1 /* 2 * query.c -- nsd(8) the resolver. 3 * 4 * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. 5 * 6 * See LICENSE for the license. 7 * 8 */ 9 10 #include "config.h" 11 12 #include <sys/types.h> 13 #include <sys/socket.h> 14 #include <netinet/in.h> 15 #include <arpa/inet.h> 16 #include <assert.h> 17 #include <ctype.h> 18 #include <errno.h> 19 #include <limits.h> 20 #include <netdb.h> 21 #include <stddef.h> 22 #include <stdio.h> 23 #include <stdlib.h> 24 #include <string.h> 25 #include <time.h> 26 #include <unistd.h> 27 #include <netdb.h> 28 29 #include "answer.h" 30 #include "axfr.h" 31 #include "dns.h" 32 #include "dname.h" 33 #include "nsd.h" 34 #include "namedb.h" 35 #include "query.h" 36 #include "util.h" 37 #include "options.h" 38 #include "nsec3.h" 39 #include "tsig.h" 40 41 /* [Bug #253] Adding unnecessary NS RRset may lead to undesired truncation. 42 * This function determines if the final response packet needs the NS RRset 43 * included. Currently, it will only return negative if QTYPE == DNSKEY|DS. 44 * This way, resolvers won't fallback to TCP unnecessarily when priming 45 * trust anchors. 46 */ 47 static int answer_needs_ns(struct query *query); 48 49 static int add_rrset(struct query *query, 50 answer_type *answer, 51 rr_section_type section, 52 domain_type *owner, 53 rrset_type *rrset); 54 55 static void answer_authoritative(struct nsd *nsd, 56 struct query *q, 57 answer_type *answer, 58 uint32_t domain_number, 59 int exact, 60 domain_type *closest_match, 61 domain_type *closest_encloser, 62 const dname_type *qname); 63 64 static void answer_lookup_zone(struct nsd *nsd, struct query *q, 65 answer_type *answer, uint32_t domain_number, 66 int exact, domain_type *closest_match, 67 domain_type *closest_encloser, 68 const dname_type *qname); 69 70 void 71 query_put_dname_offset(struct query *q, domain_type *domain, uint16_t offset) 72 { 73 assert(q); 74 assert(domain); 75 assert(domain->number > 0); 76 77 if (offset > MAX_COMPRESSION_OFFSET) 78 return; 79 if (q->compressed_dname_count >= MAX_COMPRESSED_DNAMES) 80 return; 81 82 q->compressed_dname_offsets[domain->number] = offset; 83 q->compressed_dnames[q->compressed_dname_count] = domain; 84 ++q->compressed_dname_count; 85 } 86 87 void 88 query_clear_dname_offsets(struct query *q, size_t max_offset) 89 { 90 while (q->compressed_dname_count > 0 91 && (q->compressed_dname_offsets[q->compressed_dnames[q->compressed_dname_count - 1]->number] 92 >= max_offset)) 93 { 94 q->compressed_dname_offsets[q->compressed_dnames[q->compressed_dname_count - 1]->number] = 0; 95 --q->compressed_dname_count; 96 } 97 } 98 99 void 100 query_clear_compression_tables(struct query *q) 101 { 102 uint16_t i; 103 104 for (i = 0; i < q->compressed_dname_count; ++i) { 105 assert(q->compressed_dnames); 106 q->compressed_dname_offsets[q->compressed_dnames[i]->number] = 0; 107 } 108 q->compressed_dname_count = 0; 109 } 110 111 void 112 query_add_compression_domain(struct query *q, domain_type *domain, uint16_t offset) 113 { 114 while (domain->parent) { 115 DEBUG(DEBUG_NAME_COMPRESSION, 2, 116 (LOG_INFO, "query dname: %s, number: %lu, offset: %u\n", 117 dname_to_string(domain_dname(domain), NULL), 118 (unsigned long) domain->number, 119 offset)); 120 query_put_dname_offset(q, domain, offset); 121 offset += label_length(dname_name(domain_dname(domain))) + 1; 122 domain = domain->parent; 123 } 124 } 125 126 /* 127 * Generate an error response with the specified RCODE. 128 */ 129 query_state_type 130 query_error (struct query *q, nsd_rc_type rcode) 131 { 132 if (rcode == NSD_RC_DISCARD) { 133 return QUERY_DISCARDED; 134 } 135 136 buffer_clear(q->packet); 137 138 QR_SET(q->packet); /* This is an answer. */ 139 RCODE_SET(q->packet, (int) rcode); /* Error code. */ 140 141 /* Truncate the question as well... */ 142 QDCOUNT_SET(q->packet, 0); 143 ANCOUNT_SET(q->packet, 0); 144 NSCOUNT_SET(q->packet, 0); 145 ARCOUNT_SET(q->packet, 0); 146 buffer_set_position(q->packet, QHEADERSZ); 147 return QUERY_PROCESSED; 148 } 149 150 static query_state_type 151 query_formerr (struct query *query) 152 { 153 int opcode = OPCODE(query->packet); 154 FLAGS_SET(query->packet, FLAGS(query->packet) & 0x0100U); 155 /* Preserve the RD flag. Clear the rest. */ 156 OPCODE_SET(query->packet, opcode); 157 return query_error(query, NSD_RC_FORMAT); 158 } 159 160 static void 161 query_cleanup(void *data) 162 { 163 query_type *query = (query_type *) data; 164 region_destroy(query->region); 165 } 166 167 query_type * 168 query_create(region_type *region, uint16_t *compressed_dname_offsets, 169 uint32_t compressed_dname_size) 170 { 171 query_type *query 172 = (query_type *) region_alloc_zero(region, sizeof(query_type)); 173 /* create region with large block size, because the initial chunk 174 saves many mallocs in the server */ 175 query->region = region_create_custom(xalloc, free, 16384, 16384/8, 32, 0); 176 query->compressed_dname_offsets = compressed_dname_offsets; 177 query->packet = buffer_create(region, QIOBUFSZ); 178 region_add_cleanup(region, query_cleanup, query); 179 query->compressed_dname_offsets_size = compressed_dname_size; 180 tsig_create_record(&query->tsig, region); 181 query->tsig_prepare_it = 1; 182 query->tsig_update_it = 1; 183 query->tsig_sign_it = 1; 184 return query; 185 } 186 187 void 188 query_reset(query_type *q, size_t maxlen, int is_tcp) 189 { 190 /* 191 * As long as less than 4Kb (region block size) has been used, 192 * this call to free_all is free, the block is saved for re-use, 193 * so no malloc() or free() calls are done. 194 * at present use of the region is for: 195 * o query qname dname_type (255 max). 196 * o wildcard expansion domain_type (7*ptr+u32+2bytes)+(5*ptr nsec3) 197 * o wildcard expansion for additional section domain_type. 198 * o nsec3 hashed name(s) (3 dnames for a nonexist_proof, 199 * one proof per wildcard and for nx domain). 200 */ 201 region_free_all(q->region); 202 q->addrlen = sizeof(q->addr); 203 q->maxlen = maxlen; 204 q->reserved_space = 0; 205 buffer_clear(q->packet); 206 edns_init_record(&q->edns); 207 tsig_init_record(&q->tsig, NULL, NULL); 208 q->tsig_prepare_it = 1; 209 q->tsig_update_it = 1; 210 q->tsig_sign_it = 1; 211 q->tcp = is_tcp; 212 q->qname = NULL; 213 q->qtype = 0; 214 q->qclass = 0; 215 q->zone = NULL; 216 q->domain = NULL; 217 q->opcode = 0; 218 q->cname_count = 0; 219 q->delegation_domain = NULL; 220 q->delegation_rrset = NULL; 221 q->compressed_dname_count = 0; 222 q->number_temporary_domains = 0; 223 224 q->axfr_is_done = 0; 225 q->axfr_zone = NULL; 226 q->axfr_current_domain = NULL; 227 q->axfr_current_rrset = NULL; 228 q->axfr_current_rr = 0; 229 } 230 231 /* get a temporary domain number (or 0=failure) */ 232 static domain_type* 233 query_get_tempdomain(struct query *q) 234 { 235 static domain_type d[EXTRA_DOMAIN_NUMBERS]; 236 if(q->number_temporary_domains >= EXTRA_DOMAIN_NUMBERS) 237 return 0; 238 q->number_temporary_domains ++; 239 memset(&d[q->number_temporary_domains-1], 0, sizeof(domain_type)); 240 d[q->number_temporary_domains-1].number = q->compressed_dname_offsets_size + 241 q->number_temporary_domains - 1; 242 return &d[q->number_temporary_domains-1]; 243 } 244 245 static void 246 query_addtxt(struct query *q, 247 const uint8_t *dname, 248 uint16_t klass, 249 uint32_t ttl, 250 const char *txt) 251 { 252 size_t txt_length = strlen(txt); 253 uint8_t len = (uint8_t) txt_length; 254 255 assert(txt_length <= UCHAR_MAX); 256 257 /* Add the dname */ 258 if (dname >= buffer_begin(q->packet) 259 && dname <= buffer_current(q->packet)) 260 { 261 buffer_write_u16(q->packet, 262 0xc000 | (dname - buffer_begin(q->packet))); 263 } else { 264 buffer_write(q->packet, dname + 1, *dname); 265 } 266 267 buffer_write_u16(q->packet, TYPE_TXT); 268 buffer_write_u16(q->packet, klass); 269 buffer_write_u32(q->packet, ttl); 270 buffer_write_u16(q->packet, len + 1); 271 buffer_write_u8(q->packet, len); 272 buffer_write(q->packet, txt, len); 273 } 274 275 /* 276 * Parse the question section of a query. The normalized query name 277 * is stored in QUERY->name, the class in QUERY->klass, and the type 278 * in QUERY->type. 279 */ 280 static int 281 process_query_section(query_type *query) 282 { 283 uint8_t qnamebuf[MAXDOMAINLEN]; 284 285 buffer_set_position(query->packet, QHEADERSZ); 286 /* Lets parse the query name and convert it to lower case. */ 287 if(!packet_read_query_section(query->packet, qnamebuf, 288 &query->qtype, &query->qclass)) 289 return 0; 290 query->qname = dname_make(query->region, qnamebuf, 1); 291 query->opcode = OPCODE(query->packet); 292 return 1; 293 } 294 295 296 /* 297 * Process an optional EDNS OPT record. Sets QUERY->EDNS to 0 if 298 * there was no EDNS record, to -1 if there was an invalid or 299 * unsupported EDNS record, and to 1 otherwise. Updates QUERY->MAXLEN 300 * if the EDNS record specifies a maximum supported response length. 301 * 302 * Return NSD_RC_FORMAT on failure, NSD_RC_OK on success. 303 */ 304 static nsd_rc_type 305 process_edns(nsd_type* nsd, struct query *q) 306 { 307 if (q->edns.status == EDNS_ERROR) { 308 /* The only error is VERSION not implemented */ 309 return NSD_RC_FORMAT; 310 } 311 312 if (q->edns.status == EDNS_OK) { 313 /* Only care about UDP size larger than normal... */ 314 if (!q->tcp && q->edns.maxlen > UDP_MAX_MESSAGE_LEN) { 315 size_t edns_size; 316 #if defined(INET6) 317 if (q->addr.ss_family == AF_INET6) { 318 edns_size = nsd->ipv6_edns_size; 319 } else 320 #endif 321 edns_size = nsd->ipv4_edns_size; 322 323 if (q->edns.maxlen < edns_size) { 324 q->maxlen = q->edns.maxlen; 325 } else { 326 q->maxlen = edns_size; 327 } 328 329 #if defined(INET6) && !defined(IPV6_USE_MIN_MTU) && !defined(IPV6_MTU) 330 /* 331 * Use IPv6 minimum MTU to avoid sending 332 * packets that are too large for some links. 333 * IPv6 will not automatically fragment in 334 * this case (unlike IPv4). 335 */ 336 if (q->addr.ss_family == AF_INET6 337 && q->maxlen > IPV6_MIN_MTU) 338 { 339 q->maxlen = IPV6_MIN_MTU; 340 } 341 #endif 342 } 343 344 /* Strip the OPT resource record off... */ 345 buffer_set_position(q->packet, q->edns.position); 346 buffer_set_limit(q->packet, q->edns.position); 347 ARCOUNT_SET(q->packet, ARCOUNT(q->packet) - 1); 348 } 349 return NSD_RC_OK; 350 } 351 352 /* 353 * Processes TSIG. 354 * Sets error when tsig does not verify on the query. 355 */ 356 static nsd_rc_type 357 process_tsig(struct query* q) 358 { 359 if(q->tsig.status == TSIG_ERROR) 360 return NSD_RC_FORMAT; 361 if(q->tsig.status == TSIG_OK) { 362 if(!tsig_from_query(&q->tsig)) { 363 log_msg(LOG_ERR, "query tsig unknown key/algorithm"); 364 return NSD_RC_REFUSE; 365 } 366 buffer_set_limit(q->packet, q->tsig.position); 367 ARCOUNT_SET(q->packet, ARCOUNT(q->packet) - 1); 368 tsig_prepare(&q->tsig); 369 tsig_update(&q->tsig, q->packet, buffer_limit(q->packet)); 370 if(!tsig_verify(&q->tsig)) { 371 log_msg(LOG_ERR, "query: bad tsig signature for key %s", 372 dname_to_string(q->tsig.key->name, NULL)); 373 return NSD_RC_REFUSE; 374 } 375 DEBUG(DEBUG_XFRD,1, (LOG_INFO, "query good tsig signature for %s", 376 dname_to_string(q->tsig.key->name, NULL))); 377 } 378 return NSD_RC_OK; 379 } 380 381 /* 382 * Check notify acl and forward to xfrd (or return an error). 383 */ 384 static query_state_type 385 answer_notify(struct nsd* nsd, struct query *query) 386 { 387 int acl_num; 388 acl_options_t *why; 389 nsd_rc_type rc; 390 391 zone_options_t* zone_opt; 392 DEBUG(DEBUG_XFRD,1, (LOG_INFO, "got notify %s processing acl", 393 dname_to_string(query->qname, NULL))); 394 395 zone_opt = zone_options_find(nsd->options, query->qname); 396 if(!zone_opt) 397 return query_error(query, NSD_RC_NXDOMAIN); 398 399 if(!nsd->this_child) /* we are in debug mode or something */ 400 return query_error(query, NSD_RC_SERVFAIL); 401 402 if(!tsig_find_rr(&query->tsig, query->packet)) { 403 DEBUG(DEBUG_XFRD,2, (LOG_ERR, "bad tsig RR format")); 404 return query_error(query, NSD_RC_FORMAT); 405 } 406 rc = process_tsig(query); 407 if(rc != NSD_RC_OK) 408 return query_error(query, rc); 409 410 /* check if it passes acl */ 411 if((acl_num = acl_check_incoming(zone_opt->allow_notify, query, 412 &why)) != -1) 413 { 414 sig_atomic_t mode = NSD_PASS_TO_XFRD; 415 int s = nsd->this_child->parent_fd; 416 uint16_t sz; 417 uint32_t acl_send = htonl(acl_num); 418 size_t pos; 419 assert(why); 420 DEBUG(DEBUG_XFRD,1, (LOG_INFO, "got notify %s passed acl %s %s", 421 dname_to_string(query->qname, NULL), 422 why->ip_address_spec, 423 why->nokey?"NOKEY": 424 (why->blocked?"BLOCKED":why->key_name))); 425 sz = buffer_limit(query->packet); 426 if(buffer_limit(query->packet) > MAX_PACKET_SIZE) 427 return query_error(query, NSD_RC_SERVFAIL); 428 /* forward to xfrd for processing 429 Note. Blocking IPC I/O, but acl is OK. */ 430 sz = htons(sz); 431 if(!write_socket(s, &mode, sizeof(mode)) || 432 !write_socket(s, &sz, sizeof(sz)) || 433 !write_socket(s, buffer_begin(query->packet), 434 buffer_limit(query->packet)) || 435 !write_socket(s, &acl_send, sizeof(acl_send))) { 436 log_msg(LOG_ERR, "error in IPC notify server2main, %s", 437 strerror(errno)); 438 return query_error(query, NSD_RC_SERVFAIL); 439 } 440 441 /* create notify reply - keep same query contents */ 442 QR_SET(query->packet); /* This is an answer. */ 443 AA_SET(query->packet); /* we are authoritative. */ 444 ANCOUNT_SET(query->packet, 0); 445 NSCOUNT_SET(query->packet, 0); 446 ARCOUNT_SET(query->packet, 0); 447 RCODE_SET(query->packet, RCODE_OK); /* Error code. */ 448 /* position is right after the query */ 449 pos = buffer_position(query->packet); 450 buffer_clear(query->packet); 451 buffer_set_position(query->packet, pos); 452 VERBOSITY(2, (LOG_INFO, "Notify received and accepted, forward to xfrd")); 453 /* tsig is added in add_additional later (if needed) */ 454 return QUERY_PROCESSED; 455 } 456 457 if (verbosity > 1) { 458 char address[128]; 459 if (addr2ip(query->addr, address, sizeof(address))) { 460 DEBUG(DEBUG_XFRD,1, (LOG_INFO, "addr2ip failed")); 461 strlcpy(address, "[unknown]", sizeof(address)); 462 } 463 464 VERBOSITY(1, (LOG_INFO, "notify for zone %s from client %s refused, %s%s", 465 dname_to_string(query->qname, NULL), 466 address, 467 why?why->key_name:"no acl matches", 468 why?why->ip_address_spec:".")); 469 } 470 471 return query_error(query, NSD_RC_REFUSE); 472 } 473 474 475 /* 476 * Answer a query in the CHAOS class. 477 */ 478 static query_state_type 479 answer_chaos(struct nsd *nsd, query_type *q) 480 { 481 AA_CLR(q->packet); 482 switch (q->qtype) { 483 case TYPE_ANY: 484 case TYPE_TXT: 485 if ((q->qname->name_size == 11 486 && memcmp(dname_name(q->qname), "\002id\006server", 11) == 0) || 487 (q->qname->name_size == 15 488 && memcmp(dname_name(q->qname), "\010hostname\004bind", 15) == 0)) 489 { 490 /* Add ID */ 491 query_addtxt(q, 492 buffer_begin(q->packet) + QHEADERSZ, 493 CLASS_CH, 494 0, 495 nsd->identity); 496 ANCOUNT_SET(q->packet, ANCOUNT(q->packet) + 1); 497 } else if ((q->qname->name_size == 16 498 && memcmp(dname_name(q->qname), "\007version\006server", 16) == 0) || 499 (q->qname->name_size == 14 500 && memcmp(dname_name(q->qname), "\007version\004bind", 14) == 0)) 501 { 502 if(!nsd->options->hide_version) { 503 /* Add version */ 504 query_addtxt(q, 505 buffer_begin(q->packet) + QHEADERSZ, 506 CLASS_CH, 507 0, 508 nsd->version); 509 ANCOUNT_SET(q->packet, ANCOUNT(q->packet) + 1); 510 } else { 511 RCODE_SET(q->packet, RCODE_REFUSE); 512 } 513 } 514 break; 515 default: 516 RCODE_SET(q->packet, RCODE_REFUSE); 517 break; 518 } 519 520 return QUERY_PROCESSED; 521 } 522 523 524 /* 525 * Find the covering NSEC for a non-existent domain name. Normally 526 * the NSEC will be located at CLOSEST_MATCH, except when it is an 527 * empty non-terminal. In this case the NSEC may be located at the 528 * previous domain name (in canonical ordering). 529 */ 530 static domain_type * 531 find_covering_nsec(domain_type *closest_match, 532 zone_type *zone, 533 rrset_type **nsec_rrset) 534 { 535 assert(closest_match); 536 assert(nsec_rrset); 537 538 /* loop away temporary created domains. For real ones it is &RBTREE_NULL */ 539 while (closest_match->node.parent == NULL) 540 closest_match = closest_match->parent; 541 while (closest_match) { 542 *nsec_rrset = domain_find_rrset(closest_match, zone, TYPE_NSEC); 543 if (*nsec_rrset) { 544 return closest_match; 545 } 546 if (closest_match == zone->apex) { 547 /* Don't look outside the current zone. */ 548 return NULL; 549 } 550 closest_match = domain_previous(closest_match); 551 } 552 return NULL; 553 } 554 555 556 struct additional_rr_types 557 { 558 uint16_t rr_type; 559 rr_section_type rr_section; 560 }; 561 562 struct additional_rr_types default_additional_rr_types[] = { 563 { TYPE_A, ADDITIONAL_A_SECTION }, 564 { TYPE_AAAA, ADDITIONAL_AAAA_SECTION }, 565 { 0, (rr_section_type) 0 } 566 }; 567 568 struct additional_rr_types rt_additional_rr_types[] = { 569 { TYPE_A, ADDITIONAL_A_SECTION }, 570 { TYPE_AAAA, ADDITIONAL_AAAA_SECTION }, 571 { TYPE_X25, ADDITIONAL_OTHER_SECTION }, 572 { TYPE_ISDN, ADDITIONAL_OTHER_SECTION }, 573 { 0, (rr_section_type) 0 } 574 }; 575 576 static void 577 add_additional_rrsets(struct query *query, answer_type *answer, 578 rrset_type *master_rrset, size_t rdata_index, 579 int allow_glue, struct additional_rr_types types[]) 580 { 581 size_t i; 582 583 assert(query); 584 assert(answer); 585 assert(master_rrset); 586 assert(rdata_atom_is_domain(rrset_rrtype(master_rrset), rdata_index)); 587 588 for (i = 0; i < master_rrset->rr_count; ++i) { 589 int j; 590 domain_type *additional = rdata_atom_domain(master_rrset->rrs[i].rdatas[rdata_index]); 591 domain_type *match = additional; 592 593 assert(additional); 594 595 if (!allow_glue && domain_is_glue(match, query->zone)) 596 continue; 597 598 /* 599 * Check to see if we need to generate the dependent 600 * based on a wildcard domain. 601 */ 602 while (!match->is_existing) { 603 match = match->parent; 604 } 605 if (additional != match && domain_wildcard_child(match)) { 606 domain_type *wildcard_child = domain_wildcard_child(match); 607 domain_type *temp = (domain_type *) region_alloc( 608 query->region, sizeof(domain_type)); 609 memcpy(&temp->node, &additional->node, sizeof(rbnode_t)); 610 temp->number = additional->number; 611 temp->parent = match; 612 temp->wildcard_child_closest_match = temp; 613 temp->rrsets = wildcard_child->rrsets; 614 temp->is_existing = wildcard_child->is_existing; 615 additional = temp; 616 } 617 618 for (j = 0; types[j].rr_type != 0; ++j) { 619 rrset_type *rrset = domain_find_rrset( 620 additional, query->zone, types[j].rr_type); 621 if (rrset) { 622 answer_add_rrset(answer, types[j].rr_section, 623 additional, rrset); 624 } 625 } 626 } 627 } 628 629 static int 630 answer_needs_ns(struct query* query) 631 { 632 assert(query); 633 /* Currently, only troublesome for DNSKEY and DS, 634 * cuz their RRSETs are quite large. */ 635 return (query->qtype != TYPE_DNSKEY && query->qtype != TYPE_DS); 636 } 637 638 static int 639 add_rrset(struct query *query, 640 answer_type *answer, 641 rr_section_type section, 642 domain_type *owner, 643 rrset_type *rrset) 644 { 645 int result; 646 647 assert(query); 648 assert(answer); 649 assert(owner); 650 assert(rrset); 651 assert(rrset_rrclass(rrset) == CLASS_IN); 652 653 result = answer_add_rrset(answer, section, owner, rrset); 654 switch (rrset_rrtype(rrset)) { 655 case TYPE_NS: 656 add_additional_rrsets(query, answer, rrset, 0, 1, 657 default_additional_rr_types); 658 break; 659 case TYPE_MB: 660 add_additional_rrsets(query, answer, rrset, 0, 0, 661 default_additional_rr_types); 662 break; 663 case TYPE_MX: 664 case TYPE_KX: 665 add_additional_rrsets(query, answer, rrset, 1, 0, 666 default_additional_rr_types); 667 break; 668 case TYPE_RT: 669 add_additional_rrsets(query, answer, rrset, 1, 0, 670 rt_additional_rr_types); 671 break; 672 default: 673 break; 674 } 675 676 return result; 677 } 678 679 680 /* returns 0 on error, or the domain number for to_name. 681 from_name is changes to to_name by the DNAME rr. 682 DNAME rr is from src to dest. 683 closest encloser encloses the to_name. */ 684 static uint32_t 685 query_synthesize_cname(struct query* q, struct answer* answer, const dname_type* from_name, 686 const dname_type* to_name, domain_type* src, domain_type* to_closest_encloser, 687 domain_type** to_closest_match) 688 { 689 /* add temporary domains for from_name and to_name and all 690 their (not allocated yet) parents */ 691 /* any domains below src are not_existing (because of DNAME at src) */ 692 int i; 693 domain_type* cname_domain; 694 domain_type* cname_dest; 695 rrset_type* rrset; 696 697 /* allocate source part */ 698 domain_type* lastparent = src; 699 assert(q && answer && from_name && to_name && src && to_closest_encloser); 700 assert(to_closest_match); 701 for(i=0; i < from_name->label_count - domain_dname(src)->label_count; i++) 702 { 703 domain_type* newdom = query_get_tempdomain(q); 704 if(!newdom) 705 return 0; 706 newdom->is_existing = 1; 707 newdom->parent = lastparent; 708 newdom->node.key = dname_partial_copy(q->region, 709 from_name, domain_dname(src)->label_count + i + 1); 710 if(dname_compare(domain_dname(newdom), q->qname) == 0) { 711 /* 0 good for query name, otherwise new number */ 712 newdom->number = 0; 713 } 714 DEBUG(DEBUG_QUERY,2, (LOG_INFO, "created temp domain src %d. %s nr %d", i, 715 dname_to_string(domain_dname(newdom), NULL), 716 newdom->number)); 717 lastparent = newdom; 718 } 719 cname_domain = lastparent; 720 721 /* allocate dest part */ 722 lastparent = to_closest_encloser; 723 for(i=0; i < to_name->label_count - domain_dname(to_closest_encloser)->label_count; 724 i++) 725 { 726 domain_type* newdom = query_get_tempdomain(q); 727 if(!newdom) 728 return 0; 729 newdom->is_existing = 0; 730 newdom->parent = lastparent; 731 newdom->node.key = dname_partial_copy(q->region, 732 to_name, domain_dname(to_closest_encloser)->label_count + i + 1); 733 DEBUG(DEBUG_QUERY,2, (LOG_INFO, "created temp domain dest %d. %s nr %d", i, 734 dname_to_string(domain_dname(newdom), NULL), 735 newdom->number)); 736 lastparent = newdom; 737 } 738 cname_dest = lastparent; 739 *to_closest_match = cname_dest; 740 741 /* allocate the CNAME RR */ 742 rrset = (rrset_type*) region_alloc(q->region, sizeof(rrset_type)); 743 memset(rrset, 0, sizeof(rrset_type)); 744 rrset->zone = q->zone; 745 rrset->rr_count = 1; 746 rrset->rrs = (rr_type*) region_alloc(q->region, sizeof(rr_type)); 747 memset(rrset->rrs, 0, sizeof(rr_type)); 748 rrset->rrs->owner = cname_domain; 749 rrset->rrs->ttl = 0; 750 rrset->rrs->type = TYPE_CNAME; 751 rrset->rrs->klass = CLASS_IN; 752 rrset->rrs->rdata_count = 1; 753 rrset->rrs->rdatas = (rdata_atom_type*)region_alloc(q->region, 754 sizeof(rdata_atom_type)); 755 rrset->rrs->rdatas->domain = cname_dest; 756 757 if(!add_rrset(q, answer, ANSWER_SECTION, cname_domain, rrset)) { 758 log_msg(LOG_ERR, "could not add synthesized CNAME rrset to packet"); 759 } 760 761 return cname_dest->number; 762 } 763 764 /* 765 * Answer delegation information. 766 * 767 * DNSSEC: Include the DS RRset if present. Otherwise include an NSEC 768 * record proving the DS RRset does not exist. 769 */ 770 static void 771 answer_delegation(query_type *query, answer_type *answer) 772 { 773 assert(answer); 774 assert(query->delegation_domain); 775 assert(query->delegation_rrset); 776 777 if (query->cname_count == 0) { 778 AA_CLR(query->packet); 779 } else { 780 AA_SET(query->packet); 781 } 782 783 add_rrset(query, 784 answer, 785 AUTHORITY_SECTION, 786 query->delegation_domain, 787 query->delegation_rrset); 788 if (query->edns.dnssec_ok && zone_is_secure(query->zone)) { 789 rrset_type *rrset; 790 if ((rrset = domain_find_rrset(query->delegation_domain, query->zone, TYPE_DS))) { 791 add_rrset(query, answer, AUTHORITY_SECTION, 792 query->delegation_domain, rrset); 793 #ifdef NSEC3 794 } else if (query->zone->nsec3_soa_rr) { 795 nsec3_answer_delegation(query, answer); 796 #endif 797 } else if ((rrset = domain_find_rrset(query->delegation_domain, query->zone, TYPE_NSEC))) { 798 add_rrset(query, answer, AUTHORITY_SECTION, 799 query->delegation_domain, rrset); 800 } 801 } 802 query->domain = query->delegation_domain; 803 } 804 805 806 /* 807 * Answer SOA information. 808 */ 809 static void 810 answer_soa(struct query *query, answer_type *answer) 811 { 812 query->domain = query->zone->apex; 813 814 if (query->qclass != CLASS_ANY) { 815 add_rrset(query, answer, 816 AUTHORITY_SECTION, 817 query->zone->apex, 818 query->zone->soa_nx_rrset); 819 } 820 } 821 822 823 /* 824 * Answer that the domain name exists but there is no RRset with the 825 * requested type. 826 * 827 * DNSSEC: Include the correct NSEC record proving that the type does 828 * not exist. In the wildcard no data (3.1.3.4) case the wildcard IS 829 * NOT expanded, so the ORIGINAL parameter must point to the original 830 * wildcard entry, not to the generated entry. 831 */ 832 static void 833 answer_nodata(struct query *query, answer_type *answer, domain_type *original) 834 { 835 if (query->cname_count == 0) { 836 answer_soa(query, answer); 837 } 838 839 #ifdef NSEC3 840 if (query->edns.dnssec_ok && query->zone->nsec3_soa_rr) { 841 nsec3_answer_nodata(query, answer, original); 842 } else 843 #endif 844 if (query->edns.dnssec_ok && zone_is_secure(query->zone)) { 845 domain_type *nsec_domain; 846 rrset_type *nsec_rrset; 847 848 nsec_domain = find_covering_nsec(original, query->zone, &nsec_rrset); 849 if (nsec_domain) { 850 add_rrset(query, answer, AUTHORITY_SECTION, nsec_domain, nsec_rrset); 851 } 852 } 853 } 854 855 static void 856 answer_nxdomain(query_type *query, answer_type *answer) 857 { 858 if (query->cname_count == 0) { 859 RCODE_SET(query->packet, RCODE_NXDOMAIN); 860 answer_soa(query, answer); 861 } 862 } 863 864 865 /* 866 * Answer domain information (or SOA if we do not have an RRset for 867 * the type specified by the query). 868 */ 869 static void 870 answer_domain(struct nsd* nsd, struct query *q, answer_type *answer, 871 domain_type *domain, domain_type *original) 872 { 873 rrset_type *rrset; 874 875 if (q->qtype == TYPE_ANY) { 876 int added = 0; 877 for (rrset = domain_find_any_rrset(domain, q->zone); rrset; rrset = rrset->next) { 878 if (rrset->zone == q->zone 879 #ifdef NSEC3 880 && rrset_rrtype(rrset) != TYPE_NSEC3 881 #endif 882 /* 883 * Don't include the RRSIG RRset when 884 * DNSSEC is used, because it is added 885 * automatically on an per-RRset basis. 886 */ 887 && !(q->edns.dnssec_ok 888 && zone_is_secure(q->zone) 889 && rrset_rrtype(rrset) == TYPE_RRSIG)) 890 { 891 add_rrset(q, answer, ANSWER_SECTION, domain, rrset); 892 ++added; 893 } 894 } 895 if (added == 0) { 896 answer_nodata(q, answer, original); 897 return; 898 } 899 #ifdef NSEC3 900 } else if (q->qtype == TYPE_NSEC3) { 901 answer_nodata(q, answer, original); 902 return; 903 #endif 904 } else if ((rrset = domain_find_rrset(domain, q->zone, q->qtype))) { 905 add_rrset(q, answer, ANSWER_SECTION, domain, rrset); 906 } else if ((rrset = domain_find_rrset(domain, q->zone, TYPE_CNAME))) { 907 int added; 908 909 /* 910 * If the CNAME is not added it is already in the 911 * answer, so we have a CNAME loop. Don't follow the 912 * CNAME target in this case. 913 */ 914 added = add_rrset(q, answer, ANSWER_SECTION, domain, rrset); 915 assert(rrset->rr_count > 0); 916 if (added) { 917 /* only process first CNAME record */ 918 domain_type *closest_match = rdata_atom_domain(rrset->rrs[0].rdatas[0]); 919 domain_type *closest_encloser = closest_match; 920 zone_type* origzone = q->zone; 921 ++q->cname_count; 922 923 while (!closest_encloser->is_existing) 924 closest_encloser = closest_encloser->parent; 925 926 answer_lookup_zone(nsd, q, answer, closest_match->number, 927 closest_match == closest_encloser, 928 closest_match, closest_encloser, 929 domain_dname(closest_match)); 930 q->zone = origzone; 931 } 932 /* example 6.2.7 shows no NS-set from zone in auth (RFC1034) */ 933 q->domain = domain; 934 return; 935 } else { 936 answer_nodata(q, answer, original); 937 return; 938 } 939 940 q->domain = domain; 941 942 if (q->qclass != CLASS_ANY && q->zone->ns_rrset && answer_needs_ns(q)) { 943 add_rrset(q, answer, OPTIONAL_AUTHORITY_SECTION, q->zone->apex, 944 q->zone->ns_rrset); 945 } 946 } 947 948 949 /* 950 * Answer with authoritative data. If a wildcard is matched the owner 951 * name will be expanded to the domain name specified by 952 * DOMAIN_NUMBER. DOMAIN_NUMBER 0 (zero) is reserved for the original 953 * query name. 954 * 955 * DNSSEC: Include the necessary NSEC records in case the request 956 * domain name does not exist and/or a wildcard match does not exist. 957 */ 958 static void 959 answer_authoritative(struct nsd *nsd, 960 struct query *q, 961 answer_type *answer, 962 uint32_t domain_number, 963 int exact, 964 domain_type *closest_match, 965 domain_type *closest_encloser, 966 const dname_type *qname) 967 { 968 domain_type *match; 969 domain_type *original = closest_match; 970 rrset_type *rrset; 971 972 #ifdef NSEC3 973 if(exact && domain_has_only_NSEC3(closest_match, q->zone)) { 974 exact = 0; /* pretend it does not exist */ 975 if(closest_encloser->parent) 976 closest_encloser = closest_encloser->parent; 977 } 978 #endif /* NSEC3 */ 979 980 if (exact) { 981 match = closest_match; 982 } else if ((rrset=domain_find_rrset(closest_encloser, q->zone, TYPE_DNAME))) { 983 /* process DNAME */ 984 const dname_type* name = qname; 985 domain_type *dest = rdata_atom_domain(rrset->rrs[0].rdatas[0]); 986 int added; 987 assert(rrset->rr_count > 0); 988 if(domain_number != 0) /* we followed CNAMEs or DNAMEs */ 989 name = domain_dname(closest_match); 990 DEBUG(DEBUG_QUERY,2, (LOG_INFO, "expanding DNAME for q=%s", dname_to_string(name, NULL))); 991 DEBUG(DEBUG_QUERY,2, (LOG_INFO, "->src is %s", 992 dname_to_string(domain_dname(closest_encloser), NULL))); 993 DEBUG(DEBUG_QUERY,2, (LOG_INFO, "->dest is %s", 994 dname_to_string(domain_dname(dest), NULL))); 995 /* if the DNAME set is not added we have a loop, do not follow */ 996 added = add_rrset(q, answer, ANSWER_SECTION, closest_encloser, rrset); 997 if(added) { 998 domain_type* src = closest_encloser; 999 const dname_type* newname = dname_replace(q->region, name, 1000 domain_dname(src), domain_dname(dest)); 1001 uint32_t newnum = 0; 1002 zone_type* origzone = q->zone; 1003 ++q->cname_count; 1004 if(!newname) { /* newname too long */ 1005 RCODE_SET(q->packet, RCODE_YXDOMAIN); 1006 return; 1007 } 1008 DEBUG(DEBUG_QUERY,2, (LOG_INFO, "->result is %s", dname_to_string(newname, NULL))); 1009 /* follow the DNAME */ 1010 exact = namedb_lookup(nsd->db, newname, &closest_match, &closest_encloser); 1011 /* synthesize CNAME record */ 1012 newnum = query_synthesize_cname(q, answer, name, newname, 1013 src, closest_encloser, &closest_match); 1014 if(!newnum) { 1015 /* could not synthesize the CNAME. */ 1016 /* return previous CNAMEs to make resolver recurse for us */ 1017 return; 1018 } 1019 1020 while (closest_encloser && !closest_encloser->is_existing) 1021 closest_encloser = closest_encloser->parent; 1022 answer_lookup_zone(nsd, q, answer, newnum, 1023 closest_match == closest_encloser, 1024 closest_match, closest_encloser, newname); 1025 q->zone = origzone; 1026 } 1027 if(!added) /* log the error so operator can find looping recursors */ 1028 log_msg(LOG_INFO, "DNAME processing stopped due to loop, qname %s", 1029 dname_to_string(q->qname, NULL)); 1030 return; 1031 } else if (domain_wildcard_child(closest_encloser)) { 1032 /* Generate the domain from the wildcard. */ 1033 domain_type *wildcard_child = domain_wildcard_child(closest_encloser); 1034 1035 match = (domain_type *) region_alloc(q->region, 1036 sizeof(domain_type)); 1037 memcpy(&match->node, &wildcard_child->node, sizeof(rbnode_t)); 1038 match->parent = closest_encloser; 1039 match->wildcard_child_closest_match = match; 1040 match->number = domain_number; 1041 match->rrsets = wildcard_child->rrsets; 1042 match->is_existing = wildcard_child->is_existing; 1043 #ifdef NSEC3 1044 match->nsec3_cover = wildcard_child->nsec3_cover; 1045 #ifdef FULL_PREHASH 1046 match->nsec3_is_exact = wildcard_child->nsec3_is_exact; 1047 match->nsec3_wcard_child_cover = wildcard_child->nsec3_wcard_child_cover; 1048 match->nsec3_ds_parent_is_exact = wildcard_child->nsec3_ds_parent_is_exact; 1049 match->nsec3_ds_parent_cover = wildcard_child->nsec3_ds_parent_cover; 1050 #endif 1051 if (q->edns.dnssec_ok && q->zone->nsec3_soa_rr) { 1052 /* Only add nsec3 wildcard data when do bit is set */ 1053 nsec3_answer_wildcard(q, answer, wildcard_child, nsd->db, qname); 1054 } 1055 #endif 1056 1057 /* 1058 * Remember the original domain in case a Wildcard No 1059 * Data (3.1.3.4) response needs to be generated. In 1060 * this particular case the wildcard IS NOT 1061 * expanded. 1062 */ 1063 original = wildcard_child; 1064 } else { 1065 match = NULL; 1066 } 1067 1068 /* Authorative zone. */ 1069 #ifdef NSEC3 1070 if (q->edns.dnssec_ok && q->zone->nsec3_soa_rr) { 1071 nsec3_answer_authoritative(&match, q, answer, 1072 closest_encloser, nsd->db, qname); 1073 } else 1074 #endif 1075 if (q->edns.dnssec_ok && zone_is_secure(q->zone)) { 1076 if (match != closest_encloser) { 1077 domain_type *nsec_domain; 1078 rrset_type *nsec_rrset; 1079 1080 /* 1081 * No match found or generated from wildcard, 1082 * include NSEC record. 1083 */ 1084 nsec_domain = find_covering_nsec(closest_match, q->zone, &nsec_rrset); 1085 if (nsec_domain) { 1086 add_rrset(q, answer, AUTHORITY_SECTION, nsec_domain, nsec_rrset); 1087 } 1088 } 1089 if (!match) { 1090 domain_type *nsec_domain; 1091 rrset_type *nsec_rrset; 1092 1093 /* 1094 * No match and no wildcard. Include NSEC 1095 * proving there is no wildcard. 1096 */ 1097 nsec_domain = find_covering_nsec(closest_encloser->wildcard_child_closest_match, q->zone, &nsec_rrset); 1098 if (nsec_domain) { 1099 add_rrset(q, answer, AUTHORITY_SECTION, nsec_domain, nsec_rrset); 1100 } 1101 } 1102 } 1103 1104 #ifdef NSEC3 1105 if (RCODE(q->packet)!=RCODE_OK) { 1106 return; /* nsec3 collision failure */ 1107 } 1108 #endif 1109 if (match) { 1110 answer_domain(nsd, q, answer, match, original); 1111 } else { 1112 answer_nxdomain(q, answer); 1113 } 1114 } 1115 1116 /* 1117 * qname may be different after CNAMEs have been followed from query->qname. 1118 */ 1119 static void 1120 answer_lookup_zone(struct nsd *nsd, struct query *q, answer_type *answer, 1121 uint32_t domain_number, int exact, domain_type *closest_match, 1122 domain_type *closest_encloser, const dname_type *qname) 1123 { 1124 q->zone = domain_find_zone(closest_encloser); 1125 if (!q->zone) { 1126 if(q->cname_count == 0) 1127 RCODE_SET(q->packet, RCODE_SERVFAIL); 1128 return; 1129 } 1130 1131 /* 1132 * See RFC 4035 (DNSSEC protocol) section 3.1.4.1 Responding 1133 * to Queries for DS RRs. 1134 */ 1135 if (exact && q->qtype == TYPE_DS && closest_encloser == q->zone->apex) { 1136 /* 1137 * Type DS query at a zone cut, use the responsible 1138 * parent zone to generate the answer if we are 1139 * authoritative for the parent zone. 1140 */ 1141 zone_type *zone = domain_find_parent_zone(q->zone); 1142 if (zone) 1143 q->zone = zone; 1144 } 1145 1146 /* see if the zone has expired (for secondary zones) */ 1147 if(q->zone && q->zone->opts && zone_is_slave(q->zone->opts) 1148 && !q->zone->is_ok) { 1149 if(q->cname_count == 0) 1150 RCODE_SET(q->packet, RCODE_SERVFAIL); 1151 return; 1152 } 1153 1154 if (exact && q->qtype == TYPE_DS && closest_encloser == q->zone->apex) { 1155 /* 1156 * Type DS query at the zone apex (and the server is 1157 * not authoratitive for the parent zone). 1158 */ 1159 if (q->qclass == CLASS_ANY) { 1160 AA_CLR(q->packet); 1161 } else { 1162 AA_SET(q->packet); 1163 } 1164 answer_nodata(q, answer, closest_encloser); 1165 } else { 1166 q->delegation_domain = domain_find_ns_rrsets( 1167 closest_encloser, q->zone, &q->delegation_rrset); 1168 1169 if (!q->delegation_domain 1170 || (exact && q->qtype == TYPE_DS && closest_encloser == q->delegation_domain)) 1171 { 1172 if (q->qclass == CLASS_ANY) { 1173 AA_CLR(q->packet); 1174 } else { 1175 AA_SET(q->packet); 1176 } 1177 answer_authoritative(nsd, q, answer, domain_number, exact, 1178 closest_match, closest_encloser, qname); 1179 } 1180 else { 1181 answer_delegation(q, answer); 1182 } 1183 } 1184 } 1185 1186 static void 1187 answer_query(struct nsd *nsd, struct query *q) 1188 { 1189 domain_type *closest_match; 1190 domain_type *closest_encloser; 1191 int exact; 1192 uint16_t offset; 1193 answer_type answer; 1194 1195 answer_init(&answer); 1196 1197 exact = namedb_lookup(nsd->db, q->qname, &closest_match, &closest_encloser); 1198 if (!closest_encloser->is_existing) { 1199 exact = 0; 1200 while (closest_encloser != NULL && !closest_encloser->is_existing) 1201 closest_encloser = closest_encloser->parent; 1202 } 1203 if(!closest_encloser) { 1204 RCODE_SET(q->packet, RCODE_SERVFAIL); 1205 return; 1206 } 1207 1208 q->domain = closest_encloser; 1209 answer_lookup_zone(nsd, q, &answer, 0, exact, closest_match, 1210 closest_encloser, q->qname); 1211 1212 ZTATUP2(q->zone, opcode, q->opcode); 1213 ZTATUP2(q->zone, qtype, q->qtype); 1214 ZTATUP2(q->zone, opcode, q->qclass); 1215 1216 offset = dname_label_offsets(q->qname)[domain_dname(closest_encloser)->label_count - 1] + QHEADERSZ; 1217 query_add_compression_domain(q, closest_encloser, offset); 1218 encode_answer(q, &answer); 1219 query_clear_compression_tables(q); 1220 } 1221 1222 void 1223 query_prepare_response(query_type *q) 1224 { 1225 uint16_t flags; 1226 1227 /* 1228 * Preserve the data up-to the current packet's limit. 1229 */ 1230 buffer_set_position(q->packet, buffer_limit(q->packet)); 1231 buffer_set_limit(q->packet, buffer_capacity(q->packet)); 1232 1233 /* 1234 * Reserve space for the EDNS records if required. 1235 */ 1236 q->reserved_space = edns_reserved_space(&q->edns); 1237 q->reserved_space += tsig_reserved_space(&q->tsig); 1238 1239 /* Update the flags. */ 1240 flags = FLAGS(q->packet); 1241 flags &= 0x0100U; /* Preserve the RD flag. */ 1242 /* CD flag must be cleared for auth answers */ 1243 flags |= 0x8000U; /* Set the QR flag. */ 1244 FLAGS_SET(q->packet, flags); 1245 } 1246 1247 /* 1248 * Processes the query. 1249 * 1250 */ 1251 query_state_type 1252 query_process(query_type *q, nsd_type *nsd) 1253 { 1254 /* The query... */ 1255 nsd_rc_type rc; 1256 query_state_type query_state; 1257 uint16_t arcount; 1258 1259 /* Sanity checks */ 1260 if (buffer_limit(q->packet) < QHEADERSZ) { 1261 /* packet too small to contain DNS header. 1262 Now packet investigation macros will work without problems. */ 1263 return QUERY_DISCARDED; 1264 } 1265 if (QR(q->packet)) { 1266 /* Not a query? Drop it on the floor. */ 1267 return QUERY_DISCARDED; 1268 } 1269 1270 if (RCODE(q->packet) != RCODE_OK || !process_query_section(q)) { 1271 return query_formerr(q); 1272 } 1273 1274 /* Update statistics. */ 1275 STATUP2(nsd, opcode, q->opcode); 1276 STATUP2(nsd, qtype, q->qtype); 1277 STATUP2(nsd, qclass, q->qclass); 1278 1279 if (q->opcode != OPCODE_QUERY) { 1280 if (q->opcode == OPCODE_NOTIFY) { 1281 return answer_notify(nsd, q); 1282 } else { 1283 return query_error(q, NSD_RC_IMPL); 1284 } 1285 } 1286 1287 /* Dont bother to answer more than one question at once... */ 1288 if (QDCOUNT(q->packet) != 1) { 1289 FLAGS_SET(q->packet, 0); 1290 return query_formerr(q); 1291 } 1292 /* Ignore settings of flags */ 1293 1294 /* Dont allow any records in the answer or authority section... 1295 except for IXFR queries. */ 1296 if (ANCOUNT(q->packet) != 0 || 1297 (q->qtype!=TYPE_IXFR && NSCOUNT(q->packet) != 0)) { 1298 return query_formerr(q); 1299 } 1300 if(q->qtype==TYPE_IXFR && NSCOUNT(q->packet) > 0) { 1301 int i; /* skip ixfr soa information data here */ 1302 for(i=0; i< NSCOUNT(q->packet); i++) 1303 if(!packet_skip_rr(q->packet, 0)) 1304 return query_formerr(q); 1305 } 1306 1307 arcount = ARCOUNT(q->packet); 1308 if (arcount > 0) { 1309 /* see if tsig is before edns record */ 1310 if (!tsig_parse_rr(&q->tsig, q->packet)) 1311 return query_formerr(q); 1312 if(q->tsig.status != TSIG_NOT_PRESENT) 1313 --arcount; 1314 } 1315 if (arcount > 0) { 1316 if (edns_parse_record(&q->edns, q->packet)) 1317 --arcount; 1318 } 1319 if (arcount > 0 && q->tsig.status == TSIG_NOT_PRESENT) { 1320 /* see if tsig is after the edns record */ 1321 if (!tsig_parse_rr(&q->tsig, q->packet)) 1322 return query_formerr(q); 1323 if(q->tsig.status != TSIG_NOT_PRESENT) 1324 --arcount; 1325 } 1326 if (arcount > 0) { 1327 return query_formerr(q); 1328 } 1329 1330 /* Do we have any trailing garbage? */ 1331 #ifdef STRICT_MESSAGE_PARSE 1332 if (buffer_remaining(q->packet) > 0) { 1333 /* If we're strict.... */ 1334 return query_formerr(q); 1335 } 1336 #endif 1337 /* Remove trailing garbage. */ 1338 buffer_set_limit(q->packet, buffer_position(q->packet)); 1339 1340 rc = process_tsig(q); 1341 if (rc != NSD_RC_OK) { 1342 return query_error(q, rc); 1343 } 1344 rc = process_edns(nsd, q); 1345 if (rc != NSD_RC_OK) { 1346 /* We should not return FORMERR, but BADVERS (=16). 1347 * BADVERS is created with Ext. RCODE, followed by RCODE. 1348 * Ext. RCODE is set to 1, RCODE must be 0 (getting 0x10 = 16). 1349 * Thus RCODE = NOERROR = NSD_RC_OK. */ 1350 return query_error(q, NSD_RC_OK); 1351 } 1352 1353 query_prepare_response(q); 1354 1355 if (q->qclass != CLASS_IN && q->qclass != CLASS_ANY) { 1356 if (q->qclass == CLASS_CH) { 1357 return answer_chaos(nsd, q); 1358 } else { 1359 return query_error(q, NSD_RC_REFUSE); 1360 } 1361 } 1362 1363 query_state = answer_axfr_ixfr(nsd, q); 1364 if (query_state == QUERY_PROCESSED || query_state == QUERY_IN_AXFR) { 1365 return query_state; 1366 } 1367 1368 answer_query(nsd, q); 1369 1370 return QUERY_PROCESSED; 1371 } 1372 1373 void 1374 query_add_optional(query_type *q, nsd_type *nsd) 1375 { 1376 struct edns_data *edns = &nsd->edns_ipv4; 1377 #if defined(INET6) 1378 if (q->addr.ss_family == AF_INET6) { 1379 edns = &nsd->edns_ipv6; 1380 } 1381 #endif 1382 switch (q->edns.status) { 1383 case EDNS_NOT_PRESENT: 1384 break; 1385 case EDNS_OK: 1386 if (q->edns.dnssec_ok) edns->ok[7] = 0x80; 1387 else edns->ok[7] = 0x00; 1388 buffer_write(q->packet, edns->ok, OPT_LEN); 1389 if (nsd->nsid_len > 0 && q->edns.nsid == 1 && 1390 !query_overflow_nsid(q, nsd->nsid_len)) { 1391 /* rdata length */ 1392 buffer_write(q->packet, edns->rdata_nsid, OPT_RDATA); 1393 /* nsid opt header */ 1394 buffer_write(q->packet, edns->nsid, OPT_HDR); 1395 /* nsid payload */ 1396 buffer_write(q->packet, nsd->nsid, nsd->nsid_len); 1397 } else { 1398 /* fill with NULLs */ 1399 buffer_write(q->packet, edns->rdata_none, OPT_RDATA); 1400 } 1401 ARCOUNT_SET(q->packet, ARCOUNT(q->packet) + 1); 1402 STATUP(nsd, edns); 1403 ZTATUP(q->zone, edns); 1404 break; 1405 case EDNS_ERROR: 1406 if (q->edns.dnssec_ok) edns->error[7] = 0x80; 1407 else edns->error[7] = 0x00; 1408 buffer_write(q->packet, edns->error, OPT_LEN); 1409 buffer_write(q->packet, edns->rdata_none, OPT_RDATA); 1410 ARCOUNT_SET(q->packet, ARCOUNT(q->packet) + 1); 1411 STATUP(nsd, ednserr); 1412 ZTATUP(q->zone, ednserr); 1413 break; 1414 } 1415 1416 if (q->tsig.status != TSIG_NOT_PRESENT) { 1417 if (q->tsig.status == TSIG_ERROR || 1418 q->tsig.error_code != TSIG_ERROR_NOERROR) { 1419 tsig_error_reply(&q->tsig); 1420 tsig_append_rr(&q->tsig, q->packet); 1421 ARCOUNT_SET(q->packet, ARCOUNT(q->packet) + 1); 1422 } else if(q->tsig.status == TSIG_OK && 1423 q->tsig.error_code == TSIG_ERROR_NOERROR) 1424 { 1425 if(q->tsig_prepare_it) 1426 tsig_prepare(&q->tsig); 1427 if(q->tsig_update_it) 1428 tsig_update(&q->tsig, q->packet, buffer_position(q->packet)); 1429 if(q->tsig_sign_it) { 1430 tsig_sign(&q->tsig); 1431 tsig_append_rr(&q->tsig, q->packet); 1432 ARCOUNT_SET(q->packet, ARCOUNT(q->packet) + 1); 1433 } 1434 } 1435 } 1436 } 1437