xref: /freebsd/contrib/unbound/cachedb/cachedb.c (revision 46d2f61818f594174cafe31ee338c6e083fa1876)
1  /*
2   * cachedb/cachedb.c - cache from a database external to the program module
3   *
4   * Copyright (c) 2016, NLnet Labs. All rights reserved.
5   *
6   * This software is open source.
7   *
8   * Redistribution and use in source and binary forms, with or without
9   * modification, are permitted provided that the following conditions
10   * are met:
11   *
12   * Redistributions of source code must retain the above copyright notice,
13   * this list of conditions and the following disclaimer.
14   *
15   * Redistributions in binary form must reproduce the above copyright notice,
16   * this list of conditions and the following disclaimer in the documentation
17   * and/or other materials provided with the distribution.
18   *
19   * Neither the name of the NLNET LABS nor the names of its contributors may
20   * be used to endorse or promote products derived from this software without
21   * specific prior written permission.
22   *
23   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24   * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25   * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26   * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27   * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28   * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29   * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30   * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31   * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32   * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33   * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34   */
35  
36  /**
37   * \file
38   *
39   * This file contains a module that uses an external database to cache
40   * dns responses.
41   */
42  
43  #include "config.h"
44  #ifdef USE_CACHEDB
45  #include "cachedb/cachedb.h"
46  #include "cachedb/redis.h"
47  #include "util/regional.h"
48  #include "util/net_help.h"
49  #include "util/config_file.h"
50  #include "util/data/msgreply.h"
51  #include "util/data/msgencode.h"
52  #include "services/cache/dns.h"
53  #include "services/mesh.h"
54  #include "services/modstack.h"
55  #include "validator/val_neg.h"
56  #include "validator/val_secalgo.h"
57  #include "iterator/iter_utils.h"
58  #include "sldns/parseutil.h"
59  #include "sldns/wire2str.h"
60  #include "sldns/sbuffer.h"
61  
62  /* header file for htobe64 */
63  #ifdef HAVE_ENDIAN_H
64  #  include <endian.h>
65  #endif
66  #ifdef HAVE_SYS_ENDIAN_H
67  #  include <sys/endian.h>
68  #endif
69  
70  #ifndef HAVE_HTOBE64
71  #  ifdef HAVE_LIBKERN_OSBYTEORDER_H
72       /* In practice this is specific to MacOS X.  We assume it doesn't have
73        * htobe64/be64toh but has alternatives with a different name. */
74  #    include <libkern/OSByteOrder.h>
75  #    define htobe64(x) OSSwapHostToBigInt64(x)
76  #    define be64toh(x) OSSwapBigToHostInt64(x)
77  #  else
78       /* not OSX */
79       /* Some compilers do not define __BYTE_ORDER__, like IBM XLC on AIX */
80  #    if __BIG_ENDIAN__
81  #      define be64toh(n) (n)
82  #      define htobe64(n) (n)
83  #    else
84  #      define be64toh(n) (((uint64_t)htonl((n) & 0xFFFFFFFF) << 32) | htonl((n) >> 32))
85  #      define htobe64(n) (((uint64_t)htonl((n) & 0xFFFFFFFF) << 32) | htonl((n) >> 32))
86  #    endif /* _ENDIAN */
87  #  endif /* HAVE_LIBKERN_OSBYTEORDER_H */
88  #endif /* HAVE_BE64TOH */
89  
90  /** the unit test testframe for cachedb, its module state contains
91   * a cache for a couple queries (in memory). */
92  struct testframe_moddata {
93  	/** lock for mutex */
94  	lock_basic_type lock;
95  	/** key for single stored data element, NULL if none */
96  	char* stored_key;
97  	/** data for single stored data element, NULL if none */
98  	uint8_t* stored_data;
99  	/** length of stored data */
100  	size_t stored_datalen;
101  };
102  
103  static int
testframe_init(struct module_env * env,struct cachedb_env * cachedb_env)104  testframe_init(struct module_env* env, struct cachedb_env* cachedb_env)
105  {
106  	struct testframe_moddata* d;
107  	verbose(VERB_ALGO, "testframe_init");
108  	d = (struct testframe_moddata*)calloc(1,
109  		sizeof(struct testframe_moddata));
110  	cachedb_env->backend_data = (void*)d;
111  	if(!cachedb_env->backend_data) {
112  		log_err("out of memory");
113  		return 0;
114  	}
115  	/* Register an EDNS option (65534) to bypass the worker cache lookup
116  	 * for testing */
117  	if(!edns_register_option(LDNS_EDNS_UNBOUND_CACHEDB_TESTFRAME_TEST,
118  		1 /* bypass cache */,
119  		0 /* no aggregation */, env)) {
120  		log_err("testframe_init, could not register test opcode");
121  		free(d);
122  		return 0;
123  	}
124  	lock_basic_init(&d->lock);
125  	lock_protect(&d->lock, d, sizeof(*d));
126  	return 1;
127  }
128  
129  static void
testframe_deinit(struct module_env * env,struct cachedb_env * cachedb_env)130  testframe_deinit(struct module_env* env, struct cachedb_env* cachedb_env)
131  {
132  	struct testframe_moddata* d = (struct testframe_moddata*)
133  		cachedb_env->backend_data;
134  	(void)env;
135  	verbose(VERB_ALGO, "testframe_deinit");
136  	if(!d)
137  		return;
138  	lock_basic_destroy(&d->lock);
139  	free(d->stored_key);
140  	free(d->stored_data);
141  	free(d);
142  }
143  
144  static int
testframe_lookup(struct module_env * env,struct cachedb_env * cachedb_env,char * key,struct sldns_buffer * result_buffer)145  testframe_lookup(struct module_env* env, struct cachedb_env* cachedb_env,
146  	char* key, struct sldns_buffer* result_buffer)
147  {
148  	struct testframe_moddata* d = (struct testframe_moddata*)
149  		cachedb_env->backend_data;
150  	(void)env;
151  	verbose(VERB_ALGO, "testframe_lookup of %s", key);
152  	lock_basic_lock(&d->lock);
153  	if(d->stored_key && strcmp(d->stored_key, key) == 0) {
154  		if(d->stored_datalen > sldns_buffer_capacity(result_buffer)) {
155  			lock_basic_unlock(&d->lock);
156  			return 0; /* too large */
157  		}
158  		verbose(VERB_ALGO, "testframe_lookup found %d bytes",
159  			(int)d->stored_datalen);
160  		sldns_buffer_clear(result_buffer);
161  		sldns_buffer_write(result_buffer, d->stored_data,
162  			d->stored_datalen);
163  		sldns_buffer_flip(result_buffer);
164  		lock_basic_unlock(&d->lock);
165  		return 1;
166  	}
167  	lock_basic_unlock(&d->lock);
168  	return 0;
169  }
170  
171  static void
testframe_store(struct module_env * env,struct cachedb_env * cachedb_env,char * key,uint8_t * data,size_t data_len,time_t ATTR_UNUSED (ttl))172  testframe_store(struct module_env* env, struct cachedb_env* cachedb_env,
173  	char* key, uint8_t* data, size_t data_len, time_t ATTR_UNUSED(ttl))
174  {
175  	struct testframe_moddata* d = (struct testframe_moddata*)
176  		cachedb_env->backend_data;
177  	(void)env;
178  	lock_basic_lock(&d->lock);
179  	verbose(VERB_ALGO, "testframe_store %s (%d bytes)", key, (int)data_len);
180  
181  	/* free old data element (if any) */
182  	free(d->stored_key);
183  	d->stored_key = NULL;
184  	free(d->stored_data);
185  	d->stored_data = NULL;
186  	d->stored_datalen = 0;
187  
188  	d->stored_data = memdup(data, data_len);
189  	if(!d->stored_data) {
190  		lock_basic_unlock(&d->lock);
191  		log_err("out of memory");
192  		return;
193  	}
194  	d->stored_datalen = data_len;
195  	d->stored_key = strdup(key);
196  	if(!d->stored_key) {
197  		free(d->stored_data);
198  		d->stored_data = NULL;
199  		d->stored_datalen = 0;
200  		lock_basic_unlock(&d->lock);
201  		return;
202  	}
203  	lock_basic_unlock(&d->lock);
204  	/* (key,data) successfully stored */
205  }
206  
207  /** The testframe backend is for unit tests */
208  static struct cachedb_backend testframe_backend = { "testframe",
209  	testframe_init, testframe_deinit, testframe_lookup, testframe_store
210  };
211  
212  /** find a particular backend from possible backends */
213  static struct cachedb_backend*
cachedb_find_backend(const char * str)214  cachedb_find_backend(const char* str)
215  {
216  #ifdef USE_REDIS
217  	if(strcmp(str, redis_backend.name) == 0)
218  		return &redis_backend;
219  #endif
220  	if(strcmp(str, testframe_backend.name) == 0)
221  		return &testframe_backend;
222  	/* TODO add more backends here */
223  	return NULL;
224  }
225  
226  /** apply configuration to cachedb module 'global' state */
227  static int
cachedb_apply_cfg(struct cachedb_env * cachedb_env,struct config_file * cfg)228  cachedb_apply_cfg(struct cachedb_env* cachedb_env, struct config_file* cfg)
229  {
230  	const char* backend_str = cfg->cachedb_backend;
231  	if(!backend_str || *backend_str==0)
232  		return 1;
233  	cachedb_env->backend = cachedb_find_backend(backend_str);
234  	if(!cachedb_env->backend) {
235  		log_err("cachedb: cannot find backend name '%s'", backend_str);
236  		return 0;
237  	}
238  
239  	/* TODO see if more configuration needs to be applied or not */
240  	return 1;
241  }
242  
243  int
cachedb_init(struct module_env * env,int id)244  cachedb_init(struct module_env* env, int id)
245  {
246  	struct cachedb_env* cachedb_env = (struct cachedb_env*)calloc(1,
247  		sizeof(struct cachedb_env));
248  	if(!cachedb_env) {
249  		log_err("malloc failure");
250  		return 0;
251  	}
252  	env->modinfo[id] = (void*)cachedb_env;
253  	if(!cachedb_apply_cfg(cachedb_env, env->cfg)) {
254  		log_err("cachedb: could not apply configuration settings.");
255  		free(cachedb_env);
256  		env->modinfo[id] = NULL;
257  		return 0;
258  	}
259  	/* see if a backend is selected */
260  	if(!cachedb_env->backend || !cachedb_env->backend->name)
261  		return 1;
262  	if(!(*cachedb_env->backend->init)(env, cachedb_env)) {
263  		log_err("cachedb: could not init %s backend",
264  			cachedb_env->backend->name);
265  		free(cachedb_env);
266  		env->modinfo[id] = NULL;
267  		return 0;
268  	}
269  	cachedb_env->enabled = 1;
270  	return 1;
271  }
272  
273  void
cachedb_deinit(struct module_env * env,int id)274  cachedb_deinit(struct module_env* env, int id)
275  {
276  	struct cachedb_env* cachedb_env;
277  	if(!env || !env->modinfo[id])
278  		return;
279  	cachedb_env = (struct cachedb_env*)env->modinfo[id];
280  	if(cachedb_env->enabled) {
281  		(*cachedb_env->backend->deinit)(env, cachedb_env);
282  	}
283  	free(cachedb_env);
284  	env->modinfo[id] = NULL;
285  }
286  
287  /** new query for cachedb */
288  static int
cachedb_new(struct module_qstate * qstate,int id)289  cachedb_new(struct module_qstate* qstate, int id)
290  {
291  	struct cachedb_qstate* iq = (struct cachedb_qstate*)regional_alloc(
292  		qstate->region, sizeof(struct cachedb_qstate));
293  	qstate->minfo[id] = iq;
294  	if(!iq)
295  		return 0;
296  	memset(iq, 0, sizeof(*iq));
297  	/* initialise it */
298  	/* TODO */
299  
300  	return 1;
301  }
302  
303  /**
304   * Return an error
305   * @param qstate: our query state
306   * @param id: module id
307   * @param rcode: error code (DNS errcode).
308   * @return: 0 for use by caller, to make notation easy, like:
309   * 	return error_response(..).
310   */
311  static int
error_response(struct module_qstate * qstate,int id,int rcode)312  error_response(struct module_qstate* qstate, int id, int rcode)
313  {
314  	verbose(VERB_QUERY, "return error response %s",
315  		sldns_lookup_by_id(sldns_rcodes, rcode)?
316  		sldns_lookup_by_id(sldns_rcodes, rcode)->name:"??");
317  	qstate->return_rcode = rcode;
318  	qstate->return_msg = NULL;
319  	qstate->ext_state[id] = module_finished;
320  	return 0;
321  }
322  
323  /**
324   * Hash the query name, type, class and dbacess-secret into lookup buffer.
325   * @param qinfo: query info
326   * @param env: with env->cfg with secret.
327   * @param buf: returned buffer with hash to lookup
328   * @param len: length of the buffer.
329   */
330  static void
calc_hash(struct query_info * qinfo,struct module_env * env,char * buf,size_t len)331  calc_hash(struct query_info* qinfo, struct module_env* env, char* buf,
332  	size_t len)
333  {
334  	uint8_t clear[1024];
335  	size_t clen = 0;
336  	uint8_t hash[CACHEDB_HASHSIZE/8];
337  	const char* hex = "0123456789ABCDEF";
338  	const char* secret = env->cfg->cachedb_secret;
339  	size_t i;
340  
341  	/* copy the hash info into the clear buffer */
342  	if(clen + qinfo->qname_len < sizeof(clear)) {
343  		memmove(clear+clen, qinfo->qname, qinfo->qname_len);
344  		clen += qinfo->qname_len;
345  	}
346  	if(clen + 4 < sizeof(clear)) {
347  		uint16_t t = htons(qinfo->qtype);
348  		uint16_t c = htons(qinfo->qclass);
349  		memmove(clear+clen, &t, 2);
350  		memmove(clear+clen+2, &c, 2);
351  		clen += 4;
352  	}
353  	if(secret && secret[0] && clen + strlen(secret) < sizeof(clear)) {
354  		memmove(clear+clen, secret, strlen(secret));
355  		clen += strlen(secret);
356  	}
357  
358  	/* hash the buffer */
359  	secalgo_hash_sha256(clear, clen, hash);
360  #ifdef HAVE_EXPLICIT_BZERO
361  	explicit_bzero(clear, clen);
362  #else
363  	memset(clear, 0, clen);
364  #endif
365  
366  	/* hex encode output for portability (some online dbs need
367  	 * no nulls, no control characters, and so on) */
368  	log_assert(len >= sizeof(hash)*2 + 1);
369  	(void)len;
370  	for(i=0; i<sizeof(hash); i++) {
371  		buf[i*2] = hex[(hash[i]&0xf0)>>4];
372  		buf[i*2+1] = hex[hash[i]&0x0f];
373  	}
374  	buf[sizeof(hash)*2] = 0;
375  }
376  
377  /** convert data from return_msg into the data buffer */
378  static int
prep_data(struct module_qstate * qstate,struct sldns_buffer * buf)379  prep_data(struct module_qstate* qstate, struct sldns_buffer* buf)
380  {
381  	uint64_t timestamp, expiry;
382  	size_t oldlim;
383  	struct edns_data edns;
384  	memset(&edns, 0, sizeof(edns));
385  	edns.edns_present = 1;
386  	edns.bits = EDNS_DO;
387  	edns.ext_rcode = 0;
388  	edns.edns_version = EDNS_ADVERTISED_VERSION;
389  	edns.udp_size = EDNS_ADVERTISED_SIZE;
390  
391  	if(!qstate->return_msg || !qstate->return_msg->rep)
392  		return 0;
393  	/* do not store failures like SERVFAIL in the cachedb, this avoids
394  	 * overwriting expired, valid, content with broken content. */
395  	if(FLAGS_GET_RCODE(qstate->return_msg->rep->flags) !=
396  		LDNS_RCODE_NOERROR &&
397  	   FLAGS_GET_RCODE(qstate->return_msg->rep->flags) !=
398  		LDNS_RCODE_NXDOMAIN &&
399  	   FLAGS_GET_RCODE(qstate->return_msg->rep->flags) !=
400  		LDNS_RCODE_YXDOMAIN)
401  		return 0;
402  	/* We don't store the reply if its TTL is 0 unless serve-expired is
403  	 * enabled.  Such a reply won't be reusable and simply be a waste for
404  	 * the backend.  It's also compatible with the default behavior of
405  	 * dns_cache_store_msg(). */
406  	if(qstate->return_msg->rep->ttl == 0 &&
407  		!qstate->env->cfg->serve_expired)
408  		return 0;
409  
410  	/* The EDE is added to the out-list so it is encoded in the cached message */
411  	if (qstate->env->cfg->ede && qstate->return_msg->rep->reason_bogus != LDNS_EDE_NONE) {
412  		edns_opt_list_append_ede(&edns.opt_list_out, qstate->env->scratch,
413  					qstate->return_msg->rep->reason_bogus,
414  					qstate->return_msg->rep->reason_bogus_str);
415  	}
416  
417  	if(verbosity >= VERB_ALGO)
418  		log_dns_msg("cachedb encoding", &qstate->return_msg->qinfo,
419  	                qstate->return_msg->rep);
420  	if(!reply_info_answer_encode(&qstate->return_msg->qinfo,
421  		qstate->return_msg->rep, 0, qstate->query_flags,
422  		buf, 0, 1, qstate->env->scratch, 65535, &edns, 1, 0))
423  		return 0;
424  
425  	/* TTLs in the return_msg are relative to time(0) so we have to
426  	 * store that, we also store the smallest ttl in the packet+time(0)
427  	 * as the packet expiry time */
428  	/* qstate->return_msg->rep->ttl contains that relative shortest ttl */
429  	timestamp = (uint64_t)*qstate->env->now;
430  	expiry = timestamp + (uint64_t)qstate->return_msg->rep->ttl;
431  	timestamp = htobe64(timestamp);
432  	expiry = htobe64(expiry);
433  	oldlim = sldns_buffer_limit(buf);
434  	if(oldlim + sizeof(timestamp)+sizeof(expiry) >=
435  		sldns_buffer_capacity(buf))
436  		return 0; /* doesn't fit. */
437  	sldns_buffer_set_limit(buf, oldlim + sizeof(timestamp)+sizeof(expiry));
438  	sldns_buffer_write_at(buf, oldlim, &timestamp, sizeof(timestamp));
439  	sldns_buffer_write_at(buf, oldlim+sizeof(timestamp), &expiry,
440  		sizeof(expiry));
441  
442  	return 1;
443  }
444  
445  /** check expiry, return true if matches OK */
446  static int
good_expiry_and_qinfo(struct module_qstate * qstate,struct sldns_buffer * buf)447  good_expiry_and_qinfo(struct module_qstate* qstate, struct sldns_buffer* buf)
448  {
449  	uint64_t expiry;
450  	/* the expiry time is the last bytes of the buffer */
451  	if(sldns_buffer_limit(buf) < sizeof(expiry))
452  		return 0;
453  	sldns_buffer_read_at(buf, sldns_buffer_limit(buf)-sizeof(expiry),
454  		&expiry, sizeof(expiry));
455  	expiry = be64toh(expiry);
456  
457  	/* Check if we are allowed to return expired entries:
458  	 * - serve_expired needs to be set
459  	 * - if SERVE_EXPIRED_TTL is set make sure that the record is not older
460  	 *   than that. */
461  	if((time_t)expiry < *qstate->env->now &&
462  		(!qstate->env->cfg->serve_expired ||
463  			(SERVE_EXPIRED_TTL &&
464  			*qstate->env->now - (time_t)expiry > SERVE_EXPIRED_TTL)))
465  		return 0;
466  
467  	return 1;
468  }
469  
470  /* Adjust the TTL of the given RRset by 'subtract'.  If 'subtract' is
471   * negative, set the TTL to 0. */
472  static void
packed_rrset_ttl_subtract(struct packed_rrset_data * data,time_t subtract)473  packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract)
474  {
475  	size_t i;
476  	size_t total = data->count + data->rrsig_count;
477  	if(subtract >= 0 && data->ttl > subtract)
478  		data->ttl -= subtract;
479  	else	data->ttl = 0;
480  	for(i=0; i<total; i++) {
481  		if(subtract >= 0 && data->rr_ttl[i] > subtract)
482  			data->rr_ttl[i] -= subtract;
483  		else	data->rr_ttl[i] = 0;
484  	}
485  	data->ttl_add = (subtract < data->ttl_add) ? (data->ttl_add - subtract) : 0;
486  }
487  
488  /* Adjust the TTL of a DNS message and its RRs by 'adjust'.  If 'adjust' is
489   * negative, set the TTLs to 0. */
490  static void
adjust_msg_ttl(struct dns_msg * msg,time_t adjust)491  adjust_msg_ttl(struct dns_msg* msg, time_t adjust)
492  {
493  	size_t i;
494  	if(adjust >= 0 && msg->rep->ttl > adjust)
495  		msg->rep->ttl -= adjust;
496  	else
497  		msg->rep->ttl = 0;
498  	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
499  	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
500  
501  	for(i=0; i<msg->rep->rrset_count; i++) {
502  		packed_rrset_ttl_subtract((struct packed_rrset_data*)msg->
503  			rep->rrsets[i]->entry.data, adjust);
504  	}
505  }
506  
507  /* Set the TTL of the given RRset to fixed value. */
508  static void
packed_rrset_ttl_set(struct packed_rrset_data * data,time_t ttl)509  packed_rrset_ttl_set(struct packed_rrset_data* data, time_t ttl)
510  {
511  	size_t i;
512  	size_t total = data->count + data->rrsig_count;
513  	data->ttl = ttl;
514  	for(i=0; i<total; i++) {
515  		data->rr_ttl[i] = ttl;
516  	}
517  	data->ttl_add = 0;
518  }
519  
520  /* Set the TTL of a DNS message and its RRs by to a fixed value. */
521  static void
set_msg_ttl(struct dns_msg * msg,time_t ttl)522  set_msg_ttl(struct dns_msg* msg, time_t ttl)
523  {
524  	size_t i;
525  	msg->rep->ttl = ttl;
526  	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
527  	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
528  
529  	for(i=0; i<msg->rep->rrset_count; i++) {
530  		packed_rrset_ttl_set((struct packed_rrset_data*)msg->
531  			rep->rrsets[i]->entry.data, ttl);
532  	}
533  }
534  
535  /** convert dns message in buffer to return_msg */
536  static int
parse_data(struct module_qstate * qstate,struct sldns_buffer * buf,int * msg_expired)537  parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
538  	int* msg_expired)
539  {
540  	struct msg_parse* prs;
541  	struct edns_data edns;
542  	struct edns_option* ede;
543  	uint64_t timestamp, expiry;
544  	time_t adjust;
545  	size_t lim = sldns_buffer_limit(buf);
546  	if(lim < LDNS_HEADER_SIZE+sizeof(timestamp)+sizeof(expiry))
547  		return 0; /* too short */
548  
549  	/* remove timestamp and expiry from end */
550  	sldns_buffer_read_at(buf, lim-sizeof(expiry), &expiry, sizeof(expiry));
551  	sldns_buffer_read_at(buf, lim-sizeof(expiry)-sizeof(timestamp),
552  		&timestamp, sizeof(timestamp));
553  	expiry = be64toh(expiry);
554  	timestamp = be64toh(timestamp);
555  
556  	/* parse DNS packet */
557  	regional_free_all(qstate->env->scratch);
558  	prs = (struct msg_parse*)regional_alloc(qstate->env->scratch,
559  		sizeof(struct msg_parse));
560  	if(!prs)
561  		return 0; /* out of memory */
562  	memset(prs, 0, sizeof(*prs));
563  	memset(&edns, 0, sizeof(edns));
564  	sldns_buffer_set_limit(buf, lim - sizeof(expiry)-sizeof(timestamp));
565  	if(parse_packet(buf, prs, qstate->env->scratch) != LDNS_RCODE_NOERROR) {
566  		sldns_buffer_set_limit(buf, lim);
567  		return 0;
568  	}
569  	if(parse_extract_edns_from_response_msg(prs, &edns, qstate->env->scratch) !=
570  		LDNS_RCODE_NOERROR) {
571  		sldns_buffer_set_limit(buf, lim);
572  		return 0;
573  	}
574  
575  	qstate->return_msg = dns_alloc_msg(buf, prs, qstate->region);
576  	sldns_buffer_set_limit(buf, lim);
577  	if(!qstate->return_msg)
578  		return 0;
579  
580  	/* We find the EDE in the in-list after parsing */
581  	if(qstate->env->cfg->ede &&
582  		(ede = edns_opt_list_find(edns.opt_list_in, LDNS_EDNS_EDE))) {
583  		if(ede->opt_len >= 2) {
584  			qstate->return_msg->rep->reason_bogus =
585  				sldns_read_uint16(ede->opt_data);
586  		}
587  		/* allocate space and store the error string and it's size */
588  		if(ede->opt_len > 2) {
589  			size_t ede_len = ede->opt_len - 2;
590  			qstate->return_msg->rep->reason_bogus_str = regional_alloc(
591  				qstate->region, sizeof(char) * (ede_len+1));
592  			memcpy(qstate->return_msg->rep->reason_bogus_str,
593  				ede->opt_data+2, ede_len);
594  			qstate->return_msg->rep->reason_bogus_str[ede_len] = 0;
595  		}
596  	}
597  
598  	qstate->return_rcode = LDNS_RCODE_NOERROR;
599  
600  	/* see how much of the TTL expired, and remove it */
601  	if(*qstate->env->now <= (time_t)timestamp) {
602  		verbose(VERB_ALGO, "cachedb msg adjust by zero");
603  		return 1; /* message from the future (clock skew?) */
604  	}
605  	adjust = *qstate->env->now - (time_t)timestamp;
606  	if(qstate->return_msg->rep->ttl < adjust) {
607  		verbose(VERB_ALGO, "cachedb msg expired");
608  		*msg_expired = 1;
609  		/* If serve-expired is enabled, we still use an expired message
610  		 * setting the TTL to 0. */
611  		if(!qstate->env->cfg->serve_expired ||
612  			(FLAGS_GET_RCODE(qstate->return_msg->rep->flags)
613  			!= LDNS_RCODE_NOERROR &&
614  			FLAGS_GET_RCODE(qstate->return_msg->rep->flags)
615  			!= LDNS_RCODE_NXDOMAIN &&
616  			FLAGS_GET_RCODE(qstate->return_msg->rep->flags)
617  			!= LDNS_RCODE_YXDOMAIN))
618  			return 0; /* message expired */
619  		else
620  			adjust = -1;
621  	}
622  	verbose(VERB_ALGO, "cachedb msg adjusted down by %d", (int)adjust);
623  	adjust_msg_ttl(qstate->return_msg, adjust);
624  	if(qstate->env->cfg->aggressive_nsec) {
625  		limit_nsec_ttl(qstate->return_msg);
626  	}
627  
628  	/* Similar to the unbound worker, if serve-expired is enabled and
629  	 * the msg would be considered to be expired, mark the state so a
630  	 * refetch will be scheduled.  The comparison between 'expiry' and
631  	 * 'now' should be redundant given how these values were calculated,
632  	 * but we check it just in case as does good_expiry_and_qinfo(). */
633  	if(qstate->env->cfg->serve_expired &&
634  		!qstate->env->cfg->serve_expired_client_timeout &&
635  		(adjust == -1 || (time_t)expiry < *qstate->env->now)) {
636  		qstate->need_refetch = 1;
637  	}
638  
639  	return 1;
640  }
641  
642  /**
643   * Lookup the qstate.qinfo in extcache, store in qstate.return_msg.
644   * return true if lookup was successful.
645   */
646  static int
cachedb_extcache_lookup(struct module_qstate * qstate,struct cachedb_env * ie,int * msg_expired)647  cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie,
648  	int* msg_expired)
649  {
650  	char key[(CACHEDB_HASHSIZE/8)*2+1];
651  	calc_hash(&qstate->qinfo, qstate->env, key, sizeof(key));
652  
653  	/* call backend to fetch data for key into scratch buffer */
654  	if( !(*ie->backend->lookup)(qstate->env, ie, key,
655  		qstate->env->scratch_buffer)) {
656  		return 0;
657  	}
658  
659  	/* check expiry date and check if query-data matches */
660  	if( !good_expiry_and_qinfo(qstate, qstate->env->scratch_buffer) ) {
661  		return 0;
662  	}
663  
664  	/* parse dns message into return_msg */
665  	if( !parse_data(qstate, qstate->env->scratch_buffer, msg_expired) ) {
666  		return 0;
667  	}
668  	return 1;
669  }
670  
671  /**
672   * Store the qstate.return_msg in extcache for key qstate.info
673   */
674  static void
cachedb_extcache_store(struct module_qstate * qstate,struct cachedb_env * ie)675  cachedb_extcache_store(struct module_qstate* qstate, struct cachedb_env* ie)
676  {
677  	char key[(CACHEDB_HASHSIZE/8)*2+1];
678  	calc_hash(&qstate->qinfo, qstate->env, key, sizeof(key));
679  
680  	/* prepare data in scratch buffer */
681  	if(!prep_data(qstate, qstate->env->scratch_buffer))
682  		return;
683  
684  	/* call backend */
685  	(*ie->backend->store)(qstate->env, ie, key,
686  		sldns_buffer_begin(qstate->env->scratch_buffer),
687  		sldns_buffer_limit(qstate->env->scratch_buffer),
688  		qstate->return_msg->rep->ttl);
689  }
690  
691  /**
692   * See if unbound's internal cache can answer the query
693   */
694  static int
cachedb_intcache_lookup(struct module_qstate * qstate,struct cachedb_env * cde)695  cachedb_intcache_lookup(struct module_qstate* qstate, struct cachedb_env* cde)
696  {
697  	uint8_t dpname_storage[LDNS_MAX_DOMAINLEN+1];
698  	uint8_t* dpname=NULL;
699  	size_t dpnamelen=0;
700  	struct dns_msg* msg;
701  	/* for testframe bypass this lookup */
702  	if(cde->backend == &testframe_backend) {
703  		return 0;
704  	}
705  	if(iter_stub_fwd_no_cache(qstate, &qstate->qinfo,
706  		&dpname, &dpnamelen, dpname_storage, sizeof(dpname_storage)))
707  		return 0; /* no cache for these queries */
708  	msg = dns_cache_lookup(qstate->env, qstate->qinfo.qname,
709  		qstate->qinfo.qname_len, qstate->qinfo.qtype,
710  		qstate->qinfo.qclass, qstate->query_flags,
711  		qstate->region, qstate->env->scratch,
712  		1, /* no partial messages with only a CNAME */
713  		dpname, dpnamelen
714  		);
715  	if(!msg && qstate->env->neg_cache &&
716  		iter_qname_indicates_dnssec(qstate->env, &qstate->qinfo)) {
717  		/* lookup in negative cache; may result in
718  		 * NOERROR/NODATA or NXDOMAIN answers that need validation */
719  		msg = val_neg_getmsg(qstate->env->neg_cache, &qstate->qinfo,
720  			qstate->region, qstate->env->rrset_cache,
721  			qstate->env->scratch_buffer,
722  			*qstate->env->now, 1/*add SOA*/, NULL,
723  			qstate->env->cfg);
724  	}
725  	if(!msg)
726  		return 0;
727  	/* this is the returned msg */
728  	qstate->return_rcode = LDNS_RCODE_NOERROR;
729  	qstate->return_msg = msg;
730  	return 1;
731  }
732  
733  /**
734   * Store query into the internal cache of unbound.
735   */
736  static void
cachedb_intcache_store(struct module_qstate * qstate,int msg_expired)737  cachedb_intcache_store(struct module_qstate* qstate, int msg_expired)
738  {
739  	uint32_t store_flags = qstate->query_flags;
740  	int serve_expired = qstate->env->cfg->serve_expired;
741  
742  	if(qstate->env->cfg->serve_expired)
743  		store_flags |= DNSCACHE_STORE_ZEROTTL;
744  	if(!qstate->return_msg)
745  		return;
746  	if(serve_expired && msg_expired) {
747  		/* Set TTLs to a value such that value + *env->now is
748  		 * going to be now-3 seconds. Making it expired
749  		 * in the cache. */
750  		set_msg_ttl(qstate->return_msg, (time_t)-3);
751  		/* The expired entry does not get checked by the validator
752  		 * and we need a validation value for it. */
753  		if(qstate->env->cfg->cachedb_check_when_serve_expired)
754  			qstate->return_msg->rep->security = sec_status_insecure;
755  	}
756  	(void)dns_cache_store(qstate->env, &qstate->qinfo,
757  		qstate->return_msg->rep, 0, qstate->prefetch_leeway, 0,
758  		qstate->region, store_flags, qstate->qstarttime);
759  	if(serve_expired && msg_expired) {
760  		if(qstate->env->cfg->serve_expired_client_timeout) {
761  			/* No expired response from the query state, the
762  			 * query resolution needs to continue and it can
763  			 * pick up the expired result after the timer out
764  			 * of cache. */
765  			return;
766  		}
767  		/* set TTLs to zero again */
768  		adjust_msg_ttl(qstate->return_msg, -1);
769  		/* Send serve expired responses based on the cachedb
770  		 * returned message, that was just stored in the cache.
771  		 * It can then continue to work on this query. */
772  		mesh_respond_serve_expired(qstate->mesh_info);
773  	}
774  }
775  
776  /**
777   * Handle a cachedb module event with a query
778   * @param qstate: query state (from the mesh), passed between modules.
779   * 	contains qstate->env module environment with global caches and so on.
780   * @param iq: query state specific for this module.  per-query.
781   * @param ie: environment specific for this module.  global.
782   * @param id: module id.
783   */
784  static void
cachedb_handle_query(struct module_qstate * qstate,struct cachedb_qstate * ATTR_UNUSED (iq),struct cachedb_env * ie,int id)785  cachedb_handle_query(struct module_qstate* qstate,
786  	struct cachedb_qstate* ATTR_UNUSED(iq),
787  	struct cachedb_env* ie, int id)
788  {
789  	int msg_expired = 0;
790  	qstate->is_cachedb_answer = 0;
791  	/* check if we are enabled, and skip if so */
792  	if(!ie->enabled) {
793  		/* pass request to next module */
794  		qstate->ext_state[id] = module_wait_module;
795  		return;
796  	}
797  
798  	if(qstate->blacklist || qstate->no_cache_lookup) {
799  		/* cache is blacklisted or we are instructed from edns to not look */
800  		/* pass request to next module */
801  		qstate->ext_state[id] = module_wait_module;
802  		return;
803  	}
804  
805  	/* lookup inside unbound's internal cache.
806  	 * This does not look for expired entries. */
807  	if(cachedb_intcache_lookup(qstate, ie)) {
808  		if(verbosity >= VERB_ALGO) {
809  			if(qstate->return_msg->rep)
810  				log_dns_msg("cachedb internal cache lookup",
811  					&qstate->return_msg->qinfo,
812  					qstate->return_msg->rep);
813  			else log_info("cachedb internal cache lookup: rcode %s",
814  				sldns_lookup_by_id(sldns_rcodes, qstate->return_rcode)
815  				?sldns_lookup_by_id(sldns_rcodes, qstate->return_rcode)->name
816  				:"??");
817  		}
818  		/* we are done with the query */
819  		qstate->ext_state[id] = module_finished;
820  		return;
821  	}
822  
823  	/* ask backend cache to see if we have data */
824  	if(cachedb_extcache_lookup(qstate, ie, &msg_expired)) {
825  		if(verbosity >= VERB_ALGO)
826  			log_dns_msg(ie->backend->name,
827  				&qstate->return_msg->qinfo,
828  				qstate->return_msg->rep);
829  		/* store this result in internal cache */
830  		cachedb_intcache_store(qstate, msg_expired);
831  		/* In case we have expired data but there is a client timer for expired
832  		 * answers, pass execution to next module in order to try updating the
833  		 * data first.
834  		 */
835  		if(qstate->env->cfg->serve_expired && msg_expired) {
836  			qstate->return_msg = NULL;
837  			qstate->ext_state[id] = module_wait_module;
838  			/* The expired reply is sent with
839  			 * mesh_respond_serve_expired, and so
840  			 * the need_refetch is not used. */
841  			qstate->need_refetch = 0;
842  			return;
843  		}
844  		if(qstate->need_refetch && qstate->serve_expired_data &&
845  			qstate->serve_expired_data->timer) {
846  				qstate->return_msg = NULL;
847  				qstate->ext_state[id] = module_wait_module;
848  				return;
849  		}
850  		qstate->is_cachedb_answer = 1;
851  		/* we are done with the query */
852  		qstate->ext_state[id] = module_finished;
853  		return;
854  	}
855  
856  	if(qstate->serve_expired_data &&
857  		qstate->env->cfg->cachedb_check_when_serve_expired &&
858  		!qstate->env->cfg->serve_expired_client_timeout) {
859  		/* Reply with expired data if any to client, because cachedb
860  		 * also has no useful, current data */
861  		mesh_respond_serve_expired(qstate->mesh_info);
862  	}
863  
864  	/* no cache fetches */
865  	/* pass request to next module */
866  	qstate->ext_state[id] = module_wait_module;
867  }
868  
869  /**
870   * Handle a cachedb module event with a response from the iterator.
871   * @param qstate: query state (from the mesh), passed between modules.
872   * 	contains qstate->env module environment with global caches and so on.
873   * @param iq: query state specific for this module.  per-query.
874   * @param ie: environment specific for this module.  global.
875   * @param id: module id.
876   */
877  static void
cachedb_handle_response(struct module_qstate * qstate,struct cachedb_qstate * ATTR_UNUSED (iq),struct cachedb_env * ie,int id)878  cachedb_handle_response(struct module_qstate* qstate,
879  	struct cachedb_qstate* ATTR_UNUSED(iq), struct cachedb_env* ie, int id)
880  {
881  	qstate->is_cachedb_answer = 0;
882  	/* check if we are not enabled or instructed to not cache, and skip */
883  	if(!ie->enabled || qstate->no_cache_store) {
884  		/* we are done with the query */
885  		qstate->ext_state[id] = module_finished;
886  		return;
887  	}
888  	if(qstate->env->cfg->cachedb_no_store) {
889  		/* do not store the item in the external cache */
890  		qstate->ext_state[id] = module_finished;
891  		return;
892  	}
893  
894  	/* store the item into the backend cache */
895  	cachedb_extcache_store(qstate, ie);
896  
897  	/* we are done with the query */
898  	qstate->ext_state[id] = module_finished;
899  }
900  
901  void
cachedb_operate(struct module_qstate * qstate,enum module_ev event,int id,struct outbound_entry * outbound)902  cachedb_operate(struct module_qstate* qstate, enum module_ev event, int id,
903  	struct outbound_entry* outbound)
904  {
905  	struct cachedb_env* ie = (struct cachedb_env*)qstate->env->modinfo[id];
906  	struct cachedb_qstate* iq = (struct cachedb_qstate*)qstate->minfo[id];
907  	verbose(VERB_QUERY, "cachedb[module %d] operate: extstate:%s event:%s",
908  		id, strextstate(qstate->ext_state[id]), strmodulevent(event));
909  	if(iq) log_query_info(VERB_QUERY, "cachedb operate: query",
910  		&qstate->qinfo);
911  
912  	/* perform cachedb state machine */
913  	if((event == module_event_new || event == module_event_pass) &&
914  		iq == NULL) {
915  		if(!cachedb_new(qstate, id)) {
916  			(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
917  			return;
918  		}
919  		iq = (struct cachedb_qstate*)qstate->minfo[id];
920  	}
921  	if(iq && (event == module_event_pass || event == module_event_new)) {
922  		cachedb_handle_query(qstate, iq, ie, id);
923  		return;
924  	}
925  	if(iq && (event == module_event_moddone)) {
926  		cachedb_handle_response(qstate, iq, ie, id);
927  		return;
928  	}
929  	if(iq && outbound) {
930  		/* cachedb does not need to process responses at this time
931  		 * ignore it.
932  		cachedb_process_response(qstate, iq, ie, id, outbound, event);
933  		*/
934  		return;
935  	}
936  	if(event == module_event_error) {
937  		verbose(VERB_ALGO, "got called with event error, giving up");
938  		(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
939  		return;
940  	}
941  	if(!iq && (event == module_event_moddone)) {
942  		/* during priming, module done but we never started */
943  		qstate->ext_state[id] = module_finished;
944  		return;
945  	}
946  
947  	log_err("bad event for cachedb");
948  	(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
949  }
950  
951  void
cachedb_inform_super(struct module_qstate * ATTR_UNUSED (qstate),int ATTR_UNUSED (id),struct module_qstate * ATTR_UNUSED (super))952  cachedb_inform_super(struct module_qstate* ATTR_UNUSED(qstate),
953  	int ATTR_UNUSED(id), struct module_qstate* ATTR_UNUSED(super))
954  {
955  	/* cachedb does not use subordinate requests at this time */
956  	verbose(VERB_ALGO, "cachedb inform_super was called");
957  }
958  
959  void
cachedb_clear(struct module_qstate * qstate,int id)960  cachedb_clear(struct module_qstate* qstate, int id)
961  {
962  	struct cachedb_qstate* iq;
963  	if(!qstate)
964  		return;
965  	iq = (struct cachedb_qstate*)qstate->minfo[id];
966  	if(iq) {
967  		/* free contents of iq */
968  		/* TODO */
969  	}
970  	qstate->minfo[id] = NULL;
971  }
972  
973  size_t
cachedb_get_mem(struct module_env * env,int id)974  cachedb_get_mem(struct module_env* env, int id)
975  {
976  	struct cachedb_env* ie = (struct cachedb_env*)env->modinfo[id];
977  	if(!ie)
978  		return 0;
979  	return sizeof(*ie); /* TODO - more mem */
980  }
981  
982  /**
983   * The cachedb function block
984   */
985  static struct module_func_block cachedb_block = {
986  	"cachedb",
987  	NULL, NULL, &cachedb_init, &cachedb_deinit, &cachedb_operate,
988  	&cachedb_inform_super, &cachedb_clear, &cachedb_get_mem
989  };
990  
991  struct module_func_block*
cachedb_get_funcblock(void)992  cachedb_get_funcblock(void)
993  {
994  	return &cachedb_block;
995  }
996  
997  int
cachedb_is_enabled(struct module_stack * mods,struct module_env * env)998  cachedb_is_enabled(struct module_stack* mods, struct module_env* env)
999  {
1000  	struct cachedb_env* ie;
1001  	int id = modstack_find(mods, "cachedb");
1002  	if(id == -1)
1003  		return 0;
1004  	ie = (struct cachedb_env*)env->modinfo[id];
1005  	if(ie && ie->enabled)
1006  		return 1;
1007  	return 0;
1008  }
1009  
cachedb_msg_remove(struct module_qstate * qstate)1010  void cachedb_msg_remove(struct module_qstate* qstate)
1011  {
1012  	cachedb_msg_remove_qinfo(qstate->env, &qstate->qinfo);
1013  }
1014  
cachedb_msg_remove_qinfo(struct module_env * env,struct query_info * qinfo)1015  void cachedb_msg_remove_qinfo(struct module_env* env, struct query_info* qinfo)
1016  {
1017  	char key[(CACHEDB_HASHSIZE/8)*2+1];
1018  	int id = modstack_find(env->modstack, "cachedb");
1019  	struct cachedb_env* ie = (struct cachedb_env*)env->modinfo[id];
1020  
1021  	log_query_info(VERB_ALGO, "cachedb msg remove", qinfo);
1022  	calc_hash(qinfo, env, key, sizeof(key));
1023  	sldns_buffer_clear(env->scratch_buffer);
1024  	sldns_buffer_write_u32(env->scratch_buffer, 0);
1025  	sldns_buffer_flip(env->scratch_buffer);
1026  
1027  	/* call backend */
1028  	(*ie->backend->store)(env, ie, key,
1029  		sldns_buffer_begin(env->scratch_buffer),
1030  		sldns_buffer_limit(env->scratch_buffer),
1031  		0);
1032  }
1033  #endif /* USE_CACHEDB */
1034