1 /* 2 * util/netevent.c - event notification 3 * 4 * Copyright (c) 2007, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains event notification functions. 40 */ 41 #include "config.h" 42 #include "util/netevent.h" 43 #include "util/ub_event.h" 44 #include "util/log.h" 45 #include "util/net_help.h" 46 #include "util/tcp_conn_limit.h" 47 #include "util/fptr_wlist.h" 48 #include "util/proxy_protocol.h" 49 #include "util/timeval_func.h" 50 #include "sldns/pkthdr.h" 51 #include "sldns/sbuffer.h" 52 #include "sldns/str2wire.h" 53 #include "dnstap/dnstap.h" 54 #include "dnscrypt/dnscrypt.h" 55 #include "services/listen_dnsport.h" 56 #include "util/random.h" 57 #ifdef HAVE_SYS_TYPES_H 58 #include <sys/types.h> 59 #endif 60 #ifdef HAVE_SYS_SOCKET_H 61 #include <sys/socket.h> 62 #endif 63 #ifdef HAVE_NETDB_H 64 #include <netdb.h> 65 #endif 66 #ifdef HAVE_POLL_H 67 #include <poll.h> 68 #endif 69 70 #ifdef HAVE_OPENSSL_SSL_H 71 #include <openssl/ssl.h> 72 #endif 73 #ifdef HAVE_OPENSSL_ERR_H 74 #include <openssl/err.h> 75 #endif 76 77 #ifdef HAVE_NGTCP2 78 #include <ngtcp2/ngtcp2.h> 79 #include <ngtcp2/ngtcp2_crypto.h> 80 #endif 81 82 #ifdef HAVE_LINUX_NET_TSTAMP_H 83 #include <linux/net_tstamp.h> 84 #endif 85 86 /* -------- Start of local definitions -------- */ 87 /** if CMSG_ALIGN is not defined on this platform, a workaround */ 88 #ifndef CMSG_ALIGN 89 # ifdef __CMSG_ALIGN 90 # define CMSG_ALIGN(n) __CMSG_ALIGN(n) 91 # elif defined(CMSG_DATA_ALIGN) 92 # define CMSG_ALIGN _CMSG_DATA_ALIGN 93 # else 94 # define CMSG_ALIGN(len) (((len)+sizeof(long)-1) & ~(sizeof(long)-1)) 95 # endif 96 #endif 97 98 /** if CMSG_LEN is not defined on this platform, a workaround */ 99 #ifndef CMSG_LEN 100 # define CMSG_LEN(len) (CMSG_ALIGN(sizeof(struct cmsghdr))+(len)) 101 #endif 102 103 /** if CMSG_SPACE is not defined on this platform, a workaround */ 104 #ifndef CMSG_SPACE 105 # ifdef _CMSG_HDR_ALIGN 106 # define CMSG_SPACE(l) (CMSG_ALIGN(l)+_CMSG_HDR_ALIGN(sizeof(struct cmsghdr))) 107 # else 108 # define CMSG_SPACE(l) (CMSG_ALIGN(l)+CMSG_ALIGN(sizeof(struct cmsghdr))) 109 # endif 110 #endif 111 112 /** The TCP writing query timeout in milliseconds */ 113 #define TCP_QUERY_TIMEOUT 120000 114 /** The minimum actual TCP timeout to use, regardless of what we advertise, 115 * in msec */ 116 #define TCP_QUERY_TIMEOUT_MINIMUM 200 117 118 #ifndef NONBLOCKING_IS_BROKEN 119 /** number of UDP reads to perform per read indication from select */ 120 #define NUM_UDP_PER_SELECT 100 121 #else 122 #define NUM_UDP_PER_SELECT 1 123 #endif 124 125 /** The number of TCP queries over a TCP connection, per read indication 126 * from select. */ 127 #define NUM_TCP_PER_SELECT 100 128 129 /** timeout in millisec to wait for write to unblock, packets dropped after.*/ 130 #define SEND_BLOCKED_WAIT_TIMEOUT 200 131 /** max number of times to wait for write to unblock, packets dropped after.*/ 132 #define SEND_BLOCKED_MAX_RETRY 5 133 134 /** Let's make timestamping code cleaner and redefine SO_TIMESTAMP* */ 135 #ifndef SO_TIMESTAMP 136 #define SO_TIMESTAMP 29 137 #endif 138 #ifndef SO_TIMESTAMPNS 139 #define SO_TIMESTAMPNS 35 140 #endif 141 #ifndef SO_TIMESTAMPING 142 #define SO_TIMESTAMPING 37 143 #endif 144 /** 145 * The internal event structure for keeping ub_event info for the event. 146 * Possibly other structures (list, tree) this is part of. 147 */ 148 struct internal_event { 149 /** the comm base */ 150 struct comm_base* base; 151 /** ub_event event type */ 152 struct ub_event* ev; 153 }; 154 155 /** 156 * Internal base structure, so that every thread has its own events. 157 */ 158 struct internal_base { 159 /** ub_event event_base type. */ 160 struct ub_event_base* base; 161 /** seconds time pointer points here */ 162 time_t secs; 163 /** timeval with current time */ 164 struct timeval now; 165 /** the event used for slow_accept timeouts */ 166 struct ub_event* slow_accept; 167 /** true if slow_accept is enabled */ 168 int slow_accept_enabled; 169 /** last log time for slow logging of file descriptor errors */ 170 time_t last_slow_log; 171 /** last log time for slow logging of write wait failures */ 172 time_t last_writewait_log; 173 }; 174 175 /** 176 * Internal timer structure, to store timer event in. 177 */ 178 struct internal_timer { 179 /** the super struct from which derived */ 180 struct comm_timer super; 181 /** the comm base */ 182 struct comm_base* base; 183 /** ub_event event type */ 184 struct ub_event* ev; 185 /** is timer enabled */ 186 uint8_t enabled; 187 }; 188 189 /** 190 * Internal signal structure, to store signal event in. 191 */ 192 struct internal_signal { 193 /** ub_event event type */ 194 struct ub_event* ev; 195 /** next in signal list */ 196 struct internal_signal* next; 197 }; 198 199 /** create a tcp handler with a parent */ 200 static struct comm_point* comm_point_create_tcp_handler( 201 struct comm_base *base, struct comm_point* parent, size_t bufsize, 202 struct sldns_buffer* spoolbuf, comm_point_callback_type* callback, 203 void* callback_arg, struct unbound_socket* socket); 204 205 /* -------- End of local definitions -------- */ 206 207 struct comm_base* 208 comm_base_create(int sigs) 209 { 210 struct comm_base* b = (struct comm_base*)calloc(1, 211 sizeof(struct comm_base)); 212 const char *evnm="event", *evsys="", *evmethod=""; 213 214 if(!b) 215 return NULL; 216 b->eb = (struct internal_base*)calloc(1, sizeof(struct internal_base)); 217 if(!b->eb) { 218 free(b); 219 return NULL; 220 } 221 b->eb->base = ub_default_event_base(sigs, &b->eb->secs, &b->eb->now); 222 if(!b->eb->base) { 223 free(b->eb); 224 free(b); 225 return NULL; 226 } 227 ub_comm_base_now(b); 228 ub_get_event_sys(b->eb->base, &evnm, &evsys, &evmethod); 229 verbose(VERB_ALGO, "%s %s uses %s method.", evnm, evsys, evmethod); 230 return b; 231 } 232 233 struct comm_base* 234 comm_base_create_event(struct ub_event_base* base) 235 { 236 struct comm_base* b = (struct comm_base*)calloc(1, 237 sizeof(struct comm_base)); 238 if(!b) 239 return NULL; 240 b->eb = (struct internal_base*)calloc(1, sizeof(struct internal_base)); 241 if(!b->eb) { 242 free(b); 243 return NULL; 244 } 245 b->eb->base = base; 246 ub_comm_base_now(b); 247 return b; 248 } 249 250 void 251 comm_base_delete(struct comm_base* b) 252 { 253 if(!b) 254 return; 255 if(b->eb->slow_accept_enabled) { 256 if(ub_event_del(b->eb->slow_accept) != 0) { 257 log_err("could not event_del slow_accept"); 258 } 259 ub_event_free(b->eb->slow_accept); 260 } 261 ub_event_base_free(b->eb->base); 262 b->eb->base = NULL; 263 free(b->eb); 264 free(b); 265 } 266 267 void 268 comm_base_delete_no_base(struct comm_base* b) 269 { 270 if(!b) 271 return; 272 if(b->eb->slow_accept_enabled) { 273 if(ub_event_del(b->eb->slow_accept) != 0) { 274 log_err("could not event_del slow_accept"); 275 } 276 ub_event_free(b->eb->slow_accept); 277 } 278 b->eb->base = NULL; 279 free(b->eb); 280 free(b); 281 } 282 283 void 284 comm_base_timept(struct comm_base* b, time_t** tt, struct timeval** tv) 285 { 286 *tt = &b->eb->secs; 287 *tv = &b->eb->now; 288 } 289 290 void 291 comm_base_dispatch(struct comm_base* b) 292 { 293 int retval; 294 retval = ub_event_base_dispatch(b->eb->base); 295 if(retval < 0) { 296 fatal_exit("event_dispatch returned error %d, " 297 "errno is %s", retval, strerror(errno)); 298 } 299 } 300 301 void comm_base_exit(struct comm_base* b) 302 { 303 if(ub_event_base_loopexit(b->eb->base) != 0) { 304 log_err("Could not loopexit"); 305 } 306 } 307 308 void comm_base_set_slow_accept_handlers(struct comm_base* b, 309 void (*stop_acc)(void*), void (*start_acc)(void*), void* arg) 310 { 311 b->stop_accept = stop_acc; 312 b->start_accept = start_acc; 313 b->cb_arg = arg; 314 } 315 316 struct ub_event_base* comm_base_internal(struct comm_base* b) 317 { 318 return b->eb->base; 319 } 320 321 struct ub_event* comm_point_internal(struct comm_point* c) 322 { 323 return c->ev->ev; 324 } 325 326 /** see if errno for udp has to be logged or not uses globals */ 327 static int 328 udp_send_errno_needs_log(struct sockaddr* addr, socklen_t addrlen) 329 { 330 /* do not log transient errors (unless high verbosity) */ 331 #if defined(ENETUNREACH) || defined(EHOSTDOWN) || defined(EHOSTUNREACH) || defined(ENETDOWN) 332 switch(errno) { 333 # ifdef ENETUNREACH 334 case ENETUNREACH: 335 # endif 336 # ifdef EHOSTDOWN 337 case EHOSTDOWN: 338 # endif 339 # ifdef EHOSTUNREACH 340 case EHOSTUNREACH: 341 # endif 342 # ifdef ENETDOWN 343 case ENETDOWN: 344 # endif 345 case EPERM: 346 case EACCES: 347 if(verbosity < VERB_ALGO) 348 return 0; 349 break; 350 default: 351 break; 352 } 353 #endif 354 /* permission denied is gotten for every send if the 355 * network is disconnected (on some OS), squelch it */ 356 if( ((errno == EPERM) 357 # ifdef EADDRNOTAVAIL 358 /* 'Cannot assign requested address' also when disconnected */ 359 || (errno == EADDRNOTAVAIL) 360 # endif 361 ) && verbosity < VERB_ALGO) 362 return 0; 363 # ifdef EADDRINUSE 364 /* If SO_REUSEADDR is set, we could try to connect to the same server 365 * from the same source port twice. */ 366 if(errno == EADDRINUSE && verbosity < VERB_DETAIL) 367 return 0; 368 # endif 369 /* squelch errors where people deploy AAAA ::ffff:bla for 370 * authority servers, which we try for intranets. */ 371 if(errno == EINVAL && addr_is_ip4mapped( 372 (struct sockaddr_storage*)addr, addrlen) && 373 verbosity < VERB_DETAIL) 374 return 0; 375 /* SO_BROADCAST sockopt can give access to 255.255.255.255, 376 * but a dns cache does not need it. */ 377 if(errno == EACCES && addr_is_broadcast( 378 (struct sockaddr_storage*)addr, addrlen) && 379 verbosity < VERB_DETAIL) 380 return 0; 381 # ifdef ENOTCONN 382 /* For 0.0.0.0, ::0 targets it can return that socket is not connected. 383 * This can be ignored, and the address skipped. It remains 384 * possible to send there for completeness in configuration. */ 385 if(errno == ENOTCONN && addr_is_any( 386 (struct sockaddr_storage*)addr, addrlen) && 387 verbosity < VERB_DETAIL) 388 return 0; 389 # endif 390 return 1; 391 } 392 393 int tcp_connect_errno_needs_log(struct sockaddr* addr, socklen_t addrlen) 394 { 395 return udp_send_errno_needs_log(addr, addrlen); 396 } 397 398 /* send a UDP reply */ 399 int 400 comm_point_send_udp_msg(struct comm_point *c, sldns_buffer* packet, 401 struct sockaddr* addr, socklen_t addrlen, int is_connected) 402 { 403 ssize_t sent; 404 log_assert(c->fd != -1); 405 #ifdef UNBOUND_DEBUG 406 if(sldns_buffer_remaining(packet) == 0) 407 log_err("error: send empty UDP packet"); 408 #endif 409 log_assert(addr && addrlen > 0); 410 if(!is_connected) { 411 sent = sendto(c->fd, (void*)sldns_buffer_begin(packet), 412 sldns_buffer_remaining(packet), 0, 413 addr, addrlen); 414 } else { 415 sent = send(c->fd, (void*)sldns_buffer_begin(packet), 416 sldns_buffer_remaining(packet), 0); 417 } 418 if(sent == -1) { 419 /* try again and block, waiting for IO to complete, 420 * we want to send the answer, and we will wait for 421 * the ethernet interface buffer to have space. */ 422 #ifndef USE_WINSOCK 423 if(errno == EAGAIN || errno == EINTR || 424 # ifdef EWOULDBLOCK 425 errno == EWOULDBLOCK || 426 # endif 427 errno == ENOBUFS) { 428 #else 429 if(WSAGetLastError() == WSAEINPROGRESS || 430 WSAGetLastError() == WSAEINTR || 431 WSAGetLastError() == WSAENOBUFS || 432 WSAGetLastError() == WSAEWOULDBLOCK) { 433 #endif 434 int retries = 0; 435 /* if we set the fd blocking, other threads suddenly 436 * have a blocking fd that they operate on */ 437 while(sent == -1 && retries < SEND_BLOCKED_MAX_RETRY && ( 438 #ifndef USE_WINSOCK 439 errno == EAGAIN || errno == EINTR || 440 # ifdef EWOULDBLOCK 441 errno == EWOULDBLOCK || 442 # endif 443 errno == ENOBUFS 444 #else 445 WSAGetLastError() == WSAEINPROGRESS || 446 WSAGetLastError() == WSAEINTR || 447 WSAGetLastError() == WSAENOBUFS || 448 WSAGetLastError() == WSAEWOULDBLOCK 449 #endif 450 )) { 451 #if defined(HAVE_POLL) || defined(USE_WINSOCK) 452 int send_nobufs = ( 453 #ifndef USE_WINSOCK 454 errno == ENOBUFS 455 #else 456 WSAGetLastError() == WSAENOBUFS 457 #endif 458 ); 459 struct pollfd p; 460 int pret; 461 memset(&p, 0, sizeof(p)); 462 p.fd = c->fd; 463 p.events = POLLOUT 464 #ifndef USE_WINSOCK 465 | POLLERR | POLLHUP 466 #endif 467 ; 468 # ifndef USE_WINSOCK 469 pret = poll(&p, 1, SEND_BLOCKED_WAIT_TIMEOUT); 470 # else 471 pret = WSAPoll(&p, 1, 472 SEND_BLOCKED_WAIT_TIMEOUT); 473 # endif 474 if(pret == 0) { 475 /* timer expired */ 476 struct comm_base* b = c->ev->base; 477 if(b->eb->last_writewait_log+SLOW_LOG_TIME <= 478 b->eb->secs) { 479 b->eb->last_writewait_log = b->eb->secs; 480 verbose(VERB_OPS, "send udp blocked " 481 "for long, dropping packet."); 482 } 483 return 0; 484 } else if(pret < 0 && 485 #ifndef USE_WINSOCK 486 errno != EAGAIN && errno != EINTR && 487 # ifdef EWOULDBLOCK 488 errno != EWOULDBLOCK && 489 # endif 490 errno != ENOMEM && errno != ENOBUFS 491 #else 492 WSAGetLastError() != WSAEINPROGRESS && 493 WSAGetLastError() != WSAEINTR && 494 WSAGetLastError() != WSAENOBUFS && 495 WSAGetLastError() != WSAEWOULDBLOCK 496 #endif 497 ) { 498 log_err("poll udp out failed: %s", 499 sock_strerror(errno)); 500 return 0; 501 } else if((pret < 0 && 502 #ifndef USE_WINSOCK 503 ( errno == ENOBUFS /* Maybe some systems */ 504 || errno == ENOMEM /* Linux */ 505 || errno == EAGAIN) /* Macos, solaris, openbsd */ 506 #else 507 WSAGetLastError() == WSAENOBUFS 508 #endif 509 ) || (send_nobufs && retries > 0)) { 510 /* ENOBUFS/ENOMEM/EAGAIN, and poll 511 * returned without 512 * a timeout. Or the retried send call 513 * returned ENOBUFS/ENOMEM/EAGAIN. 514 * It is good to wait a bit for the 515 * error to clear. */ 516 /* The timeout is 20*(2^(retries+1)), 517 * it increases exponentially, starting 518 * at 40 msec. After 5 tries, 1240 msec 519 * have passed in total, when poll 520 * returned the error, and 1200 msec 521 * when send returned the errors. */ 522 #ifndef USE_WINSOCK 523 pret = poll(NULL, 0, (SEND_BLOCKED_WAIT_TIMEOUT/10)<<(retries+1)); 524 #else 525 Sleep((SEND_BLOCKED_WAIT_TIMEOUT/10)<<(retries+1)); 526 pret = 0; 527 #endif 528 if(pret < 0 529 #ifndef USE_WINSOCK 530 && errno != EAGAIN && errno != EINTR && 531 # ifdef EWOULDBLOCK 532 errno != EWOULDBLOCK && 533 # endif 534 errno != ENOMEM && errno != ENOBUFS 535 #else 536 /* Sleep does not error */ 537 #endif 538 ) { 539 log_err("poll udp out timer failed: %s", 540 sock_strerror(errno)); 541 } 542 } 543 #endif /* defined(HAVE_POLL) || defined(USE_WINSOCK) */ 544 retries++; 545 if (!is_connected) { 546 sent = sendto(c->fd, (void*)sldns_buffer_begin(packet), 547 sldns_buffer_remaining(packet), 0, 548 addr, addrlen); 549 } else { 550 sent = send(c->fd, (void*)sldns_buffer_begin(packet), 551 sldns_buffer_remaining(packet), 0); 552 } 553 } 554 } 555 } 556 if(sent == -1) { 557 if(!udp_send_errno_needs_log(addr, addrlen)) 558 return 0; 559 if (!is_connected) { 560 verbose(VERB_OPS, "sendto failed: %s", sock_strerror(errno)); 561 } else { 562 verbose(VERB_OPS, "send failed: %s", sock_strerror(errno)); 563 } 564 if(addr) 565 log_addr(VERB_OPS, "remote address is", 566 (struct sockaddr_storage*)addr, addrlen); 567 return 0; 568 } else if((size_t)sent != sldns_buffer_remaining(packet)) { 569 log_err("sent %d in place of %d bytes", 570 (int)sent, (int)sldns_buffer_remaining(packet)); 571 return 0; 572 } 573 return 1; 574 } 575 576 #if defined(AF_INET6) && defined(IPV6_PKTINFO) && (defined(HAVE_RECVMSG) || defined(HAVE_SENDMSG)) 577 /** print debug ancillary info */ 578 static void p_ancil(const char* str, struct comm_reply* r) 579 { 580 if(r->srctype != 4 && r->srctype != 6) { 581 log_info("%s: unknown srctype %d", str, r->srctype); 582 return; 583 } 584 585 if(r->srctype == 6) { 586 #ifdef IPV6_PKTINFO 587 char buf[1024]; 588 if(inet_ntop(AF_INET6, &r->pktinfo.v6info.ipi6_addr, 589 buf, (socklen_t)sizeof(buf)) == 0) { 590 (void)strlcpy(buf, "(inet_ntop error)", sizeof(buf)); 591 } 592 buf[sizeof(buf)-1]=0; 593 log_info("%s: %s %d", str, buf, r->pktinfo.v6info.ipi6_ifindex); 594 #endif 595 } else if(r->srctype == 4) { 596 #ifdef IP_PKTINFO 597 char buf1[1024], buf2[1024]; 598 if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_addr, 599 buf1, (socklen_t)sizeof(buf1)) == 0) { 600 (void)strlcpy(buf1, "(inet_ntop error)", sizeof(buf1)); 601 } 602 buf1[sizeof(buf1)-1]=0; 603 #ifdef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST 604 if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_spec_dst, 605 buf2, (socklen_t)sizeof(buf2)) == 0) { 606 (void)strlcpy(buf2, "(inet_ntop error)", sizeof(buf2)); 607 } 608 buf2[sizeof(buf2)-1]=0; 609 #else 610 buf2[0]=0; 611 #endif 612 log_info("%s: %d %s %s", str, r->pktinfo.v4info.ipi_ifindex, 613 buf1, buf2); 614 #elif defined(IP_RECVDSTADDR) 615 char buf1[1024]; 616 if(inet_ntop(AF_INET, &r->pktinfo.v4addr, 617 buf1, (socklen_t)sizeof(buf1)) == 0) { 618 (void)strlcpy(buf1, "(inet_ntop error)", sizeof(buf1)); 619 } 620 buf1[sizeof(buf1)-1]=0; 621 log_info("%s: %s", str, buf1); 622 #endif /* IP_PKTINFO or PI_RECVDSTDADDR */ 623 } 624 } 625 #endif /* AF_INET6 && IPV6_PKTINFO && HAVE_RECVMSG||HAVE_SENDMSG */ 626 627 /** send a UDP reply over specified interface*/ 628 static int 629 comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet, 630 struct sockaddr* addr, socklen_t addrlen, struct comm_reply* r) 631 { 632 #if defined(AF_INET6) && defined(IPV6_PKTINFO) && defined(HAVE_SENDMSG) 633 ssize_t sent; 634 struct msghdr msg; 635 struct iovec iov[1]; 636 union { 637 struct cmsghdr hdr; 638 char buf[256]; 639 } control; 640 #ifndef S_SPLINT_S 641 struct cmsghdr *cmsg; 642 #endif /* S_SPLINT_S */ 643 644 log_assert(c->fd != -1); 645 #ifdef UNBOUND_DEBUG 646 if(sldns_buffer_remaining(packet) == 0) 647 log_err("error: send empty UDP packet"); 648 #endif 649 log_assert(addr && addrlen > 0); 650 651 msg.msg_name = addr; 652 msg.msg_namelen = addrlen; 653 iov[0].iov_base = sldns_buffer_begin(packet); 654 iov[0].iov_len = sldns_buffer_remaining(packet); 655 msg.msg_iov = iov; 656 msg.msg_iovlen = 1; 657 msg.msg_control = control.buf; 658 #ifndef S_SPLINT_S 659 msg.msg_controllen = sizeof(control.buf); 660 #endif /* S_SPLINT_S */ 661 msg.msg_flags = 0; 662 663 #ifndef S_SPLINT_S 664 cmsg = CMSG_FIRSTHDR(&msg); 665 if(r->srctype == 4) { 666 #ifdef IP_PKTINFO 667 void* cmsg_data; 668 msg.msg_controllen = CMSG_SPACE(sizeof(struct in_pktinfo)); 669 log_assert(msg.msg_controllen <= sizeof(control.buf)); 670 cmsg->cmsg_level = IPPROTO_IP; 671 cmsg->cmsg_type = IP_PKTINFO; 672 memmove(CMSG_DATA(cmsg), &r->pktinfo.v4info, 673 sizeof(struct in_pktinfo)); 674 /* unset the ifindex to not bypass the routing tables */ 675 cmsg_data = CMSG_DATA(cmsg); 676 ((struct in_pktinfo *) cmsg_data)->ipi_ifindex = 0; 677 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo)); 678 /* zero the padding bytes inserted by the CMSG_LEN */ 679 if(sizeof(struct in_pktinfo) < cmsg->cmsg_len) 680 memset(((uint8_t*)(CMSG_DATA(cmsg))) + 681 sizeof(struct in_pktinfo), 0, cmsg->cmsg_len 682 - sizeof(struct in_pktinfo)); 683 #elif defined(IP_SENDSRCADDR) 684 msg.msg_controllen = CMSG_SPACE(sizeof(struct in_addr)); 685 log_assert(msg.msg_controllen <= sizeof(control.buf)); 686 cmsg->cmsg_level = IPPROTO_IP; 687 cmsg->cmsg_type = IP_SENDSRCADDR; 688 memmove(CMSG_DATA(cmsg), &r->pktinfo.v4addr, 689 sizeof(struct in_addr)); 690 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_addr)); 691 /* zero the padding bytes inserted by the CMSG_LEN */ 692 if(sizeof(struct in_addr) < cmsg->cmsg_len) 693 memset(((uint8_t*)(CMSG_DATA(cmsg))) + 694 sizeof(struct in_addr), 0, cmsg->cmsg_len 695 - sizeof(struct in_addr)); 696 #else 697 verbose(VERB_ALGO, "no IP_PKTINFO or IP_SENDSRCADDR"); 698 msg.msg_control = NULL; 699 #endif /* IP_PKTINFO or IP_SENDSRCADDR */ 700 } else if(r->srctype == 6) { 701 void* cmsg_data; 702 msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo)); 703 log_assert(msg.msg_controllen <= sizeof(control.buf)); 704 cmsg->cmsg_level = IPPROTO_IPV6; 705 cmsg->cmsg_type = IPV6_PKTINFO; 706 memmove(CMSG_DATA(cmsg), &r->pktinfo.v6info, 707 sizeof(struct in6_pktinfo)); 708 /* unset the ifindex to not bypass the routing tables */ 709 cmsg_data = CMSG_DATA(cmsg); 710 ((struct in6_pktinfo *) cmsg_data)->ipi6_ifindex = 0; 711 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo)); 712 /* zero the padding bytes inserted by the CMSG_LEN */ 713 if(sizeof(struct in6_pktinfo) < cmsg->cmsg_len) 714 memset(((uint8_t*)(CMSG_DATA(cmsg))) + 715 sizeof(struct in6_pktinfo), 0, cmsg->cmsg_len 716 - sizeof(struct in6_pktinfo)); 717 } else { 718 /* try to pass all 0 to use default route */ 719 msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo)); 720 log_assert(msg.msg_controllen <= sizeof(control.buf)); 721 cmsg->cmsg_level = IPPROTO_IPV6; 722 cmsg->cmsg_type = IPV6_PKTINFO; 723 memset(CMSG_DATA(cmsg), 0, sizeof(struct in6_pktinfo)); 724 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo)); 725 /* zero the padding bytes inserted by the CMSG_LEN */ 726 if(sizeof(struct in6_pktinfo) < cmsg->cmsg_len) 727 memset(((uint8_t*)(CMSG_DATA(cmsg))) + 728 sizeof(struct in6_pktinfo), 0, cmsg->cmsg_len 729 - sizeof(struct in6_pktinfo)); 730 } 731 #endif /* S_SPLINT_S */ 732 if(verbosity >= VERB_ALGO && r->srctype != 0) 733 p_ancil("send_udp over interface", r); 734 sent = sendmsg(c->fd, &msg, 0); 735 if(sent == -1) { 736 /* try again and block, waiting for IO to complete, 737 * we want to send the answer, and we will wait for 738 * the ethernet interface buffer to have space. */ 739 #ifndef USE_WINSOCK 740 if(errno == EAGAIN || errno == EINTR || 741 # ifdef EWOULDBLOCK 742 errno == EWOULDBLOCK || 743 # endif 744 errno == ENOBUFS) { 745 #else 746 if(WSAGetLastError() == WSAEINPROGRESS || 747 WSAGetLastError() == WSAEINTR || 748 WSAGetLastError() == WSAENOBUFS || 749 WSAGetLastError() == WSAEWOULDBLOCK) { 750 #endif 751 int retries = 0; 752 while(sent == -1 && retries < SEND_BLOCKED_MAX_RETRY && ( 753 #ifndef USE_WINSOCK 754 errno == EAGAIN || errno == EINTR || 755 # ifdef EWOULDBLOCK 756 errno == EWOULDBLOCK || 757 # endif 758 errno == ENOBUFS 759 #else 760 WSAGetLastError() == WSAEINPROGRESS || 761 WSAGetLastError() == WSAEINTR || 762 WSAGetLastError() == WSAENOBUFS || 763 WSAGetLastError() == WSAEWOULDBLOCK 764 #endif 765 )) { 766 #if defined(HAVE_POLL) || defined(USE_WINSOCK) 767 int send_nobufs = ( 768 #ifndef USE_WINSOCK 769 errno == ENOBUFS 770 #else 771 WSAGetLastError() == WSAENOBUFS 772 #endif 773 ); 774 struct pollfd p; 775 int pret; 776 memset(&p, 0, sizeof(p)); 777 p.fd = c->fd; 778 p.events = POLLOUT 779 #ifndef USE_WINSOCK 780 | POLLERR | POLLHUP 781 #endif 782 ; 783 # ifndef USE_WINSOCK 784 pret = poll(&p, 1, SEND_BLOCKED_WAIT_TIMEOUT); 785 # else 786 pret = WSAPoll(&p, 1, 787 SEND_BLOCKED_WAIT_TIMEOUT); 788 # endif 789 if(pret == 0) { 790 /* timer expired */ 791 struct comm_base* b = c->ev->base; 792 if(b->eb->last_writewait_log+SLOW_LOG_TIME <= 793 b->eb->secs) { 794 b->eb->last_writewait_log = b->eb->secs; 795 verbose(VERB_OPS, "send udp blocked " 796 "for long, dropping packet."); 797 } 798 return 0; 799 } else if(pret < 0 && 800 #ifndef USE_WINSOCK 801 errno != EAGAIN && errno != EINTR && 802 # ifdef EWOULDBLOCK 803 errno != EWOULDBLOCK && 804 # endif 805 errno != ENOMEM && errno != ENOBUFS 806 #else 807 WSAGetLastError() != WSAEINPROGRESS && 808 WSAGetLastError() != WSAEINTR && 809 WSAGetLastError() != WSAENOBUFS && 810 WSAGetLastError() != WSAEWOULDBLOCK 811 #endif 812 ) { 813 log_err("poll udp out failed: %s", 814 sock_strerror(errno)); 815 return 0; 816 } else if((pret < 0 && 817 #ifndef USE_WINSOCK 818 ( errno == ENOBUFS /* Maybe some systems */ 819 || errno == ENOMEM /* Linux */ 820 || errno == EAGAIN) /* Macos, solaris, openbsd */ 821 #else 822 WSAGetLastError() == WSAENOBUFS 823 #endif 824 ) || (send_nobufs && retries > 0)) { 825 /* ENOBUFS/ENOMEM/EAGAIN, and poll 826 * returned without 827 * a timeout. Or the retried send call 828 * returned ENOBUFS/ENOMEM/EAGAIN. 829 * It is good to wait a bit for the 830 * error to clear. */ 831 /* The timeout is 20*(2^(retries+1)), 832 * it increases exponentially, starting 833 * at 40 msec. After 5 tries, 1240 msec 834 * have passed in total, when poll 835 * returned the error, and 1200 msec 836 * when send returned the errors. */ 837 #ifndef USE_WINSOCK 838 pret = poll(NULL, 0, (SEND_BLOCKED_WAIT_TIMEOUT/10)<<(retries+1)); 839 #else 840 Sleep((SEND_BLOCKED_WAIT_TIMEOUT/10)<<(retries+1)); 841 pret = 0; 842 #endif 843 if(pret < 0 844 #ifndef USE_WINSOCK 845 && errno != EAGAIN && errno != EINTR && 846 # ifdef EWOULDBLOCK 847 errno != EWOULDBLOCK && 848 # endif 849 errno != ENOMEM && errno != ENOBUFS 850 #else /* USE_WINSOCK */ 851 /* Sleep does not error */ 852 #endif 853 ) { 854 log_err("poll udp out timer failed: %s", 855 sock_strerror(errno)); 856 } 857 } 858 #endif /* defined(HAVE_POLL) || defined(USE_WINSOCK) */ 859 retries++; 860 sent = sendmsg(c->fd, &msg, 0); 861 } 862 } 863 } 864 if(sent == -1) { 865 if(!udp_send_errno_needs_log(addr, addrlen)) 866 return 0; 867 verbose(VERB_OPS, "sendmsg failed: %s", strerror(errno)); 868 log_addr(VERB_OPS, "remote address is", 869 (struct sockaddr_storage*)addr, addrlen); 870 #ifdef __NetBSD__ 871 /* netbsd 7 has IP_PKTINFO for recv but not send */ 872 if(errno == EINVAL && r->srctype == 4) 873 log_err("sendmsg: No support for sendmsg(IP_PKTINFO). " 874 "Please disable interface-automatic"); 875 #endif 876 return 0; 877 } else if((size_t)sent != sldns_buffer_remaining(packet)) { 878 log_err("sent %d in place of %d bytes", 879 (int)sent, (int)sldns_buffer_remaining(packet)); 880 return 0; 881 } 882 return 1; 883 #else 884 (void)c; 885 (void)packet; 886 (void)addr; 887 (void)addrlen; 888 (void)r; 889 log_err("sendmsg: IPV6_PKTINFO not supported"); 890 return 0; 891 #endif /* AF_INET6 && IPV6_PKTINFO && HAVE_SENDMSG */ 892 } 893 894 /** return true is UDP receive error needs to be logged */ 895 static int udp_recv_needs_log(int err) 896 { 897 switch(err) { 898 case EACCES: /* some hosts send ICMP 'Permission Denied' */ 899 #ifndef USE_WINSOCK 900 case ECONNREFUSED: 901 # ifdef ENETUNREACH 902 case ENETUNREACH: 903 # endif 904 # ifdef EHOSTDOWN 905 case EHOSTDOWN: 906 # endif 907 # ifdef EHOSTUNREACH 908 case EHOSTUNREACH: 909 # endif 910 # ifdef ENETDOWN 911 case ENETDOWN: 912 # endif 913 #else /* USE_WINSOCK */ 914 case WSAECONNREFUSED: 915 case WSAENETUNREACH: 916 case WSAEHOSTDOWN: 917 case WSAEHOSTUNREACH: 918 case WSAENETDOWN: 919 #endif 920 if(verbosity >= VERB_ALGO) 921 return 1; 922 return 0; 923 default: 924 break; 925 } 926 return 1; 927 } 928 929 /** Parses the PROXYv2 header from buf and updates the comm_reply struct. 930 * Returns 1 on success, 0 on failure. */ 931 static int consume_pp2_header(struct sldns_buffer* buf, struct comm_reply* rep, 932 int stream) { 933 size_t size; 934 struct pp2_header *header; 935 int err = pp2_read_header(sldns_buffer_begin(buf), 936 sldns_buffer_remaining(buf)); 937 if(err) return 0; 938 header = (struct pp2_header*)sldns_buffer_begin(buf); 939 size = PP2_HEADER_SIZE + ntohs(header->len); 940 if((header->ver_cmd & 0xF) == PP2_CMD_LOCAL) { 941 /* A connection from the proxy itself. 942 * No need to do anything with addresses. */ 943 goto done; 944 } 945 if(header->fam_prot == PP2_UNSPEC_UNSPEC) { 946 /* Unspecified family and protocol. This could be used for 947 * health checks by proxies. 948 * No need to do anything with addresses. */ 949 goto done; 950 } 951 /* Read the proxied address */ 952 switch(header->fam_prot) { 953 case PP2_INET_STREAM: 954 case PP2_INET_DGRAM: 955 { 956 struct sockaddr_in* addr = 957 (struct sockaddr_in*)&rep->client_addr; 958 if(ntohs(header->len) < PP2_HEADER_LEN_INET) { 959 verbose(VERB_OPS, "proxy_protocol: header too short for IPv4 address"); 960 return 0; 961 } 962 addr->sin_family = AF_INET; 963 addr->sin_addr.s_addr = header->addr.addr4.src_addr; 964 addr->sin_port = header->addr.addr4.src_port; 965 rep->client_addrlen = (socklen_t)sizeof(struct sockaddr_in); 966 } 967 /* Ignore the destination address; it should be us. */ 968 break; 969 case PP2_INET6_STREAM: 970 case PP2_INET6_DGRAM: 971 { 972 struct sockaddr_in6* addr = 973 (struct sockaddr_in6*)&rep->client_addr; 974 if(ntohs(header->len) < PP2_HEADER_LEN_INET6) { 975 verbose(VERB_OPS, "proxy_protocol: header too short for IPv6 address"); 976 return 0; 977 } 978 memset(addr, 0, sizeof(*addr)); 979 addr->sin6_family = AF_INET6; 980 memcpy(&addr->sin6_addr, 981 header->addr.addr6.src_addr, 16); 982 addr->sin6_port = header->addr.addr6.src_port; 983 rep->client_addrlen = (socklen_t)sizeof(struct sockaddr_in6); 984 } 985 /* Ignore the destination address; it should be us. */ 986 break; 987 default: 988 log_err("proxy_protocol: unsupported family and " 989 "protocol 0x%x", (int)header->fam_prot); 990 return 0; 991 } 992 rep->is_proxied = 1; 993 done: 994 if(!stream) { 995 /* We are reading a whole packet; 996 * Move the rest of the data to overwrite the PROXYv2 header */ 997 /* XXX can we do better to avoid memmove? */ 998 memmove(header, ((char*)header)+size, 999 sldns_buffer_limit(buf)-size); 1000 sldns_buffer_set_limit(buf, sldns_buffer_limit(buf)-size); 1001 } 1002 return 1; 1003 } 1004 1005 #if defined(AF_INET6) && defined(IPV6_PKTINFO) && defined(HAVE_RECVMSG) 1006 void 1007 comm_point_udp_ancil_callback(int fd, short event, void* arg) 1008 { 1009 struct comm_reply rep; 1010 struct msghdr msg; 1011 struct iovec iov[1]; 1012 ssize_t rcv; 1013 union { 1014 struct cmsghdr hdr; 1015 char buf[256]; 1016 } ancil; 1017 int i; 1018 #ifndef S_SPLINT_S 1019 struct cmsghdr* cmsg; 1020 #endif /* S_SPLINT_S */ 1021 #ifdef HAVE_LINUX_NET_TSTAMP_H 1022 struct timespec *ts; 1023 #endif /* HAVE_LINUX_NET_TSTAMP_H */ 1024 1025 rep.c = (struct comm_point*)arg; 1026 log_assert(rep.c->type == comm_udp); 1027 1028 if(!(event&UB_EV_READ)) 1029 return; 1030 log_assert(rep.c && rep.c->buffer && rep.c->fd == fd); 1031 ub_comm_base_now(rep.c->ev->base); 1032 for(i=0; i<NUM_UDP_PER_SELECT; i++) { 1033 sldns_buffer_clear(rep.c->buffer); 1034 timeval_clear(&rep.c->recv_tv); 1035 rep.remote_addrlen = (socklen_t)sizeof(rep.remote_addr); 1036 log_assert(fd != -1); 1037 log_assert(sldns_buffer_remaining(rep.c->buffer) > 0); 1038 msg.msg_name = &rep.remote_addr; 1039 msg.msg_namelen = (socklen_t)sizeof(rep.remote_addr); 1040 iov[0].iov_base = sldns_buffer_begin(rep.c->buffer); 1041 iov[0].iov_len = sldns_buffer_remaining(rep.c->buffer); 1042 msg.msg_iov = iov; 1043 msg.msg_iovlen = 1; 1044 msg.msg_control = ancil.buf; 1045 #ifndef S_SPLINT_S 1046 msg.msg_controllen = sizeof(ancil.buf); 1047 #endif /* S_SPLINT_S */ 1048 msg.msg_flags = 0; 1049 rcv = recvmsg(fd, &msg, MSG_DONTWAIT); 1050 if(rcv == -1) { 1051 if(errno != EAGAIN && errno != EINTR 1052 && udp_recv_needs_log(errno)) { 1053 log_err("recvmsg failed: %s", strerror(errno)); 1054 } 1055 return; 1056 } 1057 rep.remote_addrlen = msg.msg_namelen; 1058 sldns_buffer_skip(rep.c->buffer, rcv); 1059 sldns_buffer_flip(rep.c->buffer); 1060 rep.srctype = 0; 1061 rep.is_proxied = 0; 1062 #ifndef S_SPLINT_S 1063 for(cmsg = CMSG_FIRSTHDR(&msg); cmsg != NULL; 1064 cmsg = CMSG_NXTHDR(&msg, cmsg)) { 1065 if( cmsg->cmsg_level == IPPROTO_IPV6 && 1066 cmsg->cmsg_type == IPV6_PKTINFO) { 1067 rep.srctype = 6; 1068 memmove(&rep.pktinfo.v6info, CMSG_DATA(cmsg), 1069 sizeof(struct in6_pktinfo)); 1070 break; 1071 #ifdef IP_PKTINFO 1072 } else if( cmsg->cmsg_level == IPPROTO_IP && 1073 cmsg->cmsg_type == IP_PKTINFO) { 1074 rep.srctype = 4; 1075 memmove(&rep.pktinfo.v4info, CMSG_DATA(cmsg), 1076 sizeof(struct in_pktinfo)); 1077 break; 1078 #elif defined(IP_RECVDSTADDR) 1079 } else if( cmsg->cmsg_level == IPPROTO_IP && 1080 cmsg->cmsg_type == IP_RECVDSTADDR) { 1081 rep.srctype = 4; 1082 memmove(&rep.pktinfo.v4addr, CMSG_DATA(cmsg), 1083 sizeof(struct in_addr)); 1084 break; 1085 #endif /* IP_PKTINFO or IP_RECVDSTADDR */ 1086 #ifdef HAVE_LINUX_NET_TSTAMP_H 1087 } else if( cmsg->cmsg_level == SOL_SOCKET && 1088 cmsg->cmsg_type == SO_TIMESTAMPNS) { 1089 ts = (struct timespec *)CMSG_DATA(cmsg); 1090 TIMESPEC_TO_TIMEVAL(&rep.c->recv_tv, ts); 1091 } else if( cmsg->cmsg_level == SOL_SOCKET && 1092 cmsg->cmsg_type == SO_TIMESTAMPING) { 1093 ts = (struct timespec *)CMSG_DATA(cmsg); 1094 TIMESPEC_TO_TIMEVAL(&rep.c->recv_tv, ts); 1095 } else if( cmsg->cmsg_level == SOL_SOCKET && 1096 cmsg->cmsg_type == SO_TIMESTAMP) { 1097 memmove(&rep.c->recv_tv, CMSG_DATA(cmsg), sizeof(struct timeval)); 1098 #elif defined(SO_TIMESTAMP) && defined(SCM_TIMESTAMP) 1099 } else if( cmsg->cmsg_level == SOL_SOCKET && 1100 cmsg->cmsg_type == SCM_TIMESTAMP) { 1101 /* FreeBSD and also Linux. */ 1102 memmove(&rep.c->recv_tv, CMSG_DATA(cmsg), sizeof(struct timeval)); 1103 #endif /* HAVE_LINUX_NET_TSTAMP_H */ 1104 } 1105 } 1106 1107 if(verbosity >= VERB_ALGO && rep.srctype != 0) 1108 p_ancil("receive_udp on interface", &rep); 1109 #endif /* S_SPLINT_S */ 1110 1111 if(rep.c->pp2_enabled && !consume_pp2_header(rep.c->buffer, 1112 &rep, 0)) { 1113 log_err("proxy_protocol: could not consume PROXYv2 header"); 1114 return; 1115 } 1116 if(!rep.is_proxied) { 1117 rep.client_addrlen = rep.remote_addrlen; 1118 memmove(&rep.client_addr, &rep.remote_addr, 1119 rep.remote_addrlen); 1120 } 1121 1122 fptr_ok(fptr_whitelist_comm_point(rep.c->callback)); 1123 if((*rep.c->callback)(rep.c, rep.c->cb_arg, NETEVENT_NOERROR, &rep)) { 1124 /* send back immediate reply */ 1125 struct sldns_buffer *buffer; 1126 #ifdef USE_DNSCRYPT 1127 buffer = rep.c->dnscrypt_buffer; 1128 #else 1129 buffer = rep.c->buffer; 1130 #endif 1131 (void)comm_point_send_udp_msg_if(rep.c, buffer, 1132 (struct sockaddr*)&rep.remote_addr, 1133 rep.remote_addrlen, &rep); 1134 } 1135 if(!rep.c || rep.c->fd == -1) /* commpoint closed */ 1136 break; 1137 } 1138 } 1139 #endif /* AF_INET6 && IPV6_PKTINFO && HAVE_RECVMSG */ 1140 1141 void 1142 comm_point_udp_callback(int fd, short event, void* arg) 1143 { 1144 struct comm_reply rep; 1145 ssize_t rcv; 1146 int i; 1147 struct sldns_buffer *buffer; 1148 1149 rep.c = (struct comm_point*)arg; 1150 log_assert(rep.c->type == comm_udp); 1151 1152 if(!(event&UB_EV_READ)) 1153 return; 1154 log_assert(rep.c && rep.c->buffer && rep.c->fd == fd); 1155 ub_comm_base_now(rep.c->ev->base); 1156 for(i=0; i<NUM_UDP_PER_SELECT; i++) { 1157 sldns_buffer_clear(rep.c->buffer); 1158 rep.remote_addrlen = (socklen_t)sizeof(rep.remote_addr); 1159 log_assert(fd != -1); 1160 log_assert(sldns_buffer_remaining(rep.c->buffer) > 0); 1161 rcv = recvfrom(fd, (void*)sldns_buffer_begin(rep.c->buffer), 1162 sldns_buffer_remaining(rep.c->buffer), MSG_DONTWAIT, 1163 (struct sockaddr*)&rep.remote_addr, &rep.remote_addrlen); 1164 if(rcv == -1) { 1165 #ifndef USE_WINSOCK 1166 if(errno != EAGAIN && errno != EINTR 1167 && udp_recv_needs_log(errno)) 1168 log_err("recvfrom %d failed: %s", 1169 fd, strerror(errno)); 1170 #else 1171 if(WSAGetLastError() != WSAEINPROGRESS && 1172 WSAGetLastError() != WSAECONNRESET && 1173 WSAGetLastError()!= WSAEWOULDBLOCK && 1174 udp_recv_needs_log(WSAGetLastError())) 1175 log_err("recvfrom failed: %s", 1176 wsa_strerror(WSAGetLastError())); 1177 #endif 1178 return; 1179 } 1180 sldns_buffer_skip(rep.c->buffer, rcv); 1181 sldns_buffer_flip(rep.c->buffer); 1182 rep.srctype = 0; 1183 rep.is_proxied = 0; 1184 1185 if(rep.c->pp2_enabled && !consume_pp2_header(rep.c->buffer, 1186 &rep, 0)) { 1187 log_err("proxy_protocol: could not consume PROXYv2 header"); 1188 return; 1189 } 1190 if(!rep.is_proxied) { 1191 rep.client_addrlen = rep.remote_addrlen; 1192 memmove(&rep.client_addr, &rep.remote_addr, 1193 rep.remote_addrlen); 1194 } 1195 1196 fptr_ok(fptr_whitelist_comm_point(rep.c->callback)); 1197 if((*rep.c->callback)(rep.c, rep.c->cb_arg, NETEVENT_NOERROR, &rep)) { 1198 /* send back immediate reply */ 1199 #ifdef USE_DNSCRYPT 1200 buffer = rep.c->dnscrypt_buffer; 1201 #else 1202 buffer = rep.c->buffer; 1203 #endif 1204 (void)comm_point_send_udp_msg(rep.c, buffer, 1205 (struct sockaddr*)&rep.remote_addr, 1206 rep.remote_addrlen, 0); 1207 } 1208 if(!rep.c || rep.c->fd != fd) /* commpoint closed to -1 or reused for 1209 another UDP port. Note rep.c cannot be reused with TCP fd. */ 1210 break; 1211 } 1212 } 1213 1214 #ifdef HAVE_NGTCP2 1215 void 1216 doq_pkt_addr_init(struct doq_pkt_addr* paddr) 1217 { 1218 paddr->addrlen = (socklen_t)sizeof(paddr->addr); 1219 paddr->localaddrlen = (socklen_t)sizeof(paddr->localaddr); 1220 paddr->ifindex = 0; 1221 } 1222 1223 /** set the ecn on the transmission */ 1224 static void 1225 doq_set_ecn(int fd, int family, uint32_t ecn) 1226 { 1227 unsigned int val = ecn; 1228 if(family == AF_INET6) { 1229 if(setsockopt(fd, IPPROTO_IPV6, IPV6_TCLASS, &val, 1230 (socklen_t)sizeof(val)) == -1) { 1231 log_err("setsockopt(.. IPV6_TCLASS ..): %s", 1232 strerror(errno)); 1233 } 1234 return; 1235 } 1236 if(setsockopt(fd, IPPROTO_IP, IP_TOS, &val, 1237 (socklen_t)sizeof(val)) == -1) { 1238 log_err("setsockopt(.. IP_TOS ..): %s", 1239 strerror(errno)); 1240 } 1241 } 1242 1243 /** set the local address in the control ancillary data */ 1244 static void 1245 doq_set_localaddr_cmsg(struct msghdr* msg, size_t control_size, 1246 struct doq_addr_storage* localaddr, socklen_t localaddrlen, 1247 int ifindex) 1248 { 1249 #ifndef S_SPLINT_S 1250 struct cmsghdr* cmsg; 1251 #endif /* S_SPLINT_S */ 1252 #ifndef S_SPLINT_S 1253 cmsg = CMSG_FIRSTHDR(msg); 1254 if(localaddr->sockaddr.in.sin_family == AF_INET) { 1255 #ifdef IP_PKTINFO 1256 struct sockaddr_in* sa = (struct sockaddr_in*)localaddr; 1257 struct in_pktinfo v4info; 1258 log_assert(localaddrlen >= sizeof(struct sockaddr_in)); 1259 msg->msg_controllen = CMSG_SPACE(sizeof(struct in_pktinfo)); 1260 memset(msg->msg_control, 0, msg->msg_controllen); 1261 log_assert(msg->msg_controllen <= control_size); 1262 cmsg->cmsg_level = IPPROTO_IP; 1263 cmsg->cmsg_type = IP_PKTINFO; 1264 memset(&v4info, 0, sizeof(v4info)); 1265 # ifdef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST 1266 memmove(&v4info.ipi_spec_dst, &sa->sin_addr, 1267 sizeof(struct in_addr)); 1268 # else 1269 memmove(&v4info.ipi_addr, &sa->sin_addr, 1270 sizeof(struct in_addr)); 1271 # endif 1272 v4info.ipi_ifindex = ifindex; 1273 memmove(CMSG_DATA(cmsg), &v4info, sizeof(struct in_pktinfo)); 1274 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo)); 1275 #elif defined(IP_SENDSRCADDR) 1276 struct sockaddr_in* sa= (struct sockaddr_in*)localaddr; 1277 log_assert(localaddrlen >= sizeof(struct sockaddr_in)); 1278 msg->msg_controllen = CMSG_SPACE(sizeof(struct in_addr)); 1279 memset(msg->msg_control, 0, msg->msg_controllen); 1280 log_assert(msg->msg_controllen <= control_size); 1281 cmsg->cmsg_level = IPPROTO_IP; 1282 cmsg->cmsg_type = IP_SENDSRCADDR; 1283 memmove(CMSG_DATA(cmsg), &sa->sin_addr, 1284 sizeof(struct in_addr)); 1285 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_addr)); 1286 #endif 1287 } else { 1288 struct sockaddr_in6* sa6 = (struct sockaddr_in6*)localaddr; 1289 struct in6_pktinfo v6info; 1290 log_assert(localaddrlen >= sizeof(struct sockaddr_in6)); 1291 msg->msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo)); 1292 memset(msg->msg_control, 0, msg->msg_controllen); 1293 log_assert(msg->msg_controllen <= control_size); 1294 cmsg->cmsg_level = IPPROTO_IPV6; 1295 cmsg->cmsg_type = IPV6_PKTINFO; 1296 memset(&v6info, 0, sizeof(v6info)); 1297 memmove(&v6info.ipi6_addr, &sa6->sin6_addr, 1298 sizeof(struct in6_addr)); 1299 v6info.ipi6_ifindex = ifindex; 1300 memmove(CMSG_DATA(cmsg), &v6info, sizeof(struct in6_pktinfo)); 1301 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo)); 1302 } 1303 #endif /* S_SPLINT_S */ 1304 /* Ignore unused variables, if no assertions are compiled. */ 1305 (void)localaddrlen; 1306 (void)control_size; 1307 } 1308 1309 /** write address and port into strings */ 1310 static int 1311 doq_print_addr_port(struct doq_addr_storage* addr, socklen_t addrlen, 1312 char* host, size_t hostlen, char* port, size_t portlen) 1313 { 1314 if(addr->sockaddr.in.sin_family == AF_INET) { 1315 struct sockaddr_in* sa = (struct sockaddr_in*)addr; 1316 log_assert(addrlen >= sizeof(*sa)); 1317 if(inet_ntop(sa->sin_family, &sa->sin_addr, host, 1318 (socklen_t)hostlen) == 0) { 1319 log_hex("inet_ntop error: address", &sa->sin_addr, 1320 sizeof(sa->sin_addr)); 1321 return 0; 1322 } 1323 snprintf(port, portlen, "%u", (unsigned)ntohs(sa->sin_port)); 1324 } else if(addr->sockaddr.in.sin_family == AF_INET6) { 1325 struct sockaddr_in6* sa6 = (struct sockaddr_in6*)addr; 1326 log_assert(addrlen >= sizeof(*sa6)); 1327 if(inet_ntop(sa6->sin6_family, &sa6->sin6_addr, host, 1328 (socklen_t)hostlen) == 0) { 1329 log_hex("inet_ntop error: address", &sa6->sin6_addr, 1330 sizeof(sa6->sin6_addr)); 1331 return 0; 1332 } 1333 snprintf(port, portlen, "%u", (unsigned)ntohs(sa6->sin6_port)); 1334 } 1335 return 1; 1336 } 1337 1338 /** doq store the blocked packet when write has blocked */ 1339 static void 1340 doq_store_blocked_pkt(struct comm_point* c, struct doq_pkt_addr* paddr, 1341 uint32_t ecn) 1342 { 1343 if(c->doq_socket->have_blocked_pkt) 1344 return; /* should not happen that we write when there is 1345 already a blocked write, but if so, drop it. */ 1346 if(sldns_buffer_limit(c->doq_socket->pkt_buf) > 1347 sldns_buffer_capacity(c->doq_socket->blocked_pkt)) 1348 return; /* impossibly large, drop packet. impossible because 1349 pkt_buf and blocked_pkt are the same size. */ 1350 c->doq_socket->have_blocked_pkt = 1; 1351 c->doq_socket->blocked_pkt_pi.ecn = ecn; 1352 memcpy(c->doq_socket->blocked_paddr, paddr, 1353 sizeof(*c->doq_socket->blocked_paddr)); 1354 sldns_buffer_clear(c->doq_socket->blocked_pkt); 1355 sldns_buffer_write(c->doq_socket->blocked_pkt, 1356 sldns_buffer_begin(c->doq_socket->pkt_buf), 1357 sldns_buffer_limit(c->doq_socket->pkt_buf)); 1358 sldns_buffer_flip(c->doq_socket->blocked_pkt); 1359 } 1360 1361 void 1362 doq_send_pkt(struct comm_point* c, struct doq_pkt_addr* paddr, uint32_t ecn) 1363 { 1364 struct msghdr msg; 1365 struct iovec iov[1]; 1366 union { 1367 struct cmsghdr hdr; 1368 char buf[256]; 1369 } control; 1370 ssize_t ret; 1371 iov[0].iov_base = sldns_buffer_begin(c->doq_socket->pkt_buf); 1372 iov[0].iov_len = sldns_buffer_limit(c->doq_socket->pkt_buf); 1373 memset(&msg, 0, sizeof(msg)); 1374 msg.msg_name = (void*)&paddr->addr; 1375 msg.msg_namelen = paddr->addrlen; 1376 msg.msg_iov = iov; 1377 msg.msg_iovlen = 1; 1378 msg.msg_control = control.buf; 1379 #ifndef S_SPLINT_S 1380 msg.msg_controllen = sizeof(control.buf); 1381 #endif /* S_SPLINT_S */ 1382 msg.msg_flags = 0; 1383 1384 doq_set_localaddr_cmsg(&msg, sizeof(control.buf), &paddr->localaddr, 1385 paddr->localaddrlen, paddr->ifindex); 1386 doq_set_ecn(c->fd, paddr->addr.sockaddr.in.sin_family, ecn); 1387 1388 for(;;) { 1389 ret = sendmsg(c->fd, &msg, MSG_DONTWAIT); 1390 if(ret == -1 && errno == EINTR) 1391 continue; 1392 break; 1393 } 1394 if(ret == -1) { 1395 #ifndef USE_WINSOCK 1396 if(errno == EAGAIN || 1397 # ifdef EWOULDBLOCK 1398 errno == EWOULDBLOCK || 1399 # endif 1400 errno == ENOBUFS) 1401 #else 1402 if(WSAGetLastError() == WSAEINPROGRESS || 1403 WSAGetLastError() == WSAENOBUFS || 1404 WSAGetLastError() == WSAEWOULDBLOCK) 1405 #endif 1406 { 1407 /* udp send has blocked */ 1408 doq_store_blocked_pkt(c, paddr, ecn); 1409 return; 1410 } 1411 if(!udp_send_errno_needs_log((void*)&paddr->addr, 1412 paddr->addrlen)) 1413 return; 1414 if(verbosity >= VERB_OPS) { 1415 char host[256], port[32]; 1416 if(doq_print_addr_port(&paddr->addr, paddr->addrlen, 1417 host, sizeof(host), port, sizeof(port))) { 1418 verbose(VERB_OPS, "doq sendmsg to %s %s " 1419 "failed: %s", host, port, 1420 strerror(errno)); 1421 } else { 1422 verbose(VERB_OPS, "doq sendmsg failed: %s", 1423 strerror(errno)); 1424 } 1425 } 1426 return; 1427 } else if(ret != (ssize_t)sldns_buffer_limit(c->doq_socket->pkt_buf)) { 1428 char host[256], port[32]; 1429 if(doq_print_addr_port(&paddr->addr, paddr->addrlen, host, 1430 sizeof(host), port, sizeof(port))) { 1431 log_err("doq sendmsg to %s %s failed: " 1432 "sent %d in place of %d bytes", 1433 host, port, (int)ret, 1434 (int)sldns_buffer_limit(c->doq_socket->pkt_buf)); 1435 } else { 1436 log_err("doq sendmsg failed: " 1437 "sent %d in place of %d bytes", 1438 (int)ret, (int)sldns_buffer_limit(c->doq_socket->pkt_buf)); 1439 } 1440 return; 1441 } 1442 } 1443 1444 /** fetch port number */ 1445 static int 1446 doq_sockaddr_get_port(struct doq_addr_storage* addr) 1447 { 1448 if(addr->sockaddr.in.sin_family == AF_INET) { 1449 struct sockaddr_in* sa = (struct sockaddr_in*)addr; 1450 return ntohs(sa->sin_port); 1451 } else if(addr->sockaddr.in.sin_family == AF_INET6) { 1452 struct sockaddr_in6* sa6 = (struct sockaddr_in6*)addr; 1453 return ntohs(sa6->sin6_port); 1454 } 1455 return 0; 1456 } 1457 1458 /** get local address from ancillary data headers */ 1459 static int 1460 doq_get_localaddr_cmsg(struct comm_point* c, struct doq_pkt_addr* paddr, 1461 int* pkt_continue, struct msghdr* msg) 1462 { 1463 #ifndef S_SPLINT_S 1464 struct cmsghdr* cmsg; 1465 #endif /* S_SPLINT_S */ 1466 1467 memset(&paddr->localaddr, 0, sizeof(paddr->localaddr)); 1468 #ifndef S_SPLINT_S 1469 for(cmsg = CMSG_FIRSTHDR(msg); cmsg != NULL; 1470 cmsg = CMSG_NXTHDR(msg, cmsg)) { 1471 if( cmsg->cmsg_level == IPPROTO_IPV6 && 1472 cmsg->cmsg_type == IPV6_PKTINFO) { 1473 struct in6_pktinfo* v6info = 1474 (struct in6_pktinfo*)CMSG_DATA(cmsg); 1475 struct sockaddr_in6* sa= (struct sockaddr_in6*) 1476 &paddr->localaddr; 1477 struct sockaddr_in6* rema = (struct sockaddr_in6*) 1478 &paddr->addr; 1479 if(rema->sin6_family != AF_INET6) { 1480 log_err("doq cmsg family mismatch cmsg is ip6"); 1481 *pkt_continue = 1; 1482 return 0; 1483 } 1484 sa->sin6_family = AF_INET6; 1485 sa->sin6_port = htons(doq_sockaddr_get_port( 1486 (void*)c->socket->addr)); 1487 paddr->ifindex = v6info->ipi6_ifindex; 1488 memmove(&sa->sin6_addr, &v6info->ipi6_addr, 1489 sizeof(struct in6_addr)); 1490 paddr->localaddrlen = sizeof(struct sockaddr_in6); 1491 break; 1492 #ifdef IP_PKTINFO 1493 } else if( cmsg->cmsg_level == IPPROTO_IP && 1494 cmsg->cmsg_type == IP_PKTINFO) { 1495 struct in_pktinfo* v4info = 1496 (struct in_pktinfo*)CMSG_DATA(cmsg); 1497 struct sockaddr_in* sa= (struct sockaddr_in*) 1498 &paddr->localaddr; 1499 struct sockaddr_in* rema = (struct sockaddr_in*) 1500 &paddr->addr; 1501 if(rema->sin_family != AF_INET) { 1502 log_err("doq cmsg family mismatch cmsg is ip4"); 1503 *pkt_continue = 1; 1504 return 0; 1505 } 1506 sa->sin_family = AF_INET; 1507 sa->sin_port = htons(doq_sockaddr_get_port( 1508 (void*)c->socket->addr)); 1509 paddr->ifindex = v4info->ipi_ifindex; 1510 memmove(&sa->sin_addr, &v4info->ipi_addr, 1511 sizeof(struct in_addr)); 1512 paddr->localaddrlen = sizeof(struct sockaddr_in); 1513 break; 1514 #elif defined(IP_RECVDSTADDR) 1515 } else if( cmsg->cmsg_level == IPPROTO_IP && 1516 cmsg->cmsg_type == IP_RECVDSTADDR) { 1517 struct sockaddr_in* sa= (struct sockaddr_in*) 1518 &paddr->localaddr; 1519 struct sockaddr_in* rema = (struct sockaddr_in*) 1520 &paddr->addr; 1521 if(rema->sin_family != AF_INET) { 1522 log_err("doq cmsg family mismatch cmsg is ip4"); 1523 *pkt_continue = 1; 1524 return 0; 1525 } 1526 sa->sin_family = AF_INET; 1527 sa->sin_port = htons(doq_sockaddr_get_port( 1528 (void*)c->socket->addr)); 1529 paddr->ifindex = 0; 1530 memmove(&sa.sin_addr, CMSG_DATA(cmsg), 1531 sizeof(struct in_addr)); 1532 paddr->localaddrlen = sizeof(struct sockaddr_in); 1533 break; 1534 #endif /* IP_PKTINFO or IP_RECVDSTADDR */ 1535 } 1536 } 1537 #endif /* S_SPLINT_S */ 1538 1539 return 1; 1540 } 1541 1542 /** get packet ecn information */ 1543 static uint32_t 1544 msghdr_get_ecn(struct msghdr* msg, int family) 1545 { 1546 #ifndef S_SPLINT_S 1547 struct cmsghdr* cmsg; 1548 if(family == AF_INET6) { 1549 for(cmsg = CMSG_FIRSTHDR(msg); cmsg != NULL; 1550 cmsg = CMSG_NXTHDR(msg, cmsg)) { 1551 if(cmsg->cmsg_level == IPPROTO_IPV6 && 1552 cmsg->cmsg_type == IPV6_TCLASS && 1553 cmsg->cmsg_len != 0) { 1554 uint8_t* ecn = (uint8_t*)CMSG_DATA(cmsg); 1555 return *ecn; 1556 } 1557 } 1558 return 0; 1559 } 1560 for(cmsg = CMSG_FIRSTHDR(msg); cmsg != NULL; 1561 cmsg = CMSG_NXTHDR(msg, cmsg)) { 1562 if(cmsg->cmsg_level == IPPROTO_IP && 1563 cmsg->cmsg_type == IP_TOS && 1564 cmsg->cmsg_len != 0) { 1565 uint8_t* ecn = (uint8_t*)CMSG_DATA(cmsg); 1566 return *ecn; 1567 } 1568 } 1569 #endif /* S_SPLINT_S */ 1570 return 0; 1571 } 1572 1573 /** receive packet for DoQ on UDP. get ancillary data for addresses, 1574 * return false if failed and the callback can stop receiving UDP packets 1575 * if pkt_continue is false. */ 1576 static int 1577 doq_recv(struct comm_point* c, struct doq_pkt_addr* paddr, int* pkt_continue, 1578 struct ngtcp2_pkt_info* pi) 1579 { 1580 struct msghdr msg; 1581 struct iovec iov[1]; 1582 ssize_t rcv; 1583 union { 1584 struct cmsghdr hdr; 1585 char buf[256]; 1586 } ancil; 1587 1588 msg.msg_name = &paddr->addr; 1589 msg.msg_namelen = (socklen_t)sizeof(paddr->addr); 1590 iov[0].iov_base = sldns_buffer_begin(c->doq_socket->pkt_buf); 1591 iov[0].iov_len = sldns_buffer_remaining(c->doq_socket->pkt_buf); 1592 msg.msg_iov = iov; 1593 msg.msg_iovlen = 1; 1594 msg.msg_control = ancil.buf; 1595 #ifndef S_SPLINT_S 1596 msg.msg_controllen = sizeof(ancil.buf); 1597 #endif /* S_SPLINT_S */ 1598 msg.msg_flags = 0; 1599 1600 rcv = recvmsg(c->fd, &msg, MSG_DONTWAIT); 1601 if(rcv == -1) { 1602 if(errno != EAGAIN && errno != EINTR 1603 && udp_recv_needs_log(errno)) { 1604 log_err("recvmsg failed for doq: %s", strerror(errno)); 1605 } 1606 *pkt_continue = 0; 1607 return 0; 1608 } 1609 1610 paddr->addrlen = msg.msg_namelen; 1611 sldns_buffer_skip(c->doq_socket->pkt_buf, rcv); 1612 sldns_buffer_flip(c->doq_socket->pkt_buf); 1613 if(!doq_get_localaddr_cmsg(c, paddr, pkt_continue, &msg)) 1614 return 0; 1615 pi->ecn = msghdr_get_ecn(&msg, paddr->addr.sockaddr.in.sin_family); 1616 return 1; 1617 } 1618 1619 /** send the version negotiation for doq. scid and dcid are flipped around 1620 * to send back to the client. */ 1621 static void 1622 doq_send_version_negotiation(struct comm_point* c, struct doq_pkt_addr* paddr, 1623 const uint8_t* dcid, size_t dcidlen, const uint8_t* scid, 1624 size_t scidlen) 1625 { 1626 uint32_t versions[2]; 1627 size_t versions_len = 0; 1628 ngtcp2_ssize ret; 1629 uint8_t unused_random; 1630 1631 /* fill the array with supported versions */ 1632 versions[0] = NGTCP2_PROTO_VER_V1; 1633 versions_len = 1; 1634 unused_random = ub_random_max(c->doq_socket->rnd, 256); 1635 sldns_buffer_clear(c->doq_socket->pkt_buf); 1636 ret = ngtcp2_pkt_write_version_negotiation( 1637 sldns_buffer_begin(c->doq_socket->pkt_buf), 1638 sldns_buffer_capacity(c->doq_socket->pkt_buf), unused_random, 1639 dcid, dcidlen, scid, scidlen, versions, versions_len); 1640 if(ret < 0) { 1641 log_err("ngtcp2_pkt_write_version_negotiation failed: %s", 1642 ngtcp2_strerror(ret)); 1643 return; 1644 } 1645 sldns_buffer_set_position(c->doq_socket->pkt_buf, ret); 1646 sldns_buffer_flip(c->doq_socket->pkt_buf); 1647 doq_send_pkt(c, paddr, 0); 1648 } 1649 1650 /** Find the doq_conn object by remote address and dcid */ 1651 static struct doq_conn* 1652 doq_conn_find(struct doq_table* table, struct doq_addr_storage* addr, 1653 socklen_t addrlen, struct doq_addr_storage* localaddr, 1654 socklen_t localaddrlen, int ifindex, const uint8_t* dcid, 1655 size_t dcidlen) 1656 { 1657 struct rbnode_type* node; 1658 struct doq_conn key; 1659 memset(&key.node, 0, sizeof(key.node)); 1660 key.node.key = &key; 1661 memmove(&key.key.paddr.addr, addr, addrlen); 1662 key.key.paddr.addrlen = addrlen; 1663 memmove(&key.key.paddr.localaddr, localaddr, localaddrlen); 1664 key.key.paddr.localaddrlen = localaddrlen; 1665 key.key.paddr.ifindex = ifindex; 1666 key.key.dcid = (void*)dcid; 1667 key.key.dcidlen = dcidlen; 1668 node = rbtree_search(table->conn_tree, &key); 1669 if(node) 1670 return (struct doq_conn*)node->key; 1671 return NULL; 1672 } 1673 1674 /** find the doq_con by the connection id */ 1675 static struct doq_conn* 1676 doq_conn_find_by_id(struct doq_table* table, const uint8_t* dcid, 1677 size_t dcidlen) 1678 { 1679 struct doq_conid* conid; 1680 lock_rw_rdlock(&table->conid_lock); 1681 conid = doq_conid_find(table, dcid, dcidlen); 1682 if(conid) { 1683 /* make a copy of the key */ 1684 struct doq_conn* conn; 1685 struct doq_conn_key key = conid->key; 1686 uint8_t cid[NGTCP2_MAX_CIDLEN]; 1687 log_assert(conid->key.dcidlen <= NGTCP2_MAX_CIDLEN); 1688 memcpy(cid, conid->key.dcid, conid->key.dcidlen); 1689 key.dcid = cid; 1690 lock_rw_unlock(&table->conid_lock); 1691 1692 /* now that the conid lock is released, look up the conn */ 1693 lock_rw_rdlock(&table->lock); 1694 conn = doq_conn_find(table, &key.paddr.addr, 1695 key.paddr.addrlen, &key.paddr.localaddr, 1696 key.paddr.localaddrlen, key.paddr.ifindex, key.dcid, 1697 key.dcidlen); 1698 if(!conn) { 1699 /* The connection got deleted between the conid lookup 1700 * and the connection lock grab, it no longer exists, 1701 * so return null. */ 1702 lock_rw_unlock(&table->lock); 1703 return NULL; 1704 } 1705 lock_basic_lock(&conn->lock); 1706 if(conn->is_deleted) { 1707 lock_rw_unlock(&table->lock); 1708 lock_basic_unlock(&conn->lock); 1709 return NULL; 1710 } 1711 lock_rw_unlock(&table->lock); 1712 return conn; 1713 } 1714 lock_rw_unlock(&table->conid_lock); 1715 return NULL; 1716 } 1717 1718 /** Find the doq_conn, by addr or by connection id */ 1719 static struct doq_conn* 1720 doq_conn_find_by_addr_or_cid(struct doq_table* table, 1721 struct doq_pkt_addr* paddr, const uint8_t* dcid, size_t dcidlen) 1722 { 1723 struct doq_conn* conn; 1724 lock_rw_rdlock(&table->lock); 1725 conn = doq_conn_find(table, &paddr->addr, paddr->addrlen, 1726 &paddr->localaddr, paddr->localaddrlen, paddr->ifindex, 1727 dcid, dcidlen); 1728 if(conn && conn->is_deleted) { 1729 conn = NULL; 1730 } 1731 if(conn) { 1732 lock_basic_lock(&conn->lock); 1733 lock_rw_unlock(&table->lock); 1734 verbose(VERB_ALGO, "doq: found connection by address, dcid"); 1735 } else { 1736 lock_rw_unlock(&table->lock); 1737 conn = doq_conn_find_by_id(table, dcid, dcidlen); 1738 if(conn) { 1739 verbose(VERB_ALGO, "doq: found connection by dcid"); 1740 } 1741 } 1742 return conn; 1743 } 1744 1745 /** decode doq packet header, false on handled or failure, true to continue 1746 * to process the packet */ 1747 static int 1748 doq_decode_pkt_header_negotiate(struct comm_point* c, 1749 struct doq_pkt_addr* paddr, struct doq_conn** conn) 1750 { 1751 #ifdef HAVE_STRUCT_NGTCP2_VERSION_CID 1752 struct ngtcp2_version_cid vc; 1753 #else 1754 uint32_t version; 1755 const uint8_t *dcid, *scid; 1756 size_t dcidlen, scidlen; 1757 #endif 1758 int rv; 1759 1760 #ifdef HAVE_STRUCT_NGTCP2_VERSION_CID 1761 rv = ngtcp2_pkt_decode_version_cid(&vc, 1762 sldns_buffer_begin(c->doq_socket->pkt_buf), 1763 sldns_buffer_limit(c->doq_socket->pkt_buf), 1764 c->doq_socket->sv_scidlen); 1765 #else 1766 rv = ngtcp2_pkt_decode_version_cid(&version, &dcid, &dcidlen, 1767 &scid, &scidlen, sldns_buffer_begin(c->doq_socket->pkt_buf), 1768 sldns_buffer_limit(c->doq_socket->pkt_buf), c->doq_socket->sv_scidlen); 1769 #endif 1770 if(rv != 0) { 1771 if(rv == NGTCP2_ERR_VERSION_NEGOTIATION) { 1772 /* send the version negotiation */ 1773 doq_send_version_negotiation(c, paddr, 1774 #ifdef HAVE_STRUCT_NGTCP2_VERSION_CID 1775 vc.scid, vc.scidlen, vc.dcid, vc.dcidlen 1776 #else 1777 scid, scidlen, dcid, dcidlen 1778 #endif 1779 ); 1780 return 0; 1781 } 1782 verbose(VERB_ALGO, "doq: could not decode version " 1783 "and CID from QUIC packet header: %s", 1784 ngtcp2_strerror(rv)); 1785 return 0; 1786 } 1787 1788 if(verbosity >= VERB_ALGO) { 1789 verbose(VERB_ALGO, "ngtcp2_pkt_decode_version_cid packet has " 1790 "QUIC protocol version %u", (unsigned) 1791 #ifdef HAVE_STRUCT_NGTCP2_VERSION_CID 1792 vc. 1793 #endif 1794 version 1795 ); 1796 log_hex("dcid", 1797 #ifdef HAVE_STRUCT_NGTCP2_VERSION_CID 1798 (void*)vc.dcid, vc.dcidlen 1799 #else 1800 (void*)dcid, dcidlen 1801 #endif 1802 ); 1803 log_hex("scid", 1804 #ifdef HAVE_STRUCT_NGTCP2_VERSION_CID 1805 (void*)vc.scid, vc.scidlen 1806 #else 1807 (void*)scid, scidlen 1808 #endif 1809 ); 1810 } 1811 *conn = doq_conn_find_by_addr_or_cid(c->doq_socket->table, paddr, 1812 #ifdef HAVE_STRUCT_NGTCP2_VERSION_CID 1813 vc.dcid, vc.dcidlen 1814 #else 1815 dcid, dcidlen 1816 #endif 1817 ); 1818 if(*conn) 1819 (*conn)->doq_socket = c->doq_socket; 1820 return 1; 1821 } 1822 1823 /** fill cid structure with random data */ 1824 static void doq_cid_randfill(struct ngtcp2_cid* cid, size_t datalen, 1825 struct ub_randstate* rnd) 1826 { 1827 uint8_t buf[32]; 1828 if(datalen > sizeof(buf)) 1829 datalen = sizeof(buf); 1830 doq_fill_rand(rnd, buf, datalen); 1831 ngtcp2_cid_init(cid, buf, datalen); 1832 } 1833 1834 /** send retry packet for doq connection. */ 1835 static void 1836 doq_send_retry(struct comm_point* c, struct doq_pkt_addr* paddr, 1837 struct ngtcp2_pkt_hd* hd) 1838 { 1839 char host[256], port[32]; 1840 struct ngtcp2_cid scid; 1841 uint8_t token[NGTCP2_CRYPTO_MAX_RETRY_TOKENLEN]; 1842 ngtcp2_ssize tokenlen, ret; 1843 1844 if(!doq_print_addr_port(&paddr->addr, paddr->addrlen, host, 1845 sizeof(host), port, sizeof(port))) { 1846 log_err("doq_send_retry failed"); 1847 return; 1848 } 1849 verbose(VERB_ALGO, "doq: sending retry packet to %s %s", host, port); 1850 1851 /* the server chosen source connection ID */ 1852 scid.datalen = c->doq_socket->sv_scidlen; 1853 doq_cid_randfill(&scid, scid.datalen, c->doq_socket->rnd); 1854 1855 tokenlen = ngtcp2_crypto_generate_retry_token(token, 1856 c->doq_socket->static_secret, c->doq_socket->static_secret_len, 1857 hd->version, (void*)&paddr->addr, paddr->addrlen, &scid, 1858 &hd->dcid, doq_get_timestamp_nanosec()); 1859 if(tokenlen < 0) { 1860 log_err("ngtcp2_crypto_generate_retry_token failed: %s", 1861 ngtcp2_strerror(tokenlen)); 1862 return; 1863 } 1864 1865 sldns_buffer_clear(c->doq_socket->pkt_buf); 1866 ret = ngtcp2_crypto_write_retry(sldns_buffer_begin(c->doq_socket->pkt_buf), 1867 sldns_buffer_capacity(c->doq_socket->pkt_buf), hd->version, 1868 &hd->scid, &scid, &hd->dcid, token, tokenlen); 1869 if(ret < 0) { 1870 log_err("ngtcp2_crypto_write_retry failed: %s", 1871 ngtcp2_strerror(ret)); 1872 return; 1873 } 1874 sldns_buffer_set_position(c->doq_socket->pkt_buf, ret); 1875 sldns_buffer_flip(c->doq_socket->pkt_buf); 1876 doq_send_pkt(c, paddr, 0); 1877 } 1878 1879 /** doq send stateless connection close */ 1880 static void 1881 doq_send_stateless_connection_close(struct comm_point* c, 1882 struct doq_pkt_addr* paddr, struct ngtcp2_pkt_hd* hd, 1883 uint64_t error_code) 1884 { 1885 ngtcp2_ssize ret; 1886 sldns_buffer_clear(c->doq_socket->pkt_buf); 1887 ret = ngtcp2_crypto_write_connection_close( 1888 sldns_buffer_begin(c->doq_socket->pkt_buf), 1889 sldns_buffer_capacity(c->doq_socket->pkt_buf), hd->version, &hd->scid, 1890 &hd->dcid, error_code, NULL, 0); 1891 if(ret < 0) { 1892 log_err("ngtcp2_crypto_write_connection_close failed: %s", 1893 ngtcp2_strerror(ret)); 1894 return; 1895 } 1896 sldns_buffer_set_position(c->doq_socket->pkt_buf, ret); 1897 sldns_buffer_flip(c->doq_socket->pkt_buf); 1898 doq_send_pkt(c, paddr, 0); 1899 } 1900 1901 /** doq verify retry token, false on failure */ 1902 static int 1903 doq_verify_retry_token(struct comm_point* c, struct doq_pkt_addr* paddr, 1904 struct ngtcp2_cid* ocid, struct ngtcp2_pkt_hd* hd) 1905 { 1906 char host[256], port[32]; 1907 if(!doq_print_addr_port(&paddr->addr, paddr->addrlen, host, 1908 sizeof(host), port, sizeof(port))) { 1909 log_err("doq_verify_retry_token failed"); 1910 return 0; 1911 } 1912 verbose(VERB_ALGO, "doq: verifying retry token from %s %s", host, 1913 port); 1914 if(ngtcp2_crypto_verify_retry_token(ocid, 1915 #ifdef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN 1916 hd->token, hd->tokenlen, 1917 #else 1918 hd->token.base, hd->token.len, 1919 #endif 1920 c->doq_socket->static_secret, 1921 c->doq_socket->static_secret_len, hd->version, 1922 (void*)&paddr->addr, paddr->addrlen, &hd->dcid, 1923 10*NGTCP2_SECONDS, doq_get_timestamp_nanosec()) != 0) { 1924 verbose(VERB_ALGO, "doq: could not verify retry token " 1925 "from %s %s", host, port); 1926 return 0; 1927 } 1928 verbose(VERB_ALGO, "doq: verified retry token from %s %s", host, port); 1929 return 1; 1930 } 1931 1932 /** doq verify token, false on failure */ 1933 static int 1934 doq_verify_token(struct comm_point* c, struct doq_pkt_addr* paddr, 1935 struct ngtcp2_pkt_hd* hd) 1936 { 1937 char host[256], port[32]; 1938 if(!doq_print_addr_port(&paddr->addr, paddr->addrlen, host, 1939 sizeof(host), port, sizeof(port))) { 1940 log_err("doq_verify_token failed"); 1941 return 0; 1942 } 1943 verbose(VERB_ALGO, "doq: verifying token from %s %s", host, port); 1944 if(ngtcp2_crypto_verify_regular_token( 1945 #ifdef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN 1946 hd->token, hd->tokenlen, 1947 #else 1948 hd->token.base, hd->token.len, 1949 #endif 1950 c->doq_socket->static_secret, c->doq_socket->static_secret_len, 1951 (void*)&paddr->addr, paddr->addrlen, 3600*NGTCP2_SECONDS, 1952 doq_get_timestamp_nanosec()) != 0) { 1953 verbose(VERB_ALGO, "doq: could not verify token from %s %s", 1954 host, port); 1955 return 0; 1956 } 1957 verbose(VERB_ALGO, "doq: verified token from %s %s", host, port); 1958 return 1; 1959 } 1960 1961 /** delete and remove from the lookup tree the doq_conn connection */ 1962 static void 1963 doq_delete_connection(struct comm_point* c, struct doq_conn* conn) 1964 { 1965 struct doq_conn copy; 1966 uint8_t cid[NGTCP2_MAX_CIDLEN]; 1967 rbnode_type* node; 1968 if(!conn) 1969 return; 1970 /* Copy the key and set it deleted. */ 1971 conn->is_deleted = 1; 1972 doq_conn_write_disable(conn); 1973 copy.key = conn->key; 1974 log_assert(conn->key.dcidlen <= NGTCP2_MAX_CIDLEN); 1975 memcpy(cid, conn->key.dcid, conn->key.dcidlen); 1976 copy.key.dcid = cid; 1977 copy.node.key = © 1978 lock_basic_unlock(&conn->lock); 1979 1980 /* Now get the table lock to delete it from the tree */ 1981 lock_rw_wrlock(&c->doq_socket->table->lock); 1982 node = rbtree_delete(c->doq_socket->table->conn_tree, copy.node.key); 1983 if(node) { 1984 conn = (struct doq_conn*)node->key; 1985 lock_basic_lock(&conn->lock); 1986 doq_conn_write_list_remove(c->doq_socket->table, conn); 1987 if(conn->timer.timer_in_list) { 1988 /* Remove timer from list first, because finding the 1989 * rbnode element of the setlist of same timeouts 1990 * needs tree lookup. Edit the tree structure after 1991 * that lookup. */ 1992 doq_timer_list_remove(c->doq_socket->table, 1993 &conn->timer); 1994 } 1995 if(conn->timer.timer_in_tree) 1996 doq_timer_tree_remove(c->doq_socket->table, 1997 &conn->timer); 1998 } 1999 lock_rw_unlock(&c->doq_socket->table->lock); 2000 if(node) { 2001 lock_basic_unlock(&conn->lock); 2002 doq_table_quic_size_subtract(c->doq_socket->table, 2003 sizeof(*conn)+conn->key.dcidlen); 2004 doq_conn_delete(conn, c->doq_socket->table); 2005 } 2006 } 2007 2008 /** create and setup a new doq connection, to a new destination, or with 2009 * a new dcid. It has a new set of streams. It is inserted in the lookup tree. 2010 * Returns NULL on failure. */ 2011 static struct doq_conn* 2012 doq_setup_new_conn(struct comm_point* c, struct doq_pkt_addr* paddr, 2013 struct ngtcp2_pkt_hd* hd, struct ngtcp2_cid* ocid) 2014 { 2015 struct doq_conn* conn; 2016 if(!doq_table_quic_size_available(c->doq_socket->table, 2017 c->doq_socket->cfg, sizeof(*conn)+hd->dcid.datalen 2018 + sizeof(struct doq_stream) 2019 + 100 /* estimated input query */ 2020 + 1200 /* estimated output query */)) { 2021 verbose(VERB_ALGO, "doq: no mem available for new connection"); 2022 doq_send_stateless_connection_close(c, paddr, hd, 2023 NGTCP2_CONNECTION_REFUSED); 2024 return NULL; 2025 } 2026 conn = doq_conn_create(c, paddr, hd->dcid.data, hd->dcid.datalen, 2027 hd->version); 2028 if(!conn) { 2029 log_err("doq: could not allocate doq_conn"); 2030 return NULL; 2031 } 2032 lock_rw_wrlock(&c->doq_socket->table->lock); 2033 lock_basic_lock(&conn->lock); 2034 if(!rbtree_insert(c->doq_socket->table->conn_tree, &conn->node)) { 2035 lock_rw_unlock(&c->doq_socket->table->lock); 2036 log_err("doq: duplicate connection"); 2037 /* conn has no entry in writelist, and no timer yet. */ 2038 lock_basic_unlock(&conn->lock); 2039 doq_conn_delete(conn, c->doq_socket->table); 2040 return NULL; 2041 } 2042 lock_rw_unlock(&c->doq_socket->table->lock); 2043 doq_table_quic_size_add(c->doq_socket->table, 2044 sizeof(*conn)+conn->key.dcidlen); 2045 verbose(VERB_ALGO, "doq: created new connection"); 2046 2047 /* the scid and dcid switch meaning from the accepted client 2048 * connection to the server connection. The 'source' and 'destination' 2049 * meaning is reversed. */ 2050 if(!doq_conn_setup(conn, hd->scid.data, hd->scid.datalen, 2051 (ocid?ocid->data:NULL), (ocid?ocid->datalen:0), 2052 #ifdef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN 2053 hd->token, hd->tokenlen 2054 #else 2055 hd->token.base, hd->token.len 2056 #endif 2057 )) { 2058 log_err("doq: could not set up connection"); 2059 doq_delete_connection(c, conn); 2060 return NULL; 2061 } 2062 return conn; 2063 } 2064 2065 /** perform doq address validation */ 2066 static int 2067 doq_address_validation(struct comm_point* c, struct doq_pkt_addr* paddr, 2068 struct ngtcp2_pkt_hd* hd, struct ngtcp2_cid* ocid, 2069 struct ngtcp2_cid** pocid) 2070 { 2071 #ifdef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN 2072 const uint8_t* token = hd->token; 2073 size_t tokenlen = hd->tokenlen; 2074 #else 2075 const uint8_t* token = hd->token.base; 2076 size_t tokenlen = hd->token.len; 2077 #endif 2078 verbose(VERB_ALGO, "doq stateless address validation"); 2079 2080 if(tokenlen == 0 || token == NULL) { 2081 doq_send_retry(c, paddr, hd); 2082 return 0; 2083 } 2084 if(token[0] != NGTCP2_CRYPTO_TOKEN_MAGIC_RETRY && 2085 hd->dcid.datalen < NGTCP2_MIN_INITIAL_DCIDLEN) { 2086 doq_send_stateless_connection_close(c, paddr, hd, 2087 NGTCP2_INVALID_TOKEN); 2088 return 0; 2089 } 2090 if(token[0] == NGTCP2_CRYPTO_TOKEN_MAGIC_RETRY) { 2091 if(!doq_verify_retry_token(c, paddr, ocid, hd)) { 2092 doq_send_stateless_connection_close(c, paddr, hd, 2093 NGTCP2_INVALID_TOKEN); 2094 return 0; 2095 } 2096 *pocid = ocid; 2097 } else if(token[0] == NGTCP2_CRYPTO_TOKEN_MAGIC_REGULAR) { 2098 if(!doq_verify_token(c, paddr, hd)) { 2099 doq_send_retry(c, paddr, hd); 2100 return 0; 2101 } 2102 #ifdef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN 2103 hd->token = NULL; 2104 hd->tokenlen = 0; 2105 #else 2106 hd->token.base = NULL; 2107 hd->token.len = 0; 2108 #endif 2109 } else { 2110 verbose(VERB_ALGO, "doq address validation: unrecognised " 2111 "token in hd.token.base with magic byte 0x%2.2x", 2112 (int)token[0]); 2113 if(c->doq_socket->validate_addr) { 2114 doq_send_retry(c, paddr, hd); 2115 return 0; 2116 } 2117 #ifdef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN 2118 hd->token = NULL; 2119 hd->tokenlen = 0; 2120 #else 2121 hd->token.base = NULL; 2122 hd->token.len = 0; 2123 #endif 2124 } 2125 return 1; 2126 } 2127 2128 /** the doq accept, returns false if no further processing of content */ 2129 static int 2130 doq_accept(struct comm_point* c, struct doq_pkt_addr* paddr, 2131 struct doq_conn** conn, struct ngtcp2_pkt_info* pi) 2132 { 2133 int rv; 2134 struct ngtcp2_pkt_hd hd; 2135 struct ngtcp2_cid ocid, *pocid=NULL; 2136 int err_retry; 2137 memset(&hd, 0, sizeof(hd)); 2138 rv = ngtcp2_accept(&hd, sldns_buffer_begin(c->doq_socket->pkt_buf), 2139 sldns_buffer_limit(c->doq_socket->pkt_buf)); 2140 if(rv != 0) { 2141 if(rv == NGTCP2_ERR_RETRY) { 2142 doq_send_retry(c, paddr, &hd); 2143 return 0; 2144 } 2145 log_err("doq: initial packet failed, ngtcp2_accept failed: %s", 2146 ngtcp2_strerror(rv)); 2147 return 0; 2148 } 2149 if(c->doq_socket->validate_addr || 2150 #ifdef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN 2151 hd.tokenlen 2152 #else 2153 hd.token.len 2154 #endif 2155 ) { 2156 if(!doq_address_validation(c, paddr, &hd, &ocid, &pocid)) 2157 return 0; 2158 } 2159 *conn = doq_setup_new_conn(c, paddr, &hd, pocid); 2160 if(!*conn) 2161 return 0; 2162 (*conn)->doq_socket = c->doq_socket; 2163 if(!doq_conn_recv(c, paddr, *conn, pi, &err_retry, NULL)) { 2164 if(err_retry) 2165 doq_send_retry(c, paddr, &hd); 2166 doq_delete_connection(c, *conn); 2167 *conn = NULL; 2168 return 0; 2169 } 2170 return 1; 2171 } 2172 2173 /** doq pickup a timer to wait for for the worker. If any timer exists. */ 2174 static void 2175 doq_pickup_timer(struct comm_point* c) 2176 { 2177 struct doq_timer* t; 2178 struct timeval tv; 2179 ngtcp2_tstamp ts = 0; 2180 int have_time = 0; 2181 memset(&tv, 0, sizeof(tv)); 2182 2183 lock_rw_wrlock(&c->doq_socket->table->lock); 2184 RBTREE_FOR(t, struct doq_timer*, c->doq_socket->table->timer_tree) { 2185 if(t->worker_doq_socket == NULL || 2186 t->worker_doq_socket == c->doq_socket) { 2187 /* pick up this element */ 2188 t->worker_doq_socket = c->doq_socket; 2189 memcpy(&tv, &t->time_real, sizeof(tv)); 2190 ts = t->time_mono; 2191 have_time = 1; 2192 break; 2193 } 2194 } 2195 lock_rw_unlock(&c->doq_socket->table->lock); 2196 c->doq_socket->marked_time = ts; 2197 if(have_time) { 2198 struct timeval rel; 2199 timeval_subtract(&rel, &tv, c->doq_socket->now_tv); 2200 comm_timer_set(c->doq_socket->timer, &rel); 2201 verbose(VERB_ALGO, "doq pickup timer at %d.%6.6d in %d.%6.6d", 2202 (int)tv.tv_sec, (int)tv.tv_usec, (int)rel.tv_sec, 2203 (int)rel.tv_usec); 2204 } else { 2205 if(comm_timer_is_set(c->doq_socket->timer)) 2206 comm_timer_disable(c->doq_socket->timer); 2207 verbose(VERB_ALGO, "doq timer disabled"); 2208 } 2209 } 2210 2211 /** doq done with connection, release locks and setup timer and write */ 2212 static void 2213 doq_done_setup_timer_and_write(struct comm_point* c, struct doq_conn* conn) 2214 { 2215 struct doq_conn copy; 2216 uint8_t cid[NGTCP2_MAX_CIDLEN]; 2217 rbnode_type* node; 2218 struct timeval new_tv; 2219 ngtcp2_tstamp new_ts; 2220 int write_change = 0, timer_change = 0; 2221 2222 /* No longer in callbacks, so the pointer to doq_socket is back 2223 * to NULL. */ 2224 conn->doq_socket = NULL; 2225 2226 if(doq_conn_check_timer(conn, &new_tv, &new_ts)) 2227 timer_change = 1; 2228 if( (conn->write_interest && !conn->on_write_list) || 2229 (!conn->write_interest && conn->on_write_list)) 2230 write_change = 1; 2231 2232 if(!timer_change && !write_change) { 2233 /* Nothing to do. */ 2234 lock_basic_unlock(&conn->lock); 2235 return; 2236 } 2237 2238 /* The table lock is needed to change the write list and timer tree. 2239 * So the connection lock is release and then the connection is 2240 * looked up again. */ 2241 copy.key = conn->key; 2242 log_assert(conn->key.dcidlen <= NGTCP2_MAX_CIDLEN); 2243 memcpy(cid, conn->key.dcid, conn->key.dcidlen); 2244 copy.key.dcid = cid; 2245 copy.node.key = © 2246 lock_basic_unlock(&conn->lock); 2247 2248 lock_rw_wrlock(&c->doq_socket->table->lock); 2249 node = rbtree_search(c->doq_socket->table->conn_tree, copy.node.key); 2250 if(!node) { 2251 lock_rw_unlock(&c->doq_socket->table->lock); 2252 /* Must have been deleted in the mean time. */ 2253 return; 2254 } 2255 conn = (struct doq_conn*)node->key; 2256 lock_basic_lock(&conn->lock); 2257 if(conn->is_deleted) { 2258 /* It is deleted now. */ 2259 lock_rw_unlock(&c->doq_socket->table->lock); 2260 lock_basic_unlock(&conn->lock); 2261 return; 2262 } 2263 2264 if(write_change) { 2265 /* Edit the write lists, we are holding the table.lock and can 2266 * edit the list first,last and also prev,next and on_list 2267 * elements in the doq_conn structures. */ 2268 doq_conn_set_write_list(c->doq_socket->table, conn); 2269 } 2270 if(timer_change) { 2271 doq_timer_set(c->doq_socket->table, &conn->timer, 2272 c->doq_socket, &new_tv, new_ts); 2273 } 2274 lock_rw_unlock(&c->doq_socket->table->lock); 2275 lock_basic_unlock(&conn->lock); 2276 } 2277 2278 /** doq done with connection callbacks, release locks and setup write */ 2279 static void 2280 doq_done_with_conn_cb(struct comm_point* c, struct doq_conn* conn) 2281 { 2282 struct doq_conn copy; 2283 uint8_t cid[NGTCP2_MAX_CIDLEN]; 2284 rbnode_type* node; 2285 2286 /* no longer in callbacks, so the pointer to doq_socket is back 2287 * to NULL. */ 2288 conn->doq_socket = NULL; 2289 2290 if( (conn->write_interest && conn->on_write_list) || 2291 (!conn->write_interest && !conn->on_write_list)) { 2292 /* The connection already has the required write list 2293 * status. */ 2294 lock_basic_unlock(&conn->lock); 2295 return; 2296 } 2297 2298 /* To edit the write list of connections we have to hold the table 2299 * lock, so we release the connection and then look it up again. */ 2300 copy.key = conn->key; 2301 log_assert(conn->key.dcidlen <= NGTCP2_MAX_CIDLEN); 2302 memcpy(cid, conn->key.dcid, conn->key.dcidlen); 2303 copy.key.dcid = cid; 2304 copy.node.key = © 2305 lock_basic_unlock(&conn->lock); 2306 2307 lock_rw_wrlock(&c->doq_socket->table->lock); 2308 node = rbtree_search(c->doq_socket->table->conn_tree, copy.node.key); 2309 if(!node) { 2310 lock_rw_unlock(&c->doq_socket->table->lock); 2311 /* must have been deleted in the mean time */ 2312 return; 2313 } 2314 conn = (struct doq_conn*)node->key; 2315 lock_basic_lock(&conn->lock); 2316 if(conn->is_deleted) { 2317 /* it is deleted now. */ 2318 lock_rw_unlock(&c->doq_socket->table->lock); 2319 lock_basic_unlock(&conn->lock); 2320 return; 2321 } 2322 2323 /* edit the write lists, we are holding the table.lock and can 2324 * edit the list first,last and also prev,next and on_list elements 2325 * in the doq_conn structures. */ 2326 doq_conn_set_write_list(c->doq_socket->table, conn); 2327 lock_rw_unlock(&c->doq_socket->table->lock); 2328 lock_basic_unlock(&conn->lock); 2329 } 2330 2331 /** doq count the length of the write list */ 2332 static size_t 2333 doq_write_list_length(struct comm_point* c) 2334 { 2335 size_t count = 0; 2336 struct doq_conn* conn; 2337 lock_rw_rdlock(&c->doq_socket->table->lock); 2338 conn = c->doq_socket->table->write_list_first; 2339 while(conn) { 2340 count++; 2341 conn = conn->write_next; 2342 } 2343 lock_rw_unlock(&c->doq_socket->table->lock); 2344 return count; 2345 } 2346 2347 /** doq pop the first element from the write list to have write events */ 2348 static struct doq_conn* 2349 doq_pop_write_conn(struct comm_point* c) 2350 { 2351 struct doq_conn* conn; 2352 lock_rw_wrlock(&c->doq_socket->table->lock); 2353 conn = doq_table_pop_first(c->doq_socket->table); 2354 while(conn && conn->is_deleted) { 2355 lock_basic_unlock(&conn->lock); 2356 conn = doq_table_pop_first(c->doq_socket->table); 2357 } 2358 lock_rw_unlock(&c->doq_socket->table->lock); 2359 if(conn) 2360 conn->doq_socket = c->doq_socket; 2361 return conn; 2362 } 2363 2364 /** doq the connection is done with write callbacks, release it. */ 2365 static void 2366 doq_done_with_write_cb(struct comm_point* c, struct doq_conn* conn, 2367 int delete_it) 2368 { 2369 if(delete_it) { 2370 doq_delete_connection(c, conn); 2371 return; 2372 } 2373 doq_done_setup_timer_and_write(c, conn); 2374 } 2375 2376 /** see if the doq socket wants to write packets */ 2377 static int 2378 doq_socket_want_write(struct comm_point* c) 2379 { 2380 int want_write = 0; 2381 if(c->doq_socket->have_blocked_pkt) 2382 return 1; 2383 lock_rw_rdlock(&c->doq_socket->table->lock); 2384 if(c->doq_socket->table->write_list_first) 2385 want_write = 1; 2386 lock_rw_unlock(&c->doq_socket->table->lock); 2387 return want_write; 2388 } 2389 2390 /** enable write event for the doq server socket fd */ 2391 static void 2392 doq_socket_write_enable(struct comm_point* c) 2393 { 2394 verbose(VERB_ALGO, "doq socket want write"); 2395 if(c->doq_socket->event_has_write) 2396 return; 2397 comm_point_listen_for_rw(c, 1, 1); 2398 c->doq_socket->event_has_write = 1; 2399 } 2400 2401 /** disable write event for the doq server socket fd */ 2402 static void 2403 doq_socket_write_disable(struct comm_point* c) 2404 { 2405 verbose(VERB_ALGO, "doq socket want no write"); 2406 if(!c->doq_socket->event_has_write) 2407 return; 2408 comm_point_listen_for_rw(c, 1, 0); 2409 c->doq_socket->event_has_write = 0; 2410 } 2411 2412 /** write blocked packet, if possible. returns false if failed, again. */ 2413 static int 2414 doq_write_blocked_pkt(struct comm_point* c) 2415 { 2416 struct doq_pkt_addr paddr; 2417 if(!c->doq_socket->have_blocked_pkt) 2418 return 1; 2419 c->doq_socket->have_blocked_pkt = 0; 2420 if(sldns_buffer_limit(c->doq_socket->blocked_pkt) > 2421 sldns_buffer_remaining(c->doq_socket->pkt_buf)) 2422 return 1; /* impossibly large, drop it. 2423 impossible since pkt_buf is same size as blocked_pkt buf. */ 2424 sldns_buffer_clear(c->doq_socket->pkt_buf); 2425 sldns_buffer_write(c->doq_socket->pkt_buf, 2426 sldns_buffer_begin(c->doq_socket->blocked_pkt), 2427 sldns_buffer_limit(c->doq_socket->blocked_pkt)); 2428 sldns_buffer_flip(c->doq_socket->pkt_buf); 2429 memcpy(&paddr, c->doq_socket->blocked_paddr, sizeof(paddr)); 2430 doq_send_pkt(c, &paddr, c->doq_socket->blocked_pkt_pi.ecn); 2431 if(c->doq_socket->have_blocked_pkt) 2432 return 0; 2433 return 1; 2434 } 2435 2436 /** doq find a timer that timed out and return the conn, locked. */ 2437 static struct doq_conn* 2438 doq_timer_timeout_conn(struct doq_server_socket* doq_socket) 2439 { 2440 struct doq_conn* conn = NULL; 2441 struct rbnode_type* node; 2442 lock_rw_wrlock(&doq_socket->table->lock); 2443 node = rbtree_first(doq_socket->table->timer_tree); 2444 if(node && node != RBTREE_NULL) { 2445 struct doq_timer* t = (struct doq_timer*)node; 2446 conn = t->conn; 2447 2448 /* If now < timer then no further timeouts in tree. */ 2449 if(timeval_smaller(doq_socket->now_tv, &t->time_real)) { 2450 lock_rw_unlock(&doq_socket->table->lock); 2451 return NULL; 2452 } 2453 2454 lock_basic_lock(&conn->lock); 2455 conn->doq_socket = doq_socket; 2456 2457 /* Now that the timer is fired, remove it. */ 2458 doq_timer_unset(doq_socket->table, t); 2459 lock_rw_unlock(&doq_socket->table->lock); 2460 return conn; 2461 } 2462 lock_rw_unlock(&doq_socket->table->lock); 2463 return NULL; 2464 } 2465 2466 /** doq timer erase the marker that said which timer the worker uses. */ 2467 static void 2468 doq_timer_erase_marker(struct doq_server_socket* doq_socket) 2469 { 2470 struct doq_timer* t; 2471 lock_rw_wrlock(&doq_socket->table->lock); 2472 t = doq_timer_find_time(doq_socket->table, doq_socket->marked_time); 2473 if(t && t->worker_doq_socket == doq_socket) 2474 t->worker_doq_socket = NULL; 2475 lock_rw_unlock(&doq_socket->table->lock); 2476 doq_socket->marked_time = 0; 2477 } 2478 2479 void 2480 doq_timer_cb(void* arg) 2481 { 2482 struct doq_server_socket* doq_socket = (struct doq_server_socket*)arg; 2483 struct doq_conn* conn; 2484 verbose(VERB_ALGO, "doq timer callback"); 2485 2486 doq_timer_erase_marker(doq_socket); 2487 2488 while((conn = doq_timer_timeout_conn(doq_socket)) != NULL) { 2489 if(conn->is_deleted || 2490 #ifdef HAVE_NGTCP2_CONN_IN_CLOSING_PERIOD 2491 ngtcp2_conn_in_closing_period(conn->conn) || 2492 #else 2493 ngtcp2_conn_is_in_closing_period(conn->conn) || 2494 #endif 2495 #ifdef HAVE_NGTCP2_CONN_IN_DRAINING_PERIOD 2496 ngtcp2_conn_in_draining_period(conn->conn) 2497 #else 2498 ngtcp2_conn_is_in_draining_period(conn->conn) 2499 #endif 2500 ) { 2501 if(verbosity >= VERB_ALGO) { 2502 char remotestr[256]; 2503 addr_to_str((void*)&conn->key.paddr.addr, 2504 conn->key.paddr.addrlen, remotestr, 2505 sizeof(remotestr)); 2506 verbose(VERB_ALGO, "doq conn %s is deleted " 2507 "after timeout", remotestr); 2508 } 2509 doq_delete_connection(doq_socket->cp, conn); 2510 continue; 2511 } 2512 if(!doq_conn_handle_timeout(conn)) 2513 doq_delete_connection(doq_socket->cp, conn); 2514 else doq_done_setup_timer_and_write(doq_socket->cp, conn); 2515 } 2516 2517 if(doq_socket_want_write(doq_socket->cp)) 2518 doq_socket_write_enable(doq_socket->cp); 2519 else doq_socket_write_disable(doq_socket->cp); 2520 doq_pickup_timer(doq_socket->cp); 2521 } 2522 2523 void 2524 comm_point_doq_callback(int fd, short event, void* arg) 2525 { 2526 struct comm_point* c; 2527 struct doq_pkt_addr paddr; 2528 int i, pkt_continue, err_drop; 2529 struct doq_conn* conn; 2530 struct ngtcp2_pkt_info pi; 2531 size_t count, num_len; 2532 2533 c = (struct comm_point*)arg; 2534 log_assert(c->type == comm_doq); 2535 2536 log_assert(c && c->doq_socket->pkt_buf && c->fd == fd); 2537 ub_comm_base_now(c->ev->base); 2538 2539 /* see if there is a blocked packet, and send that if possible. 2540 * do not attempt to read yet, even if possible, that would just 2541 * push more answers in reply to those read packets onto the list 2542 * of written replies. First attempt to clear the write content out. 2543 * That keeps the memory usage from bloating up. */ 2544 if(c->doq_socket->have_blocked_pkt) { 2545 if(!doq_write_blocked_pkt(c)) { 2546 /* this write has also blocked, attempt to write 2547 * later. Make sure the event listens to write 2548 * events. */ 2549 if(!c->doq_socket->event_has_write) 2550 doq_socket_write_enable(c); 2551 doq_pickup_timer(c); 2552 return; 2553 } 2554 } 2555 2556 /* see if there is write interest */ 2557 count = 0; 2558 num_len = doq_write_list_length(c); 2559 while((conn = doq_pop_write_conn(c)) != NULL) { 2560 if(conn->is_deleted || 2561 #ifdef HAVE_NGTCP2_CONN_IN_CLOSING_PERIOD 2562 ngtcp2_conn_in_closing_period(conn->conn) || 2563 #else 2564 ngtcp2_conn_is_in_closing_period(conn->conn) || 2565 #endif 2566 #ifdef HAVE_NGTCP2_CONN_IN_DRAINING_PERIOD 2567 ngtcp2_conn_in_draining_period(conn->conn) 2568 #else 2569 ngtcp2_conn_is_in_draining_period(conn->conn) 2570 #endif 2571 ) { 2572 conn->doq_socket = NULL; 2573 lock_basic_unlock(&conn->lock); 2574 if(c->doq_socket->have_blocked_pkt) { 2575 if(!c->doq_socket->event_has_write) 2576 doq_socket_write_enable(c); 2577 doq_pickup_timer(c); 2578 return; 2579 } 2580 if(++count > num_len*2) 2581 break; 2582 continue; 2583 } 2584 if(verbosity >= VERB_ALGO) { 2585 char remotestr[256]; 2586 addr_to_str((void*)&conn->key.paddr.addr, 2587 conn->key.paddr.addrlen, remotestr, 2588 sizeof(remotestr)); 2589 verbose(VERB_ALGO, "doq write connection %s %d", 2590 remotestr, doq_sockaddr_get_port( 2591 &conn->key.paddr.addr)); 2592 } 2593 if(doq_conn_write_streams(c, conn, &err_drop)) 2594 err_drop = 0; 2595 doq_done_with_write_cb(c, conn, err_drop); 2596 if(c->doq_socket->have_blocked_pkt) { 2597 if(!c->doq_socket->event_has_write) 2598 doq_socket_write_enable(c); 2599 doq_pickup_timer(c); 2600 return; 2601 } 2602 /* Stop overly long write lists that are created 2603 * while we are processing. Do those next time there 2604 * is a write callback. Stops long loops, and keeps 2605 * fair for other events. */ 2606 if(++count > num_len*2) 2607 break; 2608 } 2609 2610 /* check for data to read */ 2611 if((event&UB_EV_READ)!=0) 2612 for(i=0; i<NUM_UDP_PER_SELECT; i++) { 2613 /* there may be a blocked write packet and if so, stop 2614 * reading because the reply cannot get written. The 2615 * blocked packet could be written during the conn_recv 2616 * handling of replies, or for a connection close. */ 2617 if(c->doq_socket->have_blocked_pkt) { 2618 if(!c->doq_socket->event_has_write) 2619 doq_socket_write_enable(c); 2620 doq_pickup_timer(c); 2621 return; 2622 } 2623 sldns_buffer_clear(c->doq_socket->pkt_buf); 2624 doq_pkt_addr_init(&paddr); 2625 log_assert(fd != -1); 2626 log_assert(sldns_buffer_remaining(c->doq_socket->pkt_buf) > 0); 2627 if(!doq_recv(c, &paddr, &pkt_continue, &pi)) { 2628 if(pkt_continue) 2629 continue; 2630 break; 2631 } 2632 2633 /* handle incoming packet from remote addr to localaddr */ 2634 if(verbosity >= VERB_ALGO) { 2635 char remotestr[256], localstr[256]; 2636 addr_to_str((void*)&paddr.addr, paddr.addrlen, 2637 remotestr, sizeof(remotestr)); 2638 addr_to_str((void*)&paddr.localaddr, 2639 paddr.localaddrlen, localstr, 2640 sizeof(localstr)); 2641 log_info("incoming doq packet from %s port %d on " 2642 "%s port %d ifindex %d", 2643 remotestr, doq_sockaddr_get_port(&paddr.addr), 2644 localstr, 2645 doq_sockaddr_get_port(&paddr.localaddr), 2646 paddr.ifindex); 2647 log_info("doq_recv length %d ecn 0x%x", 2648 (int)sldns_buffer_limit(c->doq_socket->pkt_buf), 2649 (int)pi.ecn); 2650 } 2651 2652 if(sldns_buffer_limit(c->doq_socket->pkt_buf) == 0) 2653 continue; 2654 2655 conn = NULL; 2656 if(!doq_decode_pkt_header_negotiate(c, &paddr, &conn)) 2657 continue; 2658 if(!conn) { 2659 if(!doq_accept(c, &paddr, &conn, &pi)) 2660 continue; 2661 if(!doq_conn_write_streams(c, conn, NULL)) { 2662 doq_delete_connection(c, conn); 2663 continue; 2664 } 2665 doq_done_setup_timer_and_write(c, conn); 2666 continue; 2667 } 2668 if( 2669 #ifdef HAVE_NGTCP2_CONN_IN_CLOSING_PERIOD 2670 ngtcp2_conn_in_closing_period(conn->conn) 2671 #else 2672 ngtcp2_conn_is_in_closing_period(conn->conn) 2673 #endif 2674 ) { 2675 if(!doq_conn_send_close(c, conn)) { 2676 doq_delete_connection(c, conn); 2677 } else { 2678 doq_done_setup_timer_and_write(c, conn); 2679 } 2680 continue; 2681 } 2682 if( 2683 #ifdef HAVE_NGTCP2_CONN_IN_DRAINING_PERIOD 2684 ngtcp2_conn_in_draining_period(conn->conn) 2685 #else 2686 ngtcp2_conn_is_in_draining_period(conn->conn) 2687 #endif 2688 ) { 2689 doq_done_setup_timer_and_write(c, conn); 2690 continue; 2691 } 2692 if(!doq_conn_recv(c, &paddr, conn, &pi, NULL, &err_drop)) { 2693 /* The receive failed, and if it also failed to send 2694 * a close, drop the connection. That means it is not 2695 * in the closing period. */ 2696 if(err_drop) { 2697 doq_delete_connection(c, conn); 2698 } else { 2699 doq_done_setup_timer_and_write(c, conn); 2700 } 2701 continue; 2702 } 2703 if(!doq_conn_write_streams(c, conn, &err_drop)) { 2704 if(err_drop) { 2705 doq_delete_connection(c, conn); 2706 } else { 2707 doq_done_setup_timer_and_write(c, conn); 2708 } 2709 continue; 2710 } 2711 doq_done_setup_timer_and_write(c, conn); 2712 } 2713 2714 /* see if we want to have more write events */ 2715 verbose(VERB_ALGO, "doq check write enable"); 2716 if(doq_socket_want_write(c)) 2717 doq_socket_write_enable(c); 2718 else doq_socket_write_disable(c); 2719 doq_pickup_timer(c); 2720 } 2721 2722 /** create new doq server socket structure */ 2723 static struct doq_server_socket* 2724 doq_server_socket_create(struct doq_table* table, struct ub_randstate* rnd, 2725 const void* quic_sslctx, struct comm_point* c, struct comm_base* base, 2726 struct config_file* cfg) 2727 { 2728 size_t doq_buffer_size = 4096; /* bytes buffer size, for one packet. */ 2729 struct doq_server_socket* doq_socket; 2730 log_assert(table != NULL); 2731 doq_socket = calloc(1, sizeof(*doq_socket)); 2732 if(!doq_socket) { 2733 return NULL; 2734 } 2735 doq_socket->table = table; 2736 doq_socket->rnd = rnd; 2737 doq_socket->validate_addr = 1; 2738 /* the doq_socket has its own copy of the static secret, as 2739 * well as other config values, so that they do not need table.lock */ 2740 doq_socket->static_secret_len = table->static_secret_len; 2741 doq_socket->static_secret = memdup(table->static_secret, 2742 table->static_secret_len); 2743 if(!doq_socket->static_secret) { 2744 free(doq_socket); 2745 return NULL; 2746 } 2747 doq_socket->ctx = (SSL_CTX*)quic_sslctx; 2748 doq_socket->idle_timeout = table->idle_timeout; 2749 doq_socket->sv_scidlen = table->sv_scidlen; 2750 doq_socket->cp = c; 2751 doq_socket->pkt_buf = sldns_buffer_new(doq_buffer_size); 2752 if(!doq_socket->pkt_buf) { 2753 free(doq_socket->static_secret); 2754 free(doq_socket); 2755 return NULL; 2756 } 2757 doq_socket->blocked_pkt = sldns_buffer_new( 2758 sldns_buffer_capacity(doq_socket->pkt_buf)); 2759 if(!doq_socket->pkt_buf) { 2760 free(doq_socket->static_secret); 2761 sldns_buffer_free(doq_socket->pkt_buf); 2762 free(doq_socket); 2763 return NULL; 2764 } 2765 doq_socket->blocked_paddr = calloc(1, 2766 sizeof(*doq_socket->blocked_paddr)); 2767 if(!doq_socket->blocked_paddr) { 2768 free(doq_socket->static_secret); 2769 sldns_buffer_free(doq_socket->pkt_buf); 2770 sldns_buffer_free(doq_socket->blocked_pkt); 2771 free(doq_socket); 2772 return NULL; 2773 } 2774 doq_socket->timer = comm_timer_create(base, doq_timer_cb, doq_socket); 2775 if(!doq_socket->timer) { 2776 free(doq_socket->static_secret); 2777 sldns_buffer_free(doq_socket->pkt_buf); 2778 sldns_buffer_free(doq_socket->blocked_pkt); 2779 free(doq_socket->blocked_paddr); 2780 free(doq_socket); 2781 return NULL; 2782 } 2783 doq_socket->marked_time = 0; 2784 comm_base_timept(base, &doq_socket->now_tt, &doq_socket->now_tv); 2785 doq_socket->cfg = cfg; 2786 return doq_socket; 2787 } 2788 2789 /** delete doq server socket structure */ 2790 static void 2791 doq_server_socket_delete(struct doq_server_socket* doq_socket) 2792 { 2793 if(!doq_socket) 2794 return; 2795 free(doq_socket->static_secret); 2796 #ifndef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_SERVER_CONTEXT 2797 free(doq_socket->quic_method); 2798 #endif 2799 sldns_buffer_free(doq_socket->pkt_buf); 2800 sldns_buffer_free(doq_socket->blocked_pkt); 2801 free(doq_socket->blocked_paddr); 2802 comm_timer_delete(doq_socket->timer); 2803 free(doq_socket); 2804 } 2805 2806 /** find repinfo in the doq table */ 2807 static struct doq_conn* 2808 doq_lookup_repinfo(struct doq_table* table, struct comm_reply* repinfo) 2809 { 2810 struct doq_conn* conn; 2811 struct doq_conn_key key; 2812 log_assert(table != NULL); 2813 doq_conn_key_from_repinfo(&key, repinfo); 2814 lock_rw_rdlock(&table->lock); 2815 conn = doq_conn_find(table, &key.paddr.addr, 2816 key.paddr.addrlen, &key.paddr.localaddr, 2817 key.paddr.localaddrlen, key.paddr.ifindex, key.dcid, 2818 key.dcidlen); 2819 if(conn) { 2820 lock_basic_lock(&conn->lock); 2821 lock_rw_unlock(&table->lock); 2822 return conn; 2823 } 2824 lock_rw_unlock(&table->lock); 2825 return NULL; 2826 } 2827 2828 /** doq find connection and stream. From inside callbacks from worker. */ 2829 static int 2830 doq_lookup_conn_stream(struct comm_reply* repinfo, struct comm_point* c, 2831 struct doq_conn** conn, struct doq_stream** stream) 2832 { 2833 log_assert(c->doq_socket); 2834 if(c->doq_socket->current_conn) { 2835 *conn = c->doq_socket->current_conn; 2836 } else { 2837 *conn = doq_lookup_repinfo(c->doq_socket->table, repinfo); 2838 if((*conn) && (*conn)->is_deleted) { 2839 lock_basic_unlock(&(*conn)->lock); 2840 *conn = NULL; 2841 } 2842 if(*conn) { 2843 (*conn)->doq_socket = c->doq_socket; 2844 } 2845 } 2846 if(!*conn) { 2847 *stream = NULL; 2848 return 0; 2849 } 2850 *stream = doq_stream_find(*conn, repinfo->doq_streamid); 2851 if(!*stream) { 2852 if(!c->doq_socket->current_conn) { 2853 /* Not inside callbacks, we have our own lock on conn. 2854 * Release it. */ 2855 lock_basic_unlock(&(*conn)->lock); 2856 } 2857 return 0; 2858 } 2859 if((*stream)->is_closed) { 2860 /* stream is closed, ignore reply or drop */ 2861 if(!c->doq_socket->current_conn) { 2862 /* Not inside callbacks, we have our own lock on conn. 2863 * Release it. */ 2864 lock_basic_unlock(&(*conn)->lock); 2865 } 2866 return 0; 2867 } 2868 return 1; 2869 } 2870 2871 /** doq send a reply from a comm reply */ 2872 static void 2873 doq_socket_send_reply(struct comm_reply* repinfo) 2874 { 2875 struct doq_conn* conn; 2876 struct doq_stream* stream; 2877 log_assert(repinfo->c->type == comm_doq); 2878 if(!doq_lookup_conn_stream(repinfo, repinfo->c, &conn, &stream)) { 2879 verbose(VERB_ALGO, "doq: send_reply but %s is gone", 2880 (conn?"stream":"connection")); 2881 /* No stream, it may have been closed. */ 2882 /* Drop the reply, it cannot be sent. */ 2883 return; 2884 } 2885 if(!doq_stream_send_reply(conn, stream, repinfo->c->buffer)) 2886 doq_stream_close(conn, stream, 1); 2887 if(!repinfo->c->doq_socket->current_conn) { 2888 /* Not inside callbacks, we have our own lock on conn. 2889 * Release it. */ 2890 doq_done_with_conn_cb(repinfo->c, conn); 2891 /* since we sent a reply, or closed it, the assumption is 2892 * that there is something to write, so enable write event. 2893 * It waits until the write event happens to write the 2894 * streams with answers, this allows some answers to be 2895 * answered before the event loop reaches the doq fd, in 2896 * repinfo->c->fd, and that collates answers. That would 2897 * not happen if we write doq packets right now. */ 2898 doq_socket_write_enable(repinfo->c); 2899 } 2900 } 2901 2902 /** doq drop a reply from a comm reply */ 2903 static void 2904 doq_socket_drop_reply(struct comm_reply* repinfo) 2905 { 2906 struct doq_conn* conn; 2907 struct doq_stream* stream; 2908 log_assert(repinfo->c->type == comm_doq); 2909 if(!doq_lookup_conn_stream(repinfo, repinfo->c, &conn, &stream)) { 2910 verbose(VERB_ALGO, "doq: drop_reply but %s is gone", 2911 (conn?"stream":"connection")); 2912 /* The connection or stream is already gone. */ 2913 return; 2914 } 2915 doq_stream_close(conn, stream, 1); 2916 if(!repinfo->c->doq_socket->current_conn) { 2917 /* Not inside callbacks, we have our own lock on conn. 2918 * Release it. */ 2919 doq_done_with_conn_cb(repinfo->c, conn); 2920 doq_socket_write_enable(repinfo->c); 2921 } 2922 } 2923 #endif /* HAVE_NGTCP2 */ 2924 2925 int adjusted_tcp_timeout(struct comm_point* c) 2926 { 2927 if(c->tcp_timeout_msec < TCP_QUERY_TIMEOUT_MINIMUM) 2928 return TCP_QUERY_TIMEOUT_MINIMUM; 2929 return c->tcp_timeout_msec; 2930 } 2931 2932 /** Use a new tcp handler for new query fd, set to read query */ 2933 static void 2934 setup_tcp_handler(struct comm_point* c, int fd, int cur, int max) 2935 { 2936 int handler_usage; 2937 log_assert(c->type == comm_tcp || c->type == comm_http); 2938 log_assert(c->fd == -1); 2939 sldns_buffer_clear(c->buffer); 2940 #ifdef USE_DNSCRYPT 2941 if (c->dnscrypt) 2942 sldns_buffer_clear(c->dnscrypt_buffer); 2943 #endif 2944 c->tcp_is_reading = 1; 2945 c->tcp_byte_count = 0; 2946 c->tcp_keepalive = 0; 2947 /* reset to configured value before applying load-based reduction */ 2948 c->tcp_timeout_msec = c->tcp_parent->tcp_timeout_msec; 2949 /* if more than half the tcp handlers are in use, use a shorter 2950 * timeout for this TCP connection, we need to make space for 2951 * other connections to be able to get attention */ 2952 /* If > 50% TCP handler structures in use, set timeout to 1/100th 2953 * configured value. 2954 * If > 65%TCP handler structures in use, set to 1/500th configured 2955 * value. 2956 * If > 80% TCP handler structures in use, set to 0. 2957 * 2958 * If the timeout to use falls below 200 milliseconds, an actual 2959 * timeout of 200ms is used. 2960 */ 2961 handler_usage = (cur * 100) / max; 2962 if(handler_usage > 50 && handler_usage <= 65) 2963 c->tcp_timeout_msec /= 100; 2964 else if (handler_usage > 65 && handler_usage <= 80) 2965 c->tcp_timeout_msec /= 500; 2966 else if (handler_usage > 80) 2967 c->tcp_timeout_msec = 0; 2968 comm_point_start_listening(c, fd, adjusted_tcp_timeout(c)); 2969 } 2970 2971 void comm_base_handle_slow_accept(int ATTR_UNUSED(fd), 2972 short ATTR_UNUSED(event), void* arg) 2973 { 2974 struct comm_base* b = (struct comm_base*)arg; 2975 /* timeout for the slow accept, re-enable accepts again */ 2976 if(b->start_accept) { 2977 verbose(VERB_ALGO, "wait is over, slow accept disabled"); 2978 fptr_ok(fptr_whitelist_start_accept(b->start_accept)); 2979 (*b->start_accept)(b->cb_arg); 2980 b->eb->slow_accept_enabled = 0; 2981 } 2982 } 2983 2984 /** out of resources in the accept path: pause all listening for 2985 * NETEVENT_SLOW_ACCEPT_TIME and re-arm via comm_base_handle_slow_accept. 2986 * 2987 * If the routine fails, the socket is accepted and then closed, draining it 2988 * from the waiting list of connections to be accepted. 2989 * @param c: the comm point that is a listening socket. 2990 * @param msec: if 0: uses the slow accept time. Otherwise, sets the time 2991 * to wait. 2992 */ 2993 static void 2994 comm_point_slow_accept(struct comm_point* c, int msec) 2995 { 2996 struct comm_base* b = c->ev->base; 2997 struct timeval tv; 2998 struct ub_event* slowev; 2999 if(!b->stop_accept) 3000 return; 3001 if(b->eb->slow_accept_enabled) 3002 return; 3003 /* Allocate the event */ 3004 slowev = ub_event_new(b->eb->base, -1, UB_EV_TIMEOUT, 3005 comm_base_handle_slow_accept, b); 3006 if(!slowev) { 3007 /* The slow accept was not enabled yet, to handle 3008 * the allocation failure, instead drain the incoming 3009 * connection. */ 3010 int new_fd = accept(c->fd, NULL, NULL); 3011 if(new_fd != -1) { 3012 verbose(VERB_ALGO, "slow accept: event_new failed, " 3013 "drop connection"); 3014 sock_close(new_fd); 3015 } 3016 return; 3017 } 3018 ub_comm_base_now(b); 3019 if(b->eb->last_slow_log+SLOW_LOG_TIME <= b->eb->secs) { 3020 b->eb->last_slow_log = b->eb->secs; 3021 verbose(VERB_OPS, "out of resources on accept, " 3022 "slow down accept for %d msec", 3023 NETEVENT_SLOW_ACCEPT_TIME); 3024 } 3025 b->eb->slow_accept_enabled = 1; 3026 fptr_ok(fptr_whitelist_stop_accept(b->stop_accept)); 3027 (*b->stop_accept)(b->cb_arg); 3028 /* set timeout, no mallocs */ 3029 if(msec == 0) 3030 msec = NETEVENT_SLOW_ACCEPT_TIME; 3031 tv.tv_sec = msec/1000; 3032 tv.tv_usec = (msec%1000)*1000; 3033 b->eb->slow_accept = slowev; 3034 if(ub_event_add(b->eb->slow_accept, &tv) != 0) { 3035 /* we do not want to log here, 3036 * error: "event_add failed." */ 3037 } 3038 } 3039 3040 int comm_point_perform_accept(struct comm_point* c, 3041 struct sockaddr_storage* addr, socklen_t* addrlen) 3042 { 3043 int new_fd; 3044 *addrlen = (socklen_t)sizeof(*addr); 3045 #ifndef HAVE_ACCEPT4 3046 new_fd = accept(c->fd, (struct sockaddr*)addr, addrlen); 3047 #else 3048 /* SOCK_NONBLOCK saves extra calls to fcntl for the same result */ 3049 new_fd = accept4(c->fd, (struct sockaddr*)addr, addrlen, SOCK_NONBLOCK); 3050 #endif 3051 if(new_fd == -1) { 3052 #ifndef USE_WINSOCK 3053 /* EINTR is signal interrupt. others are closed connection. */ 3054 if( errno == EINTR || errno == EAGAIN 3055 #ifdef EWOULDBLOCK 3056 || errno == EWOULDBLOCK 3057 #endif 3058 #ifdef ECONNABORTED 3059 || errno == ECONNABORTED 3060 #endif 3061 #ifdef EPROTO 3062 || errno == EPROTO 3063 #endif /* EPROTO */ 3064 ) 3065 return -1; 3066 #if defined(ENFILE) && defined(EMFILE) 3067 if(errno == ENFILE || errno == EMFILE) { 3068 /* out of file descriptors, likely outside of our 3069 * control. stop accept() calls for some time */ 3070 if(c->ev->base->stop_accept) { 3071 struct comm_base* b = c->ev->base; 3072 struct timeval tv; 3073 struct ub_event* slowev = ub_event_new( 3074 b->eb->base, -1, UB_EV_TIMEOUT, 3075 comm_base_handle_slow_accept, b); 3076 if(!slowev) { 3077 verbose(VERB_ALGO, "slow accept: " 3078 "event_new failed"); 3079 return -1; 3080 } 3081 verbose(VERB_ALGO, "out of file descriptors: " 3082 "slow accept"); 3083 ub_comm_base_now(b); 3084 if(b->eb->last_slow_log+SLOW_LOG_TIME <= 3085 b->eb->secs) { 3086 b->eb->last_slow_log = b->eb->secs; 3087 verbose(VERB_OPS, "accept failed, " 3088 "slow down accept for %d " 3089 "msec: %s", 3090 NETEVENT_SLOW_ACCEPT_TIME, 3091 sock_strerror(errno)); 3092 } 3093 b->eb->slow_accept_enabled = 1; 3094 fptr_ok(fptr_whitelist_stop_accept( 3095 b->stop_accept)); 3096 (*b->stop_accept)(b->cb_arg); 3097 /* set timeout, no mallocs */ 3098 tv.tv_sec = NETEVENT_SLOW_ACCEPT_TIME/1000; 3099 tv.tv_usec = (NETEVENT_SLOW_ACCEPT_TIME%1000)*1000; 3100 b->eb->slow_accept = slowev; 3101 if(ub_event_add(b->eb->slow_accept, &tv) 3102 != 0) { 3103 /* we do not want to log here, 3104 * error: "event_add failed." */ 3105 } 3106 } else { 3107 log_err("accept, with no slow down, " 3108 "failed: %s", sock_strerror(errno)); 3109 } 3110 return -1; 3111 } 3112 #endif 3113 #else /* USE_WINSOCK */ 3114 if(WSAGetLastError() == WSAEINPROGRESS || 3115 WSAGetLastError() == WSAECONNRESET) 3116 return -1; 3117 if(WSAGetLastError() == WSAEWOULDBLOCK) { 3118 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ); 3119 return -1; 3120 } 3121 #endif 3122 log_err_addr("accept failed", sock_strerror(errno), addr, 3123 *addrlen); 3124 return -1; 3125 } 3126 if(c->tcp_conn_limit && c->type == comm_tcp_accept) { 3127 c->tcl_addr = tcl_addr_lookup(c->tcp_conn_limit, addr, *addrlen); 3128 if(!tcl_new_connection(c->tcl_addr)) { 3129 if(verbosity >= 3) 3130 log_err_addr("accept rejected", 3131 "connection limit exceeded", addr, *addrlen); 3132 sock_close(new_fd); 3133 return -1; 3134 } 3135 } 3136 #ifndef HAVE_ACCEPT4 3137 fd_set_nonblock(new_fd); 3138 #endif 3139 return new_fd; 3140 } 3141 3142 #ifdef USE_WINSOCK 3143 static long win_bio_cb(BIO *b, int oper, const char* ATTR_UNUSED(argp), 3144 #ifdef HAVE_BIO_SET_CALLBACK_EX 3145 size_t ATTR_UNUSED(len), 3146 #endif 3147 int ATTR_UNUSED(argi), long argl, 3148 #ifndef HAVE_BIO_SET_CALLBACK_EX 3149 long retvalue 3150 #else 3151 int retvalue, size_t* ATTR_UNUSED(processed) 3152 #endif 3153 ) 3154 { 3155 int wsa_err = WSAGetLastError(); /* store errcode before it is gone */ 3156 verbose(VERB_ALGO, "bio_cb %d, %s %s %s", oper, 3157 (oper&BIO_CB_RETURN)?"return":"before", 3158 (oper&BIO_CB_READ)?"read":((oper&BIO_CB_WRITE)?"write":"other"), 3159 wsa_err==WSAEWOULDBLOCK?"wsawb":""); 3160 /* on windows, check if previous operation caused EWOULDBLOCK */ 3161 if( (oper == (BIO_CB_READ|BIO_CB_RETURN) && argl == 0) || 3162 (oper == (BIO_CB_GETS|BIO_CB_RETURN) && argl == 0)) { 3163 if(wsa_err == WSAEWOULDBLOCK) 3164 ub_winsock_tcp_wouldblock((struct ub_event*) 3165 BIO_get_callback_arg(b), UB_EV_READ); 3166 } 3167 if( (oper == (BIO_CB_WRITE|BIO_CB_RETURN) && argl == 0) || 3168 (oper == (BIO_CB_PUTS|BIO_CB_RETURN) && argl == 0)) { 3169 if(wsa_err == WSAEWOULDBLOCK) 3170 ub_winsock_tcp_wouldblock((struct ub_event*) 3171 BIO_get_callback_arg(b), UB_EV_WRITE); 3172 } 3173 /* return original return value */ 3174 return retvalue; 3175 } 3176 3177 /** set win bio callbacks for nonblocking operations */ 3178 void 3179 comm_point_tcp_win_bio_cb(struct comm_point* c, void* thessl) 3180 { 3181 SSL* ssl = (SSL*)thessl; 3182 /* set them both just in case, but usually they are the same BIO */ 3183 #ifdef HAVE_BIO_SET_CALLBACK_EX 3184 BIO_set_callback_ex(SSL_get_rbio(ssl), &win_bio_cb); 3185 #else 3186 BIO_set_callback(SSL_get_rbio(ssl), &win_bio_cb); 3187 #endif 3188 BIO_set_callback_arg(SSL_get_rbio(ssl), (char*)c->ev->ev); 3189 #ifdef HAVE_BIO_SET_CALLBACK_EX 3190 BIO_set_callback_ex(SSL_get_wbio(ssl), &win_bio_cb); 3191 #else 3192 BIO_set_callback(SSL_get_wbio(ssl), &win_bio_cb); 3193 #endif 3194 BIO_set_callback_arg(SSL_get_wbio(ssl), (char*)c->ev->ev); 3195 } 3196 #endif 3197 3198 #ifdef HAVE_NGHTTP2 3199 /** Create http2 session server. Per connection, after TCP accepted.*/ 3200 static int http2_session_server_create(struct http2_session* h2_session) 3201 { 3202 log_assert(h2_session->callbacks); 3203 h2_session->is_drop = 0; 3204 if(nghttp2_session_server_new(&h2_session->session, 3205 h2_session->callbacks, 3206 h2_session) == NGHTTP2_ERR_NOMEM) { 3207 log_err("failed to create nghttp2 session server"); 3208 return 0; 3209 } 3210 3211 return 1; 3212 } 3213 3214 /** Submit http2 setting to session. Once per session. */ 3215 static int http2_submit_settings(struct http2_session* h2_session) 3216 { 3217 int ret; 3218 nghttp2_settings_entry settings[1] = { 3219 {NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS, 3220 h2_session->c->http2_max_streams}}; 3221 3222 ret = nghttp2_submit_settings(h2_session->session, NGHTTP2_FLAG_NONE, 3223 settings, 1); 3224 if(ret) { 3225 verbose(VERB_QUERY, "http2: submit_settings failed, " 3226 "error: %s", nghttp2_strerror(ret)); 3227 return 0; 3228 } 3229 return 1; 3230 } 3231 #endif /* HAVE_NGHTTP2 */ 3232 3233 /** Clear http2 stream mesh states */ 3234 static void http2_session_clear_meshstate(struct http2_session* h2_session) 3235 { 3236 #ifdef HAVE_NGHTTP2 3237 /* Since the session gets closed, remove the mesh state references. */ 3238 struct http2_stream* h2_stream; 3239 for(h2_stream = h2_session->first_stream; h2_stream; 3240 h2_stream = h2_stream->next) { 3241 if(h2_stream->mesh_state) { 3242 mesh_state_remove_reply(h2_stream->mesh, 3243 h2_stream->mesh_state, h2_session->c, 3244 h2_stream, NULL); 3245 h2_stream->mesh_state = NULL; 3246 } 3247 } 3248 #else 3249 (void)h2_session; 3250 #endif /* HAVE_NGHTTP2 */ 3251 } 3252 3253 #ifdef HAVE_NGHTTP2 3254 /** Delete http2 stream. After session delete or stream close callback */ 3255 static void http2_stream_delete(struct http2_session* h2_session, 3256 struct http2_stream* h2_stream) 3257 { 3258 if(h2_stream->mesh_state) { 3259 mesh_state_remove_reply(h2_stream->mesh, h2_stream->mesh_state, 3260 h2_session->c, h2_stream, NULL); 3261 h2_stream->mesh_state = NULL; 3262 } 3263 http2_req_stream_clear(h2_stream); 3264 free(h2_stream); 3265 } 3266 #endif /* HAVE_NGHTTP2 */ 3267 3268 /** delete http2 session server. After closing connection. */ 3269 static void http2_session_server_delete(struct http2_session* h2_session) 3270 { 3271 #ifdef HAVE_NGHTTP2 3272 struct http2_stream* h2_stream, *next; 3273 nghttp2_session_del(h2_session->session); /* NULL input is fine */ 3274 h2_session->session = NULL; 3275 for(h2_stream = h2_session->first_stream; h2_stream;) { 3276 next = h2_stream->next; 3277 http2_stream_delete(h2_session, h2_stream); 3278 h2_stream = next; 3279 } 3280 h2_session->first_stream = NULL; 3281 h2_session->is_drop = 0; 3282 h2_session->postpone_drop = 0; 3283 h2_session->c->h2_stream = NULL; 3284 #endif 3285 (void)h2_session; 3286 } 3287 3288 void 3289 comm_point_tcp_accept_callback(int fd, short event, void* arg) 3290 { 3291 struct comm_point* c = (struct comm_point*)arg, *c_hdl; 3292 int new_fd; 3293 log_assert(c->type == comm_tcp_accept); 3294 if(!(event & UB_EV_READ)) { 3295 log_info("ignoring tcp accept event %d", (int)event); 3296 return; 3297 } 3298 ub_comm_base_now(c->ev->base); 3299 /* find free tcp handler. */ 3300 if(!c->tcp_free) { 3301 log_warn("accepted too many tcp, connections full"); 3302 /* Wait for a short moment (say 50msec) so that other 3303 * TCP connections can complete. Or timeout, at the busy 3304 * timeout of about 200msec. That stops this routine from 3305 * spinning endlessly, and gives time to complete the other 3306 * requests. But it is not as slow as the 2000msec wait 3307 * time for when the kernel is out of buffers. */ 3308 comm_point_slow_accept(c, NETEVENT_SLOW_ACCEPT_QUEUE_TIME); 3309 return; 3310 } 3311 /* accept incoming connection. */ 3312 c_hdl = c->tcp_free; 3313 /* Should not happen: inconsistent tcp_free state in 3314 * accept_callback. */ 3315 log_assert(c_hdl->is_in_tcp_free); 3316 /* clear leftover flags from previous use, and then set the 3317 * correct event base for the event structure for libevent */ 3318 ub_event_free(c_hdl->ev->ev); 3319 c_hdl->ev->ev = NULL; 3320 if((c_hdl->type == comm_tcp && c_hdl->tcp_req_info) || 3321 c_hdl->type == comm_local || c_hdl->type == comm_raw) 3322 c_hdl->tcp_do_toggle_rw = 0; 3323 else c_hdl->tcp_do_toggle_rw = 1; 3324 3325 if(c_hdl->type == comm_http) { 3326 #ifdef HAVE_NGHTTP2 3327 if(!c_hdl->h2_session || 3328 !http2_session_server_create(c_hdl->h2_session)) { 3329 log_warn("failed to create nghttp2"); 3330 comm_point_slow_accept(c, 0); 3331 return; 3332 } 3333 if(!c_hdl->h2_session || 3334 !http2_submit_settings(c_hdl->h2_session)) { 3335 log_warn("failed to submit http2 settings"); 3336 if(c_hdl->h2_session) 3337 http2_session_server_delete(c_hdl->h2_session); 3338 comm_point_slow_accept(c, 0); 3339 return; 3340 } 3341 if(!c->ssl) { 3342 c_hdl->tcp_do_toggle_rw = 0; 3343 c_hdl->use_h2 = 1; 3344 } 3345 #endif 3346 c_hdl->ev->ev = ub_event_new(c_hdl->ev->base->eb->base, -1, 3347 UB_EV_PERSIST | UB_EV_READ | UB_EV_TIMEOUT, 3348 comm_point_http_handle_callback, c_hdl); 3349 } else { 3350 c_hdl->ev->ev = ub_event_new(c_hdl->ev->base->eb->base, -1, 3351 UB_EV_PERSIST | UB_EV_READ | UB_EV_TIMEOUT, 3352 comm_point_tcp_handle_callback, c_hdl); 3353 } 3354 if(!c_hdl->ev->ev) { 3355 log_warn("could not ub_event_new, for new tcp"); 3356 #ifdef HAVE_NGHTTP2 3357 if(c_hdl->type == comm_http && c_hdl->h2_session) 3358 http2_session_server_delete(c_hdl->h2_session); 3359 #endif 3360 comm_point_slow_accept(c, 0); 3361 return; 3362 } 3363 log_assert(fd != -1); 3364 (void)fd; 3365 new_fd = comm_point_perform_accept(c, &c_hdl->repinfo.remote_addr, 3366 &c_hdl->repinfo.remote_addrlen); 3367 if(new_fd == -1) { 3368 #ifdef HAVE_NGHTTP2 3369 if(c_hdl->type == comm_http && c_hdl->h2_session) 3370 http2_session_server_delete(c_hdl->h2_session); 3371 #endif 3372 return; 3373 } 3374 /* move per-netblock TCP-connection-limit handle to the handler so that 3375 * comm_point_close() on the handler decrements the count on close */ 3376 c_hdl->tcl_addr = c->tcl_addr; 3377 c->tcl_addr = NULL; 3378 /* Copy remote_address to client_address. 3379 * Simplest way/time for streams to do that. */ 3380 c_hdl->repinfo.client_addrlen = c_hdl->repinfo.remote_addrlen; 3381 memmove(&c_hdl->repinfo.client_addr, 3382 &c_hdl->repinfo.remote_addr, 3383 c_hdl->repinfo.remote_addrlen); 3384 if(c->ssl) { 3385 c_hdl->ssl = incoming_ssl_fd(c->ssl, new_fd); 3386 if(!c_hdl->ssl) { 3387 c_hdl->fd = new_fd; 3388 comm_point_close(c_hdl); 3389 return; 3390 } 3391 c_hdl->ssl_shake_state = comm_ssl_shake_read; 3392 #ifdef USE_WINSOCK 3393 comm_point_tcp_win_bio_cb(c_hdl, c_hdl->ssl); 3394 #endif 3395 } 3396 3397 /* Paranoia: Check that the state has not changed from above: */ 3398 /* Should not happen: tcp_free state changed within accept_callback. */ 3399 log_assert(c_hdl == c->tcp_free); 3400 log_assert(c_hdl->is_in_tcp_free); 3401 /* grab the tcp handler buffers */ 3402 c->cur_tcp_count++; 3403 c->tcp_free = c_hdl->tcp_free; 3404 c_hdl->tcp_free = NULL; 3405 c_hdl->is_in_tcp_free = 0; 3406 if(!c->tcp_free) { 3407 /* stop accepting incoming queries for now. */ 3408 comm_point_stop_listening(c); 3409 } 3410 setup_tcp_handler(c_hdl, new_fd, c->cur_tcp_count, c->max_tcp_count); 3411 } 3412 3413 /** Make tcp handler free for next assignment */ 3414 static void 3415 reclaim_tcp_handler(struct comm_point* c) 3416 { 3417 log_assert(c->type == comm_tcp); 3418 if(c->ssl) { 3419 #ifdef HAVE_SSL 3420 SSL_shutdown(c->ssl); 3421 SSL_free(c->ssl); 3422 c->ssl = NULL; 3423 #endif 3424 } 3425 comm_point_close(c); 3426 if(c->tcp_parent && !c->is_in_tcp_free) { 3427 /* Should not happen: bad tcp_free state in reclaim_tcp. */ 3428 log_assert(c->tcp_free == NULL); 3429 log_assert(c->tcp_parent->cur_tcp_count > 0); 3430 c->tcp_parent->cur_tcp_count--; 3431 c->tcp_free = c->tcp_parent->tcp_free; 3432 c->tcp_parent->tcp_free = c; 3433 c->is_in_tcp_free = 1; 3434 if(!c->tcp_free) { 3435 /* re-enable listening on accept socket */ 3436 comm_point_start_listening(c->tcp_parent, -1, -1); 3437 } 3438 } 3439 c->tcp_more_read_again = NULL; 3440 c->tcp_more_write_again = NULL; 3441 c->tcp_byte_count = 0; 3442 c->pp2_header_state = pp2_header_none; 3443 sldns_buffer_clear(c->buffer); 3444 } 3445 3446 /** do the callback when writing is done */ 3447 static void 3448 tcp_callback_writer(struct comm_point* c) 3449 { 3450 log_assert(c->type == comm_tcp); 3451 if(!c->tcp_write_and_read) { 3452 sldns_buffer_clear(c->buffer); 3453 c->tcp_byte_count = 0; 3454 } 3455 if(c->tcp_do_toggle_rw) 3456 c->tcp_is_reading = 1; 3457 /* switch from listening(write) to listening(read) */ 3458 if(c->tcp_req_info) { 3459 tcp_req_info_handle_writedone(c->tcp_req_info); 3460 } else { 3461 comm_point_stop_listening(c); 3462 if(c->tcp_write_and_read) { 3463 fptr_ok(fptr_whitelist_comm_point(c->callback)); 3464 if( (*c->callback)(c, c->cb_arg, NETEVENT_PKT_WRITTEN, 3465 &c->repinfo) ) { 3466 comm_point_start_listening(c, -1, 3467 adjusted_tcp_timeout(c)); 3468 } 3469 } else { 3470 comm_point_start_listening(c, -1, 3471 adjusted_tcp_timeout(c)); 3472 } 3473 } 3474 } 3475 3476 /** do the callback when reading is done */ 3477 static void 3478 tcp_callback_reader(struct comm_point* c) 3479 { 3480 log_assert(c->type == comm_tcp || c->type == comm_local); 3481 sldns_buffer_flip(c->buffer); 3482 if(c->tcp_do_toggle_rw) 3483 c->tcp_is_reading = 0; 3484 c->tcp_byte_count = 0; 3485 if(c->tcp_req_info) { 3486 tcp_req_info_handle_readdone(c->tcp_req_info); 3487 } else { 3488 if(c->type == comm_tcp) 3489 comm_point_stop_listening(c); 3490 fptr_ok(fptr_whitelist_comm_point(c->callback)); 3491 if( (*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, &c->repinfo) ) { 3492 comm_point_start_listening(c, -1, 3493 adjusted_tcp_timeout(c)); 3494 } 3495 } 3496 } 3497 3498 #ifdef HAVE_SSL 3499 /** true if the ssl handshake error has to be squelched from the logs */ 3500 int 3501 squelch_err_ssl_handshake(unsigned long err) 3502 { 3503 if(verbosity >= VERB_QUERY) 3504 return 0; /* only squelch on low verbosity */ 3505 if(ERR_GET_LIB(err) == ERR_LIB_SSL && 3506 (ERR_GET_REASON(err) == SSL_R_HTTPS_PROXY_REQUEST || 3507 ERR_GET_REASON(err) == SSL_R_HTTP_REQUEST || 3508 ERR_GET_REASON(err) == SSL_R_WRONG_VERSION_NUMBER || 3509 ERR_GET_REASON(err) == SSL_R_SSLV3_ALERT_BAD_CERTIFICATE 3510 #ifdef SSL_F_TLS_POST_PROCESS_CLIENT_HELLO 3511 || ERR_GET_REASON(err) == SSL_R_NO_SHARED_CIPHER 3512 #endif 3513 #ifdef SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO 3514 || ERR_GET_REASON(err) == SSL_R_UNKNOWN_PROTOCOL 3515 || ERR_GET_REASON(err) == SSL_R_UNSUPPORTED_PROTOCOL 3516 # ifdef SSL_R_VERSION_TOO_LOW 3517 || ERR_GET_REASON(err) == SSL_R_VERSION_TOO_LOW 3518 # endif 3519 #endif 3520 )) 3521 return 1; 3522 return 0; 3523 } 3524 #endif /* HAVE_SSL */ 3525 3526 /** continue ssl handshake */ 3527 #ifdef HAVE_SSL 3528 static int 3529 ssl_handshake(struct comm_point* c) 3530 { 3531 int r; 3532 if(c->ssl_shake_state == comm_ssl_shake_hs_read) { 3533 /* read condition satisfied back to writing */ 3534 comm_point_listen_for_rw(c, 0, 1); 3535 c->ssl_shake_state = comm_ssl_shake_none; 3536 return 1; 3537 } 3538 if(c->ssl_shake_state == comm_ssl_shake_hs_write) { 3539 /* write condition satisfied, back to reading */ 3540 comm_point_listen_for_rw(c, 1, 0); 3541 c->ssl_shake_state = comm_ssl_shake_none; 3542 return 1; 3543 } 3544 3545 ERR_clear_error(); 3546 r = SSL_do_handshake(c->ssl); 3547 if(r != 1) { 3548 int want = SSL_get_error(c->ssl, r); 3549 if(want == SSL_ERROR_WANT_READ) { 3550 if(c->ssl_shake_state == comm_ssl_shake_read) 3551 return 1; 3552 c->ssl_shake_state = comm_ssl_shake_read; 3553 comm_point_listen_for_rw(c, 1, 0); 3554 return 1; 3555 } else if(want == SSL_ERROR_WANT_WRITE) { 3556 if(c->ssl_shake_state == comm_ssl_shake_write) 3557 return 1; 3558 c->ssl_shake_state = comm_ssl_shake_write; 3559 comm_point_listen_for_rw(c, 0, 1); 3560 return 1; 3561 } else if(r == 0) { 3562 return 0; /* closed */ 3563 } else if(want == SSL_ERROR_SYSCALL) { 3564 /* SYSCALL and errno==0 means closed uncleanly */ 3565 #ifdef EPIPE 3566 if(errno == EPIPE && verbosity < 2) 3567 return 0; /* silence 'broken pipe' */ 3568 #endif 3569 #ifdef ECONNRESET 3570 if(errno == ECONNRESET && verbosity < 2) 3571 return 0; /* silence reset by peer */ 3572 #endif 3573 if(!tcp_connect_errno_needs_log( 3574 (struct sockaddr*)&c->repinfo.remote_addr, 3575 c->repinfo.remote_addrlen)) 3576 return 0; /* silence connect failures that 3577 show up because after connect this is the 3578 first system call that accesses the socket */ 3579 if(errno != 0) 3580 log_err("SSL_handshake syscall: %s", 3581 strerror(errno)); 3582 return 0; 3583 } else { 3584 unsigned long err = ERR_get_error(); 3585 if(!squelch_err_ssl_handshake(err)) { 3586 long vr; 3587 log_crypto_err_io_code("ssl handshake failed", 3588 want, err); 3589 if((vr=SSL_get_verify_result(c->ssl)) != 0) 3590 log_err("ssl handshake cert error: %s", 3591 X509_verify_cert_error_string( 3592 vr)); 3593 log_addr(VERB_OPS, "ssl handshake failed", 3594 &c->repinfo.remote_addr, 3595 c->repinfo.remote_addrlen); 3596 } 3597 return 0; 3598 } 3599 } 3600 /* this is where peer verification could take place */ 3601 if((SSL_get_verify_mode(c->ssl)&SSL_VERIFY_PEER)) { 3602 /* verification */ 3603 if(SSL_get_verify_result(c->ssl) == X509_V_OK) { 3604 #ifdef HAVE_SSL_GET1_PEER_CERTIFICATE 3605 X509* x = SSL_get1_peer_certificate(c->ssl); 3606 #else 3607 X509* x = SSL_get_peer_certificate(c->ssl); 3608 #endif 3609 if(!x) { 3610 log_addr(VERB_ALGO, "SSL connection failed: " 3611 "no certificate", 3612 &c->repinfo.remote_addr, 3613 c->repinfo.remote_addrlen); 3614 return 0; 3615 } 3616 log_cert(VERB_ALGO, "peer certificate", x); 3617 #ifdef HAVE_SSL_GET0_PEERNAME 3618 if(SSL_get0_peername(c->ssl)) { 3619 char buf[255]; 3620 snprintf(buf, sizeof(buf), "SSL connection " 3621 "to %s authenticated", 3622 SSL_get0_peername(c->ssl)); 3623 log_addr(VERB_ALGO, buf, &c->repinfo.remote_addr, 3624 c->repinfo.remote_addrlen); 3625 } else { 3626 #endif 3627 log_addr(VERB_ALGO, "SSL connection " 3628 "authenticated", &c->repinfo.remote_addr, 3629 c->repinfo.remote_addrlen); 3630 #ifdef HAVE_SSL_GET0_PEERNAME 3631 } 3632 #endif 3633 X509_free(x); 3634 } else { 3635 #ifdef HAVE_SSL_GET1_PEER_CERTIFICATE 3636 X509* x = SSL_get1_peer_certificate(c->ssl); 3637 #else 3638 X509* x = SSL_get_peer_certificate(c->ssl); 3639 #endif 3640 if(x) { 3641 log_cert(VERB_ALGO, "peer certificate", x); 3642 X509_free(x); 3643 } 3644 log_addr(VERB_ALGO, "SSL connection failed: " 3645 "failed to authenticate", 3646 &c->repinfo.remote_addr, 3647 c->repinfo.remote_addrlen); 3648 return 0; 3649 } 3650 } else { 3651 /* unauthenticated, the verify peer flag was not set 3652 * in c->ssl when the ssl object was created from ssl_ctx */ 3653 log_addr(VERB_ALGO, "SSL connection", &c->repinfo.remote_addr, 3654 c->repinfo.remote_addrlen); 3655 } 3656 3657 #ifdef HAVE_SSL_GET0_ALPN_SELECTED 3658 /* check if http2 use is negotiated */ 3659 if(c->type == comm_http && c->h2_session) { 3660 const unsigned char *alpn; 3661 unsigned int alpnlen = 0; 3662 SSL_get0_alpn_selected(c->ssl, &alpn, &alpnlen); 3663 if(alpnlen == 2 && memcmp("h2", alpn, 2) == 0) { 3664 /* connection upgraded to HTTP2 */ 3665 c->tcp_do_toggle_rw = 0; 3666 c->use_h2 = 1; 3667 } else { 3668 verbose(VERB_ALGO, "client doesn't support HTTP/2"); 3669 return 0; 3670 } 3671 } 3672 #endif 3673 3674 /* setup listen rw correctly */ 3675 if(c->tcp_is_reading) { 3676 if(c->ssl_shake_state != comm_ssl_shake_read) 3677 comm_point_listen_for_rw(c, 1, 0); 3678 } else { 3679 comm_point_listen_for_rw(c, 0, 1); 3680 } 3681 c->ssl_shake_state = comm_ssl_shake_none; 3682 return 1; 3683 } 3684 #endif /* HAVE_SSL */ 3685 3686 /** ssl read callback on TCP */ 3687 static int 3688 ssl_handle_read(struct comm_point* c) 3689 { 3690 #ifdef HAVE_SSL 3691 int r; 3692 if(c->ssl_shake_state != comm_ssl_shake_none) { 3693 if(!ssl_handshake(c)) 3694 return 0; 3695 if(c->ssl_shake_state != comm_ssl_shake_none) 3696 return 1; 3697 } 3698 if(c->pp2_enabled && c->pp2_header_state != pp2_header_done) { 3699 struct pp2_header* header = NULL; 3700 size_t want_read_size = 0; 3701 size_t current_read_size = 0; 3702 if(c->pp2_header_state == pp2_header_none) { 3703 want_read_size = PP2_HEADER_SIZE; 3704 if(sldns_buffer_remaining(c->buffer)<want_read_size) { 3705 log_err_addr("proxy_protocol: not enough " 3706 "buffer size to read PROXYv2 header", "", 3707 &c->repinfo.remote_addr, 3708 c->repinfo.remote_addrlen); 3709 return 0; 3710 } 3711 verbose(VERB_ALGO, "proxy_protocol: reading fixed " 3712 "part of PROXYv2 header (len %lu)", 3713 (unsigned long)want_read_size); 3714 current_read_size = want_read_size; 3715 if(c->tcp_byte_count < current_read_size) { 3716 ERR_clear_error(); 3717 if((r=SSL_read(c->ssl, (void*)sldns_buffer_at( 3718 c->buffer, c->tcp_byte_count), 3719 current_read_size - 3720 c->tcp_byte_count)) <= 0) { 3721 int want = SSL_get_error(c->ssl, r); 3722 if(want == SSL_ERROR_ZERO_RETURN) { 3723 if(c->tcp_req_info) 3724 return tcp_req_info_handle_read_close(c->tcp_req_info); 3725 return 0; /* shutdown, closed */ 3726 } else if(want == SSL_ERROR_WANT_READ) { 3727 #ifdef USE_WINSOCK 3728 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ); 3729 #endif 3730 return 1; /* read more later */ 3731 } else if(want == SSL_ERROR_WANT_WRITE) { 3732 c->ssl_shake_state = comm_ssl_shake_hs_write; 3733 comm_point_listen_for_rw(c, 0, 1); 3734 return 1; 3735 } else if(want == SSL_ERROR_SYSCALL) { 3736 #ifdef ECONNRESET 3737 if(errno == ECONNRESET && verbosity < 2) 3738 return 0; /* silence reset by peer */ 3739 #endif 3740 if(errno != 0) 3741 log_err("SSL_read syscall: %s", 3742 strerror(errno)); 3743 return 0; 3744 } 3745 log_crypto_err_io("could not SSL_read", 3746 want); 3747 return 0; 3748 } 3749 c->tcp_byte_count += r; 3750 sldns_buffer_skip(c->buffer, r); 3751 if(c->tcp_byte_count != current_read_size) return 1; 3752 c->pp2_header_state = pp2_header_init; 3753 } 3754 } 3755 if(c->pp2_header_state == pp2_header_init) { 3756 int err; 3757 err = pp2_read_header( 3758 sldns_buffer_begin(c->buffer), 3759 sldns_buffer_limit(c->buffer)); 3760 if(err) { 3761 log_err("proxy_protocol: could not parse " 3762 "PROXYv2 header (%s)", 3763 pp_lookup_error(err)); 3764 return 0; 3765 } 3766 header = (struct pp2_header*)sldns_buffer_begin(c->buffer); 3767 want_read_size = ntohs(header->len); 3768 if(sldns_buffer_limit(c->buffer) < 3769 PP2_HEADER_SIZE + want_read_size) { 3770 log_err_addr("proxy_protocol: not enough " 3771 "buffer size to read PROXYv2 header", "", 3772 &c->repinfo.remote_addr, 3773 c->repinfo.remote_addrlen); 3774 return 0; 3775 } 3776 verbose(VERB_ALGO, "proxy_protocol: reading variable " 3777 "part of PROXYv2 header (len %lu)", 3778 (unsigned long)want_read_size); 3779 current_read_size = PP2_HEADER_SIZE + want_read_size; 3780 if(want_read_size == 0) { 3781 /* nothing more to read; header is complete */ 3782 c->pp2_header_state = pp2_header_done; 3783 } else if(c->tcp_byte_count < current_read_size) { 3784 ERR_clear_error(); 3785 if((r=SSL_read(c->ssl, (void*)sldns_buffer_at( 3786 c->buffer, c->tcp_byte_count), 3787 current_read_size - 3788 c->tcp_byte_count)) <= 0) { 3789 int want = SSL_get_error(c->ssl, r); 3790 if(want == SSL_ERROR_ZERO_RETURN) { 3791 if(c->tcp_req_info) 3792 return tcp_req_info_handle_read_close(c->tcp_req_info); 3793 return 0; /* shutdown, closed */ 3794 } else if(want == SSL_ERROR_WANT_READ) { 3795 #ifdef USE_WINSOCK 3796 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ); 3797 #endif 3798 return 1; /* read more later */ 3799 } else if(want == SSL_ERROR_WANT_WRITE) { 3800 c->ssl_shake_state = comm_ssl_shake_hs_write; 3801 comm_point_listen_for_rw(c, 0, 1); 3802 return 1; 3803 } else if(want == SSL_ERROR_SYSCALL) { 3804 #ifdef ECONNRESET 3805 if(errno == ECONNRESET && verbosity < 2) 3806 return 0; /* silence reset by peer */ 3807 #endif 3808 if(errno != 0) 3809 log_err("SSL_read syscall: %s", 3810 strerror(errno)); 3811 return 0; 3812 } 3813 log_crypto_err_io("could not SSL_read", 3814 want); 3815 return 0; 3816 } 3817 c->tcp_byte_count += r; 3818 sldns_buffer_skip(c->buffer, r); 3819 if(c->tcp_byte_count != current_read_size) return 1; 3820 c->pp2_header_state = pp2_header_done; 3821 } 3822 } 3823 if(c->pp2_header_state != pp2_header_done || !header) { 3824 log_err_addr("proxy_protocol: wrong state for the " 3825 "PROXYv2 header", "", &c->repinfo.remote_addr, 3826 c->repinfo.remote_addrlen); 3827 return 0; 3828 } 3829 sldns_buffer_flip(c->buffer); 3830 if(!consume_pp2_header(c->buffer, &c->repinfo, 1)) { 3831 log_err_addr("proxy_protocol: could not consume " 3832 "PROXYv2 header", "", &c->repinfo.remote_addr, 3833 c->repinfo.remote_addrlen); 3834 return 0; 3835 } 3836 verbose(VERB_ALGO, "proxy_protocol: successful read of " 3837 "PROXYv2 header"); 3838 /* Clear and reset the buffer to read the following 3839 * DNS packet(s). */ 3840 sldns_buffer_clear(c->buffer); 3841 c->tcp_byte_count = 0; 3842 return 1; 3843 } 3844 if(c->tcp_byte_count < sizeof(uint16_t)) { 3845 /* read length bytes */ 3846 ERR_clear_error(); 3847 if((r=SSL_read(c->ssl, (void*)sldns_buffer_at(c->buffer, 3848 c->tcp_byte_count), (int)(sizeof(uint16_t) - 3849 c->tcp_byte_count))) <= 0) { 3850 int want = SSL_get_error(c->ssl, r); 3851 if(want == SSL_ERROR_ZERO_RETURN) { 3852 if(c->tcp_req_info) 3853 return tcp_req_info_handle_read_close(c->tcp_req_info); 3854 return 0; /* shutdown, closed */ 3855 } else if(want == SSL_ERROR_WANT_READ) { 3856 #ifdef USE_WINSOCK 3857 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ); 3858 #endif 3859 return 1; /* read more later */ 3860 } else if(want == SSL_ERROR_WANT_WRITE) { 3861 c->ssl_shake_state = comm_ssl_shake_hs_write; 3862 comm_point_listen_for_rw(c, 0, 1); 3863 return 1; 3864 } else if(want == SSL_ERROR_SYSCALL) { 3865 #ifdef ECONNRESET 3866 if(errno == ECONNRESET && verbosity < 2) 3867 return 0; /* silence reset by peer */ 3868 #endif 3869 if(errno != 0) 3870 log_err("SSL_read syscall: %s", 3871 strerror(errno)); 3872 return 0; 3873 } 3874 log_crypto_err_io("could not SSL_read", want); 3875 return 0; 3876 } 3877 c->tcp_byte_count += r; 3878 if(c->tcp_byte_count < sizeof(uint16_t)) 3879 return 1; 3880 if(sldns_buffer_read_u16_at(c->buffer, 0) > 3881 sldns_buffer_capacity(c->buffer)) { 3882 verbose(VERB_QUERY, "ssl: dropped larger than buffer"); 3883 return 0; 3884 } 3885 sldns_buffer_set_limit(c->buffer, 3886 sldns_buffer_read_u16_at(c->buffer, 0)); 3887 if(sldns_buffer_limit(c->buffer) < LDNS_HEADER_SIZE) { 3888 verbose(VERB_QUERY, "ssl: dropped bogus too short."); 3889 return 0; 3890 } 3891 sldns_buffer_skip(c->buffer, (ssize_t)(c->tcp_byte_count-sizeof(uint16_t))); 3892 verbose(VERB_ALGO, "Reading ssl tcp query of length %d", 3893 (int)sldns_buffer_limit(c->buffer)); 3894 } 3895 if(sldns_buffer_remaining(c->buffer) > 0) { 3896 ERR_clear_error(); 3897 r = SSL_read(c->ssl, (void*)sldns_buffer_current(c->buffer), 3898 (int)sldns_buffer_remaining(c->buffer)); 3899 if(r <= 0) { 3900 int want = SSL_get_error(c->ssl, r); 3901 if(want == SSL_ERROR_ZERO_RETURN) { 3902 if(c->tcp_req_info) 3903 return tcp_req_info_handle_read_close(c->tcp_req_info); 3904 return 0; /* shutdown, closed */ 3905 } else if(want == SSL_ERROR_WANT_READ) { 3906 #ifdef USE_WINSOCK 3907 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ); 3908 #endif 3909 return 1; /* read more later */ 3910 } else if(want == SSL_ERROR_WANT_WRITE) { 3911 c->ssl_shake_state = comm_ssl_shake_hs_write; 3912 comm_point_listen_for_rw(c, 0, 1); 3913 return 1; 3914 } else if(want == SSL_ERROR_SYSCALL) { 3915 #ifdef ECONNRESET 3916 if(errno == ECONNRESET && verbosity < 2) 3917 return 0; /* silence reset by peer */ 3918 #endif 3919 if(errno != 0) 3920 log_err("SSL_read syscall: %s", 3921 strerror(errno)); 3922 return 0; 3923 } 3924 log_crypto_err_io("could not SSL_read", want); 3925 return 0; 3926 } 3927 sldns_buffer_skip(c->buffer, (ssize_t)r); 3928 } 3929 if(sldns_buffer_remaining(c->buffer) <= 0) { 3930 tcp_callback_reader(c); 3931 } 3932 return 1; 3933 #else 3934 (void)c; 3935 return 0; 3936 #endif /* HAVE_SSL */ 3937 } 3938 3939 /** ssl write callback on TCP */ 3940 static int 3941 ssl_handle_write(struct comm_point* c) 3942 { 3943 #ifdef HAVE_SSL 3944 int r; 3945 if(c->ssl_shake_state != comm_ssl_shake_none) { 3946 if(!ssl_handshake(c)) 3947 return 0; 3948 if(c->ssl_shake_state != comm_ssl_shake_none) 3949 return 1; 3950 } 3951 /* ignore return, if fails we may simply block */ 3952 (void)SSL_set_mode(c->ssl, (long)SSL_MODE_ENABLE_PARTIAL_WRITE); 3953 if((c->tcp_write_and_read?c->tcp_write_byte_count:c->tcp_byte_count) < sizeof(uint16_t)) { 3954 uint16_t len = htons(c->tcp_write_and_read?c->tcp_write_pkt_len:sldns_buffer_limit(c->buffer)); 3955 ERR_clear_error(); 3956 if(c->tcp_write_and_read) { 3957 if(c->tcp_write_pkt_len + 2 < LDNS_RR_BUF_SIZE) { 3958 /* combine the tcp length and the query for 3959 * write, this emulates writev */ 3960 uint8_t buf[LDNS_RR_BUF_SIZE]; 3961 memmove(buf, &len, sizeof(uint16_t)); 3962 memmove(buf+sizeof(uint16_t), 3963 c->tcp_write_pkt, 3964 c->tcp_write_pkt_len); 3965 r = SSL_write(c->ssl, 3966 (void*)(buf+c->tcp_write_byte_count), 3967 c->tcp_write_pkt_len + 2 - 3968 c->tcp_write_byte_count); 3969 } else { 3970 r = SSL_write(c->ssl, 3971 (void*)(((uint8_t*)&len)+c->tcp_write_byte_count), 3972 (int)(sizeof(uint16_t)-c->tcp_write_byte_count)); 3973 } 3974 } else if(sizeof(uint16_t)+sldns_buffer_remaining(c->buffer) < 3975 LDNS_RR_BUF_SIZE) { 3976 /* combine the tcp length and the query for write, 3977 * this emulates writev */ 3978 uint8_t buf[LDNS_RR_BUF_SIZE]; 3979 memmove(buf, &len, sizeof(uint16_t)); 3980 memmove(buf+sizeof(uint16_t), 3981 sldns_buffer_current(c->buffer), 3982 sldns_buffer_remaining(c->buffer)); 3983 r = SSL_write(c->ssl, (void*)(buf+c->tcp_byte_count), 3984 (int)(sizeof(uint16_t)+ 3985 sldns_buffer_remaining(c->buffer) 3986 - c->tcp_byte_count)); 3987 } else { 3988 r = SSL_write(c->ssl, 3989 (void*)(((uint8_t*)&len)+c->tcp_byte_count), 3990 (int)(sizeof(uint16_t)-c->tcp_byte_count)); 3991 } 3992 if(r <= 0) { 3993 int want = SSL_get_error(c->ssl, r); 3994 if(want == SSL_ERROR_ZERO_RETURN) { 3995 return 0; /* closed */ 3996 } else if(want == SSL_ERROR_WANT_READ) { 3997 c->ssl_shake_state = comm_ssl_shake_hs_read; 3998 comm_point_listen_for_rw(c, 1, 0); 3999 return 1; /* wait for read condition */ 4000 } else if(want == SSL_ERROR_WANT_WRITE) { 4001 #ifdef USE_WINSOCK 4002 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE); 4003 #endif 4004 return 1; /* write more later */ 4005 } else if(want == SSL_ERROR_SYSCALL) { 4006 #ifdef EPIPE 4007 if(errno == EPIPE && verbosity < 2) 4008 return 0; /* silence 'broken pipe' */ 4009 #endif 4010 if(errno != 0) 4011 log_err("SSL_write syscall: %s", 4012 strerror(errno)); 4013 return 0; 4014 } 4015 log_crypto_err_io("could not SSL_write", want); 4016 return 0; 4017 } 4018 if(c->tcp_write_and_read) { 4019 c->tcp_write_byte_count += r; 4020 if(c->tcp_write_byte_count < sizeof(uint16_t)) 4021 return 1; 4022 } else { 4023 c->tcp_byte_count += r; 4024 if(c->tcp_byte_count < sizeof(uint16_t)) 4025 return 1; 4026 sldns_buffer_set_position(c->buffer, c->tcp_byte_count - 4027 sizeof(uint16_t)); 4028 } 4029 if((!c->tcp_write_and_read && sldns_buffer_remaining(c->buffer) == 0) || (c->tcp_write_and_read && c->tcp_write_byte_count == c->tcp_write_pkt_len + 2)) { 4030 tcp_callback_writer(c); 4031 return 1; 4032 } 4033 } 4034 log_assert(c->tcp_write_and_read || sldns_buffer_remaining(c->buffer) > 0); 4035 log_assert(!c->tcp_write_and_read || c->tcp_write_byte_count < c->tcp_write_pkt_len + 2); 4036 ERR_clear_error(); 4037 if(c->tcp_write_and_read) { 4038 r = SSL_write(c->ssl, (void*)(c->tcp_write_pkt + c->tcp_write_byte_count - 2), 4039 (int)(c->tcp_write_pkt_len + 2 - c->tcp_write_byte_count)); 4040 } else { 4041 r = SSL_write(c->ssl, (void*)sldns_buffer_current(c->buffer), 4042 (int)sldns_buffer_remaining(c->buffer)); 4043 } 4044 if(r <= 0) { 4045 int want = SSL_get_error(c->ssl, r); 4046 if(want == SSL_ERROR_ZERO_RETURN) { 4047 return 0; /* closed */ 4048 } else if(want == SSL_ERROR_WANT_READ) { 4049 c->ssl_shake_state = comm_ssl_shake_hs_read; 4050 comm_point_listen_for_rw(c, 1, 0); 4051 return 1; /* wait for read condition */ 4052 } else if(want == SSL_ERROR_WANT_WRITE) { 4053 #ifdef USE_WINSOCK 4054 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE); 4055 #endif 4056 return 1; /* write more later */ 4057 } else if(want == SSL_ERROR_SYSCALL) { 4058 #ifdef EPIPE 4059 if(errno == EPIPE && verbosity < 2) 4060 return 0; /* silence 'broken pipe' */ 4061 #endif 4062 if(errno != 0) 4063 log_err("SSL_write syscall: %s", 4064 strerror(errno)); 4065 return 0; 4066 } 4067 log_crypto_err_io("could not SSL_write", want); 4068 return 0; 4069 } 4070 if(c->tcp_write_and_read) { 4071 c->tcp_write_byte_count += r; 4072 } else { 4073 sldns_buffer_skip(c->buffer, (ssize_t)r); 4074 } 4075 4076 if((!c->tcp_write_and_read && sldns_buffer_remaining(c->buffer) == 0) || (c->tcp_write_and_read && c->tcp_write_byte_count == c->tcp_write_pkt_len + 2)) { 4077 tcp_callback_writer(c); 4078 } 4079 return 1; 4080 #else 4081 (void)c; 4082 return 0; 4083 #endif /* HAVE_SSL */ 4084 } 4085 4086 /** handle ssl tcp connection with dns contents */ 4087 static int 4088 ssl_handle_it(struct comm_point* c, int is_write) 4089 { 4090 /* handle case where renegotiation wants read during write call 4091 * or write during read calls */ 4092 if(is_write && c->ssl_shake_state == comm_ssl_shake_hs_write) 4093 return ssl_handle_read(c); 4094 else if(!is_write && c->ssl_shake_state == comm_ssl_shake_hs_read) 4095 return ssl_handle_write(c); 4096 /* handle read events for read operation and write events for a 4097 * write operation */ 4098 else if(!is_write) 4099 return ssl_handle_read(c); 4100 return ssl_handle_write(c); 4101 } 4102 4103 /** 4104 * Handle tcp reading callback. 4105 * @param fd: file descriptor of socket. 4106 * @param c: comm point to read from into buffer. 4107 * @param short_ok: if true, very short packets are OK (for comm_local). 4108 * @return: 0 on error 4109 */ 4110 static int 4111 comm_point_tcp_handle_read(int fd, struct comm_point* c, int short_ok) 4112 { 4113 ssize_t r; 4114 int recv_initial = 0; 4115 log_assert(c->type == comm_tcp || c->type == comm_local); 4116 if(c->ssl) 4117 return ssl_handle_it(c, 0); 4118 if(!c->tcp_is_reading && !c->tcp_write_and_read) 4119 return 0; 4120 4121 log_assert(fd != -1); 4122 if(c->pp2_enabled && c->pp2_header_state != pp2_header_done) { 4123 struct pp2_header* header = NULL; 4124 size_t want_read_size = 0; 4125 size_t current_read_size = 0; 4126 if(c->pp2_header_state == pp2_header_none) { 4127 want_read_size = PP2_HEADER_SIZE; 4128 if(sldns_buffer_remaining(c->buffer)<want_read_size) { 4129 log_err_addr("proxy_protocol: not enough " 4130 "buffer size to read PROXYv2 header", "", 4131 &c->repinfo.remote_addr, 4132 c->repinfo.remote_addrlen); 4133 return 0; 4134 } 4135 verbose(VERB_ALGO, "proxy_protocol: reading fixed " 4136 "part of PROXYv2 header (len %lu)", 4137 (unsigned long)want_read_size); 4138 current_read_size = want_read_size; 4139 if(c->tcp_byte_count < current_read_size) { 4140 r = recv(fd, (void*)sldns_buffer_at(c->buffer, 4141 c->tcp_byte_count), 4142 current_read_size-c->tcp_byte_count, MSG_DONTWAIT); 4143 if(r == 0) { 4144 if(c->tcp_req_info) 4145 return tcp_req_info_handle_read_close(c->tcp_req_info); 4146 return 0; 4147 } else if(r == -1) { 4148 goto recv_error_initial; 4149 } 4150 c->tcp_byte_count += r; 4151 sldns_buffer_skip(c->buffer, r); 4152 if(c->tcp_byte_count != current_read_size) return 1; 4153 c->pp2_header_state = pp2_header_init; 4154 } 4155 } 4156 if(c->pp2_header_state == pp2_header_init) { 4157 int err; 4158 err = pp2_read_header( 4159 sldns_buffer_begin(c->buffer), 4160 sldns_buffer_limit(c->buffer)); 4161 if(err) { 4162 log_err("proxy_protocol: could not parse " 4163 "PROXYv2 header (%s)", 4164 pp_lookup_error(err)); 4165 return 0; 4166 } 4167 header = (struct pp2_header*)sldns_buffer_begin(c->buffer); 4168 want_read_size = ntohs(header->len); 4169 if(sldns_buffer_limit(c->buffer) < 4170 PP2_HEADER_SIZE + want_read_size) { 4171 log_err_addr("proxy_protocol: not enough " 4172 "buffer size to read PROXYv2 header", "", 4173 &c->repinfo.remote_addr, 4174 c->repinfo.remote_addrlen); 4175 return 0; 4176 } 4177 verbose(VERB_ALGO, "proxy_protocol: reading variable " 4178 "part of PROXYv2 header (len %lu)", 4179 (unsigned long)want_read_size); 4180 current_read_size = PP2_HEADER_SIZE + want_read_size; 4181 if(want_read_size == 0) { 4182 /* nothing more to read; header is complete */ 4183 c->pp2_header_state = pp2_header_done; 4184 } else if(c->tcp_byte_count < current_read_size) { 4185 r = recv(fd, (void*)sldns_buffer_at(c->buffer, 4186 c->tcp_byte_count), 4187 current_read_size-c->tcp_byte_count, MSG_DONTWAIT); 4188 if(r == 0) { 4189 if(c->tcp_req_info) 4190 return tcp_req_info_handle_read_close(c->tcp_req_info); 4191 return 0; 4192 } else if(r == -1) { 4193 goto recv_error; 4194 } 4195 c->tcp_byte_count += r; 4196 sldns_buffer_skip(c->buffer, r); 4197 if(c->tcp_byte_count != current_read_size) return 1; 4198 c->pp2_header_state = pp2_header_done; 4199 } 4200 } 4201 if(c->pp2_header_state != pp2_header_done || !header) { 4202 log_err_addr("proxy_protocol: wrong state for the " 4203 "PROXYv2 header", "", &c->repinfo.remote_addr, 4204 c->repinfo.remote_addrlen); 4205 return 0; 4206 } 4207 sldns_buffer_flip(c->buffer); 4208 if(!consume_pp2_header(c->buffer, &c->repinfo, 1)) { 4209 log_err_addr("proxy_protocol: could not consume " 4210 "PROXYv2 header", "", &c->repinfo.remote_addr, 4211 c->repinfo.remote_addrlen); 4212 return 0; 4213 } 4214 verbose(VERB_ALGO, "proxy_protocol: successful read of " 4215 "PROXYv2 header"); 4216 /* Clear and reset the buffer to read the following 4217 * DNS packet(s). */ 4218 sldns_buffer_clear(c->buffer); 4219 c->tcp_byte_count = 0; 4220 return 1; 4221 } 4222 4223 if(c->tcp_byte_count < sizeof(uint16_t)) { 4224 /* read length bytes */ 4225 r = recv(fd,(void*)sldns_buffer_at(c->buffer,c->tcp_byte_count), 4226 sizeof(uint16_t)-c->tcp_byte_count, MSG_DONTWAIT); 4227 if(r == 0) { 4228 if(c->tcp_req_info) 4229 return tcp_req_info_handle_read_close(c->tcp_req_info); 4230 return 0; 4231 } else if(r == -1) { 4232 if(c->pp2_enabled) goto recv_error; 4233 goto recv_error_initial; 4234 } 4235 c->tcp_byte_count += r; 4236 if(c->tcp_byte_count != sizeof(uint16_t)) 4237 return 1; 4238 if(sldns_buffer_read_u16_at(c->buffer, 0) > 4239 sldns_buffer_capacity(c->buffer)) { 4240 verbose(VERB_QUERY, "tcp: dropped larger than buffer"); 4241 return 0; 4242 } 4243 sldns_buffer_set_limit(c->buffer, 4244 sldns_buffer_read_u16_at(c->buffer, 0)); 4245 if(!short_ok && 4246 sldns_buffer_limit(c->buffer) < LDNS_HEADER_SIZE) { 4247 verbose(VERB_QUERY, "tcp: dropped bogus too short."); 4248 return 0; 4249 } 4250 verbose(VERB_ALGO, "Reading tcp query of length %d", 4251 (int)sldns_buffer_limit(c->buffer)); 4252 } 4253 4254 if(sldns_buffer_remaining(c->buffer) == 0) 4255 log_err("in comm_point_tcp_handle_read buffer_remaining is " 4256 "not > 0 as expected, continuing with (harmless) 0 " 4257 "length recv"); 4258 r = recv(fd, (void*)sldns_buffer_current(c->buffer), 4259 sldns_buffer_remaining(c->buffer), MSG_DONTWAIT); 4260 if(r == 0) { 4261 if(c->tcp_req_info) 4262 return tcp_req_info_handle_read_close(c->tcp_req_info); 4263 return 0; 4264 } else if(r == -1) { 4265 goto recv_error; 4266 } 4267 sldns_buffer_skip(c->buffer, r); 4268 if(sldns_buffer_remaining(c->buffer) <= 0) { 4269 tcp_callback_reader(c); 4270 } 4271 return 1; 4272 4273 recv_error_initial: 4274 recv_initial = 1; 4275 recv_error: 4276 #ifndef USE_WINSOCK 4277 if(errno == EINTR || errno == EAGAIN) 4278 return 1; 4279 #ifdef ECONNRESET 4280 if(errno == ECONNRESET && verbosity < 2) 4281 return 0; /* silence reset by peer */ 4282 #endif 4283 if(recv_initial) { 4284 #ifdef ECONNREFUSED 4285 if(errno == ECONNREFUSED && verbosity < 2) 4286 return 0; /* silence reset by peer */ 4287 #endif 4288 #ifdef ENETUNREACH 4289 if(errno == ENETUNREACH && verbosity < 2) 4290 return 0; /* silence it */ 4291 #endif 4292 #ifdef EHOSTDOWN 4293 if(errno == EHOSTDOWN && verbosity < 2) 4294 return 0; /* silence it */ 4295 #endif 4296 #ifdef EHOSTUNREACH 4297 if(errno == EHOSTUNREACH && verbosity < 2) 4298 return 0; /* silence it */ 4299 #endif 4300 #ifdef ENETDOWN 4301 if(errno == ENETDOWN && verbosity < 2) 4302 return 0; /* silence it */ 4303 #endif 4304 #ifdef EACCES 4305 if(errno == EACCES && verbosity < 2) 4306 return 0; /* silence it */ 4307 #endif 4308 #ifdef ENOTCONN 4309 if(errno == ENOTCONN) { 4310 log_err_addr("read (in tcp initial) failed and this " 4311 "could be because TCP Fast Open is " 4312 "enabled [--disable-tfo-client " 4313 "--disable-tfo-server] but does not " 4314 "work", sock_strerror(errno), 4315 &c->repinfo.remote_addr, 4316 c->repinfo.remote_addrlen); 4317 return 0; 4318 } 4319 #endif 4320 } 4321 #else /* USE_WINSOCK */ 4322 if(recv_initial) { 4323 if(WSAGetLastError() == WSAECONNREFUSED && verbosity < 2) 4324 return 0; 4325 if(WSAGetLastError() == WSAEHOSTDOWN && verbosity < 2) 4326 return 0; 4327 if(WSAGetLastError() == WSAEHOSTUNREACH && verbosity < 2) 4328 return 0; 4329 if(WSAGetLastError() == WSAENETDOWN && verbosity < 2) 4330 return 0; 4331 if(WSAGetLastError() == WSAENETUNREACH && verbosity < 2) 4332 return 0; 4333 } 4334 if(WSAGetLastError() == WSAECONNRESET) 4335 return 0; 4336 if(WSAGetLastError() == WSAEINPROGRESS) 4337 return 1; 4338 if(WSAGetLastError() == WSAEWOULDBLOCK) { 4339 ub_winsock_tcp_wouldblock(c->ev->ev, 4340 UB_EV_READ); 4341 return 1; 4342 } 4343 #endif 4344 log_err_addr((recv_initial?"read (in tcp initial)":"read (in tcp)"), 4345 sock_strerror(errno), &c->repinfo.remote_addr, 4346 c->repinfo.remote_addrlen); 4347 return 0; 4348 } 4349 4350 /** 4351 * Handle tcp writing callback. 4352 * @param fd: file descriptor of socket. 4353 * @param c: comm point to write buffer out of. 4354 * @return: 0 on error 4355 */ 4356 static int 4357 comm_point_tcp_handle_write(int fd, struct comm_point* c) 4358 { 4359 ssize_t r; 4360 struct sldns_buffer *buffer; 4361 log_assert(c->type == comm_tcp); 4362 #ifdef USE_DNSCRYPT 4363 buffer = c->dnscrypt_buffer; 4364 #else 4365 buffer = c->buffer; 4366 #endif 4367 if(c->tcp_is_reading && !c->ssl && !c->tcp_write_and_read) 4368 return 0; 4369 log_assert(fd != -1); 4370 if(((!c->tcp_write_and_read && c->tcp_byte_count == 0) || (c->tcp_write_and_read && c->tcp_write_byte_count == 0)) && c->tcp_check_nb_connect) { 4371 /* check for pending error from nonblocking connect */ 4372 /* from Stevens, unix network programming, vol1, 3rd ed, p450*/ 4373 int error = 0; 4374 socklen_t len = (socklen_t)sizeof(error); 4375 if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error, 4376 &len) < 0){ 4377 #ifndef USE_WINSOCK 4378 error = errno; /* on solaris errno is error */ 4379 #else /* USE_WINSOCK */ 4380 error = WSAGetLastError(); 4381 #endif 4382 } 4383 #ifndef USE_WINSOCK 4384 #if defined(EINPROGRESS) && defined(EWOULDBLOCK) 4385 if(error == EINPROGRESS || error == EWOULDBLOCK) 4386 return 1; /* try again later */ 4387 else 4388 #endif 4389 if(error != 0 && verbosity < 2) 4390 return 0; /* silence lots of chatter in the logs */ 4391 else if(error != 0) { 4392 log_err_addr("tcp connect", strerror(error), 4393 &c->repinfo.remote_addr, 4394 c->repinfo.remote_addrlen); 4395 #else /* USE_WINSOCK */ 4396 /* examine error */ 4397 if(error == WSAEINPROGRESS) 4398 return 1; 4399 else if(error == WSAEWOULDBLOCK) { 4400 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE); 4401 return 1; 4402 } else if(error != 0 && verbosity < 2) 4403 return 0; 4404 else if(error != 0) { 4405 log_err_addr("tcp connect", wsa_strerror(error), 4406 &c->repinfo.remote_addr, 4407 c->repinfo.remote_addrlen); 4408 #endif /* USE_WINSOCK */ 4409 return 0; 4410 } 4411 } 4412 if(c->ssl) 4413 return ssl_handle_it(c, 1); 4414 4415 #ifdef USE_MSG_FASTOPEN 4416 /* Only try this on first use of a connection that uses tfo, 4417 otherwise fall through to normal write */ 4418 /* Also, TFO support on WINDOWS not implemented at the moment */ 4419 if(c->tcp_do_fastopen == 1) { 4420 /* this form of sendmsg() does both a connect() and send() so need to 4421 look for various flavours of error*/ 4422 uint16_t len = htons(c->tcp_write_and_read?c->tcp_write_pkt_len:sldns_buffer_limit(buffer)); 4423 struct msghdr msg; 4424 struct iovec iov[2]; 4425 c->tcp_do_fastopen = 0; 4426 memset(&msg, 0, sizeof(msg)); 4427 if(c->tcp_write_and_read) { 4428 iov[0].iov_base = (uint8_t*)&len + c->tcp_write_byte_count; 4429 iov[0].iov_len = sizeof(uint16_t) - c->tcp_write_byte_count; 4430 iov[1].iov_base = c->tcp_write_pkt; 4431 iov[1].iov_len = c->tcp_write_pkt_len; 4432 } else { 4433 iov[0].iov_base = (uint8_t*)&len + c->tcp_byte_count; 4434 iov[0].iov_len = sizeof(uint16_t) - c->tcp_byte_count; 4435 iov[1].iov_base = sldns_buffer_begin(buffer); 4436 iov[1].iov_len = sldns_buffer_limit(buffer); 4437 } 4438 log_assert(iov[0].iov_len > 0); 4439 msg.msg_name = &c->repinfo.remote_addr; 4440 msg.msg_namelen = c->repinfo.remote_addrlen; 4441 msg.msg_iov = iov; 4442 msg.msg_iovlen = 2; 4443 r = sendmsg(fd, &msg, MSG_FASTOPEN); 4444 if (r == -1) { 4445 #if defined(EINPROGRESS) && defined(EWOULDBLOCK) 4446 /* Handshake is underway, maybe because no TFO cookie available. 4447 Come back to write the message*/ 4448 if(errno == EINPROGRESS || errno == EWOULDBLOCK) 4449 return 1; 4450 #endif 4451 if(errno == EINTR || errno == EAGAIN) 4452 return 1; 4453 /* Not handling EISCONN here as shouldn't ever hit that case.*/ 4454 if(errno != EPIPE 4455 #ifdef EOPNOTSUPP 4456 /* if /proc/sys/net/ipv4/tcp_fastopen is 4457 * disabled on Linux, sendmsg may return 4458 * 'Operation not supported', if so 4459 * fallthrough to ordinary connect. */ 4460 && errno != EOPNOTSUPP 4461 #endif 4462 && errno != 0) { 4463 if(verbosity < 2) 4464 return 0; /* silence lots of chatter in the logs */ 4465 log_err_addr("tcp sendmsg", strerror(errno), 4466 &c->repinfo.remote_addr, 4467 c->repinfo.remote_addrlen); 4468 return 0; 4469 } 4470 verbose(VERB_ALGO, "tcp sendmsg for fastopen failed (with %s), try normal connect", strerror(errno)); 4471 /* fallthrough to nonFASTOPEN 4472 * (MSG_FASTOPEN on Linux 3 produces EPIPE) 4473 * we need to perform connect() */ 4474 if(connect(fd, (struct sockaddr *)&c->repinfo.remote_addr, 4475 c->repinfo.remote_addrlen) == -1) { 4476 #ifdef EINPROGRESS 4477 if(errno == EINPROGRESS) 4478 return 1; /* wait until connect done*/ 4479 #endif 4480 #ifdef USE_WINSOCK 4481 if(WSAGetLastError() == WSAEINPROGRESS || 4482 WSAGetLastError() == WSAEWOULDBLOCK) 4483 return 1; /* wait until connect done*/ 4484 #endif 4485 if(tcp_connect_errno_needs_log( 4486 (struct sockaddr *)&c->repinfo.remote_addr, 4487 c->repinfo.remote_addrlen)) { 4488 log_err_addr("outgoing tcp: connect after EPIPE for fastopen", 4489 strerror(errno), 4490 &c->repinfo.remote_addr, 4491 c->repinfo.remote_addrlen); 4492 } 4493 return 0; 4494 } 4495 4496 } else { 4497 if(c->tcp_write_and_read) { 4498 c->tcp_write_byte_count += r; 4499 if(c->tcp_write_byte_count < sizeof(uint16_t)) 4500 return 1; 4501 } else { 4502 c->tcp_byte_count += r; 4503 if(c->tcp_byte_count < sizeof(uint16_t)) 4504 return 1; 4505 sldns_buffer_set_position(buffer, c->tcp_byte_count - 4506 sizeof(uint16_t)); 4507 } 4508 if((!c->tcp_write_and_read && sldns_buffer_remaining(buffer) == 0) || (c->tcp_write_and_read && c->tcp_write_byte_count == c->tcp_write_pkt_len + 2)) { 4509 tcp_callback_writer(c); 4510 return 1; 4511 } 4512 } 4513 } 4514 #endif /* USE_MSG_FASTOPEN */ 4515 4516 if((c->tcp_write_and_read?c->tcp_write_byte_count:c->tcp_byte_count) < sizeof(uint16_t)) { 4517 uint16_t len = htons(c->tcp_write_and_read?c->tcp_write_pkt_len:sldns_buffer_limit(buffer)); 4518 #ifdef HAVE_WRITEV 4519 struct iovec iov[2]; 4520 if(c->tcp_write_and_read) { 4521 iov[0].iov_base = (uint8_t*)&len + c->tcp_write_byte_count; 4522 iov[0].iov_len = sizeof(uint16_t) - c->tcp_write_byte_count; 4523 iov[1].iov_base = c->tcp_write_pkt; 4524 iov[1].iov_len = c->tcp_write_pkt_len; 4525 } else { 4526 iov[0].iov_base = (uint8_t*)&len + c->tcp_byte_count; 4527 iov[0].iov_len = sizeof(uint16_t) - c->tcp_byte_count; 4528 iov[1].iov_base = sldns_buffer_begin(buffer); 4529 iov[1].iov_len = sldns_buffer_limit(buffer); 4530 } 4531 log_assert(iov[0].iov_len > 0); 4532 r = writev(fd, iov, 2); 4533 #else /* HAVE_WRITEV */ 4534 if(c->tcp_write_and_read) { 4535 r = send(fd, (void*)(((uint8_t*)&len)+c->tcp_write_byte_count), 4536 sizeof(uint16_t)-c->tcp_write_byte_count, 0); 4537 } else { 4538 r = send(fd, (void*)(((uint8_t*)&len)+c->tcp_byte_count), 4539 sizeof(uint16_t)-c->tcp_byte_count, 0); 4540 } 4541 #endif /* HAVE_WRITEV */ 4542 if(r == -1) { 4543 #ifndef USE_WINSOCK 4544 # ifdef EPIPE 4545 if(errno == EPIPE && verbosity < 2) 4546 return 0; /* silence 'broken pipe' */ 4547 #endif 4548 if(errno == EINTR || errno == EAGAIN) 4549 return 1; 4550 #ifdef ECONNRESET 4551 if(errno == ECONNRESET && verbosity < 2) 4552 return 0; /* silence reset by peer */ 4553 #endif 4554 # ifdef HAVE_WRITEV 4555 log_err_addr("tcp writev", strerror(errno), 4556 &c->repinfo.remote_addr, 4557 c->repinfo.remote_addrlen); 4558 # else /* HAVE_WRITEV */ 4559 log_err_addr("tcp send s", strerror(errno), 4560 &c->repinfo.remote_addr, 4561 c->repinfo.remote_addrlen); 4562 # endif /* HAVE_WRITEV */ 4563 #else 4564 if(WSAGetLastError() == WSAENOTCONN) 4565 return 1; 4566 if(WSAGetLastError() == WSAEINPROGRESS) 4567 return 1; 4568 if(WSAGetLastError() == WSAEWOULDBLOCK) { 4569 ub_winsock_tcp_wouldblock(c->ev->ev, 4570 UB_EV_WRITE); 4571 return 1; 4572 } 4573 if(WSAGetLastError() == WSAECONNRESET && verbosity < 2) 4574 return 0; /* silence reset by peer */ 4575 log_err_addr("tcp send s", 4576 wsa_strerror(WSAGetLastError()), 4577 &c->repinfo.remote_addr, 4578 c->repinfo.remote_addrlen); 4579 #endif 4580 return 0; 4581 } 4582 if(c->tcp_write_and_read) { 4583 c->tcp_write_byte_count += r; 4584 if(c->tcp_write_byte_count < sizeof(uint16_t)) 4585 return 1; 4586 } else { 4587 c->tcp_byte_count += r; 4588 if(c->tcp_byte_count < sizeof(uint16_t)) 4589 return 1; 4590 sldns_buffer_set_position(buffer, c->tcp_byte_count - 4591 sizeof(uint16_t)); 4592 } 4593 if((!c->tcp_write_and_read && sldns_buffer_remaining(buffer) == 0) || (c->tcp_write_and_read && c->tcp_write_byte_count == c->tcp_write_pkt_len + 2)) { 4594 tcp_callback_writer(c); 4595 return 1; 4596 } 4597 } 4598 log_assert(c->tcp_write_and_read || sldns_buffer_remaining(buffer) > 0); 4599 log_assert(!c->tcp_write_and_read || c->tcp_write_byte_count < c->tcp_write_pkt_len + 2); 4600 if(c->tcp_write_and_read) { 4601 r = send(fd, (void*)(c->tcp_write_pkt + c->tcp_write_byte_count - 2), 4602 c->tcp_write_pkt_len + 2 - c->tcp_write_byte_count, 0); 4603 } else { 4604 r = send(fd, (void*)sldns_buffer_current(buffer), 4605 sldns_buffer_remaining(buffer), 0); 4606 } 4607 if(r == -1) { 4608 #ifndef USE_WINSOCK 4609 if(errno == EINTR || errno == EAGAIN) 4610 return 1; 4611 #ifdef ECONNRESET 4612 if(errno == ECONNRESET && verbosity < 2) 4613 return 0; /* silence reset by peer */ 4614 #endif 4615 #else 4616 if(WSAGetLastError() == WSAEINPROGRESS) 4617 return 1; 4618 if(WSAGetLastError() == WSAEWOULDBLOCK) { 4619 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE); 4620 return 1; 4621 } 4622 if(WSAGetLastError() == WSAECONNRESET && verbosity < 2) 4623 return 0; /* silence reset by peer */ 4624 #endif 4625 log_err_addr("tcp send r", sock_strerror(errno), 4626 &c->repinfo.remote_addr, 4627 c->repinfo.remote_addrlen); 4628 return 0; 4629 } 4630 if(c->tcp_write_and_read) { 4631 c->tcp_write_byte_count += r; 4632 } else { 4633 sldns_buffer_skip(buffer, r); 4634 } 4635 4636 if((!c->tcp_write_and_read && sldns_buffer_remaining(buffer) == 0) || (c->tcp_write_and_read && c->tcp_write_byte_count == c->tcp_write_pkt_len + 2)) { 4637 tcp_callback_writer(c); 4638 } 4639 4640 return 1; 4641 } 4642 4643 /** read again to drain buffers when there could be more to read, returns 0 4644 * on failure which means the comm point is closed. */ 4645 static int 4646 tcp_req_info_read_again(int fd, struct comm_point* c) 4647 { 4648 /* One event-loop visit drains at most this many pipelined queries; 4649 * the rest is re-queued, so that other file descriptors get 4650 * serviced in between. */ 4651 int budget = NUM_TCP_PER_SELECT; 4652 while(c->tcp_req_info->read_again) { 4653 int r; 4654 c->tcp_req_info->read_again = 0; 4655 if(c->tcp_is_reading) 4656 r = comm_point_tcp_handle_read(fd, c, 0); 4657 else r = comm_point_tcp_handle_write(fd, c); 4658 if(!r) { 4659 reclaim_tcp_handler(c); 4660 if(!c->tcp_do_close) { 4661 fptr_ok(fptr_whitelist_comm_point( 4662 c->callback)); 4663 (void)(*c->callback)(c, c->cb_arg, 4664 NETEVENT_CLOSED, NULL); 4665 } 4666 return 0; 4667 } 4668 if(--budget <= 0 && c->tcp_req_info->read_again) { 4669 /* Defer the rest of the drain to the next loop turn. 4670 * This uses a zero delay timer. For TLS the undrained 4671 * remainder sits in OpenSSL's user-space buffer. */ 4672 struct timeval tv; 4673 memset(&tv, 0, sizeof(tv)); 4674 verbose(VERB_ALGO, "Defer tcp_req_info read again"); 4675 comm_timer_set(c->tcp_req_info->read_again_timer, &tv); 4676 return 1; 4677 } 4678 } 4679 return 1; 4680 } 4681 4682 /** read again to drain buffers when there could be more to read */ 4683 static void 4684 tcp_more_read_again(int fd, struct comm_point* c) 4685 { 4686 /* if the packet is done, but another one could be waiting on 4687 * the connection, the callback signals this, and we try again */ 4688 /* this continues until the read routines get EAGAIN or so, 4689 * and thus does not call the callback, and the bool is 0 */ 4690 int* moreread = c->tcp_more_read_again; 4691 int budget = NUM_TCP_PER_SELECT; 4692 while(moreread && *moreread) { 4693 *moreread = 0; 4694 if(!comm_point_tcp_handle_read(fd, c, 0)) { 4695 reclaim_tcp_handler(c); 4696 if(!c->tcp_do_close) { 4697 fptr_ok(fptr_whitelist_comm_point( 4698 c->callback)); 4699 (void)(*c->callback)(c, c->cb_arg, 4700 NETEVENT_CLOSED, NULL); 4701 } 4702 return; 4703 } 4704 if(--budget <= 0 && *moreread) { 4705 /* Defer the rest of the drain to the next loop turn. 4706 * This uses a zero delay timer. For TLS the undrained 4707 * remainder sits in OpenSSL's user-space buffer. */ 4708 struct timeval tv; 4709 memset(&tv, 0, sizeof(tv)); 4710 if(!c->tcp_more_read_again_timer) { 4711 c->tcp_more_read_again_timer = comm_timer_create(c->ev->base, tcp_more_read_again_cb, c); 4712 if(!c->tcp_more_read_again_timer) { 4713 log_err("out of memory for tcp more read again timer"); 4714 reclaim_tcp_handler(c); 4715 if(!c->tcp_do_close) { 4716 fptr_ok(fptr_whitelist_comm_point( 4717 c->callback)); 4718 (void)(*c->callback)(c, c->cb_arg, 4719 NETEVENT_CLOSED, NULL); 4720 } 4721 return; 4722 } 4723 } 4724 verbose(VERB_ALGO, "Defer more read again"); 4725 comm_timer_set(c->tcp_more_read_again_timer, &tv); 4726 return; 4727 } 4728 } 4729 } 4730 4731 /** write again to fill up when there could be more to write */ 4732 static void 4733 tcp_more_write_again(int fd, struct comm_point* c) 4734 { 4735 /* if the packet is done, but another is waiting to be written, 4736 * the callback signals it and we try again. */ 4737 /* this continues until the write routines get EAGAIN or so, 4738 * and thus does not call the callback, and the bool is 0 */ 4739 int* morewrite = c->tcp_more_write_again; 4740 while(morewrite && *morewrite) { 4741 *morewrite = 0; 4742 if(!comm_point_tcp_handle_write(fd, c)) { 4743 reclaim_tcp_handler(c); 4744 if(!c->tcp_do_close) { 4745 fptr_ok(fptr_whitelist_comm_point( 4746 c->callback)); 4747 (void)(*c->callback)(c, c->cb_arg, 4748 NETEVENT_CLOSED, NULL); 4749 } 4750 return; 4751 } 4752 } 4753 } 4754 4755 void 4756 tcp_read_again_cb(void* arg) 4757 { 4758 struct tcp_req_info* req = (struct tcp_req_info*)arg; 4759 verbose(VERB_ALGO, "tcp_read_again_cb"); 4760 if(!tcp_req_info_read_again(req->cp->fd, req->cp)) 4761 return; 4762 } 4763 4764 void 4765 tcp_more_read_again_cb(void* arg) 4766 { 4767 struct comm_point* c = (struct comm_point*)arg; 4768 verbose(VERB_ALGO, "tcp_more_read_again_cb"); 4769 tcp_more_read_again(c->fd, c); 4770 } 4771 4772 void 4773 comm_point_tcp_handle_callback(int fd, short event, void* arg) 4774 { 4775 struct comm_point* c = (struct comm_point*)arg; 4776 log_assert(c->type == comm_tcp); 4777 ub_comm_base_now(c->ev->base); 4778 4779 if(c->fd == -1 || c->fd != fd) 4780 return; /* duplicate event, but commpoint closed. */ 4781 4782 #ifdef USE_DNSCRYPT 4783 /* Initialize if this is a dnscrypt socket */ 4784 if(c->tcp_parent) { 4785 c->dnscrypt = c->tcp_parent->dnscrypt; 4786 } 4787 if(c->dnscrypt && c->dnscrypt_buffer == c->buffer) { 4788 c->dnscrypt_buffer = sldns_buffer_new(sldns_buffer_capacity(c->buffer)); 4789 if(!c->dnscrypt_buffer) { 4790 log_err("Could not allocate dnscrypt buffer"); 4791 reclaim_tcp_handler(c); 4792 if(!c->tcp_do_close) { 4793 fptr_ok(fptr_whitelist_comm_point( 4794 c->callback)); 4795 (void)(*c->callback)(c, c->cb_arg, 4796 NETEVENT_CLOSED, NULL); 4797 } 4798 return; 4799 } 4800 } 4801 #endif 4802 4803 if((event&UB_EV_TIMEOUT)) { 4804 verbose(VERB_QUERY, "tcp took too long, dropped"); 4805 reclaim_tcp_handler(c); 4806 if(!c->tcp_do_close) { 4807 fptr_ok(fptr_whitelist_comm_point(c->callback)); 4808 (void)(*c->callback)(c, c->cb_arg, 4809 NETEVENT_TIMEOUT, NULL); 4810 } 4811 return; 4812 } 4813 if((event&UB_EV_READ) 4814 #ifdef USE_MSG_FASTOPEN 4815 && !(c->tcp_do_fastopen && (event&UB_EV_WRITE)) 4816 #endif 4817 ) { 4818 int has_tcpq = (c->tcp_req_info != NULL); 4819 int* moreread = c->tcp_more_read_again; 4820 if(!comm_point_tcp_handle_read(fd, c, 0)) { 4821 reclaim_tcp_handler(c); 4822 if(!c->tcp_do_close) { 4823 fptr_ok(fptr_whitelist_comm_point( 4824 c->callback)); 4825 (void)(*c->callback)(c, c->cb_arg, 4826 NETEVENT_CLOSED, NULL); 4827 } 4828 return; 4829 } 4830 if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again) { 4831 if(!tcp_req_info_read_again(fd, c)) 4832 return; 4833 } 4834 if(moreread && *moreread) 4835 tcp_more_read_again(fd, c); 4836 return; 4837 } 4838 if((event&UB_EV_WRITE)) { 4839 int has_tcpq = (c->tcp_req_info != NULL); 4840 int* morewrite = c->tcp_more_write_again; 4841 if(!comm_point_tcp_handle_write(fd, c)) { 4842 reclaim_tcp_handler(c); 4843 if(!c->tcp_do_close) { 4844 fptr_ok(fptr_whitelist_comm_point( 4845 c->callback)); 4846 (void)(*c->callback)(c, c->cb_arg, 4847 NETEVENT_CLOSED, NULL); 4848 } 4849 return; 4850 } 4851 if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again) { 4852 if(!tcp_req_info_read_again(fd, c)) 4853 return; 4854 } 4855 if(morewrite && *morewrite) 4856 tcp_more_write_again(fd, c); 4857 return; 4858 } 4859 log_err("Ignored event %d for tcphdl.", event); 4860 } 4861 4862 /** Make http handler free for next assignment */ 4863 static void 4864 reclaim_http_handler(struct comm_point* c) 4865 { 4866 log_assert(c->type == comm_http); 4867 if(c->ssl) { 4868 #ifdef HAVE_SSL 4869 SSL_shutdown(c->ssl); 4870 SSL_free(c->ssl); 4871 c->ssl = NULL; 4872 #endif 4873 } 4874 comm_point_close(c); 4875 if(c->tcp_parent && !c->is_in_tcp_free) { 4876 /* Should not happen: bad tcp_free state in reclaim_http. */ 4877 log_assert(c->tcp_free == NULL); 4878 log_assert(c->tcp_parent->cur_tcp_count > 0); 4879 c->tcp_parent->cur_tcp_count--; 4880 c->tcp_free = c->tcp_parent->tcp_free; 4881 c->tcp_parent->tcp_free = c; 4882 c->is_in_tcp_free = 1; 4883 if(!c->tcp_free) { 4884 /* re-enable listening on accept socket */ 4885 comm_point_start_listening(c->tcp_parent, -1, -1); 4886 } 4887 } 4888 } 4889 4890 /** read more data for http (with ssl) */ 4891 static int 4892 ssl_http_read_more(struct comm_point* c) 4893 { 4894 #ifdef HAVE_SSL 4895 int r; 4896 log_assert(sldns_buffer_remaining(c->buffer) > 0); 4897 ERR_clear_error(); 4898 r = SSL_read(c->ssl, (void*)sldns_buffer_current(c->buffer), 4899 (int)sldns_buffer_remaining(c->buffer)); 4900 if(r <= 0) { 4901 int want = SSL_get_error(c->ssl, r); 4902 if(want == SSL_ERROR_ZERO_RETURN) { 4903 return 0; /* shutdown, closed */ 4904 } else if(want == SSL_ERROR_WANT_READ) { 4905 return 1; /* read more later */ 4906 } else if(want == SSL_ERROR_WANT_WRITE) { 4907 c->ssl_shake_state = comm_ssl_shake_hs_write; 4908 comm_point_listen_for_rw(c, 0, 1); 4909 return 1; 4910 } else if(want == SSL_ERROR_SYSCALL) { 4911 #ifdef ECONNRESET 4912 if(errno == ECONNRESET && verbosity < 2) 4913 return 0; /* silence reset by peer */ 4914 #endif 4915 if(errno != 0) 4916 log_err("SSL_read syscall: %s", 4917 strerror(errno)); 4918 return 0; 4919 } 4920 log_crypto_err_io("could not SSL_read", want); 4921 return 0; 4922 } 4923 verbose(VERB_ALGO, "ssl http read more skip to %d + %d", 4924 (int)sldns_buffer_position(c->buffer), (int)r); 4925 sldns_buffer_skip(c->buffer, (ssize_t)r); 4926 return 1; 4927 #else 4928 (void)c; 4929 return 0; 4930 #endif /* HAVE_SSL */ 4931 } 4932 4933 /** read more data for http */ 4934 static int 4935 http_read_more(int fd, struct comm_point* c) 4936 { 4937 ssize_t r; 4938 log_assert(sldns_buffer_remaining(c->buffer) > 0); 4939 r = recv(fd, (void*)sldns_buffer_current(c->buffer), 4940 sldns_buffer_remaining(c->buffer), MSG_DONTWAIT); 4941 if(r == 0) { 4942 return 0; 4943 } else if(r == -1) { 4944 #ifndef USE_WINSOCK 4945 if(errno == EINTR || errno == EAGAIN) 4946 return 1; 4947 #else /* USE_WINSOCK */ 4948 if(WSAGetLastError() == WSAECONNRESET) 4949 return 0; 4950 if(WSAGetLastError() == WSAEINPROGRESS) 4951 return 1; 4952 if(WSAGetLastError() == WSAEWOULDBLOCK) { 4953 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ); 4954 return 1; 4955 } 4956 #endif 4957 log_err_addr("read (in http r)", sock_strerror(errno), 4958 &c->repinfo.remote_addr, c->repinfo.remote_addrlen); 4959 return 0; 4960 } 4961 verbose(VERB_ALGO, "http read more skip to %d + %d", 4962 (int)sldns_buffer_position(c->buffer), (int)r); 4963 sldns_buffer_skip(c->buffer, r); 4964 return 1; 4965 } 4966 4967 /** return true if http header has been read (one line complete) */ 4968 static int 4969 http_header_done(sldns_buffer* buf) 4970 { 4971 size_t i; 4972 for(i=sldns_buffer_position(buf); i<sldns_buffer_limit(buf); i++) { 4973 /* there was a \r before the \n, but we ignore that */ 4974 if((char)sldns_buffer_read_u8_at(buf, i) == '\n') 4975 return 1; 4976 } 4977 return 0; 4978 } 4979 4980 /** return character string into buffer for header line, moves buffer 4981 * past that line and puts zero terminator into linefeed-newline */ 4982 static char* 4983 http_header_line(sldns_buffer* buf) 4984 { 4985 char* result = (char*)sldns_buffer_current(buf); 4986 size_t i; 4987 for(i=sldns_buffer_position(buf); i<sldns_buffer_limit(buf); i++) { 4988 /* terminate the string on the \r */ 4989 if((char)sldns_buffer_read_u8_at(buf, i) == '\r') 4990 sldns_buffer_write_u8_at(buf, i, 0); 4991 /* terminate on the \n and skip past the it and done */ 4992 if((char)sldns_buffer_read_u8_at(buf, i) == '\n') { 4993 sldns_buffer_write_u8_at(buf, i, 0); 4994 sldns_buffer_set_position(buf, i+1); 4995 return result; 4996 } 4997 } 4998 return NULL; 4999 } 5000 5001 /** move unread buffer to start and clear rest for putting the rest into it */ 5002 static void 5003 http_moveover_buffer(sldns_buffer* buf) 5004 { 5005 size_t pos = sldns_buffer_position(buf); 5006 size_t len = sldns_buffer_remaining(buf); 5007 sldns_buffer_clear(buf); 5008 memmove(sldns_buffer_begin(buf), sldns_buffer_at(buf, pos), len); 5009 sldns_buffer_set_position(buf, len); 5010 } 5011 5012 /** a http header is complete, process it */ 5013 static int 5014 http_process_initial_header(struct comm_point* c) 5015 { 5016 char* line = http_header_line(c->buffer); 5017 if(!line) return 1; 5018 verbose(VERB_ALGO, "http header: %s", line); 5019 if(strncasecmp(line, "HTTP/1.1 ", 9) == 0) { 5020 /* check returncode */ 5021 if(line[9] != '2') { 5022 verbose(VERB_ALGO, "http bad status %s", line+9); 5023 return 0; 5024 } 5025 } else if(strncasecmp(line, "Content-Length: ", 16) == 0) { 5026 if(!c->http_is_chunked) { 5027 char* end = NULL; 5028 long long cl; 5029 errno = 0; 5030 cl = strtoll(line+16, &end, 10); 5031 if(end == line+16 || errno != 0 || cl < 0) { 5032 verbose(VERB_ALGO, "http invalid Content-Length: " ARG_LL "d", cl); 5033 return 0; /* reject */ 5034 } 5035 c->tcp_byte_count = (size_t)cl; 5036 } 5037 } else if(strncasecmp(line, "Transfer-Encoding: chunked", 19+7) == 0) { 5038 c->tcp_byte_count = 0; 5039 c->http_is_chunked = 1; 5040 } else if(line[0] == 0) { 5041 /* end of initial headers */ 5042 c->http_in_headers = 0; 5043 if(c->http_is_chunked) 5044 c->http_in_chunk_headers = 1; 5045 /* remove header text from front of buffer 5046 * the buffer is going to be used to return the data segment 5047 * itself and we don't want the header to get returned 5048 * prepended with it */ 5049 http_moveover_buffer(c->buffer); 5050 sldns_buffer_flip(c->buffer); 5051 return 1; 5052 } 5053 /* ignore other headers */ 5054 return 1; 5055 } 5056 5057 /** a chunk header is complete, process it, return 0=fail, 1=continue next 5058 * header line, 2=done with chunked transfer*/ 5059 static int 5060 http_process_chunk_header(struct comm_point* c) 5061 { 5062 char* line = http_header_line(c->buffer); 5063 if(!line) return 1; 5064 if(c->http_in_chunk_headers == 3) { 5065 verbose(VERB_ALGO, "http chunk trailer: %s", line); 5066 /* are we done ? */ 5067 if(line[0] == 0 && c->tcp_byte_count == 0) { 5068 /* callback of http reader when NETEVENT_DONE, 5069 * end of data, with no data in buffer */ 5070 sldns_buffer_set_position(c->buffer, 0); 5071 sldns_buffer_set_limit(c->buffer, 0); 5072 fptr_ok(fptr_whitelist_comm_point(c->callback)); 5073 (void)(*c->callback)(c, c->cb_arg, NETEVENT_DONE, NULL); 5074 /* return that we are done */ 5075 return 2; 5076 } 5077 if(line[0] == 0) { 5078 /* continue with header of the next chunk */ 5079 c->http_in_chunk_headers = 1; 5080 /* remove header text from front of buffer */ 5081 http_moveover_buffer(c->buffer); 5082 sldns_buffer_flip(c->buffer); 5083 return 1; 5084 } 5085 /* ignore further trail headers */ 5086 return 1; 5087 } 5088 verbose(VERB_ALGO, "http chunk header: %s", line); 5089 if(c->http_in_chunk_headers == 1) { 5090 /* read chunked start line */ 5091 char* end = NULL; 5092 long chunk_sz; 5093 errno = 0; 5094 chunk_sz = strtol(line, &end, 16); 5095 if(end == line || errno != 0 || chunk_sz < 0) { 5096 verbose(VERB_ALGO, "http invalid chunk size: %ld", 5097 chunk_sz); 5098 return 0; 5099 } 5100 c->tcp_byte_count = (size_t)chunk_sz; 5101 c->http_in_chunk_headers = 0; 5102 /* remove header text from front of buffer */ 5103 http_moveover_buffer(c->buffer); 5104 sldns_buffer_flip(c->buffer); 5105 if(c->tcp_byte_count == 0) { 5106 /* done with chunks, process chunk_trailer lines */ 5107 c->http_in_chunk_headers = 3; 5108 } 5109 return 1; 5110 } 5111 /* ignore other headers */ 5112 return 1; 5113 } 5114 5115 /** handle nonchunked data segment, 0=fail, 1=wait */ 5116 static int 5117 http_nonchunk_segment(struct comm_point* c) 5118 { 5119 /* c->buffer at position..limit has new data we read in. 5120 * the buffer itself is full of nonchunked data. 5121 * we are looking to read tcp_byte_count more data 5122 * and then the transfer is done. */ 5123 size_t remainbufferlen; 5124 size_t got_now = sldns_buffer_limit(c->buffer); 5125 if(c->tcp_byte_count <= got_now) { 5126 /* done, this is the last data fragment */ 5127 c->http_stored = 0; 5128 sldns_buffer_set_position(c->buffer, 0); 5129 fptr_ok(fptr_whitelist_comm_point(c->callback)); 5130 (void)(*c->callback)(c, c->cb_arg, NETEVENT_DONE, NULL); 5131 return 1; 5132 } 5133 /* if we have the buffer space, 5134 * read more data collected into the buffer */ 5135 remainbufferlen = sldns_buffer_capacity(c->buffer) - 5136 sldns_buffer_limit(c->buffer); 5137 if(remainbufferlen+got_now >= c->tcp_byte_count || 5138 remainbufferlen >= (size_t)(c->ssl?16384:2048)) { 5139 size_t total = sldns_buffer_limit(c->buffer); 5140 sldns_buffer_clear(c->buffer); 5141 sldns_buffer_set_position(c->buffer, total); 5142 c->http_stored = total; 5143 /* return and wait to read more */ 5144 return 1; 5145 } 5146 /* call callback with this data amount, then 5147 * wait for more */ 5148 c->tcp_byte_count -= got_now; 5149 c->http_stored = 0; 5150 sldns_buffer_set_position(c->buffer, 0); 5151 fptr_ok(fptr_whitelist_comm_point(c->callback)); 5152 (void)(*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, NULL); 5153 /* c->callback has to buffer_clear(c->buffer). */ 5154 /* return and wait to read more */ 5155 return 1; 5156 } 5157 5158 /** handle chunked data segment, return 0=fail, 1=wait, 2=process more */ 5159 static int 5160 http_chunked_segment(struct comm_point* c) 5161 { 5162 /* the c->buffer has from position..limit new data we read. */ 5163 /* the current chunk has length tcp_byte_count. 5164 * once we read that read more chunk headers. 5165 */ 5166 size_t remainbufferlen; 5167 size_t got_now = sldns_buffer_limit(c->buffer) - c->http_stored; 5168 verbose(VERB_ALGO, "http_chunked_segment: got now %d, tcpbytcount %d, http_stored %d, buffer pos %d, buffer limit %d", (int)got_now, (int)c->tcp_byte_count, (int)c->http_stored, (int)sldns_buffer_position(c->buffer), (int)sldns_buffer_limit(c->buffer)); 5169 if(c->tcp_byte_count <= got_now) { 5170 /* the chunk has completed (with perhaps some extra data 5171 * from next chunk header and next chunk) */ 5172 /* save too much info into temp buffer */ 5173 size_t fraglen; 5174 struct comm_reply repinfo; 5175 c->http_stored = 0; 5176 sldns_buffer_skip(c->buffer, (ssize_t)c->tcp_byte_count); 5177 sldns_buffer_clear(c->http_temp); 5178 if(sldns_buffer_remaining(c->buffer) > 5179 sldns_buffer_capacity(c->http_temp)) { 5180 verbose(VERB_OPS, "http chunked: surplus %d exceeds " 5181 "temp buffer %d", (int)sldns_buffer_remaining( 5182 c->buffer), (int)sldns_buffer_capacity( 5183 c->http_temp)); 5184 return 0; 5185 } 5186 sldns_buffer_write(c->http_temp, 5187 sldns_buffer_current(c->buffer), 5188 sldns_buffer_remaining(c->buffer)); 5189 sldns_buffer_flip(c->http_temp); 5190 5191 /* callback with this fragment */ 5192 fraglen = sldns_buffer_position(c->buffer); 5193 sldns_buffer_set_position(c->buffer, 0); 5194 sldns_buffer_set_limit(c->buffer, fraglen); 5195 repinfo = c->repinfo; 5196 fptr_ok(fptr_whitelist_comm_point(c->callback)); 5197 (void)(*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, &repinfo); 5198 /* c->callback has to buffer_clear(). */ 5199 5200 /* is commpoint deleted? */ 5201 if(!repinfo.c) { 5202 return 1; 5203 } 5204 /* copy waiting info */ 5205 sldns_buffer_clear(c->buffer); 5206 sldns_buffer_write(c->buffer, 5207 sldns_buffer_begin(c->http_temp), 5208 sldns_buffer_remaining(c->http_temp)); 5209 sldns_buffer_flip(c->buffer); 5210 /* process end of chunk trailer header lines, until 5211 * an empty line */ 5212 c->http_in_chunk_headers = 3; 5213 /* process more data in buffer (if any) */ 5214 return 2; 5215 } 5216 c->tcp_byte_count -= got_now; 5217 5218 /* if we have the buffer space, 5219 * read more data collected into the buffer */ 5220 remainbufferlen = sldns_buffer_capacity(c->buffer) - 5221 sldns_buffer_limit(c->buffer); 5222 if(remainbufferlen >= c->tcp_byte_count || 5223 remainbufferlen >= 2048) { 5224 size_t total = sldns_buffer_limit(c->buffer); 5225 sldns_buffer_clear(c->buffer); 5226 sldns_buffer_set_position(c->buffer, total); 5227 c->http_stored = total; 5228 /* return and wait to read more */ 5229 return 1; 5230 } 5231 5232 /* callback of http reader for a new part of the data */ 5233 c->http_stored = 0; 5234 sldns_buffer_set_position(c->buffer, 0); 5235 fptr_ok(fptr_whitelist_comm_point(c->callback)); 5236 (void)(*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, NULL); 5237 /* c->callback has to buffer_clear(c->buffer). */ 5238 /* return and wait to read more */ 5239 return 1; 5240 } 5241 5242 #ifdef HAVE_NGHTTP2 5243 /** Create new http2 session. Called when creating handling comm point. */ 5244 static struct http2_session* http2_session_create(struct comm_point* c) 5245 { 5246 struct http2_session* session = calloc(1, sizeof(*session)); 5247 if(!session) { 5248 log_err("malloc failure while creating http2 session"); 5249 return NULL; 5250 } 5251 session->c = c; 5252 5253 return session; 5254 } 5255 #endif 5256 5257 /** Delete http2 session. After closing connection or on error */ 5258 static void http2_session_delete(struct http2_session* h2_session) 5259 { 5260 #ifdef HAVE_NGHTTP2 5261 if(h2_session->callbacks) 5262 nghttp2_session_callbacks_del(h2_session->callbacks); 5263 free(h2_session); 5264 #else 5265 (void)h2_session; 5266 #endif 5267 } 5268 5269 #ifdef HAVE_NGHTTP2 5270 struct http2_stream* http2_stream_create(int32_t stream_id) 5271 { 5272 struct http2_stream* h2_stream = calloc(1, sizeof(*h2_stream)); 5273 if(!h2_stream) { 5274 log_err("malloc failure while creating http2 stream"); 5275 return NULL; 5276 } 5277 h2_stream->stream_id = stream_id; 5278 return h2_stream; 5279 } 5280 #endif 5281 5282 void http2_stream_add_meshstate(struct http2_stream* h2_stream, 5283 struct mesh_area* mesh, struct mesh_state* m) 5284 { 5285 h2_stream->mesh = mesh; 5286 h2_stream->mesh_state = m; 5287 } 5288 5289 void http2_stream_remove_mesh_state(struct http2_stream* h2_stream) 5290 { 5291 if(!h2_stream) 5292 return; 5293 h2_stream->mesh_state = NULL; 5294 } 5295 5296 #ifdef HAVE_NGHTTP2 5297 void http2_session_add_stream(struct http2_session* h2_session, 5298 struct http2_stream* h2_stream) 5299 { 5300 if(h2_session->first_stream) 5301 h2_session->first_stream->prev = h2_stream; 5302 h2_stream->next = h2_session->first_stream; 5303 h2_session->first_stream = h2_stream; 5304 } 5305 5306 /** remove stream from session linked list. After stream close callback or 5307 * closing connection */ 5308 static void http2_session_remove_stream(struct http2_session* h2_session, 5309 struct http2_stream* h2_stream) 5310 { 5311 if(h2_stream->prev) 5312 h2_stream->prev->next = h2_stream->next; 5313 else 5314 h2_session->first_stream = h2_stream->next; 5315 if(h2_stream->next) 5316 h2_stream->next->prev = h2_stream->prev; 5317 5318 } 5319 5320 int http2_stream_close_cb(nghttp2_session* ATTR_UNUSED(session), 5321 int32_t stream_id, uint32_t ATTR_UNUSED(error_code), void* cb_arg) 5322 { 5323 struct http2_stream* h2_stream; 5324 struct http2_session* h2_session = (struct http2_session*)cb_arg; 5325 if(!(h2_stream = nghttp2_session_get_stream_user_data( 5326 h2_session->session, stream_id))) { 5327 return 0; 5328 } 5329 http2_session_remove_stream(h2_session, h2_stream); 5330 http2_stream_delete(h2_session, h2_stream); 5331 return 0; 5332 } 5333 5334 ssize_t http2_recv_cb(nghttp2_session* ATTR_UNUSED(session), uint8_t* buf, 5335 size_t len, int ATTR_UNUSED(flags), void* cb_arg) 5336 { 5337 struct http2_session* h2_session = (struct http2_session*)cb_arg; 5338 ssize_t ret; 5339 5340 log_assert(h2_session->c->type == comm_http); 5341 log_assert(h2_session->c->h2_session); 5342 if(++h2_session->reads_count > h2_session->c->http2_max_streams) { 5343 /* We are somewhat arbitrarily capping the amount of 5344 * consecutive reads on the HTTP2 session to the number of max 5345 * allowed streams. 5346 * When we reach the cap, error out with NGHTTP2_ERR_WOULDBLOCK 5347 * to signal nghttp2_session_recv() to stop reading for now. */ 5348 h2_session->reads_count = 0; 5349 return NGHTTP2_ERR_WOULDBLOCK; 5350 } 5351 5352 #ifdef HAVE_SSL 5353 if(h2_session->c->ssl) { 5354 int r; 5355 ERR_clear_error(); 5356 r = SSL_read(h2_session->c->ssl, buf, len); 5357 if(r <= 0) { 5358 int want = SSL_get_error(h2_session->c->ssl, r); 5359 if(want == SSL_ERROR_ZERO_RETURN) { 5360 return NGHTTP2_ERR_EOF; 5361 } else if(want == SSL_ERROR_WANT_READ) { 5362 return NGHTTP2_ERR_WOULDBLOCK; 5363 } else if(want == SSL_ERROR_WANT_WRITE) { 5364 h2_session->c->ssl_shake_state = comm_ssl_shake_hs_write; 5365 comm_point_listen_for_rw(h2_session->c, 0, 1); 5366 return NGHTTP2_ERR_WOULDBLOCK; 5367 } else if(want == SSL_ERROR_SYSCALL) { 5368 #ifdef ECONNRESET 5369 if(errno == ECONNRESET && verbosity < 2) 5370 return NGHTTP2_ERR_CALLBACK_FAILURE; 5371 #endif 5372 if(errno != 0) 5373 log_err("SSL_read syscall: %s", 5374 strerror(errno)); 5375 return NGHTTP2_ERR_CALLBACK_FAILURE; 5376 } 5377 log_crypto_err_io("could not SSL_read", want); 5378 return NGHTTP2_ERR_CALLBACK_FAILURE; 5379 } 5380 return r; 5381 } 5382 #endif /* HAVE_SSL */ 5383 5384 ret = recv(h2_session->c->fd, (void*)buf, len, MSG_DONTWAIT); 5385 if(ret == 0) { 5386 return NGHTTP2_ERR_EOF; 5387 } else if(ret < 0) { 5388 #ifndef USE_WINSOCK 5389 if(errno == EINTR || errno == EAGAIN) 5390 return NGHTTP2_ERR_WOULDBLOCK; 5391 #ifdef ECONNRESET 5392 if(errno == ECONNRESET && verbosity < 2) 5393 return NGHTTP2_ERR_CALLBACK_FAILURE; 5394 #endif 5395 log_err_addr("could not http2 recv: %s", strerror(errno), 5396 &h2_session->c->repinfo.remote_addr, 5397 h2_session->c->repinfo.remote_addrlen); 5398 #else /* USE_WINSOCK */ 5399 if(WSAGetLastError() == WSAECONNRESET) 5400 return NGHTTP2_ERR_CALLBACK_FAILURE; 5401 if(WSAGetLastError() == WSAEINPROGRESS) 5402 return NGHTTP2_ERR_WOULDBLOCK; 5403 if(WSAGetLastError() == WSAEWOULDBLOCK) { 5404 ub_winsock_tcp_wouldblock(h2_session->c->ev->ev, 5405 UB_EV_READ); 5406 return NGHTTP2_ERR_WOULDBLOCK; 5407 } 5408 log_err_addr("could not http2 recv: %s", 5409 wsa_strerror(WSAGetLastError()), 5410 &h2_session->c->repinfo.remote_addr, 5411 h2_session->c->repinfo.remote_addrlen); 5412 #endif 5413 return NGHTTP2_ERR_CALLBACK_FAILURE; 5414 } 5415 return ret; 5416 } 5417 #endif /* HAVE_NGHTTP2 */ 5418 5419 /** Handle http2 read */ 5420 static int 5421 comm_point_http2_handle_read(int ATTR_UNUSED(fd), struct comm_point* c) 5422 { 5423 #ifdef HAVE_NGHTTP2 5424 int ret; 5425 log_assert(c->h2_session); 5426 5427 /* reading until recv cb returns NGHTTP2_ERR_WOULDBLOCK */ 5428 ret = nghttp2_session_recv(c->h2_session->session); 5429 if(ret) { 5430 if(ret != NGHTTP2_ERR_EOF && 5431 ret != NGHTTP2_ERR_CALLBACK_FAILURE) { 5432 char a[256]; 5433 addr_to_str(&c->repinfo.remote_addr, 5434 c->repinfo.remote_addrlen, a, sizeof(a)); 5435 verbose(VERB_QUERY, "http2: session_recv from %s failed, " 5436 "error: %s", a, nghttp2_strerror(ret)); 5437 } 5438 return 0; 5439 } 5440 if(nghttp2_session_want_write(c->h2_session->session)) { 5441 c->tcp_is_reading = 0; 5442 comm_point_stop_listening(c); 5443 comm_point_start_listening(c, -1, adjusted_tcp_timeout(c)); 5444 } else if(!nghttp2_session_want_read(c->h2_session->session)) 5445 return 0; /* connection can be closed */ 5446 return 1; 5447 #else 5448 (void)c; 5449 return 0; 5450 #endif 5451 } 5452 5453 /** 5454 * Handle http reading callback. 5455 * @param fd: file descriptor of socket. 5456 * @param c: comm point to read from into buffer. 5457 * @return: 0 on error 5458 */ 5459 static int 5460 comm_point_http_handle_read(int fd, struct comm_point* c) 5461 { 5462 log_assert(c->type == comm_http); 5463 log_assert(fd != -1); 5464 5465 /* if we are in ssl handshake, handle SSL handshake */ 5466 #ifdef HAVE_SSL 5467 if(c->ssl && c->ssl_shake_state != comm_ssl_shake_none) { 5468 if(!ssl_handshake(c)) 5469 return 0; 5470 if(c->ssl_shake_state != comm_ssl_shake_none) 5471 return 1; 5472 } 5473 #endif /* HAVE_SSL */ 5474 5475 if(!c->tcp_is_reading) 5476 return 1; 5477 5478 if(c->use_h2) { 5479 return comm_point_http2_handle_read(fd, c); 5480 } 5481 5482 /* http version is <= http/1.1 */ 5483 5484 if(c->http_min_version >= http_version_2) { 5485 /* HTTP/2 failed, not allowed to use lower version. */ 5486 return 0; 5487 } 5488 5489 /* read more data */ 5490 if(c->ssl) { 5491 if(!ssl_http_read_more(c)) 5492 return 0; 5493 } else { 5494 if(!http_read_more(fd, c)) 5495 return 0; 5496 } 5497 5498 if(c->http_stored >= sldns_buffer_position(c->buffer)) { 5499 /* read did not work but we wanted more data, there is 5500 * no bytes to process now. */ 5501 return 1; 5502 } 5503 sldns_buffer_flip(c->buffer); 5504 /* if we are partway in a segment of data, position us at the point 5505 * where we left off previously */ 5506 if(c->http_stored < sldns_buffer_limit(c->buffer)) 5507 sldns_buffer_set_position(c->buffer, c->http_stored); 5508 else sldns_buffer_set_position(c->buffer, sldns_buffer_limit(c->buffer)); 5509 5510 while(sldns_buffer_remaining(c->buffer) > 0) { 5511 /* Handle HTTP/1.x data */ 5512 /* if we are reading headers, read more headers */ 5513 if(c->http_in_headers || c->http_in_chunk_headers) { 5514 /* if header is done, process the header */ 5515 if(!http_header_done(c->buffer)) { 5516 if(sldns_buffer_limit(c->buffer) == 5517 sldns_buffer_capacity(c->buffer)) { 5518 verbose(VERB_OPS, "http header line " 5519 "exceeds %d bytes, transfer " 5520 "failed", (int)sldns_buffer_capacity(c->buffer)); 5521 return 0; 5522 } 5523 /* copy remaining data to front of buffer 5524 * and set rest for writing into it */ 5525 http_moveover_buffer(c->buffer); 5526 /* return and wait to read more */ 5527 return 1; 5528 } 5529 if(!c->http_in_chunk_headers) { 5530 /* process initial headers */ 5531 if(!http_process_initial_header(c)) 5532 return 0; 5533 } else { 5534 /* process chunk headers */ 5535 int r = http_process_chunk_header(c); 5536 if(r == 0) return 0; 5537 if(r == 2) return 1; /* done */ 5538 /* r == 1, continue */ 5539 } 5540 /* see if we have more to process */ 5541 continue; 5542 } 5543 5544 if(!c->http_is_chunked) { 5545 /* if we are reading nonchunks, process that*/ 5546 return http_nonchunk_segment(c); 5547 } else { 5548 /* if we are reading chunks, read the chunk */ 5549 int r = http_chunked_segment(c); 5550 if(r == 0) return 0; 5551 if(r == 1) return 1; 5552 continue; 5553 } 5554 } 5555 /* broke out of the loop; could not process header instead need 5556 * to read more */ 5557 /* moveover any remaining data and read more data */ 5558 http_moveover_buffer(c->buffer); 5559 /* return and wait to read more */ 5560 return 1; 5561 } 5562 5563 /** check pending connect for http */ 5564 static int 5565 http_check_connect(int fd, struct comm_point* c) 5566 { 5567 /* check for pending error from nonblocking connect */ 5568 /* from Stevens, unix network programming, vol1, 3rd ed, p450*/ 5569 int error = 0; 5570 socklen_t len = (socklen_t)sizeof(error); 5571 if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error, 5572 &len) < 0){ 5573 #ifndef USE_WINSOCK 5574 error = errno; /* on solaris errno is error */ 5575 #else /* USE_WINSOCK */ 5576 error = WSAGetLastError(); 5577 #endif 5578 } 5579 #ifndef USE_WINSOCK 5580 #if defined(EINPROGRESS) && defined(EWOULDBLOCK) 5581 if(error == EINPROGRESS || error == EWOULDBLOCK) 5582 return 1; /* try again later */ 5583 else 5584 #endif 5585 if(error != 0 && verbosity < 2) 5586 return 0; /* silence lots of chatter in the logs */ 5587 else if(error != 0) { 5588 log_err_addr("http connect", strerror(error), 5589 &c->repinfo.remote_addr, c->repinfo.remote_addrlen); 5590 #else /* USE_WINSOCK */ 5591 /* examine error */ 5592 if(error == WSAEINPROGRESS) 5593 return 1; 5594 else if(error == WSAEWOULDBLOCK) { 5595 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE); 5596 return 1; 5597 } else if(error != 0 && verbosity < 2) 5598 return 0; 5599 else if(error != 0) { 5600 log_err_addr("http connect", wsa_strerror(error), 5601 &c->repinfo.remote_addr, c->repinfo.remote_addrlen); 5602 #endif /* USE_WINSOCK */ 5603 return 0; 5604 } 5605 /* keep on processing this socket */ 5606 return 2; 5607 } 5608 5609 /** write more data for http (with ssl) */ 5610 static int 5611 ssl_http_write_more(struct comm_point* c) 5612 { 5613 #ifdef HAVE_SSL 5614 int r; 5615 log_assert(sldns_buffer_remaining(c->buffer) > 0); 5616 ERR_clear_error(); 5617 r = SSL_write(c->ssl, (void*)sldns_buffer_current(c->buffer), 5618 (int)sldns_buffer_remaining(c->buffer)); 5619 if(r <= 0) { 5620 int want = SSL_get_error(c->ssl, r); 5621 if(want == SSL_ERROR_ZERO_RETURN) { 5622 return 0; /* closed */ 5623 } else if(want == SSL_ERROR_WANT_READ) { 5624 c->ssl_shake_state = comm_ssl_shake_hs_read; 5625 comm_point_listen_for_rw(c, 1, 0); 5626 return 1; /* wait for read condition */ 5627 } else if(want == SSL_ERROR_WANT_WRITE) { 5628 return 1; /* write more later */ 5629 } else if(want == SSL_ERROR_SYSCALL) { 5630 #ifdef EPIPE 5631 if(errno == EPIPE && verbosity < 2) 5632 return 0; /* silence 'broken pipe' */ 5633 #endif 5634 if(errno != 0) 5635 log_err("SSL_write syscall: %s", 5636 strerror(errno)); 5637 return 0; 5638 } 5639 log_crypto_err_io("could not SSL_write", want); 5640 return 0; 5641 } 5642 sldns_buffer_skip(c->buffer, (ssize_t)r); 5643 return 1; 5644 #else 5645 (void)c; 5646 return 0; 5647 #endif /* HAVE_SSL */ 5648 } 5649 5650 /** write more data for http */ 5651 static int 5652 http_write_more(int fd, struct comm_point* c) 5653 { 5654 ssize_t r; 5655 log_assert(sldns_buffer_remaining(c->buffer) > 0); 5656 r = send(fd, (void*)sldns_buffer_current(c->buffer), 5657 sldns_buffer_remaining(c->buffer), 0); 5658 if(r == -1) { 5659 #ifndef USE_WINSOCK 5660 if(errno == EINTR || errno == EAGAIN) 5661 return 1; 5662 #else 5663 if(WSAGetLastError() == WSAEINPROGRESS) 5664 return 1; 5665 if(WSAGetLastError() == WSAEWOULDBLOCK) { 5666 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE); 5667 return 1; 5668 } 5669 #endif 5670 log_err_addr("http send r", sock_strerror(errno), 5671 &c->repinfo.remote_addr, c->repinfo.remote_addrlen); 5672 return 0; 5673 } 5674 sldns_buffer_skip(c->buffer, r); 5675 return 1; 5676 } 5677 5678 #ifdef HAVE_NGHTTP2 5679 ssize_t http2_send_cb(nghttp2_session* ATTR_UNUSED(session), const uint8_t* buf, 5680 size_t len, int ATTR_UNUSED(flags), void* cb_arg) 5681 { 5682 ssize_t ret; 5683 struct http2_session* h2_session = (struct http2_session*)cb_arg; 5684 log_assert(h2_session->c->type == comm_http); 5685 log_assert(h2_session->c->h2_session); 5686 5687 #ifdef HAVE_SSL 5688 if(h2_session->c->ssl) { 5689 int r; 5690 ERR_clear_error(); 5691 r = SSL_write(h2_session->c->ssl, buf, len); 5692 if(r <= 0) { 5693 int want = SSL_get_error(h2_session->c->ssl, r); 5694 if(want == SSL_ERROR_ZERO_RETURN) { 5695 return NGHTTP2_ERR_CALLBACK_FAILURE; 5696 } else if(want == SSL_ERROR_WANT_READ) { 5697 h2_session->c->ssl_shake_state = comm_ssl_shake_hs_read; 5698 comm_point_listen_for_rw(h2_session->c, 1, 0); 5699 return NGHTTP2_ERR_WOULDBLOCK; 5700 } else if(want == SSL_ERROR_WANT_WRITE) { 5701 return NGHTTP2_ERR_WOULDBLOCK; 5702 } else if(want == SSL_ERROR_SYSCALL) { 5703 #ifdef EPIPE 5704 if(errno == EPIPE && verbosity < 2) 5705 return NGHTTP2_ERR_CALLBACK_FAILURE; 5706 #endif 5707 if(errno != 0) 5708 log_err("SSL_write syscall: %s", 5709 strerror(errno)); 5710 return NGHTTP2_ERR_CALLBACK_FAILURE; 5711 } 5712 log_crypto_err_io("could not SSL_write", want); 5713 return NGHTTP2_ERR_CALLBACK_FAILURE; 5714 } 5715 return r; 5716 } 5717 #endif /* HAVE_SSL */ 5718 5719 ret = send(h2_session->c->fd, (void*)buf, len, 0); 5720 if(ret == 0) { 5721 return NGHTTP2_ERR_CALLBACK_FAILURE; 5722 } else if(ret < 0) { 5723 #ifndef USE_WINSOCK 5724 if(errno == EINTR || errno == EAGAIN) 5725 return NGHTTP2_ERR_WOULDBLOCK; 5726 #ifdef EPIPE 5727 if(errno == EPIPE && verbosity < 2) 5728 return NGHTTP2_ERR_CALLBACK_FAILURE; 5729 #endif 5730 #ifdef ECONNRESET 5731 if(errno == ECONNRESET && verbosity < 2) 5732 return NGHTTP2_ERR_CALLBACK_FAILURE; 5733 #endif 5734 log_err_addr("could not http2 write: %s", strerror(errno), 5735 &h2_session->c->repinfo.remote_addr, 5736 h2_session->c->repinfo.remote_addrlen); 5737 #else /* USE_WINSOCK */ 5738 if(WSAGetLastError() == WSAENOTCONN) 5739 return NGHTTP2_ERR_WOULDBLOCK; 5740 if(WSAGetLastError() == WSAEINPROGRESS) 5741 return NGHTTP2_ERR_WOULDBLOCK; 5742 if(WSAGetLastError() == WSAEWOULDBLOCK) { 5743 ub_winsock_tcp_wouldblock(h2_session->c->ev->ev, 5744 UB_EV_WRITE); 5745 return NGHTTP2_ERR_WOULDBLOCK; 5746 } 5747 if(WSAGetLastError() == WSAECONNRESET && verbosity < 2) 5748 return NGHTTP2_ERR_CALLBACK_FAILURE; 5749 log_err_addr("could not http2 write: %s", 5750 wsa_strerror(WSAGetLastError()), 5751 &h2_session->c->repinfo.remote_addr, 5752 h2_session->c->repinfo.remote_addrlen); 5753 #endif 5754 return NGHTTP2_ERR_CALLBACK_FAILURE; 5755 } 5756 return ret; 5757 } 5758 #endif /* HAVE_NGHTTP2 */ 5759 5760 /** Handle http2 writing */ 5761 static int 5762 comm_point_http2_handle_write(int ATTR_UNUSED(fd), struct comm_point* c) 5763 { 5764 #ifdef HAVE_NGHTTP2 5765 int ret; 5766 log_assert(c->h2_session); 5767 5768 ret = nghttp2_session_send(c->h2_session->session); 5769 if(ret) { 5770 verbose(VERB_QUERY, "http2: session_send failed, " 5771 "error: %s", nghttp2_strerror(ret)); 5772 return 0; 5773 } 5774 5775 if(nghttp2_session_want_read(c->h2_session->session)) { 5776 c->tcp_is_reading = 1; 5777 comm_point_stop_listening(c); 5778 comm_point_start_listening(c, -1, adjusted_tcp_timeout(c)); 5779 } else if(!nghttp2_session_want_write(c->h2_session->session)) 5780 return 0; /* connection can be closed */ 5781 return 1; 5782 #else 5783 (void)c; 5784 return 0; 5785 #endif 5786 } 5787 5788 /** 5789 * Handle http writing callback. 5790 * @param fd: file descriptor of socket. 5791 * @param c: comm point to write buffer out of. 5792 * @return: 0 on error 5793 */ 5794 static int 5795 comm_point_http_handle_write(int fd, struct comm_point* c) 5796 { 5797 log_assert(c->type == comm_http); 5798 log_assert(fd != -1); 5799 5800 /* check pending connect errors, if that fails, we wait for more, 5801 * or we can continue to write contents */ 5802 if(c->tcp_check_nb_connect) { 5803 int r = http_check_connect(fd, c); 5804 if(r == 0) return 0; 5805 if(r == 1) return 1; 5806 c->tcp_check_nb_connect = 0; 5807 } 5808 /* if we are in ssl handshake, handle SSL handshake */ 5809 #ifdef HAVE_SSL 5810 if(c->ssl && c->ssl_shake_state != comm_ssl_shake_none) { 5811 if(!ssl_handshake(c)) 5812 return 0; 5813 if(c->ssl_shake_state != comm_ssl_shake_none) 5814 return 1; 5815 } 5816 #endif /* HAVE_SSL */ 5817 if(c->tcp_is_reading) 5818 return 1; 5819 5820 if(c->use_h2) { 5821 return comm_point_http2_handle_write(fd, c); 5822 } 5823 5824 /* http version is <= http/1.1 */ 5825 5826 if(c->http_min_version >= http_version_2) { 5827 /* HTTP/2 failed, not allowed to use lower version. */ 5828 return 0; 5829 } 5830 5831 /* if we are writing, write more */ 5832 if(c->ssl) { 5833 if(!ssl_http_write_more(c)) 5834 return 0; 5835 } else { 5836 if(!http_write_more(fd, c)) 5837 return 0; 5838 } 5839 5840 /* we write a single buffer contents, that can contain 5841 * the http request, and then flip to read the results */ 5842 /* see if write is done */ 5843 if(sldns_buffer_remaining(c->buffer) == 0) { 5844 sldns_buffer_clear(c->buffer); 5845 if(c->tcp_do_toggle_rw) 5846 c->tcp_is_reading = 1; 5847 c->tcp_byte_count = 0; 5848 /* switch from listening(write) to listening(read) */ 5849 comm_point_stop_listening(c); 5850 comm_point_start_listening(c, -1, -1); 5851 } 5852 return 1; 5853 } 5854 5855 void 5856 comm_point_http_handle_callback(int fd, short event, void* arg) 5857 { 5858 struct comm_point* c = (struct comm_point*)arg; 5859 log_assert(c->type == comm_http); 5860 ub_comm_base_now(c->ev->base); 5861 5862 if((event&UB_EV_TIMEOUT)) { 5863 verbose(VERB_QUERY, "http took too long, dropped"); 5864 reclaim_http_handler(c); 5865 if(!c->tcp_do_close) { 5866 fptr_ok(fptr_whitelist_comm_point(c->callback)); 5867 (void)(*c->callback)(c, c->cb_arg, 5868 NETEVENT_TIMEOUT, NULL); 5869 } 5870 return; 5871 } 5872 if((event&UB_EV_READ)) { 5873 if(!comm_point_http_handle_read(fd, c)) { 5874 reclaim_http_handler(c); 5875 if(!c->tcp_do_close) { 5876 fptr_ok(fptr_whitelist_comm_point( 5877 c->callback)); 5878 (void)(*c->callback)(c, c->cb_arg, 5879 NETEVENT_CLOSED, NULL); 5880 } 5881 } 5882 return; 5883 } 5884 if((event&UB_EV_WRITE)) { 5885 if(!comm_point_http_handle_write(fd, c)) { 5886 reclaim_http_handler(c); 5887 if(!c->tcp_do_close) { 5888 fptr_ok(fptr_whitelist_comm_point( 5889 c->callback)); 5890 (void)(*c->callback)(c, c->cb_arg, 5891 NETEVENT_CLOSED, NULL); 5892 } 5893 } 5894 return; 5895 } 5896 log_err("Ignored event %d for httphdl.", event); 5897 } 5898 5899 void comm_point_local_handle_callback(int fd, short event, void* arg) 5900 { 5901 struct comm_point* c = (struct comm_point*)arg; 5902 log_assert(c->type == comm_local); 5903 ub_comm_base_now(c->ev->base); 5904 5905 if((event&UB_EV_READ)) { 5906 if(!comm_point_tcp_handle_read(fd, c, 1)) { 5907 fptr_ok(fptr_whitelist_comm_point(c->callback)); 5908 (void)(*c->callback)(c, c->cb_arg, NETEVENT_CLOSED, 5909 NULL); 5910 } 5911 return; 5912 } 5913 log_err("Ignored event %d for localhdl.", event); 5914 } 5915 5916 void comm_point_raw_handle_callback(int ATTR_UNUSED(fd), 5917 short event, void* arg) 5918 { 5919 struct comm_point* c = (struct comm_point*)arg; 5920 int err = NETEVENT_NOERROR; 5921 log_assert(c->type == comm_raw); 5922 ub_comm_base_now(c->ev->base); 5923 5924 if((event&UB_EV_TIMEOUT)) 5925 err = NETEVENT_TIMEOUT; 5926 fptr_ok(fptr_whitelist_comm_point_raw(c->callback)); 5927 (void)(*c->callback)(c, c->cb_arg, err, NULL); 5928 } 5929 5930 struct comm_point* 5931 comm_point_create_udp(struct comm_base *base, int fd, sldns_buffer* buffer, 5932 int pp2_enabled, comm_point_callback_type* callback, 5933 void* callback_arg, struct unbound_socket* socket) 5934 { 5935 struct comm_point* c = (struct comm_point*)calloc(1, 5936 sizeof(struct comm_point)); 5937 short evbits; 5938 if(!c) 5939 return NULL; 5940 c->ev = (struct internal_event*)calloc(1, 5941 sizeof(struct internal_event)); 5942 if(!c->ev) { 5943 free(c); 5944 return NULL; 5945 } 5946 c->ev->base = base; 5947 c->fd = fd; 5948 c->buffer = buffer; 5949 c->timeout = NULL; 5950 c->tcp_is_reading = 0; 5951 c->tcp_byte_count = 0; 5952 c->tcp_parent = NULL; 5953 c->max_tcp_count = 0; 5954 c->cur_tcp_count = 0; 5955 c->tcp_handlers = NULL; 5956 c->tcp_free = NULL; 5957 c->is_in_tcp_free = 0; 5958 c->type = comm_udp; 5959 c->tcp_do_close = 0; 5960 c->do_not_close = 0; 5961 c->tcp_do_toggle_rw = 0; 5962 c->tcp_check_nb_connect = 0; 5963 #ifdef USE_MSG_FASTOPEN 5964 c->tcp_do_fastopen = 0; 5965 #endif 5966 #ifdef USE_DNSCRYPT 5967 c->dnscrypt = 0; 5968 c->dnscrypt_buffer = buffer; 5969 #endif 5970 c->inuse = 0; 5971 c->callback = callback; 5972 c->cb_arg = callback_arg; 5973 c->socket = socket; 5974 c->pp2_enabled = pp2_enabled; 5975 c->pp2_header_state = pp2_header_none; 5976 evbits = UB_EV_READ | UB_EV_PERSIST; 5977 /* ub_event stuff */ 5978 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 5979 comm_point_udp_callback, c); 5980 if(c->ev->ev == NULL) { 5981 log_err("could not baseset udp event"); 5982 comm_point_delete(c); 5983 return NULL; 5984 } 5985 if(fd!=-1 && ub_event_add(c->ev->ev, c->timeout) != 0 ) { 5986 log_err("could not add udp event"); 5987 comm_point_delete(c); 5988 return NULL; 5989 } 5990 c->event_added = 1; 5991 return c; 5992 } 5993 5994 #if defined(AF_INET6) && defined(IPV6_PKTINFO) && defined(HAVE_RECVMSG) 5995 struct comm_point* 5996 comm_point_create_udp_ancil(struct comm_base *base, int fd, 5997 sldns_buffer* buffer, int pp2_enabled, 5998 comm_point_callback_type* callback, void* callback_arg, struct unbound_socket* socket) 5999 { 6000 struct comm_point* c = (struct comm_point*)calloc(1, 6001 sizeof(struct comm_point)); 6002 short evbits; 6003 if(!c) 6004 return NULL; 6005 c->ev = (struct internal_event*)calloc(1, 6006 sizeof(struct internal_event)); 6007 if(!c->ev) { 6008 free(c); 6009 return NULL; 6010 } 6011 c->ev->base = base; 6012 c->fd = fd; 6013 c->buffer = buffer; 6014 c->timeout = NULL; 6015 c->tcp_is_reading = 0; 6016 c->tcp_byte_count = 0; 6017 c->tcp_parent = NULL; 6018 c->max_tcp_count = 0; 6019 c->cur_tcp_count = 0; 6020 c->tcp_handlers = NULL; 6021 c->tcp_free = NULL; 6022 c->is_in_tcp_free = 0; 6023 c->type = comm_udp; 6024 c->tcp_do_close = 0; 6025 c->do_not_close = 0; 6026 #ifdef USE_DNSCRYPT 6027 c->dnscrypt = 0; 6028 c->dnscrypt_buffer = buffer; 6029 #endif 6030 c->inuse = 0; 6031 c->tcp_do_toggle_rw = 0; 6032 c->tcp_check_nb_connect = 0; 6033 #ifdef USE_MSG_FASTOPEN 6034 c->tcp_do_fastopen = 0; 6035 #endif 6036 c->callback = callback; 6037 c->cb_arg = callback_arg; 6038 c->socket = socket; 6039 c->pp2_enabled = pp2_enabled; 6040 c->pp2_header_state = pp2_header_none; 6041 evbits = UB_EV_READ | UB_EV_PERSIST; 6042 /* ub_event stuff */ 6043 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6044 comm_point_udp_ancil_callback, c); 6045 if(c->ev->ev == NULL) { 6046 log_err("could not baseset udp event"); 6047 comm_point_delete(c); 6048 return NULL; 6049 } 6050 if(fd!=-1 && ub_event_add(c->ev->ev, c->timeout) != 0 ) { 6051 log_err("could not add udp event"); 6052 comm_point_delete(c); 6053 return NULL; 6054 } 6055 c->event_added = 1; 6056 return c; 6057 } 6058 #endif 6059 6060 struct comm_point* 6061 comm_point_create_doq(struct comm_base *base, int fd, sldns_buffer* buffer, 6062 comm_point_callback_type* callback, void* callback_arg, 6063 struct unbound_socket* socket, struct doq_table* table, 6064 struct ub_randstate* rnd, const void* quic_sslctx, 6065 struct config_file* cfg) 6066 { 6067 #ifdef HAVE_NGTCP2 6068 struct comm_point* c = (struct comm_point*)calloc(1, 6069 sizeof(struct comm_point)); 6070 short evbits; 6071 log_assert(table != NULL); 6072 if(!c) 6073 return NULL; 6074 c->ev = (struct internal_event*)calloc(1, 6075 sizeof(struct internal_event)); 6076 if(!c->ev) { 6077 free(c); 6078 return NULL; 6079 } 6080 c->ev->base = base; 6081 c->fd = fd; 6082 c->buffer = buffer; 6083 c->timeout = NULL; 6084 c->tcp_is_reading = 0; 6085 c->tcp_byte_count = 0; 6086 c->tcp_parent = NULL; 6087 c->max_tcp_count = 0; 6088 c->cur_tcp_count = 0; 6089 c->tcp_handlers = NULL; 6090 c->tcp_free = NULL; 6091 c->is_in_tcp_free = 0; 6092 c->type = comm_doq; 6093 c->tcp_do_close = 0; 6094 c->do_not_close = 0; 6095 c->tcp_do_toggle_rw = 0; 6096 c->tcp_check_nb_connect = 0; 6097 #ifdef USE_MSG_FASTOPEN 6098 c->tcp_do_fastopen = 0; 6099 #endif 6100 #ifdef USE_DNSCRYPT 6101 c->dnscrypt = 0; 6102 c->dnscrypt_buffer = NULL; 6103 #endif 6104 c->doq_socket = doq_server_socket_create(table, rnd, quic_sslctx, c, 6105 base, cfg); 6106 if(!c->doq_socket) { 6107 log_err("could not create doq comm_point"); 6108 comm_point_delete(c); 6109 return NULL; 6110 } 6111 c->inuse = 0; 6112 c->callback = callback; 6113 c->cb_arg = callback_arg; 6114 c->socket = socket; 6115 c->pp2_enabled = 0; 6116 c->pp2_header_state = pp2_header_none; 6117 evbits = UB_EV_READ | UB_EV_PERSIST; 6118 /* ub_event stuff */ 6119 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6120 comm_point_doq_callback, c); 6121 if(c->ev->ev == NULL) { 6122 log_err("could not baseset udp event"); 6123 comm_point_delete(c); 6124 return NULL; 6125 } 6126 if(fd!=-1 && ub_event_add(c->ev->ev, c->timeout) != 0 ) { 6127 log_err("could not add udp event"); 6128 comm_point_delete(c); 6129 return NULL; 6130 } 6131 c->event_added = 1; 6132 return c; 6133 #else 6134 /* no libngtcp2, so no QUIC support */ 6135 (void)base; 6136 (void)buffer; 6137 (void)callback; 6138 (void)callback_arg; 6139 (void)socket; 6140 (void)rnd; 6141 (void)table; 6142 (void)quic_sslctx; 6143 (void)cfg; 6144 sock_close(fd); 6145 return NULL; 6146 #endif /* HAVE_NGTCP2 */ 6147 } 6148 6149 static struct comm_point* 6150 comm_point_create_tcp_handler(struct comm_base *base, 6151 struct comm_point* parent, size_t bufsize, 6152 struct sldns_buffer* spoolbuf, comm_point_callback_type* callback, 6153 void* callback_arg, struct unbound_socket* socket) 6154 { 6155 struct comm_point* c = (struct comm_point*)calloc(1, 6156 sizeof(struct comm_point)); 6157 short evbits; 6158 if(!c) 6159 return NULL; 6160 c->ev = (struct internal_event*)calloc(1, 6161 sizeof(struct internal_event)); 6162 if(!c->ev) { 6163 free(c); 6164 return NULL; 6165 } 6166 c->ev->base = base; 6167 c->fd = -1; 6168 c->buffer = sldns_buffer_new(bufsize); 6169 if(!c->buffer) { 6170 free(c->ev); 6171 free(c); 6172 return NULL; 6173 } 6174 c->timeout = (struct timeval*)malloc(sizeof(struct timeval)); 6175 if(!c->timeout) { 6176 sldns_buffer_free(c->buffer); 6177 free(c->ev); 6178 free(c); 6179 return NULL; 6180 } 6181 c->tcp_is_reading = 0; 6182 c->tcp_byte_count = 0; 6183 c->tcp_parent = parent; 6184 c->tcp_timeout_msec = parent->tcp_timeout_msec; 6185 c->tcp_conn_limit = parent->tcp_conn_limit; 6186 c->tcl_addr = NULL; 6187 c->tcp_keepalive = 0; 6188 c->max_tcp_count = 0; 6189 c->cur_tcp_count = 0; 6190 c->tcp_handlers = NULL; 6191 c->tcp_free = NULL; 6192 c->is_in_tcp_free = 0; 6193 c->type = comm_tcp; 6194 c->tcp_do_close = 0; 6195 c->do_not_close = 0; 6196 c->tcp_do_toggle_rw = 1; 6197 c->tcp_check_nb_connect = 0; 6198 #ifdef USE_MSG_FASTOPEN 6199 c->tcp_do_fastopen = 0; 6200 #endif 6201 #ifdef USE_DNSCRYPT 6202 c->dnscrypt = 0; 6203 /* We don't know just yet if this is a dnscrypt channel. Allocation 6204 * will be done when handling the callback. */ 6205 c->dnscrypt_buffer = c->buffer; 6206 #endif 6207 c->repinfo.c = c; 6208 c->callback = callback; 6209 c->cb_arg = callback_arg; 6210 c->socket = socket; 6211 c->pp2_enabled = parent->pp2_enabled; 6212 c->pp2_header_state = pp2_header_none; 6213 if(spoolbuf) { 6214 c->tcp_req_info = tcp_req_info_create(base, spoolbuf); 6215 if(!c->tcp_req_info) { 6216 log_err("could not create tcp commpoint"); 6217 sldns_buffer_free(c->buffer); 6218 free(c->timeout); 6219 free(c->ev); 6220 free(c); 6221 return NULL; 6222 } 6223 c->tcp_req_info->cp = c; 6224 c->tcp_do_close = 1; 6225 c->tcp_do_toggle_rw = 0; 6226 } 6227 /* add to parent free list */ 6228 c->tcp_free = parent->tcp_free; 6229 parent->tcp_free = c; 6230 c->is_in_tcp_free = 1; 6231 /* ub_event stuff */ 6232 evbits = UB_EV_PERSIST | UB_EV_READ | UB_EV_TIMEOUT; 6233 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6234 comm_point_tcp_handle_callback, c); 6235 if(c->ev->ev == NULL) 6236 { 6237 log_err("could not basetset tcphdl event"); 6238 parent->tcp_free = c->tcp_free; 6239 tcp_req_info_delete(c->tcp_req_info); 6240 sldns_buffer_free(c->buffer); 6241 free(c->timeout); 6242 free(c->ev); 6243 free(c); 6244 return NULL; 6245 } 6246 return c; 6247 } 6248 6249 static struct comm_point* 6250 comm_point_create_http_handler(struct comm_base *base, 6251 struct comm_point* parent, size_t bufsize, int harden_large_queries, 6252 uint32_t http_max_streams, char* http_endpoint, 6253 comm_point_callback_type* callback, void* callback_arg, 6254 struct unbound_socket* socket) 6255 { 6256 struct comm_point* c = (struct comm_point*)calloc(1, 6257 sizeof(struct comm_point)); 6258 short evbits; 6259 if(!c) 6260 return NULL; 6261 c->ev = (struct internal_event*)calloc(1, 6262 sizeof(struct internal_event)); 6263 if(!c->ev) { 6264 free(c); 6265 return NULL; 6266 } 6267 c->ev->base = base; 6268 c->fd = -1; 6269 c->buffer = sldns_buffer_new(bufsize); 6270 if(!c->buffer) { 6271 free(c->ev); 6272 free(c); 6273 return NULL; 6274 } 6275 c->timeout = (struct timeval*)malloc(sizeof(struct timeval)); 6276 if(!c->timeout) { 6277 sldns_buffer_free(c->buffer); 6278 free(c->ev); 6279 free(c); 6280 return NULL; 6281 } 6282 c->tcp_is_reading = 0; 6283 c->tcp_byte_count = 0; 6284 c->tcp_parent = parent; 6285 c->tcp_timeout_msec = parent->tcp_timeout_msec; 6286 c->tcp_conn_limit = parent->tcp_conn_limit; 6287 c->tcl_addr = NULL; 6288 c->tcp_keepalive = 0; 6289 c->max_tcp_count = 0; 6290 c->cur_tcp_count = 0; 6291 c->tcp_handlers = NULL; 6292 c->tcp_free = NULL; 6293 c->is_in_tcp_free = 0; 6294 c->type = comm_http; 6295 c->tcp_do_close = 1; 6296 c->do_not_close = 0; 6297 c->tcp_do_toggle_rw = 1; /* will be set to 0 after http2 upgrade */ 6298 c->tcp_check_nb_connect = 0; 6299 #ifdef USE_MSG_FASTOPEN 6300 c->tcp_do_fastopen = 0; 6301 #endif 6302 #ifdef USE_DNSCRYPT 6303 c->dnscrypt = 0; 6304 c->dnscrypt_buffer = NULL; 6305 #endif 6306 c->repinfo.c = c; 6307 c->callback = callback; 6308 c->cb_arg = callback_arg; 6309 c->socket = socket; 6310 c->pp2_enabled = 0; 6311 c->pp2_header_state = pp2_header_none; 6312 6313 c->http_min_version = http_version_2; 6314 c->http2_stream_max_qbuffer_size = bufsize; 6315 if(harden_large_queries && bufsize > 512) 6316 c->http2_stream_max_qbuffer_size = 512; 6317 c->http2_max_streams = http_max_streams; 6318 if(!(c->http_endpoint = strdup(http_endpoint))) { 6319 log_err("could not strdup http_endpoint"); 6320 sldns_buffer_free(c->buffer); 6321 free(c->timeout); 6322 free(c->ev); 6323 free(c); 6324 return NULL; 6325 } 6326 c->use_h2 = 0; 6327 #ifdef HAVE_NGHTTP2 6328 if(!(c->h2_session = http2_session_create(c))) { 6329 log_err("could not create http2 session"); 6330 free(c->http_endpoint); 6331 sldns_buffer_free(c->buffer); 6332 free(c->timeout); 6333 free(c->ev); 6334 free(c); 6335 return NULL; 6336 } 6337 if(!(c->h2_session->callbacks = http2_req_callbacks_create())) { 6338 log_err("could not create http2 callbacks"); 6339 http2_session_delete(c->h2_session); 6340 free(c->http_endpoint); 6341 sldns_buffer_free(c->buffer); 6342 free(c->timeout); 6343 free(c->ev); 6344 free(c); 6345 return NULL; 6346 } 6347 #endif 6348 6349 /* add to parent free list */ 6350 c->tcp_free = parent->tcp_free; 6351 parent->tcp_free = c; 6352 c->is_in_tcp_free = 1; 6353 /* ub_event stuff */ 6354 evbits = UB_EV_PERSIST | UB_EV_READ | UB_EV_TIMEOUT; 6355 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6356 comm_point_http_handle_callback, c); 6357 if(c->ev->ev == NULL) 6358 { 6359 log_err("could not set http handler event"); 6360 parent->tcp_free = c->tcp_free; 6361 http2_session_delete(c->h2_session); 6362 sldns_buffer_free(c->buffer); 6363 free(c->timeout); 6364 free(c->ev); 6365 free(c); 6366 return NULL; 6367 } 6368 return c; 6369 } 6370 6371 struct comm_point* 6372 comm_point_create_tcp(struct comm_base *base, int fd, int num, 6373 int idle_timeout, int harden_large_queries, 6374 uint32_t http_max_streams, char* http_endpoint, 6375 struct tcl_list* tcp_conn_limit, size_t bufsize, 6376 struct sldns_buffer* spoolbuf, enum listen_type port_type, 6377 int pp2_enabled, comm_point_callback_type* callback, 6378 void* callback_arg, struct unbound_socket* socket) 6379 { 6380 struct comm_point* c = (struct comm_point*)calloc(1, 6381 sizeof(struct comm_point)); 6382 short evbits; 6383 int i; 6384 /* first allocate the TCP accept listener */ 6385 if(!c) 6386 return NULL; 6387 c->ev = (struct internal_event*)calloc(1, 6388 sizeof(struct internal_event)); 6389 if(!c->ev) { 6390 free(c); 6391 return NULL; 6392 } 6393 c->ev->base = base; 6394 c->fd = fd; 6395 c->buffer = NULL; 6396 c->timeout = NULL; 6397 c->tcp_is_reading = 0; 6398 c->tcp_byte_count = 0; 6399 c->tcp_timeout_msec = idle_timeout; 6400 c->tcp_conn_limit = tcp_conn_limit; 6401 c->tcl_addr = NULL; 6402 c->tcp_keepalive = 0; 6403 c->tcp_parent = NULL; 6404 c->max_tcp_count = num; 6405 c->cur_tcp_count = 0; 6406 c->tcp_handlers = (struct comm_point**)calloc((size_t)num, 6407 sizeof(struct comm_point*)); 6408 if(!c->tcp_handlers) { 6409 free(c->ev); 6410 free(c); 6411 return NULL; 6412 } 6413 c->tcp_free = NULL; 6414 c->is_in_tcp_free = 0; 6415 c->type = comm_tcp_accept; 6416 c->tcp_do_close = 0; 6417 c->do_not_close = 0; 6418 c->tcp_do_toggle_rw = 0; 6419 c->tcp_check_nb_connect = 0; 6420 #ifdef USE_MSG_FASTOPEN 6421 c->tcp_do_fastopen = 0; 6422 #endif 6423 #ifdef USE_DNSCRYPT 6424 c->dnscrypt = 0; 6425 c->dnscrypt_buffer = NULL; 6426 #endif 6427 c->callback = NULL; 6428 c->cb_arg = NULL; 6429 c->socket = socket; 6430 c->pp2_enabled = (port_type==listen_type_http?0:pp2_enabled); 6431 c->pp2_header_state = pp2_header_none; 6432 evbits = UB_EV_READ | UB_EV_PERSIST; 6433 /* ub_event stuff */ 6434 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6435 comm_point_tcp_accept_callback, c); 6436 if(c->ev->ev == NULL) { 6437 log_err("could not baseset tcpacc event"); 6438 comm_point_delete(c); 6439 return NULL; 6440 } 6441 if (ub_event_add(c->ev->ev, c->timeout) != 0) { 6442 log_err("could not add tcpacc event"); 6443 comm_point_delete(c); 6444 return NULL; 6445 } 6446 c->event_added = 1; 6447 /* now prealloc the handlers */ 6448 for(i=0; i<num; i++) { 6449 if(port_type == listen_type_tcp || 6450 port_type == listen_type_ssl || 6451 port_type == listen_type_tcp_dnscrypt) { 6452 c->tcp_handlers[i] = comm_point_create_tcp_handler(base, 6453 c, bufsize, spoolbuf, callback, callback_arg, socket); 6454 } else if(port_type == listen_type_http) { 6455 c->tcp_handlers[i] = comm_point_create_http_handler( 6456 base, c, bufsize, harden_large_queries, 6457 http_max_streams, http_endpoint, 6458 callback, callback_arg, socket); 6459 } 6460 else { 6461 log_err("could not create tcp handler, unknown listen " 6462 "type"); 6463 return NULL; 6464 } 6465 if(!c->tcp_handlers[i]) { 6466 comm_point_delete(c); 6467 return NULL; 6468 } 6469 } 6470 6471 return c; 6472 } 6473 6474 struct comm_point* 6475 comm_point_create_tcp_out(struct comm_base *base, size_t bufsize, 6476 comm_point_callback_type* callback, void* callback_arg) 6477 { 6478 struct comm_point* c = (struct comm_point*)calloc(1, 6479 sizeof(struct comm_point)); 6480 short evbits; 6481 if(!c) 6482 return NULL; 6483 c->ev = (struct internal_event*)calloc(1, 6484 sizeof(struct internal_event)); 6485 if(!c->ev) { 6486 free(c); 6487 return NULL; 6488 } 6489 c->ev->base = base; 6490 c->fd = -1; 6491 c->buffer = sldns_buffer_new(bufsize); 6492 if(!c->buffer) { 6493 free(c->ev); 6494 free(c); 6495 return NULL; 6496 } 6497 c->timeout = NULL; 6498 c->tcp_is_reading = 0; 6499 c->tcp_byte_count = 0; 6500 c->tcp_timeout_msec = TCP_QUERY_TIMEOUT; 6501 c->tcp_conn_limit = NULL; 6502 c->tcl_addr = NULL; 6503 c->tcp_keepalive = 0; 6504 c->tcp_parent = NULL; 6505 c->max_tcp_count = 0; 6506 c->cur_tcp_count = 0; 6507 c->tcp_handlers = NULL; 6508 c->tcp_free = NULL; 6509 c->is_in_tcp_free = 0; 6510 c->type = comm_tcp; 6511 c->tcp_do_close = 0; 6512 c->do_not_close = 0; 6513 c->tcp_do_toggle_rw = 1; 6514 c->tcp_check_nb_connect = 1; 6515 #ifdef USE_MSG_FASTOPEN 6516 c->tcp_do_fastopen = 1; 6517 #endif 6518 #ifdef USE_DNSCRYPT 6519 c->dnscrypt = 0; 6520 c->dnscrypt_buffer = c->buffer; 6521 #endif 6522 c->repinfo.c = c; 6523 c->callback = callback; 6524 c->cb_arg = callback_arg; 6525 c->pp2_enabled = 0; 6526 c->pp2_header_state = pp2_header_none; 6527 evbits = UB_EV_PERSIST | UB_EV_WRITE; 6528 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6529 comm_point_tcp_handle_callback, c); 6530 if(c->ev->ev == NULL) 6531 { 6532 log_err("could not baseset tcpout event"); 6533 sldns_buffer_free(c->buffer); 6534 free(c->ev); 6535 free(c); 6536 return NULL; 6537 } 6538 6539 return c; 6540 } 6541 6542 struct comm_point* 6543 comm_point_create_http_out(struct comm_base *base, size_t bufsize, 6544 comm_point_callback_type* callback, void* callback_arg, 6545 sldns_buffer* temp) 6546 { 6547 struct comm_point* c = (struct comm_point*)calloc(1, 6548 sizeof(struct comm_point)); 6549 short evbits; 6550 if(!c) 6551 return NULL; 6552 c->ev = (struct internal_event*)calloc(1, 6553 sizeof(struct internal_event)); 6554 if(!c->ev) { 6555 free(c); 6556 return NULL; 6557 } 6558 c->ev->base = base; 6559 c->fd = -1; 6560 c->buffer = sldns_buffer_new(bufsize); 6561 if(!c->buffer) { 6562 free(c->ev); 6563 free(c); 6564 return NULL; 6565 } 6566 c->timeout = NULL; 6567 c->tcp_is_reading = 0; 6568 c->tcp_byte_count = 0; 6569 c->tcp_parent = NULL; 6570 c->max_tcp_count = 0; 6571 c->cur_tcp_count = 0; 6572 c->tcp_handlers = NULL; 6573 c->tcp_free = NULL; 6574 c->is_in_tcp_free = 0; 6575 c->type = comm_http; 6576 c->tcp_do_close = 0; 6577 c->do_not_close = 0; 6578 c->tcp_do_toggle_rw = 1; 6579 c->tcp_check_nb_connect = 1; 6580 c->http_in_headers = 1; 6581 c->http_in_chunk_headers = 0; 6582 c->http_is_chunked = 0; 6583 c->http_temp = temp; 6584 #ifdef USE_MSG_FASTOPEN 6585 c->tcp_do_fastopen = 1; 6586 #endif 6587 #ifdef USE_DNSCRYPT 6588 c->dnscrypt = 0; 6589 c->dnscrypt_buffer = c->buffer; 6590 #endif 6591 c->repinfo.c = c; 6592 c->callback = callback; 6593 c->cb_arg = callback_arg; 6594 c->pp2_enabled = 0; 6595 c->pp2_header_state = pp2_header_none; 6596 evbits = UB_EV_PERSIST | UB_EV_WRITE; 6597 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6598 comm_point_http_handle_callback, c); 6599 if(c->ev->ev == NULL) 6600 { 6601 log_err("could not baseset tcpout event"); 6602 #ifdef HAVE_SSL 6603 SSL_free(c->ssl); 6604 #endif 6605 sldns_buffer_free(c->buffer); 6606 free(c->ev); 6607 free(c); 6608 return NULL; 6609 } 6610 6611 return c; 6612 } 6613 6614 struct comm_point* 6615 comm_point_create_local(struct comm_base *base, int fd, size_t bufsize, 6616 comm_point_callback_type* callback, void* callback_arg) 6617 { 6618 struct comm_point* c = (struct comm_point*)calloc(1, 6619 sizeof(struct comm_point)); 6620 short evbits; 6621 if(!c) 6622 return NULL; 6623 c->ev = (struct internal_event*)calloc(1, 6624 sizeof(struct internal_event)); 6625 if(!c->ev) { 6626 free(c); 6627 return NULL; 6628 } 6629 c->ev->base = base; 6630 c->fd = fd; 6631 c->buffer = sldns_buffer_new(bufsize); 6632 if(!c->buffer) { 6633 free(c->ev); 6634 free(c); 6635 return NULL; 6636 } 6637 c->timeout = NULL; 6638 c->tcp_is_reading = 1; 6639 c->tcp_byte_count = 0; 6640 c->tcp_parent = NULL; 6641 c->max_tcp_count = 0; 6642 c->cur_tcp_count = 0; 6643 c->tcp_handlers = NULL; 6644 c->tcp_free = NULL; 6645 c->is_in_tcp_free = 0; 6646 c->type = comm_local; 6647 c->tcp_do_close = 0; 6648 c->do_not_close = 1; 6649 c->tcp_do_toggle_rw = 0; 6650 c->tcp_check_nb_connect = 0; 6651 #ifdef USE_MSG_FASTOPEN 6652 c->tcp_do_fastopen = 0; 6653 #endif 6654 #ifdef USE_DNSCRYPT 6655 c->dnscrypt = 0; 6656 c->dnscrypt_buffer = c->buffer; 6657 #endif 6658 c->callback = callback; 6659 c->cb_arg = callback_arg; 6660 c->pp2_enabled = 0; 6661 c->pp2_header_state = pp2_header_none; 6662 /* ub_event stuff */ 6663 evbits = UB_EV_PERSIST | UB_EV_READ; 6664 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6665 comm_point_local_handle_callback, c); 6666 if(c->ev->ev == NULL) { 6667 log_err("could not baseset localhdl event"); 6668 free(c->ev); 6669 free(c); 6670 return NULL; 6671 } 6672 if (ub_event_add(c->ev->ev, c->timeout) != 0) { 6673 log_err("could not add localhdl event"); 6674 ub_event_free(c->ev->ev); 6675 free(c->ev); 6676 free(c); 6677 return NULL; 6678 } 6679 c->event_added = 1; 6680 return c; 6681 } 6682 6683 struct comm_point* 6684 comm_point_create_raw(struct comm_base* base, int fd, int writing, 6685 comm_point_callback_type* callback, void* callback_arg) 6686 { 6687 struct comm_point* c = (struct comm_point*)calloc(1, 6688 sizeof(struct comm_point)); 6689 short evbits; 6690 if(!c) 6691 return NULL; 6692 c->ev = (struct internal_event*)calloc(1, 6693 sizeof(struct internal_event)); 6694 if(!c->ev) { 6695 free(c); 6696 return NULL; 6697 } 6698 c->ev->base = base; 6699 c->fd = fd; 6700 c->buffer = NULL; 6701 c->timeout = NULL; 6702 c->tcp_is_reading = 0; 6703 c->tcp_byte_count = 0; 6704 c->tcp_parent = NULL; 6705 c->max_tcp_count = 0; 6706 c->cur_tcp_count = 0; 6707 c->tcp_handlers = NULL; 6708 c->tcp_free = NULL; 6709 c->is_in_tcp_free = 0; 6710 c->type = comm_raw; 6711 c->tcp_do_close = 0; 6712 c->do_not_close = 1; 6713 c->tcp_do_toggle_rw = 0; 6714 c->tcp_check_nb_connect = 0; 6715 #ifdef USE_MSG_FASTOPEN 6716 c->tcp_do_fastopen = 0; 6717 #endif 6718 #ifdef USE_DNSCRYPT 6719 c->dnscrypt = 0; 6720 c->dnscrypt_buffer = c->buffer; 6721 #endif 6722 c->callback = callback; 6723 c->cb_arg = callback_arg; 6724 c->pp2_enabled = 0; 6725 c->pp2_header_state = pp2_header_none; 6726 /* ub_event stuff */ 6727 if(writing) 6728 evbits = UB_EV_PERSIST | UB_EV_WRITE; 6729 else evbits = UB_EV_PERSIST | UB_EV_READ; 6730 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6731 comm_point_raw_handle_callback, c); 6732 if(c->ev->ev == NULL) { 6733 log_err("could not baseset rawhdl event"); 6734 free(c->ev); 6735 free(c); 6736 return NULL; 6737 } 6738 if (ub_event_add(c->ev->ev, c->timeout) != 0) { 6739 log_err("could not add rawhdl event"); 6740 ub_event_free(c->ev->ev); 6741 free(c->ev); 6742 free(c); 6743 return NULL; 6744 } 6745 c->event_added = 1; 6746 return c; 6747 } 6748 6749 void 6750 comm_point_close(struct comm_point* c) 6751 { 6752 if(!c) 6753 return; 6754 if(c->fd != -1) { 6755 verbose(5, "comm_point_close of %d: event_del", c->fd); 6756 if(c->event_added) { 6757 if(ub_event_del(c->ev->ev) != 0) { 6758 log_err("could not event_del on close"); 6759 } 6760 c->event_added = 0; 6761 } 6762 } 6763 if(c->tcl_addr) { 6764 tcl_close_connection(c->tcl_addr); 6765 c->tcl_addr = NULL; 6766 } 6767 if(c->tcp_req_info) 6768 tcp_req_info_clear(c->tcp_req_info); 6769 if(c->h2_session) 6770 http2_session_server_delete(c->h2_session); 6771 /* stop the comm point from reading or writing after it is closed. */ 6772 if(c->tcp_more_read_again && *c->tcp_more_read_again) 6773 *c->tcp_more_read_again = 0; 6774 if(c->tcp_more_write_again && *c->tcp_more_write_again) 6775 *c->tcp_more_write_again = 0; 6776 if(c->tcp_more_read_again_timer && 6777 comm_timer_is_set(c->tcp_more_read_again_timer)) 6778 comm_timer_disable(c->tcp_more_read_again_timer); 6779 6780 /* close fd after removing from event lists, or epoll.. is messed up */ 6781 if(c->fd != -1 && !c->do_not_close) { 6782 #ifdef USE_WINSOCK 6783 if(c->type == comm_tcp || c->type == comm_http) { 6784 /* delete sticky events for the fd, it gets closed */ 6785 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ); 6786 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE); 6787 } 6788 #endif 6789 verbose(VERB_ALGO, "close fd %d", c->fd); 6790 sock_close(c->fd); 6791 } 6792 c->fd = -1; 6793 } 6794 6795 void 6796 comm_point_delete(struct comm_point* c) 6797 { 6798 if(!c) 6799 return; 6800 if((c->type == comm_tcp || c->type == comm_http) && c->ssl) { 6801 #ifdef HAVE_SSL 6802 SSL_shutdown(c->ssl); 6803 SSL_free(c->ssl); 6804 #endif 6805 } 6806 if(c->type == comm_http && c->http_endpoint) { 6807 free(c->http_endpoint); 6808 c->http_endpoint = NULL; 6809 } 6810 comm_point_close(c); 6811 if(c->tcp_handlers) { 6812 int i; 6813 for(i=0; i<c->max_tcp_count; i++) 6814 comm_point_delete(c->tcp_handlers[i]); 6815 free(c->tcp_handlers); 6816 } 6817 free(c->timeout); 6818 comm_timer_delete(c->tcp_more_read_again_timer); 6819 if(c->type == comm_tcp || c->type == comm_local || c->type == comm_http) { 6820 sldns_buffer_free(c->buffer); 6821 #ifdef USE_DNSCRYPT 6822 if(c->dnscrypt && c->dnscrypt_buffer != c->buffer) { 6823 sldns_buffer_free(c->dnscrypt_buffer); 6824 } 6825 #endif 6826 if(c->tcp_req_info) { 6827 tcp_req_info_delete(c->tcp_req_info); 6828 } 6829 if(c->h2_session) { 6830 http2_session_delete(c->h2_session); 6831 } 6832 } 6833 #ifdef HAVE_NGTCP2 6834 if(c->doq_socket) 6835 doq_server_socket_delete(c->doq_socket); 6836 #endif 6837 ub_event_free(c->ev->ev); 6838 free(c->ev); 6839 free(c); 6840 } 6841 6842 #ifdef USE_DNSTAP 6843 static void 6844 send_reply_dnstap(struct dt_env* dtenv, 6845 struct sockaddr* addr, socklen_t addrlen, 6846 struct sockaddr_storage* client_addr, socklen_t client_addrlen, 6847 enum comm_point_type type, void* ssl, sldns_buffer* buffer) 6848 { 6849 log_addr(VERB_ALGO, "from local addr", (void*)addr, addrlen); 6850 log_addr(VERB_ALGO, "response to client", client_addr, client_addrlen); 6851 dt_msg_send_client_response(dtenv, client_addr, 6852 (struct sockaddr_storage*)addr, type, ssl, buffer); 6853 } 6854 #endif 6855 6856 void 6857 comm_point_send_reply(struct comm_reply *repinfo) 6858 { 6859 struct sldns_buffer* buffer; 6860 log_assert(repinfo && repinfo->c); 6861 #ifdef USE_DNSCRYPT 6862 buffer = repinfo->c->dnscrypt_buffer; 6863 if(!dnsc_handle_uncurved_request(repinfo, 6864 repinfo->c->tcp_req_info? 6865 repinfo->c->tcp_req_info->spool_buffer:repinfo->c->buffer)) { 6866 return; 6867 } 6868 #else 6869 buffer = repinfo->c->buffer; 6870 #endif 6871 if(repinfo->c->type == comm_udp) { 6872 if(repinfo->srctype) 6873 comm_point_send_udp_msg_if(repinfo->c, buffer, 6874 (struct sockaddr*)&repinfo->remote_addr, 6875 repinfo->remote_addrlen, repinfo); 6876 else 6877 comm_point_send_udp_msg(repinfo->c, buffer, 6878 (struct sockaddr*)&repinfo->remote_addr, 6879 repinfo->remote_addrlen, 0); 6880 #ifdef USE_DNSTAP 6881 /* 6882 * sending src (client)/dst (local service) addresses over 6883 * DNSTAP from udp callback 6884 */ 6885 if(repinfo->c->dtenv != NULL && repinfo->c->dtenv->log_client_response_messages) { 6886 send_reply_dnstap(repinfo->c->dtenv, 6887 repinfo->c->socket->addr, 6888 repinfo->c->socket->addrlen, 6889 &repinfo->client_addr, repinfo->client_addrlen, 6890 repinfo->c->type, repinfo->c->ssl, 6891 repinfo->c->buffer); 6892 } 6893 #endif 6894 } else { 6895 #ifdef USE_DNSTAP 6896 struct dt_env* dtenv = 6897 #ifdef HAVE_NGTCP2 6898 repinfo->c->doq_socket 6899 ?repinfo->c->dtenv: 6900 #endif 6901 repinfo->c->tcp_parent->dtenv; 6902 struct sldns_buffer* dtbuffer = repinfo->c->tcp_req_info 6903 ?repinfo->c->tcp_req_info->spool_buffer 6904 :repinfo->c->buffer; 6905 #ifdef USE_DNSCRYPT 6906 if(repinfo->c->dnscrypt && repinfo->is_dnscrypted) 6907 dtbuffer = repinfo->c->buffer; 6908 #endif 6909 /* 6910 * sending src (client)/dst (local service) addresses over 6911 * DNSTAP from other callbacks 6912 */ 6913 if(dtenv != NULL && dtenv->log_client_response_messages) { 6914 send_reply_dnstap(dtenv, 6915 repinfo->c->socket->addr, 6916 repinfo->c->socket->addrlen, 6917 &repinfo->client_addr, repinfo->client_addrlen, 6918 repinfo->c->type, repinfo->c->ssl, 6919 dtbuffer); 6920 } 6921 #endif 6922 if(repinfo->c->tcp_req_info) { 6923 tcp_req_info_send_reply(repinfo->c->tcp_req_info); 6924 } else if(repinfo->c->use_h2) { 6925 if(!http2_submit_dns_response(repinfo->c->h2_session)) { 6926 return; 6927 } 6928 repinfo->c->h2_stream = NULL; 6929 repinfo->c->tcp_is_reading = 0; 6930 comm_point_stop_listening(repinfo->c); 6931 comm_point_start_listening(repinfo->c, -1, 6932 adjusted_tcp_timeout(repinfo->c)); 6933 return; 6934 #ifdef HAVE_NGTCP2 6935 } else if(repinfo->c->doq_socket) { 6936 doq_socket_send_reply(repinfo); 6937 #endif 6938 } else { 6939 comm_point_start_listening(repinfo->c, -1, 6940 adjusted_tcp_timeout(repinfo->c)); 6941 } 6942 } 6943 } 6944 6945 void 6946 comm_point_drop_reply(struct comm_reply* repinfo) 6947 { 6948 if(!repinfo) 6949 return; 6950 log_assert(repinfo->c); 6951 log_assert(repinfo->c->type != comm_tcp_accept); 6952 if(repinfo->c->type == comm_udp) 6953 return; 6954 if(repinfo->c->tcp_req_info) 6955 repinfo->c->tcp_req_info->is_drop = 1; 6956 if(repinfo->c->type == comm_http) { 6957 if(repinfo->c->h2_session) { 6958 repinfo->c->h2_session->is_drop = 1; 6959 http2_session_clear_meshstate(repinfo->c->h2_session); 6960 if(!repinfo->c->h2_session->postpone_drop) 6961 reclaim_http_handler(repinfo->c); 6962 return; 6963 } 6964 reclaim_http_handler(repinfo->c); 6965 return; 6966 #ifdef HAVE_NGTCP2 6967 } else if(repinfo->c->doq_socket) { 6968 doq_socket_drop_reply(repinfo); 6969 return; 6970 #endif 6971 } 6972 reclaim_tcp_handler(repinfo->c); 6973 } 6974 6975 void 6976 comm_point_stop_listening(struct comm_point* c) 6977 { 6978 verbose(VERB_ALGO, "comm point stop listening %d", c->fd); 6979 if(c->event_added) { 6980 if(ub_event_del(c->ev->ev) != 0) { 6981 log_err("event_del error to stoplisten"); 6982 } 6983 c->event_added = 0; 6984 } 6985 } 6986 6987 void 6988 comm_point_start_listening(struct comm_point* c, int newfd, int msec) 6989 { 6990 verbose(VERB_ALGO, "comm point start listening %d (%d msec)", 6991 c->fd==-1?newfd:c->fd, msec); 6992 if(c->type == comm_tcp_accept && !c->tcp_free) { 6993 /* no use to start listening no free slots. */ 6994 return; 6995 } 6996 if(c->event_added) { 6997 if(ub_event_del(c->ev->ev) != 0) { 6998 log_err("event_del error to startlisten"); 6999 } 7000 c->event_added = 0; 7001 } 7002 if(msec != -1 && msec != 0) { 7003 if(!c->timeout) { 7004 c->timeout = (struct timeval*)malloc(sizeof( 7005 struct timeval)); 7006 if(!c->timeout) { 7007 log_err("cpsl: malloc failed. No net read."); 7008 return; 7009 } 7010 } 7011 ub_event_add_bits(c->ev->ev, UB_EV_TIMEOUT); 7012 #ifndef S_SPLINT_S /* splint fails on struct timeval. */ 7013 c->timeout->tv_sec = msec/1000; 7014 c->timeout->tv_usec = (msec%1000)*1000; 7015 #endif /* S_SPLINT_S */ 7016 } else { 7017 if(msec == 0 || !c->timeout) { 7018 ub_event_del_bits(c->ev->ev, UB_EV_TIMEOUT); 7019 } 7020 } 7021 if(c->type == comm_tcp || c->type == comm_http) { 7022 ub_event_del_bits(c->ev->ev, UB_EV_READ|UB_EV_WRITE); 7023 if(c->tcp_write_and_read) { 7024 verbose(5, "startlistening %d mode rw", (newfd==-1?c->fd:newfd)); 7025 ub_event_add_bits(c->ev->ev, UB_EV_READ|UB_EV_WRITE); 7026 } else if(c->tcp_is_reading) { 7027 verbose(5, "startlistening %d mode r", (newfd==-1?c->fd:newfd)); 7028 ub_event_add_bits(c->ev->ev, UB_EV_READ); 7029 } else { 7030 verbose(5, "startlistening %d mode w", (newfd==-1?c->fd:newfd)); 7031 ub_event_add_bits(c->ev->ev, UB_EV_WRITE); 7032 } 7033 } 7034 if(newfd != -1) { 7035 if(c->fd != -1 && c->fd != newfd) { 7036 verbose(5, "cpsl close of fd %d for %d", c->fd, newfd); 7037 sock_close(c->fd); 7038 } 7039 c->fd = newfd; 7040 ub_event_set_fd(c->ev->ev, c->fd); 7041 } 7042 if(ub_event_add(c->ev->ev, msec==0?NULL:c->timeout) != 0) { 7043 log_err("event_add failed. in cpsl."); 7044 return; 7045 } 7046 c->event_added = 1; 7047 } 7048 7049 void comm_point_listen_for_rw(struct comm_point* c, int rd, int wr) 7050 { 7051 verbose(VERB_ALGO, "comm point listen_for_rw %d %d", c->fd, wr); 7052 if(c->event_added) { 7053 if(ub_event_del(c->ev->ev) != 0) { 7054 log_err("event_del error to cplf"); 7055 } 7056 c->event_added = 0; 7057 } 7058 if(!c->timeout) { 7059 ub_event_del_bits(c->ev->ev, UB_EV_TIMEOUT); 7060 } 7061 ub_event_del_bits(c->ev->ev, UB_EV_READ|UB_EV_WRITE); 7062 if(rd) ub_event_add_bits(c->ev->ev, UB_EV_READ); 7063 if(wr) ub_event_add_bits(c->ev->ev, UB_EV_WRITE); 7064 if(ub_event_add(c->ev->ev, c->timeout) != 0) { 7065 log_err("event_add failed. in cplf."); 7066 return; 7067 } 7068 c->event_added = 1; 7069 } 7070 7071 size_t comm_point_get_mem(struct comm_point* c) 7072 { 7073 size_t s; 7074 if(!c) 7075 return 0; 7076 s = sizeof(*c) + sizeof(*c->ev); 7077 if(c->timeout) 7078 s += sizeof(*c->timeout); 7079 if(c->type == comm_tcp || c->type == comm_local) { 7080 s += sizeof(*c->buffer) + sldns_buffer_capacity(c->buffer); 7081 #ifdef USE_DNSCRYPT 7082 s += sizeof(*c->dnscrypt_buffer); 7083 if(c->buffer != c->dnscrypt_buffer) { 7084 s += sldns_buffer_capacity(c->dnscrypt_buffer); 7085 } 7086 #endif 7087 } 7088 if(c->type == comm_tcp_accept) { 7089 int i; 7090 for(i=0; i<c->max_tcp_count; i++) 7091 s += comm_point_get_mem(c->tcp_handlers[i]); 7092 } 7093 return s; 7094 } 7095 7096 struct comm_timer* 7097 comm_timer_create(struct comm_base* base, void (*cb)(void*), void* cb_arg) 7098 { 7099 struct internal_timer *tm = (struct internal_timer*)calloc(1, 7100 sizeof(struct internal_timer)); 7101 if(!tm) { 7102 log_err("malloc failed"); 7103 return NULL; 7104 } 7105 tm->super.ev_timer = tm; 7106 tm->base = base; 7107 tm->super.callback = cb; 7108 tm->super.cb_arg = cb_arg; 7109 tm->ev = ub_event_new(base->eb->base, -1, UB_EV_TIMEOUT, 7110 comm_timer_callback, &tm->super); 7111 if(tm->ev == NULL) { 7112 log_err("timer_create: event_base_set failed."); 7113 free(tm); 7114 return NULL; 7115 } 7116 return &tm->super; 7117 } 7118 7119 void 7120 comm_timer_disable(struct comm_timer* timer) 7121 { 7122 if(!timer) 7123 return; 7124 ub_timer_del(timer->ev_timer->ev); 7125 timer->ev_timer->enabled = 0; 7126 } 7127 7128 void 7129 comm_timer_set(struct comm_timer* timer, struct timeval* tv) 7130 { 7131 log_assert(tv); 7132 if(timer->ev_timer->enabled) 7133 comm_timer_disable(timer); 7134 if(ub_timer_add(timer->ev_timer->ev, timer->ev_timer->base->eb->base, 7135 comm_timer_callback, timer, tv) != 0) 7136 log_err("comm_timer_set: evtimer_add failed."); 7137 timer->ev_timer->enabled = 1; 7138 } 7139 7140 void 7141 comm_timer_delete(struct comm_timer* timer) 7142 { 7143 if(!timer) 7144 return; 7145 comm_timer_disable(timer); 7146 /* Free the sub struct timer->ev_timer derived from the super struct timer. 7147 * i.e. assert(timer == timer->ev_timer) 7148 */ 7149 ub_event_free(timer->ev_timer->ev); 7150 free(timer->ev_timer); 7151 } 7152 7153 void 7154 comm_timer_callback(int ATTR_UNUSED(fd), short event, void* arg) 7155 { 7156 struct comm_timer* tm = (struct comm_timer*)arg; 7157 if(!(event&UB_EV_TIMEOUT)) 7158 return; 7159 ub_comm_base_now(tm->ev_timer->base); 7160 tm->ev_timer->enabled = 0; 7161 fptr_ok(fptr_whitelist_comm_timer(tm->callback)); 7162 (*tm->callback)(tm->cb_arg); 7163 } 7164 7165 int 7166 comm_timer_is_set(struct comm_timer* timer) 7167 { 7168 return (int)timer->ev_timer->enabled; 7169 } 7170 7171 size_t 7172 comm_timer_get_mem(struct comm_timer* timer) 7173 { 7174 if(!timer) return 0; 7175 return sizeof(struct internal_timer); 7176 } 7177 7178 struct comm_signal* 7179 comm_signal_create(struct comm_base* base, 7180 void (*callback)(int, void*), void* cb_arg) 7181 { 7182 struct comm_signal* com = (struct comm_signal*)malloc( 7183 sizeof(struct comm_signal)); 7184 if(!com) { 7185 log_err("malloc failed"); 7186 return NULL; 7187 } 7188 com->base = base; 7189 com->callback = callback; 7190 com->cb_arg = cb_arg; 7191 com->ev_signal = NULL; 7192 return com; 7193 } 7194 7195 void 7196 comm_signal_callback(int sig, short event, void* arg) 7197 { 7198 struct comm_signal* comsig = (struct comm_signal*)arg; 7199 if(!(event & UB_EV_SIGNAL)) 7200 return; 7201 ub_comm_base_now(comsig->base); 7202 fptr_ok(fptr_whitelist_comm_signal(comsig->callback)); 7203 (*comsig->callback)(sig, comsig->cb_arg); 7204 } 7205 7206 int 7207 comm_signal_bind(struct comm_signal* comsig, int sig) 7208 { 7209 struct internal_signal* entry = (struct internal_signal*)calloc(1, 7210 sizeof(struct internal_signal)); 7211 if(!entry) { 7212 log_err("malloc failed"); 7213 return 0; 7214 } 7215 log_assert(comsig); 7216 /* add signal event */ 7217 entry->ev = ub_signal_new(comsig->base->eb->base, sig, 7218 comm_signal_callback, comsig); 7219 if(entry->ev == NULL) { 7220 log_err("Could not create signal event"); 7221 free(entry); 7222 return 0; 7223 } 7224 if(ub_signal_add(entry->ev, NULL) != 0) { 7225 log_err("Could not add signal handler"); 7226 ub_event_free(entry->ev); 7227 free(entry); 7228 return 0; 7229 } 7230 /* link into list */ 7231 entry->next = comsig->ev_signal; 7232 comsig->ev_signal = entry; 7233 return 1; 7234 } 7235 7236 void 7237 comm_signal_delete(struct comm_signal* comsig) 7238 { 7239 struct internal_signal* p, *np; 7240 if(!comsig) 7241 return; 7242 p=comsig->ev_signal; 7243 while(p) { 7244 np = p->next; 7245 ub_signal_del(p->ev); 7246 ub_event_free(p->ev); 7247 free(p); 7248 p = np; 7249 } 7250 free(comsig); 7251 } 7252