1 /* 2 * util/netevent.c - event notification 3 * 4 * Copyright (c) 2007, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains event notification functions. 40 */ 41 #include "config.h" 42 #include "util/netevent.h" 43 #include "util/ub_event.h" 44 #include "util/log.h" 45 #include "util/net_help.h" 46 #include "util/tcp_conn_limit.h" 47 #include "util/fptr_wlist.h" 48 #include "util/proxy_protocol.h" 49 #include "util/timeval_func.h" 50 #include "sldns/pkthdr.h" 51 #include "sldns/sbuffer.h" 52 #include "sldns/str2wire.h" 53 #include "dnstap/dnstap.h" 54 #include "dnscrypt/dnscrypt.h" 55 #include "services/listen_dnsport.h" 56 #include "util/random.h" 57 #ifdef HAVE_SYS_TYPES_H 58 #include <sys/types.h> 59 #endif 60 #ifdef HAVE_SYS_SOCKET_H 61 #include <sys/socket.h> 62 #endif 63 #ifdef HAVE_NETDB_H 64 #include <netdb.h> 65 #endif 66 #ifdef HAVE_POLL_H 67 #include <poll.h> 68 #endif 69 70 #ifdef HAVE_OPENSSL_SSL_H 71 #include <openssl/ssl.h> 72 #endif 73 #ifdef HAVE_OPENSSL_ERR_H 74 #include <openssl/err.h> 75 #endif 76 77 #ifdef HAVE_NGTCP2 78 #include <ngtcp2/ngtcp2.h> 79 #include <ngtcp2/ngtcp2_crypto.h> 80 #endif 81 82 #ifdef HAVE_LINUX_NET_TSTAMP_H 83 #include <linux/net_tstamp.h> 84 #endif 85 86 /* -------- Start of local definitions -------- */ 87 /** if CMSG_ALIGN is not defined on this platform, a workaround */ 88 #ifndef CMSG_ALIGN 89 # ifdef __CMSG_ALIGN 90 # define CMSG_ALIGN(n) __CMSG_ALIGN(n) 91 # elif defined(CMSG_DATA_ALIGN) 92 # define CMSG_ALIGN _CMSG_DATA_ALIGN 93 # else 94 # define CMSG_ALIGN(len) (((len)+sizeof(long)-1) & ~(sizeof(long)-1)) 95 # endif 96 #endif 97 98 /** if CMSG_LEN is not defined on this platform, a workaround */ 99 #ifndef CMSG_LEN 100 # define CMSG_LEN(len) (CMSG_ALIGN(sizeof(struct cmsghdr))+(len)) 101 #endif 102 103 /** if CMSG_SPACE is not defined on this platform, a workaround */ 104 #ifndef CMSG_SPACE 105 # ifdef _CMSG_HDR_ALIGN 106 # define CMSG_SPACE(l) (CMSG_ALIGN(l)+_CMSG_HDR_ALIGN(sizeof(struct cmsghdr))) 107 # else 108 # define CMSG_SPACE(l) (CMSG_ALIGN(l)+CMSG_ALIGN(sizeof(struct cmsghdr))) 109 # endif 110 #endif 111 112 /** The TCP writing query timeout in milliseconds */ 113 #define TCP_QUERY_TIMEOUT 120000 114 /** The minimum actual TCP timeout to use, regardless of what we advertise, 115 * in msec */ 116 #define TCP_QUERY_TIMEOUT_MINIMUM 200 117 118 #ifndef NONBLOCKING_IS_BROKEN 119 /** number of UDP reads to perform per read indication from select */ 120 #define NUM_UDP_PER_SELECT 100 121 #else 122 #define NUM_UDP_PER_SELECT 1 123 #endif 124 125 /** The number of TCP queries over a TCP connection, per read indication 126 * from select. */ 127 #define NUM_TCP_PER_SELECT 100 128 129 /** timeout in millisec to wait for write to unblock, packets dropped after.*/ 130 #define SEND_BLOCKED_WAIT_TIMEOUT 200 131 /** max number of times to wait for write to unblock, packets dropped after.*/ 132 #define SEND_BLOCKED_MAX_RETRY 5 133 134 /** Let's make timestamping code cleaner and redefine SO_TIMESTAMP* */ 135 #ifndef SO_TIMESTAMP 136 #define SO_TIMESTAMP 29 137 #endif 138 #ifndef SO_TIMESTAMPNS 139 #define SO_TIMESTAMPNS 35 140 #endif 141 #ifndef SO_TIMESTAMPING 142 #define SO_TIMESTAMPING 37 143 #endif 144 /** 145 * The internal event structure for keeping ub_event info for the event. 146 * Possibly other structures (list, tree) this is part of. 147 */ 148 struct internal_event { 149 /** the comm base */ 150 struct comm_base* base; 151 /** ub_event event type */ 152 struct ub_event* ev; 153 }; 154 155 /** 156 * Internal base structure, so that every thread has its own events. 157 */ 158 struct internal_base { 159 /** ub_event event_base type. */ 160 struct ub_event_base* base; 161 /** seconds time pointer points here */ 162 time_t secs; 163 /** timeval with current time */ 164 struct timeval now; 165 /** the event used for slow_accept timeouts */ 166 struct ub_event* slow_accept; 167 /** true if slow_accept is enabled */ 168 int slow_accept_enabled; 169 /** last log time for slow logging of file descriptor errors */ 170 time_t last_slow_log; 171 /** last log time for slow logging of write wait failures */ 172 time_t last_writewait_log; 173 }; 174 175 /** 176 * Internal timer structure, to store timer event in. 177 */ 178 struct internal_timer { 179 /** the super struct from which derived */ 180 struct comm_timer super; 181 /** the comm base */ 182 struct comm_base* base; 183 /** ub_event event type */ 184 struct ub_event* ev; 185 /** is timer enabled */ 186 uint8_t enabled; 187 }; 188 189 /** 190 * Internal signal structure, to store signal event in. 191 */ 192 struct internal_signal { 193 /** ub_event event type */ 194 struct ub_event* ev; 195 /** next in signal list */ 196 struct internal_signal* next; 197 }; 198 199 /** create a tcp handler with a parent */ 200 static struct comm_point* comm_point_create_tcp_handler( 201 struct comm_base *base, struct comm_point* parent, size_t bufsize, 202 struct sldns_buffer* spoolbuf, comm_point_callback_type* callback, 203 void* callback_arg, struct unbound_socket* socket); 204 205 /* -------- End of local definitions -------- */ 206 207 struct comm_base* 208 comm_base_create(int sigs) 209 { 210 struct comm_base* b = (struct comm_base*)calloc(1, 211 sizeof(struct comm_base)); 212 const char *evnm="event", *evsys="", *evmethod=""; 213 214 if(!b) 215 return NULL; 216 b->eb = (struct internal_base*)calloc(1, sizeof(struct internal_base)); 217 if(!b->eb) { 218 free(b); 219 return NULL; 220 } 221 b->eb->base = ub_default_event_base(sigs, &b->eb->secs, &b->eb->now); 222 if(!b->eb->base) { 223 free(b->eb); 224 free(b); 225 return NULL; 226 } 227 ub_comm_base_now(b); 228 ub_get_event_sys(b->eb->base, &evnm, &evsys, &evmethod); 229 verbose(VERB_ALGO, "%s %s uses %s method.", evnm, evsys, evmethod); 230 return b; 231 } 232 233 struct comm_base* 234 comm_base_create_event(struct ub_event_base* base) 235 { 236 struct comm_base* b = (struct comm_base*)calloc(1, 237 sizeof(struct comm_base)); 238 if(!b) 239 return NULL; 240 b->eb = (struct internal_base*)calloc(1, sizeof(struct internal_base)); 241 if(!b->eb) { 242 free(b); 243 return NULL; 244 } 245 b->eb->base = base; 246 ub_comm_base_now(b); 247 return b; 248 } 249 250 void 251 comm_base_delete(struct comm_base* b) 252 { 253 if(!b) 254 return; 255 if(b->eb->slow_accept_enabled) { 256 if(ub_event_del(b->eb->slow_accept) != 0) { 257 log_err("could not event_del slow_accept"); 258 } 259 ub_event_free(b->eb->slow_accept); 260 } 261 ub_event_base_free(b->eb->base); 262 b->eb->base = NULL; 263 free(b->eb); 264 free(b); 265 } 266 267 void 268 comm_base_delete_no_base(struct comm_base* b) 269 { 270 if(!b) 271 return; 272 if(b->eb->slow_accept_enabled) { 273 if(ub_event_del(b->eb->slow_accept) != 0) { 274 log_err("could not event_del slow_accept"); 275 } 276 ub_event_free(b->eb->slow_accept); 277 } 278 b->eb->base = NULL; 279 free(b->eb); 280 free(b); 281 } 282 283 void 284 comm_base_timept(struct comm_base* b, time_t** tt, struct timeval** tv) 285 { 286 *tt = &b->eb->secs; 287 *tv = &b->eb->now; 288 } 289 290 void 291 comm_base_dispatch(struct comm_base* b) 292 { 293 int retval; 294 retval = ub_event_base_dispatch(b->eb->base); 295 if(retval < 0) { 296 fatal_exit("event_dispatch returned error %d, " 297 "errno is %s", retval, strerror(errno)); 298 } 299 } 300 301 void comm_base_exit(struct comm_base* b) 302 { 303 if(ub_event_base_loopexit(b->eb->base) != 0) { 304 log_err("Could not loopexit"); 305 } 306 } 307 308 void comm_base_set_slow_accept_handlers(struct comm_base* b, 309 void (*stop_acc)(void*), void (*start_acc)(void*), void* arg) 310 { 311 b->stop_accept = stop_acc; 312 b->start_accept = start_acc; 313 b->cb_arg = arg; 314 } 315 316 struct ub_event_base* comm_base_internal(struct comm_base* b) 317 { 318 return b->eb->base; 319 } 320 321 struct ub_event* comm_point_internal(struct comm_point* c) 322 { 323 return c->ev->ev; 324 } 325 326 /** see if errno for udp has to be logged or not uses globals */ 327 static int 328 udp_send_errno_needs_log(struct sockaddr* addr, socklen_t addrlen) 329 { 330 /* do not log transient errors (unless high verbosity) */ 331 #if defined(ENETUNREACH) || defined(EHOSTDOWN) || defined(EHOSTUNREACH) || defined(ENETDOWN) 332 switch(errno) { 333 # ifdef ENETUNREACH 334 case ENETUNREACH: 335 # endif 336 # ifdef EHOSTDOWN 337 case EHOSTDOWN: 338 # endif 339 # ifdef EHOSTUNREACH 340 case EHOSTUNREACH: 341 # endif 342 # ifdef ENETDOWN 343 case ENETDOWN: 344 # endif 345 case EPERM: 346 case EACCES: 347 if(verbosity < VERB_ALGO) 348 return 0; 349 break; 350 default: 351 break; 352 } 353 #endif 354 /* permission denied is gotten for every send if the 355 * network is disconnected (on some OS), squelch it */ 356 if( ((errno == EPERM) 357 # ifdef EADDRNOTAVAIL 358 /* 'Cannot assign requested address' also when disconnected */ 359 || (errno == EADDRNOTAVAIL) 360 # endif 361 ) && verbosity < VERB_ALGO) 362 return 0; 363 # ifdef EADDRINUSE 364 /* If SO_REUSEADDR is set, we could try to connect to the same server 365 * from the same source port twice. */ 366 if(errno == EADDRINUSE && verbosity < VERB_DETAIL) 367 return 0; 368 # endif 369 /* squelch errors where people deploy AAAA ::ffff:bla for 370 * authority servers, which we try for intranets. */ 371 if(errno == EINVAL && addr_is_ip4mapped( 372 (struct sockaddr_storage*)addr, addrlen) && 373 verbosity < VERB_DETAIL) 374 return 0; 375 /* SO_BROADCAST sockopt can give access to 255.255.255.255, 376 * but a dns cache does not need it. */ 377 if(errno == EACCES && addr_is_broadcast( 378 (struct sockaddr_storage*)addr, addrlen) && 379 verbosity < VERB_DETAIL) 380 return 0; 381 # ifdef ENOTCONN 382 /* For 0.0.0.0, ::0 targets it can return that socket is not connected. 383 * This can be ignored, and the address skipped. It remains 384 * possible to send there for completeness in configuration. */ 385 if(errno == ENOTCONN && addr_is_any( 386 (struct sockaddr_storage*)addr, addrlen) && 387 verbosity < VERB_DETAIL) 388 return 0; 389 # endif 390 return 1; 391 } 392 393 int tcp_connect_errno_needs_log(struct sockaddr* addr, socklen_t addrlen) 394 { 395 return udp_send_errno_needs_log(addr, addrlen); 396 } 397 398 /* send a UDP reply */ 399 int 400 comm_point_send_udp_msg(struct comm_point *c, sldns_buffer* packet, 401 struct sockaddr* addr, socklen_t addrlen, int is_connected) 402 { 403 ssize_t sent; 404 log_assert(c->fd != -1); 405 #ifdef UNBOUND_DEBUG 406 if(sldns_buffer_remaining(packet) == 0) 407 log_err("error: send empty UDP packet"); 408 #endif 409 log_assert(addr && addrlen > 0); 410 if(!is_connected) { 411 sent = sendto(c->fd, (void*)sldns_buffer_begin(packet), 412 sldns_buffer_remaining(packet), 0, 413 addr, addrlen); 414 } else { 415 sent = send(c->fd, (void*)sldns_buffer_begin(packet), 416 sldns_buffer_remaining(packet), 0); 417 } 418 if(sent == -1) { 419 /* try again and block, waiting for IO to complete, 420 * we want to send the answer, and we will wait for 421 * the ethernet interface buffer to have space. */ 422 #ifndef USE_WINSOCK 423 if(errno == EAGAIN || errno == EINTR || 424 # ifdef EWOULDBLOCK 425 errno == EWOULDBLOCK || 426 # endif 427 errno == ENOBUFS) { 428 #else 429 if(WSAGetLastError() == WSAEINPROGRESS || 430 WSAGetLastError() == WSAEINTR || 431 WSAGetLastError() == WSAENOBUFS || 432 WSAGetLastError() == WSAEWOULDBLOCK) { 433 #endif 434 int retries = 0; 435 /* if we set the fd blocking, other threads suddenly 436 * have a blocking fd that they operate on */ 437 while(sent == -1 && retries < SEND_BLOCKED_MAX_RETRY && ( 438 #ifndef USE_WINSOCK 439 errno == EAGAIN || errno == EINTR || 440 # ifdef EWOULDBLOCK 441 errno == EWOULDBLOCK || 442 # endif 443 errno == ENOBUFS 444 #else 445 WSAGetLastError() == WSAEINPROGRESS || 446 WSAGetLastError() == WSAEINTR || 447 WSAGetLastError() == WSAENOBUFS || 448 WSAGetLastError() == WSAEWOULDBLOCK 449 #endif 450 )) { 451 #if defined(HAVE_POLL) || defined(USE_WINSOCK) 452 int send_nobufs = ( 453 #ifndef USE_WINSOCK 454 errno == ENOBUFS 455 #else 456 WSAGetLastError() == WSAENOBUFS 457 #endif 458 ); 459 struct pollfd p; 460 int pret; 461 memset(&p, 0, sizeof(p)); 462 p.fd = c->fd; 463 p.events = POLLOUT 464 #ifndef USE_WINSOCK 465 | POLLERR | POLLHUP 466 #endif 467 ; 468 # ifndef USE_WINSOCK 469 pret = poll(&p, 1, SEND_BLOCKED_WAIT_TIMEOUT); 470 # else 471 pret = WSAPoll(&p, 1, 472 SEND_BLOCKED_WAIT_TIMEOUT); 473 # endif 474 if(pret == 0) { 475 /* timer expired */ 476 struct comm_base* b = c->ev->base; 477 if(b->eb->last_writewait_log+SLOW_LOG_TIME <= 478 b->eb->secs) { 479 b->eb->last_writewait_log = b->eb->secs; 480 verbose(VERB_OPS, "send udp blocked " 481 "for long, dropping packet."); 482 } 483 return 0; 484 } else if(pret < 0 && 485 #ifndef USE_WINSOCK 486 errno != EAGAIN && errno != EINTR && 487 # ifdef EWOULDBLOCK 488 errno != EWOULDBLOCK && 489 # endif 490 errno != ENOMEM && errno != ENOBUFS 491 #else 492 WSAGetLastError() != WSAEINPROGRESS && 493 WSAGetLastError() != WSAEINTR && 494 WSAGetLastError() != WSAENOBUFS && 495 WSAGetLastError() != WSAEWOULDBLOCK 496 #endif 497 ) { 498 log_err("poll udp out failed: %s", 499 sock_strerror(errno)); 500 return 0; 501 } else if((pret < 0 && 502 #ifndef USE_WINSOCK 503 ( errno == ENOBUFS /* Maybe some systems */ 504 || errno == ENOMEM /* Linux */ 505 || errno == EAGAIN) /* Macos, solaris, openbsd */ 506 #else 507 WSAGetLastError() == WSAENOBUFS 508 #endif 509 ) || (send_nobufs && retries > 0)) { 510 /* ENOBUFS/ENOMEM/EAGAIN, and poll 511 * returned without 512 * a timeout. Or the retried send call 513 * returned ENOBUFS/ENOMEM/EAGAIN. 514 * It is good to wait a bit for the 515 * error to clear. */ 516 /* The timeout is 20*(2^(retries+1)), 517 * it increases exponentially, starting 518 * at 40 msec. After 5 tries, 1240 msec 519 * have passed in total, when poll 520 * returned the error, and 1200 msec 521 * when send returned the errors. */ 522 #ifndef USE_WINSOCK 523 pret = poll(NULL, 0, (SEND_BLOCKED_WAIT_TIMEOUT/10)<<(retries+1)); 524 #else 525 Sleep((SEND_BLOCKED_WAIT_TIMEOUT/10)<<(retries+1)); 526 pret = 0; 527 #endif 528 if(pret < 0 529 #ifndef USE_WINSOCK 530 && errno != EAGAIN && errno != EINTR && 531 # ifdef EWOULDBLOCK 532 errno != EWOULDBLOCK && 533 # endif 534 errno != ENOMEM && errno != ENOBUFS 535 #else 536 /* Sleep does not error */ 537 #endif 538 ) { 539 log_err("poll udp out timer failed: %s", 540 sock_strerror(errno)); 541 } 542 } 543 #endif /* defined(HAVE_POLL) || defined(USE_WINSOCK) */ 544 retries++; 545 if (!is_connected) { 546 sent = sendto(c->fd, (void*)sldns_buffer_begin(packet), 547 sldns_buffer_remaining(packet), 0, 548 addr, addrlen); 549 } else { 550 sent = send(c->fd, (void*)sldns_buffer_begin(packet), 551 sldns_buffer_remaining(packet), 0); 552 } 553 } 554 } 555 } 556 if(sent == -1) { 557 if(!udp_send_errno_needs_log(addr, addrlen)) 558 return 0; 559 if (!is_connected) { 560 verbose(VERB_OPS, "sendto failed: %s", sock_strerror(errno)); 561 } else { 562 verbose(VERB_OPS, "send failed: %s", sock_strerror(errno)); 563 } 564 if(addr) 565 log_addr(VERB_OPS, "remote address is", 566 (struct sockaddr_storage*)addr, addrlen); 567 return 0; 568 } else if((size_t)sent != sldns_buffer_remaining(packet)) { 569 log_err("sent %d in place of %d bytes", 570 (int)sent, (int)sldns_buffer_remaining(packet)); 571 return 0; 572 } 573 return 1; 574 } 575 576 #if defined(AF_INET6) && defined(IPV6_PKTINFO) && (defined(HAVE_RECVMSG) || defined(HAVE_SENDMSG)) 577 /** print debug ancillary info */ 578 static void p_ancil(const char* str, struct comm_reply* r) 579 { 580 if(r->srctype != 4 && r->srctype != 6) { 581 log_info("%s: unknown srctype %d", str, r->srctype); 582 return; 583 } 584 585 if(r->srctype == 6) { 586 #ifdef IPV6_PKTINFO 587 char buf[1024]; 588 if(inet_ntop(AF_INET6, &r->pktinfo.v6info.ipi6_addr, 589 buf, (socklen_t)sizeof(buf)) == 0) { 590 (void)strlcpy(buf, "(inet_ntop error)", sizeof(buf)); 591 } 592 buf[sizeof(buf)-1]=0; 593 log_info("%s: %s %d", str, buf, r->pktinfo.v6info.ipi6_ifindex); 594 #endif 595 } else if(r->srctype == 4) { 596 #ifdef IP_PKTINFO 597 char buf1[1024], buf2[1024]; 598 if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_addr, 599 buf1, (socklen_t)sizeof(buf1)) == 0) { 600 (void)strlcpy(buf1, "(inet_ntop error)", sizeof(buf1)); 601 } 602 buf1[sizeof(buf1)-1]=0; 603 #ifdef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST 604 if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_spec_dst, 605 buf2, (socklen_t)sizeof(buf2)) == 0) { 606 (void)strlcpy(buf2, "(inet_ntop error)", sizeof(buf2)); 607 } 608 buf2[sizeof(buf2)-1]=0; 609 #else 610 buf2[0]=0; 611 #endif 612 log_info("%s: %d %s %s", str, r->pktinfo.v4info.ipi_ifindex, 613 buf1, buf2); 614 #elif defined(IP_RECVDSTADDR) 615 char buf1[1024]; 616 if(inet_ntop(AF_INET, &r->pktinfo.v4addr, 617 buf1, (socklen_t)sizeof(buf1)) == 0) { 618 (void)strlcpy(buf1, "(inet_ntop error)", sizeof(buf1)); 619 } 620 buf1[sizeof(buf1)-1]=0; 621 log_info("%s: %s", str, buf1); 622 #endif /* IP_PKTINFO or PI_RECVDSTDADDR */ 623 } 624 } 625 #endif /* AF_INET6 && IPV6_PKTINFO && HAVE_RECVMSG||HAVE_SENDMSG */ 626 627 /** send a UDP reply over specified interface*/ 628 static int 629 comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet, 630 struct sockaddr* addr, socklen_t addrlen, struct comm_reply* r) 631 { 632 #if defined(AF_INET6) && defined(IPV6_PKTINFO) && defined(HAVE_SENDMSG) 633 ssize_t sent; 634 struct msghdr msg; 635 struct iovec iov[1]; 636 union { 637 struct cmsghdr hdr; 638 char buf[256]; 639 } control; 640 #ifndef S_SPLINT_S 641 struct cmsghdr *cmsg; 642 #endif /* S_SPLINT_S */ 643 644 log_assert(c->fd != -1); 645 #ifdef UNBOUND_DEBUG 646 if(sldns_buffer_remaining(packet) == 0) 647 log_err("error: send empty UDP packet"); 648 #endif 649 log_assert(addr && addrlen > 0); 650 651 msg.msg_name = addr; 652 msg.msg_namelen = addrlen; 653 iov[0].iov_base = sldns_buffer_begin(packet); 654 iov[0].iov_len = sldns_buffer_remaining(packet); 655 msg.msg_iov = iov; 656 msg.msg_iovlen = 1; 657 msg.msg_control = control.buf; 658 #ifndef S_SPLINT_S 659 msg.msg_controllen = sizeof(control.buf); 660 #endif /* S_SPLINT_S */ 661 msg.msg_flags = 0; 662 663 #ifndef S_SPLINT_S 664 cmsg = CMSG_FIRSTHDR(&msg); 665 if(r->srctype == 4) { 666 #ifdef IP_PKTINFO 667 void* cmsg_data; 668 msg.msg_controllen = CMSG_SPACE(sizeof(struct in_pktinfo)); 669 log_assert(msg.msg_controllen <= sizeof(control.buf)); 670 cmsg->cmsg_level = IPPROTO_IP; 671 cmsg->cmsg_type = IP_PKTINFO; 672 memmove(CMSG_DATA(cmsg), &r->pktinfo.v4info, 673 sizeof(struct in_pktinfo)); 674 /* unset the ifindex to not bypass the routing tables */ 675 cmsg_data = CMSG_DATA(cmsg); 676 ((struct in_pktinfo *) cmsg_data)->ipi_ifindex = 0; 677 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo)); 678 /* zero the padding bytes inserted by the CMSG_LEN */ 679 if(sizeof(struct in_pktinfo) < cmsg->cmsg_len) 680 memset(((uint8_t*)(CMSG_DATA(cmsg))) + 681 sizeof(struct in_pktinfo), 0, cmsg->cmsg_len 682 - sizeof(struct in_pktinfo)); 683 #elif defined(IP_SENDSRCADDR) 684 msg.msg_controllen = CMSG_SPACE(sizeof(struct in_addr)); 685 log_assert(msg.msg_controllen <= sizeof(control.buf)); 686 cmsg->cmsg_level = IPPROTO_IP; 687 cmsg->cmsg_type = IP_SENDSRCADDR; 688 memmove(CMSG_DATA(cmsg), &r->pktinfo.v4addr, 689 sizeof(struct in_addr)); 690 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_addr)); 691 /* zero the padding bytes inserted by the CMSG_LEN */ 692 if(sizeof(struct in_addr) < cmsg->cmsg_len) 693 memset(((uint8_t*)(CMSG_DATA(cmsg))) + 694 sizeof(struct in_addr), 0, cmsg->cmsg_len 695 - sizeof(struct in_addr)); 696 #else 697 verbose(VERB_ALGO, "no IP_PKTINFO or IP_SENDSRCADDR"); 698 msg.msg_control = NULL; 699 #endif /* IP_PKTINFO or IP_SENDSRCADDR */ 700 } else if(r->srctype == 6) { 701 void* cmsg_data; 702 msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo)); 703 log_assert(msg.msg_controllen <= sizeof(control.buf)); 704 cmsg->cmsg_level = IPPROTO_IPV6; 705 cmsg->cmsg_type = IPV6_PKTINFO; 706 memmove(CMSG_DATA(cmsg), &r->pktinfo.v6info, 707 sizeof(struct in6_pktinfo)); 708 /* unset the ifindex to not bypass the routing tables */ 709 cmsg_data = CMSG_DATA(cmsg); 710 ((struct in6_pktinfo *) cmsg_data)->ipi6_ifindex = 0; 711 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo)); 712 /* zero the padding bytes inserted by the CMSG_LEN */ 713 if(sizeof(struct in6_pktinfo) < cmsg->cmsg_len) 714 memset(((uint8_t*)(CMSG_DATA(cmsg))) + 715 sizeof(struct in6_pktinfo), 0, cmsg->cmsg_len 716 - sizeof(struct in6_pktinfo)); 717 } else { 718 /* try to pass all 0 to use default route */ 719 msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo)); 720 log_assert(msg.msg_controllen <= sizeof(control.buf)); 721 cmsg->cmsg_level = IPPROTO_IPV6; 722 cmsg->cmsg_type = IPV6_PKTINFO; 723 memset(CMSG_DATA(cmsg), 0, sizeof(struct in6_pktinfo)); 724 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo)); 725 /* zero the padding bytes inserted by the CMSG_LEN */ 726 if(sizeof(struct in6_pktinfo) < cmsg->cmsg_len) 727 memset(((uint8_t*)(CMSG_DATA(cmsg))) + 728 sizeof(struct in6_pktinfo), 0, cmsg->cmsg_len 729 - sizeof(struct in6_pktinfo)); 730 } 731 #endif /* S_SPLINT_S */ 732 if(verbosity >= VERB_ALGO && r->srctype != 0) 733 p_ancil("send_udp over interface", r); 734 sent = sendmsg(c->fd, &msg, 0); 735 if(sent == -1) { 736 /* try again and block, waiting for IO to complete, 737 * we want to send the answer, and we will wait for 738 * the ethernet interface buffer to have space. */ 739 #ifndef USE_WINSOCK 740 if(errno == EAGAIN || errno == EINTR || 741 # ifdef EWOULDBLOCK 742 errno == EWOULDBLOCK || 743 # endif 744 errno == ENOBUFS) { 745 #else 746 if(WSAGetLastError() == WSAEINPROGRESS || 747 WSAGetLastError() == WSAEINTR || 748 WSAGetLastError() == WSAENOBUFS || 749 WSAGetLastError() == WSAEWOULDBLOCK) { 750 #endif 751 int retries = 0; 752 while(sent == -1 && retries < SEND_BLOCKED_MAX_RETRY && ( 753 #ifndef USE_WINSOCK 754 errno == EAGAIN || errno == EINTR || 755 # ifdef EWOULDBLOCK 756 errno == EWOULDBLOCK || 757 # endif 758 errno == ENOBUFS 759 #else 760 WSAGetLastError() == WSAEINPROGRESS || 761 WSAGetLastError() == WSAEINTR || 762 WSAGetLastError() == WSAENOBUFS || 763 WSAGetLastError() == WSAEWOULDBLOCK 764 #endif 765 )) { 766 #if defined(HAVE_POLL) || defined(USE_WINSOCK) 767 int send_nobufs = ( 768 #ifndef USE_WINSOCK 769 errno == ENOBUFS 770 #else 771 WSAGetLastError() == WSAENOBUFS 772 #endif 773 ); 774 struct pollfd p; 775 int pret; 776 memset(&p, 0, sizeof(p)); 777 p.fd = c->fd; 778 p.events = POLLOUT 779 #ifndef USE_WINSOCK 780 | POLLERR | POLLHUP 781 #endif 782 ; 783 # ifndef USE_WINSOCK 784 pret = poll(&p, 1, SEND_BLOCKED_WAIT_TIMEOUT); 785 # else 786 pret = WSAPoll(&p, 1, 787 SEND_BLOCKED_WAIT_TIMEOUT); 788 # endif 789 if(pret == 0) { 790 /* timer expired */ 791 struct comm_base* b = c->ev->base; 792 if(b->eb->last_writewait_log+SLOW_LOG_TIME <= 793 b->eb->secs) { 794 b->eb->last_writewait_log = b->eb->secs; 795 verbose(VERB_OPS, "send udp blocked " 796 "for long, dropping packet."); 797 } 798 return 0; 799 } else if(pret < 0 && 800 #ifndef USE_WINSOCK 801 errno != EAGAIN && errno != EINTR && 802 # ifdef EWOULDBLOCK 803 errno != EWOULDBLOCK && 804 # endif 805 errno != ENOMEM && errno != ENOBUFS 806 #else 807 WSAGetLastError() != WSAEINPROGRESS && 808 WSAGetLastError() != WSAEINTR && 809 WSAGetLastError() != WSAENOBUFS && 810 WSAGetLastError() != WSAEWOULDBLOCK 811 #endif 812 ) { 813 log_err("poll udp out failed: %s", 814 sock_strerror(errno)); 815 return 0; 816 } else if((pret < 0 && 817 #ifndef USE_WINSOCK 818 ( errno == ENOBUFS /* Maybe some systems */ 819 || errno == ENOMEM /* Linux */ 820 || errno == EAGAIN) /* Macos, solaris, openbsd */ 821 #else 822 WSAGetLastError() == WSAENOBUFS 823 #endif 824 ) || (send_nobufs && retries > 0)) { 825 /* ENOBUFS/ENOMEM/EAGAIN, and poll 826 * returned without 827 * a timeout. Or the retried send call 828 * returned ENOBUFS/ENOMEM/EAGAIN. 829 * It is good to wait a bit for the 830 * error to clear. */ 831 /* The timeout is 20*(2^(retries+1)), 832 * it increases exponentially, starting 833 * at 40 msec. After 5 tries, 1240 msec 834 * have passed in total, when poll 835 * returned the error, and 1200 msec 836 * when send returned the errors. */ 837 #ifndef USE_WINSOCK 838 pret = poll(NULL, 0, (SEND_BLOCKED_WAIT_TIMEOUT/10)<<(retries+1)); 839 #else 840 Sleep((SEND_BLOCKED_WAIT_TIMEOUT/10)<<(retries+1)); 841 pret = 0; 842 #endif 843 if(pret < 0 844 #ifndef USE_WINSOCK 845 && errno != EAGAIN && errno != EINTR && 846 # ifdef EWOULDBLOCK 847 errno != EWOULDBLOCK && 848 # endif 849 errno != ENOMEM && errno != ENOBUFS 850 #else /* USE_WINSOCK */ 851 /* Sleep does not error */ 852 #endif 853 ) { 854 log_err("poll udp out timer failed: %s", 855 sock_strerror(errno)); 856 } 857 } 858 #endif /* defined(HAVE_POLL) || defined(USE_WINSOCK) */ 859 retries++; 860 sent = sendmsg(c->fd, &msg, 0); 861 } 862 } 863 } 864 if(sent == -1) { 865 if(!udp_send_errno_needs_log(addr, addrlen)) 866 return 0; 867 verbose(VERB_OPS, "sendmsg failed: %s", strerror(errno)); 868 log_addr(VERB_OPS, "remote address is", 869 (struct sockaddr_storage*)addr, addrlen); 870 #ifdef __NetBSD__ 871 /* netbsd 7 has IP_PKTINFO for recv but not send */ 872 if(errno == EINVAL && r->srctype == 4) 873 log_err("sendmsg: No support for sendmsg(IP_PKTINFO). " 874 "Please disable interface-automatic"); 875 #endif 876 return 0; 877 } else if((size_t)sent != sldns_buffer_remaining(packet)) { 878 log_err("sent %d in place of %d bytes", 879 (int)sent, (int)sldns_buffer_remaining(packet)); 880 return 0; 881 } 882 return 1; 883 #else 884 (void)c; 885 (void)packet; 886 (void)addr; 887 (void)addrlen; 888 (void)r; 889 log_err("sendmsg: IPV6_PKTINFO not supported"); 890 return 0; 891 #endif /* AF_INET6 && IPV6_PKTINFO && HAVE_SENDMSG */ 892 } 893 894 /** return true is UDP receive error needs to be logged */ 895 static int udp_recv_needs_log(int err) 896 { 897 switch(err) { 898 case EACCES: /* some hosts send ICMP 'Permission Denied' */ 899 #ifndef USE_WINSOCK 900 case ECONNREFUSED: 901 # ifdef ENETUNREACH 902 case ENETUNREACH: 903 # endif 904 # ifdef EHOSTDOWN 905 case EHOSTDOWN: 906 # endif 907 # ifdef EHOSTUNREACH 908 case EHOSTUNREACH: 909 # endif 910 # ifdef ENETDOWN 911 case ENETDOWN: 912 # endif 913 #else /* USE_WINSOCK */ 914 case WSAECONNREFUSED: 915 case WSAENETUNREACH: 916 case WSAEHOSTDOWN: 917 case WSAEHOSTUNREACH: 918 case WSAENETDOWN: 919 #endif 920 if(verbosity >= VERB_ALGO) 921 return 1; 922 return 0; 923 default: 924 break; 925 } 926 return 1; 927 } 928 929 /** Parses the PROXYv2 header from buf and updates the comm_reply struct. 930 * Returns 1 on success, 0 on failure. */ 931 static int consume_pp2_header(struct sldns_buffer* buf, struct comm_reply* rep, 932 int stream) { 933 size_t size; 934 struct pp2_header *header; 935 int err = pp2_read_header(sldns_buffer_begin(buf), 936 sldns_buffer_remaining(buf)); 937 if(err) return 0; 938 header = (struct pp2_header*)sldns_buffer_begin(buf); 939 size = PP2_HEADER_SIZE + ntohs(header->len); 940 if((header->ver_cmd & 0xF) == PP2_CMD_LOCAL) { 941 /* A connection from the proxy itself. 942 * No need to do anything with addresses. */ 943 goto done; 944 } 945 if(header->fam_prot == PP2_UNSPEC_UNSPEC) { 946 /* Unspecified family and protocol. This could be used for 947 * health checks by proxies. 948 * No need to do anything with addresses. */ 949 goto done; 950 } 951 /* Read the proxied address */ 952 switch(header->fam_prot) { 953 case PP2_INET_STREAM: 954 case PP2_INET_DGRAM: 955 { 956 struct sockaddr_in* addr = 957 (struct sockaddr_in*)&rep->client_addr; 958 if(ntohs(header->len) < PP2_HEADER_LEN_INET) { 959 verbose(VERB_OPS, "proxy_protocol: header too short for IPv4 address"); 960 return 0; 961 } 962 addr->sin_family = AF_INET; 963 addr->sin_addr.s_addr = header->addr.addr4.src_addr; 964 addr->sin_port = header->addr.addr4.src_port; 965 rep->client_addrlen = (socklen_t)sizeof(struct sockaddr_in); 966 } 967 /* Ignore the destination address; it should be us. */ 968 break; 969 case PP2_INET6_STREAM: 970 case PP2_INET6_DGRAM: 971 { 972 struct sockaddr_in6* addr = 973 (struct sockaddr_in6*)&rep->client_addr; 974 if(ntohs(header->len) < PP2_HEADER_LEN_INET6) { 975 verbose(VERB_OPS, "proxy_protocol: header too short for IPv6 address"); 976 return 0; 977 } 978 memset(addr, 0, sizeof(*addr)); 979 addr->sin6_family = AF_INET6; 980 memcpy(&addr->sin6_addr, 981 header->addr.addr6.src_addr, 16); 982 addr->sin6_port = header->addr.addr6.src_port; 983 rep->client_addrlen = (socklen_t)sizeof(struct sockaddr_in6); 984 } 985 /* Ignore the destination address; it should be us. */ 986 break; 987 default: 988 log_err("proxy_protocol: unsupported family and " 989 "protocol 0x%x", (int)header->fam_prot); 990 return 0; 991 } 992 rep->is_proxied = 1; 993 done: 994 if(!stream) { 995 /* We are reading a whole packet; 996 * Move the rest of the data to overwrite the PROXYv2 header */ 997 /* XXX can we do better to avoid memmove? */ 998 memmove(header, ((char*)header)+size, 999 sldns_buffer_limit(buf)-size); 1000 sldns_buffer_set_limit(buf, sldns_buffer_limit(buf)-size); 1001 } 1002 return 1; 1003 } 1004 1005 #if defined(AF_INET6) && defined(IPV6_PKTINFO) && defined(HAVE_RECVMSG) 1006 void 1007 comm_point_udp_ancil_callback(int fd, short event, void* arg) 1008 { 1009 struct comm_reply rep; 1010 struct msghdr msg; 1011 struct iovec iov[1]; 1012 ssize_t rcv; 1013 union { 1014 struct cmsghdr hdr; 1015 char buf[256]; 1016 } ancil; 1017 int i; 1018 #ifndef S_SPLINT_S 1019 struct cmsghdr* cmsg; 1020 #endif /* S_SPLINT_S */ 1021 #ifdef HAVE_LINUX_NET_TSTAMP_H 1022 struct timespec *ts; 1023 #endif /* HAVE_LINUX_NET_TSTAMP_H */ 1024 1025 rep.c = (struct comm_point*)arg; 1026 log_assert(rep.c->type == comm_udp); 1027 1028 if(!(event&UB_EV_READ)) 1029 return; 1030 log_assert(rep.c && rep.c->buffer && rep.c->fd == fd); 1031 ub_comm_base_now(rep.c->ev->base); 1032 for(i=0; i<NUM_UDP_PER_SELECT; i++) { 1033 sldns_buffer_clear(rep.c->buffer); 1034 timeval_clear(&rep.c->recv_tv); 1035 rep.remote_addrlen = (socklen_t)sizeof(rep.remote_addr); 1036 log_assert(fd != -1); 1037 log_assert(sldns_buffer_remaining(rep.c->buffer) > 0); 1038 msg.msg_name = &rep.remote_addr; 1039 msg.msg_namelen = (socklen_t)sizeof(rep.remote_addr); 1040 iov[0].iov_base = sldns_buffer_begin(rep.c->buffer); 1041 iov[0].iov_len = sldns_buffer_remaining(rep.c->buffer); 1042 msg.msg_iov = iov; 1043 msg.msg_iovlen = 1; 1044 msg.msg_control = ancil.buf; 1045 #ifndef S_SPLINT_S 1046 msg.msg_controllen = sizeof(ancil.buf); 1047 #endif /* S_SPLINT_S */ 1048 msg.msg_flags = 0; 1049 rcv = recvmsg(fd, &msg, MSG_DONTWAIT); 1050 if(rcv == -1) { 1051 if(errno != EAGAIN && errno != EINTR 1052 && udp_recv_needs_log(errno)) { 1053 log_err("recvmsg failed: %s", strerror(errno)); 1054 } 1055 return; 1056 } 1057 rep.remote_addrlen = msg.msg_namelen; 1058 sldns_buffer_skip(rep.c->buffer, rcv); 1059 sldns_buffer_flip(rep.c->buffer); 1060 rep.srctype = 0; 1061 rep.is_proxied = 0; 1062 #ifndef S_SPLINT_S 1063 for(cmsg = CMSG_FIRSTHDR(&msg); cmsg != NULL; 1064 cmsg = CMSG_NXTHDR(&msg, cmsg)) { 1065 if( cmsg->cmsg_level == IPPROTO_IPV6 && 1066 cmsg->cmsg_type == IPV6_PKTINFO) { 1067 rep.srctype = 6; 1068 memmove(&rep.pktinfo.v6info, CMSG_DATA(cmsg), 1069 sizeof(struct in6_pktinfo)); 1070 break; 1071 #ifdef IP_PKTINFO 1072 } else if( cmsg->cmsg_level == IPPROTO_IP && 1073 cmsg->cmsg_type == IP_PKTINFO) { 1074 rep.srctype = 4; 1075 memmove(&rep.pktinfo.v4info, CMSG_DATA(cmsg), 1076 sizeof(struct in_pktinfo)); 1077 break; 1078 #elif defined(IP_RECVDSTADDR) 1079 } else if( cmsg->cmsg_level == IPPROTO_IP && 1080 cmsg->cmsg_type == IP_RECVDSTADDR) { 1081 rep.srctype = 4; 1082 memmove(&rep.pktinfo.v4addr, CMSG_DATA(cmsg), 1083 sizeof(struct in_addr)); 1084 break; 1085 #endif /* IP_PKTINFO or IP_RECVDSTADDR */ 1086 #ifdef HAVE_LINUX_NET_TSTAMP_H 1087 } else if( cmsg->cmsg_level == SOL_SOCKET && 1088 cmsg->cmsg_type == SO_TIMESTAMPNS) { 1089 ts = (struct timespec *)CMSG_DATA(cmsg); 1090 TIMESPEC_TO_TIMEVAL(&rep.c->recv_tv, ts); 1091 } else if( cmsg->cmsg_level == SOL_SOCKET && 1092 cmsg->cmsg_type == SO_TIMESTAMPING) { 1093 ts = (struct timespec *)CMSG_DATA(cmsg); 1094 TIMESPEC_TO_TIMEVAL(&rep.c->recv_tv, ts); 1095 } else if( cmsg->cmsg_level == SOL_SOCKET && 1096 cmsg->cmsg_type == SO_TIMESTAMP) { 1097 memmove(&rep.c->recv_tv, CMSG_DATA(cmsg), sizeof(struct timeval)); 1098 #elif defined(SO_TIMESTAMP) && defined(SCM_TIMESTAMP) 1099 } else if( cmsg->cmsg_level == SOL_SOCKET && 1100 cmsg->cmsg_type == SCM_TIMESTAMP) { 1101 /* FreeBSD and also Linux. */ 1102 memmove(&rep.c->recv_tv, CMSG_DATA(cmsg), sizeof(struct timeval)); 1103 #endif /* HAVE_LINUX_NET_TSTAMP_H */ 1104 } 1105 } 1106 1107 if(verbosity >= VERB_ALGO && rep.srctype != 0) 1108 p_ancil("receive_udp on interface", &rep); 1109 #endif /* S_SPLINT_S */ 1110 1111 if(rep.c->pp2_enabled && !consume_pp2_header(rep.c->buffer, 1112 &rep, 0)) { 1113 log_err("proxy_protocol: could not consume PROXYv2 header"); 1114 return; 1115 } 1116 if(!rep.is_proxied) { 1117 rep.client_addrlen = rep.remote_addrlen; 1118 memmove(&rep.client_addr, &rep.remote_addr, 1119 rep.remote_addrlen); 1120 } 1121 1122 fptr_ok(fptr_whitelist_comm_point(rep.c->callback)); 1123 if((*rep.c->callback)(rep.c, rep.c->cb_arg, NETEVENT_NOERROR, &rep)) { 1124 /* send back immediate reply */ 1125 struct sldns_buffer *buffer; 1126 #ifdef USE_DNSCRYPT 1127 buffer = rep.c->dnscrypt_buffer; 1128 #else 1129 buffer = rep.c->buffer; 1130 #endif 1131 (void)comm_point_send_udp_msg_if(rep.c, buffer, 1132 (struct sockaddr*)&rep.remote_addr, 1133 rep.remote_addrlen, &rep); 1134 } 1135 if(!rep.c || rep.c->fd == -1) /* commpoint closed */ 1136 break; 1137 } 1138 } 1139 #endif /* AF_INET6 && IPV6_PKTINFO && HAVE_RECVMSG */ 1140 1141 void 1142 comm_point_udp_callback(int fd, short event, void* arg) 1143 { 1144 struct comm_reply rep; 1145 ssize_t rcv; 1146 int i; 1147 struct sldns_buffer *buffer; 1148 1149 rep.c = (struct comm_point*)arg; 1150 log_assert(rep.c->type == comm_udp); 1151 1152 if(!(event&UB_EV_READ)) 1153 return; 1154 log_assert(rep.c && rep.c->buffer && rep.c->fd == fd); 1155 ub_comm_base_now(rep.c->ev->base); 1156 for(i=0; i<NUM_UDP_PER_SELECT; i++) { 1157 sldns_buffer_clear(rep.c->buffer); 1158 rep.remote_addrlen = (socklen_t)sizeof(rep.remote_addr); 1159 log_assert(fd != -1); 1160 log_assert(sldns_buffer_remaining(rep.c->buffer) > 0); 1161 rcv = recvfrom(fd, (void*)sldns_buffer_begin(rep.c->buffer), 1162 sldns_buffer_remaining(rep.c->buffer), MSG_DONTWAIT, 1163 (struct sockaddr*)&rep.remote_addr, &rep.remote_addrlen); 1164 if(rcv == -1) { 1165 #ifndef USE_WINSOCK 1166 if(errno != EAGAIN && errno != EINTR 1167 && udp_recv_needs_log(errno)) 1168 log_err("recvfrom %d failed: %s", 1169 fd, strerror(errno)); 1170 #else 1171 if(WSAGetLastError() != WSAEINPROGRESS && 1172 WSAGetLastError() != WSAECONNRESET && 1173 WSAGetLastError()!= WSAEWOULDBLOCK && 1174 udp_recv_needs_log(WSAGetLastError())) 1175 log_err("recvfrom failed: %s", 1176 wsa_strerror(WSAGetLastError())); 1177 #endif 1178 return; 1179 } 1180 sldns_buffer_skip(rep.c->buffer, rcv); 1181 sldns_buffer_flip(rep.c->buffer); 1182 rep.srctype = 0; 1183 rep.is_proxied = 0; 1184 1185 if(rep.c->pp2_enabled && !consume_pp2_header(rep.c->buffer, 1186 &rep, 0)) { 1187 log_err("proxy_protocol: could not consume PROXYv2 header"); 1188 return; 1189 } 1190 if(!rep.is_proxied) { 1191 rep.client_addrlen = rep.remote_addrlen; 1192 memmove(&rep.client_addr, &rep.remote_addr, 1193 rep.remote_addrlen); 1194 } 1195 1196 fptr_ok(fptr_whitelist_comm_point(rep.c->callback)); 1197 if((*rep.c->callback)(rep.c, rep.c->cb_arg, NETEVENT_NOERROR, &rep)) { 1198 /* send back immediate reply */ 1199 #ifdef USE_DNSCRYPT 1200 buffer = rep.c->dnscrypt_buffer; 1201 #else 1202 buffer = rep.c->buffer; 1203 #endif 1204 (void)comm_point_send_udp_msg(rep.c, buffer, 1205 (struct sockaddr*)&rep.remote_addr, 1206 rep.remote_addrlen, 0); 1207 } 1208 if(!rep.c || rep.c->fd != fd) /* commpoint closed to -1 or reused for 1209 another UDP port. Note rep.c cannot be reused with TCP fd. */ 1210 break; 1211 } 1212 } 1213 1214 #ifdef HAVE_NGTCP2 1215 void 1216 doq_pkt_addr_init(struct doq_pkt_addr* paddr) 1217 { 1218 paddr->addrlen = (socklen_t)sizeof(paddr->addr); 1219 paddr->localaddrlen = (socklen_t)sizeof(paddr->localaddr); 1220 paddr->ifindex = 0; 1221 } 1222 1223 /** set the ecn on the transmission */ 1224 static void 1225 doq_set_ecn(int fd, int family, uint32_t ecn) 1226 { 1227 unsigned int val = ecn; 1228 if(family == AF_INET6) { 1229 if(setsockopt(fd, IPPROTO_IPV6, IPV6_TCLASS, &val, 1230 (socklen_t)sizeof(val)) == -1) { 1231 log_err("setsockopt(.. IPV6_TCLASS ..): %s", 1232 strerror(errno)); 1233 } 1234 return; 1235 } 1236 if(setsockopt(fd, IPPROTO_IP, IP_TOS, &val, 1237 (socklen_t)sizeof(val)) == -1) { 1238 log_err("setsockopt(.. IP_TOS ..): %s", 1239 strerror(errno)); 1240 } 1241 } 1242 1243 /** set the local address in the control ancillary data */ 1244 static void 1245 doq_set_localaddr_cmsg(struct msghdr* msg, size_t control_size, 1246 struct doq_addr_storage* localaddr, socklen_t localaddrlen, 1247 int ifindex) 1248 { 1249 #ifndef S_SPLINT_S 1250 struct cmsghdr* cmsg; 1251 #endif /* S_SPLINT_S */ 1252 #ifndef S_SPLINT_S 1253 cmsg = CMSG_FIRSTHDR(msg); 1254 if(localaddr->sockaddr.in.sin_family == AF_INET) { 1255 #ifdef IP_PKTINFO 1256 struct sockaddr_in* sa = (struct sockaddr_in*)localaddr; 1257 struct in_pktinfo v4info; 1258 log_assert(localaddrlen >= sizeof(struct sockaddr_in)); 1259 msg->msg_controllen = CMSG_SPACE(sizeof(struct in_pktinfo)); 1260 memset(msg->msg_control, 0, msg->msg_controllen); 1261 log_assert(msg->msg_controllen <= control_size); 1262 cmsg->cmsg_level = IPPROTO_IP; 1263 cmsg->cmsg_type = IP_PKTINFO; 1264 memset(&v4info, 0, sizeof(v4info)); 1265 # ifdef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST 1266 memmove(&v4info.ipi_spec_dst, &sa->sin_addr, 1267 sizeof(struct in_addr)); 1268 # else 1269 memmove(&v4info.ipi_addr, &sa->sin_addr, 1270 sizeof(struct in_addr)); 1271 # endif 1272 v4info.ipi_ifindex = ifindex; 1273 memmove(CMSG_DATA(cmsg), &v4info, sizeof(struct in_pktinfo)); 1274 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo)); 1275 #elif defined(IP_SENDSRCADDR) 1276 struct sockaddr_in* sa= (struct sockaddr_in*)localaddr; 1277 log_assert(localaddrlen >= sizeof(struct sockaddr_in)); 1278 msg->msg_controllen = CMSG_SPACE(sizeof(struct in_addr)); 1279 memset(msg->msg_control, 0, msg->msg_controllen); 1280 log_assert(msg->msg_controllen <= control_size); 1281 cmsg->cmsg_level = IPPROTO_IP; 1282 cmsg->cmsg_type = IP_SENDSRCADDR; 1283 memmove(CMSG_DATA(cmsg), &sa->sin_addr, 1284 sizeof(struct in_addr)); 1285 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_addr)); 1286 #endif 1287 } else { 1288 struct sockaddr_in6* sa6 = (struct sockaddr_in6*)localaddr; 1289 struct in6_pktinfo v6info; 1290 log_assert(localaddrlen >= sizeof(struct sockaddr_in6)); 1291 msg->msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo)); 1292 memset(msg->msg_control, 0, msg->msg_controllen); 1293 log_assert(msg->msg_controllen <= control_size); 1294 cmsg->cmsg_level = IPPROTO_IPV6; 1295 cmsg->cmsg_type = IPV6_PKTINFO; 1296 memset(&v6info, 0, sizeof(v6info)); 1297 memmove(&v6info.ipi6_addr, &sa6->sin6_addr, 1298 sizeof(struct in6_addr)); 1299 v6info.ipi6_ifindex = ifindex; 1300 memmove(CMSG_DATA(cmsg), &v6info, sizeof(struct in6_pktinfo)); 1301 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo)); 1302 } 1303 #endif /* S_SPLINT_S */ 1304 /* Ignore unused variables, if no assertions are compiled. */ 1305 (void)localaddrlen; 1306 (void)control_size; 1307 } 1308 1309 /** write address and port into strings */ 1310 static int 1311 doq_print_addr_port(struct doq_addr_storage* addr, socklen_t addrlen, 1312 char* host, size_t hostlen, char* port, size_t portlen) 1313 { 1314 if(addr->sockaddr.in.sin_family == AF_INET) { 1315 struct sockaddr_in* sa = (struct sockaddr_in*)addr; 1316 log_assert(addrlen >= sizeof(*sa)); 1317 if(inet_ntop(sa->sin_family, &sa->sin_addr, host, 1318 (socklen_t)hostlen) == 0) { 1319 log_hex("inet_ntop error: address", &sa->sin_addr, 1320 sizeof(sa->sin_addr)); 1321 return 0; 1322 } 1323 snprintf(port, portlen, "%u", (unsigned)ntohs(sa->sin_port)); 1324 } else if(addr->sockaddr.in.sin_family == AF_INET6) { 1325 struct sockaddr_in6* sa6 = (struct sockaddr_in6*)addr; 1326 log_assert(addrlen >= sizeof(*sa6)); 1327 if(inet_ntop(sa6->sin6_family, &sa6->sin6_addr, host, 1328 (socklen_t)hostlen) == 0) { 1329 log_hex("inet_ntop error: address", &sa6->sin6_addr, 1330 sizeof(sa6->sin6_addr)); 1331 return 0; 1332 } 1333 snprintf(port, portlen, "%u", (unsigned)ntohs(sa6->sin6_port)); 1334 } 1335 return 1; 1336 } 1337 1338 /** doq store the blocked packet when write has blocked */ 1339 static void 1340 doq_store_blocked_pkt(struct comm_point* c, struct doq_pkt_addr* paddr, 1341 uint32_t ecn) 1342 { 1343 if(c->doq_socket->have_blocked_pkt) 1344 return; /* should not happen that we write when there is 1345 already a blocked write, but if so, drop it. */ 1346 if(sldns_buffer_limit(c->doq_socket->pkt_buf) > 1347 sldns_buffer_capacity(c->doq_socket->blocked_pkt)) 1348 return; /* impossibly large, drop packet. impossible because 1349 pkt_buf and blocked_pkt are the same size. */ 1350 c->doq_socket->have_blocked_pkt = 1; 1351 c->doq_socket->blocked_pkt_pi.ecn = ecn; 1352 memcpy(c->doq_socket->blocked_paddr, paddr, 1353 sizeof(*c->doq_socket->blocked_paddr)); 1354 sldns_buffer_clear(c->doq_socket->blocked_pkt); 1355 sldns_buffer_write(c->doq_socket->blocked_pkt, 1356 sldns_buffer_begin(c->doq_socket->pkt_buf), 1357 sldns_buffer_limit(c->doq_socket->pkt_buf)); 1358 sldns_buffer_flip(c->doq_socket->blocked_pkt); 1359 } 1360 1361 void 1362 doq_send_pkt(struct comm_point* c, struct doq_pkt_addr* paddr, uint32_t ecn) 1363 { 1364 struct msghdr msg; 1365 struct iovec iov[1]; 1366 union { 1367 struct cmsghdr hdr; 1368 char buf[256]; 1369 } control; 1370 ssize_t ret; 1371 iov[0].iov_base = sldns_buffer_begin(c->doq_socket->pkt_buf); 1372 iov[0].iov_len = sldns_buffer_limit(c->doq_socket->pkt_buf); 1373 memset(&msg, 0, sizeof(msg)); 1374 msg.msg_name = (void*)&paddr->addr; 1375 msg.msg_namelen = paddr->addrlen; 1376 msg.msg_iov = iov; 1377 msg.msg_iovlen = 1; 1378 msg.msg_control = control.buf; 1379 #ifndef S_SPLINT_S 1380 msg.msg_controllen = sizeof(control.buf); 1381 #endif /* S_SPLINT_S */ 1382 msg.msg_flags = 0; 1383 1384 doq_set_localaddr_cmsg(&msg, sizeof(control.buf), &paddr->localaddr, 1385 paddr->localaddrlen, paddr->ifindex); 1386 doq_set_ecn(c->fd, paddr->addr.sockaddr.in.sin_family, ecn); 1387 1388 for(;;) { 1389 ret = sendmsg(c->fd, &msg, MSG_DONTWAIT); 1390 if(ret == -1 && errno == EINTR) 1391 continue; 1392 break; 1393 } 1394 if(ret == -1) { 1395 #ifndef USE_WINSOCK 1396 if(errno == EAGAIN || 1397 # ifdef EWOULDBLOCK 1398 errno == EWOULDBLOCK || 1399 # endif 1400 errno == ENOBUFS) 1401 #else 1402 if(WSAGetLastError() == WSAEINPROGRESS || 1403 WSAGetLastError() == WSAENOBUFS || 1404 WSAGetLastError() == WSAEWOULDBLOCK) 1405 #endif 1406 { 1407 /* udp send has blocked */ 1408 doq_store_blocked_pkt(c, paddr, ecn); 1409 return; 1410 } 1411 if(!udp_send_errno_needs_log((void*)&paddr->addr, 1412 paddr->addrlen)) 1413 return; 1414 if(verbosity >= VERB_OPS) { 1415 char host[256], port[32]; 1416 if(doq_print_addr_port(&paddr->addr, paddr->addrlen, 1417 host, sizeof(host), port, sizeof(port))) { 1418 verbose(VERB_OPS, "doq sendmsg to %s %s " 1419 "failed: %s", host, port, 1420 strerror(errno)); 1421 } else { 1422 verbose(VERB_OPS, "doq sendmsg failed: %s", 1423 strerror(errno)); 1424 } 1425 } 1426 return; 1427 } else if(ret != (ssize_t)sldns_buffer_limit(c->doq_socket->pkt_buf)) { 1428 char host[256], port[32]; 1429 if(doq_print_addr_port(&paddr->addr, paddr->addrlen, host, 1430 sizeof(host), port, sizeof(port))) { 1431 log_err("doq sendmsg to %s %s failed: " 1432 "sent %d in place of %d bytes", 1433 host, port, (int)ret, 1434 (int)sldns_buffer_limit(c->doq_socket->pkt_buf)); 1435 } else { 1436 log_err("doq sendmsg failed: " 1437 "sent %d in place of %d bytes", 1438 (int)ret, (int)sldns_buffer_limit(c->doq_socket->pkt_buf)); 1439 } 1440 return; 1441 } 1442 } 1443 1444 /** fetch port number */ 1445 static int 1446 doq_sockaddr_get_port(struct doq_addr_storage* addr) 1447 { 1448 if(addr->sockaddr.in.sin_family == AF_INET) { 1449 struct sockaddr_in* sa = (struct sockaddr_in*)addr; 1450 return ntohs(sa->sin_port); 1451 } else if(addr->sockaddr.in.sin_family == AF_INET6) { 1452 struct sockaddr_in6* sa6 = (struct sockaddr_in6*)addr; 1453 return ntohs(sa6->sin6_port); 1454 } 1455 return 0; 1456 } 1457 1458 /** get local address from ancillary data headers */ 1459 static int 1460 doq_get_localaddr_cmsg(struct comm_point* c, struct doq_pkt_addr* paddr, 1461 int* pkt_continue, struct msghdr* msg) 1462 { 1463 #ifndef S_SPLINT_S 1464 struct cmsghdr* cmsg; 1465 #endif /* S_SPLINT_S */ 1466 1467 memset(&paddr->localaddr, 0, sizeof(paddr->localaddr)); 1468 #ifndef S_SPLINT_S 1469 for(cmsg = CMSG_FIRSTHDR(msg); cmsg != NULL; 1470 cmsg = CMSG_NXTHDR(msg, cmsg)) { 1471 if( cmsg->cmsg_level == IPPROTO_IPV6 && 1472 cmsg->cmsg_type == IPV6_PKTINFO) { 1473 struct in6_pktinfo* v6info = 1474 (struct in6_pktinfo*)CMSG_DATA(cmsg); 1475 struct sockaddr_in6* sa= (struct sockaddr_in6*) 1476 &paddr->localaddr; 1477 struct sockaddr_in6* rema = (struct sockaddr_in6*) 1478 &paddr->addr; 1479 if(rema->sin6_family != AF_INET6) { 1480 log_err("doq cmsg family mismatch cmsg is ip6"); 1481 *pkt_continue = 1; 1482 return 0; 1483 } 1484 sa->sin6_family = AF_INET6; 1485 sa->sin6_port = htons(doq_sockaddr_get_port( 1486 (void*)c->socket->addr)); 1487 paddr->ifindex = v6info->ipi6_ifindex; 1488 memmove(&sa->sin6_addr, &v6info->ipi6_addr, 1489 sizeof(struct in6_addr)); 1490 paddr->localaddrlen = sizeof(struct sockaddr_in6); 1491 break; 1492 #ifdef IP_PKTINFO 1493 } else if( cmsg->cmsg_level == IPPROTO_IP && 1494 cmsg->cmsg_type == IP_PKTINFO) { 1495 struct in_pktinfo* v4info = 1496 (struct in_pktinfo*)CMSG_DATA(cmsg); 1497 struct sockaddr_in* sa= (struct sockaddr_in*) 1498 &paddr->localaddr; 1499 struct sockaddr_in* rema = (struct sockaddr_in*) 1500 &paddr->addr; 1501 if(rema->sin_family != AF_INET) { 1502 log_err("doq cmsg family mismatch cmsg is ip4"); 1503 *pkt_continue = 1; 1504 return 0; 1505 } 1506 sa->sin_family = AF_INET; 1507 sa->sin_port = htons(doq_sockaddr_get_port( 1508 (void*)c->socket->addr)); 1509 paddr->ifindex = v4info->ipi_ifindex; 1510 memmove(&sa->sin_addr, &v4info->ipi_addr, 1511 sizeof(struct in_addr)); 1512 paddr->localaddrlen = sizeof(struct sockaddr_in); 1513 break; 1514 #elif defined(IP_RECVDSTADDR) 1515 } else if( cmsg->cmsg_level == IPPROTO_IP && 1516 cmsg->cmsg_type == IP_RECVDSTADDR) { 1517 struct sockaddr_in* sa= (struct sockaddr_in*) 1518 &paddr->localaddr; 1519 struct sockaddr_in* rema = (struct sockaddr_in*) 1520 &paddr->addr; 1521 if(rema->sin_family != AF_INET) { 1522 log_err("doq cmsg family mismatch cmsg is ip4"); 1523 *pkt_continue = 1; 1524 return 0; 1525 } 1526 sa->sin_family = AF_INET; 1527 sa->sin_port = htons(doq_sockaddr_get_port( 1528 (void*)c->socket->addr)); 1529 paddr->ifindex = 0; 1530 memmove(&sa.sin_addr, CMSG_DATA(cmsg), 1531 sizeof(struct in_addr)); 1532 paddr->localaddrlen = sizeof(struct sockaddr_in); 1533 break; 1534 #endif /* IP_PKTINFO or IP_RECVDSTADDR */ 1535 } 1536 } 1537 #endif /* S_SPLINT_S */ 1538 1539 return 1; 1540 } 1541 1542 /** get packet ecn information */ 1543 static uint32_t 1544 msghdr_get_ecn(struct msghdr* msg, int family) 1545 { 1546 #ifndef S_SPLINT_S 1547 struct cmsghdr* cmsg; 1548 if(family == AF_INET6) { 1549 for(cmsg = CMSG_FIRSTHDR(msg); cmsg != NULL; 1550 cmsg = CMSG_NXTHDR(msg, cmsg)) { 1551 if(cmsg->cmsg_level == IPPROTO_IPV6 && 1552 cmsg->cmsg_type == IPV6_TCLASS && 1553 cmsg->cmsg_len != 0) { 1554 uint8_t* ecn = (uint8_t*)CMSG_DATA(cmsg); 1555 return *ecn; 1556 } 1557 } 1558 return 0; 1559 } 1560 for(cmsg = CMSG_FIRSTHDR(msg); cmsg != NULL; 1561 cmsg = CMSG_NXTHDR(msg, cmsg)) { 1562 if(cmsg->cmsg_level == IPPROTO_IP && 1563 cmsg->cmsg_type == IP_TOS && 1564 cmsg->cmsg_len != 0) { 1565 uint8_t* ecn = (uint8_t*)CMSG_DATA(cmsg); 1566 return *ecn; 1567 } 1568 } 1569 #endif /* S_SPLINT_S */ 1570 return 0; 1571 } 1572 1573 /** receive packet for DoQ on UDP. get ancillary data for addresses, 1574 * return false if failed and the callback can stop receiving UDP packets 1575 * if pkt_continue is false. */ 1576 static int 1577 doq_recv(struct comm_point* c, struct doq_pkt_addr* paddr, int* pkt_continue, 1578 struct ngtcp2_pkt_info* pi) 1579 { 1580 struct msghdr msg; 1581 struct iovec iov[1]; 1582 ssize_t rcv; 1583 union { 1584 struct cmsghdr hdr; 1585 char buf[256]; 1586 } ancil; 1587 1588 msg.msg_name = &paddr->addr; 1589 msg.msg_namelen = (socklen_t)sizeof(paddr->addr); 1590 iov[0].iov_base = sldns_buffer_begin(c->doq_socket->pkt_buf); 1591 iov[0].iov_len = sldns_buffer_remaining(c->doq_socket->pkt_buf); 1592 msg.msg_iov = iov; 1593 msg.msg_iovlen = 1; 1594 msg.msg_control = ancil.buf; 1595 #ifndef S_SPLINT_S 1596 msg.msg_controllen = sizeof(ancil.buf); 1597 #endif /* S_SPLINT_S */ 1598 msg.msg_flags = 0; 1599 1600 rcv = recvmsg(c->fd, &msg, MSG_DONTWAIT); 1601 if(rcv == -1) { 1602 if(errno != EAGAIN && errno != EINTR 1603 && udp_recv_needs_log(errno)) { 1604 log_err("recvmsg failed for doq: %s", strerror(errno)); 1605 } 1606 *pkt_continue = 0; 1607 return 0; 1608 } 1609 1610 paddr->addrlen = msg.msg_namelen; 1611 sldns_buffer_skip(c->doq_socket->pkt_buf, rcv); 1612 sldns_buffer_flip(c->doq_socket->pkt_buf); 1613 if(!doq_get_localaddr_cmsg(c, paddr, pkt_continue, &msg)) 1614 return 0; 1615 pi->ecn = msghdr_get_ecn(&msg, paddr->addr.sockaddr.in.sin_family); 1616 return 1; 1617 } 1618 1619 /** send the version negotiation for doq. scid and dcid are flipped around 1620 * to send back to the client. */ 1621 static void 1622 doq_send_version_negotiation(struct comm_point* c, struct doq_pkt_addr* paddr, 1623 const uint8_t* dcid, size_t dcidlen, const uint8_t* scid, 1624 size_t scidlen) 1625 { 1626 uint32_t versions[2]; 1627 size_t versions_len = 0; 1628 ngtcp2_ssize ret; 1629 uint8_t unused_random; 1630 1631 /* fill the array with supported versions */ 1632 versions[0] = NGTCP2_PROTO_VER_V1; 1633 versions_len = 1; 1634 unused_random = ub_random_max(c->doq_socket->rnd, 256); 1635 sldns_buffer_clear(c->doq_socket->pkt_buf); 1636 ret = ngtcp2_pkt_write_version_negotiation( 1637 sldns_buffer_begin(c->doq_socket->pkt_buf), 1638 sldns_buffer_capacity(c->doq_socket->pkt_buf), unused_random, 1639 dcid, dcidlen, scid, scidlen, versions, versions_len); 1640 if(ret < 0) { 1641 log_err("ngtcp2_pkt_write_version_negotiation failed: %s", 1642 ngtcp2_strerror(ret)); 1643 return; 1644 } 1645 sldns_buffer_set_position(c->doq_socket->pkt_buf, ret); 1646 sldns_buffer_flip(c->doq_socket->pkt_buf); 1647 doq_send_pkt(c, paddr, 0); 1648 } 1649 1650 /** Find the doq_conn object by remote address and dcid */ 1651 static struct doq_conn* 1652 doq_conn_find(struct doq_table* table, struct doq_addr_storage* addr, 1653 socklen_t addrlen, struct doq_addr_storage* localaddr, 1654 socklen_t localaddrlen, int ifindex, const uint8_t* dcid, 1655 size_t dcidlen) 1656 { 1657 struct rbnode_type* node; 1658 struct doq_conn key; 1659 memset(&key.node, 0, sizeof(key.node)); 1660 key.node.key = &key; 1661 memmove(&key.key.paddr.addr, addr, addrlen); 1662 key.key.paddr.addrlen = addrlen; 1663 memmove(&key.key.paddr.localaddr, localaddr, localaddrlen); 1664 key.key.paddr.localaddrlen = localaddrlen; 1665 key.key.paddr.ifindex = ifindex; 1666 key.key.dcid = (void*)dcid; 1667 key.key.dcidlen = dcidlen; 1668 node = rbtree_search(table->conn_tree, &key); 1669 if(node) 1670 return (struct doq_conn*)node->key; 1671 return NULL; 1672 } 1673 1674 /** find the doq_con by the connection id */ 1675 static struct doq_conn* 1676 doq_conn_find_by_id(struct doq_table* table, const uint8_t* dcid, 1677 size_t dcidlen) 1678 { 1679 struct doq_conid* conid; 1680 lock_rw_rdlock(&table->conid_lock); 1681 conid = doq_conid_find(table, dcid, dcidlen); 1682 if(conid) { 1683 /* make a copy of the key */ 1684 struct doq_conn* conn; 1685 struct doq_conn_key key = conid->key; 1686 uint8_t cid[NGTCP2_MAX_CIDLEN]; 1687 log_assert(conid->key.dcidlen <= NGTCP2_MAX_CIDLEN); 1688 memcpy(cid, conid->key.dcid, conid->key.dcidlen); 1689 key.dcid = cid; 1690 lock_rw_unlock(&table->conid_lock); 1691 1692 /* now that the conid lock is released, look up the conn */ 1693 lock_rw_rdlock(&table->lock); 1694 conn = doq_conn_find(table, &key.paddr.addr, 1695 key.paddr.addrlen, &key.paddr.localaddr, 1696 key.paddr.localaddrlen, key.paddr.ifindex, key.dcid, 1697 key.dcidlen); 1698 if(!conn) { 1699 /* The connection got deleted between the conid lookup 1700 * and the connection lock grab, it no longer exists, 1701 * so return null. */ 1702 lock_rw_unlock(&table->lock); 1703 return NULL; 1704 } 1705 lock_basic_lock(&conn->lock); 1706 if(conn->is_deleted) { 1707 lock_rw_unlock(&table->lock); 1708 lock_basic_unlock(&conn->lock); 1709 return NULL; 1710 } 1711 lock_rw_unlock(&table->lock); 1712 return conn; 1713 } 1714 lock_rw_unlock(&table->conid_lock); 1715 return NULL; 1716 } 1717 1718 /** Find the doq_conn, by addr or by connection id */ 1719 static struct doq_conn* 1720 doq_conn_find_by_addr_or_cid(struct doq_table* table, 1721 struct doq_pkt_addr* paddr, const uint8_t* dcid, size_t dcidlen) 1722 { 1723 struct doq_conn* conn; 1724 lock_rw_rdlock(&table->lock); 1725 conn = doq_conn_find(table, &paddr->addr, paddr->addrlen, 1726 &paddr->localaddr, paddr->localaddrlen, paddr->ifindex, 1727 dcid, dcidlen); 1728 if(conn && conn->is_deleted) { 1729 conn = NULL; 1730 } 1731 if(conn) { 1732 lock_basic_lock(&conn->lock); 1733 lock_rw_unlock(&table->lock); 1734 verbose(VERB_ALGO, "doq: found connection by address, dcid"); 1735 } else { 1736 lock_rw_unlock(&table->lock); 1737 conn = doq_conn_find_by_id(table, dcid, dcidlen); 1738 if(conn) { 1739 verbose(VERB_ALGO, "doq: found connection by dcid"); 1740 } 1741 } 1742 return conn; 1743 } 1744 1745 /** decode doq packet header, false on handled or failure, true to continue 1746 * to process the packet */ 1747 static int 1748 doq_decode_pkt_header_negotiate(struct comm_point* c, 1749 struct doq_pkt_addr* paddr, struct doq_conn** conn) 1750 { 1751 #ifdef HAVE_STRUCT_NGTCP2_VERSION_CID 1752 struct ngtcp2_version_cid vc; 1753 #else 1754 uint32_t version; 1755 const uint8_t *dcid, *scid; 1756 size_t dcidlen, scidlen; 1757 #endif 1758 int rv; 1759 1760 #ifdef HAVE_STRUCT_NGTCP2_VERSION_CID 1761 rv = ngtcp2_pkt_decode_version_cid(&vc, 1762 sldns_buffer_begin(c->doq_socket->pkt_buf), 1763 sldns_buffer_limit(c->doq_socket->pkt_buf), 1764 c->doq_socket->sv_scidlen); 1765 #else 1766 rv = ngtcp2_pkt_decode_version_cid(&version, &dcid, &dcidlen, 1767 &scid, &scidlen, sldns_buffer_begin(c->doq_socket->pkt_buf), 1768 sldns_buffer_limit(c->doq_socket->pkt_buf), c->doq_socket->sv_scidlen); 1769 #endif 1770 if(rv != 0) { 1771 if(rv == NGTCP2_ERR_VERSION_NEGOTIATION) { 1772 /* send the version negotiation */ 1773 doq_send_version_negotiation(c, paddr, 1774 #ifdef HAVE_STRUCT_NGTCP2_VERSION_CID 1775 vc.scid, vc.scidlen, vc.dcid, vc.dcidlen 1776 #else 1777 scid, scidlen, dcid, dcidlen 1778 #endif 1779 ); 1780 return 0; 1781 } 1782 verbose(VERB_ALGO, "doq: could not decode version " 1783 "and CID from QUIC packet header: %s", 1784 ngtcp2_strerror(rv)); 1785 return 0; 1786 } 1787 1788 if(verbosity >= VERB_ALGO) { 1789 verbose(VERB_ALGO, "ngtcp2_pkt_decode_version_cid packet has " 1790 "QUIC protocol version %u", (unsigned) 1791 #ifdef HAVE_STRUCT_NGTCP2_VERSION_CID 1792 vc. 1793 #endif 1794 version 1795 ); 1796 log_hex("dcid", 1797 #ifdef HAVE_STRUCT_NGTCP2_VERSION_CID 1798 (void*)vc.dcid, vc.dcidlen 1799 #else 1800 (void*)dcid, dcidlen 1801 #endif 1802 ); 1803 log_hex("scid", 1804 #ifdef HAVE_STRUCT_NGTCP2_VERSION_CID 1805 (void*)vc.scid, vc.scidlen 1806 #else 1807 (void*)scid, scidlen 1808 #endif 1809 ); 1810 } 1811 *conn = doq_conn_find_by_addr_or_cid(c->doq_socket->table, paddr, 1812 #ifdef HAVE_STRUCT_NGTCP2_VERSION_CID 1813 vc.dcid, vc.dcidlen 1814 #else 1815 dcid, dcidlen 1816 #endif 1817 ); 1818 if(*conn) 1819 (*conn)->doq_socket = c->doq_socket; 1820 return 1; 1821 } 1822 1823 /** fill cid structure with random data */ 1824 static void doq_cid_randfill(struct ngtcp2_cid* cid, size_t datalen, 1825 struct ub_randstate* rnd) 1826 { 1827 uint8_t buf[32]; 1828 if(datalen > sizeof(buf)) 1829 datalen = sizeof(buf); 1830 doq_fill_rand(rnd, buf, datalen); 1831 ngtcp2_cid_init(cid, buf, datalen); 1832 } 1833 1834 /** send retry packet for doq connection. */ 1835 static void 1836 doq_send_retry(struct comm_point* c, struct doq_pkt_addr* paddr, 1837 struct ngtcp2_pkt_hd* hd) 1838 { 1839 char host[256], port[32]; 1840 struct ngtcp2_cid scid; 1841 uint8_t token[NGTCP2_CRYPTO_MAX_RETRY_TOKENLEN]; 1842 ngtcp2_ssize tokenlen, ret; 1843 1844 if(!doq_print_addr_port(&paddr->addr, paddr->addrlen, host, 1845 sizeof(host), port, sizeof(port))) { 1846 log_err("doq_send_retry failed"); 1847 return; 1848 } 1849 verbose(VERB_ALGO, "doq: sending retry packet to %s %s", host, port); 1850 1851 /* the server chosen source connection ID */ 1852 scid.datalen = c->doq_socket->sv_scidlen; 1853 doq_cid_randfill(&scid, scid.datalen, c->doq_socket->rnd); 1854 1855 tokenlen = ngtcp2_crypto_generate_retry_token(token, 1856 c->doq_socket->static_secret, c->doq_socket->static_secret_len, 1857 hd->version, (void*)&paddr->addr, paddr->addrlen, &scid, 1858 &hd->dcid, doq_get_timestamp_nanosec()); 1859 if(tokenlen < 0) { 1860 log_err("ngtcp2_crypto_generate_retry_token failed: %s", 1861 ngtcp2_strerror(tokenlen)); 1862 return; 1863 } 1864 1865 sldns_buffer_clear(c->doq_socket->pkt_buf); 1866 ret = ngtcp2_crypto_write_retry(sldns_buffer_begin(c->doq_socket->pkt_buf), 1867 sldns_buffer_capacity(c->doq_socket->pkt_buf), hd->version, 1868 &hd->scid, &scid, &hd->dcid, token, tokenlen); 1869 if(ret < 0) { 1870 log_err("ngtcp2_crypto_write_retry failed: %s", 1871 ngtcp2_strerror(ret)); 1872 return; 1873 } 1874 sldns_buffer_set_position(c->doq_socket->pkt_buf, ret); 1875 sldns_buffer_flip(c->doq_socket->pkt_buf); 1876 doq_send_pkt(c, paddr, 0); 1877 } 1878 1879 /** doq send stateless connection close */ 1880 static void 1881 doq_send_stateless_connection_close(struct comm_point* c, 1882 struct doq_pkt_addr* paddr, struct ngtcp2_pkt_hd* hd, 1883 uint64_t error_code) 1884 { 1885 ngtcp2_ssize ret; 1886 sldns_buffer_clear(c->doq_socket->pkt_buf); 1887 ret = ngtcp2_crypto_write_connection_close( 1888 sldns_buffer_begin(c->doq_socket->pkt_buf), 1889 sldns_buffer_capacity(c->doq_socket->pkt_buf), hd->version, &hd->scid, 1890 &hd->dcid, error_code, NULL, 0); 1891 if(ret < 0) { 1892 log_err("ngtcp2_crypto_write_connection_close failed: %s", 1893 ngtcp2_strerror(ret)); 1894 return; 1895 } 1896 sldns_buffer_set_position(c->doq_socket->pkt_buf, ret); 1897 sldns_buffer_flip(c->doq_socket->pkt_buf); 1898 doq_send_pkt(c, paddr, 0); 1899 } 1900 1901 /** doq verify retry token, false on failure */ 1902 static int 1903 doq_verify_retry_token(struct comm_point* c, struct doq_pkt_addr* paddr, 1904 struct ngtcp2_cid* ocid, struct ngtcp2_pkt_hd* hd) 1905 { 1906 char host[256], port[32]; 1907 if(!doq_print_addr_port(&paddr->addr, paddr->addrlen, host, 1908 sizeof(host), port, sizeof(port))) { 1909 log_err("doq_verify_retry_token failed"); 1910 return 0; 1911 } 1912 verbose(VERB_ALGO, "doq: verifying retry token from %s %s", host, 1913 port); 1914 if(ngtcp2_crypto_verify_retry_token(ocid, 1915 #ifdef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN 1916 hd->token, hd->tokenlen, 1917 #else 1918 hd->token.base, hd->token.len, 1919 #endif 1920 c->doq_socket->static_secret, 1921 c->doq_socket->static_secret_len, hd->version, 1922 (void*)&paddr->addr, paddr->addrlen, &hd->dcid, 1923 10*NGTCP2_SECONDS, doq_get_timestamp_nanosec()) != 0) { 1924 verbose(VERB_ALGO, "doq: could not verify retry token " 1925 "from %s %s", host, port); 1926 return 0; 1927 } 1928 verbose(VERB_ALGO, "doq: verified retry token from %s %s", host, port); 1929 return 1; 1930 } 1931 1932 /** doq verify token, false on failure */ 1933 static int 1934 doq_verify_token(struct comm_point* c, struct doq_pkt_addr* paddr, 1935 struct ngtcp2_pkt_hd* hd) 1936 { 1937 char host[256], port[32]; 1938 if(!doq_print_addr_port(&paddr->addr, paddr->addrlen, host, 1939 sizeof(host), port, sizeof(port))) { 1940 log_err("doq_verify_token failed"); 1941 return 0; 1942 } 1943 verbose(VERB_ALGO, "doq: verifying token from %s %s", host, port); 1944 if(ngtcp2_crypto_verify_regular_token( 1945 #ifdef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN 1946 hd->token, hd->tokenlen, 1947 #else 1948 hd->token.base, hd->token.len, 1949 #endif 1950 c->doq_socket->static_secret, c->doq_socket->static_secret_len, 1951 (void*)&paddr->addr, paddr->addrlen, 3600*NGTCP2_SECONDS, 1952 doq_get_timestamp_nanosec()) != 0) { 1953 verbose(VERB_ALGO, "doq: could not verify token from %s %s", 1954 host, port); 1955 return 0; 1956 } 1957 verbose(VERB_ALGO, "doq: verified token from %s %s", host, port); 1958 return 1; 1959 } 1960 1961 /** delete and remove from the lookup tree the doq_conn connection */ 1962 static void 1963 doq_delete_connection(struct comm_point* c, struct doq_conn* conn) 1964 { 1965 struct doq_conn copy; 1966 uint8_t cid[NGTCP2_MAX_CIDLEN]; 1967 rbnode_type* node; 1968 if(!conn) 1969 return; 1970 /* Copy the key and set it deleted. */ 1971 conn->is_deleted = 1; 1972 doq_conn_write_disable(conn); 1973 copy.key = conn->key; 1974 log_assert(conn->key.dcidlen <= NGTCP2_MAX_CIDLEN); 1975 memcpy(cid, conn->key.dcid, conn->key.dcidlen); 1976 copy.key.dcid = cid; 1977 copy.node.key = © 1978 lock_basic_unlock(&conn->lock); 1979 1980 /* Now get the table lock to delete it from the tree */ 1981 lock_rw_wrlock(&c->doq_socket->table->lock); 1982 node = rbtree_delete(c->doq_socket->table->conn_tree, copy.node.key); 1983 if(node) { 1984 conn = (struct doq_conn*)node->key; 1985 lock_basic_lock(&conn->lock); 1986 doq_conn_write_list_remove(c->doq_socket->table, conn); 1987 if(conn->timer.timer_in_list) { 1988 /* Remove timer from list first, because finding the 1989 * rbnode element of the setlist of same timeouts 1990 * needs tree lookup. Edit the tree structure after 1991 * that lookup. */ 1992 doq_timer_list_remove(c->doq_socket->table, 1993 &conn->timer); 1994 } 1995 if(conn->timer.timer_in_tree) 1996 doq_timer_tree_remove(c->doq_socket->table, 1997 &conn->timer); 1998 } 1999 lock_rw_unlock(&c->doq_socket->table->lock); 2000 if(node) { 2001 lock_basic_unlock(&conn->lock); 2002 doq_table_quic_size_subtract(c->doq_socket->table, 2003 sizeof(*conn)+conn->key.dcidlen); 2004 doq_conn_delete(conn, c->doq_socket->table); 2005 } 2006 } 2007 2008 /** create and setup a new doq connection, to a new destination, or with 2009 * a new dcid. It has a new set of streams. It is inserted in the lookup tree. 2010 * Returns NULL on failure. */ 2011 static struct doq_conn* 2012 doq_setup_new_conn(struct comm_point* c, struct doq_pkt_addr* paddr, 2013 struct ngtcp2_pkt_hd* hd, struct ngtcp2_cid* ocid) 2014 { 2015 struct doq_conn* conn; 2016 if(!doq_table_quic_size_available(c->doq_socket->table, 2017 c->doq_socket->cfg, sizeof(*conn)+hd->dcid.datalen 2018 + sizeof(struct doq_stream) 2019 + 100 /* estimated input query */ 2020 + 1200 /* estimated output query */)) { 2021 verbose(VERB_ALGO, "doq: no mem available for new connection"); 2022 doq_send_stateless_connection_close(c, paddr, hd, 2023 NGTCP2_CONNECTION_REFUSED); 2024 return NULL; 2025 } 2026 conn = doq_conn_create(c, paddr, hd->dcid.data, hd->dcid.datalen, 2027 hd->version); 2028 if(!conn) { 2029 log_err("doq: could not allocate doq_conn"); 2030 return NULL; 2031 } 2032 lock_rw_wrlock(&c->doq_socket->table->lock); 2033 lock_basic_lock(&conn->lock); 2034 if(!rbtree_insert(c->doq_socket->table->conn_tree, &conn->node)) { 2035 lock_rw_unlock(&c->doq_socket->table->lock); 2036 log_err("doq: duplicate connection"); 2037 /* conn has no entry in writelist, and no timer yet. */ 2038 lock_basic_unlock(&conn->lock); 2039 doq_conn_delete(conn, c->doq_socket->table); 2040 return NULL; 2041 } 2042 lock_rw_unlock(&c->doq_socket->table->lock); 2043 doq_table_quic_size_add(c->doq_socket->table, 2044 sizeof(*conn)+conn->key.dcidlen); 2045 verbose(VERB_ALGO, "doq: created new connection"); 2046 2047 /* the scid and dcid switch meaning from the accepted client 2048 * connection to the server connection. The 'source' and 'destination' 2049 * meaning is reversed. */ 2050 if(!doq_conn_setup(conn, hd->scid.data, hd->scid.datalen, 2051 (ocid?ocid->data:NULL), (ocid?ocid->datalen:0), 2052 #ifdef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN 2053 hd->token, hd->tokenlen 2054 #else 2055 hd->token.base, hd->token.len 2056 #endif 2057 )) { 2058 log_err("doq: could not set up connection"); 2059 doq_delete_connection(c, conn); 2060 return NULL; 2061 } 2062 return conn; 2063 } 2064 2065 /** perform doq address validation */ 2066 static int 2067 doq_address_validation(struct comm_point* c, struct doq_pkt_addr* paddr, 2068 struct ngtcp2_pkt_hd* hd, struct ngtcp2_cid* ocid, 2069 struct ngtcp2_cid** pocid) 2070 { 2071 #ifdef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN 2072 const uint8_t* token = hd->token; 2073 size_t tokenlen = hd->tokenlen; 2074 #else 2075 const uint8_t* token = hd->token.base; 2076 size_t tokenlen = hd->token.len; 2077 #endif 2078 verbose(VERB_ALGO, "doq stateless address validation"); 2079 2080 if(tokenlen == 0 || token == NULL) { 2081 doq_send_retry(c, paddr, hd); 2082 return 0; 2083 } 2084 if(token[0] != NGTCP2_CRYPTO_TOKEN_MAGIC_RETRY && 2085 hd->dcid.datalen < NGTCP2_MIN_INITIAL_DCIDLEN) { 2086 doq_send_stateless_connection_close(c, paddr, hd, 2087 NGTCP2_INVALID_TOKEN); 2088 return 0; 2089 } 2090 if(token[0] == NGTCP2_CRYPTO_TOKEN_MAGIC_RETRY) { 2091 if(!doq_verify_retry_token(c, paddr, ocid, hd)) { 2092 doq_send_stateless_connection_close(c, paddr, hd, 2093 NGTCP2_INVALID_TOKEN); 2094 return 0; 2095 } 2096 *pocid = ocid; 2097 } else if(token[0] == NGTCP2_CRYPTO_TOKEN_MAGIC_REGULAR) { 2098 if(!doq_verify_token(c, paddr, hd)) { 2099 doq_send_retry(c, paddr, hd); 2100 return 0; 2101 } 2102 #ifdef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN 2103 hd->token = NULL; 2104 hd->tokenlen = 0; 2105 #else 2106 hd->token.base = NULL; 2107 hd->token.len = 0; 2108 #endif 2109 } else { 2110 verbose(VERB_ALGO, "doq address validation: unrecognised " 2111 "token in hd.token.base with magic byte 0x%2.2x", 2112 (int)token[0]); 2113 if(c->doq_socket->validate_addr) { 2114 doq_send_retry(c, paddr, hd); 2115 return 0; 2116 } 2117 #ifdef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN 2118 hd->token = NULL; 2119 hd->tokenlen = 0; 2120 #else 2121 hd->token.base = NULL; 2122 hd->token.len = 0; 2123 #endif 2124 } 2125 return 1; 2126 } 2127 2128 /** the doq accept, returns false if no further processing of content */ 2129 static int 2130 doq_accept(struct comm_point* c, struct doq_pkt_addr* paddr, 2131 struct doq_conn** conn, struct ngtcp2_pkt_info* pi) 2132 { 2133 int rv; 2134 struct ngtcp2_pkt_hd hd; 2135 struct ngtcp2_cid ocid, *pocid=NULL; 2136 int err_retry; 2137 memset(&hd, 0, sizeof(hd)); 2138 rv = ngtcp2_accept(&hd, sldns_buffer_begin(c->doq_socket->pkt_buf), 2139 sldns_buffer_limit(c->doq_socket->pkt_buf)); 2140 if(rv != 0) { 2141 if(rv == NGTCP2_ERR_RETRY) { 2142 doq_send_retry(c, paddr, &hd); 2143 return 0; 2144 } 2145 log_err("doq: initial packet failed, ngtcp2_accept failed: %s", 2146 ngtcp2_strerror(rv)); 2147 return 0; 2148 } 2149 if(c->doq_socket->validate_addr || 2150 #ifdef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN 2151 hd.tokenlen 2152 #else 2153 hd.token.len 2154 #endif 2155 ) { 2156 if(!doq_address_validation(c, paddr, &hd, &ocid, &pocid)) 2157 return 0; 2158 } 2159 *conn = doq_setup_new_conn(c, paddr, &hd, pocid); 2160 if(!*conn) 2161 return 0; 2162 (*conn)->doq_socket = c->doq_socket; 2163 if(!doq_conn_recv(c, paddr, *conn, pi, &err_retry, NULL)) { 2164 if(err_retry) 2165 doq_send_retry(c, paddr, &hd); 2166 doq_delete_connection(c, *conn); 2167 *conn = NULL; 2168 return 0; 2169 } 2170 return 1; 2171 } 2172 2173 /** doq pickup a timer to wait for for the worker. If any timer exists. */ 2174 static void 2175 doq_pickup_timer(struct comm_point* c) 2176 { 2177 struct doq_timer* t; 2178 struct timeval tv; 2179 ngtcp2_tstamp ts = 0; 2180 int have_time = 0; 2181 memset(&tv, 0, sizeof(tv)); 2182 2183 lock_rw_wrlock(&c->doq_socket->table->lock); 2184 RBTREE_FOR(t, struct doq_timer*, c->doq_socket->table->timer_tree) { 2185 if(t->worker_doq_socket == NULL || 2186 t->worker_doq_socket == c->doq_socket) { 2187 /* pick up this element */ 2188 t->worker_doq_socket = c->doq_socket; 2189 memcpy(&tv, &t->time_real, sizeof(tv)); 2190 ts = t->time_mono; 2191 have_time = 1; 2192 break; 2193 } 2194 } 2195 lock_rw_unlock(&c->doq_socket->table->lock); 2196 c->doq_socket->marked_time = ts; 2197 if(have_time) { 2198 struct timeval rel; 2199 timeval_subtract(&rel, &tv, c->doq_socket->now_tv); 2200 comm_timer_set(c->doq_socket->timer, &rel); 2201 verbose(VERB_ALGO, "doq pickup timer at %d.%6.6d in %d.%6.6d", 2202 (int)tv.tv_sec, (int)tv.tv_usec, (int)rel.tv_sec, 2203 (int)rel.tv_usec); 2204 } else { 2205 if(comm_timer_is_set(c->doq_socket->timer)) 2206 comm_timer_disable(c->doq_socket->timer); 2207 verbose(VERB_ALGO, "doq timer disabled"); 2208 } 2209 } 2210 2211 /** doq done with connection, release locks and setup timer and write */ 2212 static void 2213 doq_done_setup_timer_and_write(struct comm_point* c, struct doq_conn* conn) 2214 { 2215 struct doq_conn copy; 2216 uint8_t cid[NGTCP2_MAX_CIDLEN]; 2217 rbnode_type* node; 2218 struct timeval new_tv; 2219 ngtcp2_tstamp new_ts; 2220 int write_change = 0, timer_change = 0; 2221 2222 /* No longer in callbacks, so the pointer to doq_socket is back 2223 * to NULL. */ 2224 conn->doq_socket = NULL; 2225 2226 if(doq_conn_check_timer(conn, &new_tv, &new_ts)) 2227 timer_change = 1; 2228 if( (conn->write_interest && !conn->on_write_list) || 2229 (!conn->write_interest && conn->on_write_list)) 2230 write_change = 1; 2231 2232 if(!timer_change && !write_change) { 2233 /* Nothing to do. */ 2234 lock_basic_unlock(&conn->lock); 2235 return; 2236 } 2237 2238 /* The table lock is needed to change the write list and timer tree. 2239 * So the connection lock is release and then the connection is 2240 * looked up again. */ 2241 copy.key = conn->key; 2242 log_assert(conn->key.dcidlen <= NGTCP2_MAX_CIDLEN); 2243 memcpy(cid, conn->key.dcid, conn->key.dcidlen); 2244 copy.key.dcid = cid; 2245 copy.node.key = © 2246 lock_basic_unlock(&conn->lock); 2247 2248 lock_rw_wrlock(&c->doq_socket->table->lock); 2249 node = rbtree_search(c->doq_socket->table->conn_tree, copy.node.key); 2250 if(!node) { 2251 lock_rw_unlock(&c->doq_socket->table->lock); 2252 /* Must have been deleted in the mean time. */ 2253 return; 2254 } 2255 conn = (struct doq_conn*)node->key; 2256 lock_basic_lock(&conn->lock); 2257 if(conn->is_deleted) { 2258 /* It is deleted now. */ 2259 lock_rw_unlock(&c->doq_socket->table->lock); 2260 lock_basic_unlock(&conn->lock); 2261 return; 2262 } 2263 2264 if(write_change) { 2265 /* Edit the write lists, we are holding the table.lock and can 2266 * edit the list first,last and also prev,next and on_list 2267 * elements in the doq_conn structures. */ 2268 doq_conn_set_write_list(c->doq_socket->table, conn); 2269 } 2270 if(timer_change) { 2271 doq_timer_set(c->doq_socket->table, &conn->timer, 2272 c->doq_socket, &new_tv, new_ts); 2273 } 2274 lock_rw_unlock(&c->doq_socket->table->lock); 2275 lock_basic_unlock(&conn->lock); 2276 } 2277 2278 /** doq done with connection callbacks, release locks and setup write */ 2279 static void 2280 doq_done_with_conn_cb(struct comm_point* c, struct doq_conn* conn) 2281 { 2282 struct doq_conn copy; 2283 uint8_t cid[NGTCP2_MAX_CIDLEN]; 2284 rbnode_type* node; 2285 2286 /* no longer in callbacks, so the pointer to doq_socket is back 2287 * to NULL. */ 2288 conn->doq_socket = NULL; 2289 2290 if( (conn->write_interest && conn->on_write_list) || 2291 (!conn->write_interest && !conn->on_write_list)) { 2292 /* The connection already has the required write list 2293 * status. */ 2294 lock_basic_unlock(&conn->lock); 2295 return; 2296 } 2297 2298 /* To edit the write list of connections we have to hold the table 2299 * lock, so we release the connection and then look it up again. */ 2300 copy.key = conn->key; 2301 log_assert(conn->key.dcidlen <= NGTCP2_MAX_CIDLEN); 2302 memcpy(cid, conn->key.dcid, conn->key.dcidlen); 2303 copy.key.dcid = cid; 2304 copy.node.key = © 2305 lock_basic_unlock(&conn->lock); 2306 2307 lock_rw_wrlock(&c->doq_socket->table->lock); 2308 node = rbtree_search(c->doq_socket->table->conn_tree, copy.node.key); 2309 if(!node) { 2310 lock_rw_unlock(&c->doq_socket->table->lock); 2311 /* must have been deleted in the mean time */ 2312 return; 2313 } 2314 conn = (struct doq_conn*)node->key; 2315 lock_basic_lock(&conn->lock); 2316 if(conn->is_deleted) { 2317 /* it is deleted now. */ 2318 lock_rw_unlock(&c->doq_socket->table->lock); 2319 lock_basic_unlock(&conn->lock); 2320 return; 2321 } 2322 2323 /* edit the write lists, we are holding the table.lock and can 2324 * edit the list first,last and also prev,next and on_list elements 2325 * in the doq_conn structures. */ 2326 doq_conn_set_write_list(c->doq_socket->table, conn); 2327 lock_rw_unlock(&c->doq_socket->table->lock); 2328 lock_basic_unlock(&conn->lock); 2329 } 2330 2331 /** doq count the length of the write list */ 2332 static size_t 2333 doq_write_list_length(struct comm_point* c) 2334 { 2335 size_t count = 0; 2336 struct doq_conn* conn; 2337 lock_rw_rdlock(&c->doq_socket->table->lock); 2338 conn = c->doq_socket->table->write_list_first; 2339 while(conn) { 2340 count++; 2341 conn = conn->write_next; 2342 } 2343 lock_rw_unlock(&c->doq_socket->table->lock); 2344 return count; 2345 } 2346 2347 /** doq pop the first element from the write list to have write events */ 2348 static struct doq_conn* 2349 doq_pop_write_conn(struct comm_point* c) 2350 { 2351 struct doq_conn* conn; 2352 lock_rw_wrlock(&c->doq_socket->table->lock); 2353 conn = doq_table_pop_first(c->doq_socket->table); 2354 while(conn && conn->is_deleted) { 2355 lock_basic_unlock(&conn->lock); 2356 conn = doq_table_pop_first(c->doq_socket->table); 2357 } 2358 lock_rw_unlock(&c->doq_socket->table->lock); 2359 if(conn) 2360 conn->doq_socket = c->doq_socket; 2361 return conn; 2362 } 2363 2364 /** doq the connection is done with write callbacks, release it. */ 2365 static void 2366 doq_done_with_write_cb(struct comm_point* c, struct doq_conn* conn, 2367 int delete_it) 2368 { 2369 if(delete_it) { 2370 doq_delete_connection(c, conn); 2371 return; 2372 } 2373 doq_done_setup_timer_and_write(c, conn); 2374 } 2375 2376 /** see if the doq socket wants to write packets */ 2377 static int 2378 doq_socket_want_write(struct comm_point* c) 2379 { 2380 int want_write = 0; 2381 if(c->doq_socket->have_blocked_pkt) 2382 return 1; 2383 lock_rw_rdlock(&c->doq_socket->table->lock); 2384 if(c->doq_socket->table->write_list_first) 2385 want_write = 1; 2386 lock_rw_unlock(&c->doq_socket->table->lock); 2387 return want_write; 2388 } 2389 2390 /** enable write event for the doq server socket fd */ 2391 static void 2392 doq_socket_write_enable(struct comm_point* c) 2393 { 2394 verbose(VERB_ALGO, "doq socket want write"); 2395 if(c->doq_socket->event_has_write) 2396 return; 2397 comm_point_listen_for_rw(c, 1, 1); 2398 c->doq_socket->event_has_write = 1; 2399 } 2400 2401 /** disable write event for the doq server socket fd */ 2402 static void 2403 doq_socket_write_disable(struct comm_point* c) 2404 { 2405 verbose(VERB_ALGO, "doq socket want no write"); 2406 if(!c->doq_socket->event_has_write) 2407 return; 2408 comm_point_listen_for_rw(c, 1, 0); 2409 c->doq_socket->event_has_write = 0; 2410 } 2411 2412 /** write blocked packet, if possible. returns false if failed, again. */ 2413 static int 2414 doq_write_blocked_pkt(struct comm_point* c) 2415 { 2416 struct doq_pkt_addr paddr; 2417 if(!c->doq_socket->have_blocked_pkt) 2418 return 1; 2419 c->doq_socket->have_blocked_pkt = 0; 2420 if(sldns_buffer_limit(c->doq_socket->blocked_pkt) > 2421 sldns_buffer_remaining(c->doq_socket->pkt_buf)) 2422 return 1; /* impossibly large, drop it. 2423 impossible since pkt_buf is same size as blocked_pkt buf. */ 2424 sldns_buffer_clear(c->doq_socket->pkt_buf); 2425 sldns_buffer_write(c->doq_socket->pkt_buf, 2426 sldns_buffer_begin(c->doq_socket->blocked_pkt), 2427 sldns_buffer_limit(c->doq_socket->blocked_pkt)); 2428 sldns_buffer_flip(c->doq_socket->pkt_buf); 2429 memcpy(&paddr, c->doq_socket->blocked_paddr, sizeof(paddr)); 2430 doq_send_pkt(c, &paddr, c->doq_socket->blocked_pkt_pi.ecn); 2431 if(c->doq_socket->have_blocked_pkt) 2432 return 0; 2433 return 1; 2434 } 2435 2436 /** doq find a timer that timed out and return the conn, locked. */ 2437 static struct doq_conn* 2438 doq_timer_timeout_conn(struct doq_server_socket* doq_socket) 2439 { 2440 struct doq_conn* conn = NULL; 2441 struct rbnode_type* node; 2442 lock_rw_wrlock(&doq_socket->table->lock); 2443 node = rbtree_first(doq_socket->table->timer_tree); 2444 if(node && node != RBTREE_NULL) { 2445 struct doq_timer* t = (struct doq_timer*)node; 2446 conn = t->conn; 2447 2448 /* If now < timer then no further timeouts in tree. */ 2449 if(timeval_smaller(doq_socket->now_tv, &t->time_real)) { 2450 lock_rw_unlock(&doq_socket->table->lock); 2451 return NULL; 2452 } 2453 2454 lock_basic_lock(&conn->lock); 2455 conn->doq_socket = doq_socket; 2456 2457 /* Now that the timer is fired, remove it. */ 2458 doq_timer_unset(doq_socket->table, t); 2459 lock_rw_unlock(&doq_socket->table->lock); 2460 return conn; 2461 } 2462 lock_rw_unlock(&doq_socket->table->lock); 2463 return NULL; 2464 } 2465 2466 /** doq timer erase the marker that said which timer the worker uses. */ 2467 static void 2468 doq_timer_erase_marker(struct doq_server_socket* doq_socket) 2469 { 2470 struct doq_timer* t; 2471 lock_rw_wrlock(&doq_socket->table->lock); 2472 t = doq_timer_find_time(doq_socket->table, doq_socket->marked_time); 2473 if(t && t->worker_doq_socket == doq_socket) 2474 t->worker_doq_socket = NULL; 2475 lock_rw_unlock(&doq_socket->table->lock); 2476 doq_socket->marked_time = 0; 2477 } 2478 2479 void 2480 doq_timer_cb(void* arg) 2481 { 2482 struct doq_server_socket* doq_socket = (struct doq_server_socket*)arg; 2483 struct doq_conn* conn; 2484 verbose(VERB_ALGO, "doq timer callback"); 2485 2486 doq_timer_erase_marker(doq_socket); 2487 2488 while((conn = doq_timer_timeout_conn(doq_socket)) != NULL) { 2489 if(conn->is_deleted || 2490 #ifdef HAVE_NGTCP2_CONN_IN_CLOSING_PERIOD 2491 ngtcp2_conn_in_closing_period(conn->conn) || 2492 #else 2493 ngtcp2_conn_is_in_closing_period(conn->conn) || 2494 #endif 2495 #ifdef HAVE_NGTCP2_CONN_IN_DRAINING_PERIOD 2496 ngtcp2_conn_in_draining_period(conn->conn) 2497 #else 2498 ngtcp2_conn_is_in_draining_period(conn->conn) 2499 #endif 2500 ) { 2501 if(verbosity >= VERB_ALGO) { 2502 char remotestr[256]; 2503 addr_to_str((void*)&conn->key.paddr.addr, 2504 conn->key.paddr.addrlen, remotestr, 2505 sizeof(remotestr)); 2506 verbose(VERB_ALGO, "doq conn %s is deleted " 2507 "after timeout", remotestr); 2508 } 2509 doq_delete_connection(doq_socket->cp, conn); 2510 continue; 2511 } 2512 if(!doq_conn_handle_timeout(conn)) 2513 doq_delete_connection(doq_socket->cp, conn); 2514 else doq_done_setup_timer_and_write(doq_socket->cp, conn); 2515 } 2516 2517 if(doq_socket_want_write(doq_socket->cp)) 2518 doq_socket_write_enable(doq_socket->cp); 2519 else doq_socket_write_disable(doq_socket->cp); 2520 doq_pickup_timer(doq_socket->cp); 2521 } 2522 2523 void 2524 comm_point_doq_callback(int fd, short event, void* arg) 2525 { 2526 struct comm_point* c; 2527 struct doq_pkt_addr paddr; 2528 int i, pkt_continue, err_drop; 2529 struct doq_conn* conn; 2530 struct ngtcp2_pkt_info pi; 2531 size_t count, num_len; 2532 2533 c = (struct comm_point*)arg; 2534 log_assert(c->type == comm_doq); 2535 2536 log_assert(c && c->doq_socket->pkt_buf && c->fd == fd); 2537 ub_comm_base_now(c->ev->base); 2538 2539 /* see if there is a blocked packet, and send that if possible. 2540 * do not attempt to read yet, even if possible, that would just 2541 * push more answers in reply to those read packets onto the list 2542 * of written replies. First attempt to clear the write content out. 2543 * That keeps the memory usage from bloating up. */ 2544 if(c->doq_socket->have_blocked_pkt) { 2545 if(!doq_write_blocked_pkt(c)) { 2546 /* this write has also blocked, attempt to write 2547 * later. Make sure the event listens to write 2548 * events. */ 2549 if(!c->doq_socket->event_has_write) 2550 doq_socket_write_enable(c); 2551 doq_pickup_timer(c); 2552 return; 2553 } 2554 } 2555 2556 /* see if there is write interest */ 2557 count = 0; 2558 num_len = doq_write_list_length(c); 2559 while((conn = doq_pop_write_conn(c)) != NULL) { 2560 if(conn->is_deleted || 2561 #ifdef HAVE_NGTCP2_CONN_IN_CLOSING_PERIOD 2562 ngtcp2_conn_in_closing_period(conn->conn) || 2563 #else 2564 ngtcp2_conn_is_in_closing_period(conn->conn) || 2565 #endif 2566 #ifdef HAVE_NGTCP2_CONN_IN_DRAINING_PERIOD 2567 ngtcp2_conn_in_draining_period(conn->conn) 2568 #else 2569 ngtcp2_conn_is_in_draining_period(conn->conn) 2570 #endif 2571 ) { 2572 conn->doq_socket = NULL; 2573 lock_basic_unlock(&conn->lock); 2574 if(c->doq_socket->have_blocked_pkt) { 2575 if(!c->doq_socket->event_has_write) 2576 doq_socket_write_enable(c); 2577 doq_pickup_timer(c); 2578 return; 2579 } 2580 if(++count > num_len*2) 2581 break; 2582 continue; 2583 } 2584 if(verbosity >= VERB_ALGO) { 2585 char remotestr[256]; 2586 addr_to_str((void*)&conn->key.paddr.addr, 2587 conn->key.paddr.addrlen, remotestr, 2588 sizeof(remotestr)); 2589 verbose(VERB_ALGO, "doq write connection %s %d", 2590 remotestr, doq_sockaddr_get_port( 2591 &conn->key.paddr.addr)); 2592 } 2593 if(doq_conn_write_streams(c, conn, &err_drop)) 2594 err_drop = 0; 2595 doq_done_with_write_cb(c, conn, err_drop); 2596 if(c->doq_socket->have_blocked_pkt) { 2597 if(!c->doq_socket->event_has_write) 2598 doq_socket_write_enable(c); 2599 doq_pickup_timer(c); 2600 return; 2601 } 2602 /* Stop overly long write lists that are created 2603 * while we are processing. Do those next time there 2604 * is a write callback. Stops long loops, and keeps 2605 * fair for other events. */ 2606 if(++count > num_len*2) 2607 break; 2608 } 2609 2610 /* check for data to read */ 2611 if((event&UB_EV_READ)!=0) 2612 for(i=0; i<NUM_UDP_PER_SELECT; i++) { 2613 /* there may be a blocked write packet and if so, stop 2614 * reading because the reply cannot get written. The 2615 * blocked packet could be written during the conn_recv 2616 * handling of replies, or for a connection close. */ 2617 if(c->doq_socket->have_blocked_pkt) { 2618 if(!c->doq_socket->event_has_write) 2619 doq_socket_write_enable(c); 2620 doq_pickup_timer(c); 2621 return; 2622 } 2623 sldns_buffer_clear(c->doq_socket->pkt_buf); 2624 doq_pkt_addr_init(&paddr); 2625 log_assert(fd != -1); 2626 log_assert(sldns_buffer_remaining(c->doq_socket->pkt_buf) > 0); 2627 if(!doq_recv(c, &paddr, &pkt_continue, &pi)) { 2628 if(pkt_continue) 2629 continue; 2630 break; 2631 } 2632 2633 /* handle incoming packet from remote addr to localaddr */ 2634 if(verbosity >= VERB_ALGO) { 2635 char remotestr[256], localstr[256]; 2636 addr_to_str((void*)&paddr.addr, paddr.addrlen, 2637 remotestr, sizeof(remotestr)); 2638 addr_to_str((void*)&paddr.localaddr, 2639 paddr.localaddrlen, localstr, 2640 sizeof(localstr)); 2641 log_info("incoming doq packet from %s port %d on " 2642 "%s port %d ifindex %d", 2643 remotestr, doq_sockaddr_get_port(&paddr.addr), 2644 localstr, 2645 doq_sockaddr_get_port(&paddr.localaddr), 2646 paddr.ifindex); 2647 log_info("doq_recv length %d ecn 0x%x", 2648 (int)sldns_buffer_limit(c->doq_socket->pkt_buf), 2649 (int)pi.ecn); 2650 } 2651 2652 if(sldns_buffer_limit(c->doq_socket->pkt_buf) == 0) 2653 continue; 2654 2655 conn = NULL; 2656 if(!doq_decode_pkt_header_negotiate(c, &paddr, &conn)) 2657 continue; 2658 if(!conn) { 2659 if(!doq_accept(c, &paddr, &conn, &pi)) 2660 continue; 2661 if(!doq_conn_write_streams(c, conn, NULL)) { 2662 doq_delete_connection(c, conn); 2663 continue; 2664 } 2665 doq_done_setup_timer_and_write(c, conn); 2666 continue; 2667 } 2668 if( 2669 #ifdef HAVE_NGTCP2_CONN_IN_CLOSING_PERIOD 2670 ngtcp2_conn_in_closing_period(conn->conn) 2671 #else 2672 ngtcp2_conn_is_in_closing_period(conn->conn) 2673 #endif 2674 ) { 2675 if(!doq_conn_send_close(c, conn)) { 2676 doq_delete_connection(c, conn); 2677 } else { 2678 doq_done_setup_timer_and_write(c, conn); 2679 } 2680 continue; 2681 } 2682 if( 2683 #ifdef HAVE_NGTCP2_CONN_IN_DRAINING_PERIOD 2684 ngtcp2_conn_in_draining_period(conn->conn) 2685 #else 2686 ngtcp2_conn_is_in_draining_period(conn->conn) 2687 #endif 2688 ) { 2689 doq_done_setup_timer_and_write(c, conn); 2690 continue; 2691 } 2692 if(!doq_conn_recv(c, &paddr, conn, &pi, NULL, &err_drop)) { 2693 /* The receive failed, and if it also failed to send 2694 * a close, drop the connection. That means it is not 2695 * in the closing period. */ 2696 if(err_drop) { 2697 doq_delete_connection(c, conn); 2698 } else { 2699 doq_done_setup_timer_and_write(c, conn); 2700 } 2701 continue; 2702 } 2703 if(!doq_conn_write_streams(c, conn, &err_drop)) { 2704 if(err_drop) { 2705 doq_delete_connection(c, conn); 2706 } else { 2707 doq_done_setup_timer_and_write(c, conn); 2708 } 2709 continue; 2710 } 2711 doq_done_setup_timer_and_write(c, conn); 2712 } 2713 2714 /* see if we want to have more write events */ 2715 verbose(VERB_ALGO, "doq check write enable"); 2716 if(doq_socket_want_write(c)) 2717 doq_socket_write_enable(c); 2718 else doq_socket_write_disable(c); 2719 doq_pickup_timer(c); 2720 } 2721 2722 /** create new doq server socket structure */ 2723 static struct doq_server_socket* 2724 doq_server_socket_create(struct doq_table* table, struct ub_randstate* rnd, 2725 const void* quic_sslctx, struct comm_point* c, struct comm_base* base, 2726 struct config_file* cfg) 2727 { 2728 size_t doq_buffer_size = 4096; /* bytes buffer size, for one packet. */ 2729 struct doq_server_socket* doq_socket; 2730 log_assert(table != NULL); 2731 doq_socket = calloc(1, sizeof(*doq_socket)); 2732 if(!doq_socket) { 2733 return NULL; 2734 } 2735 doq_socket->table = table; 2736 doq_socket->rnd = rnd; 2737 doq_socket->validate_addr = 1; 2738 /* the doq_socket has its own copy of the static secret, as 2739 * well as other config values, so that they do not need table.lock */ 2740 doq_socket->static_secret_len = table->static_secret_len; 2741 doq_socket->static_secret = memdup(table->static_secret, 2742 table->static_secret_len); 2743 if(!doq_socket->static_secret) { 2744 free(doq_socket); 2745 return NULL; 2746 } 2747 doq_socket->ctx = (SSL_CTX*)quic_sslctx; 2748 doq_socket->idle_timeout = table->idle_timeout; 2749 doq_socket->sv_scidlen = table->sv_scidlen; 2750 doq_socket->cp = c; 2751 doq_socket->pkt_buf = sldns_buffer_new(doq_buffer_size); 2752 if(!doq_socket->pkt_buf) { 2753 free(doq_socket->static_secret); 2754 free(doq_socket); 2755 return NULL; 2756 } 2757 doq_socket->blocked_pkt = sldns_buffer_new( 2758 sldns_buffer_capacity(doq_socket->pkt_buf)); 2759 if(!doq_socket->pkt_buf) { 2760 free(doq_socket->static_secret); 2761 sldns_buffer_free(doq_socket->pkt_buf); 2762 free(doq_socket); 2763 return NULL; 2764 } 2765 doq_socket->blocked_paddr = calloc(1, 2766 sizeof(*doq_socket->blocked_paddr)); 2767 if(!doq_socket->blocked_paddr) { 2768 free(doq_socket->static_secret); 2769 sldns_buffer_free(doq_socket->pkt_buf); 2770 sldns_buffer_free(doq_socket->blocked_pkt); 2771 free(doq_socket); 2772 return NULL; 2773 } 2774 doq_socket->timer = comm_timer_create(base, doq_timer_cb, doq_socket); 2775 if(!doq_socket->timer) { 2776 free(doq_socket->static_secret); 2777 sldns_buffer_free(doq_socket->pkt_buf); 2778 sldns_buffer_free(doq_socket->blocked_pkt); 2779 free(doq_socket->blocked_paddr); 2780 free(doq_socket); 2781 return NULL; 2782 } 2783 doq_socket->marked_time = 0; 2784 comm_base_timept(base, &doq_socket->now_tt, &doq_socket->now_tv); 2785 doq_socket->cfg = cfg; 2786 return doq_socket; 2787 } 2788 2789 /** delete doq server socket structure */ 2790 static void 2791 doq_server_socket_delete(struct doq_server_socket* doq_socket) 2792 { 2793 if(!doq_socket) 2794 return; 2795 free(doq_socket->static_secret); 2796 #ifndef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_SERVER_CONTEXT 2797 free(doq_socket->quic_method); 2798 #endif 2799 sldns_buffer_free(doq_socket->pkt_buf); 2800 sldns_buffer_free(doq_socket->blocked_pkt); 2801 free(doq_socket->blocked_paddr); 2802 comm_timer_delete(doq_socket->timer); 2803 free(doq_socket); 2804 } 2805 2806 /** find repinfo in the doq table */ 2807 static struct doq_conn* 2808 doq_lookup_repinfo(struct doq_table* table, struct comm_reply* repinfo) 2809 { 2810 struct doq_conn* conn; 2811 struct doq_conn_key key; 2812 log_assert(table != NULL); 2813 doq_conn_key_from_repinfo(&key, repinfo); 2814 lock_rw_rdlock(&table->lock); 2815 conn = doq_conn_find(table, &key.paddr.addr, 2816 key.paddr.addrlen, &key.paddr.localaddr, 2817 key.paddr.localaddrlen, key.paddr.ifindex, key.dcid, 2818 key.dcidlen); 2819 if(conn) { 2820 lock_basic_lock(&conn->lock); 2821 lock_rw_unlock(&table->lock); 2822 return conn; 2823 } 2824 lock_rw_unlock(&table->lock); 2825 return NULL; 2826 } 2827 2828 /** doq find connection and stream. From inside callbacks from worker. */ 2829 static int 2830 doq_lookup_conn_stream(struct comm_reply* repinfo, struct comm_point* c, 2831 struct doq_conn** conn, struct doq_stream** stream, int checkclose) 2832 { 2833 log_assert(c->doq_socket); 2834 if(c->doq_socket->current_conn) { 2835 *conn = c->doq_socket->current_conn; 2836 } else { 2837 *conn = doq_lookup_repinfo(c->doq_socket->table, repinfo); 2838 if((*conn) && (*conn)->is_deleted) { 2839 lock_basic_unlock(&(*conn)->lock); 2840 *conn = NULL; 2841 } 2842 if(*conn) { 2843 (*conn)->doq_socket = c->doq_socket; 2844 } 2845 } 2846 if(!*conn) { 2847 *stream = NULL; 2848 return 0; 2849 } 2850 *stream = doq_stream_find(*conn, repinfo->doq_streamid); 2851 if(!*stream) { 2852 if(!c->doq_socket->current_conn) { 2853 /* Not inside callbacks, we have our own lock on conn. 2854 * Release it. */ 2855 lock_basic_unlock(&(*conn)->lock); 2856 } 2857 return 0; 2858 } 2859 if(checkclose && (*stream)->is_closed) { 2860 /* stream is closed, ignore reply or drop */ 2861 if(!c->doq_socket->current_conn) { 2862 /* Not inside callbacks, we have our own lock on conn. 2863 * Release it. */ 2864 lock_basic_unlock(&(*conn)->lock); 2865 } 2866 return 0; 2867 } 2868 return 1; 2869 } 2870 2871 /** doq remove mesh state from stream */ 2872 void doq_find_stream_remove_mesh_state(struct comm_reply* repinfo) 2873 { 2874 struct doq_conn* conn; 2875 struct doq_stream* stream; 2876 log_assert(repinfo->c->type == comm_doq); 2877 if(!doq_lookup_conn_stream(repinfo, repinfo->c, &conn, &stream, 0)) { 2878 /* No stream, it may have been removed. */ 2879 return; 2880 } 2881 doq_stream_remove_mesh_state(stream); 2882 if(!repinfo->c->doq_socket->current_conn) { 2883 /* Not inside callbacks, we have our own lock on conn. 2884 * Release it. */ 2885 lock_basic_unlock(&conn->lock); 2886 } 2887 } 2888 2889 /** doq send a reply from a comm reply */ 2890 static void 2891 doq_socket_send_reply(struct comm_reply* repinfo) 2892 { 2893 struct doq_conn* conn; 2894 struct doq_stream* stream; 2895 log_assert(repinfo->c->type == comm_doq); 2896 if(!doq_lookup_conn_stream(repinfo, repinfo->c, &conn, &stream, 1)) { 2897 verbose(VERB_ALGO, "doq: send_reply but %s is gone", 2898 (conn?"stream":"connection")); 2899 /* No stream, it may have been closed. */ 2900 /* Drop the reply, it cannot be sent. */ 2901 return; 2902 } 2903 if(!doq_stream_send_reply(conn, stream, repinfo->c->buffer)) 2904 doq_stream_close(conn, stream, 1); 2905 if(!repinfo->c->doq_socket->current_conn) { 2906 /* Not inside callbacks, we have our own lock on conn. 2907 * Release it. */ 2908 doq_done_with_conn_cb(repinfo->c, conn); 2909 /* since we sent a reply, or closed it, the assumption is 2910 * that there is something to write, so enable write event. 2911 * It waits until the write event happens to write the 2912 * streams with answers, this allows some answers to be 2913 * answered before the event loop reaches the doq fd, in 2914 * repinfo->c->fd, and that collates answers. That would 2915 * not happen if we write doq packets right now. */ 2916 doq_socket_write_enable(repinfo->c); 2917 } 2918 } 2919 2920 /** doq drop a reply from a comm reply */ 2921 static void 2922 doq_socket_drop_reply(struct comm_reply* repinfo) 2923 { 2924 struct doq_conn* conn; 2925 struct doq_stream* stream; 2926 log_assert(repinfo->c->type == comm_doq); 2927 if(!doq_lookup_conn_stream(repinfo, repinfo->c, &conn, &stream, 1)) { 2928 verbose(VERB_ALGO, "doq: drop_reply but %s is gone", 2929 (conn?"stream":"connection")); 2930 /* The connection or stream is already gone. */ 2931 return; 2932 } 2933 doq_stream_close(conn, stream, 1); 2934 if(!repinfo->c->doq_socket->current_conn) { 2935 /* Not inside callbacks, we have our own lock on conn. 2936 * Release it. */ 2937 doq_done_with_conn_cb(repinfo->c, conn); 2938 doq_socket_write_enable(repinfo->c); 2939 } 2940 } 2941 #endif /* HAVE_NGTCP2 */ 2942 2943 int adjusted_tcp_timeout(struct comm_point* c) 2944 { 2945 if(c->tcp_timeout_msec < TCP_QUERY_TIMEOUT_MINIMUM) 2946 return TCP_QUERY_TIMEOUT_MINIMUM; 2947 return c->tcp_timeout_msec; 2948 } 2949 2950 /** Use a new tcp handler for new query fd, set to read query */ 2951 static void 2952 setup_tcp_handler(struct comm_point* c, int fd, int cur, int max) 2953 { 2954 int handler_usage; 2955 log_assert(c->type == comm_tcp || c->type == comm_http); 2956 log_assert(c->fd == -1); 2957 sldns_buffer_clear(c->buffer); 2958 #ifdef USE_DNSCRYPT 2959 if (c->dnscrypt) 2960 sldns_buffer_clear(c->dnscrypt_buffer); 2961 #endif 2962 c->tcp_is_reading = 1; 2963 c->tcp_byte_count = 0; 2964 c->tcp_keepalive = 0; 2965 /* reset to configured value before applying load-based reduction */ 2966 c->tcp_timeout_msec = c->tcp_parent->tcp_timeout_msec; 2967 /* if more than half the tcp handlers are in use, use a shorter 2968 * timeout for this TCP connection, we need to make space for 2969 * other connections to be able to get attention */ 2970 /* If > 50% TCP handler structures in use, set timeout to 1/100th 2971 * configured value. 2972 * If > 65%TCP handler structures in use, set to 1/500th configured 2973 * value. 2974 * If > 80% TCP handler structures in use, set to 0. 2975 * 2976 * If the timeout to use falls below 200 milliseconds, an actual 2977 * timeout of 200ms is used. 2978 */ 2979 handler_usage = (cur * 100) / max; 2980 if(handler_usage > 50 && handler_usage <= 65) 2981 c->tcp_timeout_msec /= 100; 2982 else if (handler_usage > 65 && handler_usage <= 80) 2983 c->tcp_timeout_msec /= 500; 2984 else if (handler_usage > 80) 2985 c->tcp_timeout_msec = 0; 2986 comm_point_start_listening(c, fd, adjusted_tcp_timeout(c)); 2987 } 2988 2989 void comm_base_handle_slow_accept(int ATTR_UNUSED(fd), 2990 short ATTR_UNUSED(event), void* arg) 2991 { 2992 struct comm_base* b = (struct comm_base*)arg; 2993 /* timeout for the slow accept, re-enable accepts again */ 2994 if(b->start_accept) { 2995 verbose(VERB_ALGO, "wait is over, slow accept disabled"); 2996 fptr_ok(fptr_whitelist_start_accept(b->start_accept)); 2997 (*b->start_accept)(b->cb_arg); 2998 b->eb->slow_accept_enabled = 0; 2999 } 3000 } 3001 3002 /** out of resources in the accept path: pause all listening for 3003 * NETEVENT_SLOW_ACCEPT_TIME and re-arm via comm_base_handle_slow_accept. 3004 * 3005 * If the routine fails, the socket is accepted and then closed, draining it 3006 * from the waiting list of connections to be accepted. 3007 * @param c: the comm point that is a listening socket. 3008 * @param msec: if 0: uses the slow accept time. Otherwise, sets the time 3009 * to wait. 3010 */ 3011 static void 3012 comm_point_slow_accept(struct comm_point* c, int msec) 3013 { 3014 struct comm_base* b = c->ev->base; 3015 struct timeval tv; 3016 struct ub_event* slowev; 3017 if(!b->stop_accept) 3018 return; 3019 if(b->eb->slow_accept_enabled) 3020 return; 3021 /* Allocate the event */ 3022 slowev = ub_event_new(b->eb->base, -1, UB_EV_TIMEOUT, 3023 comm_base_handle_slow_accept, b); 3024 if(!slowev) { 3025 /* The slow accept was not enabled yet, to handle 3026 * the allocation failure, instead drain the incoming 3027 * connection. */ 3028 int new_fd = accept(c->fd, NULL, NULL); 3029 if(new_fd != -1) { 3030 verbose(VERB_ALGO, "slow accept: event_new failed, " 3031 "drop connection"); 3032 sock_close(new_fd); 3033 } 3034 return; 3035 } 3036 ub_comm_base_now(b); 3037 if(b->eb->last_slow_log+SLOW_LOG_TIME <= b->eb->secs) { 3038 b->eb->last_slow_log = b->eb->secs; 3039 verbose(VERB_OPS, "out of resources on accept, " 3040 "slow down accept for %d msec", 3041 NETEVENT_SLOW_ACCEPT_TIME); 3042 } 3043 b->eb->slow_accept_enabled = 1; 3044 fptr_ok(fptr_whitelist_stop_accept(b->stop_accept)); 3045 (*b->stop_accept)(b->cb_arg); 3046 /* set timeout, no mallocs */ 3047 if(msec == 0) 3048 msec = NETEVENT_SLOW_ACCEPT_TIME; 3049 tv.tv_sec = msec/1000; 3050 tv.tv_usec = (msec%1000)*1000; 3051 b->eb->slow_accept = slowev; 3052 if(ub_event_add(b->eb->slow_accept, &tv) != 0) { 3053 /* we do not want to log here, 3054 * error: "event_add failed." */ 3055 } 3056 } 3057 3058 int comm_point_perform_accept(struct comm_point* c, 3059 struct sockaddr_storage* addr, socklen_t* addrlen) 3060 { 3061 int new_fd; 3062 *addrlen = (socklen_t)sizeof(*addr); 3063 #ifndef HAVE_ACCEPT4 3064 new_fd = accept(c->fd, (struct sockaddr*)addr, addrlen); 3065 #else 3066 /* SOCK_NONBLOCK saves extra calls to fcntl for the same result */ 3067 new_fd = accept4(c->fd, (struct sockaddr*)addr, addrlen, SOCK_NONBLOCK); 3068 #endif 3069 if(new_fd == -1) { 3070 #ifndef USE_WINSOCK 3071 /* EINTR is signal interrupt. others are closed connection. */ 3072 if( errno == EINTR || errno == EAGAIN 3073 #ifdef EWOULDBLOCK 3074 || errno == EWOULDBLOCK 3075 #endif 3076 #ifdef ECONNABORTED 3077 || errno == ECONNABORTED 3078 #endif 3079 #ifdef EPROTO 3080 || errno == EPROTO 3081 #endif /* EPROTO */ 3082 ) 3083 return -1; 3084 #if defined(ENFILE) && defined(EMFILE) 3085 if(errno == ENFILE || errno == EMFILE) { 3086 /* out of file descriptors, likely outside of our 3087 * control. stop accept() calls for some time */ 3088 if(c->ev->base->stop_accept) { 3089 struct comm_base* b = c->ev->base; 3090 struct timeval tv; 3091 struct ub_event* slowev = ub_event_new( 3092 b->eb->base, -1, UB_EV_TIMEOUT, 3093 comm_base_handle_slow_accept, b); 3094 if(!slowev) { 3095 verbose(VERB_ALGO, "slow accept: " 3096 "event_new failed"); 3097 return -1; 3098 } 3099 verbose(VERB_ALGO, "out of file descriptors: " 3100 "slow accept"); 3101 ub_comm_base_now(b); 3102 if(b->eb->last_slow_log+SLOW_LOG_TIME <= 3103 b->eb->secs) { 3104 b->eb->last_slow_log = b->eb->secs; 3105 verbose(VERB_OPS, "accept failed, " 3106 "slow down accept for %d " 3107 "msec: %s", 3108 NETEVENT_SLOW_ACCEPT_TIME, 3109 sock_strerror(errno)); 3110 } 3111 b->eb->slow_accept_enabled = 1; 3112 fptr_ok(fptr_whitelist_stop_accept( 3113 b->stop_accept)); 3114 (*b->stop_accept)(b->cb_arg); 3115 /* set timeout, no mallocs */ 3116 tv.tv_sec = NETEVENT_SLOW_ACCEPT_TIME/1000; 3117 tv.tv_usec = (NETEVENT_SLOW_ACCEPT_TIME%1000)*1000; 3118 b->eb->slow_accept = slowev; 3119 if(ub_event_add(b->eb->slow_accept, &tv) 3120 != 0) { 3121 /* we do not want to log here, 3122 * error: "event_add failed." */ 3123 } 3124 } else { 3125 log_err("accept, with no slow down, " 3126 "failed: %s", sock_strerror(errno)); 3127 } 3128 return -1; 3129 } 3130 #endif 3131 #else /* USE_WINSOCK */ 3132 if(WSAGetLastError() == WSAEINPROGRESS || 3133 WSAGetLastError() == WSAECONNRESET) 3134 return -1; 3135 if(WSAGetLastError() == WSAEWOULDBLOCK) { 3136 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ); 3137 return -1; 3138 } 3139 #endif 3140 log_err_addr("accept failed", sock_strerror(errno), addr, 3141 *addrlen); 3142 return -1; 3143 } 3144 if(c->tcp_conn_limit && c->type == comm_tcp_accept) { 3145 c->tcl_addr = tcl_addr_lookup(c->tcp_conn_limit, addr, *addrlen); 3146 if(!tcl_new_connection(c->tcl_addr)) { 3147 if(verbosity >= 3) 3148 log_err_addr("accept rejected", 3149 "connection limit exceeded", addr, *addrlen); 3150 sock_close(new_fd); 3151 return -1; 3152 } 3153 } 3154 #ifndef HAVE_ACCEPT4 3155 fd_set_nonblock(new_fd); 3156 #endif 3157 return new_fd; 3158 } 3159 3160 #ifdef USE_WINSOCK 3161 static long win_bio_cb(BIO *b, int oper, const char* ATTR_UNUSED(argp), 3162 #ifdef HAVE_BIO_SET_CALLBACK_EX 3163 size_t ATTR_UNUSED(len), 3164 #endif 3165 int ATTR_UNUSED(argi), long argl, 3166 #ifndef HAVE_BIO_SET_CALLBACK_EX 3167 long retvalue 3168 #else 3169 int retvalue, size_t* ATTR_UNUSED(processed) 3170 #endif 3171 ) 3172 { 3173 int wsa_err = WSAGetLastError(); /* store errcode before it is gone */ 3174 verbose(VERB_ALGO, "bio_cb %d, %s %s %s", oper, 3175 (oper&BIO_CB_RETURN)?"return":"before", 3176 (oper&BIO_CB_READ)?"read":((oper&BIO_CB_WRITE)?"write":"other"), 3177 wsa_err==WSAEWOULDBLOCK?"wsawb":""); 3178 /* on windows, check if previous operation caused EWOULDBLOCK */ 3179 if( (oper == (BIO_CB_READ|BIO_CB_RETURN) && argl == 0) || 3180 (oper == (BIO_CB_GETS|BIO_CB_RETURN) && argl == 0)) { 3181 if(wsa_err == WSAEWOULDBLOCK) 3182 ub_winsock_tcp_wouldblock((struct ub_event*) 3183 BIO_get_callback_arg(b), UB_EV_READ); 3184 } 3185 if( (oper == (BIO_CB_WRITE|BIO_CB_RETURN) && argl == 0) || 3186 (oper == (BIO_CB_PUTS|BIO_CB_RETURN) && argl == 0)) { 3187 if(wsa_err == WSAEWOULDBLOCK) 3188 ub_winsock_tcp_wouldblock((struct ub_event*) 3189 BIO_get_callback_arg(b), UB_EV_WRITE); 3190 } 3191 /* return original return value */ 3192 return retvalue; 3193 } 3194 3195 /** set win bio callbacks for nonblocking operations */ 3196 void 3197 comm_point_tcp_win_bio_cb(struct comm_point* c, void* thessl) 3198 { 3199 SSL* ssl = (SSL*)thessl; 3200 /* set them both just in case, but usually they are the same BIO */ 3201 #ifdef HAVE_BIO_SET_CALLBACK_EX 3202 BIO_set_callback_ex(SSL_get_rbio(ssl), &win_bio_cb); 3203 #else 3204 BIO_set_callback(SSL_get_rbio(ssl), &win_bio_cb); 3205 #endif 3206 BIO_set_callback_arg(SSL_get_rbio(ssl), (char*)c->ev->ev); 3207 #ifdef HAVE_BIO_SET_CALLBACK_EX 3208 BIO_set_callback_ex(SSL_get_wbio(ssl), &win_bio_cb); 3209 #else 3210 BIO_set_callback(SSL_get_wbio(ssl), &win_bio_cb); 3211 #endif 3212 BIO_set_callback_arg(SSL_get_wbio(ssl), (char*)c->ev->ev); 3213 } 3214 #endif 3215 3216 #ifdef HAVE_NGHTTP2 3217 /** Create http2 session server. Per connection, after TCP accepted.*/ 3218 static int http2_session_server_create(struct http2_session* h2_session) 3219 { 3220 log_assert(h2_session->callbacks); 3221 h2_session->is_drop = 0; 3222 if(nghttp2_session_server_new(&h2_session->session, 3223 h2_session->callbacks, 3224 h2_session) == NGHTTP2_ERR_NOMEM) { 3225 log_err("failed to create nghttp2 session server"); 3226 return 0; 3227 } 3228 3229 return 1; 3230 } 3231 3232 /** Submit http2 setting to session. Once per session. */ 3233 static int http2_submit_settings(struct http2_session* h2_session) 3234 { 3235 int ret; 3236 nghttp2_settings_entry settings[1] = { 3237 {NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS, 3238 h2_session->c->http2_max_streams}}; 3239 3240 ret = nghttp2_submit_settings(h2_session->session, NGHTTP2_FLAG_NONE, 3241 settings, 1); 3242 if(ret) { 3243 verbose(VERB_QUERY, "http2: submit_settings failed, " 3244 "error: %s", nghttp2_strerror(ret)); 3245 return 0; 3246 } 3247 return 1; 3248 } 3249 #endif /* HAVE_NGHTTP2 */ 3250 3251 /** Clear http2 stream mesh states */ 3252 static void http2_session_clear_meshstate(struct http2_session* h2_session) 3253 { 3254 #ifdef HAVE_NGHTTP2 3255 /* Since the session gets closed, remove the mesh state references. */ 3256 struct http2_stream* h2_stream; 3257 for(h2_stream = h2_session->first_stream; h2_stream; 3258 h2_stream = h2_stream->next) { 3259 if(h2_stream->mesh_state) { 3260 mesh_state_remove_reply(h2_stream->mesh, 3261 h2_stream->mesh_state, h2_session->c, 3262 h2_stream, NULL); 3263 h2_stream->mesh_state = NULL; 3264 } 3265 } 3266 #else 3267 (void)h2_session; 3268 #endif /* HAVE_NGHTTP2 */ 3269 } 3270 3271 #ifdef HAVE_NGHTTP2 3272 /** Delete http2 stream. After session delete or stream close callback */ 3273 static void http2_stream_delete(struct http2_session* h2_session, 3274 struct http2_stream* h2_stream) 3275 { 3276 if(h2_stream->mesh_state) { 3277 mesh_state_remove_reply(h2_stream->mesh, h2_stream->mesh_state, 3278 h2_session->c, h2_stream, NULL); 3279 h2_stream->mesh_state = NULL; 3280 } 3281 http2_req_stream_clear(h2_stream); 3282 free(h2_stream); 3283 } 3284 #endif /* HAVE_NGHTTP2 */ 3285 3286 /** delete http2 session server. After closing connection. */ 3287 static void http2_session_server_delete(struct http2_session* h2_session) 3288 { 3289 #ifdef HAVE_NGHTTP2 3290 struct http2_stream* h2_stream, *next; 3291 nghttp2_session_del(h2_session->session); /* NULL input is fine */ 3292 h2_session->session = NULL; 3293 for(h2_stream = h2_session->first_stream; h2_stream;) { 3294 next = h2_stream->next; 3295 http2_stream_delete(h2_session, h2_stream); 3296 h2_stream = next; 3297 } 3298 h2_session->first_stream = NULL; 3299 h2_session->is_drop = 0; 3300 h2_session->postpone_drop = 0; 3301 h2_session->c->h2_stream = NULL; 3302 #endif 3303 (void)h2_session; 3304 } 3305 3306 void 3307 comm_point_tcp_accept_callback(int fd, short event, void* arg) 3308 { 3309 struct comm_point* c = (struct comm_point*)arg, *c_hdl; 3310 int new_fd; 3311 log_assert(c->type == comm_tcp_accept); 3312 if(!(event & UB_EV_READ)) { 3313 log_info("ignoring tcp accept event %d", (int)event); 3314 return; 3315 } 3316 ub_comm_base_now(c->ev->base); 3317 /* find free tcp handler. */ 3318 if(!c->tcp_free) { 3319 log_warn("accepted too many tcp, connections full"); 3320 /* Wait for a short moment (say 50msec) so that other 3321 * TCP connections can complete. Or timeout, at the busy 3322 * timeout of about 200msec. That stops this routine from 3323 * spinning endlessly, and gives time to complete the other 3324 * requests. But it is not as slow as the 2000msec wait 3325 * time for when the kernel is out of buffers. */ 3326 comm_point_slow_accept(c, NETEVENT_SLOW_ACCEPT_QUEUE_TIME); 3327 return; 3328 } 3329 /* accept incoming connection. */ 3330 c_hdl = c->tcp_free; 3331 /* Should not happen: inconsistent tcp_free state in 3332 * accept_callback. */ 3333 log_assert(c_hdl->is_in_tcp_free); 3334 /* clear leftover flags from previous use, and then set the 3335 * correct event base for the event structure for libevent */ 3336 ub_event_free(c_hdl->ev->ev); 3337 c_hdl->ev->ev = NULL; 3338 if((c_hdl->type == comm_tcp && c_hdl->tcp_req_info) || 3339 c_hdl->type == comm_local || c_hdl->type == comm_raw) 3340 c_hdl->tcp_do_toggle_rw = 0; 3341 else c_hdl->tcp_do_toggle_rw = 1; 3342 3343 if(c_hdl->type == comm_http) { 3344 #ifdef HAVE_NGHTTP2 3345 if(!c_hdl->h2_session || 3346 !http2_session_server_create(c_hdl->h2_session)) { 3347 log_warn("failed to create nghttp2"); 3348 comm_point_slow_accept(c, 0); 3349 return; 3350 } 3351 if(!c_hdl->h2_session || 3352 !http2_submit_settings(c_hdl->h2_session)) { 3353 log_warn("failed to submit http2 settings"); 3354 if(c_hdl->h2_session) 3355 http2_session_server_delete(c_hdl->h2_session); 3356 comm_point_slow_accept(c, 0); 3357 return; 3358 } 3359 if(!c->ssl) { 3360 c_hdl->tcp_do_toggle_rw = 0; 3361 c_hdl->use_h2 = 1; 3362 } 3363 #endif 3364 c_hdl->ev->ev = ub_event_new(c_hdl->ev->base->eb->base, -1, 3365 UB_EV_PERSIST | UB_EV_READ | UB_EV_TIMEOUT, 3366 comm_point_http_handle_callback, c_hdl); 3367 } else { 3368 c_hdl->ev->ev = ub_event_new(c_hdl->ev->base->eb->base, -1, 3369 UB_EV_PERSIST | UB_EV_READ | UB_EV_TIMEOUT, 3370 comm_point_tcp_handle_callback, c_hdl); 3371 } 3372 if(!c_hdl->ev->ev) { 3373 log_warn("could not ub_event_new, for new tcp"); 3374 #ifdef HAVE_NGHTTP2 3375 if(c_hdl->type == comm_http && c_hdl->h2_session) 3376 http2_session_server_delete(c_hdl->h2_session); 3377 #endif 3378 comm_point_slow_accept(c, 0); 3379 return; 3380 } 3381 log_assert(fd != -1); 3382 (void)fd; 3383 new_fd = comm_point_perform_accept(c, &c_hdl->repinfo.remote_addr, 3384 &c_hdl->repinfo.remote_addrlen); 3385 if(new_fd == -1) { 3386 #ifdef HAVE_NGHTTP2 3387 if(c_hdl->type == comm_http && c_hdl->h2_session) 3388 http2_session_server_delete(c_hdl->h2_session); 3389 #endif 3390 return; 3391 } 3392 /* move per-netblock TCP-connection-limit handle to the handler so that 3393 * comm_point_close() on the handler decrements the count on close */ 3394 c_hdl->tcl_addr = c->tcl_addr; 3395 c->tcl_addr = NULL; 3396 /* Copy remote_address to client_address. 3397 * Simplest way/time for streams to do that. */ 3398 c_hdl->repinfo.client_addrlen = c_hdl->repinfo.remote_addrlen; 3399 memmove(&c_hdl->repinfo.client_addr, 3400 &c_hdl->repinfo.remote_addr, 3401 c_hdl->repinfo.remote_addrlen); 3402 if(c->ssl) { 3403 c_hdl->ssl = incoming_ssl_fd(c->ssl, new_fd); 3404 if(!c_hdl->ssl) { 3405 c_hdl->fd = new_fd; 3406 comm_point_close(c_hdl); 3407 return; 3408 } 3409 c_hdl->ssl_shake_state = comm_ssl_shake_read; 3410 #ifdef USE_WINSOCK 3411 comm_point_tcp_win_bio_cb(c_hdl, c_hdl->ssl); 3412 #endif 3413 } 3414 3415 /* Paranoia: Check that the state has not changed from above: */ 3416 /* Should not happen: tcp_free state changed within accept_callback. */ 3417 log_assert(c_hdl == c->tcp_free); 3418 log_assert(c_hdl->is_in_tcp_free); 3419 /* grab the tcp handler buffers */ 3420 c->cur_tcp_count++; 3421 c->tcp_free = c_hdl->tcp_free; 3422 c_hdl->tcp_free = NULL; 3423 c_hdl->is_in_tcp_free = 0; 3424 if(!c->tcp_free) { 3425 /* stop accepting incoming queries for now. */ 3426 comm_point_stop_listening(c); 3427 } 3428 setup_tcp_handler(c_hdl, new_fd, c->cur_tcp_count, c->max_tcp_count); 3429 } 3430 3431 /** Make tcp handler free for next assignment */ 3432 static void 3433 reclaim_tcp_handler(struct comm_point* c) 3434 { 3435 log_assert(c->type == comm_tcp); 3436 if(c->ssl) { 3437 #ifdef HAVE_SSL 3438 SSL_shutdown(c->ssl); 3439 SSL_free(c->ssl); 3440 c->ssl = NULL; 3441 #endif 3442 } 3443 comm_point_close(c); 3444 if(c->tcp_parent && !c->is_in_tcp_free) { 3445 /* Should not happen: bad tcp_free state in reclaim_tcp. */ 3446 log_assert(c->tcp_free == NULL); 3447 log_assert(c->tcp_parent->cur_tcp_count > 0); 3448 c->tcp_parent->cur_tcp_count--; 3449 c->tcp_free = c->tcp_parent->tcp_free; 3450 c->tcp_parent->tcp_free = c; 3451 c->is_in_tcp_free = 1; 3452 if(!c->tcp_free) { 3453 /* re-enable listening on accept socket */ 3454 comm_point_start_listening(c->tcp_parent, -1, -1); 3455 } 3456 } 3457 c->tcp_more_read_again = NULL; 3458 c->tcp_more_write_again = NULL; 3459 c->tcp_byte_count = 0; 3460 c->pp2_header_state = pp2_header_none; 3461 sldns_buffer_clear(c->buffer); 3462 } 3463 3464 /** do the callback when writing is done */ 3465 static void 3466 tcp_callback_writer(struct comm_point* c) 3467 { 3468 log_assert(c->type == comm_tcp); 3469 if(!c->tcp_write_and_read) { 3470 sldns_buffer_clear(c->buffer); 3471 c->tcp_byte_count = 0; 3472 } 3473 if(c->tcp_do_toggle_rw) 3474 c->tcp_is_reading = 1; 3475 /* switch from listening(write) to listening(read) */ 3476 if(c->tcp_req_info) { 3477 tcp_req_info_handle_writedone(c->tcp_req_info); 3478 } else { 3479 comm_point_stop_listening(c); 3480 if(c->tcp_write_and_read) { 3481 fptr_ok(fptr_whitelist_comm_point(c->callback)); 3482 if( (*c->callback)(c, c->cb_arg, NETEVENT_PKT_WRITTEN, 3483 &c->repinfo) ) { 3484 comm_point_start_listening(c, -1, 3485 adjusted_tcp_timeout(c)); 3486 } 3487 } else { 3488 comm_point_start_listening(c, -1, 3489 adjusted_tcp_timeout(c)); 3490 } 3491 } 3492 } 3493 3494 /** do the callback when reading is done */ 3495 static void 3496 tcp_callback_reader(struct comm_point* c) 3497 { 3498 log_assert(c->type == comm_tcp || c->type == comm_local); 3499 sldns_buffer_flip(c->buffer); 3500 if(c->tcp_do_toggle_rw) 3501 c->tcp_is_reading = 0; 3502 c->tcp_byte_count = 0; 3503 if(c->tcp_req_info) { 3504 tcp_req_info_handle_readdone(c->tcp_req_info); 3505 } else { 3506 if(c->type == comm_tcp) 3507 comm_point_stop_listening(c); 3508 fptr_ok(fptr_whitelist_comm_point(c->callback)); 3509 if( (*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, &c->repinfo) ) { 3510 comm_point_start_listening(c, -1, 3511 adjusted_tcp_timeout(c)); 3512 } 3513 } 3514 } 3515 3516 #ifdef HAVE_SSL 3517 /** true if the ssl handshake error has to be squelched from the logs */ 3518 int 3519 squelch_err_ssl_handshake(unsigned long err) 3520 { 3521 if(verbosity >= VERB_QUERY) 3522 return 0; /* only squelch on low verbosity */ 3523 if(ERR_GET_LIB(err) == ERR_LIB_SSL && 3524 (ERR_GET_REASON(err) == SSL_R_HTTPS_PROXY_REQUEST || 3525 ERR_GET_REASON(err) == SSL_R_HTTP_REQUEST || 3526 ERR_GET_REASON(err) == SSL_R_WRONG_VERSION_NUMBER || 3527 ERR_GET_REASON(err) == SSL_R_SSLV3_ALERT_BAD_CERTIFICATE 3528 #ifdef SSL_F_TLS_POST_PROCESS_CLIENT_HELLO 3529 || ERR_GET_REASON(err) == SSL_R_NO_SHARED_CIPHER 3530 #endif 3531 #ifdef SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO 3532 || ERR_GET_REASON(err) == SSL_R_UNKNOWN_PROTOCOL 3533 || ERR_GET_REASON(err) == SSL_R_UNSUPPORTED_PROTOCOL 3534 # ifdef SSL_R_VERSION_TOO_LOW 3535 || ERR_GET_REASON(err) == SSL_R_VERSION_TOO_LOW 3536 # endif 3537 #endif 3538 )) 3539 return 1; 3540 return 0; 3541 } 3542 #endif /* HAVE_SSL */ 3543 3544 /** continue ssl handshake */ 3545 #ifdef HAVE_SSL 3546 static int 3547 ssl_handshake(struct comm_point* c) 3548 { 3549 int r; 3550 if(c->ssl_shake_state == comm_ssl_shake_hs_read) { 3551 /* read condition satisfied back to writing */ 3552 comm_point_listen_for_rw(c, 0, 1); 3553 c->ssl_shake_state = comm_ssl_shake_none; 3554 return 1; 3555 } 3556 if(c->ssl_shake_state == comm_ssl_shake_hs_write) { 3557 /* write condition satisfied, back to reading */ 3558 comm_point_listen_for_rw(c, 1, 0); 3559 c->ssl_shake_state = comm_ssl_shake_none; 3560 return 1; 3561 } 3562 3563 ERR_clear_error(); 3564 r = SSL_do_handshake(c->ssl); 3565 if(r != 1) { 3566 int want = SSL_get_error(c->ssl, r); 3567 if(want == SSL_ERROR_WANT_READ) { 3568 if(c->ssl_shake_state == comm_ssl_shake_read) 3569 return 1; 3570 c->ssl_shake_state = comm_ssl_shake_read; 3571 comm_point_listen_for_rw(c, 1, 0); 3572 return 1; 3573 } else if(want == SSL_ERROR_WANT_WRITE) { 3574 if(c->ssl_shake_state == comm_ssl_shake_write) 3575 return 1; 3576 c->ssl_shake_state = comm_ssl_shake_write; 3577 comm_point_listen_for_rw(c, 0, 1); 3578 return 1; 3579 } else if(r == 0) { 3580 return 0; /* closed */ 3581 } else if(want == SSL_ERROR_SYSCALL) { 3582 /* SYSCALL and errno==0 means closed uncleanly */ 3583 #ifdef EPIPE 3584 if(errno == EPIPE && verbosity < 2) 3585 return 0; /* silence 'broken pipe' */ 3586 #endif 3587 #ifdef ECONNRESET 3588 if(errno == ECONNRESET && verbosity < 2) 3589 return 0; /* silence reset by peer */ 3590 #endif 3591 if(!tcp_connect_errno_needs_log( 3592 (struct sockaddr*)&c->repinfo.remote_addr, 3593 c->repinfo.remote_addrlen)) 3594 return 0; /* silence connect failures that 3595 show up because after connect this is the 3596 first system call that accesses the socket */ 3597 if(errno != 0) 3598 log_err("SSL_handshake syscall: %s", 3599 strerror(errno)); 3600 return 0; 3601 } else { 3602 unsigned long err = ERR_get_error(); 3603 if(!squelch_err_ssl_handshake(err)) { 3604 long vr; 3605 log_crypto_err_io_code("ssl handshake failed", 3606 want, err); 3607 if((vr=SSL_get_verify_result(c->ssl)) != 0) 3608 log_err("ssl handshake cert error: %s", 3609 X509_verify_cert_error_string( 3610 vr)); 3611 log_addr(VERB_OPS, "ssl handshake failed", 3612 &c->repinfo.remote_addr, 3613 c->repinfo.remote_addrlen); 3614 } 3615 return 0; 3616 } 3617 } 3618 /* this is where peer verification could take place */ 3619 if((SSL_get_verify_mode(c->ssl)&SSL_VERIFY_PEER)) { 3620 /* verification */ 3621 if(SSL_get_verify_result(c->ssl) == X509_V_OK) { 3622 #ifdef HAVE_SSL_GET1_PEER_CERTIFICATE 3623 X509* x = SSL_get1_peer_certificate(c->ssl); 3624 #else 3625 X509* x = SSL_get_peer_certificate(c->ssl); 3626 #endif 3627 if(!x) { 3628 log_addr(VERB_ALGO, "SSL connection failed: " 3629 "no certificate", 3630 &c->repinfo.remote_addr, 3631 c->repinfo.remote_addrlen); 3632 return 0; 3633 } 3634 log_cert(VERB_ALGO, "peer certificate", x); 3635 #ifdef HAVE_SSL_GET0_PEERNAME 3636 if(SSL_get0_peername(c->ssl)) { 3637 char buf[255]; 3638 snprintf(buf, sizeof(buf), "SSL connection " 3639 "to %s authenticated", 3640 SSL_get0_peername(c->ssl)); 3641 log_addr(VERB_ALGO, buf, &c->repinfo.remote_addr, 3642 c->repinfo.remote_addrlen); 3643 } else { 3644 #endif 3645 log_addr(VERB_ALGO, "SSL connection " 3646 "authenticated", &c->repinfo.remote_addr, 3647 c->repinfo.remote_addrlen); 3648 #ifdef HAVE_SSL_GET0_PEERNAME 3649 } 3650 #endif 3651 X509_free(x); 3652 } else { 3653 #ifdef HAVE_SSL_GET1_PEER_CERTIFICATE 3654 X509* x = SSL_get1_peer_certificate(c->ssl); 3655 #else 3656 X509* x = SSL_get_peer_certificate(c->ssl); 3657 #endif 3658 if(x) { 3659 log_cert(VERB_ALGO, "peer certificate", x); 3660 X509_free(x); 3661 } 3662 log_addr(VERB_ALGO, "SSL connection failed: " 3663 "failed to authenticate", 3664 &c->repinfo.remote_addr, 3665 c->repinfo.remote_addrlen); 3666 return 0; 3667 } 3668 } else { 3669 /* unauthenticated, the verify peer flag was not set 3670 * in c->ssl when the ssl object was created from ssl_ctx */ 3671 log_addr(VERB_ALGO, "SSL connection", &c->repinfo.remote_addr, 3672 c->repinfo.remote_addrlen); 3673 } 3674 3675 #ifdef HAVE_SSL_GET0_ALPN_SELECTED 3676 /* check if http2 use is negotiated */ 3677 if(c->type == comm_http && c->h2_session) { 3678 const unsigned char *alpn; 3679 unsigned int alpnlen = 0; 3680 SSL_get0_alpn_selected(c->ssl, &alpn, &alpnlen); 3681 if(alpnlen == 2 && memcmp("h2", alpn, 2) == 0) { 3682 /* connection upgraded to HTTP2 */ 3683 c->tcp_do_toggle_rw = 0; 3684 c->use_h2 = 1; 3685 } else { 3686 verbose(VERB_ALGO, "client doesn't support HTTP/2"); 3687 return 0; 3688 } 3689 } 3690 #endif 3691 3692 /* setup listen rw correctly */ 3693 if(c->tcp_is_reading) { 3694 if(c->ssl_shake_state != comm_ssl_shake_read) 3695 comm_point_listen_for_rw(c, 1, 0); 3696 } else { 3697 comm_point_listen_for_rw(c, 0, 1); 3698 } 3699 c->ssl_shake_state = comm_ssl_shake_none; 3700 return 1; 3701 } 3702 #endif /* HAVE_SSL */ 3703 3704 /** ssl read callback on TCP */ 3705 static int 3706 ssl_handle_read(struct comm_point* c) 3707 { 3708 #ifdef HAVE_SSL 3709 int r; 3710 if(c->ssl_shake_state != comm_ssl_shake_none) { 3711 if(!ssl_handshake(c)) 3712 return 0; 3713 if(c->ssl_shake_state != comm_ssl_shake_none) 3714 return 1; 3715 } 3716 if(c->pp2_enabled && c->pp2_header_state != pp2_header_done) { 3717 struct pp2_header* header = NULL; 3718 size_t want_read_size = 0; 3719 size_t current_read_size = 0; 3720 if(c->pp2_header_state == pp2_header_none) { 3721 want_read_size = PP2_HEADER_SIZE; 3722 if(sldns_buffer_remaining(c->buffer)<want_read_size) { 3723 log_err_addr("proxy_protocol: not enough " 3724 "buffer size to read PROXYv2 header", "", 3725 &c->repinfo.remote_addr, 3726 c->repinfo.remote_addrlen); 3727 return 0; 3728 } 3729 verbose(VERB_ALGO, "proxy_protocol: reading fixed " 3730 "part of PROXYv2 header (len %lu)", 3731 (unsigned long)want_read_size); 3732 current_read_size = want_read_size; 3733 if(c->tcp_byte_count < current_read_size) { 3734 ERR_clear_error(); 3735 if((r=SSL_read(c->ssl, (void*)sldns_buffer_at( 3736 c->buffer, c->tcp_byte_count), 3737 current_read_size - 3738 c->tcp_byte_count)) <= 0) { 3739 int want = SSL_get_error(c->ssl, r); 3740 if(want == SSL_ERROR_ZERO_RETURN) { 3741 if(c->tcp_req_info) 3742 return tcp_req_info_handle_read_close(c->tcp_req_info); 3743 return 0; /* shutdown, closed */ 3744 } else if(want == SSL_ERROR_WANT_READ) { 3745 #ifdef USE_WINSOCK 3746 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ); 3747 #endif 3748 return 1; /* read more later */ 3749 } else if(want == SSL_ERROR_WANT_WRITE) { 3750 c->ssl_shake_state = comm_ssl_shake_hs_write; 3751 comm_point_listen_for_rw(c, 0, 1); 3752 return 1; 3753 } else if(want == SSL_ERROR_SYSCALL) { 3754 #ifdef ECONNRESET 3755 if(errno == ECONNRESET && verbosity < 2) 3756 return 0; /* silence reset by peer */ 3757 #endif 3758 if(errno != 0) 3759 log_err("SSL_read syscall: %s", 3760 strerror(errno)); 3761 return 0; 3762 } 3763 log_crypto_err_io("could not SSL_read", 3764 want); 3765 return 0; 3766 } 3767 c->tcp_byte_count += r; 3768 sldns_buffer_skip(c->buffer, r); 3769 if(c->tcp_byte_count != current_read_size) return 1; 3770 c->pp2_header_state = pp2_header_init; 3771 } 3772 } 3773 if(c->pp2_header_state == pp2_header_init) { 3774 int err; 3775 err = pp2_read_header( 3776 sldns_buffer_begin(c->buffer), 3777 sldns_buffer_limit(c->buffer)); 3778 if(err) { 3779 log_err("proxy_protocol: could not parse " 3780 "PROXYv2 header (%s)", 3781 pp_lookup_error(err)); 3782 return 0; 3783 } 3784 header = (struct pp2_header*)sldns_buffer_begin(c->buffer); 3785 want_read_size = ntohs(header->len); 3786 if(sldns_buffer_limit(c->buffer) < 3787 PP2_HEADER_SIZE + want_read_size) { 3788 log_err_addr("proxy_protocol: not enough " 3789 "buffer size to read PROXYv2 header", "", 3790 &c->repinfo.remote_addr, 3791 c->repinfo.remote_addrlen); 3792 return 0; 3793 } 3794 verbose(VERB_ALGO, "proxy_protocol: reading variable " 3795 "part of PROXYv2 header (len %lu)", 3796 (unsigned long)want_read_size); 3797 current_read_size = PP2_HEADER_SIZE + want_read_size; 3798 if(want_read_size == 0) { 3799 /* nothing more to read; header is complete */ 3800 c->pp2_header_state = pp2_header_done; 3801 } else if(c->tcp_byte_count < current_read_size) { 3802 ERR_clear_error(); 3803 if((r=SSL_read(c->ssl, (void*)sldns_buffer_at( 3804 c->buffer, c->tcp_byte_count), 3805 current_read_size - 3806 c->tcp_byte_count)) <= 0) { 3807 int want = SSL_get_error(c->ssl, r); 3808 if(want == SSL_ERROR_ZERO_RETURN) { 3809 if(c->tcp_req_info) 3810 return tcp_req_info_handle_read_close(c->tcp_req_info); 3811 return 0; /* shutdown, closed */ 3812 } else if(want == SSL_ERROR_WANT_READ) { 3813 #ifdef USE_WINSOCK 3814 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ); 3815 #endif 3816 return 1; /* read more later */ 3817 } else if(want == SSL_ERROR_WANT_WRITE) { 3818 c->ssl_shake_state = comm_ssl_shake_hs_write; 3819 comm_point_listen_for_rw(c, 0, 1); 3820 return 1; 3821 } else if(want == SSL_ERROR_SYSCALL) { 3822 #ifdef ECONNRESET 3823 if(errno == ECONNRESET && verbosity < 2) 3824 return 0; /* silence reset by peer */ 3825 #endif 3826 if(errno != 0) 3827 log_err("SSL_read syscall: %s", 3828 strerror(errno)); 3829 return 0; 3830 } 3831 log_crypto_err_io("could not SSL_read", 3832 want); 3833 return 0; 3834 } 3835 c->tcp_byte_count += r; 3836 sldns_buffer_skip(c->buffer, r); 3837 if(c->tcp_byte_count != current_read_size) return 1; 3838 c->pp2_header_state = pp2_header_done; 3839 } 3840 } 3841 if(c->pp2_header_state != pp2_header_done || !header) { 3842 log_err_addr("proxy_protocol: wrong state for the " 3843 "PROXYv2 header", "", &c->repinfo.remote_addr, 3844 c->repinfo.remote_addrlen); 3845 return 0; 3846 } 3847 sldns_buffer_flip(c->buffer); 3848 if(!consume_pp2_header(c->buffer, &c->repinfo, 1)) { 3849 log_err_addr("proxy_protocol: could not consume " 3850 "PROXYv2 header", "", &c->repinfo.remote_addr, 3851 c->repinfo.remote_addrlen); 3852 return 0; 3853 } 3854 verbose(VERB_ALGO, "proxy_protocol: successful read of " 3855 "PROXYv2 header"); 3856 /* Clear and reset the buffer to read the following 3857 * DNS packet(s). */ 3858 sldns_buffer_clear(c->buffer); 3859 c->tcp_byte_count = 0; 3860 return 1; 3861 } 3862 if(c->tcp_byte_count < sizeof(uint16_t)) { 3863 /* read length bytes */ 3864 ERR_clear_error(); 3865 if((r=SSL_read(c->ssl, (void*)sldns_buffer_at(c->buffer, 3866 c->tcp_byte_count), (int)(sizeof(uint16_t) - 3867 c->tcp_byte_count))) <= 0) { 3868 int want = SSL_get_error(c->ssl, r); 3869 if(want == SSL_ERROR_ZERO_RETURN) { 3870 if(c->tcp_req_info) 3871 return tcp_req_info_handle_read_close(c->tcp_req_info); 3872 return 0; /* shutdown, closed */ 3873 } else if(want == SSL_ERROR_WANT_READ) { 3874 #ifdef USE_WINSOCK 3875 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ); 3876 #endif 3877 return 1; /* read more later */ 3878 } else if(want == SSL_ERROR_WANT_WRITE) { 3879 c->ssl_shake_state = comm_ssl_shake_hs_write; 3880 comm_point_listen_for_rw(c, 0, 1); 3881 return 1; 3882 } else if(want == SSL_ERROR_SYSCALL) { 3883 #ifdef ECONNRESET 3884 if(errno == ECONNRESET && verbosity < 2) 3885 return 0; /* silence reset by peer */ 3886 #endif 3887 if(errno != 0) 3888 log_err("SSL_read syscall: %s", 3889 strerror(errno)); 3890 return 0; 3891 } 3892 log_crypto_err_io("could not SSL_read", want); 3893 return 0; 3894 } 3895 c->tcp_byte_count += r; 3896 if(c->tcp_byte_count < sizeof(uint16_t)) 3897 return 1; 3898 if(sldns_buffer_read_u16_at(c->buffer, 0) > 3899 sldns_buffer_capacity(c->buffer)) { 3900 verbose(VERB_QUERY, "ssl: dropped larger than buffer"); 3901 return 0; 3902 } 3903 sldns_buffer_set_limit(c->buffer, 3904 sldns_buffer_read_u16_at(c->buffer, 0)); 3905 if(sldns_buffer_limit(c->buffer) < LDNS_HEADER_SIZE) { 3906 verbose(VERB_QUERY, "ssl: dropped bogus too short."); 3907 return 0; 3908 } 3909 sldns_buffer_skip(c->buffer, (ssize_t)(c->tcp_byte_count-sizeof(uint16_t))); 3910 verbose(VERB_ALGO, "Reading ssl tcp query of length %d", 3911 (int)sldns_buffer_limit(c->buffer)); 3912 } 3913 if(sldns_buffer_remaining(c->buffer) > 0) { 3914 ERR_clear_error(); 3915 r = SSL_read(c->ssl, (void*)sldns_buffer_current(c->buffer), 3916 (int)sldns_buffer_remaining(c->buffer)); 3917 if(r <= 0) { 3918 int want = SSL_get_error(c->ssl, r); 3919 if(want == SSL_ERROR_ZERO_RETURN) { 3920 if(c->tcp_req_info) 3921 return tcp_req_info_handle_read_close(c->tcp_req_info); 3922 return 0; /* shutdown, closed */ 3923 } else if(want == SSL_ERROR_WANT_READ) { 3924 #ifdef USE_WINSOCK 3925 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ); 3926 #endif 3927 return 1; /* read more later */ 3928 } else if(want == SSL_ERROR_WANT_WRITE) { 3929 c->ssl_shake_state = comm_ssl_shake_hs_write; 3930 comm_point_listen_for_rw(c, 0, 1); 3931 return 1; 3932 } else if(want == SSL_ERROR_SYSCALL) { 3933 #ifdef ECONNRESET 3934 if(errno == ECONNRESET && verbosity < 2) 3935 return 0; /* silence reset by peer */ 3936 #endif 3937 if(errno != 0) 3938 log_err("SSL_read syscall: %s", 3939 strerror(errno)); 3940 return 0; 3941 } 3942 log_crypto_err_io("could not SSL_read", want); 3943 return 0; 3944 } 3945 sldns_buffer_skip(c->buffer, (ssize_t)r); 3946 } 3947 if(sldns_buffer_remaining(c->buffer) <= 0) { 3948 tcp_callback_reader(c); 3949 } 3950 return 1; 3951 #else 3952 (void)c; 3953 return 0; 3954 #endif /* HAVE_SSL */ 3955 } 3956 3957 /** ssl write callback on TCP */ 3958 static int 3959 ssl_handle_write(struct comm_point* c) 3960 { 3961 #ifdef HAVE_SSL 3962 int r; 3963 if(c->ssl_shake_state != comm_ssl_shake_none) { 3964 if(!ssl_handshake(c)) 3965 return 0; 3966 if(c->ssl_shake_state != comm_ssl_shake_none) 3967 return 1; 3968 } 3969 /* ignore return, if fails we may simply block */ 3970 (void)SSL_set_mode(c->ssl, (long)SSL_MODE_ENABLE_PARTIAL_WRITE); 3971 if((c->tcp_write_and_read?c->tcp_write_byte_count:c->tcp_byte_count) < sizeof(uint16_t)) { 3972 uint16_t len = htons(c->tcp_write_and_read?c->tcp_write_pkt_len:sldns_buffer_limit(c->buffer)); 3973 ERR_clear_error(); 3974 if(c->tcp_write_and_read) { 3975 if(c->tcp_write_pkt_len + 2 < LDNS_RR_BUF_SIZE) { 3976 /* combine the tcp length and the query for 3977 * write, this emulates writev */ 3978 uint8_t buf[LDNS_RR_BUF_SIZE]; 3979 memmove(buf, &len, sizeof(uint16_t)); 3980 memmove(buf+sizeof(uint16_t), 3981 c->tcp_write_pkt, 3982 c->tcp_write_pkt_len); 3983 r = SSL_write(c->ssl, 3984 (void*)(buf+c->tcp_write_byte_count), 3985 c->tcp_write_pkt_len + 2 - 3986 c->tcp_write_byte_count); 3987 } else { 3988 r = SSL_write(c->ssl, 3989 (void*)(((uint8_t*)&len)+c->tcp_write_byte_count), 3990 (int)(sizeof(uint16_t)-c->tcp_write_byte_count)); 3991 } 3992 } else if(sizeof(uint16_t)+sldns_buffer_remaining(c->buffer) < 3993 LDNS_RR_BUF_SIZE) { 3994 /* combine the tcp length and the query for write, 3995 * this emulates writev */ 3996 uint8_t buf[LDNS_RR_BUF_SIZE]; 3997 memmove(buf, &len, sizeof(uint16_t)); 3998 memmove(buf+sizeof(uint16_t), 3999 sldns_buffer_current(c->buffer), 4000 sldns_buffer_remaining(c->buffer)); 4001 r = SSL_write(c->ssl, (void*)(buf+c->tcp_byte_count), 4002 (int)(sizeof(uint16_t)+ 4003 sldns_buffer_remaining(c->buffer) 4004 - c->tcp_byte_count)); 4005 } else { 4006 r = SSL_write(c->ssl, 4007 (void*)(((uint8_t*)&len)+c->tcp_byte_count), 4008 (int)(sizeof(uint16_t)-c->tcp_byte_count)); 4009 } 4010 if(r <= 0) { 4011 int want = SSL_get_error(c->ssl, r); 4012 if(want == SSL_ERROR_ZERO_RETURN) { 4013 return 0; /* closed */ 4014 } else if(want == SSL_ERROR_WANT_READ) { 4015 c->ssl_shake_state = comm_ssl_shake_hs_read; 4016 comm_point_listen_for_rw(c, 1, 0); 4017 return 1; /* wait for read condition */ 4018 } else if(want == SSL_ERROR_WANT_WRITE) { 4019 #ifdef USE_WINSOCK 4020 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE); 4021 #endif 4022 return 1; /* write more later */ 4023 } else if(want == SSL_ERROR_SYSCALL) { 4024 #ifdef EPIPE 4025 if(errno == EPIPE && verbosity < 2) 4026 return 0; /* silence 'broken pipe' */ 4027 #endif 4028 if(errno != 0) 4029 log_err("SSL_write syscall: %s", 4030 strerror(errno)); 4031 return 0; 4032 } 4033 log_crypto_err_io("could not SSL_write", want); 4034 return 0; 4035 } 4036 if(c->tcp_write_and_read) { 4037 c->tcp_write_byte_count += r; 4038 if(c->tcp_write_byte_count < sizeof(uint16_t)) 4039 return 1; 4040 } else { 4041 c->tcp_byte_count += r; 4042 if(c->tcp_byte_count < sizeof(uint16_t)) 4043 return 1; 4044 sldns_buffer_set_position(c->buffer, c->tcp_byte_count - 4045 sizeof(uint16_t)); 4046 } 4047 if((!c->tcp_write_and_read && sldns_buffer_remaining(c->buffer) == 0) || (c->tcp_write_and_read && c->tcp_write_byte_count == c->tcp_write_pkt_len + 2)) { 4048 tcp_callback_writer(c); 4049 return 1; 4050 } 4051 } 4052 log_assert(c->tcp_write_and_read || sldns_buffer_remaining(c->buffer) > 0); 4053 log_assert(!c->tcp_write_and_read || c->tcp_write_byte_count < c->tcp_write_pkt_len + 2); 4054 ERR_clear_error(); 4055 if(c->tcp_write_and_read) { 4056 r = SSL_write(c->ssl, (void*)(c->tcp_write_pkt + c->tcp_write_byte_count - 2), 4057 (int)(c->tcp_write_pkt_len + 2 - c->tcp_write_byte_count)); 4058 } else { 4059 r = SSL_write(c->ssl, (void*)sldns_buffer_current(c->buffer), 4060 (int)sldns_buffer_remaining(c->buffer)); 4061 } 4062 if(r <= 0) { 4063 int want = SSL_get_error(c->ssl, r); 4064 if(want == SSL_ERROR_ZERO_RETURN) { 4065 return 0; /* closed */ 4066 } else if(want == SSL_ERROR_WANT_READ) { 4067 c->ssl_shake_state = comm_ssl_shake_hs_read; 4068 comm_point_listen_for_rw(c, 1, 0); 4069 return 1; /* wait for read condition */ 4070 } else if(want == SSL_ERROR_WANT_WRITE) { 4071 #ifdef USE_WINSOCK 4072 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE); 4073 #endif 4074 return 1; /* write more later */ 4075 } else if(want == SSL_ERROR_SYSCALL) { 4076 #ifdef EPIPE 4077 if(errno == EPIPE && verbosity < 2) 4078 return 0; /* silence 'broken pipe' */ 4079 #endif 4080 if(errno != 0) 4081 log_err("SSL_write syscall: %s", 4082 strerror(errno)); 4083 return 0; 4084 } 4085 log_crypto_err_io("could not SSL_write", want); 4086 return 0; 4087 } 4088 if(c->tcp_write_and_read) { 4089 c->tcp_write_byte_count += r; 4090 } else { 4091 sldns_buffer_skip(c->buffer, (ssize_t)r); 4092 } 4093 4094 if((!c->tcp_write_and_read && sldns_buffer_remaining(c->buffer) == 0) || (c->tcp_write_and_read && c->tcp_write_byte_count == c->tcp_write_pkt_len + 2)) { 4095 tcp_callback_writer(c); 4096 } 4097 return 1; 4098 #else 4099 (void)c; 4100 return 0; 4101 #endif /* HAVE_SSL */ 4102 } 4103 4104 /** handle ssl tcp connection with dns contents */ 4105 static int 4106 ssl_handle_it(struct comm_point* c, int is_write) 4107 { 4108 /* handle case where renegotiation wants read during write call 4109 * or write during read calls */ 4110 if(is_write && c->ssl_shake_state == comm_ssl_shake_hs_write) 4111 return ssl_handle_read(c); 4112 else if(!is_write && c->ssl_shake_state == comm_ssl_shake_hs_read) 4113 return ssl_handle_write(c); 4114 /* handle read events for read operation and write events for a 4115 * write operation */ 4116 else if(!is_write) 4117 return ssl_handle_read(c); 4118 return ssl_handle_write(c); 4119 } 4120 4121 /** 4122 * Handle tcp reading callback. 4123 * @param fd: file descriptor of socket. 4124 * @param c: comm point to read from into buffer. 4125 * @param short_ok: if true, very short packets are OK (for comm_local). 4126 * @return: 0 on error 4127 */ 4128 static int 4129 comm_point_tcp_handle_read(int fd, struct comm_point* c, int short_ok) 4130 { 4131 ssize_t r; 4132 int recv_initial = 0; 4133 log_assert(c->type == comm_tcp || c->type == comm_local); 4134 if(c->ssl) 4135 return ssl_handle_it(c, 0); 4136 if(!c->tcp_is_reading && !c->tcp_write_and_read) 4137 return 0; 4138 4139 log_assert(fd != -1); 4140 if(c->pp2_enabled && c->pp2_header_state != pp2_header_done) { 4141 struct pp2_header* header = NULL; 4142 size_t want_read_size = 0; 4143 size_t current_read_size = 0; 4144 if(c->pp2_header_state == pp2_header_none) { 4145 want_read_size = PP2_HEADER_SIZE; 4146 if(sldns_buffer_remaining(c->buffer)<want_read_size) { 4147 log_err_addr("proxy_protocol: not enough " 4148 "buffer size to read PROXYv2 header", "", 4149 &c->repinfo.remote_addr, 4150 c->repinfo.remote_addrlen); 4151 return 0; 4152 } 4153 verbose(VERB_ALGO, "proxy_protocol: reading fixed " 4154 "part of PROXYv2 header (len %lu)", 4155 (unsigned long)want_read_size); 4156 current_read_size = want_read_size; 4157 if(c->tcp_byte_count < current_read_size) { 4158 r = recv(fd, (void*)sldns_buffer_at(c->buffer, 4159 c->tcp_byte_count), 4160 current_read_size-c->tcp_byte_count, MSG_DONTWAIT); 4161 if(r == 0) { 4162 if(c->tcp_req_info) 4163 return tcp_req_info_handle_read_close(c->tcp_req_info); 4164 return 0; 4165 } else if(r == -1) { 4166 goto recv_error_initial; 4167 } 4168 c->tcp_byte_count += r; 4169 sldns_buffer_skip(c->buffer, r); 4170 if(c->tcp_byte_count != current_read_size) return 1; 4171 c->pp2_header_state = pp2_header_init; 4172 } 4173 } 4174 if(c->pp2_header_state == pp2_header_init) { 4175 int err; 4176 err = pp2_read_header( 4177 sldns_buffer_begin(c->buffer), 4178 sldns_buffer_limit(c->buffer)); 4179 if(err) { 4180 log_err("proxy_protocol: could not parse " 4181 "PROXYv2 header (%s)", 4182 pp_lookup_error(err)); 4183 return 0; 4184 } 4185 header = (struct pp2_header*)sldns_buffer_begin(c->buffer); 4186 want_read_size = ntohs(header->len); 4187 if(sldns_buffer_limit(c->buffer) < 4188 PP2_HEADER_SIZE + want_read_size) { 4189 log_err_addr("proxy_protocol: not enough " 4190 "buffer size to read PROXYv2 header", "", 4191 &c->repinfo.remote_addr, 4192 c->repinfo.remote_addrlen); 4193 return 0; 4194 } 4195 verbose(VERB_ALGO, "proxy_protocol: reading variable " 4196 "part of PROXYv2 header (len %lu)", 4197 (unsigned long)want_read_size); 4198 current_read_size = PP2_HEADER_SIZE + want_read_size; 4199 if(want_read_size == 0) { 4200 /* nothing more to read; header is complete */ 4201 c->pp2_header_state = pp2_header_done; 4202 } else if(c->tcp_byte_count < current_read_size) { 4203 r = recv(fd, (void*)sldns_buffer_at(c->buffer, 4204 c->tcp_byte_count), 4205 current_read_size-c->tcp_byte_count, MSG_DONTWAIT); 4206 if(r == 0) { 4207 if(c->tcp_req_info) 4208 return tcp_req_info_handle_read_close(c->tcp_req_info); 4209 return 0; 4210 } else if(r == -1) { 4211 goto recv_error; 4212 } 4213 c->tcp_byte_count += r; 4214 sldns_buffer_skip(c->buffer, r); 4215 if(c->tcp_byte_count != current_read_size) return 1; 4216 c->pp2_header_state = pp2_header_done; 4217 } 4218 } 4219 if(c->pp2_header_state != pp2_header_done || !header) { 4220 log_err_addr("proxy_protocol: wrong state for the " 4221 "PROXYv2 header", "", &c->repinfo.remote_addr, 4222 c->repinfo.remote_addrlen); 4223 return 0; 4224 } 4225 sldns_buffer_flip(c->buffer); 4226 if(!consume_pp2_header(c->buffer, &c->repinfo, 1)) { 4227 log_err_addr("proxy_protocol: could not consume " 4228 "PROXYv2 header", "", &c->repinfo.remote_addr, 4229 c->repinfo.remote_addrlen); 4230 return 0; 4231 } 4232 verbose(VERB_ALGO, "proxy_protocol: successful read of " 4233 "PROXYv2 header"); 4234 /* Clear and reset the buffer to read the following 4235 * DNS packet(s). */ 4236 sldns_buffer_clear(c->buffer); 4237 c->tcp_byte_count = 0; 4238 return 1; 4239 } 4240 4241 if(c->tcp_byte_count < sizeof(uint16_t)) { 4242 /* read length bytes */ 4243 r = recv(fd,(void*)sldns_buffer_at(c->buffer,c->tcp_byte_count), 4244 sizeof(uint16_t)-c->tcp_byte_count, MSG_DONTWAIT); 4245 if(r == 0) { 4246 if(c->tcp_req_info) 4247 return tcp_req_info_handle_read_close(c->tcp_req_info); 4248 return 0; 4249 } else if(r == -1) { 4250 if(c->pp2_enabled) goto recv_error; 4251 goto recv_error_initial; 4252 } 4253 c->tcp_byte_count += r; 4254 if(c->tcp_byte_count != sizeof(uint16_t)) 4255 return 1; 4256 if(sldns_buffer_read_u16_at(c->buffer, 0) > 4257 sldns_buffer_capacity(c->buffer)) { 4258 verbose(VERB_QUERY, "tcp: dropped larger than buffer"); 4259 return 0; 4260 } 4261 sldns_buffer_set_limit(c->buffer, 4262 sldns_buffer_read_u16_at(c->buffer, 0)); 4263 if(!short_ok && 4264 sldns_buffer_limit(c->buffer) < LDNS_HEADER_SIZE) { 4265 verbose(VERB_QUERY, "tcp: dropped bogus too short."); 4266 return 0; 4267 } 4268 verbose(VERB_ALGO, "Reading tcp query of length %d", 4269 (int)sldns_buffer_limit(c->buffer)); 4270 } 4271 4272 if(sldns_buffer_remaining(c->buffer) == 0) 4273 log_err("in comm_point_tcp_handle_read buffer_remaining is " 4274 "not > 0 as expected, continuing with (harmless) 0 " 4275 "length recv"); 4276 r = recv(fd, (void*)sldns_buffer_current(c->buffer), 4277 sldns_buffer_remaining(c->buffer), MSG_DONTWAIT); 4278 if(r == 0) { 4279 if(c->tcp_req_info) 4280 return tcp_req_info_handle_read_close(c->tcp_req_info); 4281 return 0; 4282 } else if(r == -1) { 4283 goto recv_error; 4284 } 4285 sldns_buffer_skip(c->buffer, r); 4286 if(sldns_buffer_remaining(c->buffer) <= 0) { 4287 tcp_callback_reader(c); 4288 } 4289 return 1; 4290 4291 recv_error_initial: 4292 recv_initial = 1; 4293 recv_error: 4294 #ifndef USE_WINSOCK 4295 if(errno == EINTR || errno == EAGAIN) 4296 return 1; 4297 #ifdef ECONNRESET 4298 if(errno == ECONNRESET && verbosity < 2) 4299 return 0; /* silence reset by peer */ 4300 #endif 4301 if(recv_initial) { 4302 #ifdef ECONNREFUSED 4303 if(errno == ECONNREFUSED && verbosity < 2) 4304 return 0; /* silence reset by peer */ 4305 #endif 4306 #ifdef ENETUNREACH 4307 if(errno == ENETUNREACH && verbosity < 2) 4308 return 0; /* silence it */ 4309 #endif 4310 #ifdef EHOSTDOWN 4311 if(errno == EHOSTDOWN && verbosity < 2) 4312 return 0; /* silence it */ 4313 #endif 4314 #ifdef EHOSTUNREACH 4315 if(errno == EHOSTUNREACH && verbosity < 2) 4316 return 0; /* silence it */ 4317 #endif 4318 #ifdef ENETDOWN 4319 if(errno == ENETDOWN && verbosity < 2) 4320 return 0; /* silence it */ 4321 #endif 4322 #ifdef EACCES 4323 if(errno == EACCES && verbosity < 2) 4324 return 0; /* silence it */ 4325 #endif 4326 #ifdef ENOTCONN 4327 if(errno == ENOTCONN) { 4328 log_err_addr("read (in tcp initial) failed and this " 4329 "could be because TCP Fast Open is " 4330 "enabled [--disable-tfo-client " 4331 "--disable-tfo-server] but does not " 4332 "work", sock_strerror(errno), 4333 &c->repinfo.remote_addr, 4334 c->repinfo.remote_addrlen); 4335 return 0; 4336 } 4337 #endif 4338 } 4339 #else /* USE_WINSOCK */ 4340 if(recv_initial) { 4341 if(WSAGetLastError() == WSAECONNREFUSED && verbosity < 2) 4342 return 0; 4343 if(WSAGetLastError() == WSAEHOSTDOWN && verbosity < 2) 4344 return 0; 4345 if(WSAGetLastError() == WSAEHOSTUNREACH && verbosity < 2) 4346 return 0; 4347 if(WSAGetLastError() == WSAENETDOWN && verbosity < 2) 4348 return 0; 4349 if(WSAGetLastError() == WSAENETUNREACH && verbosity < 2) 4350 return 0; 4351 } 4352 if(WSAGetLastError() == WSAECONNRESET) 4353 return 0; 4354 if(WSAGetLastError() == WSAEINPROGRESS) 4355 return 1; 4356 if(WSAGetLastError() == WSAEWOULDBLOCK) { 4357 ub_winsock_tcp_wouldblock(c->ev->ev, 4358 UB_EV_READ); 4359 return 1; 4360 } 4361 #endif 4362 log_err_addr((recv_initial?"read (in tcp initial)":"read (in tcp)"), 4363 sock_strerror(errno), &c->repinfo.remote_addr, 4364 c->repinfo.remote_addrlen); 4365 return 0; 4366 } 4367 4368 /** 4369 * Handle tcp writing callback. 4370 * @param fd: file descriptor of socket. 4371 * @param c: comm point to write buffer out of. 4372 * @return: 0 on error 4373 */ 4374 static int 4375 comm_point_tcp_handle_write(int fd, struct comm_point* c) 4376 { 4377 ssize_t r; 4378 struct sldns_buffer *buffer; 4379 log_assert(c->type == comm_tcp); 4380 #ifdef USE_DNSCRYPT 4381 buffer = c->dnscrypt_buffer; 4382 #else 4383 buffer = c->buffer; 4384 #endif 4385 if(c->tcp_is_reading && !c->ssl && !c->tcp_write_and_read) 4386 return 0; 4387 log_assert(fd != -1); 4388 if(((!c->tcp_write_and_read && c->tcp_byte_count == 0) || (c->tcp_write_and_read && c->tcp_write_byte_count == 0)) && c->tcp_check_nb_connect) { 4389 /* check for pending error from nonblocking connect */ 4390 /* from Stevens, unix network programming, vol1, 3rd ed, p450*/ 4391 int error = 0; 4392 socklen_t len = (socklen_t)sizeof(error); 4393 if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error, 4394 &len) < 0){ 4395 #ifndef USE_WINSOCK 4396 error = errno; /* on solaris errno is error */ 4397 #else /* USE_WINSOCK */ 4398 error = WSAGetLastError(); 4399 #endif 4400 } 4401 #ifndef USE_WINSOCK 4402 #if defined(EINPROGRESS) && defined(EWOULDBLOCK) 4403 if(error == EINPROGRESS || error == EWOULDBLOCK) 4404 return 1; /* try again later */ 4405 else 4406 #endif 4407 if(error != 0 && verbosity < 2) 4408 return 0; /* silence lots of chatter in the logs */ 4409 else if(error != 0) { 4410 log_err_addr("tcp connect", strerror(error), 4411 &c->repinfo.remote_addr, 4412 c->repinfo.remote_addrlen); 4413 #else /* USE_WINSOCK */ 4414 /* examine error */ 4415 if(error == WSAEINPROGRESS) 4416 return 1; 4417 else if(error == WSAEWOULDBLOCK) { 4418 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE); 4419 return 1; 4420 } else if(error != 0 && verbosity < 2) 4421 return 0; 4422 else if(error != 0) { 4423 log_err_addr("tcp connect", wsa_strerror(error), 4424 &c->repinfo.remote_addr, 4425 c->repinfo.remote_addrlen); 4426 #endif /* USE_WINSOCK */ 4427 return 0; 4428 } 4429 } 4430 if(c->ssl) 4431 return ssl_handle_it(c, 1); 4432 4433 #ifdef USE_MSG_FASTOPEN 4434 /* Only try this on first use of a connection that uses tfo, 4435 otherwise fall through to normal write */ 4436 /* Also, TFO support on WINDOWS not implemented at the moment */ 4437 if(c->tcp_do_fastopen == 1) { 4438 /* this form of sendmsg() does both a connect() and send() so need to 4439 look for various flavours of error*/ 4440 uint16_t len = htons(c->tcp_write_and_read?c->tcp_write_pkt_len:sldns_buffer_limit(buffer)); 4441 struct msghdr msg; 4442 struct iovec iov[2]; 4443 c->tcp_do_fastopen = 0; 4444 memset(&msg, 0, sizeof(msg)); 4445 if(c->tcp_write_and_read) { 4446 iov[0].iov_base = (uint8_t*)&len + c->tcp_write_byte_count; 4447 iov[0].iov_len = sizeof(uint16_t) - c->tcp_write_byte_count; 4448 iov[1].iov_base = c->tcp_write_pkt; 4449 iov[1].iov_len = c->tcp_write_pkt_len; 4450 } else { 4451 iov[0].iov_base = (uint8_t*)&len + c->tcp_byte_count; 4452 iov[0].iov_len = sizeof(uint16_t) - c->tcp_byte_count; 4453 iov[1].iov_base = sldns_buffer_begin(buffer); 4454 iov[1].iov_len = sldns_buffer_limit(buffer); 4455 } 4456 log_assert(iov[0].iov_len > 0); 4457 msg.msg_name = &c->repinfo.remote_addr; 4458 msg.msg_namelen = c->repinfo.remote_addrlen; 4459 msg.msg_iov = iov; 4460 msg.msg_iovlen = 2; 4461 r = sendmsg(fd, &msg, MSG_FASTOPEN); 4462 if (r == -1) { 4463 #if defined(EINPROGRESS) && defined(EWOULDBLOCK) 4464 /* Handshake is underway, maybe because no TFO cookie available. 4465 Come back to write the message*/ 4466 if(errno == EINPROGRESS || errno == EWOULDBLOCK) 4467 return 1; 4468 #endif 4469 if(errno == EINTR || errno == EAGAIN) 4470 return 1; 4471 /* Not handling EISCONN here as shouldn't ever hit that case.*/ 4472 if(errno != EPIPE 4473 #ifdef EOPNOTSUPP 4474 /* if /proc/sys/net/ipv4/tcp_fastopen is 4475 * disabled on Linux, sendmsg may return 4476 * 'Operation not supported', if so 4477 * fallthrough to ordinary connect. */ 4478 && errno != EOPNOTSUPP 4479 #endif 4480 && errno != 0) { 4481 if(verbosity < 2) 4482 return 0; /* silence lots of chatter in the logs */ 4483 log_err_addr("tcp sendmsg", strerror(errno), 4484 &c->repinfo.remote_addr, 4485 c->repinfo.remote_addrlen); 4486 return 0; 4487 } 4488 verbose(VERB_ALGO, "tcp sendmsg for fastopen failed (with %s), try normal connect", strerror(errno)); 4489 /* fallthrough to nonFASTOPEN 4490 * (MSG_FASTOPEN on Linux 3 produces EPIPE) 4491 * we need to perform connect() */ 4492 if(connect(fd, (struct sockaddr *)&c->repinfo.remote_addr, 4493 c->repinfo.remote_addrlen) == -1) { 4494 #ifdef EINPROGRESS 4495 if(errno == EINPROGRESS) 4496 return 1; /* wait until connect done*/ 4497 #endif 4498 #ifdef USE_WINSOCK 4499 if(WSAGetLastError() == WSAEINPROGRESS || 4500 WSAGetLastError() == WSAEWOULDBLOCK) 4501 return 1; /* wait until connect done*/ 4502 #endif 4503 if(tcp_connect_errno_needs_log( 4504 (struct sockaddr *)&c->repinfo.remote_addr, 4505 c->repinfo.remote_addrlen)) { 4506 log_err_addr("outgoing tcp: connect after EPIPE for fastopen", 4507 strerror(errno), 4508 &c->repinfo.remote_addr, 4509 c->repinfo.remote_addrlen); 4510 } 4511 return 0; 4512 } 4513 4514 } else { 4515 if(c->tcp_write_and_read) { 4516 c->tcp_write_byte_count += r; 4517 if(c->tcp_write_byte_count < sizeof(uint16_t)) 4518 return 1; 4519 } else { 4520 c->tcp_byte_count += r; 4521 if(c->tcp_byte_count < sizeof(uint16_t)) 4522 return 1; 4523 sldns_buffer_set_position(buffer, c->tcp_byte_count - 4524 sizeof(uint16_t)); 4525 } 4526 if((!c->tcp_write_and_read && sldns_buffer_remaining(buffer) == 0) || (c->tcp_write_and_read && c->tcp_write_byte_count == c->tcp_write_pkt_len + 2)) { 4527 tcp_callback_writer(c); 4528 return 1; 4529 } 4530 } 4531 } 4532 #endif /* USE_MSG_FASTOPEN */ 4533 4534 if((c->tcp_write_and_read?c->tcp_write_byte_count:c->tcp_byte_count) < sizeof(uint16_t)) { 4535 uint16_t len = htons(c->tcp_write_and_read?c->tcp_write_pkt_len:sldns_buffer_limit(buffer)); 4536 #ifdef HAVE_WRITEV 4537 struct iovec iov[2]; 4538 if(c->tcp_write_and_read) { 4539 iov[0].iov_base = (uint8_t*)&len + c->tcp_write_byte_count; 4540 iov[0].iov_len = sizeof(uint16_t) - c->tcp_write_byte_count; 4541 iov[1].iov_base = c->tcp_write_pkt; 4542 iov[1].iov_len = c->tcp_write_pkt_len; 4543 } else { 4544 iov[0].iov_base = (uint8_t*)&len + c->tcp_byte_count; 4545 iov[0].iov_len = sizeof(uint16_t) - c->tcp_byte_count; 4546 iov[1].iov_base = sldns_buffer_begin(buffer); 4547 iov[1].iov_len = sldns_buffer_limit(buffer); 4548 } 4549 log_assert(iov[0].iov_len > 0); 4550 r = writev(fd, iov, 2); 4551 #else /* HAVE_WRITEV */ 4552 if(c->tcp_write_and_read) { 4553 r = send(fd, (void*)(((uint8_t*)&len)+c->tcp_write_byte_count), 4554 sizeof(uint16_t)-c->tcp_write_byte_count, 0); 4555 } else { 4556 r = send(fd, (void*)(((uint8_t*)&len)+c->tcp_byte_count), 4557 sizeof(uint16_t)-c->tcp_byte_count, 0); 4558 } 4559 #endif /* HAVE_WRITEV */ 4560 if(r == -1) { 4561 #ifndef USE_WINSOCK 4562 # ifdef EPIPE 4563 if(errno == EPIPE && verbosity < 2) 4564 return 0; /* silence 'broken pipe' */ 4565 #endif 4566 if(errno == EINTR || errno == EAGAIN) 4567 return 1; 4568 #ifdef ECONNRESET 4569 if(errno == ECONNRESET && verbosity < 2) 4570 return 0; /* silence reset by peer */ 4571 #endif 4572 # ifdef HAVE_WRITEV 4573 log_err_addr("tcp writev", strerror(errno), 4574 &c->repinfo.remote_addr, 4575 c->repinfo.remote_addrlen); 4576 # else /* HAVE_WRITEV */ 4577 log_err_addr("tcp send s", strerror(errno), 4578 &c->repinfo.remote_addr, 4579 c->repinfo.remote_addrlen); 4580 # endif /* HAVE_WRITEV */ 4581 #else 4582 if(WSAGetLastError() == WSAENOTCONN) 4583 return 1; 4584 if(WSAGetLastError() == WSAEINPROGRESS) 4585 return 1; 4586 if(WSAGetLastError() == WSAEWOULDBLOCK) { 4587 ub_winsock_tcp_wouldblock(c->ev->ev, 4588 UB_EV_WRITE); 4589 return 1; 4590 } 4591 if(WSAGetLastError() == WSAECONNRESET && verbosity < 2) 4592 return 0; /* silence reset by peer */ 4593 log_err_addr("tcp send s", 4594 wsa_strerror(WSAGetLastError()), 4595 &c->repinfo.remote_addr, 4596 c->repinfo.remote_addrlen); 4597 #endif 4598 return 0; 4599 } 4600 if(c->tcp_write_and_read) { 4601 c->tcp_write_byte_count += r; 4602 if(c->tcp_write_byte_count < sizeof(uint16_t)) 4603 return 1; 4604 } else { 4605 c->tcp_byte_count += r; 4606 if(c->tcp_byte_count < sizeof(uint16_t)) 4607 return 1; 4608 sldns_buffer_set_position(buffer, c->tcp_byte_count - 4609 sizeof(uint16_t)); 4610 } 4611 if((!c->tcp_write_and_read && sldns_buffer_remaining(buffer) == 0) || (c->tcp_write_and_read && c->tcp_write_byte_count == c->tcp_write_pkt_len + 2)) { 4612 tcp_callback_writer(c); 4613 return 1; 4614 } 4615 } 4616 log_assert(c->tcp_write_and_read || sldns_buffer_remaining(buffer) > 0); 4617 log_assert(!c->tcp_write_and_read || c->tcp_write_byte_count < c->tcp_write_pkt_len + 2); 4618 if(c->tcp_write_and_read) { 4619 r = send(fd, (void*)(c->tcp_write_pkt + c->tcp_write_byte_count - 2), 4620 c->tcp_write_pkt_len + 2 - c->tcp_write_byte_count, 0); 4621 } else { 4622 r = send(fd, (void*)sldns_buffer_current(buffer), 4623 sldns_buffer_remaining(buffer), 0); 4624 } 4625 if(r == -1) { 4626 #ifndef USE_WINSOCK 4627 if(errno == EINTR || errno == EAGAIN) 4628 return 1; 4629 #ifdef ECONNRESET 4630 if(errno == ECONNRESET && verbosity < 2) 4631 return 0; /* silence reset by peer */ 4632 #endif 4633 #else 4634 if(WSAGetLastError() == WSAEINPROGRESS) 4635 return 1; 4636 if(WSAGetLastError() == WSAEWOULDBLOCK) { 4637 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE); 4638 return 1; 4639 } 4640 if(WSAGetLastError() == WSAECONNRESET && verbosity < 2) 4641 return 0; /* silence reset by peer */ 4642 #endif 4643 log_err_addr("tcp send r", sock_strerror(errno), 4644 &c->repinfo.remote_addr, 4645 c->repinfo.remote_addrlen); 4646 return 0; 4647 } 4648 if(c->tcp_write_and_read) { 4649 c->tcp_write_byte_count += r; 4650 } else { 4651 sldns_buffer_skip(buffer, r); 4652 } 4653 4654 if((!c->tcp_write_and_read && sldns_buffer_remaining(buffer) == 0) || (c->tcp_write_and_read && c->tcp_write_byte_count == c->tcp_write_pkt_len + 2)) { 4655 tcp_callback_writer(c); 4656 } 4657 4658 return 1; 4659 } 4660 4661 /** read again to drain buffers when there could be more to read, returns 0 4662 * on failure which means the comm point is closed. */ 4663 static int 4664 tcp_req_info_read_again(int fd, struct comm_point* c) 4665 { 4666 /* One event-loop visit drains at most this many pipelined queries; 4667 * the rest is re-queued, so that other file descriptors get 4668 * serviced in between. */ 4669 int budget = NUM_TCP_PER_SELECT; 4670 while(c->tcp_req_info->read_again) { 4671 int r; 4672 c->tcp_req_info->read_again = 0; 4673 if(c->tcp_is_reading) 4674 r = comm_point_tcp_handle_read(fd, c, 0); 4675 else r = comm_point_tcp_handle_write(fd, c); 4676 if(!r) { 4677 reclaim_tcp_handler(c); 4678 if(!c->tcp_do_close) { 4679 fptr_ok(fptr_whitelist_comm_point( 4680 c->callback)); 4681 (void)(*c->callback)(c, c->cb_arg, 4682 NETEVENT_CLOSED, NULL); 4683 } 4684 return 0; 4685 } 4686 if(--budget <= 0 && c->tcp_req_info->read_again) { 4687 /* Defer the rest of the drain to the next loop turn. 4688 * This uses a zero delay timer. For TLS the undrained 4689 * remainder sits in OpenSSL's user-space buffer. */ 4690 struct timeval tv; 4691 memset(&tv, 0, sizeof(tv)); 4692 verbose(VERB_ALGO, "Defer tcp_req_info read again"); 4693 comm_timer_set(c->tcp_req_info->read_again_timer, &tv); 4694 return 1; 4695 } 4696 } 4697 return 1; 4698 } 4699 4700 /** read again to drain buffers when there could be more to read */ 4701 static void 4702 tcp_more_read_again(int fd, struct comm_point* c) 4703 { 4704 /* if the packet is done, but another one could be waiting on 4705 * the connection, the callback signals this, and we try again */ 4706 /* this continues until the read routines get EAGAIN or so, 4707 * and thus does not call the callback, and the bool is 0 */ 4708 int* moreread = c->tcp_more_read_again; 4709 int budget = NUM_TCP_PER_SELECT; 4710 while(moreread && *moreread) { 4711 *moreread = 0; 4712 if(!comm_point_tcp_handle_read(fd, c, 0)) { 4713 reclaim_tcp_handler(c); 4714 if(!c->tcp_do_close) { 4715 fptr_ok(fptr_whitelist_comm_point( 4716 c->callback)); 4717 (void)(*c->callback)(c, c->cb_arg, 4718 NETEVENT_CLOSED, NULL); 4719 } 4720 return; 4721 } 4722 if(--budget <= 0 && *moreread) { 4723 /* Defer the rest of the drain to the next loop turn. 4724 * This uses a zero delay timer. For TLS the undrained 4725 * remainder sits in OpenSSL's user-space buffer. */ 4726 struct timeval tv; 4727 memset(&tv, 0, sizeof(tv)); 4728 if(!c->tcp_more_read_again_timer) { 4729 c->tcp_more_read_again_timer = comm_timer_create(c->ev->base, tcp_more_read_again_cb, c); 4730 if(!c->tcp_more_read_again_timer) { 4731 log_err("out of memory for tcp more read again timer"); 4732 reclaim_tcp_handler(c); 4733 if(!c->tcp_do_close) { 4734 fptr_ok(fptr_whitelist_comm_point( 4735 c->callback)); 4736 (void)(*c->callback)(c, c->cb_arg, 4737 NETEVENT_CLOSED, NULL); 4738 } 4739 return; 4740 } 4741 } 4742 verbose(VERB_ALGO, "Defer more read again"); 4743 comm_timer_set(c->tcp_more_read_again_timer, &tv); 4744 return; 4745 } 4746 } 4747 } 4748 4749 /** write again to fill up when there could be more to write */ 4750 static void 4751 tcp_more_write_again(int fd, struct comm_point* c) 4752 { 4753 /* if the packet is done, but another is waiting to be written, 4754 * the callback signals it and we try again. */ 4755 /* this continues until the write routines get EAGAIN or so, 4756 * and thus does not call the callback, and the bool is 0 */ 4757 int* morewrite = c->tcp_more_write_again; 4758 while(morewrite && *morewrite) { 4759 *morewrite = 0; 4760 if(!comm_point_tcp_handle_write(fd, c)) { 4761 reclaim_tcp_handler(c); 4762 if(!c->tcp_do_close) { 4763 fptr_ok(fptr_whitelist_comm_point( 4764 c->callback)); 4765 (void)(*c->callback)(c, c->cb_arg, 4766 NETEVENT_CLOSED, NULL); 4767 } 4768 return; 4769 } 4770 } 4771 } 4772 4773 void 4774 tcp_read_again_cb(void* arg) 4775 { 4776 struct tcp_req_info* req = (struct tcp_req_info*)arg; 4777 verbose(VERB_ALGO, "tcp_read_again_cb"); 4778 if(!tcp_req_info_read_again(req->cp->fd, req->cp)) 4779 return; 4780 } 4781 4782 void 4783 tcp_more_read_again_cb(void* arg) 4784 { 4785 struct comm_point* c = (struct comm_point*)arg; 4786 verbose(VERB_ALGO, "tcp_more_read_again_cb"); 4787 tcp_more_read_again(c->fd, c); 4788 } 4789 4790 void 4791 comm_point_tcp_handle_callback(int fd, short event, void* arg) 4792 { 4793 struct comm_point* c = (struct comm_point*)arg; 4794 log_assert(c->type == comm_tcp); 4795 ub_comm_base_now(c->ev->base); 4796 4797 if(c->fd == -1 || c->fd != fd) 4798 return; /* duplicate event, but commpoint closed. */ 4799 4800 #ifdef USE_DNSCRYPT 4801 /* Initialize if this is a dnscrypt socket */ 4802 if(c->tcp_parent) { 4803 c->dnscrypt = c->tcp_parent->dnscrypt; 4804 } 4805 if(c->dnscrypt && c->dnscrypt_buffer == c->buffer) { 4806 c->dnscrypt_buffer = sldns_buffer_new(sldns_buffer_capacity(c->buffer)); 4807 if(!c->dnscrypt_buffer) { 4808 log_err("Could not allocate dnscrypt buffer"); 4809 reclaim_tcp_handler(c); 4810 if(!c->tcp_do_close) { 4811 fptr_ok(fptr_whitelist_comm_point( 4812 c->callback)); 4813 (void)(*c->callback)(c, c->cb_arg, 4814 NETEVENT_CLOSED, NULL); 4815 } 4816 return; 4817 } 4818 } 4819 #endif 4820 4821 if((event&UB_EV_TIMEOUT)) { 4822 verbose(VERB_QUERY, "tcp took too long, dropped"); 4823 reclaim_tcp_handler(c); 4824 if(!c->tcp_do_close) { 4825 fptr_ok(fptr_whitelist_comm_point(c->callback)); 4826 (void)(*c->callback)(c, c->cb_arg, 4827 NETEVENT_TIMEOUT, NULL); 4828 } 4829 return; 4830 } 4831 if((event&UB_EV_READ) 4832 #ifdef USE_MSG_FASTOPEN 4833 && !(c->tcp_do_fastopen && (event&UB_EV_WRITE)) 4834 #endif 4835 ) { 4836 int has_tcpq = (c->tcp_req_info != NULL); 4837 int* moreread = c->tcp_more_read_again; 4838 if(!comm_point_tcp_handle_read(fd, c, 0)) { 4839 reclaim_tcp_handler(c); 4840 if(!c->tcp_do_close) { 4841 fptr_ok(fptr_whitelist_comm_point( 4842 c->callback)); 4843 (void)(*c->callback)(c, c->cb_arg, 4844 NETEVENT_CLOSED, NULL); 4845 } 4846 return; 4847 } 4848 if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again) { 4849 if(!tcp_req_info_read_again(fd, c)) 4850 return; 4851 } 4852 if(moreread && *moreread) 4853 tcp_more_read_again(fd, c); 4854 return; 4855 } 4856 if((event&UB_EV_WRITE)) { 4857 int has_tcpq = (c->tcp_req_info != NULL); 4858 int* morewrite = c->tcp_more_write_again; 4859 if(!comm_point_tcp_handle_write(fd, c)) { 4860 reclaim_tcp_handler(c); 4861 if(!c->tcp_do_close) { 4862 fptr_ok(fptr_whitelist_comm_point( 4863 c->callback)); 4864 (void)(*c->callback)(c, c->cb_arg, 4865 NETEVENT_CLOSED, NULL); 4866 } 4867 return; 4868 } 4869 if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again) { 4870 if(!tcp_req_info_read_again(fd, c)) 4871 return; 4872 } 4873 if(morewrite && *morewrite) 4874 tcp_more_write_again(fd, c); 4875 return; 4876 } 4877 log_err("Ignored event %d for tcphdl.", event); 4878 } 4879 4880 /** Make http handler free for next assignment */ 4881 static void 4882 reclaim_http_handler(struct comm_point* c) 4883 { 4884 log_assert(c->type == comm_http); 4885 if(c->ssl) { 4886 #ifdef HAVE_SSL 4887 SSL_shutdown(c->ssl); 4888 SSL_free(c->ssl); 4889 c->ssl = NULL; 4890 #endif 4891 } 4892 comm_point_close(c); 4893 if(c->tcp_parent && !c->is_in_tcp_free) { 4894 /* Should not happen: bad tcp_free state in reclaim_http. */ 4895 log_assert(c->tcp_free == NULL); 4896 log_assert(c->tcp_parent->cur_tcp_count > 0); 4897 c->tcp_parent->cur_tcp_count--; 4898 c->tcp_free = c->tcp_parent->tcp_free; 4899 c->tcp_parent->tcp_free = c; 4900 c->is_in_tcp_free = 1; 4901 if(!c->tcp_free) { 4902 /* re-enable listening on accept socket */ 4903 comm_point_start_listening(c->tcp_parent, -1, -1); 4904 } 4905 } 4906 } 4907 4908 /** read more data for http (with ssl) */ 4909 static int 4910 ssl_http_read_more(struct comm_point* c) 4911 { 4912 #ifdef HAVE_SSL 4913 int r; 4914 log_assert(sldns_buffer_remaining(c->buffer) > 0); 4915 ERR_clear_error(); 4916 r = SSL_read(c->ssl, (void*)sldns_buffer_current(c->buffer), 4917 (int)sldns_buffer_remaining(c->buffer)); 4918 if(r <= 0) { 4919 int want = SSL_get_error(c->ssl, r); 4920 if(want == SSL_ERROR_ZERO_RETURN) { 4921 return 0; /* shutdown, closed */ 4922 } else if(want == SSL_ERROR_WANT_READ) { 4923 return 1; /* read more later */ 4924 } else if(want == SSL_ERROR_WANT_WRITE) { 4925 c->ssl_shake_state = comm_ssl_shake_hs_write; 4926 comm_point_listen_for_rw(c, 0, 1); 4927 return 1; 4928 } else if(want == SSL_ERROR_SYSCALL) { 4929 #ifdef ECONNRESET 4930 if(errno == ECONNRESET && verbosity < 2) 4931 return 0; /* silence reset by peer */ 4932 #endif 4933 if(errno != 0) 4934 log_err("SSL_read syscall: %s", 4935 strerror(errno)); 4936 return 0; 4937 } 4938 log_crypto_err_io("could not SSL_read", want); 4939 return 0; 4940 } 4941 verbose(VERB_ALGO, "ssl http read more skip to %d + %d", 4942 (int)sldns_buffer_position(c->buffer), (int)r); 4943 sldns_buffer_skip(c->buffer, (ssize_t)r); 4944 return 1; 4945 #else 4946 (void)c; 4947 return 0; 4948 #endif /* HAVE_SSL */ 4949 } 4950 4951 /** read more data for http */ 4952 static int 4953 http_read_more(int fd, struct comm_point* c) 4954 { 4955 ssize_t r; 4956 log_assert(sldns_buffer_remaining(c->buffer) > 0); 4957 r = recv(fd, (void*)sldns_buffer_current(c->buffer), 4958 sldns_buffer_remaining(c->buffer), MSG_DONTWAIT); 4959 if(r == 0) { 4960 return 0; 4961 } else if(r == -1) { 4962 #ifndef USE_WINSOCK 4963 if(errno == EINTR || errno == EAGAIN) 4964 return 1; 4965 #else /* USE_WINSOCK */ 4966 if(WSAGetLastError() == WSAECONNRESET) 4967 return 0; 4968 if(WSAGetLastError() == WSAEINPROGRESS) 4969 return 1; 4970 if(WSAGetLastError() == WSAEWOULDBLOCK) { 4971 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ); 4972 return 1; 4973 } 4974 #endif 4975 log_err_addr("read (in http r)", sock_strerror(errno), 4976 &c->repinfo.remote_addr, c->repinfo.remote_addrlen); 4977 return 0; 4978 } 4979 verbose(VERB_ALGO, "http read more skip to %d + %d", 4980 (int)sldns_buffer_position(c->buffer), (int)r); 4981 sldns_buffer_skip(c->buffer, r); 4982 return 1; 4983 } 4984 4985 /** return true if http header has been read (one line complete) */ 4986 static int 4987 http_header_done(sldns_buffer* buf) 4988 { 4989 size_t i; 4990 for(i=sldns_buffer_position(buf); i<sldns_buffer_limit(buf); i++) { 4991 /* there was a \r before the \n, but we ignore that */ 4992 if((char)sldns_buffer_read_u8_at(buf, i) == '\n') 4993 return 1; 4994 } 4995 return 0; 4996 } 4997 4998 /** return character string into buffer for header line, moves buffer 4999 * past that line and puts zero terminator into linefeed-newline */ 5000 static char* 5001 http_header_line(sldns_buffer* buf) 5002 { 5003 char* result = (char*)sldns_buffer_current(buf); 5004 size_t i; 5005 for(i=sldns_buffer_position(buf); i<sldns_buffer_limit(buf); i++) { 5006 /* terminate the string on the \r */ 5007 if((char)sldns_buffer_read_u8_at(buf, i) == '\r') 5008 sldns_buffer_write_u8_at(buf, i, 0); 5009 /* terminate on the \n and skip past the it and done */ 5010 if((char)sldns_buffer_read_u8_at(buf, i) == '\n') { 5011 sldns_buffer_write_u8_at(buf, i, 0); 5012 sldns_buffer_set_position(buf, i+1); 5013 return result; 5014 } 5015 } 5016 return NULL; 5017 } 5018 5019 /** move unread buffer to start and clear rest for putting the rest into it */ 5020 static void 5021 http_moveover_buffer(sldns_buffer* buf) 5022 { 5023 size_t pos = sldns_buffer_position(buf); 5024 size_t len = sldns_buffer_remaining(buf); 5025 sldns_buffer_clear(buf); 5026 memmove(sldns_buffer_begin(buf), sldns_buffer_at(buf, pos), len); 5027 sldns_buffer_set_position(buf, len); 5028 } 5029 5030 /** a http header is complete, process it */ 5031 static int 5032 http_process_initial_header(struct comm_point* c) 5033 { 5034 char* line = http_header_line(c->buffer); 5035 if(!line) return 1; 5036 verbose(VERB_ALGO, "http header: %s", line); 5037 if(strncasecmp(line, "HTTP/1.1 ", 9) == 0) { 5038 /* check returncode */ 5039 if(line[9] != '2') { 5040 verbose(VERB_ALGO, "http bad status %s", line+9); 5041 return 0; 5042 } 5043 } else if(strncasecmp(line, "Content-Length: ", 16) == 0) { 5044 if(!c->http_is_chunked) { 5045 char* end = NULL; 5046 long long cl; 5047 errno = 0; 5048 cl = strtoll(line+16, &end, 10); 5049 if(end == line+16 || errno != 0 || cl < 0) { 5050 verbose(VERB_ALGO, "http invalid Content-Length: " ARG_LL "d", cl); 5051 return 0; /* reject */ 5052 } 5053 c->tcp_byte_count = (size_t)cl; 5054 } 5055 } else if(strncasecmp(line, "Transfer-Encoding: chunked", 19+7) == 0) { 5056 c->tcp_byte_count = 0; 5057 c->http_is_chunked = 1; 5058 } else if(line[0] == 0) { 5059 /* end of initial headers */ 5060 c->http_in_headers = 0; 5061 if(c->http_is_chunked) 5062 c->http_in_chunk_headers = 1; 5063 /* remove header text from front of buffer 5064 * the buffer is going to be used to return the data segment 5065 * itself and we don't want the header to get returned 5066 * prepended with it */ 5067 http_moveover_buffer(c->buffer); 5068 sldns_buffer_flip(c->buffer); 5069 return 1; 5070 } 5071 /* ignore other headers */ 5072 return 1; 5073 } 5074 5075 /** a chunk header is complete, process it, return 0=fail, 1=continue next 5076 * header line, 2=done with chunked transfer*/ 5077 static int 5078 http_process_chunk_header(struct comm_point* c) 5079 { 5080 char* line = http_header_line(c->buffer); 5081 if(!line) return 1; 5082 if(c->http_in_chunk_headers == 3) { 5083 verbose(VERB_ALGO, "http chunk trailer: %s", line); 5084 /* are we done ? */ 5085 if(line[0] == 0 && c->tcp_byte_count == 0) { 5086 /* callback of http reader when NETEVENT_DONE, 5087 * end of data, with no data in buffer */ 5088 sldns_buffer_set_position(c->buffer, 0); 5089 sldns_buffer_set_limit(c->buffer, 0); 5090 fptr_ok(fptr_whitelist_comm_point(c->callback)); 5091 (void)(*c->callback)(c, c->cb_arg, NETEVENT_DONE, NULL); 5092 /* return that we are done */ 5093 return 2; 5094 } 5095 if(line[0] == 0) { 5096 /* continue with header of the next chunk */ 5097 c->http_in_chunk_headers = 1; 5098 /* remove header text from front of buffer */ 5099 http_moveover_buffer(c->buffer); 5100 sldns_buffer_flip(c->buffer); 5101 return 1; 5102 } 5103 /* ignore further trail headers */ 5104 return 1; 5105 } 5106 verbose(VERB_ALGO, "http chunk header: %s", line); 5107 if(c->http_in_chunk_headers == 1) { 5108 /* read chunked start line */ 5109 char* end = NULL; 5110 long chunk_sz; 5111 errno = 0; 5112 chunk_sz = strtol(line, &end, 16); 5113 if(end == line || errno != 0 || chunk_sz < 0) { 5114 verbose(VERB_ALGO, "http invalid chunk size: %ld", 5115 chunk_sz); 5116 return 0; 5117 } 5118 c->tcp_byte_count = (size_t)chunk_sz; 5119 c->http_in_chunk_headers = 0; 5120 /* remove header text from front of buffer */ 5121 http_moveover_buffer(c->buffer); 5122 sldns_buffer_flip(c->buffer); 5123 if(c->tcp_byte_count == 0) { 5124 /* done with chunks, process chunk_trailer lines */ 5125 c->http_in_chunk_headers = 3; 5126 } 5127 return 1; 5128 } 5129 /* ignore other headers */ 5130 return 1; 5131 } 5132 5133 /** handle nonchunked data segment, 0=fail, 1=wait */ 5134 static int 5135 http_nonchunk_segment(struct comm_point* c) 5136 { 5137 /* c->buffer at position..limit has new data we read in. 5138 * the buffer itself is full of nonchunked data. 5139 * we are looking to read tcp_byte_count more data 5140 * and then the transfer is done. */ 5141 size_t remainbufferlen; 5142 size_t got_now = sldns_buffer_limit(c->buffer); 5143 if(c->tcp_byte_count <= got_now) { 5144 /* done, this is the last data fragment */ 5145 c->http_stored = 0; 5146 sldns_buffer_set_position(c->buffer, 0); 5147 fptr_ok(fptr_whitelist_comm_point(c->callback)); 5148 (void)(*c->callback)(c, c->cb_arg, NETEVENT_DONE, NULL); 5149 return 1; 5150 } 5151 /* if we have the buffer space, 5152 * read more data collected into the buffer */ 5153 remainbufferlen = sldns_buffer_capacity(c->buffer) - 5154 sldns_buffer_limit(c->buffer); 5155 if(remainbufferlen+got_now >= c->tcp_byte_count || 5156 remainbufferlen >= (size_t)(c->ssl?16384:2048)) { 5157 size_t total = sldns_buffer_limit(c->buffer); 5158 sldns_buffer_clear(c->buffer); 5159 sldns_buffer_set_position(c->buffer, total); 5160 c->http_stored = total; 5161 /* return and wait to read more */ 5162 return 1; 5163 } 5164 /* call callback with this data amount, then 5165 * wait for more */ 5166 c->tcp_byte_count -= got_now; 5167 c->http_stored = 0; 5168 sldns_buffer_set_position(c->buffer, 0); 5169 fptr_ok(fptr_whitelist_comm_point(c->callback)); 5170 (void)(*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, NULL); 5171 /* c->callback has to buffer_clear(c->buffer). */ 5172 /* return and wait to read more */ 5173 return 1; 5174 } 5175 5176 /** handle chunked data segment, return 0=fail, 1=wait, 2=process more */ 5177 static int 5178 http_chunked_segment(struct comm_point* c) 5179 { 5180 /* the c->buffer has from position..limit new data we read. */ 5181 /* the current chunk has length tcp_byte_count. 5182 * once we read that read more chunk headers. 5183 */ 5184 size_t remainbufferlen; 5185 size_t got_now = sldns_buffer_limit(c->buffer) - c->http_stored; 5186 verbose(VERB_ALGO, "http_chunked_segment: got now %d, tcpbytcount %d, http_stored %d, buffer pos %d, buffer limit %d", (int)got_now, (int)c->tcp_byte_count, (int)c->http_stored, (int)sldns_buffer_position(c->buffer), (int)sldns_buffer_limit(c->buffer)); 5187 if(c->tcp_byte_count <= got_now) { 5188 /* the chunk has completed (with perhaps some extra data 5189 * from next chunk header and next chunk) */ 5190 /* save too much info into temp buffer */ 5191 size_t fraglen; 5192 struct comm_reply repinfo; 5193 c->http_stored = 0; 5194 sldns_buffer_skip(c->buffer, (ssize_t)c->tcp_byte_count); 5195 sldns_buffer_clear(c->http_temp); 5196 if(sldns_buffer_remaining(c->buffer) > 5197 sldns_buffer_capacity(c->http_temp)) { 5198 verbose(VERB_OPS, "http chunked: surplus %d exceeds " 5199 "temp buffer %d", (int)sldns_buffer_remaining( 5200 c->buffer), (int)sldns_buffer_capacity( 5201 c->http_temp)); 5202 return 0; 5203 } 5204 sldns_buffer_write(c->http_temp, 5205 sldns_buffer_current(c->buffer), 5206 sldns_buffer_remaining(c->buffer)); 5207 sldns_buffer_flip(c->http_temp); 5208 5209 /* callback with this fragment */ 5210 fraglen = sldns_buffer_position(c->buffer); 5211 sldns_buffer_set_position(c->buffer, 0); 5212 sldns_buffer_set_limit(c->buffer, fraglen); 5213 repinfo = c->repinfo; 5214 fptr_ok(fptr_whitelist_comm_point(c->callback)); 5215 (void)(*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, &repinfo); 5216 /* c->callback has to buffer_clear(). */ 5217 5218 /* is commpoint deleted? */ 5219 if(!repinfo.c) { 5220 return 1; 5221 } 5222 /* copy waiting info */ 5223 sldns_buffer_clear(c->buffer); 5224 sldns_buffer_write(c->buffer, 5225 sldns_buffer_begin(c->http_temp), 5226 sldns_buffer_remaining(c->http_temp)); 5227 sldns_buffer_flip(c->buffer); 5228 /* process end of chunk trailer header lines, until 5229 * an empty line */ 5230 c->http_in_chunk_headers = 3; 5231 /* process more data in buffer (if any) */ 5232 return 2; 5233 } 5234 c->tcp_byte_count -= got_now; 5235 5236 /* if we have the buffer space, 5237 * read more data collected into the buffer */ 5238 remainbufferlen = sldns_buffer_capacity(c->buffer) - 5239 sldns_buffer_limit(c->buffer); 5240 if(remainbufferlen >= c->tcp_byte_count || 5241 remainbufferlen >= 2048) { 5242 size_t total = sldns_buffer_limit(c->buffer); 5243 sldns_buffer_clear(c->buffer); 5244 sldns_buffer_set_position(c->buffer, total); 5245 c->http_stored = total; 5246 /* return and wait to read more */ 5247 return 1; 5248 } 5249 5250 /* callback of http reader for a new part of the data */ 5251 c->http_stored = 0; 5252 sldns_buffer_set_position(c->buffer, 0); 5253 fptr_ok(fptr_whitelist_comm_point(c->callback)); 5254 (void)(*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, NULL); 5255 /* c->callback has to buffer_clear(c->buffer). */ 5256 /* return and wait to read more */ 5257 return 1; 5258 } 5259 5260 #ifdef HAVE_NGHTTP2 5261 /** Create new http2 session. Called when creating handling comm point. */ 5262 static struct http2_session* http2_session_create(struct comm_point* c) 5263 { 5264 struct http2_session* session = calloc(1, sizeof(*session)); 5265 if(!session) { 5266 log_err("malloc failure while creating http2 session"); 5267 return NULL; 5268 } 5269 session->c = c; 5270 5271 return session; 5272 } 5273 #endif 5274 5275 /** Delete http2 session. After closing connection or on error */ 5276 static void http2_session_delete(struct http2_session* h2_session) 5277 { 5278 #ifdef HAVE_NGHTTP2 5279 if(h2_session->callbacks) 5280 nghttp2_session_callbacks_del(h2_session->callbacks); 5281 free(h2_session); 5282 #else 5283 (void)h2_session; 5284 #endif 5285 } 5286 5287 #ifdef HAVE_NGHTTP2 5288 struct http2_stream* http2_stream_create(int32_t stream_id) 5289 { 5290 struct http2_stream* h2_stream = calloc(1, sizeof(*h2_stream)); 5291 if(!h2_stream) { 5292 log_err("malloc failure while creating http2 stream"); 5293 return NULL; 5294 } 5295 h2_stream->stream_id = stream_id; 5296 return h2_stream; 5297 } 5298 #endif 5299 5300 void http2_stream_add_meshstate(struct http2_stream* h2_stream, 5301 struct mesh_area* mesh, struct mesh_state* m) 5302 { 5303 h2_stream->mesh = mesh; 5304 h2_stream->mesh_state = m; 5305 } 5306 5307 void http2_stream_remove_mesh_state(struct http2_stream* h2_stream) 5308 { 5309 if(!h2_stream) 5310 return; 5311 h2_stream->mesh_state = NULL; 5312 } 5313 5314 #ifdef HAVE_NGHTTP2 5315 void http2_session_add_stream(struct http2_session* h2_session, 5316 struct http2_stream* h2_stream) 5317 { 5318 if(h2_session->first_stream) 5319 h2_session->first_stream->prev = h2_stream; 5320 h2_stream->next = h2_session->first_stream; 5321 h2_session->first_stream = h2_stream; 5322 } 5323 5324 /** remove stream from session linked list. After stream close callback or 5325 * closing connection */ 5326 static void http2_session_remove_stream(struct http2_session* h2_session, 5327 struct http2_stream* h2_stream) 5328 { 5329 if(h2_stream->prev) 5330 h2_stream->prev->next = h2_stream->next; 5331 else 5332 h2_session->first_stream = h2_stream->next; 5333 if(h2_stream->next) 5334 h2_stream->next->prev = h2_stream->prev; 5335 5336 } 5337 5338 int http2_stream_close_cb(nghttp2_session* ATTR_UNUSED(session), 5339 int32_t stream_id, uint32_t ATTR_UNUSED(error_code), void* cb_arg) 5340 { 5341 struct http2_stream* h2_stream; 5342 struct http2_session* h2_session = (struct http2_session*)cb_arg; 5343 if(!(h2_stream = nghttp2_session_get_stream_user_data( 5344 h2_session->session, stream_id))) { 5345 return 0; 5346 } 5347 http2_session_remove_stream(h2_session, h2_stream); 5348 http2_stream_delete(h2_session, h2_stream); 5349 return 0; 5350 } 5351 5352 ssize_t http2_recv_cb(nghttp2_session* ATTR_UNUSED(session), uint8_t* buf, 5353 size_t len, int ATTR_UNUSED(flags), void* cb_arg) 5354 { 5355 struct http2_session* h2_session = (struct http2_session*)cb_arg; 5356 ssize_t ret; 5357 5358 log_assert(h2_session->c->type == comm_http); 5359 log_assert(h2_session->c->h2_session); 5360 if(++h2_session->reads_count > h2_session->c->http2_max_streams) { 5361 /* We are somewhat arbitrarily capping the amount of 5362 * consecutive reads on the HTTP2 session to the number of max 5363 * allowed streams. 5364 * When we reach the cap, error out with NGHTTP2_ERR_WOULDBLOCK 5365 * to signal nghttp2_session_recv() to stop reading for now. */ 5366 h2_session->reads_count = 0; 5367 return NGHTTP2_ERR_WOULDBLOCK; 5368 } 5369 5370 #ifdef HAVE_SSL 5371 if(h2_session->c->ssl) { 5372 int r; 5373 ERR_clear_error(); 5374 r = SSL_read(h2_session->c->ssl, buf, len); 5375 if(r <= 0) { 5376 int want = SSL_get_error(h2_session->c->ssl, r); 5377 if(want == SSL_ERROR_ZERO_RETURN) { 5378 return NGHTTP2_ERR_EOF; 5379 } else if(want == SSL_ERROR_WANT_READ) { 5380 return NGHTTP2_ERR_WOULDBLOCK; 5381 } else if(want == SSL_ERROR_WANT_WRITE) { 5382 h2_session->c->ssl_shake_state = comm_ssl_shake_hs_write; 5383 comm_point_listen_for_rw(h2_session->c, 0, 1); 5384 return NGHTTP2_ERR_WOULDBLOCK; 5385 } else if(want == SSL_ERROR_SYSCALL) { 5386 #ifdef ECONNRESET 5387 if(errno == ECONNRESET && verbosity < 2) 5388 return NGHTTP2_ERR_CALLBACK_FAILURE; 5389 #endif 5390 if(errno != 0) 5391 log_err("SSL_read syscall: %s", 5392 strerror(errno)); 5393 return NGHTTP2_ERR_CALLBACK_FAILURE; 5394 } 5395 log_crypto_err_io("could not SSL_read", want); 5396 return NGHTTP2_ERR_CALLBACK_FAILURE; 5397 } 5398 return r; 5399 } 5400 #endif /* HAVE_SSL */ 5401 5402 ret = recv(h2_session->c->fd, (void*)buf, len, MSG_DONTWAIT); 5403 if(ret == 0) { 5404 return NGHTTP2_ERR_EOF; 5405 } else if(ret < 0) { 5406 #ifndef USE_WINSOCK 5407 if(errno == EINTR || errno == EAGAIN) 5408 return NGHTTP2_ERR_WOULDBLOCK; 5409 #ifdef ECONNRESET 5410 if(errno == ECONNRESET && verbosity < 2) 5411 return NGHTTP2_ERR_CALLBACK_FAILURE; 5412 #endif 5413 log_err_addr("could not http2 recv: %s", strerror(errno), 5414 &h2_session->c->repinfo.remote_addr, 5415 h2_session->c->repinfo.remote_addrlen); 5416 #else /* USE_WINSOCK */ 5417 if(WSAGetLastError() == WSAECONNRESET) 5418 return NGHTTP2_ERR_CALLBACK_FAILURE; 5419 if(WSAGetLastError() == WSAEINPROGRESS) 5420 return NGHTTP2_ERR_WOULDBLOCK; 5421 if(WSAGetLastError() == WSAEWOULDBLOCK) { 5422 ub_winsock_tcp_wouldblock(h2_session->c->ev->ev, 5423 UB_EV_READ); 5424 return NGHTTP2_ERR_WOULDBLOCK; 5425 } 5426 log_err_addr("could not http2 recv: %s", 5427 wsa_strerror(WSAGetLastError()), 5428 &h2_session->c->repinfo.remote_addr, 5429 h2_session->c->repinfo.remote_addrlen); 5430 #endif 5431 return NGHTTP2_ERR_CALLBACK_FAILURE; 5432 } 5433 return ret; 5434 } 5435 #endif /* HAVE_NGHTTP2 */ 5436 5437 /** Handle http2 read */ 5438 static int 5439 comm_point_http2_handle_read(int ATTR_UNUSED(fd), struct comm_point* c) 5440 { 5441 #ifdef HAVE_NGHTTP2 5442 int ret; 5443 log_assert(c->h2_session); 5444 5445 /* reading until recv cb returns NGHTTP2_ERR_WOULDBLOCK */ 5446 ret = nghttp2_session_recv(c->h2_session->session); 5447 if(ret) { 5448 if(ret != NGHTTP2_ERR_EOF && 5449 ret != NGHTTP2_ERR_CALLBACK_FAILURE) { 5450 char a[256]; 5451 addr_to_str(&c->repinfo.remote_addr, 5452 c->repinfo.remote_addrlen, a, sizeof(a)); 5453 verbose(VERB_QUERY, "http2: session_recv from %s failed, " 5454 "error: %s", a, nghttp2_strerror(ret)); 5455 } 5456 return 0; 5457 } 5458 if(nghttp2_session_want_write(c->h2_session->session)) { 5459 c->tcp_is_reading = 0; 5460 comm_point_stop_listening(c); 5461 comm_point_start_listening(c, -1, adjusted_tcp_timeout(c)); 5462 } else if(!nghttp2_session_want_read(c->h2_session->session)) 5463 return 0; /* connection can be closed */ 5464 return 1; 5465 #else 5466 (void)c; 5467 return 0; 5468 #endif 5469 } 5470 5471 /** 5472 * Handle http reading callback. 5473 * @param fd: file descriptor of socket. 5474 * @param c: comm point to read from into buffer. 5475 * @return: 0 on error 5476 */ 5477 static int 5478 comm_point_http_handle_read(int fd, struct comm_point* c) 5479 { 5480 log_assert(c->type == comm_http); 5481 log_assert(fd != -1); 5482 5483 /* if we are in ssl handshake, handle SSL handshake */ 5484 #ifdef HAVE_SSL 5485 if(c->ssl && c->ssl_shake_state != comm_ssl_shake_none) { 5486 if(!ssl_handshake(c)) 5487 return 0; 5488 if(c->ssl_shake_state != comm_ssl_shake_none) 5489 return 1; 5490 } 5491 #endif /* HAVE_SSL */ 5492 5493 if(!c->tcp_is_reading) 5494 return 1; 5495 5496 if(c->use_h2) { 5497 return comm_point_http2_handle_read(fd, c); 5498 } 5499 5500 /* http version is <= http/1.1 */ 5501 5502 if(c->http_min_version >= http_version_2) { 5503 /* HTTP/2 failed, not allowed to use lower version. */ 5504 return 0; 5505 } 5506 5507 /* read more data */ 5508 if(c->ssl) { 5509 if(!ssl_http_read_more(c)) 5510 return 0; 5511 } else { 5512 if(!http_read_more(fd, c)) 5513 return 0; 5514 } 5515 5516 if(c->http_stored >= sldns_buffer_position(c->buffer)) { 5517 /* read did not work but we wanted more data, there is 5518 * no bytes to process now. */ 5519 return 1; 5520 } 5521 sldns_buffer_flip(c->buffer); 5522 /* if we are partway in a segment of data, position us at the point 5523 * where we left off previously */ 5524 if(c->http_stored < sldns_buffer_limit(c->buffer)) 5525 sldns_buffer_set_position(c->buffer, c->http_stored); 5526 else sldns_buffer_set_position(c->buffer, sldns_buffer_limit(c->buffer)); 5527 5528 while(sldns_buffer_remaining(c->buffer) > 0) { 5529 /* Handle HTTP/1.x data */ 5530 /* if we are reading headers, read more headers */ 5531 if(c->http_in_headers || c->http_in_chunk_headers) { 5532 /* if header is done, process the header */ 5533 if(!http_header_done(c->buffer)) { 5534 if(sldns_buffer_limit(c->buffer) == 5535 sldns_buffer_capacity(c->buffer)) { 5536 verbose(VERB_OPS, "http header line " 5537 "exceeds %d bytes, transfer " 5538 "failed", (int)sldns_buffer_capacity(c->buffer)); 5539 return 0; 5540 } 5541 /* copy remaining data to front of buffer 5542 * and set rest for writing into it */ 5543 http_moveover_buffer(c->buffer); 5544 /* return and wait to read more */ 5545 return 1; 5546 } 5547 if(!c->http_in_chunk_headers) { 5548 /* process initial headers */ 5549 if(!http_process_initial_header(c)) 5550 return 0; 5551 } else { 5552 /* process chunk headers */ 5553 int r = http_process_chunk_header(c); 5554 if(r == 0) return 0; 5555 if(r == 2) return 1; /* done */ 5556 /* r == 1, continue */ 5557 } 5558 /* see if we have more to process */ 5559 continue; 5560 } 5561 5562 if(!c->http_is_chunked) { 5563 /* if we are reading nonchunks, process that*/ 5564 return http_nonchunk_segment(c); 5565 } else { 5566 /* if we are reading chunks, read the chunk */ 5567 int r = http_chunked_segment(c); 5568 if(r == 0) return 0; 5569 if(r == 1) return 1; 5570 continue; 5571 } 5572 } 5573 /* broke out of the loop; could not process header instead need 5574 * to read more */ 5575 /* moveover any remaining data and read more data */ 5576 http_moveover_buffer(c->buffer); 5577 /* return and wait to read more */ 5578 return 1; 5579 } 5580 5581 /** check pending connect for http */ 5582 static int 5583 http_check_connect(int fd, struct comm_point* c) 5584 { 5585 /* check for pending error from nonblocking connect */ 5586 /* from Stevens, unix network programming, vol1, 3rd ed, p450*/ 5587 int error = 0; 5588 socklen_t len = (socklen_t)sizeof(error); 5589 if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error, 5590 &len) < 0){ 5591 #ifndef USE_WINSOCK 5592 error = errno; /* on solaris errno is error */ 5593 #else /* USE_WINSOCK */ 5594 error = WSAGetLastError(); 5595 #endif 5596 } 5597 #ifndef USE_WINSOCK 5598 #if defined(EINPROGRESS) && defined(EWOULDBLOCK) 5599 if(error == EINPROGRESS || error == EWOULDBLOCK) 5600 return 1; /* try again later */ 5601 else 5602 #endif 5603 if(error != 0 && verbosity < 2) 5604 return 0; /* silence lots of chatter in the logs */ 5605 else if(error != 0) { 5606 log_err_addr("http connect", strerror(error), 5607 &c->repinfo.remote_addr, c->repinfo.remote_addrlen); 5608 #else /* USE_WINSOCK */ 5609 /* examine error */ 5610 if(error == WSAEINPROGRESS) 5611 return 1; 5612 else if(error == WSAEWOULDBLOCK) { 5613 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE); 5614 return 1; 5615 } else if(error != 0 && verbosity < 2) 5616 return 0; 5617 else if(error != 0) { 5618 log_err_addr("http connect", wsa_strerror(error), 5619 &c->repinfo.remote_addr, c->repinfo.remote_addrlen); 5620 #endif /* USE_WINSOCK */ 5621 return 0; 5622 } 5623 /* keep on processing this socket */ 5624 return 2; 5625 } 5626 5627 /** write more data for http (with ssl) */ 5628 static int 5629 ssl_http_write_more(struct comm_point* c) 5630 { 5631 #ifdef HAVE_SSL 5632 int r; 5633 log_assert(sldns_buffer_remaining(c->buffer) > 0); 5634 ERR_clear_error(); 5635 r = SSL_write(c->ssl, (void*)sldns_buffer_current(c->buffer), 5636 (int)sldns_buffer_remaining(c->buffer)); 5637 if(r <= 0) { 5638 int want = SSL_get_error(c->ssl, r); 5639 if(want == SSL_ERROR_ZERO_RETURN) { 5640 return 0; /* closed */ 5641 } else if(want == SSL_ERROR_WANT_READ) { 5642 c->ssl_shake_state = comm_ssl_shake_hs_read; 5643 comm_point_listen_for_rw(c, 1, 0); 5644 return 1; /* wait for read condition */ 5645 } else if(want == SSL_ERROR_WANT_WRITE) { 5646 return 1; /* write more later */ 5647 } else if(want == SSL_ERROR_SYSCALL) { 5648 #ifdef EPIPE 5649 if(errno == EPIPE && verbosity < 2) 5650 return 0; /* silence 'broken pipe' */ 5651 #endif 5652 if(errno != 0) 5653 log_err("SSL_write syscall: %s", 5654 strerror(errno)); 5655 return 0; 5656 } 5657 log_crypto_err_io("could not SSL_write", want); 5658 return 0; 5659 } 5660 sldns_buffer_skip(c->buffer, (ssize_t)r); 5661 return 1; 5662 #else 5663 (void)c; 5664 return 0; 5665 #endif /* HAVE_SSL */ 5666 } 5667 5668 /** write more data for http */ 5669 static int 5670 http_write_more(int fd, struct comm_point* c) 5671 { 5672 ssize_t r; 5673 log_assert(sldns_buffer_remaining(c->buffer) > 0); 5674 r = send(fd, (void*)sldns_buffer_current(c->buffer), 5675 sldns_buffer_remaining(c->buffer), 0); 5676 if(r == -1) { 5677 #ifndef USE_WINSOCK 5678 if(errno == EINTR || errno == EAGAIN) 5679 return 1; 5680 #else 5681 if(WSAGetLastError() == WSAEINPROGRESS) 5682 return 1; 5683 if(WSAGetLastError() == WSAEWOULDBLOCK) { 5684 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE); 5685 return 1; 5686 } 5687 #endif 5688 log_err_addr("http send r", sock_strerror(errno), 5689 &c->repinfo.remote_addr, c->repinfo.remote_addrlen); 5690 return 0; 5691 } 5692 sldns_buffer_skip(c->buffer, r); 5693 return 1; 5694 } 5695 5696 #ifdef HAVE_NGHTTP2 5697 ssize_t http2_send_cb(nghttp2_session* ATTR_UNUSED(session), const uint8_t* buf, 5698 size_t len, int ATTR_UNUSED(flags), void* cb_arg) 5699 { 5700 ssize_t ret; 5701 struct http2_session* h2_session = (struct http2_session*)cb_arg; 5702 log_assert(h2_session->c->type == comm_http); 5703 log_assert(h2_session->c->h2_session); 5704 5705 #ifdef HAVE_SSL 5706 if(h2_session->c->ssl) { 5707 int r; 5708 ERR_clear_error(); 5709 r = SSL_write(h2_session->c->ssl, buf, len); 5710 if(r <= 0) { 5711 int want = SSL_get_error(h2_session->c->ssl, r); 5712 if(want == SSL_ERROR_ZERO_RETURN) { 5713 return NGHTTP2_ERR_CALLBACK_FAILURE; 5714 } else if(want == SSL_ERROR_WANT_READ) { 5715 h2_session->c->ssl_shake_state = comm_ssl_shake_hs_read; 5716 comm_point_listen_for_rw(h2_session->c, 1, 0); 5717 return NGHTTP2_ERR_WOULDBLOCK; 5718 } else if(want == SSL_ERROR_WANT_WRITE) { 5719 return NGHTTP2_ERR_WOULDBLOCK; 5720 } else if(want == SSL_ERROR_SYSCALL) { 5721 #ifdef EPIPE 5722 if(errno == EPIPE && verbosity < 2) 5723 return NGHTTP2_ERR_CALLBACK_FAILURE; 5724 #endif 5725 if(errno != 0) 5726 log_err("SSL_write syscall: %s", 5727 strerror(errno)); 5728 return NGHTTP2_ERR_CALLBACK_FAILURE; 5729 } 5730 log_crypto_err_io("could not SSL_write", want); 5731 return NGHTTP2_ERR_CALLBACK_FAILURE; 5732 } 5733 return r; 5734 } 5735 #endif /* HAVE_SSL */ 5736 5737 ret = send(h2_session->c->fd, (void*)buf, len, 0); 5738 if(ret == 0) { 5739 return NGHTTP2_ERR_CALLBACK_FAILURE; 5740 } else if(ret < 0) { 5741 #ifndef USE_WINSOCK 5742 if(errno == EINTR || errno == EAGAIN) 5743 return NGHTTP2_ERR_WOULDBLOCK; 5744 #ifdef EPIPE 5745 if(errno == EPIPE && verbosity < 2) 5746 return NGHTTP2_ERR_CALLBACK_FAILURE; 5747 #endif 5748 #ifdef ECONNRESET 5749 if(errno == ECONNRESET && verbosity < 2) 5750 return NGHTTP2_ERR_CALLBACK_FAILURE; 5751 #endif 5752 log_err_addr("could not http2 write: %s", strerror(errno), 5753 &h2_session->c->repinfo.remote_addr, 5754 h2_session->c->repinfo.remote_addrlen); 5755 #else /* USE_WINSOCK */ 5756 if(WSAGetLastError() == WSAENOTCONN) 5757 return NGHTTP2_ERR_WOULDBLOCK; 5758 if(WSAGetLastError() == WSAEINPROGRESS) 5759 return NGHTTP2_ERR_WOULDBLOCK; 5760 if(WSAGetLastError() == WSAEWOULDBLOCK) { 5761 ub_winsock_tcp_wouldblock(h2_session->c->ev->ev, 5762 UB_EV_WRITE); 5763 return NGHTTP2_ERR_WOULDBLOCK; 5764 } 5765 if(WSAGetLastError() == WSAECONNRESET && verbosity < 2) 5766 return NGHTTP2_ERR_CALLBACK_FAILURE; 5767 log_err_addr("could not http2 write: %s", 5768 wsa_strerror(WSAGetLastError()), 5769 &h2_session->c->repinfo.remote_addr, 5770 h2_session->c->repinfo.remote_addrlen); 5771 #endif 5772 return NGHTTP2_ERR_CALLBACK_FAILURE; 5773 } 5774 return ret; 5775 } 5776 #endif /* HAVE_NGHTTP2 */ 5777 5778 /** Handle http2 writing */ 5779 static int 5780 comm_point_http2_handle_write(int ATTR_UNUSED(fd), struct comm_point* c) 5781 { 5782 #ifdef HAVE_NGHTTP2 5783 int ret; 5784 log_assert(c->h2_session); 5785 5786 ret = nghttp2_session_send(c->h2_session->session); 5787 if(ret) { 5788 verbose(VERB_QUERY, "http2: session_send failed, " 5789 "error: %s", nghttp2_strerror(ret)); 5790 return 0; 5791 } 5792 5793 if(nghttp2_session_want_read(c->h2_session->session)) { 5794 c->tcp_is_reading = 1; 5795 comm_point_stop_listening(c); 5796 comm_point_start_listening(c, -1, adjusted_tcp_timeout(c)); 5797 } else if(!nghttp2_session_want_write(c->h2_session->session)) 5798 return 0; /* connection can be closed */ 5799 return 1; 5800 #else 5801 (void)c; 5802 return 0; 5803 #endif 5804 } 5805 5806 /** 5807 * Handle http writing callback. 5808 * @param fd: file descriptor of socket. 5809 * @param c: comm point to write buffer out of. 5810 * @return: 0 on error 5811 */ 5812 static int 5813 comm_point_http_handle_write(int fd, struct comm_point* c) 5814 { 5815 log_assert(c->type == comm_http); 5816 log_assert(fd != -1); 5817 5818 /* check pending connect errors, if that fails, we wait for more, 5819 * or we can continue to write contents */ 5820 if(c->tcp_check_nb_connect) { 5821 int r = http_check_connect(fd, c); 5822 if(r == 0) return 0; 5823 if(r == 1) return 1; 5824 c->tcp_check_nb_connect = 0; 5825 } 5826 /* if we are in ssl handshake, handle SSL handshake */ 5827 #ifdef HAVE_SSL 5828 if(c->ssl && c->ssl_shake_state != comm_ssl_shake_none) { 5829 if(!ssl_handshake(c)) 5830 return 0; 5831 if(c->ssl_shake_state != comm_ssl_shake_none) 5832 return 1; 5833 } 5834 #endif /* HAVE_SSL */ 5835 if(c->tcp_is_reading) 5836 return 1; 5837 5838 if(c->use_h2) { 5839 return comm_point_http2_handle_write(fd, c); 5840 } 5841 5842 /* http version is <= http/1.1 */ 5843 5844 if(c->http_min_version >= http_version_2) { 5845 /* HTTP/2 failed, not allowed to use lower version. */ 5846 return 0; 5847 } 5848 5849 /* if we are writing, write more */ 5850 if(c->ssl) { 5851 if(!ssl_http_write_more(c)) 5852 return 0; 5853 } else { 5854 if(!http_write_more(fd, c)) 5855 return 0; 5856 } 5857 5858 /* we write a single buffer contents, that can contain 5859 * the http request, and then flip to read the results */ 5860 /* see if write is done */ 5861 if(sldns_buffer_remaining(c->buffer) == 0) { 5862 sldns_buffer_clear(c->buffer); 5863 if(c->tcp_do_toggle_rw) 5864 c->tcp_is_reading = 1; 5865 c->tcp_byte_count = 0; 5866 /* switch from listening(write) to listening(read) */ 5867 comm_point_stop_listening(c); 5868 comm_point_start_listening(c, -1, -1); 5869 } 5870 return 1; 5871 } 5872 5873 void 5874 comm_point_http_handle_callback(int fd, short event, void* arg) 5875 { 5876 struct comm_point* c = (struct comm_point*)arg; 5877 log_assert(c->type == comm_http); 5878 ub_comm_base_now(c->ev->base); 5879 5880 if((event&UB_EV_TIMEOUT)) { 5881 verbose(VERB_QUERY, "http took too long, dropped"); 5882 reclaim_http_handler(c); 5883 if(!c->tcp_do_close) { 5884 fptr_ok(fptr_whitelist_comm_point(c->callback)); 5885 (void)(*c->callback)(c, c->cb_arg, 5886 NETEVENT_TIMEOUT, NULL); 5887 } 5888 return; 5889 } 5890 if((event&UB_EV_READ)) { 5891 if(!comm_point_http_handle_read(fd, c)) { 5892 reclaim_http_handler(c); 5893 if(!c->tcp_do_close) { 5894 fptr_ok(fptr_whitelist_comm_point( 5895 c->callback)); 5896 (void)(*c->callback)(c, c->cb_arg, 5897 NETEVENT_CLOSED, NULL); 5898 } 5899 } 5900 return; 5901 } 5902 if((event&UB_EV_WRITE)) { 5903 if(!comm_point_http_handle_write(fd, c)) { 5904 reclaim_http_handler(c); 5905 if(!c->tcp_do_close) { 5906 fptr_ok(fptr_whitelist_comm_point( 5907 c->callback)); 5908 (void)(*c->callback)(c, c->cb_arg, 5909 NETEVENT_CLOSED, NULL); 5910 } 5911 } 5912 return; 5913 } 5914 log_err("Ignored event %d for httphdl.", event); 5915 } 5916 5917 void comm_point_local_handle_callback(int fd, short event, void* arg) 5918 { 5919 struct comm_point* c = (struct comm_point*)arg; 5920 log_assert(c->type == comm_local); 5921 ub_comm_base_now(c->ev->base); 5922 5923 if((event&UB_EV_READ)) { 5924 if(!comm_point_tcp_handle_read(fd, c, 1)) { 5925 fptr_ok(fptr_whitelist_comm_point(c->callback)); 5926 (void)(*c->callback)(c, c->cb_arg, NETEVENT_CLOSED, 5927 NULL); 5928 } 5929 return; 5930 } 5931 log_err("Ignored event %d for localhdl.", event); 5932 } 5933 5934 void comm_point_raw_handle_callback(int ATTR_UNUSED(fd), 5935 short event, void* arg) 5936 { 5937 struct comm_point* c = (struct comm_point*)arg; 5938 int err = NETEVENT_NOERROR; 5939 log_assert(c->type == comm_raw); 5940 ub_comm_base_now(c->ev->base); 5941 5942 if((event&UB_EV_TIMEOUT)) 5943 err = NETEVENT_TIMEOUT; 5944 fptr_ok(fptr_whitelist_comm_point_raw(c->callback)); 5945 (void)(*c->callback)(c, c->cb_arg, err, NULL); 5946 } 5947 5948 struct comm_point* 5949 comm_point_create_udp(struct comm_base *base, int fd, sldns_buffer* buffer, 5950 int pp2_enabled, comm_point_callback_type* callback, 5951 void* callback_arg, struct unbound_socket* socket) 5952 { 5953 struct comm_point* c = (struct comm_point*)calloc(1, 5954 sizeof(struct comm_point)); 5955 short evbits; 5956 if(!c) 5957 return NULL; 5958 c->ev = (struct internal_event*)calloc(1, 5959 sizeof(struct internal_event)); 5960 if(!c->ev) { 5961 free(c); 5962 return NULL; 5963 } 5964 c->ev->base = base; 5965 c->fd = fd; 5966 c->buffer = buffer; 5967 c->timeout = NULL; 5968 c->tcp_is_reading = 0; 5969 c->tcp_byte_count = 0; 5970 c->tcp_parent = NULL; 5971 c->max_tcp_count = 0; 5972 c->cur_tcp_count = 0; 5973 c->tcp_handlers = NULL; 5974 c->tcp_free = NULL; 5975 c->is_in_tcp_free = 0; 5976 c->type = comm_udp; 5977 c->tcp_do_close = 0; 5978 c->do_not_close = 0; 5979 c->tcp_do_toggle_rw = 0; 5980 c->tcp_check_nb_connect = 0; 5981 #ifdef USE_MSG_FASTOPEN 5982 c->tcp_do_fastopen = 0; 5983 #endif 5984 #ifdef USE_DNSCRYPT 5985 c->dnscrypt = 0; 5986 c->dnscrypt_buffer = buffer; 5987 #endif 5988 c->inuse = 0; 5989 c->callback = callback; 5990 c->cb_arg = callback_arg; 5991 c->socket = socket; 5992 c->pp2_enabled = pp2_enabled; 5993 c->pp2_header_state = pp2_header_none; 5994 evbits = UB_EV_READ | UB_EV_PERSIST; 5995 /* ub_event stuff */ 5996 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 5997 comm_point_udp_callback, c); 5998 if(c->ev->ev == NULL) { 5999 log_err("could not baseset udp event"); 6000 comm_point_delete(c); 6001 return NULL; 6002 } 6003 if(fd!=-1 && ub_event_add(c->ev->ev, c->timeout) != 0 ) { 6004 log_err("could not add udp event"); 6005 comm_point_delete(c); 6006 return NULL; 6007 } 6008 c->event_added = 1; 6009 return c; 6010 } 6011 6012 #if defined(AF_INET6) && defined(IPV6_PKTINFO) && defined(HAVE_RECVMSG) 6013 struct comm_point* 6014 comm_point_create_udp_ancil(struct comm_base *base, int fd, 6015 sldns_buffer* buffer, int pp2_enabled, 6016 comm_point_callback_type* callback, void* callback_arg, struct unbound_socket* socket) 6017 { 6018 struct comm_point* c = (struct comm_point*)calloc(1, 6019 sizeof(struct comm_point)); 6020 short evbits; 6021 if(!c) 6022 return NULL; 6023 c->ev = (struct internal_event*)calloc(1, 6024 sizeof(struct internal_event)); 6025 if(!c->ev) { 6026 free(c); 6027 return NULL; 6028 } 6029 c->ev->base = base; 6030 c->fd = fd; 6031 c->buffer = buffer; 6032 c->timeout = NULL; 6033 c->tcp_is_reading = 0; 6034 c->tcp_byte_count = 0; 6035 c->tcp_parent = NULL; 6036 c->max_tcp_count = 0; 6037 c->cur_tcp_count = 0; 6038 c->tcp_handlers = NULL; 6039 c->tcp_free = NULL; 6040 c->is_in_tcp_free = 0; 6041 c->type = comm_udp; 6042 c->tcp_do_close = 0; 6043 c->do_not_close = 0; 6044 #ifdef USE_DNSCRYPT 6045 c->dnscrypt = 0; 6046 c->dnscrypt_buffer = buffer; 6047 #endif 6048 c->inuse = 0; 6049 c->tcp_do_toggle_rw = 0; 6050 c->tcp_check_nb_connect = 0; 6051 #ifdef USE_MSG_FASTOPEN 6052 c->tcp_do_fastopen = 0; 6053 #endif 6054 c->callback = callback; 6055 c->cb_arg = callback_arg; 6056 c->socket = socket; 6057 c->pp2_enabled = pp2_enabled; 6058 c->pp2_header_state = pp2_header_none; 6059 evbits = UB_EV_READ | UB_EV_PERSIST; 6060 /* ub_event stuff */ 6061 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6062 comm_point_udp_ancil_callback, c); 6063 if(c->ev->ev == NULL) { 6064 log_err("could not baseset udp event"); 6065 comm_point_delete(c); 6066 return NULL; 6067 } 6068 if(fd!=-1 && ub_event_add(c->ev->ev, c->timeout) != 0 ) { 6069 log_err("could not add udp event"); 6070 comm_point_delete(c); 6071 return NULL; 6072 } 6073 c->event_added = 1; 6074 return c; 6075 } 6076 #endif 6077 6078 struct comm_point* 6079 comm_point_create_doq(struct comm_base *base, int fd, sldns_buffer* buffer, 6080 comm_point_callback_type* callback, void* callback_arg, 6081 struct unbound_socket* socket, struct doq_table* table, 6082 struct ub_randstate* rnd, const void* quic_sslctx, 6083 struct config_file* cfg) 6084 { 6085 #ifdef HAVE_NGTCP2 6086 struct comm_point* c = (struct comm_point*)calloc(1, 6087 sizeof(struct comm_point)); 6088 short evbits; 6089 log_assert(table != NULL); 6090 if(!c) 6091 return NULL; 6092 c->ev = (struct internal_event*)calloc(1, 6093 sizeof(struct internal_event)); 6094 if(!c->ev) { 6095 free(c); 6096 return NULL; 6097 } 6098 c->ev->base = base; 6099 c->fd = fd; 6100 c->buffer = buffer; 6101 c->timeout = NULL; 6102 c->tcp_is_reading = 0; 6103 c->tcp_byte_count = 0; 6104 c->tcp_parent = NULL; 6105 c->max_tcp_count = 0; 6106 c->cur_tcp_count = 0; 6107 c->tcp_handlers = NULL; 6108 c->tcp_free = NULL; 6109 c->is_in_tcp_free = 0; 6110 c->type = comm_doq; 6111 c->tcp_do_close = 0; 6112 c->do_not_close = 0; 6113 c->tcp_do_toggle_rw = 0; 6114 c->tcp_check_nb_connect = 0; 6115 #ifdef USE_MSG_FASTOPEN 6116 c->tcp_do_fastopen = 0; 6117 #endif 6118 #ifdef USE_DNSCRYPT 6119 c->dnscrypt = 0; 6120 c->dnscrypt_buffer = NULL; 6121 #endif 6122 c->doq_socket = doq_server_socket_create(table, rnd, quic_sslctx, c, 6123 base, cfg); 6124 if(!c->doq_socket) { 6125 log_err("could not create doq comm_point"); 6126 comm_point_delete(c); 6127 return NULL; 6128 } 6129 c->inuse = 0; 6130 c->callback = callback; 6131 c->cb_arg = callback_arg; 6132 c->socket = socket; 6133 c->pp2_enabled = 0; 6134 c->pp2_header_state = pp2_header_none; 6135 evbits = UB_EV_READ | UB_EV_PERSIST; 6136 /* ub_event stuff */ 6137 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6138 comm_point_doq_callback, c); 6139 if(c->ev->ev == NULL) { 6140 log_err("could not baseset udp event"); 6141 comm_point_delete(c); 6142 return NULL; 6143 } 6144 if(fd!=-1 && ub_event_add(c->ev->ev, c->timeout) != 0 ) { 6145 log_err("could not add udp event"); 6146 comm_point_delete(c); 6147 return NULL; 6148 } 6149 c->event_added = 1; 6150 return c; 6151 #else 6152 /* no libngtcp2, so no QUIC support */ 6153 (void)base; 6154 (void)buffer; 6155 (void)callback; 6156 (void)callback_arg; 6157 (void)socket; 6158 (void)rnd; 6159 (void)table; 6160 (void)quic_sslctx; 6161 (void)cfg; 6162 sock_close(fd); 6163 return NULL; 6164 #endif /* HAVE_NGTCP2 */ 6165 } 6166 6167 static struct comm_point* 6168 comm_point_create_tcp_handler(struct comm_base *base, 6169 struct comm_point* parent, size_t bufsize, 6170 struct sldns_buffer* spoolbuf, comm_point_callback_type* callback, 6171 void* callback_arg, struct unbound_socket* socket) 6172 { 6173 struct comm_point* c = (struct comm_point*)calloc(1, 6174 sizeof(struct comm_point)); 6175 short evbits; 6176 if(!c) 6177 return NULL; 6178 c->ev = (struct internal_event*)calloc(1, 6179 sizeof(struct internal_event)); 6180 if(!c->ev) { 6181 free(c); 6182 return NULL; 6183 } 6184 c->ev->base = base; 6185 c->fd = -1; 6186 c->buffer = sldns_buffer_new(bufsize); 6187 if(!c->buffer) { 6188 free(c->ev); 6189 free(c); 6190 return NULL; 6191 } 6192 c->timeout = (struct timeval*)malloc(sizeof(struct timeval)); 6193 if(!c->timeout) { 6194 sldns_buffer_free(c->buffer); 6195 free(c->ev); 6196 free(c); 6197 return NULL; 6198 } 6199 c->tcp_is_reading = 0; 6200 c->tcp_byte_count = 0; 6201 c->tcp_parent = parent; 6202 c->tcp_timeout_msec = parent->tcp_timeout_msec; 6203 c->tcp_conn_limit = parent->tcp_conn_limit; 6204 c->tcl_addr = NULL; 6205 c->tcp_keepalive = 0; 6206 c->max_tcp_count = 0; 6207 c->cur_tcp_count = 0; 6208 c->tcp_handlers = NULL; 6209 c->tcp_free = NULL; 6210 c->is_in_tcp_free = 0; 6211 c->type = comm_tcp; 6212 c->tcp_do_close = 0; 6213 c->do_not_close = 0; 6214 c->tcp_do_toggle_rw = 1; 6215 c->tcp_check_nb_connect = 0; 6216 #ifdef USE_MSG_FASTOPEN 6217 c->tcp_do_fastopen = 0; 6218 #endif 6219 #ifdef USE_DNSCRYPT 6220 c->dnscrypt = 0; 6221 /* We don't know just yet if this is a dnscrypt channel. Allocation 6222 * will be done when handling the callback. */ 6223 c->dnscrypt_buffer = c->buffer; 6224 #endif 6225 c->repinfo.c = c; 6226 c->callback = callback; 6227 c->cb_arg = callback_arg; 6228 c->socket = socket; 6229 c->pp2_enabled = parent->pp2_enabled; 6230 c->pp2_header_state = pp2_header_none; 6231 if(spoolbuf) { 6232 c->tcp_req_info = tcp_req_info_create(base, spoolbuf); 6233 if(!c->tcp_req_info) { 6234 log_err("could not create tcp commpoint"); 6235 sldns_buffer_free(c->buffer); 6236 free(c->timeout); 6237 free(c->ev); 6238 free(c); 6239 return NULL; 6240 } 6241 c->tcp_req_info->cp = c; 6242 c->tcp_do_close = 1; 6243 c->tcp_do_toggle_rw = 0; 6244 } 6245 /* add to parent free list */ 6246 c->tcp_free = parent->tcp_free; 6247 parent->tcp_free = c; 6248 c->is_in_tcp_free = 1; 6249 /* ub_event stuff */ 6250 evbits = UB_EV_PERSIST | UB_EV_READ | UB_EV_TIMEOUT; 6251 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6252 comm_point_tcp_handle_callback, c); 6253 if(c->ev->ev == NULL) 6254 { 6255 log_err("could not basetset tcphdl event"); 6256 parent->tcp_free = c->tcp_free; 6257 tcp_req_info_delete(c->tcp_req_info); 6258 sldns_buffer_free(c->buffer); 6259 free(c->timeout); 6260 free(c->ev); 6261 free(c); 6262 return NULL; 6263 } 6264 return c; 6265 } 6266 6267 static struct comm_point* 6268 comm_point_create_http_handler(struct comm_base *base, 6269 struct comm_point* parent, size_t bufsize, int harden_large_queries, 6270 uint32_t http_max_streams, char* http_endpoint, 6271 comm_point_callback_type* callback, void* callback_arg, 6272 struct unbound_socket* socket) 6273 { 6274 struct comm_point* c = (struct comm_point*)calloc(1, 6275 sizeof(struct comm_point)); 6276 short evbits; 6277 if(!c) 6278 return NULL; 6279 c->ev = (struct internal_event*)calloc(1, 6280 sizeof(struct internal_event)); 6281 if(!c->ev) { 6282 free(c); 6283 return NULL; 6284 } 6285 c->ev->base = base; 6286 c->fd = -1; 6287 c->buffer = sldns_buffer_new(bufsize); 6288 if(!c->buffer) { 6289 free(c->ev); 6290 free(c); 6291 return NULL; 6292 } 6293 c->timeout = (struct timeval*)malloc(sizeof(struct timeval)); 6294 if(!c->timeout) { 6295 sldns_buffer_free(c->buffer); 6296 free(c->ev); 6297 free(c); 6298 return NULL; 6299 } 6300 c->tcp_is_reading = 0; 6301 c->tcp_byte_count = 0; 6302 c->tcp_parent = parent; 6303 c->tcp_timeout_msec = parent->tcp_timeout_msec; 6304 c->tcp_conn_limit = parent->tcp_conn_limit; 6305 c->tcl_addr = NULL; 6306 c->tcp_keepalive = 0; 6307 c->max_tcp_count = 0; 6308 c->cur_tcp_count = 0; 6309 c->tcp_handlers = NULL; 6310 c->tcp_free = NULL; 6311 c->is_in_tcp_free = 0; 6312 c->type = comm_http; 6313 c->tcp_do_close = 1; 6314 c->do_not_close = 0; 6315 c->tcp_do_toggle_rw = 1; /* will be set to 0 after http2 upgrade */ 6316 c->tcp_check_nb_connect = 0; 6317 #ifdef USE_MSG_FASTOPEN 6318 c->tcp_do_fastopen = 0; 6319 #endif 6320 #ifdef USE_DNSCRYPT 6321 c->dnscrypt = 0; 6322 c->dnscrypt_buffer = NULL; 6323 #endif 6324 c->repinfo.c = c; 6325 c->callback = callback; 6326 c->cb_arg = callback_arg; 6327 c->socket = socket; 6328 c->pp2_enabled = 0; 6329 c->pp2_header_state = pp2_header_none; 6330 6331 c->http_min_version = http_version_2; 6332 c->http2_stream_max_qbuffer_size = bufsize; 6333 if(harden_large_queries && bufsize > 512) 6334 c->http2_stream_max_qbuffer_size = 512; 6335 c->http2_max_streams = http_max_streams; 6336 if(!(c->http_endpoint = strdup(http_endpoint))) { 6337 log_err("could not strdup http_endpoint"); 6338 sldns_buffer_free(c->buffer); 6339 free(c->timeout); 6340 free(c->ev); 6341 free(c); 6342 return NULL; 6343 } 6344 c->use_h2 = 0; 6345 #ifdef HAVE_NGHTTP2 6346 if(!(c->h2_session = http2_session_create(c))) { 6347 log_err("could not create http2 session"); 6348 free(c->http_endpoint); 6349 sldns_buffer_free(c->buffer); 6350 free(c->timeout); 6351 free(c->ev); 6352 free(c); 6353 return NULL; 6354 } 6355 if(!(c->h2_session->callbacks = http2_req_callbacks_create())) { 6356 log_err("could not create http2 callbacks"); 6357 http2_session_delete(c->h2_session); 6358 free(c->http_endpoint); 6359 sldns_buffer_free(c->buffer); 6360 free(c->timeout); 6361 free(c->ev); 6362 free(c); 6363 return NULL; 6364 } 6365 #endif 6366 6367 /* add to parent free list */ 6368 c->tcp_free = parent->tcp_free; 6369 parent->tcp_free = c; 6370 c->is_in_tcp_free = 1; 6371 /* ub_event stuff */ 6372 evbits = UB_EV_PERSIST | UB_EV_READ | UB_EV_TIMEOUT; 6373 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6374 comm_point_http_handle_callback, c); 6375 if(c->ev->ev == NULL) 6376 { 6377 log_err("could not set http handler event"); 6378 parent->tcp_free = c->tcp_free; 6379 http2_session_delete(c->h2_session); 6380 sldns_buffer_free(c->buffer); 6381 free(c->timeout); 6382 free(c->ev); 6383 free(c); 6384 return NULL; 6385 } 6386 return c; 6387 } 6388 6389 struct comm_point* 6390 comm_point_create_tcp(struct comm_base *base, int fd, int num, 6391 int idle_timeout, int harden_large_queries, 6392 uint32_t http_max_streams, char* http_endpoint, 6393 struct tcl_list* tcp_conn_limit, size_t bufsize, 6394 struct sldns_buffer* spoolbuf, enum listen_type port_type, 6395 int pp2_enabled, comm_point_callback_type* callback, 6396 void* callback_arg, struct unbound_socket* socket) 6397 { 6398 struct comm_point* c = (struct comm_point*)calloc(1, 6399 sizeof(struct comm_point)); 6400 short evbits; 6401 int i; 6402 /* first allocate the TCP accept listener */ 6403 if(!c) 6404 return NULL; 6405 c->ev = (struct internal_event*)calloc(1, 6406 sizeof(struct internal_event)); 6407 if(!c->ev) { 6408 free(c); 6409 return NULL; 6410 } 6411 c->ev->base = base; 6412 c->fd = fd; 6413 c->buffer = NULL; 6414 c->timeout = NULL; 6415 c->tcp_is_reading = 0; 6416 c->tcp_byte_count = 0; 6417 c->tcp_timeout_msec = idle_timeout; 6418 c->tcp_conn_limit = tcp_conn_limit; 6419 c->tcl_addr = NULL; 6420 c->tcp_keepalive = 0; 6421 c->tcp_parent = NULL; 6422 c->max_tcp_count = num; 6423 c->cur_tcp_count = 0; 6424 c->tcp_handlers = (struct comm_point**)calloc((size_t)num, 6425 sizeof(struct comm_point*)); 6426 if(!c->tcp_handlers) { 6427 free(c->ev); 6428 free(c); 6429 return NULL; 6430 } 6431 c->tcp_free = NULL; 6432 c->is_in_tcp_free = 0; 6433 c->type = comm_tcp_accept; 6434 c->tcp_do_close = 0; 6435 c->do_not_close = 0; 6436 c->tcp_do_toggle_rw = 0; 6437 c->tcp_check_nb_connect = 0; 6438 #ifdef USE_MSG_FASTOPEN 6439 c->tcp_do_fastopen = 0; 6440 #endif 6441 #ifdef USE_DNSCRYPT 6442 c->dnscrypt = 0; 6443 c->dnscrypt_buffer = NULL; 6444 #endif 6445 c->callback = NULL; 6446 c->cb_arg = NULL; 6447 c->socket = socket; 6448 c->pp2_enabled = (port_type==listen_type_http?0:pp2_enabled); 6449 c->pp2_header_state = pp2_header_none; 6450 evbits = UB_EV_READ | UB_EV_PERSIST; 6451 /* ub_event stuff */ 6452 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6453 comm_point_tcp_accept_callback, c); 6454 if(c->ev->ev == NULL) { 6455 log_err("could not baseset tcpacc event"); 6456 comm_point_delete(c); 6457 return NULL; 6458 } 6459 if (ub_event_add(c->ev->ev, c->timeout) != 0) { 6460 log_err("could not add tcpacc event"); 6461 comm_point_delete(c); 6462 return NULL; 6463 } 6464 c->event_added = 1; 6465 /* now prealloc the handlers */ 6466 for(i=0; i<num; i++) { 6467 if(port_type == listen_type_tcp || 6468 port_type == listen_type_ssl || 6469 port_type == listen_type_tcp_dnscrypt) { 6470 c->tcp_handlers[i] = comm_point_create_tcp_handler(base, 6471 c, bufsize, spoolbuf, callback, callback_arg, socket); 6472 } else if(port_type == listen_type_http) { 6473 c->tcp_handlers[i] = comm_point_create_http_handler( 6474 base, c, bufsize, harden_large_queries, 6475 http_max_streams, http_endpoint, 6476 callback, callback_arg, socket); 6477 } 6478 else { 6479 log_err("could not create tcp handler, unknown listen " 6480 "type"); 6481 return NULL; 6482 } 6483 if(!c->tcp_handlers[i]) { 6484 comm_point_delete(c); 6485 return NULL; 6486 } 6487 } 6488 6489 return c; 6490 } 6491 6492 struct comm_point* 6493 comm_point_create_tcp_out(struct comm_base *base, size_t bufsize, 6494 comm_point_callback_type* callback, void* callback_arg) 6495 { 6496 struct comm_point* c = (struct comm_point*)calloc(1, 6497 sizeof(struct comm_point)); 6498 short evbits; 6499 if(!c) 6500 return NULL; 6501 c->ev = (struct internal_event*)calloc(1, 6502 sizeof(struct internal_event)); 6503 if(!c->ev) { 6504 free(c); 6505 return NULL; 6506 } 6507 c->ev->base = base; 6508 c->fd = -1; 6509 c->buffer = sldns_buffer_new(bufsize); 6510 if(!c->buffer) { 6511 free(c->ev); 6512 free(c); 6513 return NULL; 6514 } 6515 c->timeout = NULL; 6516 c->tcp_is_reading = 0; 6517 c->tcp_byte_count = 0; 6518 c->tcp_timeout_msec = TCP_QUERY_TIMEOUT; 6519 c->tcp_conn_limit = NULL; 6520 c->tcl_addr = NULL; 6521 c->tcp_keepalive = 0; 6522 c->tcp_parent = NULL; 6523 c->max_tcp_count = 0; 6524 c->cur_tcp_count = 0; 6525 c->tcp_handlers = NULL; 6526 c->tcp_free = NULL; 6527 c->is_in_tcp_free = 0; 6528 c->type = comm_tcp; 6529 c->tcp_do_close = 0; 6530 c->do_not_close = 0; 6531 c->tcp_do_toggle_rw = 1; 6532 c->tcp_check_nb_connect = 1; 6533 #ifdef USE_MSG_FASTOPEN 6534 c->tcp_do_fastopen = 1; 6535 #endif 6536 #ifdef USE_DNSCRYPT 6537 c->dnscrypt = 0; 6538 c->dnscrypt_buffer = c->buffer; 6539 #endif 6540 c->repinfo.c = c; 6541 c->callback = callback; 6542 c->cb_arg = callback_arg; 6543 c->pp2_enabled = 0; 6544 c->pp2_header_state = pp2_header_none; 6545 evbits = UB_EV_PERSIST | UB_EV_WRITE; 6546 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6547 comm_point_tcp_handle_callback, c); 6548 if(c->ev->ev == NULL) 6549 { 6550 log_err("could not baseset tcpout event"); 6551 sldns_buffer_free(c->buffer); 6552 free(c->ev); 6553 free(c); 6554 return NULL; 6555 } 6556 6557 return c; 6558 } 6559 6560 struct comm_point* 6561 comm_point_create_http_out(struct comm_base *base, size_t bufsize, 6562 comm_point_callback_type* callback, void* callback_arg, 6563 sldns_buffer* temp) 6564 { 6565 struct comm_point* c = (struct comm_point*)calloc(1, 6566 sizeof(struct comm_point)); 6567 short evbits; 6568 if(!c) 6569 return NULL; 6570 c->ev = (struct internal_event*)calloc(1, 6571 sizeof(struct internal_event)); 6572 if(!c->ev) { 6573 free(c); 6574 return NULL; 6575 } 6576 c->ev->base = base; 6577 c->fd = -1; 6578 c->buffer = sldns_buffer_new(bufsize); 6579 if(!c->buffer) { 6580 free(c->ev); 6581 free(c); 6582 return NULL; 6583 } 6584 c->timeout = NULL; 6585 c->tcp_is_reading = 0; 6586 c->tcp_byte_count = 0; 6587 c->tcp_parent = NULL; 6588 c->max_tcp_count = 0; 6589 c->cur_tcp_count = 0; 6590 c->tcp_handlers = NULL; 6591 c->tcp_free = NULL; 6592 c->is_in_tcp_free = 0; 6593 c->type = comm_http; 6594 c->tcp_do_close = 0; 6595 c->do_not_close = 0; 6596 c->tcp_do_toggle_rw = 1; 6597 c->tcp_check_nb_connect = 1; 6598 c->http_in_headers = 1; 6599 c->http_in_chunk_headers = 0; 6600 c->http_is_chunked = 0; 6601 c->http_temp = temp; 6602 #ifdef USE_MSG_FASTOPEN 6603 c->tcp_do_fastopen = 1; 6604 #endif 6605 #ifdef USE_DNSCRYPT 6606 c->dnscrypt = 0; 6607 c->dnscrypt_buffer = c->buffer; 6608 #endif 6609 c->repinfo.c = c; 6610 c->callback = callback; 6611 c->cb_arg = callback_arg; 6612 c->pp2_enabled = 0; 6613 c->pp2_header_state = pp2_header_none; 6614 evbits = UB_EV_PERSIST | UB_EV_WRITE; 6615 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6616 comm_point_http_handle_callback, c); 6617 if(c->ev->ev == NULL) 6618 { 6619 log_err("could not baseset tcpout event"); 6620 #ifdef HAVE_SSL 6621 SSL_free(c->ssl); 6622 #endif 6623 sldns_buffer_free(c->buffer); 6624 free(c->ev); 6625 free(c); 6626 return NULL; 6627 } 6628 6629 return c; 6630 } 6631 6632 struct comm_point* 6633 comm_point_create_local(struct comm_base *base, int fd, size_t bufsize, 6634 comm_point_callback_type* callback, void* callback_arg) 6635 { 6636 struct comm_point* c = (struct comm_point*)calloc(1, 6637 sizeof(struct comm_point)); 6638 short evbits; 6639 if(!c) 6640 return NULL; 6641 c->ev = (struct internal_event*)calloc(1, 6642 sizeof(struct internal_event)); 6643 if(!c->ev) { 6644 free(c); 6645 return NULL; 6646 } 6647 c->ev->base = base; 6648 c->fd = fd; 6649 c->buffer = sldns_buffer_new(bufsize); 6650 if(!c->buffer) { 6651 free(c->ev); 6652 free(c); 6653 return NULL; 6654 } 6655 c->timeout = NULL; 6656 c->tcp_is_reading = 1; 6657 c->tcp_byte_count = 0; 6658 c->tcp_parent = NULL; 6659 c->max_tcp_count = 0; 6660 c->cur_tcp_count = 0; 6661 c->tcp_handlers = NULL; 6662 c->tcp_free = NULL; 6663 c->is_in_tcp_free = 0; 6664 c->type = comm_local; 6665 c->tcp_do_close = 0; 6666 c->do_not_close = 1; 6667 c->tcp_do_toggle_rw = 0; 6668 c->tcp_check_nb_connect = 0; 6669 #ifdef USE_MSG_FASTOPEN 6670 c->tcp_do_fastopen = 0; 6671 #endif 6672 #ifdef USE_DNSCRYPT 6673 c->dnscrypt = 0; 6674 c->dnscrypt_buffer = c->buffer; 6675 #endif 6676 c->callback = callback; 6677 c->cb_arg = callback_arg; 6678 c->pp2_enabled = 0; 6679 c->pp2_header_state = pp2_header_none; 6680 /* ub_event stuff */ 6681 evbits = UB_EV_PERSIST | UB_EV_READ; 6682 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6683 comm_point_local_handle_callback, c); 6684 if(c->ev->ev == NULL) { 6685 log_err("could not baseset localhdl event"); 6686 free(c->ev); 6687 free(c); 6688 return NULL; 6689 } 6690 if (ub_event_add(c->ev->ev, c->timeout) != 0) { 6691 log_err("could not add localhdl event"); 6692 ub_event_free(c->ev->ev); 6693 free(c->ev); 6694 free(c); 6695 return NULL; 6696 } 6697 c->event_added = 1; 6698 return c; 6699 } 6700 6701 struct comm_point* 6702 comm_point_create_raw(struct comm_base* base, int fd, int writing, 6703 comm_point_callback_type* callback, void* callback_arg) 6704 { 6705 struct comm_point* c = (struct comm_point*)calloc(1, 6706 sizeof(struct comm_point)); 6707 short evbits; 6708 if(!c) 6709 return NULL; 6710 c->ev = (struct internal_event*)calloc(1, 6711 sizeof(struct internal_event)); 6712 if(!c->ev) { 6713 free(c); 6714 return NULL; 6715 } 6716 c->ev->base = base; 6717 c->fd = fd; 6718 c->buffer = NULL; 6719 c->timeout = NULL; 6720 c->tcp_is_reading = 0; 6721 c->tcp_byte_count = 0; 6722 c->tcp_parent = NULL; 6723 c->max_tcp_count = 0; 6724 c->cur_tcp_count = 0; 6725 c->tcp_handlers = NULL; 6726 c->tcp_free = NULL; 6727 c->is_in_tcp_free = 0; 6728 c->type = comm_raw; 6729 c->tcp_do_close = 0; 6730 c->do_not_close = 1; 6731 c->tcp_do_toggle_rw = 0; 6732 c->tcp_check_nb_connect = 0; 6733 #ifdef USE_MSG_FASTOPEN 6734 c->tcp_do_fastopen = 0; 6735 #endif 6736 #ifdef USE_DNSCRYPT 6737 c->dnscrypt = 0; 6738 c->dnscrypt_buffer = c->buffer; 6739 #endif 6740 c->callback = callback; 6741 c->cb_arg = callback_arg; 6742 c->pp2_enabled = 0; 6743 c->pp2_header_state = pp2_header_none; 6744 /* ub_event stuff */ 6745 if(writing) 6746 evbits = UB_EV_PERSIST | UB_EV_WRITE; 6747 else evbits = UB_EV_PERSIST | UB_EV_READ; 6748 c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, 6749 comm_point_raw_handle_callback, c); 6750 if(c->ev->ev == NULL) { 6751 log_err("could not baseset rawhdl event"); 6752 free(c->ev); 6753 free(c); 6754 return NULL; 6755 } 6756 if (ub_event_add(c->ev->ev, c->timeout) != 0) { 6757 log_err("could not add rawhdl event"); 6758 ub_event_free(c->ev->ev); 6759 free(c->ev); 6760 free(c); 6761 return NULL; 6762 } 6763 c->event_added = 1; 6764 return c; 6765 } 6766 6767 void 6768 comm_point_close(struct comm_point* c) 6769 { 6770 if(!c) 6771 return; 6772 if(c->fd != -1) { 6773 verbose(5, "comm_point_close of %d: event_del", c->fd); 6774 if(c->event_added) { 6775 if(ub_event_del(c->ev->ev) != 0) { 6776 log_err("could not event_del on close"); 6777 } 6778 c->event_added = 0; 6779 } 6780 } 6781 if(c->tcl_addr) { 6782 tcl_close_connection(c->tcl_addr); 6783 c->tcl_addr = NULL; 6784 } 6785 if(c->tcp_req_info) 6786 tcp_req_info_clear(c->tcp_req_info); 6787 if(c->h2_session) 6788 http2_session_server_delete(c->h2_session); 6789 /* stop the comm point from reading or writing after it is closed. */ 6790 if(c->tcp_more_read_again && *c->tcp_more_read_again) 6791 *c->tcp_more_read_again = 0; 6792 if(c->tcp_more_write_again && *c->tcp_more_write_again) 6793 *c->tcp_more_write_again = 0; 6794 if(c->tcp_more_read_again_timer && 6795 comm_timer_is_set(c->tcp_more_read_again_timer)) 6796 comm_timer_disable(c->tcp_more_read_again_timer); 6797 6798 /* close fd after removing from event lists, or epoll.. is messed up */ 6799 if(c->fd != -1 && !c->do_not_close) { 6800 #ifdef USE_WINSOCK 6801 if(c->type == comm_tcp || c->type == comm_http) { 6802 /* delete sticky events for the fd, it gets closed */ 6803 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ); 6804 ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE); 6805 } 6806 #endif 6807 verbose(VERB_ALGO, "close fd %d", c->fd); 6808 sock_close(c->fd); 6809 } 6810 c->fd = -1; 6811 } 6812 6813 void 6814 comm_point_delete(struct comm_point* c) 6815 { 6816 if(!c) 6817 return; 6818 if((c->type == comm_tcp || c->type == comm_http) && c->ssl) { 6819 #ifdef HAVE_SSL 6820 SSL_shutdown(c->ssl); 6821 SSL_free(c->ssl); 6822 #endif 6823 } 6824 if(c->type == comm_http && c->http_endpoint) { 6825 free(c->http_endpoint); 6826 c->http_endpoint = NULL; 6827 } 6828 comm_point_close(c); 6829 if(c->tcp_handlers) { 6830 int i; 6831 for(i=0; i<c->max_tcp_count; i++) 6832 comm_point_delete(c->tcp_handlers[i]); 6833 free(c->tcp_handlers); 6834 } 6835 free(c->timeout); 6836 comm_timer_delete(c->tcp_more_read_again_timer); 6837 if(c->type == comm_tcp || c->type == comm_local || c->type == comm_http) { 6838 sldns_buffer_free(c->buffer); 6839 #ifdef USE_DNSCRYPT 6840 if(c->dnscrypt && c->dnscrypt_buffer != c->buffer) { 6841 sldns_buffer_free(c->dnscrypt_buffer); 6842 } 6843 #endif 6844 if(c->tcp_req_info) { 6845 tcp_req_info_delete(c->tcp_req_info); 6846 } 6847 if(c->h2_session) { 6848 http2_session_delete(c->h2_session); 6849 } 6850 } 6851 #ifdef HAVE_NGTCP2 6852 if(c->doq_socket) 6853 doq_server_socket_delete(c->doq_socket); 6854 #endif 6855 ub_event_free(c->ev->ev); 6856 free(c->ev); 6857 free(c); 6858 } 6859 6860 #ifdef USE_DNSTAP 6861 static void 6862 send_reply_dnstap(struct dt_env* dtenv, 6863 struct sockaddr* addr, socklen_t addrlen, 6864 struct sockaddr_storage* client_addr, socklen_t client_addrlen, 6865 enum comm_point_type type, void* ssl, sldns_buffer* buffer) 6866 { 6867 log_addr(VERB_ALGO, "from local addr", (void*)addr, addrlen); 6868 log_addr(VERB_ALGO, "response to client", client_addr, client_addrlen); 6869 dt_msg_send_client_response(dtenv, client_addr, 6870 (struct sockaddr_storage*)addr, type, ssl, buffer); 6871 } 6872 #endif 6873 6874 void 6875 comm_point_send_reply(struct comm_reply *repinfo) 6876 { 6877 struct sldns_buffer* buffer; 6878 log_assert(repinfo && repinfo->c); 6879 #ifdef USE_DNSCRYPT 6880 buffer = repinfo->c->dnscrypt_buffer; 6881 if(!dnsc_handle_uncurved_request(repinfo, 6882 repinfo->c->tcp_req_info? 6883 repinfo->c->tcp_req_info->spool_buffer:repinfo->c->buffer)) { 6884 return; 6885 } 6886 #else 6887 buffer = repinfo->c->buffer; 6888 #endif 6889 if(repinfo->c->type == comm_udp) { 6890 if(repinfo->srctype) 6891 comm_point_send_udp_msg_if(repinfo->c, buffer, 6892 (struct sockaddr*)&repinfo->remote_addr, 6893 repinfo->remote_addrlen, repinfo); 6894 else 6895 comm_point_send_udp_msg(repinfo->c, buffer, 6896 (struct sockaddr*)&repinfo->remote_addr, 6897 repinfo->remote_addrlen, 0); 6898 #ifdef USE_DNSTAP 6899 /* 6900 * sending src (client)/dst (local service) addresses over 6901 * DNSTAP from udp callback 6902 */ 6903 if(repinfo->c->dtenv != NULL && repinfo->c->dtenv->log_client_response_messages) { 6904 send_reply_dnstap(repinfo->c->dtenv, 6905 repinfo->c->socket->addr, 6906 repinfo->c->socket->addrlen, 6907 &repinfo->client_addr, repinfo->client_addrlen, 6908 repinfo->c->type, repinfo->c->ssl, 6909 repinfo->c->buffer); 6910 } 6911 #endif 6912 } else { 6913 #ifdef USE_DNSTAP 6914 struct dt_env* dtenv = 6915 #ifdef HAVE_NGTCP2 6916 repinfo->c->doq_socket 6917 ?repinfo->c->dtenv: 6918 #endif 6919 repinfo->c->tcp_parent->dtenv; 6920 struct sldns_buffer* dtbuffer = repinfo->c->tcp_req_info 6921 ?repinfo->c->tcp_req_info->spool_buffer 6922 :repinfo->c->buffer; 6923 #ifdef USE_DNSCRYPT 6924 if(repinfo->c->dnscrypt && repinfo->is_dnscrypted) 6925 dtbuffer = repinfo->c->buffer; 6926 #endif 6927 /* 6928 * sending src (client)/dst (local service) addresses over 6929 * DNSTAP from other callbacks 6930 */ 6931 if(dtenv != NULL && dtenv->log_client_response_messages) { 6932 send_reply_dnstap(dtenv, 6933 repinfo->c->socket->addr, 6934 repinfo->c->socket->addrlen, 6935 &repinfo->client_addr, repinfo->client_addrlen, 6936 repinfo->c->type, repinfo->c->ssl, 6937 dtbuffer); 6938 } 6939 #endif 6940 if(repinfo->c->tcp_req_info) { 6941 tcp_req_info_send_reply(repinfo->c->tcp_req_info); 6942 } else if(repinfo->c->use_h2) { 6943 if(!http2_submit_dns_response(repinfo->c->h2_session)) { 6944 return; 6945 } 6946 repinfo->c->h2_stream = NULL; 6947 repinfo->c->tcp_is_reading = 0; 6948 comm_point_stop_listening(repinfo->c); 6949 comm_point_start_listening(repinfo->c, -1, 6950 adjusted_tcp_timeout(repinfo->c)); 6951 return; 6952 #ifdef HAVE_NGTCP2 6953 } else if(repinfo->c->doq_socket) { 6954 doq_socket_send_reply(repinfo); 6955 #endif 6956 } else { 6957 comm_point_start_listening(repinfo->c, -1, 6958 adjusted_tcp_timeout(repinfo->c)); 6959 } 6960 } 6961 } 6962 6963 void 6964 comm_point_drop_reply(struct comm_reply* repinfo) 6965 { 6966 if(!repinfo) 6967 return; 6968 log_assert(repinfo->c); 6969 log_assert(repinfo->c->type != comm_tcp_accept); 6970 if(repinfo->c->type == comm_udp) 6971 return; 6972 if(repinfo->c->tcp_req_info) 6973 repinfo->c->tcp_req_info->is_drop = 1; 6974 if(repinfo->c->type == comm_http) { 6975 if(repinfo->c->h2_session) { 6976 repinfo->c->h2_session->is_drop = 1; 6977 http2_session_clear_meshstate(repinfo->c->h2_session); 6978 if(!repinfo->c->h2_session->postpone_drop) 6979 reclaim_http_handler(repinfo->c); 6980 return; 6981 } 6982 reclaim_http_handler(repinfo->c); 6983 return; 6984 #ifdef HAVE_NGTCP2 6985 } else if(repinfo->c->doq_socket) { 6986 doq_socket_drop_reply(repinfo); 6987 return; 6988 #endif 6989 } 6990 reclaim_tcp_handler(repinfo->c); 6991 } 6992 6993 void 6994 comm_point_stop_listening(struct comm_point* c) 6995 { 6996 verbose(VERB_ALGO, "comm point stop listening %d", c->fd); 6997 if(c->event_added) { 6998 if(ub_event_del(c->ev->ev) != 0) { 6999 log_err("event_del error to stoplisten"); 7000 } 7001 c->event_added = 0; 7002 } 7003 } 7004 7005 void 7006 comm_point_start_listening(struct comm_point* c, int newfd, int msec) 7007 { 7008 verbose(VERB_ALGO, "comm point start listening %d (%d msec)", 7009 c->fd==-1?newfd:c->fd, msec); 7010 if(c->type == comm_tcp_accept && !c->tcp_free) { 7011 /* no use to start listening no free slots. */ 7012 return; 7013 } 7014 if(c->event_added) { 7015 if(ub_event_del(c->ev->ev) != 0) { 7016 log_err("event_del error to startlisten"); 7017 } 7018 c->event_added = 0; 7019 } 7020 if(msec != -1 && msec != 0) { 7021 if(!c->timeout) { 7022 c->timeout = (struct timeval*)malloc(sizeof( 7023 struct timeval)); 7024 if(!c->timeout) { 7025 log_err("cpsl: malloc failed. No net read."); 7026 return; 7027 } 7028 } 7029 ub_event_add_bits(c->ev->ev, UB_EV_TIMEOUT); 7030 #ifndef S_SPLINT_S /* splint fails on struct timeval. */ 7031 c->timeout->tv_sec = msec/1000; 7032 c->timeout->tv_usec = (msec%1000)*1000; 7033 #endif /* S_SPLINT_S */ 7034 } else { 7035 if(msec == 0 || !c->timeout) { 7036 ub_event_del_bits(c->ev->ev, UB_EV_TIMEOUT); 7037 } 7038 } 7039 if(c->type == comm_tcp || c->type == comm_http) { 7040 ub_event_del_bits(c->ev->ev, UB_EV_READ|UB_EV_WRITE); 7041 if(c->tcp_write_and_read) { 7042 verbose(5, "startlistening %d mode rw", (newfd==-1?c->fd:newfd)); 7043 ub_event_add_bits(c->ev->ev, UB_EV_READ|UB_EV_WRITE); 7044 } else if(c->tcp_is_reading) { 7045 verbose(5, "startlistening %d mode r", (newfd==-1?c->fd:newfd)); 7046 ub_event_add_bits(c->ev->ev, UB_EV_READ); 7047 } else { 7048 verbose(5, "startlistening %d mode w", (newfd==-1?c->fd:newfd)); 7049 ub_event_add_bits(c->ev->ev, UB_EV_WRITE); 7050 } 7051 } 7052 if(newfd != -1) { 7053 if(c->fd != -1 && c->fd != newfd) { 7054 verbose(5, "cpsl close of fd %d for %d", c->fd, newfd); 7055 sock_close(c->fd); 7056 } 7057 c->fd = newfd; 7058 ub_event_set_fd(c->ev->ev, c->fd); 7059 } 7060 if(ub_event_add(c->ev->ev, msec==0?NULL:c->timeout) != 0) { 7061 log_err("event_add failed. in cpsl."); 7062 return; 7063 } 7064 c->event_added = 1; 7065 } 7066 7067 void comm_point_listen_for_rw(struct comm_point* c, int rd, int wr) 7068 { 7069 verbose(VERB_ALGO, "comm point listen_for_rw %d %d", c->fd, wr); 7070 if(c->event_added) { 7071 if(ub_event_del(c->ev->ev) != 0) { 7072 log_err("event_del error to cplf"); 7073 } 7074 c->event_added = 0; 7075 } 7076 if(!c->timeout) { 7077 ub_event_del_bits(c->ev->ev, UB_EV_TIMEOUT); 7078 } 7079 ub_event_del_bits(c->ev->ev, UB_EV_READ|UB_EV_WRITE); 7080 if(rd) ub_event_add_bits(c->ev->ev, UB_EV_READ); 7081 if(wr) ub_event_add_bits(c->ev->ev, UB_EV_WRITE); 7082 if(ub_event_add(c->ev->ev, c->timeout) != 0) { 7083 log_err("event_add failed. in cplf."); 7084 return; 7085 } 7086 c->event_added = 1; 7087 } 7088 7089 size_t comm_point_get_mem(struct comm_point* c) 7090 { 7091 size_t s; 7092 if(!c) 7093 return 0; 7094 s = sizeof(*c) + sizeof(*c->ev); 7095 if(c->timeout) 7096 s += sizeof(*c->timeout); 7097 if(c->type == comm_tcp || c->type == comm_local) { 7098 s += sizeof(*c->buffer) + sldns_buffer_capacity(c->buffer); 7099 #ifdef USE_DNSCRYPT 7100 s += sizeof(*c->dnscrypt_buffer); 7101 if(c->buffer != c->dnscrypt_buffer) { 7102 s += sldns_buffer_capacity(c->dnscrypt_buffer); 7103 } 7104 #endif 7105 } 7106 if(c->type == comm_tcp_accept) { 7107 int i; 7108 for(i=0; i<c->max_tcp_count; i++) 7109 s += comm_point_get_mem(c->tcp_handlers[i]); 7110 } 7111 return s; 7112 } 7113 7114 struct comm_timer* 7115 comm_timer_create(struct comm_base* base, void (*cb)(void*), void* cb_arg) 7116 { 7117 struct internal_timer *tm = (struct internal_timer*)calloc(1, 7118 sizeof(struct internal_timer)); 7119 if(!tm) { 7120 log_err("malloc failed"); 7121 return NULL; 7122 } 7123 tm->super.ev_timer = tm; 7124 tm->base = base; 7125 tm->super.callback = cb; 7126 tm->super.cb_arg = cb_arg; 7127 tm->ev = ub_event_new(base->eb->base, -1, UB_EV_TIMEOUT, 7128 comm_timer_callback, &tm->super); 7129 if(tm->ev == NULL) { 7130 log_err("timer_create: event_base_set failed."); 7131 free(tm); 7132 return NULL; 7133 } 7134 return &tm->super; 7135 } 7136 7137 void 7138 comm_timer_disable(struct comm_timer* timer) 7139 { 7140 if(!timer) 7141 return; 7142 ub_timer_del(timer->ev_timer->ev); 7143 timer->ev_timer->enabled = 0; 7144 } 7145 7146 void 7147 comm_timer_set(struct comm_timer* timer, struct timeval* tv) 7148 { 7149 log_assert(tv); 7150 if(timer->ev_timer->enabled) 7151 comm_timer_disable(timer); 7152 if(ub_timer_add(timer->ev_timer->ev, timer->ev_timer->base->eb->base, 7153 comm_timer_callback, timer, tv) != 0) 7154 log_err("comm_timer_set: evtimer_add failed."); 7155 timer->ev_timer->enabled = 1; 7156 } 7157 7158 void 7159 comm_timer_delete(struct comm_timer* timer) 7160 { 7161 if(!timer) 7162 return; 7163 comm_timer_disable(timer); 7164 /* Free the sub struct timer->ev_timer derived from the super struct timer. 7165 * i.e. assert(timer == timer->ev_timer) 7166 */ 7167 ub_event_free(timer->ev_timer->ev); 7168 free(timer->ev_timer); 7169 } 7170 7171 void 7172 comm_timer_callback(int ATTR_UNUSED(fd), short event, void* arg) 7173 { 7174 struct comm_timer* tm = (struct comm_timer*)arg; 7175 if(!(event&UB_EV_TIMEOUT)) 7176 return; 7177 ub_comm_base_now(tm->ev_timer->base); 7178 tm->ev_timer->enabled = 0; 7179 fptr_ok(fptr_whitelist_comm_timer(tm->callback)); 7180 (*tm->callback)(tm->cb_arg); 7181 } 7182 7183 int 7184 comm_timer_is_set(struct comm_timer* timer) 7185 { 7186 return (int)timer->ev_timer->enabled; 7187 } 7188 7189 size_t 7190 comm_timer_get_mem(struct comm_timer* timer) 7191 { 7192 if(!timer) return 0; 7193 return sizeof(struct internal_timer); 7194 } 7195 7196 struct comm_signal* 7197 comm_signal_create(struct comm_base* base, 7198 void (*callback)(int, void*), void* cb_arg) 7199 { 7200 struct comm_signal* com = (struct comm_signal*)malloc( 7201 sizeof(struct comm_signal)); 7202 if(!com) { 7203 log_err("malloc failed"); 7204 return NULL; 7205 } 7206 com->base = base; 7207 com->callback = callback; 7208 com->cb_arg = cb_arg; 7209 com->ev_signal = NULL; 7210 return com; 7211 } 7212 7213 void 7214 comm_signal_callback(int sig, short event, void* arg) 7215 { 7216 struct comm_signal* comsig = (struct comm_signal*)arg; 7217 if(!(event & UB_EV_SIGNAL)) 7218 return; 7219 ub_comm_base_now(comsig->base); 7220 fptr_ok(fptr_whitelist_comm_signal(comsig->callback)); 7221 (*comsig->callback)(sig, comsig->cb_arg); 7222 } 7223 7224 int 7225 comm_signal_bind(struct comm_signal* comsig, int sig) 7226 { 7227 struct internal_signal* entry = (struct internal_signal*)calloc(1, 7228 sizeof(struct internal_signal)); 7229 if(!entry) { 7230 log_err("malloc failed"); 7231 return 0; 7232 } 7233 log_assert(comsig); 7234 /* add signal event */ 7235 entry->ev = ub_signal_new(comsig->base->eb->base, sig, 7236 comm_signal_callback, comsig); 7237 if(entry->ev == NULL) { 7238 log_err("Could not create signal event"); 7239 free(entry); 7240 return 0; 7241 } 7242 if(ub_signal_add(entry->ev, NULL) != 0) { 7243 log_err("Could not add signal handler"); 7244 ub_event_free(entry->ev); 7245 free(entry); 7246 return 0; 7247 } 7248 /* link into list */ 7249 entry->next = comsig->ev_signal; 7250 comsig->ev_signal = entry; 7251 return 1; 7252 } 7253 7254 void 7255 comm_signal_delete(struct comm_signal* comsig) 7256 { 7257 struct internal_signal* p, *np; 7258 if(!comsig) 7259 return; 7260 p=comsig->ev_signal; 7261 while(p) { 7262 np = p->next; 7263 ub_signal_del(p->ev); 7264 ub_event_free(p->ev); 7265 free(p); 7266 p = np; 7267 } 7268 free(comsig); 7269 } 7270