * Either the message ended prematurely, 7941 * and/or wasn't marked as being truncated, 7942 * and/or this is a response to a query we 7943 * sent over TCP. In all of these cases, 7944 * something is wrong with the remote 7945 * server and we don't want to retry using 7946 * TCP. 7947 */ 7948 if ((rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0) { 7949 /* 7950 * The problem might be that they 7951 * don't understand EDNS0. Turn it 7952 * off and try again. 7953 */ 7954 rctx->retryopts |= DNS_FETCHOPT_NOEDNS0; 7955 rctx->resend = true; 7956 add_bad_edns(fctx, &query->addrinfo->sockaddr); 7957 inc_stats(fctx->res, dns_resstatscounter_edns0fail); 7958 } else { 7959 rctx->broken_server = result; 7960 rctx->next_server = true; 7961 } 7962 7963 rctx_done(rctx, result); 7964 break; 7965 case DNS_R_FORMERR: 7966 if ((rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0) { 7967 /* 7968 * The problem might be that they 7969 * don't understand EDNS0. Turn it 7970 * off and try again. 7971 */ 7972 rctx->retryopts |= DNS_FETCHOPT_NOEDNS0; 7973 rctx->resend = true; 7974 add_bad_edns(fctx, &query->addrinfo->sockaddr); 7975 inc_stats(fctx->res, dns_resstatscounter_edns0fail); 7976 } else { 7977 rctx->broken_server = DNS_R_UNEXPECTEDRCODE; 7978 rctx->next_server = true; 7979 } 7980 7981 rctx_done(rctx, result); 7982 break; 7983 default: 7984 /* 7985 * Something bad has happened. 7986 */ 7987 rctx_done(rctx, result); 7988 break; 7989 } 7990 7991 return ISC_R_COMPLETE; 7992 } 7993 7994 /* 7995 * rctx_opt(): 7996 * Process the OPT record in the response. 7997 */ 7998 static void 7999 rctx_opt(respctx_t *rctx) { 8000 resquery_t *query = rctx->query; 8001 fetchctx_t *fctx = rctx->fctx; 8002 dns_rdata_t rdata; 8003 isc_buffer_t optbuf; 8004 isc_result_t result; 8005 bool seen_cookie = false; 8006 bool seen_nsid = false; 8007 8008 result = dns_rdataset_first(rctx->opt); 8009 if (result != ISC_R_SUCCESS) { 8010 return; 8011 } 8012 8013 dns_rdata_init(&rdata); 8014 dns_rdataset_current(rctx->opt, &rdata); 8015 isc_buffer_init(&optbuf, rdata.data, rdata.length); 8016 isc_buffer_add(&optbuf, rdata.length); 8017 8018 while (isc_buffer_remaininglength(&optbuf) >= 4) { 8019 uint16_t optcode; 8020 uint16_t optlen; 8021 unsigned char *optvalue; 8022 unsigned char cookie[CLIENT_COOKIE_SIZE]; 8023 optcode = isc_buffer_getuint16(&optbuf); 8024 optlen = isc_buffer_getuint16(&optbuf); 8025 INSIST(optlen <= isc_buffer_remaininglength(&optbuf)); 8026 switch (optcode) { 8027 case DNS_OPT_NSID: 8028 if (seen_nsid) { 8029 break; 8030 } 8031 seen_nsid = true; 8032 8033 if ((query->options & DNS_FETCHOPT_WANTNSID) != 0) { 8034 log_nsid(&optbuf, optlen, query, ISC_LOG_INFO, 8035 fctx->mctx); 8036 } 8037 break; 8038 case DNS_OPT_COOKIE: 8039 /* Only process the first cookie option. */ 8040 if (seen_cookie) { 8041 break; 8042 } 8043 seen_cookie = true; 8044 8045 optvalue = isc_buffer_current(&optbuf); 8046 compute_cc(query, cookie, sizeof(cookie)); 8047 INSIST(query->rmessage->cc_bad == 0 && 8048 query->rmessage->cc_ok == 0); 8049 8050 inc_stats(fctx->res, dns_resstatscounter_cookiein); 8051 8052 if (optlen < CLIENT_COOKIE_SIZE || 8053 memcmp(cookie, optvalue, CLIENT_COOKIE_SIZE) != 0) 8054 { 8055 query->rmessage->cc_bad = 1; 8056 break; 8057 } 8058 8059 /* Cookie OK */ 8060 if (optlen == CLIENT_COOKIE_SIZE) { 8061 query->rmessage->cc_echoed = 1; 8062 } else { 8063 query->rmessage->cc_ok = 1; 8064 inc_stats(fctx->res, 8065 dns_resstatscounter_cookieok); 8066 dns_adb_setcookie(fctx->adb, query->addrinfo, 8067 optvalue, optlen); 8068 } 8069 break; 8070 default: 8071 break; 8072 } 8073 isc_buffer_forward(&optbuf, optlen); 8074 } 8075 INSIST(isc_buffer_remaininglength(&optbuf) == 0U); 8076 } 8077 8078 /* 8079 * rctx_edns(): 8080 * Determine whether the remote server is using EDNS correctly or 8081 * incorrectly and record that information if needed. 8082 */ 8083 static void 8084 rctx_edns(respctx_t *rctx) { 8085 resquery_t *query = rctx->query; 8086 fetchctx_t *fctx = rctx->fctx; 8087 8088 /* 8089 * We have an affirmative response to the query and we have 8090 * previously got a response from this server which indicated 8091 * EDNS may not be supported so we can now cache the lack of 8092 * EDNS support. 8093 */ 8094 if (rctx->opt == NULL && !EDNSOK(query->addrinfo) && 8095 (query->rmessage->rcode == dns_rcode_noerror || 8096 query->rmessage->rcode == dns_rcode_nxdomain || 8097 query->rmessage->rcode == dns_rcode_refused || 8098 query->rmessage->rcode == dns_rcode_yxdomain) && 8099 bad_edns(fctx, &query->addrinfo->sockaddr)) 8100 { 8101 dns_message_logpacket( 8102 query->rmessage, "received packet (bad edns) from", 8103 &query->addrinfo->sockaddr, DNS_LOGCATEGORY_RESOLVER, 8104 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), fctx->mctx); 8105 dns_adb_changeflags(fctx->adb, query->addrinfo, 8106 FCTX_ADDRINFO_NOEDNS0, 8107 FCTX_ADDRINFO_NOEDNS0); 8108 } else if (rctx->opt == NULL && 8109 (query->rmessage->flags & DNS_MESSAGEFLAG_TC) == 0 && 8110 !EDNSOK(query->addrinfo) && 8111 (query->rmessage->rcode == dns_rcode_noerror || 8112 query->rmessage->rcode == dns_rcode_nxdomain) && 8113 (rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0) 8114 { 8115 /* 8116 * We didn't get a OPT record in response to a EDNS 8117 * query. 8118 * 8119 * Old versions of named incorrectly drop the OPT record 8120 * when there is a signed, truncated response so we 8121 * check that TC is not set. 8122 * 8123 * Record that the server is not talking EDNS. While 8124 * this should be safe to do for any rcode we limit it 8125 * to NOERROR and NXDOMAIN. 8126 */ 8127 dns_message_logpacket( 8128 query->rmessage, "received packet (no opt) from", 8129 &query->addrinfo->sockaddr, DNS_LOGCATEGORY_RESOLVER, 8130 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), fctx->mctx); 8131 dns_adb_changeflags(fctx->adb, query->addrinfo, 8132 FCTX_ADDRINFO_NOEDNS0, 8133 FCTX_ADDRINFO_NOEDNS0); 8134 } 8135 8136 /* 8137 * If we get a non error EDNS response record the fact so we 8138 * won't fallback to plain DNS in the future for this server. 8139 */ 8140 if (rctx->opt != NULL && !EDNSOK(query->addrinfo) && 8141 (rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0 && 8142 (query->rmessage->rcode == dns_rcode_noerror || 8143 query->rmessage->rcode == dns_rcode_nxdomain || 8144 query->rmessage->rcode == dns_rcode_refused || 8145 query->rmessage->rcode == dns_rcode_yxdomain)) 8146 { 8147 dns_adb_changeflags(fctx->adb, query->addrinfo, 8148 FCTX_ADDRINFO_EDNSOK, FCTX_ADDRINFO_EDNSOK); 8149 } 8150 } 8151 8152 /* 8153 * rctx_answer(): 8154 * We might have answers, or we might have a malformed delegation with 8155 * records in the answer section. Call rctx_answer_positive() or 8156 * rctx_answer_none() as appropriate. 8157 */ 8158 static isc_result_t 8159 rctx_answer(respctx_t *rctx) { 8160 isc_result_t result; 8161 fetchctx_t *fctx = rctx->fctx; 8162 resquery_t *query = rctx->query; 8163 8164 if ((query->rmessage->flags & DNS_MESSAGEFLAG_AA) != 0 || 8165 ISFORWARDER(query->addrinfo)) 8166 { 8167 result = rctx_answer_positive(rctx); 8168 if (result != ISC_R_SUCCESS) { 8169 FCTXTRACE3("rctx_answer_positive (AA/fwd)", result); 8170 } 8171 } else if (iscname(query->rmessage, fctx->name) && 8172 fctx->type != dns_rdatatype_any && 8173 fctx->type != dns_rdatatype_cname) 8174 { 8175 /* 8176 * A BIND8 server could return a non-authoritative 8177 * answer when a CNAME is followed. We should treat 8178 * it as a valid answer. 8179 */ 8180 result = rctx_answer_positive(rctx); 8181 if (result != ISC_R_SUCCESS) { 8182 FCTXTRACE3("rctx_answer_positive (!ANY/!CNAME)", 8183 result); 8184 } 8185 } else if (fctx->type != dns_rdatatype_ns && !betterreferral(rctx)) { 8186 result = rctx_answer_positive(rctx); 8187 if (result != ISC_R_SUCCESS) { 8188 FCTXTRACE3("rctx_answer_positive (!NS)", result); 8189 } 8190 } else { 8191 /* 8192 * This may be a delegation. First let's check for 8193 */ 8194 8195 if (fctx->type == dns_rdatatype_ns) { 8196 /* 8197 * A BIND 8 server could incorrectly return a 8198 * non-authoritative answer to an NS query 8199 * instead of a referral. Since this answer 8200 * lacks the SIGs necessary to do DNSSEC 8201 * validation, we must invoke the following 8202 * special kludge to treat it as a referral. 8203 */ 8204 rctx->ns_in_answer = true; 8205 result = rctx_answer_none(rctx); 8206 if (result != ISC_R_SUCCESS) { 8207 FCTXTRACE3("rctx_answer_none (NS)", result); 8208 } 8209 } else { 8210 /* 8211 * Some other servers may still somehow include 8212 * an answer when it should return a referral 8213 * with an empty answer. Check to see if we can 8214 * treat this as a referral by ignoring the 8215 * answer. Further more, there may be an 8216 * implementation that moves A/AAAA glue records 8217 * to the answer section for that type of 8218 * delegation when the query is for that glue 8219 * record. glue_in_answer will handle 8220 * such a corner case. 8221 */ 8222 rctx->glue_in_answer = true; 8223 result = rctx_answer_none(rctx); 8224 if (result != ISC_R_SUCCESS) { 8225 FCTXTRACE3("rctx_answer_none", result); 8226 } 8227 } 8228 8229 if (result == DNS_R_DELEGATION) { 8230 /* 8231 * With NOFOLLOW we want to return DNS_R_DELEGATION to 8232 * resume_qmin. 8233 */ 8234 if ((rctx->fctx->options & DNS_FETCHOPT_NOFOLLOW) != 0) 8235 { 8236 return result; 8237 } 8238 result = ISC_R_SUCCESS; 8239 } else { 8240 /* 8241 * At this point, AA is not set, the response 8242 * is not a referral, and the server is not a 8243 * forwarder. It is technically lame and it's 8244 * easier to treat it as such than to figure out 8245 * some more elaborate course of action. 8246 */ 8247 rctx->broken_server = DNS_R_LAME; 8248 rctx->next_server = true; 8249 FCTXTRACE3("rctx_answer lame", result); 8250 rctx_done(rctx, result); 8251 return ISC_R_COMPLETE; 8252 } 8253 } 8254 8255 if (result != ISC_R_SUCCESS) { 8256 if (result == DNS_R_FORMERR) { 8257 rctx->next_server = true; 8258 } 8259 FCTXTRACE3("rctx_answer failed", result); 8260 rctx_done(rctx, result); 8261 return ISC_R_COMPLETE; 8262 } 8263 8264 return ISC_R_SUCCESS; 8265 } 8266 8267 /* 8268 * rctx_answer_positive(): 8269 * Handles positive responses. Depending which type of answer this is 8270 * (matching QNAME/QTYPE, CNAME, DNAME, ANY) calls the proper routine 8271 * to handle it (rctx_answer_match(), rctx_answer_cname(), 8272 * rctx_answer_dname(), rctx_answer_any()). 8273 */ 8274 static isc_result_t 8275 rctx_answer_positive(respctx_t *rctx) { 8276 isc_result_t result; 8277 fetchctx_t *fctx = rctx->fctx; 8278 8279 FCTXTRACE("rctx_answer_positive"); 8280 8281 rctx_answer_init(rctx); 8282 rctx_answer_scan(rctx); 8283 8284 /* 8285 * Determine which type of positive answer this is: 8286 * type ANY, CNAME, DNAME, or an answer matching QNAME/QTYPE. 8287 * Call the appropriate routine to handle the answer type. 8288 */ 8289 if (rctx->aname != NULL && rctx->type == dns_rdatatype_any) { 8290 result = rctx_answer_any(rctx); 8291 if (result == ISC_R_COMPLETE) { 8292 return rctx->result; 8293 } 8294 } else if (rctx->aname != NULL) { 8295 result = rctx_answer_match(rctx); 8296 if (result == ISC_R_COMPLETE) { 8297 return rctx->result; 8298 } 8299 } else if (rctx->cname != NULL) { 8300 result = rctx_answer_cname(rctx); 8301 if (result == ISC_R_COMPLETE) { 8302 return rctx->result; 8303 } 8304 } else if (rctx->dname != NULL) { 8305 result = rctx_answer_dname(rctx); 8306 if (result == ISC_R_COMPLETE) { 8307 return rctx->result; 8308 } 8309 } else { 8310 log_formerr(fctx, "reply has no answer"); 8311 return DNS_R_FORMERR; 8312 } 8313 8314 /* 8315 * This response is now potentially cacheable. 8316 */ 8317 FCTX_ATTR_SET(fctx, FCTX_ATTR_WANTCACHE); 8318 8319 /* 8320 * Did chaining end before we got the final answer? 8321 */ 8322 if (rctx->chaining) { 8323 return ISC_R_SUCCESS; 8324 } 8325 8326 /* 8327 * We didn't end with an incomplete chain, so the rcode should 8328 * be "no error". 8329 */ 8330 if (rctx->query->rmessage->rcode != dns_rcode_noerror) { 8331 log_formerr(fctx, "CNAME/DNAME chain complete, but RCODE " 8332 "indicates error"); 8333 return DNS_R_FORMERR; 8334 } 8335 8336 /* 8337 * Cache records in the authority section, if 8338 * there are any suitable for caching. 8339 */ 8340 rctx_authority_positive(rctx); 8341 8342 log_ns_ttl(fctx, "rctx_answer"); 8343 8344 if (rctx->ns_rdataset != NULL && 8345 dns_name_equal(fctx->domain, rctx->ns_name) && 8346 !dns_name_equal(rctx->ns_name, dns_rootname)) 8347 { 8348 trim_ns_ttl(fctx, rctx->ns_name, rctx->ns_rdataset); 8349 } 8350 8351 return ISC_R_SUCCESS; 8352 } 8353 8354 /* 8355 * rctx_answer_scan(): 8356 * Perform a single pass over the answer section of a response, looking 8357 * for an answer that matches QNAME/QTYPE, or a CNAME matching QNAME, or 8358 * a covering DNAME. If more than one rdataset is found matching these 8359 * criteria, then only one is kept. Order of preference is 1) the 8360 * shortest DNAME, 2) the first matching answer, or 3) the first CNAME. 8361 */ 8362 static void 8363 rctx_answer_scan(respctx_t *rctx) { 8364 isc_result_t result; 8365 fetchctx_t *fctx = rctx->fctx; 8366 dns_rdataset_t *rdataset = NULL; 8367 8368 for (result = dns_message_firstname(rctx->query->rmessage, 8369 DNS_SECTION_ANSWER); 8370 result == ISC_R_SUCCESS; 8371 result = dns_message_nextname(rctx->query->rmessage, 8372 DNS_SECTION_ANSWER)) 8373 { 8374 int order; 8375 unsigned int nlabels; 8376 dns_namereln_t namereln; 8377 dns_name_t *name = NULL; 8378 8379 dns_message_currentname(rctx->query->rmessage, 8380 DNS_SECTION_ANSWER, &name); 8381 namereln = dns_name_fullcompare(fctx->name, name, &order, 8382 &nlabels); 8383 switch (namereln) { 8384 case dns_namereln_equal: 8385 for (rdataset = ISC_LIST_HEAD(name->list); 8386 rdataset != NULL; 8387 rdataset = ISC_LIST_NEXT(rdataset, link)) 8388 { 8389 if (rdataset->type == rctx->type || 8390 rctx->type == dns_rdatatype_any) 8391 { 8392 rctx->aname = name; 8393 if (rctx->type != dns_rdatatype_any) { 8394 rctx->ardataset = rdataset; 8395 } 8396 break; 8397 } 8398 if (rdataset->type == dns_rdatatype_cname) { 8399 rctx->cname = name; 8400 rctx->crdataset = rdataset; 8401 break; 8402 } 8403 } 8404 break; 8405 8406 case dns_namereln_subdomain: 8407 /* 8408 * Don't accept DNAME from parent namespace. 8409 */ 8410 if (name_external(name, dns_rdatatype_dname, fctx)) { 8411 continue; 8412 } 8413 8414 /* 8415 * In-scope DNAME records must have at least 8416 * as many labels as the domain being queried. 8417 * They also must be less that qname's labels 8418 * and any previously found dname. 8419 */ 8420 if (nlabels >= rctx->dname_labels || 8421 nlabels < rctx->domain_labels) 8422 { 8423 continue; 8424 } 8425 8426 /* 8427 * We are looking for the shortest DNAME if 8428 * there are multiple ones (which there 8429 * shouldn't be). 8430 */ 8431 for (rdataset = ISC_LIST_HEAD(name->list); 8432 rdataset != NULL; 8433 rdataset = ISC_LIST_NEXT(rdataset, link)) 8434 { 8435 if (rdataset->type != dns_rdatatype_dname) { 8436 continue; 8437 } 8438 rctx->dname = name; 8439 rctx->drdataset = rdataset; 8440 rctx->dname_labels = nlabels; 8441 break; 8442 } 8443 break; 8444 default: 8445 break; 8446 } 8447 } 8448 8449 /* 8450 * If a DNAME was found, then any CNAME or other answer matching 8451 * QNAME that may also have been found must be ignored. 8452 * Similarly, if a matching answer was found along with a CNAME, 8453 * the CNAME must be ignored. 8454 */ 8455 if (rctx->dname != NULL) { 8456 rctx->aname = NULL; 8457 rctx->ardataset = NULL; 8458 rctx->cname = NULL; 8459 rctx->crdataset = NULL; 8460 } else if (rctx->aname != NULL) { 8461 rctx->cname = NULL; 8462 rctx->crdataset = NULL; 8463 } 8464 } 8465 8466 /* 8467 * rctx_answer_any(): 8468 * Handle responses to queries of type ANY. Scan the answer section, 8469 * and as long as each RRset is of a type that is valid in the answer 8470 * section, and the rdata isn't filtered, cache it. 8471 */ 8472 static isc_result_t 8473 rctx_answer_any(respctx_t *rctx) { 8474 dns_rdataset_t *rdataset = NULL; 8475 fetchctx_t *fctx = rctx->fctx; 8476 8477 for (rdataset = ISC_LIST_HEAD(rctx->aname->list); rdataset != NULL; 8478 rdataset = ISC_LIST_NEXT(rdataset, link)) 8479 { 8480 if (!validinanswer(rdataset, fctx)) { 8481 rctx->result = DNS_R_FORMERR; 8482 return ISC_R_COMPLETE; 8483 } 8484 8485 if ((fctx->type == dns_rdatatype_sig || 8486 fctx->type == dns_rdatatype_rrsig) && 8487 rdataset->type != fctx->type) 8488 { 8489 continue; 8490 } 8491 8492 if ((rdataset->type == dns_rdatatype_a || 8493 rdataset->type == dns_rdatatype_aaaa) && 8494 !is_answeraddress_allowed(fctx->res->view, rctx->aname, 8495 rdataset)) 8496 { 8497 rctx->result = DNS_R_SERVFAIL; 8498 return ISC_R_COMPLETE; 8499 } 8500 8501 if ((rdataset->type == dns_rdatatype_cname || 8502 rdataset->type == dns_rdatatype_dname) && 8503 !is_answertarget_allowed(fctx, fctx->name, rctx->aname, 8504 rdataset, NULL)) 8505 { 8506 rctx->result = DNS_R_SERVFAIL; 8507 return ISC_R_COMPLETE; 8508 } 8509 8510 rctx->aname->attributes.cache = true; 8511 rctx->aname->attributes.answer = true; 8512 rdataset->attributes |= DNS_RDATASETATTR_ANSWER; 8513 rdataset->attributes |= DNS_RDATASETATTR_CACHE; 8514 rdataset->trust = rctx->trust; 8515 8516 (void)dns_rdataset_additionaldata(rdataset, rctx->aname, 8517 check_related, rctx); 8518 } 8519 8520 return ISC_R_SUCCESS; 8521 } 8522 8523 /* 8524 * rctx_answer_match(): 8525 * Handle responses that match the QNAME/QTYPE of the resolver query. 8526 * If QTYPE is valid in the answer section and the rdata isn't filtered, 8527 * the answer can be cached. If there is additional section data related 8528 * to the answer, it can be cached as well. 8529 */ 8530 static isc_result_t 8531 rctx_answer_match(respctx_t *rctx) { 8532 dns_rdataset_t *sigrdataset = NULL; 8533 fetchctx_t *fctx = rctx->fctx; 8534 8535 if (!validinanswer(rctx->ardataset, fctx)) { 8536 rctx->result = DNS_R_FORMERR; 8537 return ISC_R_COMPLETE; 8538 } 8539 8540 if ((rctx->ardataset->type == dns_rdatatype_a || 8541 rctx->ardataset->type == dns_rdatatype_aaaa) && 8542 !is_answeraddress_allowed(fctx->res->view, rctx->aname, 8543 rctx->ardataset)) 8544 { 8545 rctx->result = DNS_R_SERVFAIL; 8546 return ISC_R_COMPLETE; 8547 } 8548 if ((rctx->ardataset->type == dns_rdatatype_cname || 8549 rctx->ardataset->type == dns_rdatatype_dname) && 8550 rctx->type != rctx->ardataset->type && 8551 rctx->type != dns_rdatatype_any && 8552 !is_answertarget_allowed(fctx, fctx->name, rctx->aname, 8553 rctx->ardataset, NULL)) 8554 { 8555 rctx->result = DNS_R_SERVFAIL; 8556 return ISC_R_COMPLETE; 8557 } 8558 8559 rctx->aname->attributes.cache = true; 8560 rctx->aname->attributes.answer = true; 8561 rctx->ardataset->attributes |= DNS_RDATASETATTR_ANSWER; 8562 rctx->ardataset->attributes |= DNS_RDATASETATTR_CACHE; 8563 rctx->ardataset->trust = rctx->trust; 8564 (void)dns_rdataset_additionaldata(rctx->ardataset, rctx->aname, 8565 check_related, rctx); 8566 8567 for (sigrdataset = ISC_LIST_HEAD(rctx->aname->list); 8568 sigrdataset != NULL; 8569 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 8570 { 8571 if (!validinanswer(sigrdataset, fctx)) { 8572 rctx->result = DNS_R_FORMERR; 8573 return ISC_R_COMPLETE; 8574 } 8575 8576 if (sigrdataset->type != dns_rdatatype_rrsig || 8577 sigrdataset->covers != rctx->type) 8578 { 8579 continue; 8580 } 8581 8582 sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG; 8583 sigrdataset->attributes |= DNS_RDATASETATTR_CACHE; 8584 sigrdataset->trust = rctx->trust; 8585 break; 8586 } 8587 8588 return ISC_R_SUCCESS; 8589 } 8590 8591 /* 8592 * rctx_answer_cname(): 8593 * Handle answers containing a CNAME. Cache the CNAME, and flag that 8594 * there may be additional chain answers to find. 8595 */ 8596 static isc_result_t 8597 rctx_answer_cname(respctx_t *rctx) { 8598 dns_rdataset_t *sigrdataset = NULL; 8599 fetchctx_t *fctx = rctx->fctx; 8600 8601 if (!validinanswer(rctx->crdataset, fctx)) { 8602 rctx->result = DNS_R_FORMERR; 8603 return ISC_R_COMPLETE; 8604 } 8605 8606 if (rctx->type == dns_rdatatype_rrsig || 8607 rctx->type == dns_rdatatype_key || rctx->type == dns_rdatatype_nsec) 8608 { 8609 char buf[DNS_RDATATYPE_FORMATSIZE]; 8610 dns_rdatatype_format(rctx->type, buf, sizeof(buf)); 8611 log_formerr(fctx, "CNAME response for %s RR", buf); 8612 rctx->result = DNS_R_FORMERR; 8613 return ISC_R_COMPLETE; 8614 } 8615 8616 if (!is_answertarget_allowed(fctx, fctx->name, rctx->cname, 8617 rctx->crdataset, NULL)) 8618 { 8619 rctx->result = DNS_R_SERVFAIL; 8620 return ISC_R_COMPLETE; 8621 } 8622 8623 rctx->cname->attributes.cache = true; 8624 rctx->cname->attributes.answer = true; 8625 rctx->cname->attributes.chaining = true; 8626 rctx->crdataset->attributes |= DNS_RDATASETATTR_ANSWER; 8627 rctx->crdataset->attributes |= DNS_RDATASETATTR_CACHE; 8628 rctx->crdataset->attributes |= DNS_RDATASETATTR_CHAINING; 8629 rctx->crdataset->trust = rctx->trust; 8630 8631 for (sigrdataset = ISC_LIST_HEAD(rctx->cname->list); 8632 sigrdataset != NULL; 8633 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 8634 { 8635 if (!validinanswer(sigrdataset, fctx)) { 8636 rctx->result = DNS_R_FORMERR; 8637 return ISC_R_COMPLETE; 8638 } 8639 8640 if (sigrdataset->type != dns_rdatatype_rrsig || 8641 sigrdataset->covers != dns_rdatatype_cname) 8642 { 8643 continue; 8644 } 8645 8646 sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG; 8647 sigrdataset->attributes |= DNS_RDATASETATTR_CACHE; 8648 sigrdataset->trust = rctx->trust; 8649 break; 8650 } 8651 8652 rctx->chaining = true; 8653 return ISC_R_SUCCESS; 8654 } 8655 8656 /* 8657 * rctx_answer_dname(): 8658 * Handle responses with covering DNAME records. 8659 */ 8660 static isc_result_t 8661 rctx_answer_dname(respctx_t *rctx) { 8662 dns_rdataset_t *sigrdataset = NULL; 8663 fetchctx_t *fctx = rctx->fctx; 8664 8665 if (!validinanswer(rctx->drdataset, fctx)) { 8666 rctx->result = DNS_R_FORMERR; 8667 return ISC_R_COMPLETE; 8668 } 8669 8670 if (!is_answertarget_allowed(fctx, fctx->name, rctx->dname, 8671 rctx->drdataset, &rctx->chaining)) 8672 { 8673 rctx->result = DNS_R_SERVFAIL; 8674 return ISC_R_COMPLETE; 8675 } 8676 8677 rctx->dname->attributes.cache = true; 8678 rctx->dname->attributes.answer = true; 8679 rctx->dname->attributes.chaining = true; 8680 rctx->drdataset->attributes |= DNS_RDATASETATTR_ANSWER; 8681 rctx->drdataset->attributes |= DNS_RDATASETATTR_CACHE; 8682 rctx->drdataset->attributes |= DNS_RDATASETATTR_CHAINING; 8683 rctx->drdataset->trust = rctx->trust; 8684 8685 for (sigrdataset = ISC_LIST_HEAD(rctx->dname->list); 8686 sigrdataset != NULL; 8687 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) 8688 { 8689 if (!validinanswer(sigrdataset, fctx)) { 8690 rctx->result = DNS_R_FORMERR; 8691 return ISC_R_COMPLETE; 8692 } 8693 8694 if (sigrdataset->type != dns_rdatatype_rrsig || 8695 sigrdataset->covers != dns_rdatatype_dname) 8696 { 8697 continue; 8698 } 8699 8700 sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG; 8701 sigrdataset->attributes |= DNS_RDATASETATTR_CACHE; 8702 sigrdataset->trust = rctx->trust; 8703 break; 8704 } 8705 8706 return ISC_R_SUCCESS; 8707 } 8708 8709 /* 8710 * rctx_authority_positive(): 8711 * Examine the records in the authority section (if there are any) for a 8712 * positive answer. We expect the names for all rdatasets in this 8713 * section to be subdomains of the domain being queried; any that are 8714 * not are skipped. We expect to find only *one* owner name; any names 8715 * after the first one processed are ignored. We expect to find only 8716 * rdatasets of type NS, RRSIG, or SIG; all others are ignored. Whatever 8717 * remains can be cached at trust level authauthority or additional 8718 * (depending on whether the AA bit was set on the answer). 8719 */ 8720 static void 8721 rctx_authority_positive(respctx_t *rctx) { 8722 fetchctx_t *fctx = rctx->fctx; 8723 bool done = false; 8724 isc_result_t result; 8725 8726 result = dns_message_firstname(rctx->query->rmessage, 8727 DNS_SECTION_AUTHORITY); 8728 while (!done && result == ISC_R_SUCCESS) { 8729 dns_name_t *name = NULL; 8730 8731 dns_message_currentname(rctx->query->rmessage, 8732 DNS_SECTION_AUTHORITY, &name); 8733 8734 if (!name_external(name, dns_rdatatype_ns, fctx)) { 8735 dns_rdataset_t *rdataset = NULL; 8736 8737 /* 8738 * We expect to find NS or SIG NS rdatasets, and 8739 * nothing else. 8740 */ 8741 for (rdataset = ISC_LIST_HEAD(name->list); 8742 rdataset != NULL; 8743 rdataset = ISC_LIST_NEXT(rdataset, link)) 8744 { 8745 if (rdataset->type == dns_rdatatype_ns || 8746 (rdataset->type == dns_rdatatype_rrsig && 8747 rdataset->covers == dns_rdatatype_ns)) 8748 { 8749 name->attributes.cache = true; 8750 rdataset->attributes |= 8751 DNS_RDATASETATTR_CACHE; 8752 8753 if (rctx->aa) { 8754 rdataset->trust = 8755 dns_trust_authauthority; 8756 } else { 8757 rdataset->trust = 8758 dns_trust_additional; 8759 } 8760 8761 if (rdataset->type == dns_rdatatype_ns) 8762 { 8763 rctx->ns_name = name; 8764 rctx->ns_rdataset = rdataset; 8765 } 8766 /* 8767 * Mark any additional data 8768 * related to this rdataset. 8769 */ 8770 (void)dns_rdataset_additionaldata( 8771 rdataset, name, check_related, 8772 rctx); 8773 done = true; 8774 } 8775 } 8776 } 8777 8778 result = dns_message_nextname(rctx->query->rmessage, 8779 DNS_SECTION_AUTHORITY); 8780 } 8781 } 8782 8783 /* 8784 * rctx_answer_none(): 8785 * Handles a response without an answer: this is either a negative 8786 * response (NXDOMAIN or NXRRSET) or a referral. Determine which it is, 8787 * then either scan the authority section for negative caching and 8788 * DNSSEC proof of nonexistence, or else call rctx_referral(). 8789 */ 8790 static isc_result_t 8791 rctx_answer_none(respctx_t *rctx) { 8792 isc_result_t result; 8793 fetchctx_t *fctx = rctx->fctx; 8794 8795 FCTXTRACE("rctx_answer_none"); 8796 8797 rctx_answer_init(rctx); 8798 8799 /* 8800 * Sometimes we can tell if its a negative response by looking 8801 * at the message header. 8802 */ 8803 if (rctx->query->rmessage->rcode == dns_rcode_nxdomain || 8804 (rctx->query->rmessage->counts[DNS_SECTION_ANSWER] == 0 && 8805 rctx->query->rmessage->counts[DNS_SECTION_AUTHORITY] == 0)) 8806 { 8807 rctx->negative = true; 8808 } 8809 8810 /* 8811 * Process the authority section 8812 */ 8813 result = rctx_authority_negative(rctx); 8814 if (result == ISC_R_COMPLETE) { 8815 return rctx->result; 8816 } 8817 8818 log_ns_ttl(fctx, "rctx_answer_none"); 8819 8820 if (rctx->ns_rdataset != NULL && 8821 dns_name_equal(fctx->domain, rctx->ns_name) && 8822 !dns_name_equal(rctx->ns_name, dns_rootname)) 8823 { 8824 trim_ns_ttl(fctx, rctx->ns_name, rctx->ns_rdataset); 8825 } 8826 8827 /* 8828 * A negative response has a SOA record (Type 2) 8829 * and a optional NS RRset (Type 1) or it has neither 8830 * a SOA or a NS RRset (Type 3, handled above) or 8831 * rcode is NXDOMAIN (handled above) in which case 8832 * the NS RRset is allowed (Type 4). 8833 */ 8834 if (rctx->soa_name != NULL) { 8835 rctx->negative = true; 8836 } 8837 8838 if (!rctx->ns_in_answer && !rctx->glue_in_answer) { 8839 /* 8840 * Process DNSSEC records in the authority section. 8841 */ 8842 result = rctx_authority_dnssec(rctx); 8843 if (result == ISC_R_COMPLETE) { 8844 return rctx->result; 8845 } 8846 } 8847 8848 /* 8849 * Trigger lookups for DNS nameservers. 8850 */ 8851 if (rctx->negative && 8852 rctx->query->rmessage->rcode == dns_rcode_noerror && 8853 fctx->type == dns_rdatatype_ds && rctx->soa_name != NULL && 8854 dns_name_equal(rctx->soa_name, fctx->name) && 8855 !dns_name_equal(fctx->name, dns_rootname)) 8856 { 8857 return DNS_R_CHASEDSSERVERS; 8858 } 8859 8860 /* 8861 * Did we find anything? 8862 */ 8863 if (!rctx->negative && rctx->ns_name == NULL) { 8864 /* 8865 * The responder is insane. 8866 */ 8867 if (rctx->found_name == NULL) { 8868 log_formerr(fctx, "invalid response"); 8869 return DNS_R_FORMERR; 8870 } 8871 if (!dns_name_issubdomain(rctx->found_name, fctx->domain)) { 8872 char nbuf[DNS_NAME_FORMATSIZE]; 8873 char dbuf[DNS_NAME_FORMATSIZE]; 8874 char tbuf[DNS_RDATATYPE_FORMATSIZE]; 8875 8876 dns_rdatatype_format(rctx->found_type, tbuf, 8877 sizeof(tbuf)); 8878 dns_name_format(rctx->found_name, nbuf, sizeof(nbuf)); 8879 dns_name_format(fctx->domain, dbuf, sizeof(dbuf)); 8880 8881 log_formerr(fctx, 8882 "Name %s (%s) not subdomain" 8883 " of zone %s -- invalid response", 8884 nbuf, tbuf, dbuf); 8885 } else { 8886 log_formerr(fctx, "invalid response"); 8887 } 8888 return DNS_R_FORMERR; 8889 } 8890 8891 /* 8892 * If we found both NS and SOA, they should be the same name. 8893 */ 8894 if (rctx->ns_name != NULL && rctx->soa_name != NULL && 8895 rctx->ns_name != rctx->soa_name) 8896 { 8897 log_formerr(fctx, "NS/SOA mismatch"); 8898 return DNS_R_FORMERR; 8899 } 8900 8901 /* 8902 * Handle a referral. 8903 */ 8904 result = rctx_referral(rctx); 8905 if (result == ISC_R_COMPLETE) { 8906 return rctx->result; 8907 } 8908 8909 /* 8910 * Since we're not doing a referral, we don't want to cache any 8911 * NS RRs we may have found. 8912 */ 8913 if (rctx->ns_name != NULL) { 8914 rctx->ns_name->attributes.cache = false; 8915 } 8916 8917 if (rctx->negative) { 8918 FCTX_ATTR_SET(fctx, FCTX_ATTR_WANTNCACHE); 8919 } 8920 8921 return ISC_R_SUCCESS; 8922 } 8923 8924 /* 8925 * rctx_authority_negative(): 8926 * Scan the authority section of a negative answer, handling 8927 * NS and SOA records. (Note that this function does *not* handle 8928 * DNSSEC records; those are addressed separately in 8929 * rctx_authority_dnssec() below.) 8930 */ 8931 static isc_result_t 8932 rctx_authority_negative(respctx_t *rctx) { 8933 isc_result_t result; 8934 fetchctx_t *fctx = rctx->fctx; 8935 dns_section_t section; 8936 dns_rdataset_t *rdataset = NULL; 8937 bool finished = false; 8938 8939 if (rctx->ns_in_answer) { 8940 INSIST(fctx->type == dns_rdatatype_ns); 8941 section = DNS_SECTION_ANSWER; 8942 } else { 8943 section = DNS_SECTION_AUTHORITY; 8944 } 8945 8946 result = dns_message_firstname(rctx->query->rmessage, section); 8947 if (result != ISC_R_SUCCESS) { 8948 return ISC_R_SUCCESS; 8949 } 8950 8951 while (!finished) { 8952 dns_name_t *name = NULL; 8953 8954 dns_message_currentname(rctx->query->rmessage, section, &name); 8955 result = dns_message_nextname(rctx->query->rmessage, section); 8956 if (result != ISC_R_SUCCESS) { 8957 finished = true; 8958 } 8959 8960 if (!dns_name_issubdomain(name, fctx->domain)) { 8961 continue; 8962 } 8963 8964 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 8965 rdataset = ISC_LIST_NEXT(rdataset, link)) 8966 { 8967 dns_rdatatype_t type = rdataset->type; 8968 if (type == dns_rdatatype_rrsig) { 8969 type = rdataset->covers; 8970 } 8971 if ((type == dns_rdatatype_ns || 8972 type == dns_rdatatype_soa) && 8973 !dns_name_issubdomain(fctx->name, name)) 8974 { 8975 char qbuf[DNS_NAME_FORMATSIZE]; 8976 char nbuf[DNS_NAME_FORMATSIZE]; 8977 char tbuf[DNS_RDATATYPE_FORMATSIZE]; 8978 dns_rdatatype_format(type, tbuf, sizeof(tbuf)); 8979 dns_name_format(name, nbuf, sizeof(nbuf)); 8980 dns_name_format(fctx->name, qbuf, sizeof(qbuf)); 8981 log_formerr(fctx, 8982 "unrelated %s %s in " 8983 "%s authority section", 8984 tbuf, nbuf, qbuf); 8985 break; 8986 } 8987 8988 switch (type) { 8989 case dns_rdatatype_ns: 8990 /* 8991 * NS or RRSIG NS. 8992 * 8993 * Only one set of NS RRs is allowed. 8994 */ 8995 if (rdataset->type == dns_rdatatype_ns) { 8996 if (rctx->ns_name != NULL && 8997 name != rctx->ns_name) 8998 { 8999 log_formerr(fctx, "multiple NS " 9000 "RRsets " 9001 "in " 9002 "authority " 9003 "section"); 9004 rctx->result = DNS_R_FORMERR; 9005 return ISC_R_COMPLETE; 9006 } 9007 rctx->ns_name = name; 9008 rctx->ns_rdataset = rdataset; 9009 } 9010 name->attributes.cache = true; 9011 rdataset->attributes |= DNS_RDATASETATTR_CACHE; 9012 rdataset->trust = dns_trust_glue; 9013 break; 9014 case dns_rdatatype_soa: 9015 /* 9016 * SOA, or RRSIG SOA. 9017 * 9018 * Only one SOA is allowed. 9019 */ 9020 if (rdataset->type == dns_rdatatype_soa) { 9021 if (rctx->soa_name != NULL && 9022 name != rctx->soa_name) 9023 { 9024 log_formerr(fctx, "multiple " 9025 "SOA RRs " 9026 "in " 9027 "authority " 9028 "section"); 9029 rctx->result = DNS_R_FORMERR; 9030 return ISC_R_COMPLETE; 9031 } 9032 rctx->soa_name = name; 9033 } 9034 name->attributes.ncache = true; 9035 rdataset->attributes |= DNS_RDATASETATTR_NCACHE; 9036 if (rctx->aa) { 9037 rdataset->trust = 9038 dns_trust_authauthority; 9039 } else if (ISFORWARDER(fctx->addrinfo)) { 9040 rdataset->trust = dns_trust_answer; 9041 } else { 9042 rdataset->trust = dns_trust_additional; 9043 } 9044 break; 9045 default: 9046 continue; 9047 } 9048 } 9049 } 9050 9051 return ISC_R_SUCCESS; 9052 } 9053 9054 /* 9055 * rctx_ncache(): 9056 * Cache the negatively cacheable parts of the message. This may 9057 * also cause work to be queued to the DNSSEC validator. 9058 */ 9059 static void 9060 rctx_ncache(respctx_t *rctx) { 9061 isc_result_t result; 9062 dns_rdatatype_t covers; 9063 fetchctx_t *fctx = rctx->fctx; 9064 9065 if (!WANTNCACHE(fctx)) { 9066 return; 9067 } 9068 9069 /* 9070 * Cache DS NXDOMAIN separately to other types. 9071 */ 9072 if (rctx->query->rmessage->rcode == dns_rcode_nxdomain && 9073 fctx->type != dns_rdatatype_ds) 9074 { 9075 covers = dns_rdatatype_any; 9076 } else { 9077 covers = fctx->type; 9078 } 9079 9080 /* 9081 * Cache any negative cache entries in the message. 9082 */ 9083 result = ncache_message(fctx, rctx->query->rmessage, 9084 rctx->query->addrinfo, covers, rctx->now); 9085 if (result != ISC_R_SUCCESS) { 9086 FCTXTRACE3("ncache_message complete", result); 9087 } 9088 } 9089 9090 /* 9091 * rctx_authority_dnssec(): 9092 * 9093 * Scan the authority section of a negative answer or referral, 9094 * handling DNSSEC records (i.e. NSEC, NSEC3, DS). 9095 */ 9096 static isc_result_t 9097 rctx_authority_dnssec(respctx_t *rctx) { 9098 isc_result_t result; 9099 fetchctx_t *fctx = rctx->fctx; 9100 dns_rdataset_t *rdataset = NULL; 9101 bool finished = false; 9102 9103 REQUIRE(!rctx->ns_in_answer && !rctx->glue_in_answer); 9104 9105 result = dns_message_firstname(rctx->query->rmessage, 9106 DNS_SECTION_AUTHORITY); 9107 if (result != ISC_R_SUCCESS) { 9108 return ISC_R_SUCCESS; 9109 } 9110 9111 while (!finished) { 9112 dns_name_t *name = NULL; 9113 9114 dns_message_currentname(rctx->query->rmessage, 9115 DNS_SECTION_AUTHORITY, &name); 9116 result = dns_message_nextname(rctx->query->rmessage, 9117 DNS_SECTION_AUTHORITY); 9118 if (result != ISC_R_SUCCESS) { 9119 finished = true; 9120 } 9121 9122 if (!dns_name_issubdomain(name, fctx->domain)) { 9123 /* 9124 * Invalid name found; preserve it for logging 9125 * later. 9126 */ 9127 rctx->found_name = name; 9128 rctx->found_type = ISC_LIST_HEAD(name->list)->type; 9129 continue; 9130 } 9131 9132 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 9133 rdataset = ISC_LIST_NEXT(rdataset, link)) 9134 { 9135 bool checknta = true; 9136 bool secure_domain = false; 9137 dns_rdatatype_t type = rdataset->type; 9138 9139 if (type == dns_rdatatype_rrsig) { 9140 type = rdataset->covers; 9141 } 9142 9143 switch (type) { 9144 case dns_rdatatype_nsec: 9145 case dns_rdatatype_nsec3: 9146 if (rctx->negative) { 9147 name->attributes.ncache = true; 9148 rdataset->attributes |= 9149 DNS_RDATASETATTR_NCACHE; 9150 } else if (type == dns_rdatatype_nsec) { 9151 name->attributes.cache = true; 9152 rdataset->attributes |= 9153 DNS_RDATASETATTR_CACHE; 9154 } 9155 9156 if (rctx->aa) { 9157 rdataset->trust = 9158 dns_trust_authauthority; 9159 } else if (ISFORWARDER(fctx->addrinfo)) { 9160 rdataset->trust = dns_trust_answer; 9161 } else { 9162 rdataset->trust = dns_trust_additional; 9163 } 9164 /* 9165 * No additional data needs to be 9166 * marked. 9167 */ 9168 break; 9169 case dns_rdatatype_ds: 9170 /* 9171 * DS or SIG DS. 9172 * 9173 * These should only be here if this is 9174 * a referral, and there should only be 9175 * one DS RRset. 9176 */ 9177 if (rctx->ns_name == NULL) { 9178 log_formerr(fctx, "DS with no " 9179 "referral"); 9180 rctx->result = DNS_R_FORMERR; 9181 return ISC_R_COMPLETE; 9182 } 9183 9184 if (rdataset->type == dns_rdatatype_ds) { 9185 if (rctx->ds_name != NULL && 9186 name != rctx->ds_name) 9187 { 9188 log_formerr(fctx, "DS doesn't " 9189 "match " 9190 "referral " 9191 "(NS)"); 9192 rctx->result = DNS_R_FORMERR; 9193 return ISC_R_COMPLETE; 9194 } 9195 rctx->ds_name = name; 9196 } 9197 9198 name->attributes.cache = true; 9199 rdataset->attributes |= DNS_RDATASETATTR_CACHE; 9200 9201 if ((fctx->options & DNS_FETCHOPT_NONTA) != 0) { 9202 checknta = false; 9203 } 9204 if (fctx->res->view->enablevalidation) { 9205 result = issecuredomain( 9206 fctx->res->view, name, 9207 dns_rdatatype_ds, fctx->now, 9208 checknta, NULL, &secure_domain); 9209 if (result != ISC_R_SUCCESS) { 9210 return result; 9211 } 9212 } 9213 if (secure_domain) { 9214 rdataset->trust = 9215 dns_trust_pending_answer; 9216 } else if (rctx->aa) { 9217 rdataset->trust = 9218 dns_trust_authauthority; 9219 } else if (ISFORWARDER(fctx->addrinfo)) { 9220 rdataset->trust = dns_trust_answer; 9221 } else { 9222 rdataset->trust = dns_trust_additional; 9223 } 9224 break; 9225 default: 9226 continue; 9227 } 9228 } 9229 } 9230 9231 return ISC_R_SUCCESS; 9232 } 9233 9234 /* 9235 * rctx_referral(): 9236 * Handles referral responses. Check for sanity, find glue as needed, 9237 * and update the fetch context to follow the delegation. 9238 */ 9239 static isc_result_t 9240 rctx_referral(respctx_t *rctx) { 9241 isc_result_t result; 9242 fetchctx_t *fctx = rctx->fctx; 9243 9244 if (rctx->negative || rctx->ns_name == NULL) { 9245 return ISC_R_SUCCESS; 9246 } 9247 9248 /* 9249 * We already know ns_name is a subdomain of fctx->domain. 9250 * If ns_name is equal to fctx->domain, we're not making 9251 * progress. We return DNS_R_FORMERR so that we'll keep 9252 * trying other servers. 9253 */ 9254 if (dns_name_equal(rctx->ns_name, fctx->domain)) { 9255 log_formerr(fctx, "non-improving referral"); 9256 rctx->result = DNS_R_FORMERR; 9257 return ISC_R_COMPLETE; 9258 } 9259 9260 /* 9261 * If the referral name is not a parent of the query 9262 * name, consider the responder insane. 9263 */ 9264 if (!dns_name_issubdomain(fctx->name, rctx->ns_name)) { 9265 /* Logged twice */ 9266 log_formerr(fctx, "referral to non-parent"); 9267 FCTXTRACE("referral to non-parent"); 9268 rctx->result = DNS_R_FORMERR; 9269 return ISC_R_COMPLETE; 9270 } 9271 9272 /* 9273 * Mark any additional data related to this rdataset. 9274 * It's important that we do this before we change the 9275 * query domain. 9276 */ 9277 INSIST(rctx->ns_rdataset != NULL); 9278 FCTX_ATTR_SET(fctx, FCTX_ATTR_GLUING); 9279 (void)dns_rdataset_additionaldata(rctx->ns_rdataset, rctx->ns_name, 9280 check_related, rctx); 9281 #if CHECK_FOR_GLUE_IN_ANSWER 9282 /* 9283 * Look in the answer section for "glue" that is incorrectly 9284 * returned as a answer. This is needed if the server also 9285 * minimizes the response size by not adding records to the 9286 * additional section that are in the answer section or if 9287 * the record gets dropped due to message size constraints. 9288 */ 9289 if (rctx->glue_in_answer && 9290 (fctx->type == dns_rdatatype_aaaa || fctx->type == dns_rdatatype_a)) 9291 { 9292 (void)dns_rdataset_additionaldata( 9293 rctx->ns_rdataset, rctx->ns_name, check_answer, fctx); 9294 } 9295 #endif /* if CHECK_FOR_GLUE_IN_ANSWER */ 9296 FCTX_ATTR_CLR(fctx, FCTX_ATTR_GLUING); 9297 9298 /* 9299 * NS rdatasets with 0 TTL cause problems. 9300 * dns_view_findzonecut() will not find them when we 9301 * try to follow the referral, and we'll SERVFAIL 9302 * because the best nameservers are now above QDOMAIN. 9303 * We force the TTL to 1 second to prevent this. 9304 */ 9305 if (rctx->ns_rdataset->ttl == 0) { 9306 rctx->ns_rdataset->ttl = 1; 9307 } 9308 9309 /* 9310 * Set the current query domain to the referral name. 9311 * 9312 * XXXRTH We should check if we're in forward-only mode, and 9313 * if so we should bail out. 9314 */ 9315 INSIST(dns_name_countlabels(fctx->domain) > 0); 9316 fcount_decr(fctx); 9317 9318 if (dns_rdataset_isassociated(&fctx->nameservers)) { 9319 dns_rdataset_disassociate(&fctx->nameservers); 9320 } 9321 9322 dns_name_copy(rctx->ns_name, fctx->domain); 9323 9324 if ((fctx->options & DNS_FETCHOPT_QMINIMIZE) != 0) { 9325 dns_name_copy(rctx->ns_name, fctx->qmindcname); 9326 9327 fctx_minimize_qname(fctx); 9328 } 9329 9330 result = fcount_incr(fctx, true); 9331 if (result != ISC_R_SUCCESS) { 9332 rctx->result = result; 9333 return ISC_R_COMPLETE; 9334 } 9335 9336 FCTX_ATTR_SET(fctx, FCTX_ATTR_WANTCACHE); 9337 fctx->ns_ttl_ok = false; 9338 log_ns_ttl(fctx, "DELEGATION"); 9339 rctx->result = DNS_R_DELEGATION; 9340 9341 /* 9342 * Reinitialize 'rctx' to prepare for following the delegation: 9343 * set the get_nameservers and next_server flags appropriately 9344 * and reset the fetch context counters. 9345 * 9346 */ 9347 if ((rctx->fctx->options & DNS_FETCHOPT_NOFOLLOW) == 0) { 9348 rctx->get_nameservers = true; 9349 rctx->next_server = true; 9350 rctx->fctx->restarts = 0; 9351 rctx->fctx->referrals++; 9352 rctx->fctx->querysent = 0; 9353 rctx->fctx->lamecount = 0; 9354 rctx->fctx->quotacount = 0; 9355 rctx->fctx->neterr = 0; 9356 rctx->fctx->badresp = 0; 9357 rctx->fctx->adberr = 0; 9358 } 9359 9360 return ISC_R_COMPLETE; 9361 } 9362 9363 /* 9364 * rctx_additional(): 9365 * Scan the additional section of a response to find records related 9366 * to answers we were interested in. 9367 */ 9368 static void 9369 rctx_additional(respctx_t *rctx) { 9370 bool rescan; 9371 dns_section_t section = DNS_SECTION_ADDITIONAL; 9372 isc_result_t result; 9373 9374 again: 9375 rescan = false; 9376 9377 for (result = dns_message_firstname(rctx->query->rmessage, section); 9378 result == ISC_R_SUCCESS; 9379 result = dns_message_nextname(rctx->query->rmessage, section)) 9380 { 9381 dns_name_t *name = NULL; 9382 dns_rdataset_t *rdataset; 9383 dns_message_currentname(rctx->query->rmessage, 9384 DNS_SECTION_ADDITIONAL, &name); 9385 if (!name->attributes.chase) { 9386 continue; 9387 } 9388 name->attributes.chase = false; 9389 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; 9390 rdataset = ISC_LIST_NEXT(rdataset, link)) 9391 { 9392 if (CHASE(rdataset)) { 9393 rdataset->attributes &= ~DNS_RDATASETATTR_CHASE; 9394 (void)dns_rdataset_additionaldata( 9395 rdataset, name, check_related, rctx); 9396 rescan = true; 9397 } 9398 } 9399 } 9400 if (rescan) { 9401 goto again; 9402 } 9403 } 9404 9405 /* 9406 * rctx_nextserver(): 9407 * We found something wrong with the remote server, but it may be 9408 * useful to try another one. 9409 */ 9410 static void 9411 rctx_nextserver(respctx_t *rctx, dns_message_t *message, 9412 dns_adbaddrinfo_t *addrinfo, isc_result_t result) { 9413 fetchctx_t *fctx = rctx->fctx; 9414 bool retrying = true; 9415 9416 if (result == DNS_R_FORMERR) { 9417 rctx->broken_server = DNS_R_FORMERR; 9418 } 9419 if (rctx->broken_server != ISC_R_SUCCESS) { 9420 /* 9421 * Add this server to the list of bad servers for 9422 * this fctx. 9423 */ 9424 add_bad(fctx, message, addrinfo, rctx->broken_server, 9425 rctx->broken_type); 9426 } 9427 9428 if (rctx->get_nameservers) { 9429 dns_fixedname_t foundname, founddc; 9430 dns_name_t *name, *fname, *dcname; 9431 unsigned int findoptions = 0; 9432 9433 fname = dns_fixedname_initname(&foundname); 9434 dcname = dns_fixedname_initname(&founddc); 9435 9436 if (result != ISC_R_SUCCESS) { 9437 fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL); 9438 return; 9439 } 9440 if (dns_rdatatype_atparent(fctx->type)) { 9441 findoptions |= DNS_DBFIND_NOEXACT; 9442 } 9443 /* FIXME: Why??? */ 9444 if ((rctx->retryopts & DNS_FETCHOPT_UNSHARED) == 0) { 9445 name = fctx->name; 9446 } else { 9447 name = fctx->domain; 9448 } 9449 result = dns_view_findzonecut( 9450 fctx->res->view, name, fname, dcname, fctx->now, 9451 findoptions, true, true, &fctx->nameservers, NULL); 9452 if (result != ISC_R_SUCCESS) { 9453 FCTXTRACE("couldn't find a zonecut"); 9454 fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL); 9455 return; 9456 } 9457 if (!dns_name_issubdomain(fname, fctx->domain)) { 9458 /* 9459 * The best nameservers are now above our 9460 * QDOMAIN. 9461 */ 9462 FCTXTRACE("nameservers now above QDOMAIN"); 9463 fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL); 9464 return; 9465 } 9466 9467 fcount_decr(fctx); 9468 9469 dns_name_copy(fname, fctx->domain); 9470 dns_name_copy(dcname, fctx->qmindcname); 9471 9472 result = fcount_incr(fctx, true); 9473 if (result != ISC_R_SUCCESS) { 9474 fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL); 9475 return; 9476 } 9477 fctx->ns_ttl = fctx->nameservers.ttl; 9478 fctx->ns_ttl_ok = true; 9479 fctx_cancelqueries(fctx, true, false); 9480 fctx_cleanup(fctx); 9481 retrying = false; 9482 } 9483 9484 /* 9485 * Try again. 9486 */ 9487 fctx_try(fctx, retrying); 9488 } 9489 9490 /* 9491 * rctx_resend(): 9492 * 9493 * Resend the query, probably with the options changed. Calls 9494 * fctx_query(), passing rctx->retryopts (which is based on 9495 * query->options, but may have been updated since the last time 9496 * fctx_query() was called). 9497 */ 9498 static void 9499 rctx_resend(respctx_t *rctx, dns_adbaddrinfo_t *addrinfo) { 9500 fetchctx_t *fctx = rctx->fctx; 9501 isc_result_t result; 9502 9503 FCTXTRACE("resend"); 9504 inc_stats(fctx->res, dns_resstatscounter_retry); 9505 result = fctx_query(fctx, addrinfo, rctx->retryopts); 9506 if (result != ISC_R_SUCCESS) { 9507 fctx_done_detach(&rctx->fctx, result); 9508 } 9509 } 9510 9511 /* 9512 * rctx_next(): 9513 * We got what appeared to be a response but it didn't match the 9514 * question or the cookie; it may have been meant for someone else, or 9515 * it may be a spoofing attack. Drop it and continue listening for the 9516 * response we wanted. 9517 */ 9518 static isc_result_t 9519 rctx_next(respctx_t *rctx) { 9520 fetchctx_t *fctx = rctx->fctx; 9521 isc_result_t result; 9522 9523 FCTXTRACE("nextitem"); 9524 inc_stats(rctx->fctx->res, dns_resstatscounter_nextitem); 9525 INSIST(rctx->query->dispentry != NULL); 9526 dns_message_reset(rctx->query->rmessage, DNS_MESSAGE_INTENTPARSE); 9527 result = dns_dispatch_getnext(rctx->query->dispentry); 9528 return result; 9529 } 9530 9531 /* 9532 * rctx_chaseds(): 9533 * Look up the parent zone's NS records so that DS records can be 9534 * fetched. 9535 */ 9536 static void 9537 rctx_chaseds(respctx_t *rctx, dns_message_t *message, 9538 dns_adbaddrinfo_t *addrinfo, isc_result_t result) { 9539 fetchctx_t *fctx = rctx->fctx; 9540 unsigned int n; 9541 9542 add_bad(fctx, message, addrinfo, result, rctx->broken_type); 9543 fctx_cancelqueries(fctx, true, false); 9544 fctx_cleanup(fctx); 9545 9546 n = dns_name_countlabels(fctx->name); 9547 dns_name_getlabelsequence(fctx->name, 1, n - 1, fctx->nsname); 9548 9549 FCTXTRACE("suspending DS lookup to find parent's NS records"); 9550 9551 fetchctx_ref(fctx); 9552 result = dns_resolver_createfetch( 9553 fctx->res, fctx->nsname, dns_rdatatype_ns, NULL, NULL, NULL, 9554 NULL, 0, fctx->options, 0, fctx->qc, fctx->loop, 9555 resume_dslookup, fctx, &fctx->nsrrset, NULL, &fctx->nsfetch); 9556 if (result != ISC_R_SUCCESS) { 9557 if (result == DNS_R_DUPLICATE) { 9558 result = DNS_R_SERVFAIL; 9559 } 9560 fctx_done_detach(&rctx->fctx, result); 9561 fetchctx_detach(&fctx); 9562 return; 9563 } 9564 } 9565 9566 /* 9567 * rctx_done(): 9568 * This resolver query response is finished, either because we 9569 * encountered a problem or because we've gotten all the information 9570 * from it that we can. We either wait for another response, resend the 9571 * query to the same server, resend to a new server, or clean up and 9572 * shut down the fetch. 9573 */ 9574 static void 9575 rctx_done(respctx_t *rctx, isc_result_t result) { 9576 resquery_t *query = rctx->query; 9577 fetchctx_t *fctx = rctx->fctx; 9578 dns_adbaddrinfo_t *addrinfo = query->addrinfo; 9579 dns_message_t *message = NULL; 9580 9581 /* 9582 * Need to attach to the message until the scope 9583 * of this function ends, since there are many places 9584 * where the message is used and/or may be destroyed 9585 * before this function ends. 9586 */ 9587 dns_message_attach(query->rmessage, &message); 9588 9589 FCTXTRACE4("query canceled in rctx_done();", 9590 rctx->no_response ? "no response" : "responding", result); 9591 9592 #ifdef ENABLE_AFL 9593 if (dns_fuzzing_resolver && 9594 (rctx->next_server || rctx->resend || rctx->nextitem)) 9595 { 9596 fctx_cancelquery(&query, rctx->finish, rctx->no_response, 9597 false); 9598 fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL); 9599 goto detach; 9600 } 9601 #endif /* ifdef ENABLE_AFL */ 9602 9603 if (rctx->nextitem) { 9604 REQUIRE(!rctx->next_server); 9605 REQUIRE(!rctx->resend); 9606 9607 result = rctx_next(rctx); 9608 if (result == ISC_R_SUCCESS) { 9609 goto detach; 9610 } 9611 } 9612 9613 /* Cancel the query */ 9614 fctx_cancelquery(&query, rctx->finish, rctx->no_response, false); 9615 9616 /* 9617 * If nobody's waiting for results, don't resend or try next server. 9618 */ 9619 LOCK(&fctx->lock); 9620 if (ISC_LIST_EMPTY(fctx->resps)) { 9621 rctx->next_server = false; 9622 rctx->resend = false; 9623 } 9624 UNLOCK(&fctx->lock); 9625 9626 if (rctx->next_server) { 9627 rctx_nextserver(rctx, message, addrinfo, result); 9628 } else if (rctx->resend) { 9629 rctx_resend(rctx, addrinfo); 9630 } else if (result == DNS_R_CHASEDSSERVERS) { 9631 rctx_chaseds(rctx, message, addrinfo, result); 9632 } else if (result == ISC_R_SUCCESS && !HAVE_ANSWER(fctx)) { 9633 /* 9634 * All has gone well so far, but we are waiting for the DNSSEC 9635 * validator to validate the answer. 9636 */ 9637 FCTXTRACE("wait for validator"); 9638 fctx_cancelqueries(fctx, true, false); 9639 } else { 9640 /* 9641 * We're done. 9642 */ 9643 fctx_done_detach(&rctx->fctx, result); 9644 } 9645 9646 detach: 9647 dns_message_detach(&message); 9648 } 9649 9650 /* 9651 * rctx_logpacket(): 9652 * Log the incoming packet; also log to DNSTAP if configured. 9653 */ 9654 static void 9655 rctx_logpacket(respctx_t *rctx) { 9656 fetchctx_t *fctx = rctx->fctx; 9657 #ifdef HAVE_DNSTAP 9658 isc_result_t result; 9659 isc_sockaddr_t localaddr, *la = NULL; 9660 unsigned char zone[DNS_NAME_MAXWIRE]; 9661 dns_transport_type_t transport_type; 9662 dns_dtmsgtype_t dtmsgtype; 9663 dns_compress_t cctx; 9664 isc_region_t zr; 9665 isc_buffer_t zb; 9666 #endif /* HAVE_DNSTAP */ 9667 9668 dns_message_logfmtpacket( 9669 rctx->query->rmessage, "received packet from", 9670 &rctx->query->addrinfo->sockaddr, DNS_LOGCATEGORY_RESOLVER, 9671 DNS_LOGMODULE_PACKETS, &dns_master_style_comment, 9672 ISC_LOG_DEBUG(10), fctx->mctx); 9673 9674 #ifdef HAVE_DNSTAP 9675 /* 9676 * Log the response via dnstap. 9677 */ 9678 memset(&zr, 0, sizeof(zr)); 9679 dns_compress_init(&cctx, fctx->mctx, 0); 9680 dns_compress_setpermitted(&cctx, false); 9681 isc_buffer_init(&zb, zone, sizeof(zone)); 9682 result = dns_name_towire(fctx->domain, &cctx, &zb, NULL); 9683 if (result == ISC_R_SUCCESS) { 9684 isc_buffer_usedregion(&zb, &zr); 9685 } 9686 dns_compress_invalidate(&cctx); 9687 9688 if ((fctx->qmessage->flags & DNS_MESSAGEFLAG_RD) != 0) { 9689 dtmsgtype = DNS_DTTYPE_FR; 9690 } else { 9691 dtmsgtype = DNS_DTTYPE_RR; 9692 } 9693 9694 result = dns_dispentry_getlocaladdress(rctx->query->dispentry, 9695 &localaddr); 9696 if (result == ISC_R_SUCCESS) { 9697 la = &localaddr; 9698 } 9699 9700 if (rctx->query->addrinfo->transport != NULL) { 9701 transport_type = dns_transport_get_type( 9702 rctx->query->addrinfo->transport); 9703 } else if ((rctx->query->options & DNS_FETCHOPT_TCP) != 0) { 9704 transport_type = DNS_TRANSPORT_TCP; 9705 } else { 9706 transport_type = DNS_TRANSPORT_UDP; 9707 } 9708 9709 dns_dt_send(fctx->res->view, dtmsgtype, la, 9710 &rctx->query->addrinfo->sockaddr, transport_type, &zr, 9711 &rctx->query->start, NULL, &rctx->buffer); 9712 #endif /* HAVE_DNSTAP */ 9713 } 9714 9715 /* 9716 * rctx_badserver(): 9717 * Is the remote server broken, or does it dislike us? 9718 */ 9719 static isc_result_t 9720 rctx_badserver(respctx_t *rctx, isc_result_t result) { 9721 fetchctx_t *fctx = rctx->fctx; 9722 resquery_t *query = rctx->query; 9723 isc_buffer_t b; 9724 char code[64]; 9725 dns_rcode_t rcode = rctx->query->rmessage->rcode; 9726 9727 if (rcode == dns_rcode_noerror || rcode == dns_rcode_yxdomain || 9728 rcode == dns_rcode_nxdomain) 9729 { 9730 return ISC_R_SUCCESS; 9731 } 9732 9733 if ((rcode == dns_rcode_formerr) && rctx->opt == NULL && 9734 (rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0) 9735 { 9736 /* 9737 * It's very likely they don't like EDNS0. 9738 */ 9739 rctx->retryopts |= DNS_FETCHOPT_NOEDNS0; 9740 rctx->resend = true; 9741 /* 9742 * Remember that they may not like EDNS0. 9743 */ 9744 add_bad_edns(fctx, &query->addrinfo->sockaddr); 9745 inc_stats(fctx->res, dns_resstatscounter_edns0fail); 9746 } else if (rcode == dns_rcode_formerr) { 9747 if (query->rmessage->cc_echoed) { 9748 /* 9749 * Retry without DNS COOKIE. 9750 */ 9751 query->addrinfo->flags |= FCTX_ADDRINFO_NOCOOKIE; 9752 rctx->resend = true; 9753 log_formerr(fctx, "server sent FORMERR with echoed DNS " 9754 "COOKIE"); 9755 } else { 9756 /* 9757 * The server (or forwarder) doesn't understand us, 9758 * but others might. 9759 */ 9760 rctx->next_server = true; 9761 rctx->broken_server = DNS_R_REMOTEFORMERR; 9762 log_formerr(fctx, "server sent FORMERR"); 9763 } 9764 } else if (rcode == dns_rcode_badvers) { 9765 unsigned int version; 9766 #if DNS_EDNS_VERSION > 0 9767 unsigned int flags, mask; 9768 #endif /* if DNS_EDNS_VERSION > 0 */ 9769 9770 INSIST(rctx->opt != NULL); 9771 version = (rctx->opt->ttl >> 16) & 0xff; 9772 #if DNS_EDNS_VERSION > 0 9773 flags = (version << DNS_FETCHOPT_EDNSVERSIONSHIFT) | 9774 DNS_FETCHOPT_EDNSVERSIONSET; 9775 mask = DNS_FETCHOPT_EDNSVERSIONMASK | 9776 DNS_FETCHOPT_EDNSVERSIONSET; 9777 #endif /* if DNS_EDNS_VERSION > 0 */ 9778 9779 /* 9780 * Record that we got a good EDNS response. 9781 */ 9782 if (query->ednsversion > (int)version && 9783 !EDNSOK(query->addrinfo)) 9784 { 9785 dns_adb_changeflags(fctx->adb, query->addrinfo, 9786 FCTX_ADDRINFO_EDNSOK, 9787 FCTX_ADDRINFO_EDNSOK); 9788 } 9789 9790 /* 9791 * RFC 2671 was not clear that unknown options should 9792 * be ignored. RFC 6891 is clear that that they 9793 * should be ignored. If we are supporting the 9794 * experimental EDNS > 0 then perform strict 9795 * version checking of badvers responses. We won't 9796 * be sending COOKIE etc. in that case. 9797 */ 9798 #if DNS_EDNS_VERSION > 0 9799 if ((int)version < query->ednsversion) { 9800 dns_adb_changeflags(fctx->adb, query->addrinfo, flags, 9801 mask); 9802 rctx->resend = true; 9803 } else { 9804 rctx->broken_server = DNS_R_BADVERS; 9805 rctx->next_server = true; 9806 } 9807 #else /* if DNS_EDNS_VERSION > 0 */ 9808 rctx->broken_server = DNS_R_BADVERS; 9809 rctx->next_server = true; 9810 #endif /* if DNS_EDNS_VERSION > 0 */ 9811 } else if (rcode == dns_rcode_badcookie && rctx->query->rmessage->cc_ok) 9812 { 9813 /* 9814 * We have recorded the new cookie. 9815 */ 9816 if (BADCOOKIE(query->addrinfo)) { 9817 rctx->retryopts |= DNS_FETCHOPT_TCP; 9818 } 9819 query->addrinfo->flags |= FCTX_ADDRINFO_BADCOOKIE; 9820 rctx->resend = true; 9821 } else { 9822 rctx->broken_server = DNS_R_UNEXPECTEDRCODE; 9823 rctx->next_server = true; 9824 } 9825 9826 isc_buffer_init(&b, code, sizeof(code) - 1); 9827 dns_rcode_totext(rcode, &b); 9828 code[isc_buffer_usedlength(&b)] = '\0'; 9829 FCTXTRACE2("remote server broken: returned ", code); 9830 rctx_done(rctx, result); 9831 9832 return ISC_R_COMPLETE; 9833 } 9834 9835 /* 9836 * rctx_lameserver(): 9837 * Is the server lame? 9838 */ 9839 static isc_result_t 9840 rctx_lameserver(respctx_t *rctx) { 9841 isc_result_t result = ISC_R_SUCCESS; 9842 fetchctx_t *fctx = rctx->fctx; 9843 resquery_t *query = rctx->query; 9844 9845 if (ISFORWARDER(query->addrinfo) || !is_lame(fctx, query->rmessage)) { 9846 return ISC_R_SUCCESS; 9847 } 9848 9849 inc_stats(fctx->res, dns_resstatscounter_lame); 9850 log_lame(fctx, query->addrinfo); 9851 rctx->broken_server = DNS_R_LAME; 9852 rctx->next_server = true; 9853 FCTXTRACE("lame server"); 9854 rctx_done(rctx, result); 9855 9856 return ISC_R_COMPLETE; 9857 } 9858 9859 /*** 9860 *** Resolver Methods 9861 ***/ 9862 static void 9863 dns_resolver__destroy(dns_resolver_t *res) { 9864 alternate_t *a = NULL; 9865 9866 REQUIRE(!atomic_load_acquire(&res->priming)); 9867 REQUIRE(res->primefetch == NULL); 9868 9869 RTRACE("destroy"); 9870 9871 REQUIRE(atomic_load_acquire(&res->nfctx) == 0); 9872 9873 res->magic = 0; 9874 9875 dns_nametree_detach(&res->algorithms); 9876 dns_nametree_detach(&res->digests); 9877 dns_nametree_detach(&res->mustbesecure); 9878 9879 if (res->querystats != NULL) { 9880 dns_stats_detach(&res->querystats); 9881 } 9882 if (res->stats != NULL) { 9883 isc_stats_detach(&res->stats); 9884 } 9885 9886 isc_mutex_destroy(&res->primelock); 9887 isc_mutex_destroy(&res->lock); 9888 9889 INSIST(isc_hashmap_count(res->fctxs) == 0); 9890 isc_hashmap_destroy(&res->fctxs); 9891 isc_rwlock_destroy(&res->fctxs_lock); 9892 9893 INSIST(isc_hashmap_count(res->counters) == 0); 9894 isc_hashmap_destroy(&res->counters); 9895 isc_rwlock_destroy(&res->counters_lock); 9896 9897 if (res->dispatches4 != NULL) { 9898 dns_dispatchset_destroy(&res->dispatches4); 9899 } 9900 if (res->dispatches6 != NULL) { 9901 dns_dispatchset_destroy(&res->dispatches6); 9902 } 9903 while ((a = ISC_LIST_HEAD(res->alternates)) != NULL) { 9904 ISC_LIST_UNLINK(res->alternates, a, link); 9905 if (!a->isaddress) { 9906 dns_name_free(&a->_u._n.name, res->mctx); 9907 } 9908 isc_mem_put(res->mctx, a, sizeof(*a)); 9909 } 9910 9911 dns_view_weakdetach(&res->view); 9912 9913 for (size_t i = 0; i < res->nloops; i++) { 9914 dns_message_destroypools(&res->namepools[i], &res->rdspools[i]); 9915 } 9916 isc_mem_cput(res->mctx, res->rdspools, res->nloops, 9917 sizeof(res->rdspools[0])); 9918 isc_mem_cput(res->mctx, res->namepools, res->nloops, 9919 sizeof(res->namepools[0])); 9920 9921 isc_mem_putanddetach(&res->mctx, res, sizeof(*res)); 9922 } 9923 9924 static void 9925 spillattimer_countdown(void *arg) { 9926 dns_resolver_t *res = (dns_resolver_t *)arg; 9927 unsigned int spillat = 0; 9928 9929 REQUIRE(VALID_RESOLVER(res)); 9930 9931 if (atomic_load(&res->exiting)) { 9932 isc_timer_destroy(&res->spillattimer); 9933 return; 9934 } 9935 9936 LOCK(&res->lock); 9937 INSIST(!atomic_load_acquire(&res->exiting)); 9938 if (res->spillat > res->spillatmin) { 9939 spillat = --res->spillat; 9940 } 9941 if (res->spillat <= res->spillatmin) { 9942 isc_timer_destroy(&res->spillattimer); 9943 } 9944 UNLOCK(&res->lock); 9945 if (spillat > 0) { 9946 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 9947 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, 9948 "clients-per-query decreased to %u", spillat); 9949 } 9950 } 9951 9952 isc_result_t 9953 dns_resolver_create(dns_view_t *view, isc_loopmgr_t *loopmgr, isc_nm_t *nm, 9954 unsigned int options, isc_tlsctx_cache_t *tlsctx_cache, 9955 dns_dispatch_t *dispatchv4, dns_dispatch_t *dispatchv6, 9956 dns_resolver_t **resp) { 9957 dns_resolver_t *res = NULL; 9958 9959 /* 9960 * Create a resolver. 9961 */ 9962 9963 REQUIRE(DNS_VIEW_VALID(view)); 9964 REQUIRE(resp != NULL && *resp == NULL); 9965 REQUIRE(tlsctx_cache != NULL); 9966 REQUIRE(dispatchv4 != NULL || dispatchv6 != NULL); 9967 9968 res = isc_mem_get(view->mctx, sizeof(*res)); 9969 *res = (dns_resolver_t){ 9970 .loopmgr = loopmgr, 9971 .rdclass = view->rdclass, 9972 .nm = nm, 9973 .options = options, 9974 .tlsctx_cache = tlsctx_cache, 9975 .spillatmin = 10, 9976 .spillat = 10, 9977 .spillatmax = 100, 9978 .retryinterval = 800, 9979 .nonbackofftries = 3, 9980 .query_timeout = DEFAULT_QUERY_TIMEOUT, 9981 .maxdepth = DEFAULT_RECURSION_DEPTH, 9982 .maxqueries = DEFAULT_MAX_QUERIES, 9983 .alternates = ISC_LIST_INITIALIZER, 9984 .nloops = isc_loopmgr_nloops(loopmgr), 9985 .maxvalidations = DEFAULT_MAX_VALIDATIONS, 9986 .maxvalidationfails = DEFAULT_MAX_VALIDATION_FAILURES, 9987 }; 9988 9989 RTRACE("create"); 9990 9991 dns_view_weakattach(view, &res->view); 9992 isc_mem_attach(view->mctx, &res->mctx); 9993 9994 res->quotaresp[dns_quotatype_zone] = DNS_R_DROP; 9995 res->quotaresp[dns_quotatype_server] = DNS_R_SERVFAIL; 9996 9997 #if DNS_RESOLVER_TRACE 9998 fprintf(stderr, "dns_resolver__init:%s:%s:%d:%p->references = 1\n", 9999 __func__, __FILE__, __LINE__, res); 10000 #endif 10001 isc_refcount_init(&res->references, 1); 10002 10003 isc_hashmap_create(view->mctx, RES_DOMAIN_HASH_BITS, &res->fctxs); 10004 isc_rwlock_init(&res->fctxs_lock); 10005 10006 isc_hashmap_create(view->mctx, RES_DOMAIN_HASH_BITS, &res->counters); 10007 isc_rwlock_init(&res->counters_lock); 10008 10009 if (dispatchv4 != NULL) { 10010 dns_dispatchset_create(res->mctx, dispatchv4, &res->dispatches4, 10011 res->nloops); 10012 } 10013 10014 if (dispatchv6 != NULL) { 10015 dns_dispatchset_create(res->mctx, dispatchv6, &res->dispatches6, 10016 res->nloops); 10017 } 10018 10019 isc_mutex_init(&res->lock); 10020 isc_mutex_init(&res->primelock); 10021 10022 dns_nametree_create(res->mctx, DNS_NAMETREE_BITS, "algorithms", 10023 &res->algorithms); 10024 dns_nametree_create(res->mctx, DNS_NAMETREE_BITS, "ds-digests", 10025 &res->digests); 10026 dns_nametree_create(res->mctx, DNS_NAMETREE_BOOL, 10027 "dnssec-must-be-secure", &res->mustbesecure); 10028 10029 res->namepools = isc_mem_cget(res->mctx, res->nloops, 10030 sizeof(res->namepools[0])); 10031 res->rdspools = isc_mem_cget(res->mctx, res->nloops, 10032 sizeof(res->rdspools[0])); 10033 for (size_t i = 0; i < res->nloops; i++) { 10034 isc_loop_t *loop = isc_loop_get(res->loopmgr, i); 10035 isc_mem_t *pool_mctx = isc_loop_getmctx(loop); 10036 10037 dns_message_createpools(pool_mctx, &res->namepools[i], 10038 &res->rdspools[i]); 10039 } 10040 10041 res->magic = RES_MAGIC; 10042 10043 *resp = res; 10044 10045 return ISC_R_SUCCESS; 10046 } 10047 10048 static void 10049 prime_done(void *arg) { 10050 dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg; 10051 dns_resolver_t *res = resp->arg; 10052 dns_fetch_t *fetch = NULL; 10053 dns_db_t *db = NULL; 10054 10055 REQUIRE(VALID_RESOLVER(res)); 10056 10057 int level = (resp->result == ISC_R_SUCCESS) ? ISC_LOG_DEBUG(1) 10058 : ISC_LOG_NOTICE; 10059 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 10060 DNS_LOGMODULE_RESOLVER, level, 10061 "resolver priming query complete: %s", 10062 isc_result_totext(resp->result)); 10063 10064 LOCK(&res->primelock); 10065 fetch = res->primefetch; 10066 res->primefetch = NULL; 10067 UNLOCK(&res->primelock); 10068 10069 atomic_compare_exchange_enforced(&res->priming, &(bool){ true }, false); 10070 10071 if (resp->result == ISC_R_SUCCESS && res->view->cache != NULL && 10072 res->view->hints != NULL) 10073 { 10074 dns_cache_attachdb(res->view->cache, &db); 10075 dns_root_checkhints(res->view, res->view->hints, db); 10076 dns_db_detach(&db); 10077 } 10078 10079 if (resp->node != NULL) { 10080 dns_db_detachnode(resp->db, &resp->node); 10081 } 10082 if (resp->db != NULL) { 10083 dns_db_detach(&resp->db); 10084 } 10085 if (dns_rdataset_isassociated(resp->rdataset)) { 10086 dns_rdataset_disassociate(resp->rdataset); 10087 } 10088 INSIST(resp->sigrdataset == NULL); 10089 10090 isc_mem_put(res->mctx, resp->rdataset, sizeof(*resp->rdataset)); 10091 isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp)); 10092 dns_resolver_destroyfetch(&fetch); 10093 } 10094 10095 void 10096 dns_resolver_prime(dns_resolver_t *res) { 10097 bool want_priming = false; 10098 isc_result_t result; 10099 10100 REQUIRE(VALID_RESOLVER(res)); 10101 REQUIRE(res->frozen); 10102 10103 RTRACE("dns_resolver_prime"); 10104 10105 if (!atomic_load_acquire(&res->exiting)) { 10106 want_priming = atomic_compare_exchange_strong_acq_rel( 10107 &res->priming, &(bool){ false }, true); 10108 } 10109 10110 if (want_priming) { 10111 /* 10112 * To avoid any possible recursive locking problems, we 10113 * start the priming fetch like any other fetch, and 10114 * holding no resolver locks. No one else will try to 10115 * start it because we're the ones who set res->priming 10116 * to true. Any other callers of dns_resolver_prime() 10117 * while we're running will see that res->priming is 10118 * already true and do nothing. 10119 */ 10120 RTRACE("priming"); 10121 10122 dns_rdataset_t *rdataset = isc_mem_get(res->mctx, 10123 sizeof(*rdataset)); 10124 dns_rdataset_init(rdataset); 10125 10126 LOCK(&res->primelock); 10127 result = dns_resolver_createfetch( 10128 res, dns_rootname, dns_rdatatype_ns, NULL, NULL, NULL, 10129 NULL, 0, DNS_FETCHOPT_NOFORWARD, 0, NULL, isc_loop(), 10130 prime_done, res, rdataset, NULL, &res->primefetch); 10131 UNLOCK(&res->primelock); 10132 10133 if (result != ISC_R_SUCCESS) { 10134 isc_mem_put(res->mctx, rdataset, sizeof(*rdataset)); 10135 atomic_compare_exchange_enforced( 10136 &res->priming, &(bool){ true }, false); 10137 } 10138 inc_stats(res, dns_resstatscounter_priming); 10139 } 10140 } 10141 10142 void 10143 dns_resolver_freeze(dns_resolver_t *res) { 10144 /* 10145 * Freeze resolver. 10146 */ 10147 10148 REQUIRE(VALID_RESOLVER(res)); 10149 10150 res->frozen = true; 10151 } 10152 10153 void 10154 dns_resolver_shutdown(dns_resolver_t *res) { 10155 isc_result_t result; 10156 bool is_false = false; 10157 10158 REQUIRE(VALID_RESOLVER(res)); 10159 10160 RTRACE("shutdown"); 10161 10162 if (atomic_compare_exchange_strong(&res->exiting, &is_false, true)) { 10163 isc_hashmap_iter_t *it = NULL; 10164 10165 RTRACE("exiting"); 10166 10167 RWLOCK(&res->fctxs_lock, isc_rwlocktype_write); 10168 isc_hashmap_iter_create(res->fctxs, &it); 10169 for (result = isc_hashmap_iter_first(it); 10170 result == ISC_R_SUCCESS; 10171 result = isc_hashmap_iter_next(it)) 10172 { 10173 fetchctx_t *fctx = NULL; 10174 10175 isc_hashmap_iter_current(it, (void **)&fctx); 10176 INSIST(fctx != NULL); 10177 10178 fetchctx_ref(fctx); 10179 isc_async_run(fctx->loop, fctx_shutdown, fctx); 10180 } 10181 isc_hashmap_iter_destroy(&it); 10182 RWUNLOCK(&res->fctxs_lock, isc_rwlocktype_write); 10183 10184 LOCK(&res->lock); 10185 if (res->spillattimer != NULL) { 10186 isc_timer_async_destroy(&res->spillattimer); 10187 } 10188 UNLOCK(&res->lock); 10189 } 10190 } 10191 10192 #if DNS_RESOLVER_TRACE 10193 ISC_REFCOUNT_TRACE_IMPL(dns_resolver, dns_resolver__destroy); 10194 #else 10195 ISC_REFCOUNT_IMPL(dns_resolver, dns_resolver__destroy); 10196 #endif 10197 10198 static void 10199 log_fetch(const dns_name_t *name, dns_rdatatype_t type) { 10200 char namebuf[DNS_NAME_FORMATSIZE]; 10201 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 10202 int level = ISC_LOG_DEBUG(1); 10203 10204 /* 10205 * If there's no chance of logging it, don't render (format) the 10206 * name and RDATA type (further below), and return early. 10207 */ 10208 if (!isc_log_wouldlog(dns_lctx, level)) { 10209 return; 10210 } 10211 10212 dns_name_format(name, namebuf, sizeof(namebuf)); 10213 dns_rdatatype_format(type, typebuf, sizeof(typebuf)); 10214 10215 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 10216 DNS_LOGMODULE_RESOLVER, level, "fetch: %s/%s", namebuf, 10217 typebuf); 10218 } 10219 10220 static void 10221 fctx_minimize_qname(fetchctx_t *fctx) { 10222 isc_result_t result; 10223 unsigned int dlabels, nlabels; 10224 dns_name_t name; 10225 10226 REQUIRE(VALID_FCTX(fctx)); 10227 10228 dns_name_init(&name, NULL); 10229 10230 dlabels = dns_name_countlabels(fctx->qmindcname); 10231 nlabels = dns_name_countlabels(fctx->name); 10232 10233 if (dlabels > fctx->qmin_labels) { 10234 fctx->qmin_labels = dlabels + 1; 10235 } else { 10236 fctx->qmin_labels++; 10237 } 10238 10239 if (fctx->ip6arpaskip) { 10240 /* 10241 * For ip6.arpa we want to skip some of the labels, with 10242 * boundaries at /16, /32, /48, /56, /64 and /128 10243 * In 'label count' terms that's equal to 10244 * 7 11 15 17 19 35 10245 * We fix fctx->qmin_labels to point to the nearest 10246 * boundary 10247 */ 10248 if (fctx->qmin_labels < 7) { 10249 fctx->qmin_labels = 7; 10250 } else if (fctx->qmin_labels < 11) { 10251 fctx->qmin_labels = 11; 10252 } else if (fctx->qmin_labels < 15) { 10253 fctx->qmin_labels = 15; 10254 } else if (fctx->qmin_labels < 17) { 10255 fctx->qmin_labels = 17; 10256 } else if (fctx->qmin_labels < 19) { 10257 fctx->qmin_labels = 19; 10258 } else if (fctx->qmin_labels < 35) { 10259 fctx->qmin_labels = 35; 10260 } else { 10261 fctx->qmin_labels = nlabels; 10262 } 10263 } else if (fctx->qmin_labels > DNS_QMIN_MAXLABELS) { 10264 fctx->qmin_labels = DNS_NAME_MAXLABELS; 10265 } 10266 10267 if (fctx->qmin_labels < nlabels) { 10268 dns_rdataset_t rdataset; 10269 dns_fixedname_t fixed; 10270 dns_name_t *fname = dns_fixedname_initname(&fixed); 10271 dns_rdataset_init(&rdataset); 10272 do { 10273 /* 10274 * We want to query for qmin_labels from fctx->name. 10275 */ 10276 dns_name_split(fctx->name, fctx->qmin_labels, NULL, 10277 &name); 10278 /* 10279 * Look to see if we have anything cached about NS 10280 * RRsets at this name and if so skip this name and 10281 * try with an additional label prepended. 10282 */ 10283 result = dns_db_find(fctx->cache, &name, NULL, 10284 dns_rdatatype_ns, 0, 0, NULL, 10285 fname, &rdataset, NULL); 10286 if (dns_rdataset_isassociated(&rdataset)) { 10287 dns_rdataset_disassociate(&rdataset); 10288 } 10289 switch (result) { 10290 case ISC_R_SUCCESS: 10291 case DNS_R_CNAME: 10292 case DNS_R_DNAME: 10293 case DNS_R_NCACHENXDOMAIN: 10294 case DNS_R_NCACHENXRRSET: 10295 fctx->qmin_labels++; 10296 continue; 10297 default: 10298 break; 10299 } 10300 break; 10301 } while (fctx->qmin_labels < nlabels); 10302 } 10303 10304 if (fctx->qmin_labels < nlabels) { 10305 dns_name_copy(&name, fctx->qminname); 10306 fctx->qmintype = dns_rdatatype_ns; 10307 fctx->minimized = true; 10308 } else { 10309 /* Minimization is done, we'll ask for whole qname */ 10310 dns_name_copy(fctx->name, fctx->qminname); 10311 fctx->qmintype = fctx->type; 10312 fctx->minimized = false; 10313 } 10314 10315 char domainbuf[DNS_NAME_FORMATSIZE]; 10316 dns_name_format(fctx->qminname, domainbuf, sizeof(domainbuf)); 10317 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, 10318 DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(5), 10319 "QNAME minimization - %s minimized, qmintype %d " 10320 "qminname %s", 10321 fctx->minimized ? "" : "not", fctx->qmintype, domainbuf); 10322 } 10323 10324 static isc_result_t 10325 get_attached_fctx(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name, 10326 dns_rdatatype_t type, const dns_name_t *domain, 10327 dns_rdataset_t *nameservers, const isc_sockaddr_t *client, 10328 unsigned int options, unsigned int depth, isc_counter_t *qc, 10329 fetchctx_t **fctxp, bool *new_fctx) { 10330 isc_result_t result; 10331 fetchctx_t key = { 10332 .name = UNCONST(name), 10333 .options = options, 10334 .type = type, 10335 }; 10336 fetchctx_t *fctx = NULL; 10337 isc_rwlocktype_t locktype = isc_rwlocktype_read; 10338 uint32_t hashval = fctx_hash(&key); 10339 10340 again: 10341 RWLOCK(&res->fctxs_lock, locktype); 10342 result = isc_hashmap_find(res->fctxs, hashval, fctx_match, &key, 10343 (void **)&fctx); 10344 switch (result) { 10345 case ISC_R_SUCCESS: 10346 break; 10347 case ISC_R_NOTFOUND: 10348 result = fctx_create(res, loop, name, type, domain, nameservers, 10349 client, options, depth, qc, &fctx); 10350 if (result != ISC_R_SUCCESS) { 10351 goto unlock; 10352 } 10353 10354 UPGRADELOCK(&res->fctxs_lock, locktype); 10355 10356 void *found = NULL; 10357 result = isc_hashmap_add(res->fctxs, hashval, fctx_match, fctx, 10358 fctx, &found); 10359 if (result == ISC_R_SUCCESS) { 10360 *new_fctx = true; 10361 fctx->hashed = true; 10362 } else { 10363 fctx_done_detach(&fctx, result); 10364 fctx = found; 10365 result = ISC_R_SUCCESS; 10366 } 10367 INSIST(result == ISC_R_SUCCESS); 10368 break; 10369 default: 10370 UNREACHABLE(); 10371 } 10372 fetchctx_ref(fctx); 10373 unlock: 10374 RWUNLOCK(&res->fctxs_lock, locktype); 10375 if (result == ISC_R_SUCCESS) { 10376 LOCK(&fctx->lock); 10377 if (SHUTTINGDOWN(fctx) || fctx->cloned) { 10378 /* 10379 * This is the single place where fctx might get 10380 * accesses from a different thread, so we need to 10381 * double check whether fctxs is done (or cloned) and 10382 * help with the release if the fctx has been cloned. 10383 */ 10384 release_fctx(fctx); 10385 UNLOCK(&fctx->lock); 10386 fetchctx_detach(&fctx); 10387 goto again; 10388 } 10389 10390 INSIST(!SHUTTINGDOWN(fctx)); 10391 *fctxp = fctx; 10392 } 10393 10394 return result; 10395 } 10396 10397 isc_result_t 10398 dns_resolver_createfetch(dns_resolver_t *res, const dns_name_t *name, 10399 dns_rdatatype_t type, const dns_name_t *domain, 10400 dns_rdataset_t *nameservers, 10401 dns_forwarders_t *forwarders, 10402 const isc_sockaddr_t *client, dns_messageid_t id, 10403 unsigned int options, unsigned int depth, 10404 isc_counter_t *qc, isc_loop_t *loop, isc_job_cb cb, 10405 void *arg, dns_rdataset_t *rdataset, 10406 dns_rdataset_t *sigrdataset, dns_fetch_t **fetchp) { 10407 dns_fetch_t *fetch = NULL; 10408 fetchctx_t *fctx = NULL; 10409 isc_result_t result = ISC_R_SUCCESS; 10410 bool new_fctx = false; 10411 unsigned int count = 0; 10412 unsigned int spillat; 10413 unsigned int spillatmin; 10414 isc_mem_t *mctx = isc_loop_getmctx(loop); 10415 10416 UNUSED(forwarders); 10417 10418 REQUIRE(VALID_RESOLVER(res)); 10419 REQUIRE(res->frozen); 10420 /* XXXRTH Check for meta type */ 10421 if (domain != NULL) { 10422 REQUIRE(DNS_RDATASET_VALID(nameservers)); 10423 REQUIRE(nameservers->type == dns_rdatatype_ns); 10424 } else { 10425 REQUIRE(nameservers == NULL); 10426 } 10427 REQUIRE(forwarders == NULL); 10428 REQUIRE(!dns_rdataset_isassociated(rdataset)); 10429 REQUIRE(sigrdataset == NULL || !dns_rdataset_isassociated(sigrdataset)); 10430 REQUIRE(fetchp != NULL && *fetchp == NULL); 10431 10432 if (atomic_load_acquire(&res->exiting)) { 10433 return ISC_R_SHUTTINGDOWN; 10434 } 10435 10436 log_fetch(name, type); 10437 10438 fetch = isc_mem_get(mctx, sizeof(*fetch)); 10439 *fetch = (dns_fetch_t){ 0 }; 10440 10441 dns_resolver_attach(res, &fetch->res); 10442 isc_mem_attach(mctx, &fetch->mctx); 10443 10444 if ((options & DNS_FETCHOPT_UNSHARED) == 0) { 10445 /* 10446 * We don't save the unshared fetch context to a bucket because 10447 * we also would never match it again. 10448 */ 10449 10450 LOCK(&res->lock); 10451 spillat = res->spillat; 10452 spillatmin = res->spillatmin; 10453 UNLOCK(&res->lock); 10454 10455 result = get_attached_fctx(res, loop, name, type, domain, 10456 nameservers, client, options, depth, 10457 qc, &fctx, &new_fctx); 10458 if (result != ISC_R_SUCCESS) { 10459 goto fail; 10460 } 10461 10462 /* On success, the fctx is locked in get_attached_fctx() */ 10463 INSIST(!SHUTTINGDOWN(fctx)); 10464 10465 /* Is this a duplicate? */ 10466 if (client != NULL) { 10467 dns_fetchresponse_t *resp = NULL; 10468 for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL; 10469 resp = ISC_LIST_NEXT(resp, link)) 10470 { 10471 if (resp->client != NULL && resp->id == id && 10472 isc_sockaddr_equal(resp->client, client)) 10473 { 10474 result = DNS_R_DUPLICATE; 10475 goto unlock; 10476 } 10477 10478 count++; 10479 } 10480 } 10481 if (count >= spillatmin && spillatmin != 0) { 10482 if (count >= spillat) { 10483 fctx->spilled = true; 10484 } 10485 if (fctx->spilled) { 10486 inc_stats(res, dns_resstatscounter_clientquota); 10487 result = DNS_R_DROP; 10488 goto unlock; 10489 } 10490 } 10491 } else { 10492 result = fctx_create(res, loop, name, type, domain, nameservers, 10493 client, options, depth, qc, &fctx); 10494 if (result != ISC_R_SUCCESS) { 10495 goto unlock; 10496 } 10497 new_fctx = true; 10498 } 10499 10500 RUNTIME_CHECK(fctx != NULL); 10501 10502 if (fctx->depth > depth) { 10503 fctx->depth = depth; 10504 } 10505 10506 fctx_join(fctx, loop, client, id, cb, arg, rdataset, sigrdataset, 10507 fetch); 10508 10509 if (new_fctx) { 10510 fetchctx_ref(fctx); 10511 isc_async_run(fctx->loop, fctx_start, fctx); 10512 } 10513 10514 unlock: 10515 if ((options & DNS_FETCHOPT_UNSHARED) == 0) { 10516 UNLOCK(&fctx->lock); 10517 fetchctx_unref(fctx); 10518 } 10519 10520 fail: 10521 if (result != ISC_R_SUCCESS) { 10522 dns_resolver_detach(&fetch->res); 10523 isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch)); 10524 return result; 10525 } 10526 10527 FTRACE("created"); 10528 *fetchp = fetch; 10529 10530 return ISC_R_SUCCESS; 10531 } 10532 10533 void 10534 dns_resolver_cancelfetch(dns_fetch_t *fetch) { 10535 fetchctx_t *fctx = NULL; 10536 10537 REQUIRE(DNS_FETCH_VALID(fetch)); 10538 fctx = fetch->private; 10539 REQUIRE(VALID_FCTX(fctx)); 10540 10541 FTRACE("cancelfetch"); 10542 10543 LOCK(&fctx->lock); 10544 10545 /* 10546 * Find the completion event associated with this fetch (as opposed 10547 * to those for other fetches that have joined the same fctx) and run 10548 * the callback asynchronously with a ISC_R_CANCELED result. 10549 */ 10550 if (fctx->state != fetchstate_done) { 10551 dns_fetchresponse_t *next = NULL; 10552 for (dns_fetchresponse_t *resp = ISC_LIST_HEAD(fctx->resps); 10553 resp != NULL; resp = next) 10554 { 10555 next = ISC_LIST_NEXT(resp, link); 10556 10557 if (resp->fetch == fetch) { 10558 resp->result = ISC_R_CANCELED; 10559 ISC_LIST_UNLINK(fctx->resps, resp, link); 10560 isc_async_run(resp->loop, resp->cb, resp); 10561 break; 10562 } 10563 } 10564 } 10565 10566 /* 10567 * The fctx continues running even if no fetches remain; 10568 * the answer is still cached. 10569 */ 10570 UNLOCK(&fctx->lock); 10571 } 10572 10573 void 10574 dns_resolver_destroyfetch(dns_fetch_t **fetchp) { 10575 dns_fetch_t *fetch = NULL; 10576 dns_resolver_t *res = NULL; 10577 fetchctx_t *fctx = NULL; 10578 10579 REQUIRE(fetchp != NULL); 10580 fetch = *fetchp; 10581 *fetchp = NULL; 10582 REQUIRE(DNS_FETCH_VALID(fetch)); 10583 fctx = fetch->private; 10584 REQUIRE(VALID_FCTX(fctx)); 10585 res = fetch->res; 10586 10587 FTRACE("destroyfetch"); 10588 10589 fetch->magic = 0; 10590 10591 LOCK(&fctx->lock); 10592 /* 10593 * Sanity check: the caller should have gotten its event before 10594 * trying to destroy the fetch. 10595 */ 10596 if (fctx->state != fetchstate_done) { 10597 dns_fetchresponse_t *resp = NULL, *next = NULL; 10598 for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL; 10599 resp = next) 10600 { 10601 next = ISC_LIST_NEXT(resp, link); 10602 RUNTIME_CHECK(resp->fetch != fetch); 10603 } 10604 } 10605 UNLOCK(&fctx->lock); 10606 10607 isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch)); 10608 10609 fetchctx_detach(&fctx); 10610 dns_resolver_detach(&res); 10611 } 10612 10613 void 10614 dns_resolver_logfetch(dns_fetch_t *fetch, isc_log_t *lctx, 10615 isc_logcategory_t *category, isc_logmodule_t *module, 10616 int level, bool duplicateok) { 10617 fetchctx_t *fctx = NULL; 10618 10619 REQUIRE(DNS_FETCH_VALID(fetch)); 10620 fctx = fetch->private; 10621 REQUIRE(VALID_FCTX(fctx)); 10622 10623 LOCK(&fctx->lock); 10624 10625 if (!fctx->logged || duplicateok) { 10626 char domainbuf[DNS_NAME_FORMATSIZE]; 10627 dns_name_format(fctx->domain, domainbuf, sizeof(domainbuf)); 10628 isc_log_write(lctx, category, module, level, 10629 "fetch completed for %s in " 10630 "%" PRIu64 "." 10631 "%06" PRIu64 ": %s/%s " 10632 "[domain:%s,referral:%u,restart:%u,qrysent:%u," 10633 "timeout:%u,lame:%u,quota:%u,neterr:%u," 10634 "badresp:%u,adberr:%u,findfail:%u,valfail:%u]", 10635 fctx->info, fctx->duration / US_PER_SEC, 10636 fctx->duration % US_PER_SEC, 10637 isc_result_totext(fctx->result), 10638 isc_result_totext(fctx->vresult), domainbuf, 10639 fctx->referrals, fctx->restarts, fctx->querysent, 10640 fctx->timeouts, fctx->lamecount, fctx->quotacount, 10641 fctx->neterr, fctx->badresp, fctx->adberr, 10642 fctx->findfail, fctx->valfail); 10643 fctx->logged = true; 10644 } 10645 10646 UNLOCK(&fctx->lock); 10647 } 10648 10649 dns_dispatch_t * 10650 dns_resolver_dispatchv4(dns_resolver_t *resolver) { 10651 REQUIRE(VALID_RESOLVER(resolver)); 10652 return dns_dispatchset_get(resolver->dispatches4); 10653 } 10654 10655 dns_dispatch_t * 10656 dns_resolver_dispatchv6(dns_resolver_t *resolver) { 10657 REQUIRE(VALID_RESOLVER(resolver)); 10658 return dns_dispatchset_get(resolver->dispatches6); 10659 } 10660 10661 void 10662 dns_resolver_addalternate(dns_resolver_t *res, const isc_sockaddr_t *alt, 10663 const dns_name_t *name, in_port_t port) { 10664 alternate_t *a; 10665 10666 REQUIRE(VALID_RESOLVER(res)); 10667 REQUIRE(!res->frozen); 10668 REQUIRE((alt == NULL) ^ (name == NULL)); 10669 10670 a = isc_mem_get(res->mctx, sizeof(*a)); 10671 if (alt != NULL) { 10672 a->isaddress = true; 10673 a->_u.addr = *alt; 10674 } else { 10675 a->isaddress = false; 10676 a->_u._n.port = port; 10677 dns_name_init(&a->_u._n.name, NULL); 10678 dns_name_dup(name, res->mctx, &a->_u._n.name); 10679 } 10680 ISC_LINK_INIT(a, link); 10681 ISC_LIST_APPEND(res->alternates, a, link); 10682 } 10683 10684 isc_result_t 10685 dns_resolver_disable_algorithm(dns_resolver_t *resolver, const dns_name_t *name, 10686 unsigned int alg) { 10687 REQUIRE(VALID_RESOLVER(resolver)); 10688 10689 if (alg > 255) { 10690 return ISC_R_RANGE; 10691 } 10692 10693 return dns_nametree_add(resolver->algorithms, name, alg); 10694 } 10695 10696 isc_result_t 10697 dns_resolver_disable_ds_digest(dns_resolver_t *resolver, const dns_name_t *name, 10698 unsigned int digest_type) { 10699 REQUIRE(VALID_RESOLVER(resolver)); 10700 10701 if (digest_type > 255) { 10702 return ISC_R_RANGE; 10703 } 10704 10705 return dns_nametree_add(resolver->digests, name, digest_type); 10706 } 10707 10708 bool 10709 dns_resolver_algorithm_supported(dns_resolver_t *resolver, 10710 const dns_name_t *name, unsigned int alg) { 10711 REQUIRE(VALID_RESOLVER(resolver)); 10712 10713 if ((alg == DST_ALG_DH) || (alg == DST_ALG_INDIRECT)) { 10714 return false; 10715 } 10716 10717 if (dns_nametree_covered(resolver->algorithms, name, NULL, alg)) { 10718 return false; 10719 } 10720 10721 return dst_algorithm_supported(alg); 10722 } 10723 10724 bool 10725 dns_resolver_ds_digest_supported(dns_resolver_t *resolver, 10726 const dns_name_t *name, 10727 unsigned int digest_type) { 10728 REQUIRE(VALID_RESOLVER(resolver)); 10729 10730 if (dns_nametree_covered(resolver->digests, name, NULL, digest_type)) { 10731 return false; 10732 } 10733 10734 return dst_ds_digest_supported(digest_type); 10735 } 10736 10737 isc_result_t 10738 dns_resolver_setmustbesecure(dns_resolver_t *resolver, const dns_name_t *name, 10739 bool value) { 10740 isc_result_t result; 10741 10742 REQUIRE(VALID_RESOLVER(resolver)); 10743 10744 result = dns_nametree_add(resolver->mustbesecure, name, value); 10745 return result; 10746 } 10747 10748 bool 10749 dns_resolver_getmustbesecure(dns_resolver_t *resolver, const dns_name_t *name) { 10750 REQUIRE(VALID_RESOLVER(resolver)); 10751 10752 return dns_nametree_covered(resolver->mustbesecure, name, NULL, 0); 10753 } 10754 10755 void 10756 dns_resolver_getclientsperquery(dns_resolver_t *resolver, uint32_t *cur, 10757 uint32_t *min, uint32_t *max) { 10758 REQUIRE(VALID_RESOLVER(resolver)); 10759 10760 LOCK(&resolver->lock); 10761 SET_IF_NOT_NULL(cur, resolver->spillat); 10762 SET_IF_NOT_NULL(min, resolver->spillatmin); 10763 SET_IF_NOT_NULL(max, resolver->spillatmax); 10764 UNLOCK(&resolver->lock); 10765 } 10766 10767 void 10768 dns_resolver_setclientsperquery(dns_resolver_t *resolver, uint32_t min, 10769 uint32_t max) { 10770 REQUIRE(VALID_RESOLVER(resolver)); 10771 10772 LOCK(&resolver->lock); 10773 resolver->spillatmin = resolver->spillat = min; 10774 resolver->spillatmax = max; 10775 UNLOCK(&resolver->lock); 10776 } 10777 10778 void 10779 dns_resolver_setfetchesperzone(dns_resolver_t *resolver, uint32_t clients) { 10780 REQUIRE(VALID_RESOLVER(resolver)); 10781 10782 atomic_store_release(&resolver->zspill, clients); 10783 } 10784 10785 uint32_t 10786 dns_resolver_getfetchesperzone(dns_resolver_t *resolver) { 10787 REQUIRE(VALID_RESOLVER(resolver)); 10788 10789 return atomic_load_relaxed(&resolver->zspill); 10790 } 10791 10792 bool 10793 dns_resolver_getzeronosoattl(dns_resolver_t *resolver) { 10794 REQUIRE(VALID_RESOLVER(resolver)); 10795 10796 return resolver->zero_no_soa_ttl; 10797 } 10798 10799 void 10800 dns_resolver_setzeronosoattl(dns_resolver_t *resolver, bool state) { 10801 REQUIRE(VALID_RESOLVER(resolver)); 10802 10803 resolver->zero_no_soa_ttl = state; 10804 } 10805 10806 unsigned int 10807 dns_resolver_getoptions(dns_resolver_t *resolver) { 10808 REQUIRE(VALID_RESOLVER(resolver)); 10809 10810 return resolver->options; 10811 } 10812 10813 unsigned int 10814 dns_resolver_gettimeout(dns_resolver_t *resolver) { 10815 REQUIRE(VALID_RESOLVER(resolver)); 10816 10817 return resolver->query_timeout; 10818 } 10819 10820 void 10821 dns_resolver_settimeout(dns_resolver_t *resolver, unsigned int timeout) { 10822 REQUIRE(VALID_RESOLVER(resolver)); 10823 10824 if (timeout < MINIMUM_QUERY_TIMEOUT) { 10825 timeout *= 1000; 10826 } 10827 10828 if (timeout == 0) { 10829 timeout = DEFAULT_QUERY_TIMEOUT; 10830 } 10831 if (timeout > MAXIMUM_QUERY_TIMEOUT) { 10832 timeout = MAXIMUM_QUERY_TIMEOUT; 10833 } 10834 if (timeout < MINIMUM_QUERY_TIMEOUT) { 10835 timeout = MINIMUM_QUERY_TIMEOUT; 10836 } 10837 10838 resolver->query_timeout = timeout; 10839 } 10840 10841 void 10842 dns_resolver_setmaxvalidations(dns_resolver_t *resolver, uint32_t max) { 10843 REQUIRE(VALID_RESOLVER(resolver)); 10844 atomic_store(&resolver->maxvalidations, max); 10845 } 10846 10847 void 10848 dns_resolver_setmaxvalidationfails(dns_resolver_t *resolver, uint32_t max) { 10849 REQUIRE(VALID_RESOLVER(resolver)); 10850 atomic_store(&resolver->maxvalidationfails, max); 10851 } 10852 10853 void 10854 dns_resolver_setmaxdepth(dns_resolver_t *resolver, unsigned int maxdepth) { 10855 REQUIRE(VALID_RESOLVER(resolver)); 10856 resolver->maxdepth = maxdepth; 10857 } 10858 10859 unsigned int 10860 dns_resolver_getmaxdepth(dns_resolver_t *resolver) { 10861 REQUIRE(VALID_RESOLVER(resolver)); 10862 return resolver->maxdepth; 10863 } 10864 10865 void 10866 dns_resolver_setmaxqueries(dns_resolver_t *resolver, unsigned int queries) { 10867 REQUIRE(VALID_RESOLVER(resolver)); 10868 resolver->maxqueries = queries; 10869 } 10870 10871 unsigned int 10872 dns_resolver_getmaxqueries(dns_resolver_t *resolver) { 10873 REQUIRE(VALID_RESOLVER(resolver)); 10874 return resolver->maxqueries; 10875 } 10876 10877 void 10878 dns_resolver_dumpfetches(dns_resolver_t *res, isc_statsformat_t format, 10879 FILE *fp) { 10880 isc_result_t result; 10881 isc_hashmap_iter_t *it = NULL; 10882 10883 REQUIRE(VALID_RESOLVER(res)); 10884 REQUIRE(fp != NULL); 10885 REQUIRE(format == isc_statsformat_file); 10886 10887 RWLOCK(&res->counters_lock, isc_rwlocktype_read); 10888 isc_hashmap_iter_create(res->counters, &it); 10889 for (result = isc_hashmap_iter_first(it); result == ISC_R_SUCCESS; 10890 result = isc_hashmap_iter_next(it)) 10891 { 10892 fctxcount_t *counter = NULL; 10893 isc_hashmap_iter_current(it, (void **)&counter); 10894 10895 dns_name_print(counter->domain, fp); 10896 fprintf(fp, 10897 ": %" PRIuFAST32 " active (%" PRIuFAST32 10898 " spilled, %" PRIuFAST32 " allowed)\n", 10899 counter->count, counter->dropped, counter->allowed); 10900 } 10901 RWUNLOCK(&res->counters_lock, isc_rwlocktype_read); 10902 isc_hashmap_iter_destroy(&it); 10903 } 10904 10905 isc_result_t 10906 dns_resolver_dumpquota(dns_resolver_t *res, isc_buffer_t **buf) { 10907 isc_result_t result; 10908 isc_hashmap_iter_t *it = NULL; 10909 uint_fast32_t spill; 10910 10911 REQUIRE(VALID_RESOLVER(res)); 10912 10913 spill = atomic_load_acquire(&res->zspill); 10914 if (spill == 0) { 10915 return ISC_R_SUCCESS; 10916 } 10917 10918 RWLOCK(&res->counters_lock, isc_rwlocktype_read); 10919 isc_hashmap_iter_create(res->counters, &it); 10920 for (result = isc_hashmap_iter_first(it); result == ISC_R_SUCCESS; 10921 result = isc_hashmap_iter_next(it)) 10922 { 10923 fctxcount_t *counter = NULL; 10924 uint_fast32_t count, dropped, allowed; 10925 char nb[DNS_NAME_FORMATSIZE]; 10926 char text[DNS_NAME_FORMATSIZE + BUFSIZ]; 10927 10928 isc_hashmap_iter_current(it, (void **)&counter); 10929 10930 LOCK(&counter->lock); 10931 count = counter->count; 10932 dropped = counter->dropped; 10933 allowed = counter->allowed; 10934 UNLOCK(&counter->lock); 10935 10936 if (count < spill) { 10937 continue; 10938 } 10939 10940 dns_name_format(counter->domain, nb, sizeof(nb)); 10941 snprintf(text, sizeof(text), 10942 "\n- %s: %" PRIuFAST32 " active (allowed %" PRIuFAST32 10943 " spilled %" PRIuFAST32 ")", 10944 nb, count, allowed, dropped); 10945 10946 result = isc_buffer_reserve(*buf, strlen(text)); 10947 if (result != ISC_R_SUCCESS) { 10948 goto cleanup; 10949 } 10950 isc_buffer_putstr(*buf, text); 10951 } 10952 if (result == ISC_R_NOMORE) { 10953 result = ISC_R_SUCCESS; 10954 } 10955 10956 cleanup: 10957 RWUNLOCK(&res->counters_lock, isc_rwlocktype_read); 10958 isc_hashmap_iter_destroy(&it); 10959 return result; 10960 } 10961 10962 void 10963 dns_resolver_setquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which, 10964 isc_result_t resp) { 10965 REQUIRE(VALID_RESOLVER(resolver)); 10966 REQUIRE(which == dns_quotatype_zone || which == dns_quotatype_server); 10967 REQUIRE(resp == DNS_R_DROP || resp == DNS_R_SERVFAIL); 10968 10969 resolver->quotaresp[which] = resp; 10970 } 10971 10972 isc_result_t 10973 dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which) { 10974 REQUIRE(VALID_RESOLVER(resolver)); 10975 REQUIRE(which == dns_quotatype_zone || which == dns_quotatype_server); 10976 10977 return resolver->quotaresp[which]; 10978 } 10979 10980 void 10981 dns_resolver_setstats(dns_resolver_t *res, isc_stats_t *stats) { 10982 REQUIRE(VALID_RESOLVER(res)); 10983 REQUIRE(res->stats == NULL); 10984 10985 isc_stats_attach(stats, &res->stats); 10986 10987 /* initialize the bucket "counter"; it's a static value */ 10988 set_stats(res, dns_resstatscounter_buckets, 10989 isc_loopmgr_nloops(res->loopmgr)); 10990 } 10991 10992 void 10993 dns_resolver_getstats(dns_resolver_t *res, isc_stats_t **statsp) { 10994 REQUIRE(VALID_RESOLVER(res)); 10995 REQUIRE(statsp != NULL && *statsp == NULL); 10996 10997 if (res->stats != NULL) { 10998 isc_stats_attach(res->stats, statsp); 10999 } 11000 } 11001 11002 void 11003 dns_resolver_incstats(dns_resolver_t *res, isc_statscounter_t counter) { 11004 REQUIRE(VALID_RESOLVER(res)); 11005 11006 isc_stats_increment(res->stats, counter); 11007 } 11008 11009 void 11010 dns_resolver_setquerystats(dns_resolver_t *res, dns_stats_t *stats) { 11011 REQUIRE(VALID_RESOLVER(res)); 11012 REQUIRE(res->querystats == NULL); 11013 11014 dns_stats_attach(stats, &res->querystats); 11015 } 11016 11017 void 11018 dns_resolver_getquerystats(dns_resolver_t *res, dns_stats_t **statsp) { 11019 REQUIRE(VALID_RESOLVER(res)); 11020 REQUIRE(statsp != NULL && *statsp == NULL); 11021 11022 if (res->querystats != NULL) { 11023 dns_stats_attach(res->querystats, statsp); 11024 } 11025 } 11026