1 /* 2 * iterator/iterator.c - iterative resolver DNS query response module 3 * 4 * Copyright (c) 2007, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains a module that performs recusive iterative DNS query 40 * processing. 41 */ 42 43 #include "config.h" 44 #include "iterator/iterator.h" 45 #include "iterator/iter_utils.h" 46 #include "iterator/iter_hints.h" 47 #include "iterator/iter_fwd.h" 48 #include "iterator/iter_donotq.h" 49 #include "iterator/iter_delegpt.h" 50 #include "iterator/iter_resptype.h" 51 #include "iterator/iter_scrub.h" 52 #include "iterator/iter_priv.h" 53 #include "validator/val_neg.h" 54 #include "services/cache/dns.h" 55 #include "services/cache/infra.h" 56 #include "util/module.h" 57 #include "util/netevent.h" 58 #include "util/net_help.h" 59 #include "util/regional.h" 60 #include "util/data/dname.h" 61 #include "util/data/msgencode.h" 62 #include "util/fptr_wlist.h" 63 #include "util/config_file.h" 64 #include "util/random.h" 65 #include "sldns/rrdef.h" 66 #include "sldns/wire2str.h" 67 #include "sldns/str2wire.h" 68 #include "sldns/parseutil.h" 69 #include "sldns/sbuffer.h" 70 71 int 72 iter_init(struct module_env* env, int id) 73 { 74 struct iter_env* iter_env = (struct iter_env*)calloc(1, 75 sizeof(struct iter_env)); 76 if(!iter_env) { 77 log_err("malloc failure"); 78 return 0; 79 } 80 env->modinfo[id] = (void*)iter_env; 81 if(!iter_apply_cfg(iter_env, env->cfg)) { 82 log_err("iterator: could not apply configuration settings."); 83 return 0; 84 } 85 86 return 1; 87 } 88 89 /** delete caps_whitelist element */ 90 static void 91 caps_free(struct rbnode_type* n, void* ATTR_UNUSED(d)) 92 { 93 if(n) { 94 free(((struct name_tree_node*)n)->name); 95 free(n); 96 } 97 } 98 99 void 100 iter_deinit(struct module_env* env, int id) 101 { 102 struct iter_env* iter_env; 103 if(!env || !env->modinfo[id]) 104 return; 105 iter_env = (struct iter_env*)env->modinfo[id]; 106 free(iter_env->target_fetch_policy); 107 priv_delete(iter_env->priv); 108 donotq_delete(iter_env->donotq); 109 if(iter_env->caps_white) { 110 traverse_postorder(iter_env->caps_white, caps_free, NULL); 111 free(iter_env->caps_white); 112 } 113 free(iter_env); 114 env->modinfo[id] = NULL; 115 } 116 117 /** new query for iterator */ 118 static int 119 iter_new(struct module_qstate* qstate, int id) 120 { 121 struct iter_qstate* iq = (struct iter_qstate*)regional_alloc( 122 qstate->region, sizeof(struct iter_qstate)); 123 qstate->minfo[id] = iq; 124 if(!iq) 125 return 0; 126 memset(iq, 0, sizeof(*iq)); 127 iq->state = INIT_REQUEST_STATE; 128 iq->final_state = FINISHED_STATE; 129 iq->an_prepend_list = NULL; 130 iq->an_prepend_last = NULL; 131 iq->ns_prepend_list = NULL; 132 iq->ns_prepend_last = NULL; 133 iq->dp = NULL; 134 iq->depth = 0; 135 iq->num_target_queries = 0; 136 iq->num_current_queries = 0; 137 iq->query_restart_count = 0; 138 iq->referral_count = 0; 139 iq->sent_count = 0; 140 iq->ratelimit_ok = 0; 141 iq->target_count = NULL; 142 iq->wait_priming_stub = 0; 143 iq->refetch_glue = 0; 144 iq->dnssec_expected = 0; 145 iq->dnssec_lame_query = 0; 146 iq->chase_flags = qstate->query_flags; 147 /* Start with the (current) qname. */ 148 iq->qchase = qstate->qinfo; 149 outbound_list_init(&iq->outlist); 150 iq->minimise_count = 0; 151 iq->minimise_timeout_count = 0; 152 if (qstate->env->cfg->qname_minimisation) 153 iq->minimisation_state = INIT_MINIMISE_STATE; 154 else 155 iq->minimisation_state = DONOT_MINIMISE_STATE; 156 157 memset(&iq->qinfo_out, 0, sizeof(struct query_info)); 158 return 1; 159 } 160 161 /** 162 * Transition to the next state. This can be used to advance a currently 163 * processing event. It cannot be used to reactivate a forEvent. 164 * 165 * @param iq: iterator query state 166 * @param nextstate The state to transition to. 167 * @return true. This is so this can be called as the return value for the 168 * actual process*State() methods. (Transitioning to the next state 169 * implies further processing). 170 */ 171 static int 172 next_state(struct iter_qstate* iq, enum iter_state nextstate) 173 { 174 /* If transitioning to a "response" state, make sure that there is a 175 * response */ 176 if(iter_state_is_responsestate(nextstate)) { 177 if(iq->response == NULL) { 178 log_err("transitioning to response state sans " 179 "response."); 180 } 181 } 182 iq->state = nextstate; 183 return 1; 184 } 185 186 /** 187 * Transition an event to its final state. Final states always either return 188 * a result up the module chain, or reactivate a dependent event. Which 189 * final state to transition to is set in the module state for the event when 190 * it was created, and depends on the original purpose of the event. 191 * 192 * The response is stored in the qstate->buf buffer. 193 * 194 * @param iq: iterator query state 195 * @return false. This is so this method can be used as the return value for 196 * the processState methods. (Transitioning to the final state 197 */ 198 static int 199 final_state(struct iter_qstate* iq) 200 { 201 return next_state(iq, iq->final_state); 202 } 203 204 /** 205 * Callback routine to handle errors in parent query states 206 * @param qstate: query state that failed. 207 * @param id: module id. 208 * @param super: super state. 209 */ 210 static void 211 error_supers(struct module_qstate* qstate, int id, struct module_qstate* super) 212 { 213 struct iter_qstate* super_iq = (struct iter_qstate*)super->minfo[id]; 214 215 if(qstate->qinfo.qtype == LDNS_RR_TYPE_A || 216 qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA) { 217 /* mark address as failed. */ 218 struct delegpt_ns* dpns = NULL; 219 super_iq->num_target_queries--; 220 if(super_iq->dp) 221 dpns = delegpt_find_ns(super_iq->dp, 222 qstate->qinfo.qname, qstate->qinfo.qname_len); 223 if(!dpns) { 224 /* not interested */ 225 verbose(VERB_ALGO, "subq error, but not interested"); 226 log_query_info(VERB_ALGO, "superq", &super->qinfo); 227 if(super_iq->dp) 228 delegpt_log(VERB_ALGO, super_iq->dp); 229 log_assert(0); 230 return; 231 } else { 232 /* see if the failure did get (parent-lame) info */ 233 if(!cache_fill_missing(super->env, super_iq->qchase.qclass, 234 super->region, super_iq->dp)) 235 log_err("out of memory adding missing"); 236 } 237 dpns->resolved = 1; /* mark as failed */ 238 } 239 if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS) { 240 /* prime failed to get delegation */ 241 super_iq->dp = NULL; 242 } 243 /* evaluate targets again */ 244 super_iq->state = QUERYTARGETS_STATE; 245 /* super becomes runnable, and will process this change */ 246 } 247 248 /** 249 * Return an error to the client 250 * @param qstate: our query state 251 * @param id: module id 252 * @param rcode: error code (DNS errcode). 253 * @return: 0 for use by caller, to make notation easy, like: 254 * return error_response(..). 255 */ 256 static int 257 error_response(struct module_qstate* qstate, int id, int rcode) 258 { 259 verbose(VERB_QUERY, "return error response %s", 260 sldns_lookup_by_id(sldns_rcodes, rcode)? 261 sldns_lookup_by_id(sldns_rcodes, rcode)->name:"??"); 262 qstate->return_rcode = rcode; 263 qstate->return_msg = NULL; 264 qstate->ext_state[id] = module_finished; 265 return 0; 266 } 267 268 /** 269 * Return an error to the client and cache the error code in the 270 * message cache (so per qname, qtype, qclass). 271 * @param qstate: our query state 272 * @param id: module id 273 * @param rcode: error code (DNS errcode). 274 * @return: 0 for use by caller, to make notation easy, like: 275 * return error_response(..). 276 */ 277 static int 278 error_response_cache(struct module_qstate* qstate, int id, int rcode) 279 { 280 if(!qstate->no_cache_store) { 281 /* store in cache */ 282 struct reply_info err; 283 if(qstate->prefetch_leeway > NORR_TTL) { 284 verbose(VERB_ALGO, "error response for prefetch in cache"); 285 /* attempt to adjust the cache entry prefetch */ 286 if(dns_cache_prefetch_adjust(qstate->env, &qstate->qinfo, 287 NORR_TTL, qstate->query_flags)) 288 return error_response(qstate, id, rcode); 289 /* if that fails (not in cache), fall through to store err */ 290 } 291 memset(&err, 0, sizeof(err)); 292 err.flags = (uint16_t)(BIT_QR | BIT_RA); 293 FLAGS_SET_RCODE(err.flags, rcode); 294 err.qdcount = 1; 295 err.ttl = NORR_TTL; 296 err.prefetch_ttl = PREFETCH_TTL_CALC(err.ttl); 297 /* do not waste time trying to validate this servfail */ 298 err.security = sec_status_indeterminate; 299 verbose(VERB_ALGO, "store error response in message cache"); 300 iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL, 301 qstate->query_flags); 302 } 303 return error_response(qstate, id, rcode); 304 } 305 306 /** check if prepend item is duplicate item */ 307 static int 308 prepend_is_duplicate(struct ub_packed_rrset_key** sets, size_t to, 309 struct ub_packed_rrset_key* dup) 310 { 311 size_t i; 312 for(i=0; i<to; i++) { 313 if(sets[i]->rk.type == dup->rk.type && 314 sets[i]->rk.rrset_class == dup->rk.rrset_class && 315 sets[i]->rk.dname_len == dup->rk.dname_len && 316 query_dname_compare(sets[i]->rk.dname, dup->rk.dname) 317 == 0) 318 return 1; 319 } 320 return 0; 321 } 322 323 /** prepend the prepend list in the answer and authority section of dns_msg */ 324 static int 325 iter_prepend(struct iter_qstate* iq, struct dns_msg* msg, 326 struct regional* region) 327 { 328 struct iter_prep_list* p; 329 struct ub_packed_rrset_key** sets; 330 size_t num_an = 0, num_ns = 0;; 331 for(p = iq->an_prepend_list; p; p = p->next) 332 num_an++; 333 for(p = iq->ns_prepend_list; p; p = p->next) 334 num_ns++; 335 if(num_an + num_ns == 0) 336 return 1; 337 verbose(VERB_ALGO, "prepending %d rrsets", (int)num_an + (int)num_ns); 338 if(num_an > RR_COUNT_MAX || num_ns > RR_COUNT_MAX || 339 msg->rep->rrset_count > RR_COUNT_MAX) return 0; /* overflow */ 340 sets = regional_alloc(region, (num_an+num_ns+msg->rep->rrset_count) * 341 sizeof(struct ub_packed_rrset_key*)); 342 if(!sets) 343 return 0; 344 /* ANSWER section */ 345 num_an = 0; 346 for(p = iq->an_prepend_list; p; p = p->next) { 347 sets[num_an++] = p->rrset; 348 } 349 memcpy(sets+num_an, msg->rep->rrsets, msg->rep->an_numrrsets * 350 sizeof(struct ub_packed_rrset_key*)); 351 /* AUTH section */ 352 num_ns = 0; 353 for(p = iq->ns_prepend_list; p; p = p->next) { 354 if(prepend_is_duplicate(sets+msg->rep->an_numrrsets+num_an, 355 num_ns, p->rrset) || prepend_is_duplicate( 356 msg->rep->rrsets+msg->rep->an_numrrsets, 357 msg->rep->ns_numrrsets, p->rrset)) 358 continue; 359 sets[msg->rep->an_numrrsets + num_an + num_ns++] = p->rrset; 360 } 361 memcpy(sets + num_an + msg->rep->an_numrrsets + num_ns, 362 msg->rep->rrsets + msg->rep->an_numrrsets, 363 (msg->rep->ns_numrrsets + msg->rep->ar_numrrsets) * 364 sizeof(struct ub_packed_rrset_key*)); 365 366 /* NXDOMAIN rcode can stay if we prepended DNAME/CNAMEs, because 367 * this is what recursors should give. */ 368 msg->rep->rrset_count += num_an + num_ns; 369 msg->rep->an_numrrsets += num_an; 370 msg->rep->ns_numrrsets += num_ns; 371 msg->rep->rrsets = sets; 372 return 1; 373 } 374 375 /** 376 * Add rrset to ANSWER prepend list 377 * @param qstate: query state. 378 * @param iq: iterator query state. 379 * @param rrset: rrset to add. 380 * @return false on failure (malloc). 381 */ 382 static int 383 iter_add_prepend_answer(struct module_qstate* qstate, struct iter_qstate* iq, 384 struct ub_packed_rrset_key* rrset) 385 { 386 struct iter_prep_list* p = (struct iter_prep_list*)regional_alloc( 387 qstate->region, sizeof(struct iter_prep_list)); 388 if(!p) 389 return 0; 390 p->rrset = rrset; 391 p->next = NULL; 392 /* add at end */ 393 if(iq->an_prepend_last) 394 iq->an_prepend_last->next = p; 395 else iq->an_prepend_list = p; 396 iq->an_prepend_last = p; 397 return 1; 398 } 399 400 /** 401 * Add rrset to AUTHORITY prepend list 402 * @param qstate: query state. 403 * @param iq: iterator query state. 404 * @param rrset: rrset to add. 405 * @return false on failure (malloc). 406 */ 407 static int 408 iter_add_prepend_auth(struct module_qstate* qstate, struct iter_qstate* iq, 409 struct ub_packed_rrset_key* rrset) 410 { 411 struct iter_prep_list* p = (struct iter_prep_list*)regional_alloc( 412 qstate->region, sizeof(struct iter_prep_list)); 413 if(!p) 414 return 0; 415 p->rrset = rrset; 416 p->next = NULL; 417 /* add at end */ 418 if(iq->ns_prepend_last) 419 iq->ns_prepend_last->next = p; 420 else iq->ns_prepend_list = p; 421 iq->ns_prepend_last = p; 422 return 1; 423 } 424 425 /** 426 * Given a CNAME response (defined as a response containing a CNAME or DNAME 427 * that does not answer the request), process the response, modifying the 428 * state as necessary. This follows the CNAME/DNAME chain and returns the 429 * final query name. 430 * 431 * sets the new query name, after following the CNAME/DNAME chain. 432 * @param qstate: query state. 433 * @param iq: iterator query state. 434 * @param msg: the response. 435 * @param mname: returned target new query name. 436 * @param mname_len: length of mname. 437 * @return false on (malloc) error. 438 */ 439 static int 440 handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq, 441 struct dns_msg* msg, uint8_t** mname, size_t* mname_len) 442 { 443 size_t i; 444 /* Start with the (current) qname. */ 445 *mname = iq->qchase.qname; 446 *mname_len = iq->qchase.qname_len; 447 448 /* Iterate over the ANSWER rrsets in order, looking for CNAMEs and 449 * DNAMES. */ 450 for(i=0; i<msg->rep->an_numrrsets; i++) { 451 struct ub_packed_rrset_key* r = msg->rep->rrsets[i]; 452 /* If there is a (relevant) DNAME, add it to the list. 453 * We always expect there to be CNAME that was generated 454 * by this DNAME following, so we don't process the DNAME 455 * directly. */ 456 if(ntohs(r->rk.type) == LDNS_RR_TYPE_DNAME && 457 dname_strict_subdomain_c(*mname, r->rk.dname)) { 458 if(!iter_add_prepend_answer(qstate, iq, r)) 459 return 0; 460 continue; 461 } 462 463 if(ntohs(r->rk.type) == LDNS_RR_TYPE_CNAME && 464 query_dname_compare(*mname, r->rk.dname) == 0) { 465 /* Add this relevant CNAME rrset to the prepend list.*/ 466 if(!iter_add_prepend_answer(qstate, iq, r)) 467 return 0; 468 get_cname_target(r, mname, mname_len); 469 } 470 471 /* Other rrsets in the section are ignored. */ 472 } 473 /* add authority rrsets to authority prepend, for wildcarded CNAMEs */ 474 for(i=msg->rep->an_numrrsets; i<msg->rep->an_numrrsets + 475 msg->rep->ns_numrrsets; i++) { 476 struct ub_packed_rrset_key* r = msg->rep->rrsets[i]; 477 /* only add NSEC/NSEC3, as they may be needed for validation */ 478 if(ntohs(r->rk.type) == LDNS_RR_TYPE_NSEC || 479 ntohs(r->rk.type) == LDNS_RR_TYPE_NSEC3) { 480 if(!iter_add_prepend_auth(qstate, iq, r)) 481 return 0; 482 } 483 } 484 return 1; 485 } 486 487 /** see if target name is caps-for-id whitelisted */ 488 static int 489 is_caps_whitelisted(struct iter_env* ie, struct iter_qstate* iq) 490 { 491 if(!ie->caps_white) return 0; /* no whitelist, or no capsforid */ 492 return name_tree_lookup(ie->caps_white, iq->qchase.qname, 493 iq->qchase.qname_len, dname_count_labels(iq->qchase.qname), 494 iq->qchase.qclass) != NULL; 495 } 496 497 /** create target count structure for this query */ 498 static void 499 target_count_create(struct iter_qstate* iq) 500 { 501 if(!iq->target_count) { 502 iq->target_count = (int*)calloc(2, sizeof(int)); 503 /* if calloc fails we simply do not track this number */ 504 if(iq->target_count) 505 iq->target_count[0] = 1; 506 } 507 } 508 509 static void 510 target_count_increase(struct iter_qstate* iq, int num) 511 { 512 target_count_create(iq); 513 if(iq->target_count) 514 iq->target_count[1] += num; 515 } 516 517 /** 518 * Generate a subrequest. 519 * Generate a local request event. Local events are tied to this module, and 520 * have a corresponding (first tier) event that is waiting for this event to 521 * resolve to continue. 522 * 523 * @param qname The query name for this request. 524 * @param qnamelen length of qname 525 * @param qtype The query type for this request. 526 * @param qclass The query class for this request. 527 * @param qstate The event that is generating this event. 528 * @param id: module id. 529 * @param iq: The iterator state that is generating this event. 530 * @param initial_state The initial response state (normally this 531 * is QUERY_RESP_STATE, unless it is known that the request won't 532 * need iterative processing 533 * @param finalstate The final state for the response to this request. 534 * @param subq_ret: if newly allocated, the subquerystate, or NULL if it does 535 * not need initialisation. 536 * @param v: if true, validation is done on the subquery. 537 * @return false on error (malloc). 538 */ 539 static int 540 generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype, 541 uint16_t qclass, struct module_qstate* qstate, int id, 542 struct iter_qstate* iq, enum iter_state initial_state, 543 enum iter_state finalstate, struct module_qstate** subq_ret, int v) 544 { 545 struct module_qstate* subq = NULL; 546 struct iter_qstate* subiq = NULL; 547 uint16_t qflags = 0; /* OPCODE QUERY, no flags */ 548 struct query_info qinf; 549 int prime = (finalstate == PRIME_RESP_STATE)?1:0; 550 int valrec = 0; 551 qinf.qname = qname; 552 qinf.qname_len = qnamelen; 553 qinf.qtype = qtype; 554 qinf.qclass = qclass; 555 qinf.local_alias = NULL; 556 557 /* RD should be set only when sending the query back through the INIT 558 * state. */ 559 if(initial_state == INIT_REQUEST_STATE) 560 qflags |= BIT_RD; 561 /* We set the CD flag so we can send this through the "head" of 562 * the resolution chain, which might have a validator. We are 563 * uninterested in validating things not on the direct resolution 564 * path. */ 565 if(!v) { 566 qflags |= BIT_CD; 567 valrec = 1; 568 } 569 570 /* attach subquery, lookup existing or make a new one */ 571 fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub)); 572 if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime, valrec, 573 &subq)) { 574 return 0; 575 } 576 *subq_ret = subq; 577 if(subq) { 578 /* initialise the new subquery */ 579 subq->curmod = id; 580 subq->ext_state[id] = module_state_initial; 581 subq->minfo[id] = regional_alloc(subq->region, 582 sizeof(struct iter_qstate)); 583 if(!subq->minfo[id]) { 584 log_err("init subq: out of memory"); 585 fptr_ok(fptr_whitelist_modenv_kill_sub( 586 qstate->env->kill_sub)); 587 (*qstate->env->kill_sub)(subq); 588 return 0; 589 } 590 subiq = (struct iter_qstate*)subq->minfo[id]; 591 memset(subiq, 0, sizeof(*subiq)); 592 subiq->num_target_queries = 0; 593 target_count_create(iq); 594 subiq->target_count = iq->target_count; 595 if(iq->target_count) 596 iq->target_count[0] ++; /* extra reference */ 597 subiq->num_current_queries = 0; 598 subiq->depth = iq->depth+1; 599 outbound_list_init(&subiq->outlist); 600 subiq->state = initial_state; 601 subiq->final_state = finalstate; 602 subiq->qchase = subq->qinfo; 603 subiq->chase_flags = subq->query_flags; 604 subiq->refetch_glue = 0; 605 if(qstate->env->cfg->qname_minimisation) 606 subiq->minimisation_state = INIT_MINIMISE_STATE; 607 else 608 subiq->minimisation_state = DONOT_MINIMISE_STATE; 609 memset(&subiq->qinfo_out, 0, sizeof(struct query_info)); 610 } 611 return 1; 612 } 613 614 /** 615 * Generate and send a root priming request. 616 * @param qstate: the qtstate that triggered the need to prime. 617 * @param iq: iterator query state. 618 * @param id: module id. 619 * @param qclass: the class to prime. 620 * @return 0 on failure 621 */ 622 static int 623 prime_root(struct module_qstate* qstate, struct iter_qstate* iq, int id, 624 uint16_t qclass) 625 { 626 struct delegpt* dp; 627 struct module_qstate* subq; 628 verbose(VERB_DETAIL, "priming . %s NS", 629 sldns_lookup_by_id(sldns_rr_classes, (int)qclass)? 630 sldns_lookup_by_id(sldns_rr_classes, (int)qclass)->name:"??"); 631 dp = hints_lookup_root(qstate->env->hints, qclass); 632 if(!dp) { 633 verbose(VERB_ALGO, "Cannot prime due to lack of hints"); 634 return 0; 635 } 636 /* Priming requests start at the QUERYTARGETS state, skipping 637 * the normal INIT state logic (which would cause an infloop). */ 638 if(!generate_sub_request((uint8_t*)"\000", 1, LDNS_RR_TYPE_NS, 639 qclass, qstate, id, iq, QUERYTARGETS_STATE, PRIME_RESP_STATE, 640 &subq, 0)) { 641 verbose(VERB_ALGO, "could not prime root"); 642 return 0; 643 } 644 if(subq) { 645 struct iter_qstate* subiq = 646 (struct iter_qstate*)subq->minfo[id]; 647 /* Set the initial delegation point to the hint. 648 * copy dp, it is now part of the root prime query. 649 * dp was part of in the fixed hints structure. */ 650 subiq->dp = delegpt_copy(dp, subq->region); 651 if(!subiq->dp) { 652 log_err("out of memory priming root, copydp"); 653 fptr_ok(fptr_whitelist_modenv_kill_sub( 654 qstate->env->kill_sub)); 655 (*qstate->env->kill_sub)(subq); 656 return 0; 657 } 658 /* there should not be any target queries. */ 659 subiq->num_target_queries = 0; 660 subiq->dnssec_expected = iter_indicates_dnssec( 661 qstate->env, subiq->dp, NULL, subq->qinfo.qclass); 662 } 663 664 /* this module stops, our submodule starts, and does the query. */ 665 qstate->ext_state[id] = module_wait_subquery; 666 return 1; 667 } 668 669 /** 670 * Generate and process a stub priming request. This method tests for the 671 * need to prime a stub zone, so it is safe to call for every request. 672 * 673 * @param qstate: the qtstate that triggered the need to prime. 674 * @param iq: iterator query state. 675 * @param id: module id. 676 * @param qname: request name. 677 * @param qclass: request class. 678 * @return true if a priming subrequest was made, false if not. The will only 679 * issue a priming request if it detects an unprimed stub. 680 * Uses value of 2 to signal during stub-prime in root-prime situation 681 * that a noprime-stub is available and resolution can continue. 682 */ 683 static int 684 prime_stub(struct module_qstate* qstate, struct iter_qstate* iq, int id, 685 uint8_t* qname, uint16_t qclass) 686 { 687 /* Lookup the stub hint. This will return null if the stub doesn't 688 * need to be re-primed. */ 689 struct iter_hints_stub* stub; 690 struct delegpt* stub_dp; 691 struct module_qstate* subq; 692 693 if(!qname) return 0; 694 stub = hints_lookup_stub(qstate->env->hints, qname, qclass, iq->dp); 695 /* The stub (if there is one) does not need priming. */ 696 if(!stub) 697 return 0; 698 stub_dp = stub->dp; 699 700 /* is it a noprime stub (always use) */ 701 if(stub->noprime) { 702 int r = 0; 703 if(iq->dp == NULL) r = 2; 704 /* copy the dp out of the fixed hints structure, so that 705 * it can be changed when servicing this query */ 706 iq->dp = delegpt_copy(stub_dp, qstate->region); 707 if(!iq->dp) { 708 log_err("out of memory priming stub"); 709 (void)error_response(qstate, id, LDNS_RCODE_SERVFAIL); 710 return 1; /* return 1 to make module stop, with error */ 711 } 712 log_nametypeclass(VERB_DETAIL, "use stub", stub_dp->name, 713 LDNS_RR_TYPE_NS, qclass); 714 return r; 715 } 716 717 /* Otherwise, we need to (re)prime the stub. */ 718 log_nametypeclass(VERB_DETAIL, "priming stub", stub_dp->name, 719 LDNS_RR_TYPE_NS, qclass); 720 721 /* Stub priming events start at the QUERYTARGETS state to avoid the 722 * redundant INIT state processing. */ 723 if(!generate_sub_request(stub_dp->name, stub_dp->namelen, 724 LDNS_RR_TYPE_NS, qclass, qstate, id, iq, 725 QUERYTARGETS_STATE, PRIME_RESP_STATE, &subq, 0)) { 726 verbose(VERB_ALGO, "could not prime stub"); 727 (void)error_response(qstate, id, LDNS_RCODE_SERVFAIL); 728 return 1; /* return 1 to make module stop, with error */ 729 } 730 if(subq) { 731 struct iter_qstate* subiq = 732 (struct iter_qstate*)subq->minfo[id]; 733 734 /* Set the initial delegation point to the hint. */ 735 /* make copy to avoid use of stub dp by different qs/threads */ 736 subiq->dp = delegpt_copy(stub_dp, subq->region); 737 if(!subiq->dp) { 738 log_err("out of memory priming stub, copydp"); 739 fptr_ok(fptr_whitelist_modenv_kill_sub( 740 qstate->env->kill_sub)); 741 (*qstate->env->kill_sub)(subq); 742 (void)error_response(qstate, id, LDNS_RCODE_SERVFAIL); 743 return 1; /* return 1 to make module stop, with error */ 744 } 745 /* there should not be any target queries -- although there 746 * wouldn't be anyway, since stub hints never have 747 * missing targets. */ 748 subiq->num_target_queries = 0; 749 subiq->wait_priming_stub = 1; 750 subiq->dnssec_expected = iter_indicates_dnssec( 751 qstate->env, subiq->dp, NULL, subq->qinfo.qclass); 752 } 753 754 /* this module stops, our submodule starts, and does the query. */ 755 qstate->ext_state[id] = module_wait_subquery; 756 return 1; 757 } 758 759 /** 760 * Generate A and AAAA checks for glue that is in-zone for the referral 761 * we just got to obtain authoritative information on the adresses. 762 * 763 * @param qstate: the qtstate that triggered the need to prime. 764 * @param iq: iterator query state. 765 * @param id: module id. 766 */ 767 static void 768 generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq, 769 int id) 770 { 771 struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id]; 772 struct module_qstate* subq; 773 size_t i; 774 struct reply_info* rep = iq->response->rep; 775 struct ub_packed_rrset_key* s; 776 log_assert(iq->dp); 777 778 if(iq->depth == ie->max_dependency_depth) 779 return; 780 /* walk through additional, and check if in-zone, 781 * only relevant A, AAAA are left after scrub anyway */ 782 for(i=rep->an_numrrsets+rep->ns_numrrsets; i<rep->rrset_count; i++) { 783 s = rep->rrsets[i]; 784 /* check *ALL* addresses that are transmitted in additional*/ 785 /* is it an address ? */ 786 if( !(ntohs(s->rk.type)==LDNS_RR_TYPE_A || 787 ntohs(s->rk.type)==LDNS_RR_TYPE_AAAA)) { 788 continue; 789 } 790 /* is this query the same as the A/AAAA check for it */ 791 if(qstate->qinfo.qtype == ntohs(s->rk.type) && 792 qstate->qinfo.qclass == ntohs(s->rk.rrset_class) && 793 query_dname_compare(qstate->qinfo.qname, 794 s->rk.dname)==0 && 795 (qstate->query_flags&BIT_RD) && 796 !(qstate->query_flags&BIT_CD)) 797 continue; 798 799 /* generate subrequest for it */ 800 log_nametypeclass(VERB_ALGO, "schedule addr fetch", 801 s->rk.dname, ntohs(s->rk.type), 802 ntohs(s->rk.rrset_class)); 803 if(!generate_sub_request(s->rk.dname, s->rk.dname_len, 804 ntohs(s->rk.type), ntohs(s->rk.rrset_class), 805 qstate, id, iq, 806 INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1)) { 807 verbose(VERB_ALGO, "could not generate addr check"); 808 return; 809 } 810 /* ignore subq - not need for more init */ 811 } 812 } 813 814 /** 815 * Generate a NS check request to obtain authoritative information 816 * on an NS rrset. 817 * 818 * @param qstate: the qtstate that triggered the need to prime. 819 * @param iq: iterator query state. 820 * @param id: module id. 821 */ 822 static void 823 generate_ns_check(struct module_qstate* qstate, struct iter_qstate* iq, int id) 824 { 825 struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id]; 826 struct module_qstate* subq; 827 log_assert(iq->dp); 828 829 if(iq->depth == ie->max_dependency_depth) 830 return; 831 /* is this query the same as the nscheck? */ 832 if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS && 833 query_dname_compare(iq->dp->name, qstate->qinfo.qname)==0 && 834 (qstate->query_flags&BIT_RD) && !(qstate->query_flags&BIT_CD)){ 835 /* spawn off A, AAAA queries for in-zone glue to check */ 836 generate_a_aaaa_check(qstate, iq, id); 837 return; 838 } 839 840 log_nametypeclass(VERB_ALGO, "schedule ns fetch", 841 iq->dp->name, LDNS_RR_TYPE_NS, iq->qchase.qclass); 842 if(!generate_sub_request(iq->dp->name, iq->dp->namelen, 843 LDNS_RR_TYPE_NS, iq->qchase.qclass, qstate, id, iq, 844 INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1)) { 845 verbose(VERB_ALGO, "could not generate ns check"); 846 return; 847 } 848 if(subq) { 849 struct iter_qstate* subiq = 850 (struct iter_qstate*)subq->minfo[id]; 851 852 /* make copy to avoid use of stub dp by different qs/threads */ 853 /* refetch glue to start higher up the tree */ 854 subiq->refetch_glue = 1; 855 subiq->dp = delegpt_copy(iq->dp, subq->region); 856 if(!subiq->dp) { 857 log_err("out of memory generating ns check, copydp"); 858 fptr_ok(fptr_whitelist_modenv_kill_sub( 859 qstate->env->kill_sub)); 860 (*qstate->env->kill_sub)(subq); 861 return; 862 } 863 } 864 } 865 866 /** 867 * Generate a DNSKEY prefetch query to get the DNSKEY for the DS record we 868 * just got in a referral (where we have dnssec_expected, thus have trust 869 * anchors above it). Note that right after calling this routine the 870 * iterator detached subqueries (because of following the referral), and thus 871 * the DNSKEY query becomes detached, its return stored in the cache for 872 * later lookup by the validator. This cache lookup by the validator avoids 873 * the roundtrip incurred by the DNSKEY query. The DNSKEY query is now 874 * performed at about the same time the original query is sent to the domain, 875 * thus the two answers are likely to be returned at about the same time, 876 * saving a roundtrip from the validated lookup. 877 * 878 * @param qstate: the qtstate that triggered the need to prime. 879 * @param iq: iterator query state. 880 * @param id: module id. 881 */ 882 static void 883 generate_dnskey_prefetch(struct module_qstate* qstate, 884 struct iter_qstate* iq, int id) 885 { 886 struct module_qstate* subq; 887 log_assert(iq->dp); 888 889 /* is this query the same as the prefetch? */ 890 if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY && 891 query_dname_compare(iq->dp->name, qstate->qinfo.qname)==0 && 892 (qstate->query_flags&BIT_RD) && !(qstate->query_flags&BIT_CD)){ 893 return; 894 } 895 896 /* if the DNSKEY is in the cache this lookup will stop quickly */ 897 log_nametypeclass(VERB_ALGO, "schedule dnskey prefetch", 898 iq->dp->name, LDNS_RR_TYPE_DNSKEY, iq->qchase.qclass); 899 if(!generate_sub_request(iq->dp->name, iq->dp->namelen, 900 LDNS_RR_TYPE_DNSKEY, iq->qchase.qclass, qstate, id, iq, 901 INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0)) { 902 /* we'll be slower, but it'll work */ 903 verbose(VERB_ALGO, "could not generate dnskey prefetch"); 904 return; 905 } 906 if(subq) { 907 struct iter_qstate* subiq = 908 (struct iter_qstate*)subq->minfo[id]; 909 /* this qstate has the right delegation for the dnskey lookup*/ 910 /* make copy to avoid use of stub dp by different qs/threads */ 911 subiq->dp = delegpt_copy(iq->dp, subq->region); 912 /* if !subiq->dp, it'll start from the cache, no problem */ 913 } 914 } 915 916 /** 917 * See if the query needs forwarding. 918 * 919 * @param qstate: query state. 920 * @param iq: iterator query state. 921 * @return true if the request is forwarded, false if not. 922 * If returns true but, iq->dp is NULL then a malloc failure occurred. 923 */ 924 static int 925 forward_request(struct module_qstate* qstate, struct iter_qstate* iq) 926 { 927 struct delegpt* dp; 928 uint8_t* delname = iq->qchase.qname; 929 size_t delnamelen = iq->qchase.qname_len; 930 if(iq->refetch_glue) { 931 delname = iq->dp->name; 932 delnamelen = iq->dp->namelen; 933 } 934 /* strip one label off of DS query to lookup higher for it */ 935 if( (iq->qchase.qtype == LDNS_RR_TYPE_DS || iq->refetch_glue) 936 && !dname_is_root(iq->qchase.qname)) 937 dname_remove_label(&delname, &delnamelen); 938 dp = forwards_lookup(qstate->env->fwds, delname, iq->qchase.qclass); 939 if(!dp) 940 return 0; 941 /* send recursion desired to forward addr */ 942 iq->chase_flags |= BIT_RD; 943 iq->dp = delegpt_copy(dp, qstate->region); 944 /* iq->dp checked by caller */ 945 verbose(VERB_ALGO, "forwarding request"); 946 return 1; 947 } 948 949 /** 950 * Process the initial part of the request handling. This state roughly 951 * corresponds to resolver algorithms steps 1 (find answer in cache) and 2 952 * (find the best servers to ask). 953 * 954 * Note that all requests start here, and query restarts revisit this state. 955 * 956 * This state either generates: 1) a response, from cache or error, 2) a 957 * priming event, or 3) forwards the request to the next state (init2, 958 * generally). 959 * 960 * @param qstate: query state. 961 * @param iq: iterator query state. 962 * @param ie: iterator shared global environment. 963 * @param id: module id. 964 * @return true if the event needs more request processing immediately, 965 * false if not. 966 */ 967 static int 968 processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq, 969 struct iter_env* ie, int id) 970 { 971 uint8_t* delname; 972 size_t delnamelen; 973 struct dns_msg* msg = NULL; 974 975 log_query_info(VERB_DETAIL, "resolving", &qstate->qinfo); 976 /* check effort */ 977 978 /* We enforce a maximum number of query restarts. This is primarily a 979 * cheap way to prevent CNAME loops. */ 980 if(iq->query_restart_count > MAX_RESTART_COUNT) { 981 verbose(VERB_QUERY, "request has exceeded the maximum number" 982 " of query restarts with %d", iq->query_restart_count); 983 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 984 } 985 986 /* We enforce a maximum recursion/dependency depth -- in general, 987 * this is unnecessary for dependency loops (although it will 988 * catch those), but it provides a sensible limit to the amount 989 * of work required to answer a given query. */ 990 verbose(VERB_ALGO, "request has dependency depth of %d", iq->depth); 991 if(iq->depth > ie->max_dependency_depth) { 992 verbose(VERB_QUERY, "request has exceeded the maximum " 993 "dependency depth with depth of %d", iq->depth); 994 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 995 } 996 997 /* If the request is qclass=ANY, setup to generate each class */ 998 if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) { 999 iq->qchase.qclass = 0; 1000 return next_state(iq, COLLECT_CLASS_STATE); 1001 } 1002 1003 /* Resolver Algorithm Step 1 -- Look for the answer in local data. */ 1004 1005 /* This either results in a query restart (CNAME cache response), a 1006 * terminating response (ANSWER), or a cache miss (null). */ 1007 1008 if(qstate->blacklist) { 1009 /* if cache, or anything else, was blacklisted then 1010 * getting older results from cache is a bad idea, no cache */ 1011 verbose(VERB_ALGO, "cache blacklisted, going to the network"); 1012 msg = NULL; 1013 } else if(!qstate->no_cache_lookup) { 1014 msg = dns_cache_lookup(qstate->env, iq->qchase.qname, 1015 iq->qchase.qname_len, iq->qchase.qtype, 1016 iq->qchase.qclass, qstate->query_flags, 1017 qstate->region, qstate->env->scratch); 1018 if(!msg && qstate->env->neg_cache) { 1019 /* lookup in negative cache; may result in 1020 * NOERROR/NODATA or NXDOMAIN answers that need validation */ 1021 msg = val_neg_getmsg(qstate->env->neg_cache, &iq->qchase, 1022 qstate->region, qstate->env->rrset_cache, 1023 qstate->env->scratch_buffer, 1024 *qstate->env->now, 1/*add SOA*/, NULL); 1025 } 1026 /* item taken from cache does not match our query name, thus 1027 * security needs to be re-examined later */ 1028 if(msg && query_dname_compare(qstate->qinfo.qname, 1029 iq->qchase.qname) != 0) 1030 msg->rep->security = sec_status_unchecked; 1031 } 1032 if(msg) { 1033 /* handle positive cache response */ 1034 enum response_type type = response_type_from_cache(msg, 1035 &iq->qchase); 1036 if(verbosity >= VERB_ALGO) { 1037 log_dns_msg("msg from cache lookup", &msg->qinfo, 1038 msg->rep); 1039 verbose(VERB_ALGO, "msg ttl is %d, prefetch ttl %d", 1040 (int)msg->rep->ttl, 1041 (int)msg->rep->prefetch_ttl); 1042 } 1043 1044 if(type == RESPONSE_TYPE_CNAME) { 1045 uint8_t* sname = 0; 1046 size_t slen = 0; 1047 verbose(VERB_ALGO, "returning CNAME response from " 1048 "cache"); 1049 if(!handle_cname_response(qstate, iq, msg, 1050 &sname, &slen)) 1051 return error_response(qstate, id, 1052 LDNS_RCODE_SERVFAIL); 1053 iq->qchase.qname = sname; 1054 iq->qchase.qname_len = slen; 1055 /* This *is* a query restart, even if it is a cheap 1056 * one. */ 1057 iq->dp = NULL; 1058 iq->refetch_glue = 0; 1059 iq->query_restart_count++; 1060 iq->sent_count = 0; 1061 sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region); 1062 if(qstate->env->cfg->qname_minimisation) 1063 iq->minimisation_state = INIT_MINIMISE_STATE; 1064 return next_state(iq, INIT_REQUEST_STATE); 1065 } 1066 1067 /* if from cache, NULL, else insert 'cache IP' len=0 */ 1068 if(qstate->reply_origin) 1069 sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region); 1070 /* it is an answer, response, to final state */ 1071 verbose(VERB_ALGO, "returning answer from cache."); 1072 iq->response = msg; 1073 return final_state(iq); 1074 } 1075 1076 /* attempt to forward the request */ 1077 if(forward_request(qstate, iq)) 1078 { 1079 if(!iq->dp) { 1080 log_err("alloc failure for forward dp"); 1081 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 1082 } 1083 iq->refetch_glue = 0; 1084 iq->minimisation_state = DONOT_MINIMISE_STATE; 1085 /* the request has been forwarded. 1086 * forwarded requests need to be immediately sent to the 1087 * next state, QUERYTARGETS. */ 1088 return next_state(iq, QUERYTARGETS_STATE); 1089 } 1090 1091 /* Resolver Algorithm Step 2 -- find the "best" servers. */ 1092 1093 /* first, adjust for DS queries. To avoid the grandparent problem, 1094 * we just look for the closest set of server to the parent of qname. 1095 * When re-fetching glue we also need to ask the parent. 1096 */ 1097 if(iq->refetch_glue) { 1098 if(!iq->dp) { 1099 log_err("internal or malloc fail: no dp for refetch"); 1100 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 1101 } 1102 delname = iq->dp->name; 1103 delnamelen = iq->dp->namelen; 1104 } else { 1105 delname = iq->qchase.qname; 1106 delnamelen = iq->qchase.qname_len; 1107 } 1108 if(iq->qchase.qtype == LDNS_RR_TYPE_DS || iq->refetch_glue || 1109 (iq->qchase.qtype == LDNS_RR_TYPE_NS && qstate->prefetch_leeway)) { 1110 /* remove first label from delname, root goes to hints, 1111 * but only to fetch glue, not for qtype=DS. */ 1112 /* also when prefetching an NS record, fetch it again from 1113 * its parent, just as if it expired, so that you do not 1114 * get stuck on an older nameserver that gives old NSrecords */ 1115 if(dname_is_root(delname) && (iq->refetch_glue || 1116 (iq->qchase.qtype == LDNS_RR_TYPE_NS && 1117 qstate->prefetch_leeway))) 1118 delname = NULL; /* go to root priming */ 1119 else dname_remove_label(&delname, &delnamelen); 1120 } 1121 /* delname is the name to lookup a delegation for. If NULL rootprime */ 1122 while(1) { 1123 1124 /* Lookup the delegation in the cache. If null, then the 1125 * cache needs to be primed for the qclass. */ 1126 if(delname) 1127 iq->dp = dns_cache_find_delegation(qstate->env, delname, 1128 delnamelen, iq->qchase.qtype, iq->qchase.qclass, 1129 qstate->region, &iq->deleg_msg, 1130 *qstate->env->now+qstate->prefetch_leeway); 1131 else iq->dp = NULL; 1132 1133 /* If the cache has returned nothing, then we have a 1134 * root priming situation. */ 1135 if(iq->dp == NULL) { 1136 /* if there is a stub, then no root prime needed */ 1137 int r = prime_stub(qstate, iq, id, delname, 1138 iq->qchase.qclass); 1139 if(r == 2) 1140 break; /* got noprime-stub-zone, continue */ 1141 else if(r) 1142 return 0; /* stub prime request made */ 1143 if(forwards_lookup_root(qstate->env->fwds, 1144 iq->qchase.qclass)) { 1145 /* forward zone root, no root prime needed */ 1146 /* fill in some dp - safety belt */ 1147 iq->dp = hints_lookup_root(qstate->env->hints, 1148 iq->qchase.qclass); 1149 if(!iq->dp) { 1150 log_err("internal error: no hints dp"); 1151 return error_response(qstate, id, 1152 LDNS_RCODE_SERVFAIL); 1153 } 1154 iq->dp = delegpt_copy(iq->dp, qstate->region); 1155 if(!iq->dp) { 1156 log_err("out of memory in safety belt"); 1157 return error_response(qstate, id, 1158 LDNS_RCODE_SERVFAIL); 1159 } 1160 return next_state(iq, INIT_REQUEST_2_STATE); 1161 } 1162 /* Note that the result of this will set a new 1163 * DelegationPoint based on the result of priming. */ 1164 if(!prime_root(qstate, iq, id, iq->qchase.qclass)) 1165 return error_response(qstate, id, 1166 LDNS_RCODE_REFUSED); 1167 1168 /* priming creates and sends a subordinate query, with 1169 * this query as the parent. So further processing for 1170 * this event will stop until reactivated by the 1171 * results of priming. */ 1172 return 0; 1173 } 1174 if(!iq->ratelimit_ok && qstate->prefetch_leeway) 1175 iq->ratelimit_ok = 1; /* allow prefetches, this keeps 1176 otherwise valid data in the cache */ 1177 if(!iq->ratelimit_ok && infra_ratelimit_exceeded( 1178 qstate->env->infra_cache, iq->dp->name, 1179 iq->dp->namelen, *qstate->env->now)) { 1180 /* and increment the rate, so that the rate for time 1181 * now will also exceed the rate, keeping cache fresh */ 1182 (void)infra_ratelimit_inc(qstate->env->infra_cache, 1183 iq->dp->name, iq->dp->namelen, 1184 *qstate->env->now); 1185 /* see if we are passed through with slip factor */ 1186 if(qstate->env->cfg->ratelimit_factor != 0 && 1187 ub_random_max(qstate->env->rnd, 1188 qstate->env->cfg->ratelimit_factor) == 1) { 1189 iq->ratelimit_ok = 1; 1190 log_nametypeclass(VERB_ALGO, "ratelimit allowed through for " 1191 "delegation point", iq->dp->name, 1192 LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN); 1193 } else { 1194 log_nametypeclass(VERB_ALGO, "ratelimit exceeded with " 1195 "delegation point", iq->dp->name, 1196 LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN); 1197 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 1198 } 1199 } 1200 1201 /* see if this dp not useless. 1202 * It is useless if: 1203 * o all NS items are required glue. 1204 * or the query is for NS item that is required glue. 1205 * o no addresses are provided. 1206 * o RD qflag is on. 1207 * Instead, go up one level, and try to get even further 1208 * If the root was useless, use safety belt information. 1209 * Only check cache returns, because replies for servers 1210 * could be useless but lead to loops (bumping into the 1211 * same server reply) if useless-checked. 1212 */ 1213 if(iter_dp_is_useless(&qstate->qinfo, qstate->query_flags, 1214 iq->dp)) { 1215 if(dname_is_root(iq->dp->name)) { 1216 /* use safety belt */ 1217 verbose(VERB_QUERY, "Cache has root NS but " 1218 "no addresses. Fallback to the safety belt."); 1219 iq->dp = hints_lookup_root(qstate->env->hints, 1220 iq->qchase.qclass); 1221 /* note deleg_msg is from previous lookup, 1222 * but RD is on, so it is not used */ 1223 if(!iq->dp) { 1224 log_err("internal error: no hints dp"); 1225 return error_response(qstate, id, 1226 LDNS_RCODE_REFUSED); 1227 } 1228 iq->dp = delegpt_copy(iq->dp, qstate->region); 1229 if(!iq->dp) { 1230 log_err("out of memory in safety belt"); 1231 return error_response(qstate, id, 1232 LDNS_RCODE_SERVFAIL); 1233 } 1234 break; 1235 } else { 1236 verbose(VERB_ALGO, 1237 "cache delegation was useless:"); 1238 delegpt_log(VERB_ALGO, iq->dp); 1239 /* go up */ 1240 delname = iq->dp->name; 1241 delnamelen = iq->dp->namelen; 1242 dname_remove_label(&delname, &delnamelen); 1243 } 1244 } else break; 1245 } 1246 1247 verbose(VERB_ALGO, "cache delegation returns delegpt"); 1248 delegpt_log(VERB_ALGO, iq->dp); 1249 1250 /* Otherwise, set the current delegation point and move on to the 1251 * next state. */ 1252 return next_state(iq, INIT_REQUEST_2_STATE); 1253 } 1254 1255 /** 1256 * Process the second part of the initial request handling. This state 1257 * basically exists so that queries that generate root priming events have 1258 * the same init processing as ones that do not. Request events that reach 1259 * this state must have a valid currentDelegationPoint set. 1260 * 1261 * This part is primarly handling stub zone priming. Events that reach this 1262 * state must have a current delegation point. 1263 * 1264 * @param qstate: query state. 1265 * @param iq: iterator query state. 1266 * @param id: module id. 1267 * @return true if the event needs more request processing immediately, 1268 * false if not. 1269 */ 1270 static int 1271 processInitRequest2(struct module_qstate* qstate, struct iter_qstate* iq, 1272 int id) 1273 { 1274 uint8_t* delname; 1275 size_t delnamelen; 1276 log_query_info(VERB_QUERY, "resolving (init part 2): ", 1277 &qstate->qinfo); 1278 1279 if(iq->refetch_glue) { 1280 if(!iq->dp) { 1281 log_err("internal or malloc fail: no dp for refetch"); 1282 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 1283 } 1284 delname = iq->dp->name; 1285 delnamelen = iq->dp->namelen; 1286 } else { 1287 delname = iq->qchase.qname; 1288 delnamelen = iq->qchase.qname_len; 1289 } 1290 if(iq->qchase.qtype == LDNS_RR_TYPE_DS || iq->refetch_glue) { 1291 if(!dname_is_root(delname)) 1292 dname_remove_label(&delname, &delnamelen); 1293 iq->refetch_glue = 0; /* if CNAME causes restart, no refetch */ 1294 } 1295 /* Check to see if we need to prime a stub zone. */ 1296 if(prime_stub(qstate, iq, id, delname, iq->qchase.qclass)) { 1297 /* A priming sub request was made */ 1298 return 0; 1299 } 1300 1301 /* most events just get forwarded to the next state. */ 1302 return next_state(iq, INIT_REQUEST_3_STATE); 1303 } 1304 1305 /** 1306 * Process the third part of the initial request handling. This state exists 1307 * as a separate state so that queries that generate stub priming events 1308 * will get the tail end of the init process but not repeat the stub priming 1309 * check. 1310 * 1311 * @param qstate: query state. 1312 * @param iq: iterator query state. 1313 * @param id: module id. 1314 * @return true, advancing the event to the QUERYTARGETS_STATE. 1315 */ 1316 static int 1317 processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq, 1318 int id) 1319 { 1320 log_query_info(VERB_QUERY, "resolving (init part 3): ", 1321 &qstate->qinfo); 1322 /* if the cache reply dp equals a validation anchor or msg has DS, 1323 * then DNSSEC RRSIGs are expected in the reply */ 1324 iq->dnssec_expected = iter_indicates_dnssec(qstate->env, iq->dp, 1325 iq->deleg_msg, iq->qchase.qclass); 1326 1327 /* If the RD flag wasn't set, then we just finish with the 1328 * cached referral as the response. */ 1329 if(!(qstate->query_flags & BIT_RD)) { 1330 iq->response = iq->deleg_msg; 1331 if(verbosity >= VERB_ALGO && iq->response) 1332 log_dns_msg("no RD requested, using delegation msg", 1333 &iq->response->qinfo, iq->response->rep); 1334 if(qstate->reply_origin) 1335 sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region); 1336 return final_state(iq); 1337 } 1338 /* After this point, unset the RD flag -- this query is going to 1339 * be sent to an auth. server. */ 1340 iq->chase_flags &= ~BIT_RD; 1341 1342 /* if dnssec expected, fetch key for the trust-anchor or cached-DS */ 1343 if(iq->dnssec_expected && qstate->env->cfg->prefetch_key && 1344 !(qstate->query_flags&BIT_CD)) { 1345 generate_dnskey_prefetch(qstate, iq, id); 1346 fptr_ok(fptr_whitelist_modenv_detach_subs( 1347 qstate->env->detach_subs)); 1348 (*qstate->env->detach_subs)(qstate); 1349 } 1350 1351 /* Jump to the next state. */ 1352 return next_state(iq, QUERYTARGETS_STATE); 1353 } 1354 1355 /** 1356 * Given a basic query, generate a parent-side "target" query. 1357 * These are subordinate queries for missing delegation point target addresses, 1358 * for which only the parent of the delegation provides correct IP addresses. 1359 * 1360 * @param qstate: query state. 1361 * @param iq: iterator query state. 1362 * @param id: module id. 1363 * @param name: target qname. 1364 * @param namelen: target qname length. 1365 * @param qtype: target qtype (either A or AAAA). 1366 * @param qclass: target qclass. 1367 * @return true on success, false on failure. 1368 */ 1369 static int 1370 generate_parentside_target_query(struct module_qstate* qstate, 1371 struct iter_qstate* iq, int id, uint8_t* name, size_t namelen, 1372 uint16_t qtype, uint16_t qclass) 1373 { 1374 struct module_qstate* subq; 1375 if(!generate_sub_request(name, namelen, qtype, qclass, qstate, 1376 id, iq, INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0)) 1377 return 0; 1378 if(subq) { 1379 struct iter_qstate* subiq = 1380 (struct iter_qstate*)subq->minfo[id]; 1381 /* blacklist the cache - we want to fetch parent stuff */ 1382 sock_list_insert(&subq->blacklist, NULL, 0, subq->region); 1383 subiq->query_for_pside_glue = 1; 1384 if(dname_subdomain_c(name, iq->dp->name)) { 1385 subiq->dp = delegpt_copy(iq->dp, subq->region); 1386 subiq->dnssec_expected = iter_indicates_dnssec( 1387 qstate->env, subiq->dp, NULL, 1388 subq->qinfo.qclass); 1389 subiq->refetch_glue = 1; 1390 } else { 1391 subiq->dp = dns_cache_find_delegation(qstate->env, 1392 name, namelen, qtype, qclass, subq->region, 1393 &subiq->deleg_msg, 1394 *qstate->env->now+subq->prefetch_leeway); 1395 /* if no dp, then it's from root, refetch unneeded */ 1396 if(subiq->dp) { 1397 subiq->dnssec_expected = iter_indicates_dnssec( 1398 qstate->env, subiq->dp, NULL, 1399 subq->qinfo.qclass); 1400 subiq->refetch_glue = 1; 1401 } 1402 } 1403 } 1404 log_nametypeclass(VERB_QUERY, "new pside target", name, qtype, qclass); 1405 return 1; 1406 } 1407 1408 /** 1409 * Given a basic query, generate a "target" query. These are subordinate 1410 * queries for missing delegation point target addresses. 1411 * 1412 * @param qstate: query state. 1413 * @param iq: iterator query state. 1414 * @param id: module id. 1415 * @param name: target qname. 1416 * @param namelen: target qname length. 1417 * @param qtype: target qtype (either A or AAAA). 1418 * @param qclass: target qclass. 1419 * @return true on success, false on failure. 1420 */ 1421 static int 1422 generate_target_query(struct module_qstate* qstate, struct iter_qstate* iq, 1423 int id, uint8_t* name, size_t namelen, uint16_t qtype, uint16_t qclass) 1424 { 1425 struct module_qstate* subq; 1426 if(!generate_sub_request(name, namelen, qtype, qclass, qstate, 1427 id, iq, INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0)) 1428 return 0; 1429 log_nametypeclass(VERB_QUERY, "new target", name, qtype, qclass); 1430 return 1; 1431 } 1432 1433 /** 1434 * Given an event at a certain state, generate zero or more target queries 1435 * for it's current delegation point. 1436 * 1437 * @param qstate: query state. 1438 * @param iq: iterator query state. 1439 * @param ie: iterator shared global environment. 1440 * @param id: module id. 1441 * @param maxtargets: The maximum number of targets to query for. 1442 * if it is negative, there is no maximum number of targets. 1443 * @param num: returns the number of queries generated and processed, 1444 * which may be zero if there were no missing targets. 1445 * @return false on error. 1446 */ 1447 static int 1448 query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq, 1449 struct iter_env* ie, int id, int maxtargets, int* num) 1450 { 1451 int query_count = 0; 1452 struct delegpt_ns* ns; 1453 int missing; 1454 int toget = 0; 1455 1456 if(iq->depth == ie->max_dependency_depth) 1457 return 0; 1458 if(iq->depth > 0 && iq->target_count && 1459 iq->target_count[1] > MAX_TARGET_COUNT) { 1460 char s[LDNS_MAX_DOMAINLEN+1]; 1461 dname_str(qstate->qinfo.qname, s); 1462 verbose(VERB_QUERY, "request %s has exceeded the maximum " 1463 "number of glue fetches %d", s, iq->target_count[1]); 1464 return 0; 1465 } 1466 1467 iter_mark_cycle_targets(qstate, iq->dp); 1468 missing = (int)delegpt_count_missing_targets(iq->dp); 1469 log_assert(maxtargets != 0); /* that would not be useful */ 1470 1471 /* Generate target requests. Basically, any missing targets 1472 * are queried for here, regardless if it is necessary to do 1473 * so to continue processing. */ 1474 if(maxtargets < 0 || maxtargets > missing) 1475 toget = missing; 1476 else toget = maxtargets; 1477 if(toget == 0) { 1478 *num = 0; 1479 return 1; 1480 } 1481 /* select 'toget' items from the total of 'missing' items */ 1482 log_assert(toget <= missing); 1483 1484 /* loop over missing targets */ 1485 for(ns = iq->dp->nslist; ns; ns = ns->next) { 1486 if(ns->resolved) 1487 continue; 1488 1489 /* randomly select this item with probability toget/missing */ 1490 if(!iter_ns_probability(qstate->env->rnd, toget, missing)) { 1491 /* do not select this one, next; select toget number 1492 * of items from a list one less in size */ 1493 missing --; 1494 continue; 1495 } 1496 1497 if(ie->supports_ipv6 && !ns->got6) { 1498 /* Send the AAAA request. */ 1499 if(!generate_target_query(qstate, iq, id, 1500 ns->name, ns->namelen, 1501 LDNS_RR_TYPE_AAAA, iq->qchase.qclass)) { 1502 *num = query_count; 1503 if(query_count > 0) 1504 qstate->ext_state[id] = module_wait_subquery; 1505 return 0; 1506 } 1507 query_count++; 1508 } 1509 /* Send the A request. */ 1510 if(ie->supports_ipv4 && !ns->got4) { 1511 if(!generate_target_query(qstate, iq, id, 1512 ns->name, ns->namelen, 1513 LDNS_RR_TYPE_A, iq->qchase.qclass)) { 1514 *num = query_count; 1515 if(query_count > 0) 1516 qstate->ext_state[id] = module_wait_subquery; 1517 return 0; 1518 } 1519 query_count++; 1520 } 1521 1522 /* mark this target as in progress. */ 1523 ns->resolved = 1; 1524 missing--; 1525 toget--; 1526 if(toget == 0) 1527 break; 1528 } 1529 *num = query_count; 1530 if(query_count > 0) 1531 qstate->ext_state[id] = module_wait_subquery; 1532 1533 return 1; 1534 } 1535 1536 /** see if last resort is possible - does config allow queries to parent */ 1537 static int 1538 can_have_last_resort(struct module_env* env, struct delegpt* dp, 1539 struct iter_qstate* iq) 1540 { 1541 struct delegpt* fwddp; 1542 struct iter_hints_stub* stub; 1543 /* do not process a last resort (the parent side) if a stub 1544 * or forward is configured, because we do not want to go 'above' 1545 * the configured servers */ 1546 if(!dname_is_root(dp->name) && (stub = (struct iter_hints_stub*) 1547 name_tree_find(&env->hints->tree, dp->name, dp->namelen, 1548 dp->namelabs, iq->qchase.qclass)) && 1549 /* has_parent side is turned off for stub_first, where we 1550 * are allowed to go to the parent */ 1551 stub->dp->has_parent_side_NS) { 1552 verbose(VERB_QUERY, "configured stub servers failed -- returning SERVFAIL"); 1553 return 0; 1554 } 1555 if((fwddp = forwards_find(env->fwds, dp->name, iq->qchase.qclass)) && 1556 /* has_parent_side is turned off for forward_first, where 1557 * we are allowed to go to the parent */ 1558 fwddp->has_parent_side_NS) { 1559 verbose(VERB_QUERY, "configured forward servers failed -- returning SERVFAIL"); 1560 return 0; 1561 } 1562 return 1; 1563 } 1564 1565 /** 1566 * Called by processQueryTargets when it would like extra targets to query 1567 * but it seems to be out of options. At last resort some less appealing 1568 * options are explored. If there are no more options, the result is SERVFAIL 1569 * 1570 * @param qstate: query state. 1571 * @param iq: iterator query state. 1572 * @param ie: iterator shared global environment. 1573 * @param id: module id. 1574 * @return true if the event requires more request processing immediately, 1575 * false if not. 1576 */ 1577 static int 1578 processLastResort(struct module_qstate* qstate, struct iter_qstate* iq, 1579 struct iter_env* ie, int id) 1580 { 1581 struct delegpt_ns* ns; 1582 int query_count = 0; 1583 verbose(VERB_ALGO, "No more query targets, attempting last resort"); 1584 log_assert(iq->dp); 1585 1586 if(!can_have_last_resort(qstate->env, iq->dp, iq)) { 1587 /* fail -- no more targets, no more hope of targets, no hope 1588 * of a response. */ 1589 return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL); 1590 } 1591 if(!iq->dp->has_parent_side_NS && dname_is_root(iq->dp->name)) { 1592 struct delegpt* p = hints_lookup_root(qstate->env->hints, 1593 iq->qchase.qclass); 1594 if(p) { 1595 struct delegpt_ns* ns; 1596 struct delegpt_addr* a; 1597 iq->chase_flags &= ~BIT_RD; /* go to authorities */ 1598 for(ns = p->nslist; ns; ns=ns->next) { 1599 (void)delegpt_add_ns(iq->dp, qstate->region, 1600 ns->name, ns->lame); 1601 } 1602 for(a = p->target_list; a; a=a->next_target) { 1603 (void)delegpt_add_addr(iq->dp, qstate->region, 1604 &a->addr, a->addrlen, a->bogus, 1605 a->lame); 1606 } 1607 } 1608 iq->dp->has_parent_side_NS = 1; 1609 } else if(!iq->dp->has_parent_side_NS) { 1610 if(!iter_lookup_parent_NS_from_cache(qstate->env, iq->dp, 1611 qstate->region, &qstate->qinfo) 1612 || !iq->dp->has_parent_side_NS) { 1613 /* if: malloc failure in lookup go up to try */ 1614 /* if: no parent NS in cache - go up one level */ 1615 verbose(VERB_ALGO, "try to grab parent NS"); 1616 iq->store_parent_NS = iq->dp; 1617 iq->chase_flags &= ~BIT_RD; /* go to authorities */ 1618 iq->deleg_msg = NULL; 1619 iq->refetch_glue = 1; 1620 iq->query_restart_count++; 1621 iq->sent_count = 0; 1622 if(qstate->env->cfg->qname_minimisation) 1623 iq->minimisation_state = INIT_MINIMISE_STATE; 1624 return next_state(iq, INIT_REQUEST_STATE); 1625 } 1626 } 1627 /* see if that makes new names available */ 1628 if(!cache_fill_missing(qstate->env, iq->qchase.qclass, 1629 qstate->region, iq->dp)) 1630 log_err("out of memory in cache_fill_missing"); 1631 if(iq->dp->usable_list) { 1632 verbose(VERB_ALGO, "try parent-side-name, w. glue from cache"); 1633 return next_state(iq, QUERYTARGETS_STATE); 1634 } 1635 /* try to fill out parent glue from cache */ 1636 if(iter_lookup_parent_glue_from_cache(qstate->env, iq->dp, 1637 qstate->region, &qstate->qinfo)) { 1638 /* got parent stuff from cache, see if we can continue */ 1639 verbose(VERB_ALGO, "try parent-side glue from cache"); 1640 return next_state(iq, QUERYTARGETS_STATE); 1641 } 1642 /* query for an extra name added by the parent-NS record */ 1643 if(delegpt_count_missing_targets(iq->dp) > 0) { 1644 int qs = 0; 1645 verbose(VERB_ALGO, "try parent-side target name"); 1646 if(!query_for_targets(qstate, iq, ie, id, 1, &qs)) { 1647 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 1648 } 1649 iq->num_target_queries += qs; 1650 target_count_increase(iq, qs); 1651 if(qs != 0) { 1652 qstate->ext_state[id] = module_wait_subquery; 1653 return 0; /* and wait for them */ 1654 } 1655 } 1656 if(iq->depth == ie->max_dependency_depth) { 1657 verbose(VERB_QUERY, "maxdepth and need more nameservers, fail"); 1658 return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL); 1659 } 1660 if(iq->depth > 0 && iq->target_count && 1661 iq->target_count[1] > MAX_TARGET_COUNT) { 1662 char s[LDNS_MAX_DOMAINLEN+1]; 1663 dname_str(qstate->qinfo.qname, s); 1664 verbose(VERB_QUERY, "request %s has exceeded the maximum " 1665 "number of glue fetches %d", s, iq->target_count[1]); 1666 return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL); 1667 } 1668 /* mark cycle targets for parent-side lookups */ 1669 iter_mark_pside_cycle_targets(qstate, iq->dp); 1670 /* see if we can issue queries to get nameserver addresses */ 1671 /* this lookup is not randomized, but sequential. */ 1672 for(ns = iq->dp->nslist; ns; ns = ns->next) { 1673 /* query for parent-side A and AAAA for nameservers */ 1674 if(ie->supports_ipv6 && !ns->done_pside6) { 1675 /* Send the AAAA request. */ 1676 if(!generate_parentside_target_query(qstate, iq, id, 1677 ns->name, ns->namelen, 1678 LDNS_RR_TYPE_AAAA, iq->qchase.qclass)) 1679 return error_response(qstate, id, 1680 LDNS_RCODE_SERVFAIL); 1681 ns->done_pside6 = 1; 1682 query_count++; 1683 } 1684 if(ie->supports_ipv4 && !ns->done_pside4) { 1685 /* Send the A request. */ 1686 if(!generate_parentside_target_query(qstate, iq, id, 1687 ns->name, ns->namelen, 1688 LDNS_RR_TYPE_A, iq->qchase.qclass)) 1689 return error_response(qstate, id, 1690 LDNS_RCODE_SERVFAIL); 1691 ns->done_pside4 = 1; 1692 query_count++; 1693 } 1694 if(query_count != 0) { /* suspend to await results */ 1695 verbose(VERB_ALGO, "try parent-side glue lookup"); 1696 iq->num_target_queries += query_count; 1697 target_count_increase(iq, query_count); 1698 qstate->ext_state[id] = module_wait_subquery; 1699 return 0; 1700 } 1701 } 1702 1703 /* if this was a parent-side glue query itself, then store that 1704 * failure in cache. */ 1705 if(!qstate->no_cache_store && iq->query_for_pside_glue 1706 && !iq->pside_glue) 1707 iter_store_parentside_neg(qstate->env, &qstate->qinfo, 1708 iq->deleg_msg?iq->deleg_msg->rep: 1709 (iq->response?iq->response->rep:NULL)); 1710 1711 verbose(VERB_QUERY, "out of query targets -- returning SERVFAIL"); 1712 /* fail -- no more targets, no more hope of targets, no hope 1713 * of a response. */ 1714 return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL); 1715 } 1716 1717 /** 1718 * Try to find the NS record set that will resolve a qtype DS query. Due 1719 * to grandparent/grandchild reasons we did not get a proper lookup right 1720 * away. We need to create type NS queries until we get the right parent 1721 * for this lookup. We remove labels from the query to find the right point. 1722 * If we end up at the old dp name, then there is no solution. 1723 * 1724 * @param qstate: query state. 1725 * @param iq: iterator query state. 1726 * @param id: module id. 1727 * @return true if the event requires more immediate processing, false if 1728 * not. This is generally only true when forwarding the request to 1729 * the final state (i.e., on answer). 1730 */ 1731 static int 1732 processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id) 1733 { 1734 struct module_qstate* subq = NULL; 1735 verbose(VERB_ALGO, "processDSNSFind"); 1736 1737 if(!iq->dsns_point) { 1738 /* initialize */ 1739 iq->dsns_point = iq->qchase.qname; 1740 iq->dsns_point_len = iq->qchase.qname_len; 1741 } 1742 /* robustcheck for internal error: we are not underneath the dp */ 1743 if(!dname_subdomain_c(iq->dsns_point, iq->dp->name)) { 1744 return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL); 1745 } 1746 1747 /* go up one (more) step, until we hit the dp, if so, end */ 1748 dname_remove_label(&iq->dsns_point, &iq->dsns_point_len); 1749 if(query_dname_compare(iq->dsns_point, iq->dp->name) == 0) { 1750 /* there was no inbetween nameserver, use the old delegation 1751 * point again. And this time, because dsns_point is nonNULL 1752 * we are going to accept the (bad) result */ 1753 iq->state = QUERYTARGETS_STATE; 1754 return 1; 1755 } 1756 iq->state = DSNS_FIND_STATE; 1757 1758 /* spawn NS lookup (validation not needed, this is for DS lookup) */ 1759 log_nametypeclass(VERB_ALGO, "fetch nameservers", 1760 iq->dsns_point, LDNS_RR_TYPE_NS, iq->qchase.qclass); 1761 if(!generate_sub_request(iq->dsns_point, iq->dsns_point_len, 1762 LDNS_RR_TYPE_NS, iq->qchase.qclass, qstate, id, iq, 1763 INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0)) { 1764 return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL); 1765 } 1766 1767 return 0; 1768 } 1769 1770 /** 1771 * This is the request event state where the request will be sent to one of 1772 * its current query targets. This state also handles issuing target lookup 1773 * queries for missing target IP addresses. Queries typically iterate on 1774 * this state, both when they are just trying different targets for a given 1775 * delegation point, and when they change delegation points. This state 1776 * roughly corresponds to RFC 1034 algorithm steps 3 and 4. 1777 * 1778 * @param qstate: query state. 1779 * @param iq: iterator query state. 1780 * @param ie: iterator shared global environment. 1781 * @param id: module id. 1782 * @return true if the event requires more request processing immediately, 1783 * false if not. This state only returns true when it is generating 1784 * a SERVFAIL response because the query has hit a dead end. 1785 */ 1786 static int 1787 processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, 1788 struct iter_env* ie, int id) 1789 { 1790 int tf_policy; 1791 struct delegpt_addr* target; 1792 struct outbound_entry* outq; 1793 1794 /* NOTE: a request will encounter this state for each target it 1795 * needs to send a query to. That is, at least one per referral, 1796 * more if some targets timeout or return throwaway answers. */ 1797 1798 log_query_info(VERB_QUERY, "processQueryTargets:", &qstate->qinfo); 1799 verbose(VERB_ALGO, "processQueryTargets: targetqueries %d, " 1800 "currentqueries %d sentcount %d", iq->num_target_queries, 1801 iq->num_current_queries, iq->sent_count); 1802 1803 /* Make sure that we haven't run away */ 1804 /* FIXME: is this check even necessary? */ 1805 if(iq->referral_count > MAX_REFERRAL_COUNT) { 1806 verbose(VERB_QUERY, "request has exceeded the maximum " 1807 "number of referrrals with %d", iq->referral_count); 1808 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 1809 } 1810 if(iq->sent_count > MAX_SENT_COUNT) { 1811 verbose(VERB_QUERY, "request has exceeded the maximum " 1812 "number of sends with %d", iq->sent_count); 1813 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 1814 } 1815 1816 /* Make sure we have a delegation point, otherwise priming failed 1817 * or another failure occurred */ 1818 if(!iq->dp) { 1819 verbose(VERB_QUERY, "Failed to get a delegation, giving up"); 1820 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 1821 } 1822 if(!ie->supports_ipv6) 1823 delegpt_no_ipv6(iq->dp); 1824 if(!ie->supports_ipv4) 1825 delegpt_no_ipv4(iq->dp); 1826 delegpt_log(VERB_ALGO, iq->dp); 1827 1828 if(iq->num_current_queries>0) { 1829 /* already busy answering a query, this restart is because 1830 * more delegpt addrs became available, wait for existing 1831 * query. */ 1832 verbose(VERB_ALGO, "woke up, but wait for outstanding query"); 1833 qstate->ext_state[id] = module_wait_reply; 1834 return 0; 1835 } 1836 1837 tf_policy = 0; 1838 /* < not <=, because although the array is large enough for <=, the 1839 * generated query will immediately be discarded due to depth and 1840 * that servfail is cached, which is not good as opportunism goes. */ 1841 if(iq->depth < ie->max_dependency_depth 1842 && iq->sent_count < TARGET_FETCH_STOP) { 1843 tf_policy = ie->target_fetch_policy[iq->depth]; 1844 } 1845 1846 /* if in 0x20 fallback get as many targets as possible */ 1847 if(iq->caps_fallback) { 1848 int extra = 0; 1849 size_t naddr, nres, navail; 1850 if(!query_for_targets(qstate, iq, ie, id, -1, &extra)) { 1851 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 1852 } 1853 iq->num_target_queries += extra; 1854 target_count_increase(iq, extra); 1855 if(iq->num_target_queries > 0) { 1856 /* wait to get all targets, we want to try em */ 1857 verbose(VERB_ALGO, "wait for all targets for fallback"); 1858 qstate->ext_state[id] = module_wait_reply; 1859 return 0; 1860 } 1861 /* did we do enough fallback queries already? */ 1862 delegpt_count_addr(iq->dp, &naddr, &nres, &navail); 1863 /* the current caps_server is the number of fallbacks sent. 1864 * the original query is one that matched too, so we have 1865 * caps_server+1 number of matching queries now */ 1866 if(iq->caps_server+1 >= naddr*3 || 1867 iq->caps_server*2+2 >= MAX_SENT_COUNT) { 1868 /* *2 on sentcount check because ipv6 may fail */ 1869 /* we're done, process the response */ 1870 verbose(VERB_ALGO, "0x20 fallback had %d responses " 1871 "match for %d wanted, done.", 1872 (int)iq->caps_server+1, (int)naddr*3); 1873 iq->response = iq->caps_response; 1874 iq->caps_fallback = 0; 1875 iter_dec_attempts(iq->dp, 3); /* space for fallback */ 1876 iq->num_current_queries++; /* RespState decrements it*/ 1877 iq->referral_count++; /* make sure we don't loop */ 1878 iq->sent_count = 0; 1879 iq->state = QUERY_RESP_STATE; 1880 return 1; 1881 } 1882 verbose(VERB_ALGO, "0x20 fallback number %d", 1883 (int)iq->caps_server); 1884 1885 /* if there is a policy to fetch missing targets 1886 * opportunistically, do it. we rely on the fact that once a 1887 * query (or queries) for a missing name have been issued, 1888 * they will not show up again. */ 1889 } else if(tf_policy != 0) { 1890 int extra = 0; 1891 verbose(VERB_ALGO, "attempt to get extra %d targets", 1892 tf_policy); 1893 (void)query_for_targets(qstate, iq, ie, id, tf_policy, &extra); 1894 /* errors ignored, these targets are not strictly necessary for 1895 * this result, we do not have to reply with SERVFAIL */ 1896 iq->num_target_queries += extra; 1897 target_count_increase(iq, extra); 1898 } 1899 1900 /* Add the current set of unused targets to our queue. */ 1901 delegpt_add_unused_targets(iq->dp); 1902 1903 /* Select the next usable target, filtering out unsuitable targets. */ 1904 target = iter_server_selection(ie, qstate->env, iq->dp, 1905 iq->dp->name, iq->dp->namelen, iq->qchase.qtype, 1906 &iq->dnssec_lame_query, &iq->chase_to_rd, 1907 iq->num_target_queries, qstate->blacklist); 1908 1909 /* If no usable target was selected... */ 1910 if(!target) { 1911 /* Here we distinguish between three states: generate a new 1912 * target query, just wait, or quit (with a SERVFAIL). 1913 * We have the following information: number of active 1914 * target queries, number of active current queries, 1915 * the presence of missing targets at this delegation 1916 * point, and the given query target policy. */ 1917 1918 /* Check for the wait condition. If this is true, then 1919 * an action must be taken. */ 1920 if(iq->num_target_queries==0 && iq->num_current_queries==0) { 1921 /* If there is nothing to wait for, then we need 1922 * to distinguish between generating (a) new target 1923 * query, or failing. */ 1924 if(delegpt_count_missing_targets(iq->dp) > 0) { 1925 int qs = 0; 1926 verbose(VERB_ALGO, "querying for next " 1927 "missing target"); 1928 if(!query_for_targets(qstate, iq, ie, id, 1929 1, &qs)) { 1930 return error_response(qstate, id, 1931 LDNS_RCODE_SERVFAIL); 1932 } 1933 if(qs == 0 && 1934 delegpt_count_missing_targets(iq->dp) == 0){ 1935 /* it looked like there were missing 1936 * targets, but they did not turn up. 1937 * Try the bad choices again (if any), 1938 * when we get back here missing==0, 1939 * so this is not a loop. */ 1940 return 1; 1941 } 1942 iq->num_target_queries += qs; 1943 target_count_increase(iq, qs); 1944 } 1945 /* Since a target query might have been made, we 1946 * need to check again. */ 1947 if(iq->num_target_queries == 0) { 1948 /* if in capsforid fallback, instead of last 1949 * resort, we agree with the current reply 1950 * we have (if any) (our count of addrs bad)*/ 1951 if(iq->caps_fallback && iq->caps_reply) { 1952 /* we're done, process the response */ 1953 verbose(VERB_ALGO, "0x20 fallback had %d responses, " 1954 "but no more servers except " 1955 "last resort, done.", 1956 (int)iq->caps_server+1); 1957 iq->response = iq->caps_response; 1958 iq->caps_fallback = 0; 1959 iter_dec_attempts(iq->dp, 3); /* space for fallback */ 1960 iq->num_current_queries++; /* RespState decrements it*/ 1961 iq->referral_count++; /* make sure we don't loop */ 1962 iq->sent_count = 0; 1963 iq->state = QUERY_RESP_STATE; 1964 return 1; 1965 } 1966 return processLastResort(qstate, iq, ie, id); 1967 } 1968 } 1969 1970 /* otherwise, we have no current targets, so submerge 1971 * until one of the target or direct queries return. */ 1972 if(iq->num_target_queries>0 && iq->num_current_queries>0) { 1973 verbose(VERB_ALGO, "no current targets -- waiting " 1974 "for %d targets to resolve or %d outstanding" 1975 " queries to respond", iq->num_target_queries, 1976 iq->num_current_queries); 1977 qstate->ext_state[id] = module_wait_reply; 1978 } else if(iq->num_target_queries>0) { 1979 verbose(VERB_ALGO, "no current targets -- waiting " 1980 "for %d targets to resolve.", 1981 iq->num_target_queries); 1982 qstate->ext_state[id] = module_wait_subquery; 1983 } else { 1984 verbose(VERB_ALGO, "no current targets -- waiting " 1985 "for %d outstanding queries to respond.", 1986 iq->num_current_queries); 1987 qstate->ext_state[id] = module_wait_reply; 1988 } 1989 return 0; 1990 } 1991 1992 /* if not forwarding, check ratelimits per delegationpoint name */ 1993 if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) { 1994 if(!infra_ratelimit_inc(qstate->env->infra_cache, iq->dp->name, 1995 iq->dp->namelen, *qstate->env->now)) { 1996 verbose(VERB_ALGO, "query exceeded ratelimits"); 1997 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 1998 } 1999 } 2000 2001 if(iq->minimisation_state == INIT_MINIMISE_STATE) { 2002 /* (Re)set qinfo_out to (new) delegation point, except when 2003 * qinfo_out is already a subdomain of dp. This happens when 2004 * increasing by more than one label at once (QNAMEs with more 2005 * than MAX_MINIMISE_COUNT labels). */ 2006 if(!(iq->qinfo_out.qname_len 2007 && dname_subdomain_c(iq->qchase.qname, 2008 iq->qinfo_out.qname) 2009 && dname_subdomain_c(iq->qinfo_out.qname, 2010 iq->dp->name))) { 2011 iq->qinfo_out.qname = iq->dp->name; 2012 iq->qinfo_out.qname_len = iq->dp->namelen; 2013 iq->qinfo_out.qtype = LDNS_RR_TYPE_A; 2014 iq->qinfo_out.qclass = iq->qchase.qclass; 2015 iq->qinfo_out.local_alias = NULL; 2016 iq->minimise_count = 0; 2017 } 2018 2019 iq->minimisation_state = MINIMISE_STATE; 2020 } 2021 if(iq->minimisation_state == MINIMISE_STATE) { 2022 int qchaselabs = dname_count_labels(iq->qchase.qname); 2023 int labdiff = qchaselabs - 2024 dname_count_labels(iq->qinfo_out.qname); 2025 2026 iq->qinfo_out.qname = iq->qchase.qname; 2027 iq->qinfo_out.qname_len = iq->qchase.qname_len; 2028 iq->minimise_count++; 2029 iq->minimise_timeout_count = 0; 2030 2031 iter_dec_attempts(iq->dp, 1); 2032 2033 /* Limit number of iterations for QNAMEs with more 2034 * than MAX_MINIMISE_COUNT labels. Send first MINIMISE_ONE_LAB 2035 * labels of QNAME always individually. 2036 */ 2037 if(qchaselabs > MAX_MINIMISE_COUNT && labdiff > 1 && 2038 iq->minimise_count > MINIMISE_ONE_LAB) { 2039 if(iq->minimise_count < MAX_MINIMISE_COUNT) { 2040 int multilabs = qchaselabs - 1 - 2041 MINIMISE_ONE_LAB; 2042 int extralabs = multilabs / 2043 MINIMISE_MULTIPLE_LABS; 2044 2045 if (MAX_MINIMISE_COUNT - iq->minimise_count >= 2046 multilabs % MINIMISE_MULTIPLE_LABS) 2047 /* Default behaviour is to add 1 label 2048 * every iteration. Therefore, decrement 2049 * the extralabs by 1 */ 2050 extralabs--; 2051 if (extralabs < labdiff) 2052 labdiff -= extralabs; 2053 else 2054 labdiff = 1; 2055 } 2056 /* Last minimised iteration, send all labels with 2057 * QTYPE=NS */ 2058 else 2059 labdiff = 1; 2060 } 2061 2062 if(labdiff > 1) { 2063 verbose(VERB_QUERY, "removing %d labels", labdiff-1); 2064 dname_remove_labels(&iq->qinfo_out.qname, 2065 &iq->qinfo_out.qname_len, 2066 labdiff-1); 2067 } 2068 if(labdiff < 1 || (labdiff < 2 2069 && (iq->qchase.qtype == LDNS_RR_TYPE_DS 2070 || iq->qchase.qtype == LDNS_RR_TYPE_A))) 2071 /* Stop minimising this query, resolve "as usual" */ 2072 iq->minimisation_state = DONOT_MINIMISE_STATE; 2073 else if(!qstate->no_cache_lookup) { 2074 struct dns_msg* msg = dns_cache_lookup(qstate->env, 2075 iq->qinfo_out.qname, iq->qinfo_out.qname_len, 2076 iq->qinfo_out.qtype, iq->qinfo_out.qclass, 2077 qstate->query_flags, qstate->region, 2078 qstate->env->scratch); 2079 if(msg && msg->rep->an_numrrsets == 0 2080 && FLAGS_GET_RCODE(msg->rep->flags) == 2081 LDNS_RCODE_NOERROR) 2082 /* no need to send query if it is already 2083 * cached as NOERROR/NODATA */ 2084 return 1; 2085 } 2086 } 2087 if(iq->minimisation_state == SKIP_MINIMISE_STATE) { 2088 iq->minimise_timeout_count++; 2089 if(iq->minimise_timeout_count < MAX_MINIMISE_TIMEOUT_COUNT) 2090 /* Do not increment qname, continue incrementing next 2091 * iteration */ 2092 iq->minimisation_state = MINIMISE_STATE; 2093 else if(!qstate->env->cfg->qname_minimisation_strict) 2094 /* Too many time-outs detected for this QNAME and QTYPE. 2095 * We give up, disable QNAME minimisation. */ 2096 iq->minimisation_state = DONOT_MINIMISE_STATE; 2097 } 2098 if(iq->minimisation_state == DONOT_MINIMISE_STATE) 2099 iq->qinfo_out = iq->qchase; 2100 2101 /* We have a valid target. */ 2102 if(verbosity >= VERB_QUERY) { 2103 log_query_info(VERB_QUERY, "sending query:", &iq->qinfo_out); 2104 log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name, 2105 &target->addr, target->addrlen); 2106 verbose(VERB_ALGO, "dnssec status: %s%s", 2107 iq->dnssec_expected?"expected": "not expected", 2108 iq->dnssec_lame_query?" but lame_query anyway": ""); 2109 } 2110 fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query)); 2111 outq = (*qstate->env->send_query)(&iq->qinfo_out, 2112 iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), 2113 /* unset CD if to forwarder(RD set) and not dnssec retry 2114 * (blacklist nonempty) and no trust-anchors are configured 2115 * above the qname or on the first attempt when dnssec is on */ 2116 EDNS_DO| ((iq->chase_to_rd||(iq->chase_flags&BIT_RD)!=0)&& 2117 !qstate->blacklist&&(!iter_indicates_dnssec_fwd(qstate->env, 2118 &iq->qinfo_out)||target->attempts==1)?0:BIT_CD), 2119 iq->dnssec_expected, iq->caps_fallback || is_caps_whitelisted( 2120 ie, iq), &target->addr, target->addrlen, 2121 iq->dp->name, iq->dp->namelen, 2122 (iq->dp->ssl_upstream || qstate->env->cfg->ssl_upstream), qstate); 2123 if(!outq) { 2124 log_addr(VERB_DETAIL, "error sending query to auth server", 2125 &target->addr, target->addrlen); 2126 if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) 2127 infra_ratelimit_dec(qstate->env->infra_cache, iq->dp->name, 2128 iq->dp->namelen, *qstate->env->now); 2129 return next_state(iq, QUERYTARGETS_STATE); 2130 } 2131 outbound_list_insert(&iq->outlist, outq); 2132 iq->num_current_queries++; 2133 iq->sent_count++; 2134 qstate->ext_state[id] = module_wait_reply; 2135 2136 return 0; 2137 } 2138 2139 /** find NS rrset in given list */ 2140 static struct ub_packed_rrset_key* 2141 find_NS(struct reply_info* rep, size_t from, size_t to) 2142 { 2143 size_t i; 2144 for(i=from; i<to; i++) { 2145 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS) 2146 return rep->rrsets[i]; 2147 } 2148 return NULL; 2149 } 2150 2151 2152 /** 2153 * Process the query response. All queries end up at this state first. This 2154 * process generally consists of analyzing the response and routing the 2155 * event to the next state (either bouncing it back to a request state, or 2156 * terminating the processing for this event). 2157 * 2158 * @param qstate: query state. 2159 * @param iq: iterator query state. 2160 * @param id: module id. 2161 * @return true if the event requires more immediate processing, false if 2162 * not. This is generally only true when forwarding the request to 2163 * the final state (i.e., on answer). 2164 */ 2165 static int 2166 processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq, 2167 int id) 2168 { 2169 int dnsseclame = 0; 2170 enum response_type type; 2171 iq->num_current_queries--; 2172 if(iq->response == NULL) { 2173 /* Don't increment qname when QNAME minimisation is enabled */ 2174 if(qstate->env->cfg->qname_minimisation) 2175 iq->minimisation_state = SKIP_MINIMISE_STATE; 2176 iq->chase_to_rd = 0; 2177 iq->dnssec_lame_query = 0; 2178 verbose(VERB_ALGO, "query response was timeout"); 2179 return next_state(iq, QUERYTARGETS_STATE); 2180 } 2181 type = response_type_from_server( 2182 (int)((iq->chase_flags&BIT_RD) || iq->chase_to_rd), 2183 iq->response, &iq->qchase, iq->dp); 2184 iq->chase_to_rd = 0; 2185 if(type == RESPONSE_TYPE_REFERRAL && (iq->chase_flags&BIT_RD)) { 2186 /* When forwarding (RD bit is set), we handle referrals 2187 * differently. No queries should be sent elsewhere */ 2188 type = RESPONSE_TYPE_ANSWER; 2189 } 2190 if(!qstate->env->cfg->disable_dnssec_lame_check && iq->dnssec_expected 2191 && !iq->dnssec_lame_query && 2192 !(iq->chase_flags&BIT_RD) 2193 && iq->sent_count < DNSSEC_LAME_DETECT_COUNT 2194 && type != RESPONSE_TYPE_LAME 2195 && type != RESPONSE_TYPE_REC_LAME 2196 && type != RESPONSE_TYPE_THROWAWAY 2197 && type != RESPONSE_TYPE_UNTYPED) { 2198 /* a possible answer, see if it is missing DNSSEC */ 2199 /* but not when forwarding, so we dont mark fwder lame */ 2200 if(!iter_msg_has_dnssec(iq->response)) { 2201 /* Mark this address as dnsseclame in this dp, 2202 * because that will make serverselection disprefer 2203 * it, but also, once it is the only final option, 2204 * use dnssec-lame-bypass if it needs to query there.*/ 2205 if(qstate->reply) { 2206 struct delegpt_addr* a = delegpt_find_addr( 2207 iq->dp, &qstate->reply->addr, 2208 qstate->reply->addrlen); 2209 if(a) a->dnsseclame = 1; 2210 } 2211 /* test the answer is from the zone we expected, 2212 * otherwise, (due to parent,child on same server), we 2213 * might mark the server,zone lame inappropriately */ 2214 if(!iter_msg_from_zone(iq->response, iq->dp, type, 2215 iq->qchase.qclass)) 2216 qstate->reply = NULL; 2217 type = RESPONSE_TYPE_LAME; 2218 dnsseclame = 1; 2219 } 2220 } else iq->dnssec_lame_query = 0; 2221 /* see if referral brings us close to the target */ 2222 if(type == RESPONSE_TYPE_REFERRAL) { 2223 struct ub_packed_rrset_key* ns = find_NS( 2224 iq->response->rep, iq->response->rep->an_numrrsets, 2225 iq->response->rep->an_numrrsets 2226 + iq->response->rep->ns_numrrsets); 2227 if(!ns) ns = find_NS(iq->response->rep, 0, 2228 iq->response->rep->an_numrrsets); 2229 if(!ns || !dname_strict_subdomain_c(ns->rk.dname, iq->dp->name) 2230 || !dname_subdomain_c(iq->qchase.qname, ns->rk.dname)){ 2231 verbose(VERB_ALGO, "bad referral, throwaway"); 2232 type = RESPONSE_TYPE_THROWAWAY; 2233 } else 2234 iter_scrub_ds(iq->response, ns, iq->dp->name); 2235 } else iter_scrub_ds(iq->response, NULL, NULL); 2236 2237 /* handle each of the type cases */ 2238 if(type == RESPONSE_TYPE_ANSWER) { 2239 /* ANSWER type responses terminate the query algorithm, 2240 * so they sent on their */ 2241 if(verbosity >= VERB_DETAIL) { 2242 verbose(VERB_DETAIL, "query response was %s", 2243 FLAGS_GET_RCODE(iq->response->rep->flags) 2244 ==LDNS_RCODE_NXDOMAIN?"NXDOMAIN ANSWER": 2245 (iq->response->rep->an_numrrsets?"ANSWER": 2246 "nodata ANSWER")); 2247 } 2248 /* if qtype is DS, check we have the right level of answer, 2249 * like grandchild answer but we need the middle, reject it */ 2250 if(iq->qchase.qtype == LDNS_RR_TYPE_DS && !iq->dsns_point 2251 && !(iq->chase_flags&BIT_RD) 2252 && iter_ds_toolow(iq->response, iq->dp) 2253 && iter_dp_cangodown(&iq->qchase, iq->dp)) { 2254 /* close down outstanding requests to be discarded */ 2255 outbound_list_clear(&iq->outlist); 2256 iq->num_current_queries = 0; 2257 fptr_ok(fptr_whitelist_modenv_detach_subs( 2258 qstate->env->detach_subs)); 2259 (*qstate->env->detach_subs)(qstate); 2260 iq->num_target_queries = 0; 2261 return processDSNSFind(qstate, iq, id); 2262 } 2263 if(!qstate->no_cache_store) 2264 iter_dns_store(qstate->env, &iq->response->qinfo, 2265 iq->response->rep, 0, qstate->prefetch_leeway, 2266 iq->dp&&iq->dp->has_parent_side_NS, 2267 qstate->region, qstate->query_flags); 2268 /* close down outstanding requests to be discarded */ 2269 outbound_list_clear(&iq->outlist); 2270 iq->num_current_queries = 0; 2271 fptr_ok(fptr_whitelist_modenv_detach_subs( 2272 qstate->env->detach_subs)); 2273 (*qstate->env->detach_subs)(qstate); 2274 iq->num_target_queries = 0; 2275 if(qstate->reply) 2276 sock_list_insert(&qstate->reply_origin, 2277 &qstate->reply->addr, qstate->reply->addrlen, 2278 qstate->region); 2279 if(iq->minimisation_state != DONOT_MINIMISE_STATE) { 2280 if(FLAGS_GET_RCODE(iq->response->rep->flags) != 2281 LDNS_RCODE_NOERROR) { 2282 if(qstate->env->cfg->qname_minimisation_strict) 2283 return final_state(iq); 2284 /* Best effort qname-minimisation. 2285 * Stop minimising and send full query when 2286 * RCODE is not NOERROR. */ 2287 iq->minimisation_state = DONOT_MINIMISE_STATE; 2288 } 2289 if(FLAGS_GET_RCODE(iq->response->rep->flags) == 2290 LDNS_RCODE_NXDOMAIN) { 2291 /* Stop resolving when NXDOMAIN is DNSSEC 2292 * signed. Based on assumption that namservers 2293 * serving signed zones do not return NXDOMAIN 2294 * for empty-non-terminals. */ 2295 if(iq->dnssec_expected) 2296 return final_state(iq); 2297 /* Make subrequest to validate intermediate 2298 * NXDOMAIN if harden-below-nxdomain is 2299 * enabled. */ 2300 if(qstate->env->cfg->harden_below_nxdomain) { 2301 struct module_qstate* subq = NULL; 2302 log_query_info(VERB_QUERY, 2303 "schedule NXDOMAIN validation:", 2304 &iq->response->qinfo); 2305 if(!generate_sub_request( 2306 iq->response->qinfo.qname, 2307 iq->response->qinfo.qname_len, 2308 iq->response->qinfo.qtype, 2309 iq->response->qinfo.qclass, 2310 qstate, id, iq, 2311 INIT_REQUEST_STATE, 2312 FINISHED_STATE, &subq, 1)) 2313 verbose(VERB_ALGO, 2314 "could not validate NXDOMAIN " 2315 "response"); 2316 } 2317 } 2318 return next_state(iq, QUERYTARGETS_STATE); 2319 } 2320 return final_state(iq); 2321 } else if(type == RESPONSE_TYPE_REFERRAL) { 2322 /* REFERRAL type responses get a reset of the 2323 * delegation point, and back to the QUERYTARGETS_STATE. */ 2324 verbose(VERB_DETAIL, "query response was REFERRAL"); 2325 2326 if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) { 2327 /* we have a referral, no ratelimit, we can send 2328 * our queries to the given name */ 2329 infra_ratelimit_dec(qstate->env->infra_cache, 2330 iq->dp->name, iq->dp->namelen, 2331 *qstate->env->now); 2332 } 2333 2334 /* if hardened, only store referral if we asked for it */ 2335 if(!qstate->no_cache_store && 2336 (!qstate->env->cfg->harden_referral_path || 2337 ( qstate->qinfo.qtype == LDNS_RR_TYPE_NS 2338 && (qstate->query_flags&BIT_RD) 2339 && !(qstate->query_flags&BIT_CD) 2340 /* we know that all other NS rrsets are scrubbed 2341 * away, thus on referral only one is left. 2342 * see if that equals the query name... */ 2343 && ( /* auth section, but sometimes in answer section*/ 2344 reply_find_rrset_section_ns(iq->response->rep, 2345 iq->qchase.qname, iq->qchase.qname_len, 2346 LDNS_RR_TYPE_NS, iq->qchase.qclass) 2347 || reply_find_rrset_section_an(iq->response->rep, 2348 iq->qchase.qname, iq->qchase.qname_len, 2349 LDNS_RR_TYPE_NS, iq->qchase.qclass) 2350 ) 2351 ))) { 2352 /* Store the referral under the current query */ 2353 /* no prefetch-leeway, since its not the answer */ 2354 iter_dns_store(qstate->env, &iq->response->qinfo, 2355 iq->response->rep, 1, 0, 0, NULL, 0); 2356 if(iq->store_parent_NS) 2357 iter_store_parentside_NS(qstate->env, 2358 iq->response->rep); 2359 if(qstate->env->neg_cache) 2360 val_neg_addreferral(qstate->env->neg_cache, 2361 iq->response->rep, iq->dp->name); 2362 } 2363 /* store parent-side-in-zone-glue, if directly queried for */ 2364 if(!qstate->no_cache_store && iq->query_for_pside_glue 2365 && !iq->pside_glue) { 2366 iq->pside_glue = reply_find_rrset(iq->response->rep, 2367 iq->qchase.qname, iq->qchase.qname_len, 2368 iq->qchase.qtype, iq->qchase.qclass); 2369 if(iq->pside_glue) { 2370 log_rrset_key(VERB_ALGO, "found parent-side " 2371 "glue", iq->pside_glue); 2372 iter_store_parentside_rrset(qstate->env, 2373 iq->pside_glue); 2374 } 2375 } 2376 2377 /* Reset the event state, setting the current delegation 2378 * point to the referral. */ 2379 iq->deleg_msg = iq->response; 2380 iq->dp = delegpt_from_message(iq->response, qstate->region); 2381 if (qstate->env->cfg->qname_minimisation) 2382 iq->minimisation_state = INIT_MINIMISE_STATE; 2383 if(!iq->dp) 2384 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 2385 if(!cache_fill_missing(qstate->env, iq->qchase.qclass, 2386 qstate->region, iq->dp)) 2387 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 2388 if(iq->store_parent_NS && query_dname_compare(iq->dp->name, 2389 iq->store_parent_NS->name) == 0) 2390 iter_merge_retry_counts(iq->dp, iq->store_parent_NS); 2391 delegpt_log(VERB_ALGO, iq->dp); 2392 /* Count this as a referral. */ 2393 iq->referral_count++; 2394 iq->sent_count = 0; 2395 /* see if the next dp is a trust anchor, or a DS was sent 2396 * along, indicating dnssec is expected for next zone */ 2397 iq->dnssec_expected = iter_indicates_dnssec(qstate->env, 2398 iq->dp, iq->response, iq->qchase.qclass); 2399 /* if dnssec, validating then also fetch the key for the DS */ 2400 if(iq->dnssec_expected && qstate->env->cfg->prefetch_key && 2401 !(qstate->query_flags&BIT_CD)) 2402 generate_dnskey_prefetch(qstate, iq, id); 2403 2404 /* spawn off NS and addr to auth servers for the NS we just 2405 * got in the referral. This gets authoritative answer 2406 * (answer section trust level) rrset. 2407 * right after, we detach the subs, answer goes to cache. */ 2408 if(qstate->env->cfg->harden_referral_path) 2409 generate_ns_check(qstate, iq, id); 2410 2411 /* stop current outstanding queries. 2412 * FIXME: should the outstanding queries be waited for and 2413 * handled? Say by a subquery that inherits the outbound_entry. 2414 */ 2415 outbound_list_clear(&iq->outlist); 2416 iq->num_current_queries = 0; 2417 fptr_ok(fptr_whitelist_modenv_detach_subs( 2418 qstate->env->detach_subs)); 2419 (*qstate->env->detach_subs)(qstate); 2420 iq->num_target_queries = 0; 2421 verbose(VERB_ALGO, "cleared outbound list for next round"); 2422 return next_state(iq, QUERYTARGETS_STATE); 2423 } else if(type == RESPONSE_TYPE_CNAME) { 2424 uint8_t* sname = NULL; 2425 size_t snamelen = 0; 2426 /* CNAME type responses get a query restart (i.e., get a 2427 * reset of the query state and go back to INIT_REQUEST_STATE). 2428 */ 2429 verbose(VERB_DETAIL, "query response was CNAME"); 2430 if(verbosity >= VERB_ALGO) 2431 log_dns_msg("cname msg", &iq->response->qinfo, 2432 iq->response->rep); 2433 /* if qtype is DS, check we have the right level of answer, 2434 * like grandchild answer but we need the middle, reject it */ 2435 if(iq->qchase.qtype == LDNS_RR_TYPE_DS && !iq->dsns_point 2436 && !(iq->chase_flags&BIT_RD) 2437 && iter_ds_toolow(iq->response, iq->dp) 2438 && iter_dp_cangodown(&iq->qchase, iq->dp)) { 2439 outbound_list_clear(&iq->outlist); 2440 iq->num_current_queries = 0; 2441 fptr_ok(fptr_whitelist_modenv_detach_subs( 2442 qstate->env->detach_subs)); 2443 (*qstate->env->detach_subs)(qstate); 2444 iq->num_target_queries = 0; 2445 return processDSNSFind(qstate, iq, id); 2446 } 2447 /* Process the CNAME response. */ 2448 if(!handle_cname_response(qstate, iq, iq->response, 2449 &sname, &snamelen)) 2450 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 2451 /* cache the CNAME response under the current query */ 2452 /* NOTE : set referral=1, so that rrsets get stored but not 2453 * the partial query answer (CNAME only). */ 2454 /* prefetchleeway applied because this updates answer parts */ 2455 if(!qstate->no_cache_store) 2456 iter_dns_store(qstate->env, &iq->response->qinfo, 2457 iq->response->rep, 1, qstate->prefetch_leeway, 2458 iq->dp&&iq->dp->has_parent_side_NS, NULL, 2459 qstate->query_flags); 2460 /* set the current request's qname to the new value. */ 2461 iq->qchase.qname = sname; 2462 iq->qchase.qname_len = snamelen; 2463 if (qstate->env->cfg->qname_minimisation) 2464 iq->minimisation_state = INIT_MINIMISE_STATE; 2465 /* Clear the query state, since this is a query restart. */ 2466 iq->deleg_msg = NULL; 2467 iq->dp = NULL; 2468 iq->dsns_point = NULL; 2469 /* Note the query restart. */ 2470 iq->query_restart_count++; 2471 iq->sent_count = 0; 2472 2473 /* stop current outstanding queries. 2474 * FIXME: should the outstanding queries be waited for and 2475 * handled? Say by a subquery that inherits the outbound_entry. 2476 */ 2477 outbound_list_clear(&iq->outlist); 2478 iq->num_current_queries = 0; 2479 fptr_ok(fptr_whitelist_modenv_detach_subs( 2480 qstate->env->detach_subs)); 2481 (*qstate->env->detach_subs)(qstate); 2482 iq->num_target_queries = 0; 2483 if(qstate->reply) 2484 sock_list_insert(&qstate->reply_origin, 2485 &qstate->reply->addr, qstate->reply->addrlen, 2486 qstate->region); 2487 verbose(VERB_ALGO, "cleared outbound list for query restart"); 2488 /* go to INIT_REQUEST_STATE for new qname. */ 2489 return next_state(iq, INIT_REQUEST_STATE); 2490 } else if(type == RESPONSE_TYPE_LAME) { 2491 /* Cache the LAMEness. */ 2492 verbose(VERB_DETAIL, "query response was %sLAME", 2493 dnsseclame?"DNSSEC ":""); 2494 if(!dname_subdomain_c(iq->qchase.qname, iq->dp->name)) { 2495 log_err("mark lame: mismatch in qname and dpname"); 2496 /* throwaway this reply below */ 2497 } else if(qstate->reply) { 2498 /* need addr for lameness cache, but we may have 2499 * gotten this from cache, so test to be sure */ 2500 if(!infra_set_lame(qstate->env->infra_cache, 2501 &qstate->reply->addr, qstate->reply->addrlen, 2502 iq->dp->name, iq->dp->namelen, 2503 *qstate->env->now, dnsseclame, 0, 2504 iq->qchase.qtype)) 2505 log_err("mark host lame: out of memory"); 2506 } 2507 } else if(type == RESPONSE_TYPE_REC_LAME) { 2508 /* Cache the LAMEness. */ 2509 verbose(VERB_DETAIL, "query response REC_LAME: " 2510 "recursive but not authoritative server"); 2511 if(!dname_subdomain_c(iq->qchase.qname, iq->dp->name)) { 2512 log_err("mark rec_lame: mismatch in qname and dpname"); 2513 /* throwaway this reply below */ 2514 } else if(qstate->reply) { 2515 /* need addr for lameness cache, but we may have 2516 * gotten this from cache, so test to be sure */ 2517 verbose(VERB_DETAIL, "mark as REC_LAME"); 2518 if(!infra_set_lame(qstate->env->infra_cache, 2519 &qstate->reply->addr, qstate->reply->addrlen, 2520 iq->dp->name, iq->dp->namelen, 2521 *qstate->env->now, 0, 1, iq->qchase.qtype)) 2522 log_err("mark host lame: out of memory"); 2523 } 2524 } else if(type == RESPONSE_TYPE_THROWAWAY) { 2525 /* LAME and THROWAWAY responses are handled the same way. 2526 * In this case, the event is just sent directly back to 2527 * the QUERYTARGETS_STATE without resetting anything, 2528 * because, clearly, the next target must be tried. */ 2529 verbose(VERB_DETAIL, "query response was THROWAWAY"); 2530 } else { 2531 log_warn("A query response came back with an unknown type: %d", 2532 (int)type); 2533 } 2534 2535 /* LAME, THROWAWAY and "unknown" all end up here. 2536 * Recycle to the QUERYTARGETS state to hopefully try a 2537 * different target. */ 2538 if (qstate->env->cfg->qname_minimisation && 2539 !qstate->env->cfg->qname_minimisation_strict) 2540 iq->minimisation_state = DONOT_MINIMISE_STATE; 2541 return next_state(iq, QUERYTARGETS_STATE); 2542 } 2543 2544 /** 2545 * Return priming query results to interested super querystates. 2546 * 2547 * Sets the delegation point and delegation message (not nonRD queries). 2548 * This is a callback from walk_supers. 2549 * 2550 * @param qstate: priming query state that finished. 2551 * @param id: module id. 2552 * @param forq: the qstate for which priming has been done. 2553 */ 2554 static void 2555 prime_supers(struct module_qstate* qstate, int id, struct module_qstate* forq) 2556 { 2557 struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id]; 2558 struct delegpt* dp = NULL; 2559 2560 log_assert(qstate->is_priming || foriq->wait_priming_stub); 2561 log_assert(qstate->return_rcode == LDNS_RCODE_NOERROR); 2562 /* Convert our response to a delegation point */ 2563 dp = delegpt_from_message(qstate->return_msg, forq->region); 2564 if(!dp) { 2565 /* if there is no convertable delegation point, then 2566 * the ANSWER type was (presumably) a negative answer. */ 2567 verbose(VERB_ALGO, "prime response was not a positive " 2568 "ANSWER; failing"); 2569 foriq->dp = NULL; 2570 foriq->state = QUERYTARGETS_STATE; 2571 return; 2572 } 2573 2574 log_query_info(VERB_DETAIL, "priming successful for", &qstate->qinfo); 2575 delegpt_log(VERB_ALGO, dp); 2576 foriq->dp = dp; 2577 foriq->deleg_msg = dns_copy_msg(qstate->return_msg, forq->region); 2578 if(!foriq->deleg_msg) { 2579 log_err("copy prime response: out of memory"); 2580 foriq->dp = NULL; 2581 foriq->state = QUERYTARGETS_STATE; 2582 return; 2583 } 2584 2585 /* root priming responses go to init stage 2, priming stub 2586 * responses to to stage 3. */ 2587 if(foriq->wait_priming_stub) { 2588 foriq->state = INIT_REQUEST_3_STATE; 2589 foriq->wait_priming_stub = 0; 2590 } else foriq->state = INIT_REQUEST_2_STATE; 2591 /* because we are finished, the parent will be reactivated */ 2592 } 2593 2594 /** 2595 * This handles the response to a priming query. This is used to handle both 2596 * root and stub priming responses. This is basically the equivalent of the 2597 * QUERY_RESP_STATE, but will not handle CNAME responses and will treat 2598 * REFERRALs as ANSWERS. It will also update and reactivate the originating 2599 * event. 2600 * 2601 * @param qstate: query state. 2602 * @param id: module id. 2603 * @return true if the event needs more immediate processing, false if not. 2604 * This state always returns false. 2605 */ 2606 static int 2607 processPrimeResponse(struct module_qstate* qstate, int id) 2608 { 2609 struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id]; 2610 enum response_type type; 2611 iq->response->rep->flags &= ~(BIT_RD|BIT_RA); /* ignore rec-lame */ 2612 type = response_type_from_server( 2613 (int)((iq->chase_flags&BIT_RD) || iq->chase_to_rd), 2614 iq->response, &iq->qchase, iq->dp); 2615 if(type == RESPONSE_TYPE_ANSWER) { 2616 qstate->return_rcode = LDNS_RCODE_NOERROR; 2617 qstate->return_msg = iq->response; 2618 } else { 2619 qstate->return_rcode = LDNS_RCODE_SERVFAIL; 2620 qstate->return_msg = NULL; 2621 } 2622 2623 /* validate the root or stub after priming (if enabled). 2624 * This is the same query as the prime query, but with validation. 2625 * Now that we are primed, the additional queries that validation 2626 * may need can be resolved, such as DLV. */ 2627 if(qstate->env->cfg->harden_referral_path) { 2628 struct module_qstate* subq = NULL; 2629 log_nametypeclass(VERB_ALGO, "schedule prime validation", 2630 qstate->qinfo.qname, qstate->qinfo.qtype, 2631 qstate->qinfo.qclass); 2632 if(!generate_sub_request(qstate->qinfo.qname, 2633 qstate->qinfo.qname_len, qstate->qinfo.qtype, 2634 qstate->qinfo.qclass, qstate, id, iq, 2635 INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1)) { 2636 verbose(VERB_ALGO, "could not generate prime check"); 2637 } 2638 generate_a_aaaa_check(qstate, iq, id); 2639 } 2640 2641 /* This event is finished. */ 2642 qstate->ext_state[id] = module_finished; 2643 return 0; 2644 } 2645 2646 /** 2647 * Do final processing on responses to target queries. Events reach this 2648 * state after the iterative resolution algorithm terminates. This state is 2649 * responsible for reactiving the original event, and housekeeping related 2650 * to received target responses (caching, updating the current delegation 2651 * point, etc). 2652 * Callback from walk_supers for every super state that is interested in 2653 * the results from this query. 2654 * 2655 * @param qstate: query state. 2656 * @param id: module id. 2657 * @param forq: super query state. 2658 */ 2659 static void 2660 processTargetResponse(struct module_qstate* qstate, int id, 2661 struct module_qstate* forq) 2662 { 2663 struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id]; 2664 struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id]; 2665 struct ub_packed_rrset_key* rrset; 2666 struct delegpt_ns* dpns; 2667 log_assert(qstate->return_rcode == LDNS_RCODE_NOERROR); 2668 2669 foriq->state = QUERYTARGETS_STATE; 2670 log_query_info(VERB_ALGO, "processTargetResponse", &qstate->qinfo); 2671 log_query_info(VERB_ALGO, "processTargetResponse super", &forq->qinfo); 2672 2673 /* Tell the originating event that this target query has finished 2674 * (regardless if it succeeded or not). */ 2675 foriq->num_target_queries--; 2676 2677 /* check to see if parent event is still interested (in orig name). */ 2678 if(!foriq->dp) { 2679 verbose(VERB_ALGO, "subq: parent not interested, was reset"); 2680 return; /* not interested anymore */ 2681 } 2682 dpns = delegpt_find_ns(foriq->dp, qstate->qinfo.qname, 2683 qstate->qinfo.qname_len); 2684 if(!dpns) { 2685 /* If not interested, just stop processing this event */ 2686 verbose(VERB_ALGO, "subq: parent not interested anymore"); 2687 /* could be because parent was jostled out of the cache, 2688 and a new identical query arrived, that does not want it*/ 2689 return; 2690 } 2691 2692 /* if iq->query_for_pside_glue then add the pside_glue (marked lame) */ 2693 if(iq->pside_glue) { 2694 /* if the pside_glue is NULL, then it could not be found, 2695 * the done_pside is already set when created and a cache 2696 * entry created in processFinished so nothing to do here */ 2697 log_rrset_key(VERB_ALGO, "add parentside glue to dp", 2698 iq->pside_glue); 2699 if(!delegpt_add_rrset(foriq->dp, forq->region, 2700 iq->pside_glue, 1)) 2701 log_err("out of memory adding pside glue"); 2702 } 2703 2704 /* This response is relevant to the current query, so we 2705 * add (attempt to add, anyway) this target(s) and reactivate 2706 * the original event. 2707 * NOTE: we could only look for the AnswerRRset if the 2708 * response type was ANSWER. */ 2709 rrset = reply_find_answer_rrset(&iq->qchase, qstate->return_msg->rep); 2710 if(rrset) { 2711 /* if CNAMEs have been followed - add new NS to delegpt. */ 2712 /* BTW. RFC 1918 says NS should not have got CNAMEs. Robust. */ 2713 if(!delegpt_find_ns(foriq->dp, rrset->rk.dname, 2714 rrset->rk.dname_len)) { 2715 /* if dpns->lame then set newcname ns lame too */ 2716 if(!delegpt_add_ns(foriq->dp, forq->region, 2717 rrset->rk.dname, dpns->lame)) 2718 log_err("out of memory adding cnamed-ns"); 2719 } 2720 /* if dpns->lame then set the address(es) lame too */ 2721 if(!delegpt_add_rrset(foriq->dp, forq->region, rrset, 2722 dpns->lame)) 2723 log_err("out of memory adding targets"); 2724 verbose(VERB_ALGO, "added target response"); 2725 delegpt_log(VERB_ALGO, foriq->dp); 2726 } else { 2727 verbose(VERB_ALGO, "iterator TargetResponse failed"); 2728 dpns->resolved = 1; /* fail the target */ 2729 } 2730 } 2731 2732 /** 2733 * Process response for DS NS Find queries, that attempt to find the delegation 2734 * point where we ask the DS query from. 2735 * 2736 * @param qstate: query state. 2737 * @param id: module id. 2738 * @param forq: super query state. 2739 */ 2740 static void 2741 processDSNSResponse(struct module_qstate* qstate, int id, 2742 struct module_qstate* forq) 2743 { 2744 struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id]; 2745 2746 /* if the finished (iq->response) query has no NS set: continue 2747 * up to look for the right dp; nothing to change, do DPNSstate */ 2748 if(qstate->return_rcode != LDNS_RCODE_NOERROR) 2749 return; /* seek further */ 2750 /* find the NS RRset (without allowing CNAMEs) */ 2751 if(!reply_find_rrset(qstate->return_msg->rep, qstate->qinfo.qname, 2752 qstate->qinfo.qname_len, LDNS_RR_TYPE_NS, 2753 qstate->qinfo.qclass)){ 2754 return; /* seek further */ 2755 } 2756 2757 /* else, store as DP and continue at querytargets */ 2758 foriq->state = QUERYTARGETS_STATE; 2759 foriq->dp = delegpt_from_message(qstate->return_msg, forq->region); 2760 if(!foriq->dp) { 2761 log_err("out of memory in dsns dp alloc"); 2762 return; /* dp==NULL in QUERYTARGETS makes SERVFAIL */ 2763 } 2764 /* success, go query the querytargets in the new dp (and go down) */ 2765 } 2766 2767 /** 2768 * Process response for qclass=ANY queries for a particular class. 2769 * Append to result or error-exit. 2770 * 2771 * @param qstate: query state. 2772 * @param id: module id. 2773 * @param forq: super query state. 2774 */ 2775 static void 2776 processClassResponse(struct module_qstate* qstate, int id, 2777 struct module_qstate* forq) 2778 { 2779 struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id]; 2780 struct dns_msg* from = qstate->return_msg; 2781 log_query_info(VERB_ALGO, "processClassResponse", &qstate->qinfo); 2782 log_query_info(VERB_ALGO, "processClassResponse super", &forq->qinfo); 2783 if(qstate->return_rcode != LDNS_RCODE_NOERROR) { 2784 /* cause servfail for qclass ANY query */ 2785 foriq->response = NULL; 2786 foriq->state = FINISHED_STATE; 2787 return; 2788 } 2789 /* append result */ 2790 if(!foriq->response) { 2791 /* allocate the response: copy RCODE, sec_state */ 2792 foriq->response = dns_copy_msg(from, forq->region); 2793 if(!foriq->response) { 2794 log_err("malloc failed for qclass ANY response"); 2795 foriq->state = FINISHED_STATE; 2796 return; 2797 } 2798 foriq->response->qinfo.qclass = forq->qinfo.qclass; 2799 /* qclass ANY does not receive the AA flag on replies */ 2800 foriq->response->rep->authoritative = 0; 2801 } else { 2802 struct dns_msg* to = foriq->response; 2803 /* add _from_ this response _to_ existing collection */ 2804 /* if there are records, copy RCODE */ 2805 /* lower sec_state if this message is lower */ 2806 if(from->rep->rrset_count != 0) { 2807 size_t n = from->rep->rrset_count+to->rep->rrset_count; 2808 struct ub_packed_rrset_key** dest, **d; 2809 /* copy appropriate rcode */ 2810 to->rep->flags = from->rep->flags; 2811 /* copy rrsets */ 2812 if(from->rep->rrset_count > RR_COUNT_MAX || 2813 to->rep->rrset_count > RR_COUNT_MAX) { 2814 log_err("malloc failed (too many rrsets) in collect ANY"); 2815 foriq->state = FINISHED_STATE; 2816 return; /* integer overflow protection */ 2817 } 2818 dest = regional_alloc(forq->region, sizeof(dest[0])*n); 2819 if(!dest) { 2820 log_err("malloc failed in collect ANY"); 2821 foriq->state = FINISHED_STATE; 2822 return; 2823 } 2824 d = dest; 2825 /* copy AN */ 2826 memcpy(dest, to->rep->rrsets, to->rep->an_numrrsets 2827 * sizeof(dest[0])); 2828 dest += to->rep->an_numrrsets; 2829 memcpy(dest, from->rep->rrsets, from->rep->an_numrrsets 2830 * sizeof(dest[0])); 2831 dest += from->rep->an_numrrsets; 2832 /* copy NS */ 2833 memcpy(dest, to->rep->rrsets+to->rep->an_numrrsets, 2834 to->rep->ns_numrrsets * sizeof(dest[0])); 2835 dest += to->rep->ns_numrrsets; 2836 memcpy(dest, from->rep->rrsets+from->rep->an_numrrsets, 2837 from->rep->ns_numrrsets * sizeof(dest[0])); 2838 dest += from->rep->ns_numrrsets; 2839 /* copy AR */ 2840 memcpy(dest, to->rep->rrsets+to->rep->an_numrrsets+ 2841 to->rep->ns_numrrsets, 2842 to->rep->ar_numrrsets * sizeof(dest[0])); 2843 dest += to->rep->ar_numrrsets; 2844 memcpy(dest, from->rep->rrsets+from->rep->an_numrrsets+ 2845 from->rep->ns_numrrsets, 2846 from->rep->ar_numrrsets * sizeof(dest[0])); 2847 /* update counts */ 2848 to->rep->rrsets = d; 2849 to->rep->an_numrrsets += from->rep->an_numrrsets; 2850 to->rep->ns_numrrsets += from->rep->ns_numrrsets; 2851 to->rep->ar_numrrsets += from->rep->ar_numrrsets; 2852 to->rep->rrset_count = n; 2853 } 2854 if(from->rep->security < to->rep->security) /* lowest sec */ 2855 to->rep->security = from->rep->security; 2856 if(from->rep->qdcount != 0) /* insert qd if appropriate */ 2857 to->rep->qdcount = from->rep->qdcount; 2858 if(from->rep->ttl < to->rep->ttl) /* use smallest TTL */ 2859 to->rep->ttl = from->rep->ttl; 2860 if(from->rep->prefetch_ttl < to->rep->prefetch_ttl) 2861 to->rep->prefetch_ttl = from->rep->prefetch_ttl; 2862 } 2863 /* are we done? */ 2864 foriq->num_current_queries --; 2865 if(foriq->num_current_queries == 0) 2866 foriq->state = FINISHED_STATE; 2867 } 2868 2869 /** 2870 * Collect class ANY responses and make them into one response. This 2871 * state is started and it creates queries for all classes (that have 2872 * root hints). The answers are then collected. 2873 * 2874 * @param qstate: query state. 2875 * @param id: module id. 2876 * @return true if the event needs more immediate processing, false if not. 2877 */ 2878 static int 2879 processCollectClass(struct module_qstate* qstate, int id) 2880 { 2881 struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id]; 2882 struct module_qstate* subq; 2883 /* If qchase.qclass == 0 then send out queries for all classes. 2884 * Otherwise, do nothing (wait for all answers to arrive and the 2885 * processClassResponse to put them together, and that moves us 2886 * towards the Finished state when done. */ 2887 if(iq->qchase.qclass == 0) { 2888 uint16_t c = 0; 2889 iq->qchase.qclass = LDNS_RR_CLASS_ANY; 2890 while(iter_get_next_root(qstate->env->hints, 2891 qstate->env->fwds, &c)) { 2892 /* generate query for this class */ 2893 log_nametypeclass(VERB_ALGO, "spawn collect query", 2894 qstate->qinfo.qname, qstate->qinfo.qtype, c); 2895 if(!generate_sub_request(qstate->qinfo.qname, 2896 qstate->qinfo.qname_len, qstate->qinfo.qtype, 2897 c, qstate, id, iq, INIT_REQUEST_STATE, 2898 FINISHED_STATE, &subq, 2899 (int)!(qstate->query_flags&BIT_CD))) { 2900 return error_response(qstate, id, 2901 LDNS_RCODE_SERVFAIL); 2902 } 2903 /* ignore subq, no special init required */ 2904 iq->num_current_queries ++; 2905 if(c == 0xffff) 2906 break; 2907 else c++; 2908 } 2909 /* if no roots are configured at all, return */ 2910 if(iq->num_current_queries == 0) { 2911 verbose(VERB_ALGO, "No root hints or fwds, giving up " 2912 "on qclass ANY"); 2913 return error_response(qstate, id, LDNS_RCODE_REFUSED); 2914 } 2915 /* return false, wait for queries to return */ 2916 } 2917 /* if woke up here because of an answer, wait for more answers */ 2918 return 0; 2919 } 2920 2921 /** 2922 * This handles the final state for first-tier responses (i.e., responses to 2923 * externally generated queries). 2924 * 2925 * @param qstate: query state. 2926 * @param iq: iterator query state. 2927 * @param id: module id. 2928 * @return true if the event needs more processing, false if not. Since this 2929 * is the final state for an event, it always returns false. 2930 */ 2931 static int 2932 processFinished(struct module_qstate* qstate, struct iter_qstate* iq, 2933 int id) 2934 { 2935 log_query_info(VERB_QUERY, "finishing processing for", 2936 &qstate->qinfo); 2937 2938 /* store negative cache element for parent side glue. */ 2939 if(!qstate->no_cache_store && iq->query_for_pside_glue 2940 && !iq->pside_glue) 2941 iter_store_parentside_neg(qstate->env, &qstate->qinfo, 2942 iq->deleg_msg?iq->deleg_msg->rep: 2943 (iq->response?iq->response->rep:NULL)); 2944 if(!iq->response) { 2945 verbose(VERB_ALGO, "No response is set, servfail"); 2946 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 2947 } 2948 2949 /* Make sure that the RA flag is set (since the presence of 2950 * this module means that recursion is available) */ 2951 iq->response->rep->flags |= BIT_RA; 2952 2953 /* Clear the AA flag */ 2954 /* FIXME: does this action go here or in some other module? */ 2955 iq->response->rep->flags &= ~BIT_AA; 2956 2957 /* make sure QR flag is on */ 2958 iq->response->rep->flags |= BIT_QR; 2959 2960 /* we have finished processing this query */ 2961 qstate->ext_state[id] = module_finished; 2962 2963 /* TODO: we are using a private TTL, trim the response. */ 2964 /* if (mPrivateTTL > 0){IterUtils.setPrivateTTL(resp, mPrivateTTL); } */ 2965 2966 /* prepend any items we have accumulated */ 2967 if(iq->an_prepend_list || iq->ns_prepend_list) { 2968 if(!iter_prepend(iq, iq->response, qstate->region)) { 2969 log_err("prepend rrsets: out of memory"); 2970 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 2971 } 2972 /* reset the query name back */ 2973 iq->response->qinfo = qstate->qinfo; 2974 /* the security state depends on the combination */ 2975 iq->response->rep->security = sec_status_unchecked; 2976 /* store message with the finished prepended items, 2977 * but only if we did recursion. The nonrecursion referral 2978 * from cache does not need to be stored in the msg cache. */ 2979 if(!qstate->no_cache_store && qstate->query_flags&BIT_RD) { 2980 iter_dns_store(qstate->env, &qstate->qinfo, 2981 iq->response->rep, 0, qstate->prefetch_leeway, 2982 iq->dp&&iq->dp->has_parent_side_NS, 2983 qstate->region, qstate->query_flags); 2984 } 2985 } 2986 qstate->return_rcode = LDNS_RCODE_NOERROR; 2987 qstate->return_msg = iq->response; 2988 return 0; 2989 } 2990 2991 /* 2992 * Return priming query results to interestes super querystates. 2993 * 2994 * Sets the delegation point and delegation message (not nonRD queries). 2995 * This is a callback from walk_supers. 2996 * 2997 * @param qstate: query state that finished. 2998 * @param id: module id. 2999 * @param super: the qstate to inform. 3000 */ 3001 void 3002 iter_inform_super(struct module_qstate* qstate, int id, 3003 struct module_qstate* super) 3004 { 3005 if(!qstate->is_priming && super->qinfo.qclass == LDNS_RR_CLASS_ANY) 3006 processClassResponse(qstate, id, super); 3007 else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*) 3008 super->minfo[id])->state == DSNS_FIND_STATE) 3009 processDSNSResponse(qstate, id, super); 3010 else if(qstate->return_rcode != LDNS_RCODE_NOERROR) 3011 error_supers(qstate, id, super); 3012 else if(qstate->is_priming) 3013 prime_supers(qstate, id, super); 3014 else processTargetResponse(qstate, id, super); 3015 } 3016 3017 /** 3018 * Handle iterator state. 3019 * Handle events. This is the real processing loop for events, responsible 3020 * for moving events through the various states. If a processing method 3021 * returns true, then it will be advanced to the next state. If false, then 3022 * processing will stop. 3023 * 3024 * @param qstate: query state. 3025 * @param ie: iterator shared global environment. 3026 * @param iq: iterator query state. 3027 * @param id: module id. 3028 */ 3029 static void 3030 iter_handle(struct module_qstate* qstate, struct iter_qstate* iq, 3031 struct iter_env* ie, int id) 3032 { 3033 int cont = 1; 3034 while(cont) { 3035 verbose(VERB_ALGO, "iter_handle processing q with state %s", 3036 iter_state_to_string(iq->state)); 3037 switch(iq->state) { 3038 case INIT_REQUEST_STATE: 3039 cont = processInitRequest(qstate, iq, ie, id); 3040 break; 3041 case INIT_REQUEST_2_STATE: 3042 cont = processInitRequest2(qstate, iq, id); 3043 break; 3044 case INIT_REQUEST_3_STATE: 3045 cont = processInitRequest3(qstate, iq, id); 3046 break; 3047 case QUERYTARGETS_STATE: 3048 cont = processQueryTargets(qstate, iq, ie, id); 3049 break; 3050 case QUERY_RESP_STATE: 3051 cont = processQueryResponse(qstate, iq, id); 3052 break; 3053 case PRIME_RESP_STATE: 3054 cont = processPrimeResponse(qstate, id); 3055 break; 3056 case COLLECT_CLASS_STATE: 3057 cont = processCollectClass(qstate, id); 3058 break; 3059 case DSNS_FIND_STATE: 3060 cont = processDSNSFind(qstate, iq, id); 3061 break; 3062 case FINISHED_STATE: 3063 cont = processFinished(qstate, iq, id); 3064 break; 3065 default: 3066 log_warn("iterator: invalid state: %d", 3067 iq->state); 3068 cont = 0; 3069 break; 3070 } 3071 } 3072 } 3073 3074 /** 3075 * This is the primary entry point for processing request events. Note that 3076 * this method should only be used by external modules. 3077 * @param qstate: query state. 3078 * @param ie: iterator shared global environment. 3079 * @param iq: iterator query state. 3080 * @param id: module id. 3081 */ 3082 static void 3083 process_request(struct module_qstate* qstate, struct iter_qstate* iq, 3084 struct iter_env* ie, int id) 3085 { 3086 /* external requests start in the INIT state, and finish using the 3087 * FINISHED state. */ 3088 iq->state = INIT_REQUEST_STATE; 3089 iq->final_state = FINISHED_STATE; 3090 verbose(VERB_ALGO, "process_request: new external request event"); 3091 iter_handle(qstate, iq, ie, id); 3092 } 3093 3094 /** process authoritative server reply */ 3095 static void 3096 process_response(struct module_qstate* qstate, struct iter_qstate* iq, 3097 struct iter_env* ie, int id, struct outbound_entry* outbound, 3098 enum module_ev event) 3099 { 3100 struct msg_parse* prs; 3101 struct edns_data edns; 3102 sldns_buffer* pkt; 3103 3104 verbose(VERB_ALGO, "process_response: new external response event"); 3105 iq->response = NULL; 3106 iq->state = QUERY_RESP_STATE; 3107 if(event == module_event_noreply || event == module_event_error) { 3108 if(event == module_event_noreply && iq->sent_count >= 3 && 3109 qstate->env->cfg->use_caps_bits_for_id && 3110 !iq->caps_fallback) { 3111 /* start fallback */ 3112 iq->caps_fallback = 1; 3113 iq->caps_server = 0; 3114 iq->caps_reply = NULL; 3115 iq->caps_response = NULL; 3116 iq->state = QUERYTARGETS_STATE; 3117 iq->num_current_queries--; 3118 /* need fresh attempts for the 0x20 fallback, if 3119 * that was the cause for the failure */ 3120 iter_dec_attempts(iq->dp, 3); 3121 verbose(VERB_DETAIL, "Capsforid: timeouts, starting fallback"); 3122 goto handle_it; 3123 } 3124 goto handle_it; 3125 } 3126 if( (event != module_event_reply && event != module_event_capsfail) 3127 || !qstate->reply) { 3128 log_err("Bad event combined with response"); 3129 outbound_list_remove(&iq->outlist, outbound); 3130 (void)error_response(qstate, id, LDNS_RCODE_SERVFAIL); 3131 return; 3132 } 3133 3134 /* parse message */ 3135 prs = (struct msg_parse*)regional_alloc(qstate->env->scratch, 3136 sizeof(struct msg_parse)); 3137 if(!prs) { 3138 log_err("out of memory on incoming message"); 3139 /* like packet got dropped */ 3140 goto handle_it; 3141 } 3142 memset(prs, 0, sizeof(*prs)); 3143 memset(&edns, 0, sizeof(edns)); 3144 pkt = qstate->reply->c->buffer; 3145 sldns_buffer_set_position(pkt, 0); 3146 if(parse_packet(pkt, prs, qstate->env->scratch) != LDNS_RCODE_NOERROR) { 3147 verbose(VERB_ALGO, "parse error on reply packet"); 3148 goto handle_it; 3149 } 3150 /* edns is not examined, but removed from message to help cache */ 3151 if(parse_extract_edns(prs, &edns, qstate->env->scratch) != 3152 LDNS_RCODE_NOERROR) 3153 goto handle_it; 3154 3155 /* Copy the edns options we may got from the back end */ 3156 if(edns.opt_list) { 3157 qstate->edns_opts_back_in = edns_opt_copy_region(edns.opt_list, 3158 qstate->region); 3159 if(!qstate->edns_opts_back_in) { 3160 log_err("out of memory on incoming message"); 3161 /* like packet got dropped */ 3162 goto handle_it; 3163 } 3164 } 3165 3166 /* remove CD-bit, we asked for in case we handle validation ourself */ 3167 prs->flags &= ~BIT_CD; 3168 3169 /* normalize and sanitize: easy to delete items from linked lists */ 3170 if(!scrub_message(pkt, prs, &iq->qinfo_out, iq->dp->name, 3171 qstate->env->scratch, qstate->env, ie)) { 3172 /* if 0x20 enabled, start fallback, but we have no message */ 3173 if(event == module_event_capsfail && !iq->caps_fallback) { 3174 iq->caps_fallback = 1; 3175 iq->caps_server = 0; 3176 iq->caps_reply = NULL; 3177 iq->caps_response = NULL; 3178 iq->state = QUERYTARGETS_STATE; 3179 iq->num_current_queries--; 3180 verbose(VERB_DETAIL, "Capsforid: scrub failed, starting fallback with no response"); 3181 } 3182 goto handle_it; 3183 } 3184 3185 /* allocate response dns_msg in region */ 3186 iq->response = dns_alloc_msg(pkt, prs, qstate->region); 3187 if(!iq->response) 3188 goto handle_it; 3189 log_query_info(VERB_DETAIL, "response for", &qstate->qinfo); 3190 log_name_addr(VERB_DETAIL, "reply from", iq->dp->name, 3191 &qstate->reply->addr, qstate->reply->addrlen); 3192 if(verbosity >= VERB_ALGO) 3193 log_dns_msg("incoming scrubbed packet:", &iq->response->qinfo, 3194 iq->response->rep); 3195 3196 if(event == module_event_capsfail || iq->caps_fallback) { 3197 /* for fallback we care about main answer, not additionals */ 3198 /* removing that makes comparison more likely to succeed */ 3199 caps_strip_reply(iq->response->rep); 3200 if(!iq->caps_fallback) { 3201 /* start fallback */ 3202 iq->caps_fallback = 1; 3203 iq->caps_server = 0; 3204 iq->caps_reply = iq->response->rep; 3205 iq->caps_response = iq->response; 3206 iq->state = QUERYTARGETS_STATE; 3207 iq->num_current_queries--; 3208 verbose(VERB_DETAIL, "Capsforid: starting fallback"); 3209 goto handle_it; 3210 } else { 3211 /* check if reply is the same, otherwise, fail */ 3212 if(!iq->caps_reply) { 3213 iq->caps_reply = iq->response->rep; 3214 iq->caps_response = iq->response; 3215 iq->caps_server = -1; /*become zero at ++, 3216 so that we start the full set of trials */ 3217 } else if(caps_failed_rcode(iq->caps_reply) && 3218 !caps_failed_rcode(iq->response->rep)) { 3219 /* prefer to upgrade to non-SERVFAIL */ 3220 iq->caps_reply = iq->response->rep; 3221 iq->caps_response = iq->response; 3222 } else if(!caps_failed_rcode(iq->caps_reply) && 3223 caps_failed_rcode(iq->response->rep)) { 3224 /* if we have non-SERVFAIL as answer then 3225 * we can ignore SERVFAILs for the equality 3226 * comparison */ 3227 /* no instructions here, skip other else */ 3228 } else if(caps_failed_rcode(iq->caps_reply) && 3229 caps_failed_rcode(iq->response->rep)) { 3230 /* failure is same as other failure in fallbk*/ 3231 /* no instructions here, skip other else */ 3232 } else if(!reply_equal(iq->response->rep, iq->caps_reply, 3233 qstate->env->scratch)) { 3234 verbose(VERB_DETAIL, "Capsforid fallback: " 3235 "getting different replies, failed"); 3236 outbound_list_remove(&iq->outlist, outbound); 3237 (void)error_response(qstate, id, 3238 LDNS_RCODE_SERVFAIL); 3239 return; 3240 } 3241 /* continue the fallback procedure at next server */ 3242 iq->caps_server++; 3243 iq->state = QUERYTARGETS_STATE; 3244 iq->num_current_queries--; 3245 verbose(VERB_DETAIL, "Capsforid: reply is equal. " 3246 "go to next fallback"); 3247 goto handle_it; 3248 } 3249 } 3250 iq->caps_fallback = 0; /* if we were in fallback, 0x20 is OK now */ 3251 3252 handle_it: 3253 outbound_list_remove(&iq->outlist, outbound); 3254 iter_handle(qstate, iq, ie, id); 3255 } 3256 3257 void 3258 iter_operate(struct module_qstate* qstate, enum module_ev event, int id, 3259 struct outbound_entry* outbound) 3260 { 3261 struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id]; 3262 struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id]; 3263 verbose(VERB_QUERY, "iterator[module %d] operate: extstate:%s event:%s", 3264 id, strextstate(qstate->ext_state[id]), strmodulevent(event)); 3265 if(iq) log_query_info(VERB_QUERY, "iterator operate: query", 3266 &qstate->qinfo); 3267 if(iq && qstate->qinfo.qname != iq->qchase.qname) 3268 log_query_info(VERB_QUERY, "iterator operate: chased to", 3269 &iq->qchase); 3270 3271 /* perform iterator state machine */ 3272 if((event == module_event_new || event == module_event_pass) && 3273 iq == NULL) { 3274 if(!iter_new(qstate, id)) { 3275 (void)error_response(qstate, id, LDNS_RCODE_SERVFAIL); 3276 return; 3277 } 3278 iq = (struct iter_qstate*)qstate->minfo[id]; 3279 process_request(qstate, iq, ie, id); 3280 return; 3281 } 3282 if(iq && event == module_event_pass) { 3283 iter_handle(qstate, iq, ie, id); 3284 return; 3285 } 3286 if(iq && outbound) { 3287 process_response(qstate, iq, ie, id, outbound, event); 3288 return; 3289 } 3290 if(event == module_event_error) { 3291 verbose(VERB_ALGO, "got called with event error, giving up"); 3292 (void)error_response(qstate, id, LDNS_RCODE_SERVFAIL); 3293 return; 3294 } 3295 3296 log_err("bad event for iterator"); 3297 (void)error_response(qstate, id, LDNS_RCODE_SERVFAIL); 3298 } 3299 3300 void 3301 iter_clear(struct module_qstate* qstate, int id) 3302 { 3303 struct iter_qstate* iq; 3304 if(!qstate) 3305 return; 3306 iq = (struct iter_qstate*)qstate->minfo[id]; 3307 if(iq) { 3308 outbound_list_clear(&iq->outlist); 3309 if(iq->target_count && --iq->target_count[0] == 0) 3310 free(iq->target_count); 3311 iq->num_current_queries = 0; 3312 } 3313 qstate->minfo[id] = NULL; 3314 } 3315 3316 size_t 3317 iter_get_mem(struct module_env* env, int id) 3318 { 3319 struct iter_env* ie = (struct iter_env*)env->modinfo[id]; 3320 if(!ie) 3321 return 0; 3322 return sizeof(*ie) + sizeof(int)*((size_t)ie->max_dependency_depth+1) 3323 + donotq_get_mem(ie->donotq) + priv_get_mem(ie->priv); 3324 } 3325 3326 /** 3327 * The iterator function block 3328 */ 3329 static struct module_func_block iter_block = { 3330 "iterator", 3331 &iter_init, &iter_deinit, &iter_operate, &iter_inform_super, 3332 &iter_clear, &iter_get_mem 3333 }; 3334 3335 struct module_func_block* 3336 iter_get_funcblock(void) 3337 { 3338 return &iter_block; 3339 } 3340 3341 const char* 3342 iter_state_to_string(enum iter_state state) 3343 { 3344 switch (state) 3345 { 3346 case INIT_REQUEST_STATE : 3347 return "INIT REQUEST STATE"; 3348 case INIT_REQUEST_2_STATE : 3349 return "INIT REQUEST STATE (stage 2)"; 3350 case INIT_REQUEST_3_STATE: 3351 return "INIT REQUEST STATE (stage 3)"; 3352 case QUERYTARGETS_STATE : 3353 return "QUERY TARGETS STATE"; 3354 case PRIME_RESP_STATE : 3355 return "PRIME RESPONSE STATE"; 3356 case COLLECT_CLASS_STATE : 3357 return "COLLECT CLASS STATE"; 3358 case DSNS_FIND_STATE : 3359 return "DSNS FIND STATE"; 3360 case QUERY_RESP_STATE : 3361 return "QUERY RESPONSE STATE"; 3362 case FINISHED_STATE : 3363 return "FINISHED RESPONSE STATE"; 3364 default : 3365 return "UNKNOWN ITER STATE"; 3366 } 3367 } 3368 3369 int 3370 iter_state_is_responsestate(enum iter_state s) 3371 { 3372 switch(s) { 3373 case INIT_REQUEST_STATE : 3374 case INIT_REQUEST_2_STATE : 3375 case INIT_REQUEST_3_STATE : 3376 case QUERYTARGETS_STATE : 3377 case COLLECT_CLASS_STATE : 3378 return 0; 3379 default: 3380 break; 3381 } 3382 return 1; 3383 } 3384