1 /* 2 * daemon/remote.c - remote control for the unbound daemon. 3 * 4 * Copyright (c) 2008, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains the remote control functionality for the daemon. 40 * The remote control can be performed using either the commandline 41 * unbound-control tool, or a TLS capable web browser. 42 * The channel is secured using TLSv1, and certificates. 43 * Both the server and the client(control tool) have their own keys. 44 */ 45 #include "config.h" 46 #ifdef HAVE_OPENSSL_ERR_H 47 #include <openssl/err.h> 48 #endif 49 #ifdef HAVE_OPENSSL_DH_H 50 #include <openssl/dh.h> 51 #endif 52 #ifdef HAVE_OPENSSL_BN_H 53 #include <openssl/bn.h> 54 #endif 55 #ifdef HAVE_STDATOMIC_H 56 #include <stdatomic.h> 57 #endif 58 59 #include <ctype.h> 60 #include "daemon/remote.h" 61 #include "daemon/worker.h" 62 #include "daemon/daemon.h" 63 #include "daemon/stats.h" 64 #include "daemon/cachedump.h" 65 #include "util/log.h" 66 #include "util/config_file.h" 67 #include "util/net_help.h" 68 #include "util/module.h" 69 #include "util/ub_event.h" 70 #include "services/listen_dnsport.h" 71 #include "services/cache/rrset.h" 72 #include "services/cache/infra.h" 73 #include "services/mesh.h" 74 #include "services/localzone.h" 75 #include "services/authzone.h" 76 #include "services/rpz.h" 77 #include "util/storage/slabhash.h" 78 #include "util/fptr_wlist.h" 79 #include "util/data/dname.h" 80 #include "validator/validator.h" 81 #include "validator/val_kcache.h" 82 #include "validator/val_kentry.h" 83 #include "validator/val_anchor.h" 84 #include "validator/val_neg.h" 85 #include "iterator/iterator.h" 86 #include "iterator/iter_fwd.h" 87 #include "iterator/iter_hints.h" 88 #include "iterator/iter_delegpt.h" 89 #include "iterator/iter_utils.h" 90 #include "iterator/iter_donotq.h" 91 #include "iterator/iter_priv.h" 92 #include "services/outbound_list.h" 93 #include "services/outside_network.h" 94 #include "sldns/str2wire.h" 95 #include "sldns/parseutil.h" 96 #include "sldns/wire2str.h" 97 #include "sldns/sbuffer.h" 98 #include "util/timeval_func.h" 99 #include "util/tcp_conn_limit.h" 100 #include "util/edns.h" 101 #ifdef USE_CACHEDB 102 #include "cachedb/cachedb.h" 103 #endif 104 105 #ifdef HAVE_SYS_TYPES_H 106 # include <sys/types.h> 107 #endif 108 #ifdef HAVE_SYS_STAT_H 109 #include <sys/stat.h> 110 #endif 111 #ifdef HAVE_NETDB_H 112 #include <netdb.h> 113 #endif 114 #ifdef HAVE_POLL_H 115 #include <poll.h> 116 #endif 117 118 /* just for portability */ 119 #ifdef SQ 120 #undef SQ 121 #endif 122 123 /** what to put on statistics lines between var and value, ": " or "=" */ 124 #define SQ "=" 125 126 /** Acceptable lengths of str lines */ 127 #define MAX_CMD_STRLINE 1024 128 #define MAX_STDIN_STRLINE 2048 129 /** What number of loop iterations is too much for ipc retries */ 130 #define IPC_LOOP_MAX 200 131 /** Timeout in msec for ipc socket poll. */ 132 #define IPC_NOTIFICATION_WAIT 200 133 134 static void fr_printq_delete(struct fast_reload_printq* printq); 135 static void fr_main_perform_printout(struct fast_reload_thread* fr); 136 static int fr_printq_empty(struct fast_reload_printq* printq); 137 static void fr_printq_list_insert(struct fast_reload_printq* printq, 138 struct daemon* daemon); 139 static void fr_printq_remove(struct fast_reload_printq* printq); 140 static void fr_check_cmd_from_thread(struct fast_reload_thread* fr); 141 142 static int 143 remote_setup_ctx(struct daemon_remote* rc, struct config_file* cfg) 144 { 145 char* s_cert; 146 char* s_key; 147 rc->ctx = SSL_CTX_new(SSLv23_server_method()); 148 if(!rc->ctx) { 149 log_crypto_err("could not SSL_CTX_new"); 150 return 0; 151 } 152 if(!listen_sslctx_setup(rc->ctx)) { 153 return 0; 154 } 155 156 s_cert = fname_after_chroot(cfg->server_cert_file, cfg, 1); 157 s_key = fname_after_chroot(cfg->server_key_file, cfg, 1); 158 if(!s_cert || !s_key) { 159 log_err("out of memory in remote control fname"); 160 goto setup_error; 161 } 162 verbose(VERB_ALGO, "setup SSL certificates"); 163 if (!SSL_CTX_use_certificate_chain_file(rc->ctx,s_cert)) { 164 log_err("Error for server-cert-file: %s", s_cert); 165 log_crypto_err("Error in SSL_CTX use_certificate_chain_file"); 166 goto setup_error; 167 } 168 if(!SSL_CTX_use_PrivateKey_file(rc->ctx,s_key,SSL_FILETYPE_PEM)) { 169 log_err("Error for server-key-file: %s", s_key); 170 log_crypto_err("Error in SSL_CTX use_PrivateKey_file"); 171 goto setup_error; 172 } 173 if(!SSL_CTX_check_private_key(rc->ctx)) { 174 log_err("Error for server-key-file: %s", s_key); 175 log_crypto_err("Error in SSL_CTX check_private_key"); 176 goto setup_error; 177 } 178 listen_sslctx_setup_2(rc->ctx); 179 if(!SSL_CTX_load_verify_locations(rc->ctx, s_cert, NULL)) { 180 log_crypto_err("Error setting up SSL_CTX verify locations"); 181 setup_error: 182 free(s_cert); 183 free(s_key); 184 return 0; 185 } 186 SSL_CTX_set_client_CA_list(rc->ctx, SSL_load_client_CA_file(s_cert)); 187 SSL_CTX_set_verify(rc->ctx, SSL_VERIFY_PEER, NULL); 188 free(s_cert); 189 free(s_key); 190 return 1; 191 } 192 193 struct daemon_remote* 194 daemon_remote_create(struct config_file* cfg) 195 { 196 struct daemon_remote* rc = (struct daemon_remote*)calloc(1, 197 sizeof(*rc)); 198 if(!rc) { 199 log_err("out of memory in daemon_remote_create"); 200 return NULL; 201 } 202 rc->max_active = 10; 203 204 if(!cfg->remote_control_enable) { 205 rc->ctx = NULL; 206 return rc; 207 } 208 if(options_remote_is_address(cfg) && cfg->control_use_cert) { 209 if(!remote_setup_ctx(rc, cfg)) { 210 daemon_remote_delete(rc); 211 return NULL; 212 } 213 rc->use_cert = 1; 214 } else { 215 struct config_strlist* p; 216 rc->ctx = NULL; 217 rc->use_cert = 0; 218 if(!options_remote_is_address(cfg)) 219 for(p = cfg->control_ifs.first; p; p = p->next) { 220 if(p->str && p->str[0] != '/') 221 log_warn("control-interface %s is not using TLS, but plain transfer, because first control-interface in config file is a local socket (starts with a /).", p->str); 222 } 223 } 224 return rc; 225 } 226 227 void daemon_remote_clear(struct daemon_remote* rc) 228 { 229 struct rc_state* p, *np; 230 if(!rc) return; 231 /* but do not close the ports */ 232 listen_list_delete(rc->accept_list); 233 rc->accept_list = NULL; 234 /* do close these sockets */ 235 p = rc->busy_list; 236 while(p) { 237 np = p->next; 238 if(p->ssl) 239 SSL_free(p->ssl); 240 comm_point_delete(p->c); 241 free(p); 242 p = np; 243 } 244 rc->busy_list = NULL; 245 rc->active = 0; 246 rc->worker = NULL; 247 } 248 249 void daemon_remote_delete(struct daemon_remote* rc) 250 { 251 if(!rc) return; 252 daemon_remote_clear(rc); 253 if(rc->ctx) { 254 SSL_CTX_free(rc->ctx); 255 } 256 free(rc); 257 } 258 259 /** 260 * Add and open a new control port 261 * @param ip: ip str 262 * @param nr: port nr 263 * @param list: list head 264 * @param noproto_is_err: if lack of protocol support is an error. 265 * @param cfg: config with username for chown of unix-sockets. 266 * @return false on failure. 267 */ 268 static int 269 add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err, 270 struct config_file* cfg) 271 { 272 struct addrinfo hints; 273 struct addrinfo* res; 274 struct listen_port* n; 275 int noproto = 0; 276 int fd, r; 277 char port[15]; 278 snprintf(port, sizeof(port), "%d", nr); 279 port[sizeof(port)-1]=0; 280 memset(&hints, 0, sizeof(hints)); 281 log_assert(ip); 282 283 if(ip[0] == '/') { 284 /* This looks like a local socket */ 285 fd = create_local_accept_sock(ip, &noproto, cfg->use_systemd); 286 /* 287 * Change socket ownership and permissions so users other 288 * than root can access it provided they are in the same 289 * group as the user we run as. 290 */ 291 if(fd != -1) { 292 #ifdef HAVE_CHOWN 293 chmod(ip, (mode_t)(S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP)); 294 if (cfg->username && cfg->username[0] && 295 cfg_uid != (uid_t)-1) { 296 if(chown(ip, cfg_uid, cfg_gid) == -1) 297 verbose(VERB_QUERY, "cannot chown %u.%u %s: %s", 298 (unsigned)cfg_uid, (unsigned)cfg_gid, 299 ip, strerror(errno)); 300 } 301 #else 302 (void)cfg; 303 #endif 304 } 305 } else { 306 hints.ai_socktype = SOCK_STREAM; 307 hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST; 308 if((r = getaddrinfo(ip, port, &hints, &res)) != 0 || !res) { 309 #ifdef USE_WINSOCK 310 if(!noproto_is_err && r == EAI_NONAME) { 311 /* tried to lookup the address as name */ 312 return 1; /* return success, but do nothing */ 313 } 314 #endif /* USE_WINSOCK */ 315 log_err("control interface %s:%s getaddrinfo: %s %s", 316 ip?ip:"default", port, gai_strerror(r), 317 #ifdef EAI_SYSTEM 318 r==EAI_SYSTEM?(char*)strerror(errno):"" 319 #else 320 "" 321 #endif 322 ); 323 return 0; 324 } 325 326 /* open fd */ 327 fd = create_tcp_accept_sock(res, 1, &noproto, 0, 328 cfg->ip_transparent, 0, 0, cfg->ip_freebind, 329 cfg->use_systemd, cfg->ip_dscp, "unbound-control"); 330 freeaddrinfo(res); 331 } 332 333 if(fd == -1 && noproto) { 334 if(!noproto_is_err) 335 return 1; /* return success, but do nothing */ 336 log_err("cannot open control interface %s %d : " 337 "protocol not supported", ip, nr); 338 return 0; 339 } 340 if(fd == -1) { 341 log_err("cannot open control interface %s %d", ip, nr); 342 return 0; 343 } 344 345 /* alloc */ 346 n = (struct listen_port*)calloc(1, sizeof(*n)); 347 if(!n) { 348 sock_close(fd); 349 log_err("out of memory"); 350 return 0; 351 } 352 n->next = *list; 353 *list = n; 354 n->fd = fd; 355 return 1; 356 } 357 358 struct listen_port* daemon_remote_open_ports(struct config_file* cfg) 359 { 360 struct listen_port* l = NULL; 361 log_assert(cfg->remote_control_enable && cfg->control_port); 362 if(cfg->control_ifs.first) { 363 char** rcif = NULL; 364 int i, num_rcif = 0; 365 if(!resolve_interface_names(NULL, 0, cfg->control_ifs.first, 366 &rcif, &num_rcif)) { 367 return NULL; 368 } 369 for(i=0; i<num_rcif; i++) { 370 if(!add_open(rcif[i], cfg->control_port, &l, 1, cfg)) { 371 listening_ports_free(l); 372 config_del_strarray(rcif, num_rcif); 373 return NULL; 374 } 375 } 376 config_del_strarray(rcif, num_rcif); 377 } else { 378 /* defaults */ 379 if(cfg->do_ip6 && 380 !add_open("::1", cfg->control_port, &l, 0, cfg)) { 381 listening_ports_free(l); 382 return NULL; 383 } 384 if(cfg->do_ip4 && 385 !add_open("127.0.0.1", cfg->control_port, &l, 1, cfg)) { 386 listening_ports_free(l); 387 return NULL; 388 } 389 } 390 return l; 391 } 392 393 /** open accept commpoint */ 394 static int 395 accept_open(struct daemon_remote* rc, int fd) 396 { 397 struct listen_list* n = (struct listen_list*)malloc(sizeof(*n)); 398 if(!n) { 399 log_err("out of memory"); 400 return 0; 401 } 402 n->next = rc->accept_list; 403 rc->accept_list = n; 404 /* open commpt */ 405 n->com = comm_point_create_raw(rc->worker->base, fd, 0, 406 &remote_accept_callback, rc); 407 if(!n->com) 408 return 0; 409 /* keep this port open, its fd is kept in the rc portlist */ 410 n->com->do_not_close = 1; 411 return 1; 412 } 413 414 int daemon_remote_open_accept(struct daemon_remote* rc, 415 struct listen_port* ports, struct worker* worker) 416 { 417 struct listen_port* p; 418 rc->worker = worker; 419 for(p = ports; p; p = p->next) { 420 if(!accept_open(rc, p->fd)) { 421 log_err("could not create accept comm point"); 422 return 0; 423 } 424 } 425 return 1; 426 } 427 428 void daemon_remote_stop_accept(struct daemon_remote* rc) 429 { 430 struct listen_list* p; 431 for(p=rc->accept_list; p; p=p->next) { 432 comm_point_stop_listening(p->com); 433 } 434 } 435 436 void daemon_remote_start_accept(struct daemon_remote* rc) 437 { 438 struct listen_list* p; 439 for(p=rc->accept_list; p; p=p->next) { 440 comm_point_start_listening(p->com, -1, -1); 441 } 442 } 443 444 int remote_accept_callback(struct comm_point* c, void* arg, int err, 445 struct comm_reply* ATTR_UNUSED(rep)) 446 { 447 struct daemon_remote* rc = (struct daemon_remote*)arg; 448 struct sockaddr_storage addr; 449 socklen_t addrlen; 450 int newfd; 451 struct rc_state* n; 452 if(err != NETEVENT_NOERROR) { 453 log_err("error %d on remote_accept_callback", err); 454 return 0; 455 } 456 /* perform the accept */ 457 newfd = comm_point_perform_accept(c, &addr, &addrlen); 458 if(newfd == -1) 459 return 0; 460 /* create new commpoint unless we are servicing already */ 461 if(rc->active >= rc->max_active) { 462 log_warn("drop incoming remote control: too many connections"); 463 close_exit: 464 sock_close(newfd); 465 return 0; 466 } 467 468 /* setup commpoint to service the remote control command */ 469 n = (struct rc_state*)calloc(1, sizeof(*n)); 470 if(!n) { 471 log_err("out of memory"); 472 goto close_exit; 473 } 474 n->fd = newfd; 475 /* start in reading state */ 476 n->c = comm_point_create_raw(rc->worker->base, newfd, 0, 477 &remote_control_callback, n); 478 if(!n->c) { 479 log_err("out of memory"); 480 free(n); 481 goto close_exit; 482 } 483 log_addr(VERB_QUERY, "new control connection from", &addr, addrlen); 484 n->c->do_not_close = 0; 485 comm_point_stop_listening(n->c); 486 comm_point_start_listening(n->c, -1, REMOTE_CONTROL_TCP_TIMEOUT); 487 memcpy(&n->c->repinfo.remote_addr, &addr, addrlen); 488 n->c->repinfo.remote_addrlen = addrlen; 489 if(rc->use_cert) { 490 n->shake_state = rc_hs_read; 491 n->ssl = SSL_new(rc->ctx); 492 if(!n->ssl) { 493 log_crypto_err("could not SSL_new"); 494 comm_point_delete(n->c); 495 free(n); 496 goto close_exit; 497 } 498 SSL_set_accept_state(n->ssl); 499 (void)SSL_set_mode(n->ssl, (long)SSL_MODE_AUTO_RETRY); 500 if(!SSL_set_fd(n->ssl, newfd)) { 501 log_crypto_err("could not SSL_set_fd"); 502 SSL_free(n->ssl); 503 comm_point_delete(n->c); 504 free(n); 505 goto close_exit; 506 } 507 } else { 508 n->ssl = NULL; 509 } 510 511 n->rc = rc; 512 n->next = rc->busy_list; 513 rc->busy_list = n; 514 rc->active ++; 515 516 /* perform the first nonblocking read already, for windows, 517 * so it can return wouldblock. could be faster too. */ 518 (void)remote_control_callback(n->c, n, NETEVENT_NOERROR, NULL); 519 return 0; 520 } 521 522 /** delete from list */ 523 static void 524 state_list_remove_elem(struct rc_state** list, struct comm_point* c) 525 { 526 while(*list) { 527 if( (*list)->c == c) { 528 *list = (*list)->next; 529 return; 530 } 531 list = &(*list)->next; 532 } 533 } 534 535 /** decrease active count and remove commpoint from busy list */ 536 static void 537 clean_point(struct daemon_remote* rc, struct rc_state* s) 538 { 539 if(!s->rc) { 540 /* the state has been picked up and moved away */ 541 free(s); 542 return; 543 } 544 state_list_remove_elem(&rc->busy_list, s->c); 545 rc->active --; 546 if(s->ssl) { 547 SSL_shutdown(s->ssl); 548 SSL_free(s->ssl); 549 } 550 comm_point_delete(s->c); 551 free(s); 552 } 553 554 int 555 ssl_print_text(RES* res, const char* text) 556 { 557 int r; 558 if(!res) 559 return 0; 560 if(res->ssl) { 561 ERR_clear_error(); 562 if((r=SSL_write(res->ssl, text, (int)strlen(text))) <= 0) { 563 int r2; 564 if((r2=SSL_get_error(res->ssl, r)) == SSL_ERROR_ZERO_RETURN) { 565 verbose(VERB_QUERY, "warning, in SSL_write, peer " 566 "closed connection"); 567 return 0; 568 } 569 log_crypto_err_io("could not SSL_write", r2); 570 return 0; 571 } 572 } else { 573 size_t at = 0; 574 while(at < strlen(text)) { 575 ssize_t r = send(res->fd, text+at, strlen(text)-at, 0); 576 if(r == -1) { 577 if(errno == EAGAIN || errno == EINTR) 578 continue; 579 log_err("could not send: %s", 580 sock_strerror(errno)); 581 return 0; 582 } 583 at += r; 584 } 585 } 586 return 1; 587 } 588 589 /** print text over the ssl connection */ 590 static int 591 ssl_print_vmsg(RES* ssl, const char* format, va_list args) 592 { 593 char msg[65535]; 594 vsnprintf(msg, sizeof(msg), format, args); 595 return ssl_print_text(ssl, msg); 596 } 597 598 /** printf style printing to the ssl connection */ 599 int ssl_printf(RES* ssl, const char* format, ...) 600 { 601 va_list args; 602 int ret; 603 va_start(args, format); 604 ret = ssl_print_vmsg(ssl, format, args); 605 va_end(args); 606 return ret; 607 } 608 609 int 610 ssl_read_line(RES* res, char* buf, size_t max) 611 { 612 int r; 613 size_t len = 0; 614 if(!res) 615 return 0; 616 while(len < max) { 617 if(res->ssl) { 618 ERR_clear_error(); 619 if((r=SSL_read(res->ssl, buf+len, 1)) <= 0) { 620 int r2; 621 if((r2=SSL_get_error(res->ssl, r)) == SSL_ERROR_ZERO_RETURN) { 622 buf[len] = 0; 623 return 1; 624 } 625 log_crypto_err_io("could not SSL_read", r2); 626 return 0; 627 } 628 } else { 629 while(1) { 630 ssize_t rr = recv(res->fd, buf+len, 1, 0); 631 if(rr <= 0) { 632 if(rr == 0) { 633 buf[len] = 0; 634 return 1; 635 } 636 if(errno == EINTR || errno == EAGAIN) 637 continue; 638 if(rr < 0) log_err("could not recv: %s", 639 sock_strerror(errno)); 640 return 0; 641 } 642 break; 643 } 644 } 645 if(buf[len] == '\n') { 646 /* return string without \n */ 647 buf[len] = 0; 648 return 1; 649 } 650 len++; 651 } 652 buf[max-1] = 0; 653 log_err("control line too long (%d): %s", (int)max, buf); 654 return 0; 655 } 656 657 /** skip whitespace, return new pointer into string */ 658 static char* 659 skipwhite(char* str) 660 { 661 /* EOS \0 is not a space */ 662 while( isspace((unsigned char)*str) ) 663 str++; 664 return str; 665 } 666 667 /** send the OK to the control client */ 668 static void send_ok(RES* ssl) 669 { 670 (void)ssl_printf(ssl, "ok\n"); 671 } 672 673 /** tell other processes to execute the command */ 674 static void 675 distribute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd) 676 { 677 int i; 678 if(!cmd || !ssl) 679 return; 680 /* skip i=0 which is me */ 681 for(i=1; i<rc->worker->daemon->num; i++) { 682 worker_send_cmd(rc->worker->daemon->workers[i], 683 worker_cmd_remote); 684 if(!tube_write_msg(rc->worker->daemon->workers[i]->cmd, 685 (uint8_t*)cmd, strlen(cmd)+1, 0)) { 686 (void)ssl_printf(ssl, "error could not distribute cmd\n"); 687 return; 688 } 689 } 690 } 691 692 /** do the stop command */ 693 static void 694 do_stop(RES* ssl, struct worker* worker) 695 { 696 worker->need_to_exit = 1; 697 comm_base_exit(worker->base); 698 send_ok(ssl); 699 } 700 701 /** do the reload command */ 702 static void 703 do_reload(RES* ssl, struct worker* worker, int reuse_cache) 704 { 705 worker->reuse_cache = reuse_cache; 706 worker->need_to_exit = 0; 707 comm_base_exit(worker->base); 708 send_ok(ssl); 709 } 710 711 #ifndef THREADS_DISABLED 712 /** parse fast reload command options. */ 713 static int 714 fr_parse_options(RES* ssl, char* arg, int* fr_verb, int* fr_nopause, 715 int* fr_drop_mesh) 716 { 717 char* argp = arg; 718 while(*argp=='+') { 719 argp++; 720 while(*argp!=0 && *argp!=' ' && *argp!='\t') { 721 if(*argp == 'v') { 722 (*fr_verb)++; 723 } else if(*argp == 'p') { 724 (*fr_nopause) = 1; 725 } else if(*argp == 'd') { 726 (*fr_drop_mesh) = 1; 727 } else { 728 if(!ssl_printf(ssl, 729 "error: unknown option '+%c'\n", 730 *argp)) 731 return 0; 732 return 0; 733 } 734 argp++; 735 } 736 argp = skipwhite(argp); 737 } 738 if(*argp!=0) { 739 if(!ssl_printf(ssl, "error: unknown option '%s'\n", argp)) 740 return 0; 741 return 0; 742 } 743 return 1; 744 } 745 #endif /* !THREADS_DISABLED */ 746 747 /** do the fast_reload command */ 748 static void 749 do_fast_reload(RES* ssl, struct worker* worker, struct rc_state* s, char* arg) 750 { 751 #ifdef THREADS_DISABLED 752 if(!ssl_printf(ssl, "error: no threads for fast_reload, compiled without threads.\n")) 753 return; 754 (void)worker; 755 (void)s; 756 (void)arg; 757 #else 758 int fr_verb = 0, fr_nopause = 0, fr_drop_mesh = 0; 759 if(!fr_parse_options(ssl, arg, &fr_verb, &fr_nopause, &fr_drop_mesh)) 760 return; 761 if(fr_verb >= 1) { 762 if(!ssl_printf(ssl, "start fast_reload\n")) 763 return; 764 } 765 fast_reload_thread_start(ssl, worker, s, fr_verb, fr_nopause, 766 fr_drop_mesh); 767 #endif 768 } 769 770 /** do the verbosity command */ 771 static void 772 do_verbosity(RES* ssl, char* str) 773 { 774 int val = atoi(str); 775 if(val == 0 && strcmp(str, "0") != 0) { 776 ssl_printf(ssl, "error in verbosity number syntax: %s\n", str); 777 return; 778 } 779 verbosity = val; 780 send_ok(ssl); 781 } 782 783 /** print stats from statinfo */ 784 static int 785 print_stats(RES* ssl, const char* nm, struct ub_stats_info* s) 786 { 787 struct timeval sumwait, avg; 788 if(!ssl_printf(ssl, "%s.num.queries"SQ"%lu\n", nm, 789 (unsigned long)s->svr.num_queries)) return 0; 790 if(!ssl_printf(ssl, "%s.num.queries_ip_ratelimited"SQ"%lu\n", nm, 791 (unsigned long)s->svr.num_queries_ip_ratelimited)) return 0; 792 if(!ssl_printf(ssl, "%s.num.queries_cookie_valid"SQ"%lu\n", nm, 793 (unsigned long)s->svr.num_queries_cookie_valid)) return 0; 794 if(!ssl_printf(ssl, "%s.num.queries_cookie_client"SQ"%lu\n", nm, 795 (unsigned long)s->svr.num_queries_cookie_client)) return 0; 796 if(!ssl_printf(ssl, "%s.num.queries_cookie_invalid"SQ"%lu\n", nm, 797 (unsigned long)s->svr.num_queries_cookie_invalid)) return 0; 798 if(!ssl_printf(ssl, "%s.num.queries_discard_timeout"SQ"%lu\n", nm, 799 (unsigned long)s->svr.num_queries_discard_timeout)) return 0; 800 if(!ssl_printf(ssl, "%s.num.queries_wait_limit"SQ"%lu\n", nm, 801 (unsigned long)s->svr.num_queries_wait_limit)) return 0; 802 if(!ssl_printf(ssl, "%s.num.cachehits"SQ"%lu\n", nm, 803 (unsigned long)(s->svr.num_queries 804 - s->svr.num_queries_missed_cache))) return 0; 805 if(!ssl_printf(ssl, "%s.num.cachemiss"SQ"%lu\n", nm, 806 (unsigned long)s->svr.num_queries_missed_cache)) return 0; 807 if(!ssl_printf(ssl, "%s.num.prefetch"SQ"%lu\n", nm, 808 (unsigned long)s->svr.num_queries_prefetch)) return 0; 809 if(!ssl_printf(ssl, "%s.num.queries_timed_out"SQ"%lu\n", nm, 810 (unsigned long)s->svr.num_queries_timed_out)) return 0; 811 if(!ssl_printf(ssl, "%s.query.queue_time_us.max"SQ"%lu\n", nm, 812 (unsigned long)s->svr.max_query_time_us)) return 0; 813 if(!ssl_printf(ssl, "%s.num.expired"SQ"%lu\n", nm, 814 (unsigned long)s->svr.ans_expired)) return 0; 815 if(!ssl_printf(ssl, "%s.num.recursivereplies"SQ"%lu\n", nm, 816 (unsigned long)s->mesh_replies_sent)) return 0; 817 #ifdef USE_DNSCRYPT 818 if(!ssl_printf(ssl, "%s.num.dnscrypt.crypted"SQ"%lu\n", nm, 819 (unsigned long)s->svr.num_query_dnscrypt_crypted)) return 0; 820 if(!ssl_printf(ssl, "%s.num.dnscrypt.cert"SQ"%lu\n", nm, 821 (unsigned long)s->svr.num_query_dnscrypt_cert)) return 0; 822 if(!ssl_printf(ssl, "%s.num.dnscrypt.cleartext"SQ"%lu\n", nm, 823 (unsigned long)s->svr.num_query_dnscrypt_cleartext)) return 0; 824 if(!ssl_printf(ssl, "%s.num.dnscrypt.malformed"SQ"%lu\n", nm, 825 (unsigned long)s->svr.num_query_dnscrypt_crypted_malformed)) return 0; 826 #endif 827 if(!ssl_printf(ssl, "%s.num.dns_error_reports"SQ"%lu\n", nm, 828 (unsigned long)s->svr.num_dns_error_reports)) return 0; 829 if(!ssl_printf(ssl, "%s.requestlist.avg"SQ"%g\n", nm, 830 (s->svr.num_queries_missed_cache+s->svr.num_queries_prefetch)? 831 (double)s->svr.sum_query_list_size/ 832 (double)(s->svr.num_queries_missed_cache+ 833 s->svr.num_queries_prefetch) : 0.0)) return 0; 834 if(!ssl_printf(ssl, "%s.requestlist.max"SQ"%lu\n", nm, 835 (unsigned long)s->svr.max_query_list_size)) return 0; 836 if(!ssl_printf(ssl, "%s.requestlist.overwritten"SQ"%lu\n", nm, 837 (unsigned long)s->mesh_jostled)) return 0; 838 if(!ssl_printf(ssl, "%s.requestlist.exceeded"SQ"%lu\n", nm, 839 (unsigned long)s->mesh_dropped)) return 0; 840 if(!ssl_printf(ssl, "%s.requestlist.current.all"SQ"%lu\n", nm, 841 (unsigned long)s->mesh_num_states)) return 0; 842 if(!ssl_printf(ssl, "%s.requestlist.current.user"SQ"%lu\n", nm, 843 (unsigned long)s->mesh_num_reply_states)) return 0; 844 #ifndef S_SPLINT_S 845 sumwait.tv_sec = s->mesh_replies_sum_wait_sec; 846 sumwait.tv_usec = s->mesh_replies_sum_wait_usec; 847 #endif 848 timeval_divide(&avg, &sumwait, s->mesh_replies_sent); 849 if(!ssl_printf(ssl, "%s.recursion.time.avg"SQ ARG_LL "d.%6.6d\n", nm, 850 (long long)avg.tv_sec, (int)avg.tv_usec)) return 0; 851 if(!ssl_printf(ssl, "%s.recursion.time.median"SQ"%g\n", nm, 852 s->mesh_time_median)) return 0; 853 if(!ssl_printf(ssl, "%s.tcpusage"SQ"%lu\n", nm, 854 (unsigned long)s->svr.tcp_accept_usage)) return 0; 855 return 1; 856 } 857 858 /** print stats for one thread */ 859 static int 860 print_thread_stats(RES* ssl, int i, struct ub_stats_info* s) 861 { 862 char nm[32]; 863 snprintf(nm, sizeof(nm), "thread%d", i); 864 nm[sizeof(nm)-1]=0; 865 return print_stats(ssl, nm, s); 866 } 867 868 /** print long number */ 869 static int 870 print_longnum(RES* ssl, const char* desc, size_t x) 871 { 872 if(x > 1024*1024*1024) { 873 /* more than a Gb */ 874 size_t front = x / (size_t)1000000; 875 size_t back = x % (size_t)1000000; 876 return ssl_printf(ssl, "%s%u%6.6u\n", desc, 877 (unsigned)front, (unsigned)back); 878 } else { 879 return ssl_printf(ssl, "%s%lu\n", desc, (unsigned long)x); 880 } 881 } 882 883 /** print mem stats */ 884 static int 885 print_mem(RES* ssl, struct worker* worker, struct daemon* daemon, 886 struct ub_stats_info* s) 887 { 888 size_t msg, rrset, val, iter, respip; 889 #ifdef CLIENT_SUBNET 890 size_t subnet = 0; 891 #endif /* CLIENT_SUBNET */ 892 #ifdef USE_IPSECMOD 893 size_t ipsecmod = 0; 894 #endif /* USE_IPSECMOD */ 895 #ifdef USE_DNSCRYPT 896 size_t dnscrypt_shared_secret = 0; 897 size_t dnscrypt_nonce = 0; 898 #endif /* USE_DNSCRYPT */ 899 #ifdef WITH_DYNLIBMODULE 900 size_t dynlib = 0; 901 #endif /* WITH_DYNLIBMODULE */ 902 msg = slabhash_get_mem(daemon->env->msg_cache); 903 rrset = slabhash_get_mem(&daemon->env->rrset_cache->table); 904 val = mod_get_mem(&worker->env, "validator"); 905 iter = mod_get_mem(&worker->env, "iterator"); 906 respip = mod_get_mem(&worker->env, "respip"); 907 #ifdef CLIENT_SUBNET 908 subnet = mod_get_mem(&worker->env, "subnetcache"); 909 #endif /* CLIENT_SUBNET */ 910 #ifdef USE_IPSECMOD 911 ipsecmod = mod_get_mem(&worker->env, "ipsecmod"); 912 #endif /* USE_IPSECMOD */ 913 #ifdef USE_DNSCRYPT 914 if(daemon->dnscenv) { 915 dnscrypt_shared_secret = slabhash_get_mem( 916 daemon->dnscenv->shared_secrets_cache); 917 dnscrypt_nonce = slabhash_get_mem(daemon->dnscenv->nonces_cache); 918 } 919 #endif /* USE_DNSCRYPT */ 920 #ifdef WITH_DYNLIBMODULE 921 dynlib = mod_get_mem(&worker->env, "dynlib"); 922 #endif /* WITH_DYNLIBMODULE */ 923 924 if(!print_longnum(ssl, "mem.cache.rrset"SQ, rrset)) 925 return 0; 926 if(!print_longnum(ssl, "mem.cache.message"SQ, msg)) 927 return 0; 928 if(!print_longnum(ssl, "mem.mod.iterator"SQ, iter)) 929 return 0; 930 if(!print_longnum(ssl, "mem.mod.validator"SQ, val)) 931 return 0; 932 if(!print_longnum(ssl, "mem.mod.respip"SQ, respip)) 933 return 0; 934 #ifdef CLIENT_SUBNET 935 if(!print_longnum(ssl, "mem.mod.subnet"SQ, subnet)) 936 return 0; 937 #endif /* CLIENT_SUBNET */ 938 #ifdef USE_IPSECMOD 939 if(!print_longnum(ssl, "mem.mod.ipsecmod"SQ, ipsecmod)) 940 return 0; 941 #endif /* USE_IPSECMOD */ 942 #ifdef USE_DNSCRYPT 943 if(!print_longnum(ssl, "mem.cache.dnscrypt_shared_secret"SQ, 944 dnscrypt_shared_secret)) 945 return 0; 946 if(!print_longnum(ssl, "mem.cache.dnscrypt_nonce"SQ, 947 dnscrypt_nonce)) 948 return 0; 949 #endif /* USE_DNSCRYPT */ 950 #ifdef WITH_DYNLIBMODULE 951 if(!print_longnum(ssl, "mem.mod.dynlibmod"SQ, dynlib)) 952 return 0; 953 #endif /* WITH_DYNLIBMODULE */ 954 if(!print_longnum(ssl, "mem.streamwait"SQ, 955 (size_t)s->svr.mem_stream_wait)) 956 return 0; 957 if(!print_longnum(ssl, "mem.http.query_buffer"SQ, 958 (size_t)s->svr.mem_http2_query_buffer)) 959 return 0; 960 if(!print_longnum(ssl, "mem.http.response_buffer"SQ, 961 (size_t)s->svr.mem_http2_response_buffer)) 962 return 0; 963 #ifdef HAVE_NGTCP2 964 if(!print_longnum(ssl, "mem.quic"SQ, (size_t)s->svr.mem_quic)) 965 return 0; 966 #endif /* HAVE_NGTCP2 */ 967 return 1; 968 } 969 970 /** print uptime stats */ 971 static int 972 print_uptime(RES* ssl, struct worker* worker, int reset) 973 { 974 struct timeval now = *worker->env.now_tv; 975 struct timeval up, dt; 976 timeval_subtract(&up, &now, &worker->daemon->time_boot); 977 timeval_subtract(&dt, &now, &worker->daemon->time_last_stat); 978 if(reset) 979 worker->daemon->time_last_stat = now; 980 if(!ssl_printf(ssl, "time.now"SQ ARG_LL "d.%6.6d\n", 981 (long long)now.tv_sec, (unsigned)now.tv_usec)) return 0; 982 if(!ssl_printf(ssl, "time.up"SQ ARG_LL "d.%6.6d\n", 983 (long long)up.tv_sec, (unsigned)up.tv_usec)) return 0; 984 if(!ssl_printf(ssl, "time.elapsed"SQ ARG_LL "d.%6.6d\n", 985 (long long)dt.tv_sec, (unsigned)dt.tv_usec)) return 0; 986 return 1; 987 } 988 989 /** print extended histogram */ 990 static int 991 print_hist(RES* ssl, struct ub_stats_info* s) 992 { 993 struct timehist* hist; 994 size_t i; 995 hist = timehist_setup(); 996 if(!hist) { 997 log_err("out of memory"); 998 return 0; 999 } 1000 timehist_import(hist, s->svr.hist, NUM_BUCKETS_HIST); 1001 for(i=0; i<hist->num; i++) { 1002 if(!ssl_printf(ssl, 1003 "histogram.%6.6d.%6.6d.to.%6.6d.%6.6d=%lu\n", 1004 (int)hist->buckets[i].lower.tv_sec, 1005 (int)hist->buckets[i].lower.tv_usec, 1006 (int)hist->buckets[i].upper.tv_sec, 1007 (int)hist->buckets[i].upper.tv_usec, 1008 (unsigned long)hist->buckets[i].count)) { 1009 timehist_delete(hist); 1010 return 0; 1011 } 1012 } 1013 timehist_delete(hist); 1014 return 1; 1015 } 1016 1017 /** print extended stats */ 1018 static int 1019 print_ext(RES* ssl, struct ub_stats_info* s, int inhibit_zero) 1020 { 1021 int i; 1022 char nm[32]; 1023 const sldns_rr_descriptor* desc; 1024 const sldns_lookup_table* lt; 1025 /* TYPE */ 1026 for(i=0; i<UB_STATS_QTYPE_NUM; i++) { 1027 if(inhibit_zero && s->svr.qtype[i] == 0) 1028 continue; 1029 desc = sldns_rr_descript((uint16_t)i); 1030 if(desc && desc->_name) { 1031 snprintf(nm, sizeof(nm), "%s", desc->_name); 1032 } else if (i == LDNS_RR_TYPE_IXFR) { 1033 snprintf(nm, sizeof(nm), "IXFR"); 1034 } else if (i == LDNS_RR_TYPE_AXFR) { 1035 snprintf(nm, sizeof(nm), "AXFR"); 1036 } else if (i == LDNS_RR_TYPE_MAILA) { 1037 snprintf(nm, sizeof(nm), "MAILA"); 1038 } else if (i == LDNS_RR_TYPE_MAILB) { 1039 snprintf(nm, sizeof(nm), "MAILB"); 1040 } else if (i == LDNS_RR_TYPE_ANY) { 1041 snprintf(nm, sizeof(nm), "ANY"); 1042 } else { 1043 snprintf(nm, sizeof(nm), "TYPE%d", i); 1044 } 1045 if(!ssl_printf(ssl, "num.query.type.%s"SQ"%lu\n", 1046 nm, (unsigned long)s->svr.qtype[i])) return 0; 1047 } 1048 if(!inhibit_zero || s->svr.qtype_big) { 1049 if(!ssl_printf(ssl, "num.query.type.other"SQ"%lu\n", 1050 (unsigned long)s->svr.qtype_big)) return 0; 1051 } 1052 /* CLASS */ 1053 for(i=0; i<UB_STATS_QCLASS_NUM; i++) { 1054 if(inhibit_zero && s->svr.qclass[i] == 0) 1055 continue; 1056 lt = sldns_lookup_by_id(sldns_rr_classes, i); 1057 if(lt && lt->name) { 1058 snprintf(nm, sizeof(nm), "%s", lt->name); 1059 } else { 1060 snprintf(nm, sizeof(nm), "CLASS%d", i); 1061 } 1062 if(!ssl_printf(ssl, "num.query.class.%s"SQ"%lu\n", 1063 nm, (unsigned long)s->svr.qclass[i])) return 0; 1064 } 1065 if(!inhibit_zero || s->svr.qclass_big) { 1066 if(!ssl_printf(ssl, "num.query.class.other"SQ"%lu\n", 1067 (unsigned long)s->svr.qclass_big)) return 0; 1068 } 1069 /* OPCODE */ 1070 for(i=0; i<UB_STATS_OPCODE_NUM; i++) { 1071 if(inhibit_zero && s->svr.qopcode[i] == 0) 1072 continue; 1073 lt = sldns_lookup_by_id(sldns_opcodes, i); 1074 if(lt && lt->name) { 1075 snprintf(nm, sizeof(nm), "%s", lt->name); 1076 } else { 1077 snprintf(nm, sizeof(nm), "OPCODE%d", i); 1078 } 1079 if(!ssl_printf(ssl, "num.query.opcode.%s"SQ"%lu\n", 1080 nm, (unsigned long)s->svr.qopcode[i])) return 0; 1081 } 1082 /* transport */ 1083 if(!ssl_printf(ssl, "num.query.tcp"SQ"%lu\n", 1084 (unsigned long)s->svr.qtcp)) return 0; 1085 if(!ssl_printf(ssl, "num.query.tcpout"SQ"%lu\n", 1086 (unsigned long)s->svr.qtcp_outgoing)) return 0; 1087 if(!ssl_printf(ssl, "num.query.udpout"SQ"%lu\n", 1088 (unsigned long)s->svr.qudp_outgoing)) return 0; 1089 if(!ssl_printf(ssl, "num.query.tls"SQ"%lu\n", 1090 (unsigned long)s->svr.qtls)) return 0; 1091 if(!ssl_printf(ssl, "num.query.tls.resume"SQ"%lu\n", 1092 (unsigned long)s->svr.qtls_resume)) return 0; 1093 if(!ssl_printf(ssl, "num.query.ipv6"SQ"%lu\n", 1094 (unsigned long)s->svr.qipv6)) return 0; 1095 if(!ssl_printf(ssl, "num.query.https"SQ"%lu\n", 1096 (unsigned long)s->svr.qhttps)) return 0; 1097 #ifdef HAVE_NGTCP2 1098 if(!ssl_printf(ssl, "num.query.quic"SQ"%lu\n", 1099 (unsigned long)s->svr.qquic)) return 0; 1100 #endif /* HAVE_NGTCP2 */ 1101 /* flags */ 1102 if(!ssl_printf(ssl, "num.query.flags.QR"SQ"%lu\n", 1103 (unsigned long)s->svr.qbit_QR)) return 0; 1104 if(!ssl_printf(ssl, "num.query.flags.AA"SQ"%lu\n", 1105 (unsigned long)s->svr.qbit_AA)) return 0; 1106 if(!ssl_printf(ssl, "num.query.flags.TC"SQ"%lu\n", 1107 (unsigned long)s->svr.qbit_TC)) return 0; 1108 if(!ssl_printf(ssl, "num.query.flags.RD"SQ"%lu\n", 1109 (unsigned long)s->svr.qbit_RD)) return 0; 1110 if(!ssl_printf(ssl, "num.query.flags.RA"SQ"%lu\n", 1111 (unsigned long)s->svr.qbit_RA)) return 0; 1112 if(!ssl_printf(ssl, "num.query.flags.Z"SQ"%lu\n", 1113 (unsigned long)s->svr.qbit_Z)) return 0; 1114 if(!ssl_printf(ssl, "num.query.flags.AD"SQ"%lu\n", 1115 (unsigned long)s->svr.qbit_AD)) return 0; 1116 if(!ssl_printf(ssl, "num.query.flags.CD"SQ"%lu\n", 1117 (unsigned long)s->svr.qbit_CD)) return 0; 1118 if(!ssl_printf(ssl, "num.query.edns.present"SQ"%lu\n", 1119 (unsigned long)s->svr.qEDNS)) return 0; 1120 if(!ssl_printf(ssl, "num.query.edns.DO"SQ"%lu\n", 1121 (unsigned long)s->svr.qEDNS_DO)) return 0; 1122 1123 /* RCODE */ 1124 for(i=0; i<UB_STATS_RCODE_NUM; i++) { 1125 /* Always include RCODEs 0-5 */ 1126 if(inhibit_zero && i > LDNS_RCODE_REFUSED && s->svr.ans_rcode[i] == 0) 1127 continue; 1128 lt = sldns_lookup_by_id(sldns_rcodes, i); 1129 if(lt && lt->name) { 1130 snprintf(nm, sizeof(nm), "%s", lt->name); 1131 } else { 1132 snprintf(nm, sizeof(nm), "RCODE%d", i); 1133 } 1134 if(!ssl_printf(ssl, "num.answer.rcode.%s"SQ"%lu\n", 1135 nm, (unsigned long)s->svr.ans_rcode[i])) return 0; 1136 } 1137 if(!inhibit_zero || s->svr.ans_rcode_nodata) { 1138 if(!ssl_printf(ssl, "num.answer.rcode.nodata"SQ"%lu\n", 1139 (unsigned long)s->svr.ans_rcode_nodata)) return 0; 1140 } 1141 /* iteration */ 1142 if(!ssl_printf(ssl, "num.query.ratelimited"SQ"%lu\n", 1143 (unsigned long)s->svr.queries_ratelimited)) return 0; 1144 /* validation */ 1145 if(!ssl_printf(ssl, "num.answer.secure"SQ"%lu\n", 1146 (unsigned long)s->svr.ans_secure)) return 0; 1147 if(!ssl_printf(ssl, "num.answer.bogus"SQ"%lu\n", 1148 (unsigned long)s->svr.ans_bogus)) return 0; 1149 if(!ssl_printf(ssl, "num.rrset.bogus"SQ"%lu\n", 1150 (unsigned long)s->svr.rrset_bogus)) return 0; 1151 if(!ssl_printf(ssl, "num.query.aggressive.NOERROR"SQ"%lu\n", 1152 (unsigned long)s->svr.num_neg_cache_noerror)) return 0; 1153 if(!ssl_printf(ssl, "num.query.aggressive.NXDOMAIN"SQ"%lu\n", 1154 (unsigned long)s->svr.num_neg_cache_nxdomain)) return 0; 1155 /* threat detection */ 1156 if(!ssl_printf(ssl, "unwanted.queries"SQ"%lu\n", 1157 (unsigned long)s->svr.unwanted_queries)) return 0; 1158 if(!ssl_printf(ssl, "unwanted.replies"SQ"%lu\n", 1159 (unsigned long)s->svr.unwanted_replies)) return 0; 1160 /* cache counts */ 1161 if(!ssl_printf(ssl, "msg.cache.count"SQ"%u\n", 1162 (unsigned)s->svr.msg_cache_count)) return 0; 1163 if(!ssl_printf(ssl, "rrset.cache.count"SQ"%u\n", 1164 (unsigned)s->svr.rrset_cache_count)) return 0; 1165 if(!ssl_printf(ssl, "infra.cache.count"SQ"%u\n", 1166 (unsigned)s->svr.infra_cache_count)) return 0; 1167 if(!ssl_printf(ssl, "key.cache.count"SQ"%u\n", 1168 (unsigned)s->svr.key_cache_count)) return 0; 1169 /* max collisions */ 1170 if(!ssl_printf(ssl, "msg.cache.max_collisions"SQ"%u\n", 1171 (unsigned)s->svr.msg_cache_max_collisions)) return 0; 1172 if(!ssl_printf(ssl, "rrset.cache.max_collisions"SQ"%u\n", 1173 (unsigned)s->svr.rrset_cache_max_collisions)) return 0; 1174 /* applied RPZ actions */ 1175 for(i=0; i<UB_STATS_RPZ_ACTION_NUM; i++) { 1176 if(i == RPZ_NO_OVERRIDE_ACTION) 1177 continue; 1178 if(inhibit_zero && s->svr.rpz_action[i] == 0) 1179 continue; 1180 if(!ssl_printf(ssl, "num.rpz.action.%s"SQ"%lu\n", 1181 rpz_action_to_string(i), 1182 (unsigned long)s->svr.rpz_action[i])) return 0; 1183 } 1184 #ifdef USE_DNSCRYPT 1185 if(!ssl_printf(ssl, "dnscrypt_shared_secret.cache.count"SQ"%u\n", 1186 (unsigned)s->svr.shared_secret_cache_count)) return 0; 1187 if(!ssl_printf(ssl, "dnscrypt_nonce.cache.count"SQ"%u\n", 1188 (unsigned)s->svr.nonce_cache_count)) return 0; 1189 if(!ssl_printf(ssl, "num.query.dnscrypt.shared_secret.cachemiss"SQ"%lu\n", 1190 (unsigned long)s->svr.num_query_dnscrypt_secret_missed_cache)) return 0; 1191 if(!ssl_printf(ssl, "num.query.dnscrypt.replay"SQ"%lu\n", 1192 (unsigned long)s->svr.num_query_dnscrypt_replay)) return 0; 1193 #endif /* USE_DNSCRYPT */ 1194 if(!ssl_printf(ssl, "num.query.authzone.up"SQ"%lu\n", 1195 (unsigned long)s->svr.num_query_authzone_up)) return 0; 1196 if(!ssl_printf(ssl, "num.query.authzone.down"SQ"%lu\n", 1197 (unsigned long)s->svr.num_query_authzone_down)) return 0; 1198 #ifdef CLIENT_SUBNET 1199 if(!ssl_printf(ssl, "num.query.subnet"SQ"%lu\n", 1200 (unsigned long)s->svr.num_query_subnet)) return 0; 1201 if(!ssl_printf(ssl, "num.query.subnet_cache"SQ"%lu\n", 1202 (unsigned long)s->svr.num_query_subnet_cache)) return 0; 1203 #endif /* CLIENT_SUBNET */ 1204 #ifdef USE_CACHEDB 1205 if(!ssl_printf(ssl, "num.query.cachedb"SQ"%lu\n", 1206 (unsigned long)s->svr.num_query_cachedb)) return 0; 1207 #endif /* USE_CACHEDB */ 1208 return 1; 1209 } 1210 1211 /** do the stats command */ 1212 static void 1213 do_stats(RES* ssl, struct worker* worker, int reset) 1214 { 1215 struct daemon* daemon = worker->daemon; 1216 struct ub_stats_info total; 1217 struct ub_stats_info s; 1218 int i; 1219 memset(&total, 0, sizeof(total)); 1220 log_assert(daemon->num > 0); 1221 /* gather all thread statistics in one place */ 1222 for(i=0; i<daemon->num; i++) { 1223 server_stats_obtain(worker, daemon->workers[i], &s, reset); 1224 if(!print_thread_stats(ssl, i, &s)) 1225 return; 1226 if(i == 0) 1227 total = s; 1228 else server_stats_add(&total, &s); 1229 } 1230 /* print the thread statistics */ 1231 total.mesh_time_median /= (double)daemon->num; 1232 if(!print_stats(ssl, "total", &total)) 1233 return; 1234 if(!print_uptime(ssl, worker, reset)) 1235 return; 1236 if(daemon->cfg->stat_extended) { 1237 if(!print_mem(ssl, worker, daemon, &total)) 1238 return; 1239 if(!print_hist(ssl, &total)) 1240 return; 1241 if(!print_ext(ssl, &total, daemon->cfg->stat_inhibit_zero)) 1242 return; 1243 } 1244 } 1245 1246 /** parse commandline argument domain name */ 1247 static int 1248 parse_arg_name(RES* ssl, char* str, uint8_t** res, size_t* len, int* labs) 1249 { 1250 uint8_t nm[LDNS_MAX_DOMAINLEN+1]; 1251 size_t nmlen = sizeof(nm); 1252 int status; 1253 *res = NULL; 1254 *len = 0; 1255 *labs = 0; 1256 if(str[0] == '\0') { 1257 ssl_printf(ssl, "error: this option requires a domain name\n"); 1258 return 0; 1259 } 1260 status = sldns_str2wire_dname_buf(str, nm, &nmlen); 1261 if(status != 0) { 1262 ssl_printf(ssl, "error cannot parse name %s at %d: %s\n", str, 1263 LDNS_WIREPARSE_OFFSET(status), 1264 sldns_get_errorstr_parse(status)); 1265 return 0; 1266 } 1267 *res = memdup(nm, nmlen); 1268 if(!*res) { 1269 ssl_printf(ssl, "error out of memory\n"); 1270 return 0; 1271 } 1272 *labs = dname_count_size_labels(*res, len); 1273 return 1; 1274 } 1275 1276 /** find second argument, modifies string */ 1277 static int 1278 find_arg2(RES* ssl, char* arg, char** arg2) 1279 { 1280 char* as = strchr(arg, ' '); 1281 char* at = strchr(arg, '\t'); 1282 if(as && at) { 1283 if(at < as) 1284 as = at; 1285 as[0]=0; 1286 *arg2 = skipwhite(as+1); 1287 } else if(as) { 1288 as[0]=0; 1289 *arg2 = skipwhite(as+1); 1290 } else if(at) { 1291 at[0]=0; 1292 *arg2 = skipwhite(at+1); 1293 } else { 1294 ssl_printf(ssl, "error could not find next argument " 1295 "after %s\n", arg); 1296 return 0; 1297 } 1298 return 1; 1299 } 1300 1301 /** Add a new zone */ 1302 static int 1303 perform_zone_add(RES* ssl, struct local_zones* zones, char* arg) 1304 { 1305 uint8_t* nm; 1306 int nmlabs; 1307 size_t nmlen; 1308 char* arg2; 1309 enum localzone_type t; 1310 struct local_zone* z; 1311 if(!find_arg2(ssl, arg, &arg2)) 1312 return 0; 1313 if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs)) 1314 return 0; 1315 if(!local_zone_str2type(arg2, &t)) { 1316 ssl_printf(ssl, "error not a zone type. %s\n", arg2); 1317 free(nm); 1318 return 0; 1319 } 1320 lock_rw_wrlock(&zones->lock); 1321 if((z=local_zones_find(zones, nm, nmlen, 1322 nmlabs, LDNS_RR_CLASS_IN))) { 1323 /* already present in tree */ 1324 lock_rw_wrlock(&z->lock); 1325 z->type = t; /* update type anyway */ 1326 lock_rw_unlock(&z->lock); 1327 free(nm); 1328 lock_rw_unlock(&zones->lock); 1329 return 1; 1330 } 1331 if(!local_zones_add_zone(zones, nm, nmlen, 1332 nmlabs, LDNS_RR_CLASS_IN, t)) { 1333 lock_rw_unlock(&zones->lock); 1334 ssl_printf(ssl, "error out of memory\n"); 1335 return 0; 1336 } 1337 lock_rw_unlock(&zones->lock); 1338 return 1; 1339 } 1340 1341 /** Do the local_zone command */ 1342 static void 1343 do_zone_add(RES* ssl, struct local_zones* zones, char* arg) 1344 { 1345 if(!perform_zone_add(ssl, zones, arg)) 1346 return; 1347 send_ok(ssl); 1348 } 1349 1350 /** Do the local_zones command */ 1351 static void 1352 do_zones_add(struct daemon_remote* rc, RES* ssl, struct worker* worker) 1353 { 1354 char buf[MAX_CMD_STRLINE + MAX_STDIN_STRLINE] = "local_zone "; 1355 int num = 0; 1356 size_t cmd_len = strlen(buf); 1357 while(ssl_read_line(ssl, buf+cmd_len, MAX_STDIN_STRLINE)) { 1358 if(buf[0+cmd_len] == 0 || 1359 (buf[0+cmd_len] == 0x04 && buf[1+cmd_len] == 0)) 1360 break; /* zero byte line or end of transmission */ 1361 #ifdef THREADS_DISABLED 1362 /* distribute single item command */ 1363 if(rc) distribute_cmd(rc, ssl, buf); 1364 #else 1365 (void)rc; /* unused */ 1366 #endif 1367 if(!perform_zone_add(ssl, worker->daemon->local_zones, 1368 buf+cmd_len)) { 1369 if(!ssl_printf(ssl, "error for input line: %s\n", 1370 buf+cmd_len)) 1371 return; 1372 } 1373 else num++; 1374 } 1375 (void)ssl_printf(ssl, "added %d zones\n", num); 1376 } 1377 1378 /** Remove a zone */ 1379 static int 1380 perform_zone_remove(RES* ssl, struct local_zones* zones, char* arg) 1381 { 1382 uint8_t* nm; 1383 int nmlabs; 1384 size_t nmlen; 1385 struct local_zone* z; 1386 if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs)) 1387 return 0; 1388 lock_rw_wrlock(&zones->lock); 1389 if((z=local_zones_find(zones, nm, nmlen, 1390 nmlabs, LDNS_RR_CLASS_IN))) { 1391 /* present in tree */ 1392 local_zones_del_zone(zones, z); 1393 } 1394 lock_rw_unlock(&zones->lock); 1395 free(nm); 1396 return 1; 1397 } 1398 1399 /** Do the local_zone_remove command */ 1400 static void 1401 do_zone_remove(RES* ssl, struct local_zones* zones, char* arg) 1402 { 1403 if(!perform_zone_remove(ssl, zones, arg)) 1404 return; 1405 send_ok(ssl); 1406 } 1407 1408 /** Do the local_zones_remove command */ 1409 static void 1410 do_zones_remove(struct daemon_remote* rc, RES* ssl, struct worker* worker) 1411 { 1412 char buf[MAX_CMD_STRLINE + MAX_STDIN_STRLINE] = "local_zone_remove "; 1413 int num = 0; 1414 size_t cmd_len = strlen(buf); 1415 while(ssl_read_line(ssl, buf+cmd_len, MAX_STDIN_STRLINE)) { 1416 if(buf[0+cmd_len] == 0 || 1417 (buf[0+cmd_len] == 0x04 && buf[1+cmd_len] == 0)) 1418 break; /* zero byte line or end of transmission */ 1419 #ifdef THREADS_DISABLED 1420 /* distribute single item command */ 1421 if(rc) distribute_cmd(rc, ssl, buf); 1422 #else 1423 (void)rc; /* unused */ 1424 #endif 1425 if(!perform_zone_remove(ssl, worker->daemon->local_zones, 1426 buf+cmd_len)) { 1427 if(!ssl_printf(ssl, "error for input line: %s\n", 1428 buf+cmd_len)) 1429 return; 1430 } 1431 else num++; 1432 } 1433 (void)ssl_printf(ssl, "removed %d zones\n", num); 1434 } 1435 1436 /** check syntax of newly added RR */ 1437 static int 1438 check_RR_syntax(RES* ssl, char* str, int line) 1439 { 1440 uint8_t rr[LDNS_RR_BUF_SIZE]; 1441 size_t len = sizeof(rr), dname_len = 0; 1442 int s = sldns_str2wire_rr_buf(str, rr, &len, &dname_len, 3600, 1443 NULL, 0, NULL, 0); 1444 if(s != 0) { 1445 char linestr[32]; 1446 if(line == 0) 1447 linestr[0]=0; 1448 else snprintf(linestr, sizeof(linestr), "line %d ", line); 1449 if(!ssl_printf(ssl, "error parsing local-data at %sposition %d '%s': %s\n", 1450 linestr, LDNS_WIREPARSE_OFFSET(s), str, 1451 sldns_get_errorstr_parse(s))) 1452 return 0; 1453 return 0; 1454 } 1455 return 1; 1456 } 1457 1458 /** Add new RR data */ 1459 static int 1460 perform_data_add(RES* ssl, struct local_zones* zones, char* arg, int line) 1461 { 1462 if(!check_RR_syntax(ssl, arg, line)) { 1463 return 0; 1464 } 1465 if(!local_zones_add_RR(zones, arg)) { 1466 ssl_printf(ssl,"error in syntax or out of memory, %s\n", arg); 1467 return 0; 1468 } 1469 return 1; 1470 } 1471 1472 /** Do the local_data command */ 1473 static void 1474 do_data_add(RES* ssl, struct local_zones* zones, char* arg) 1475 { 1476 if(!perform_data_add(ssl, zones, arg, 0)) 1477 return; 1478 send_ok(ssl); 1479 } 1480 1481 /** Do the local_datas command */ 1482 static void 1483 do_datas_add(struct daemon_remote* rc, RES* ssl, struct worker* worker) 1484 { 1485 char buf[MAX_CMD_STRLINE + MAX_STDIN_STRLINE] = "local_data "; 1486 int num = 0, line = 0; 1487 size_t cmd_len = strlen(buf); 1488 while(ssl_read_line(ssl, buf+cmd_len, MAX_STDIN_STRLINE)) { 1489 if(buf[0+cmd_len] == 0 || 1490 (buf[0+cmd_len] == 0x04 && buf[1+cmd_len] == 0)) 1491 break; /* zero byte line or end of transmission */ 1492 #ifdef THREADS_DISABLED 1493 /* distribute single item command */ 1494 if(rc) distribute_cmd(rc, ssl, buf); 1495 #else 1496 (void)rc; /* unused */ 1497 #endif 1498 line++; 1499 if(perform_data_add(ssl, worker->daemon->local_zones, 1500 buf+cmd_len, line)) 1501 num++; 1502 } 1503 (void)ssl_printf(ssl, "added %d datas\n", num); 1504 } 1505 1506 /** Remove RR data */ 1507 static int 1508 perform_data_remove(RES* ssl, struct local_zones* zones, char* arg) 1509 { 1510 uint8_t* nm; 1511 int nmlabs; 1512 size_t nmlen; 1513 if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs)) 1514 return 0; 1515 local_zones_del_data(zones, nm, 1516 nmlen, nmlabs, LDNS_RR_CLASS_IN); 1517 free(nm); 1518 return 1; 1519 } 1520 1521 /** Do the local_data_remove command */ 1522 static void 1523 do_data_remove(RES* ssl, struct local_zones* zones, char* arg) 1524 { 1525 if(!perform_data_remove(ssl, zones, arg)) 1526 return; 1527 send_ok(ssl); 1528 } 1529 1530 /** Do the local_datas_remove command */ 1531 static void 1532 do_datas_remove(struct daemon_remote* rc, RES* ssl, struct worker* worker) 1533 { 1534 char buf[MAX_CMD_STRLINE + MAX_STDIN_STRLINE] = "local_data_remove "; 1535 int num = 0; 1536 size_t cmd_len = strlen(buf); 1537 while(ssl_read_line(ssl, buf+cmd_len, MAX_STDIN_STRLINE)) { 1538 if(buf[0+cmd_len] == 0 || 1539 (buf[0+cmd_len] == 0x04 && buf[1+cmd_len] == 0)) 1540 break; /* zero byte line or end of transmission */ 1541 #ifdef THREADS_DISABLED 1542 /* distribute single item command */ 1543 if(rc) distribute_cmd(rc, ssl, buf); 1544 #else 1545 (void)rc; /* unused */ 1546 #endif 1547 if(!perform_data_remove(ssl, worker->daemon->local_zones, 1548 buf+cmd_len)) { 1549 if(!ssl_printf(ssl, "error for input line: %s\n", 1550 buf+cmd_len)) 1551 return; 1552 } 1553 else num++; 1554 } 1555 (void)ssl_printf(ssl, "removed %d datas\n", num); 1556 } 1557 1558 /** Add a new zone to view */ 1559 static void 1560 do_view_zone_add(RES* ssl, struct worker* worker, char* arg) 1561 { 1562 char* arg2; 1563 struct view* v; 1564 if(!find_arg2(ssl, arg, &arg2)) 1565 return; 1566 v = views_find_view(worker->env.views, arg, 1 /* get write lock*/); 1567 if(!v) { 1568 ssl_printf(ssl,"no view with name: %s\n", arg); 1569 return; 1570 } 1571 if(!v->local_zones) { 1572 if(!(v->local_zones = local_zones_create())){ 1573 lock_rw_unlock(&v->lock); 1574 ssl_printf(ssl,"error out of memory\n"); 1575 return; 1576 } 1577 if(!v->isfirst) { 1578 /* Global local-zone is not used for this view, 1579 * therefore add defaults to this view-specic 1580 * local-zone. */ 1581 struct config_file lz_cfg; 1582 memset(&lz_cfg, 0, sizeof(lz_cfg)); 1583 local_zone_enter_defaults(v->local_zones, &lz_cfg); 1584 } 1585 } 1586 do_zone_add(ssl, v->local_zones, arg2); 1587 lock_rw_unlock(&v->lock); 1588 } 1589 1590 /** Remove a zone from view */ 1591 static void 1592 do_view_zone_remove(RES* ssl, struct worker* worker, char* arg) 1593 { 1594 char* arg2; 1595 struct view* v; 1596 if(!find_arg2(ssl, arg, &arg2)) 1597 return; 1598 v = views_find_view(worker->env.views, arg, 1 /* get write lock*/); 1599 if(!v) { 1600 ssl_printf(ssl,"no view with name: %s\n", arg); 1601 return; 1602 } 1603 if(!v->local_zones) { 1604 lock_rw_unlock(&v->lock); 1605 send_ok(ssl); 1606 return; 1607 } 1608 do_zone_remove(ssl, v->local_zones, arg2); 1609 lock_rw_unlock(&v->lock); 1610 } 1611 1612 /** Add new RR data to view */ 1613 static void 1614 do_view_data_add(RES* ssl, struct worker* worker, char* arg) 1615 { 1616 char* arg2; 1617 struct view* v; 1618 if(!find_arg2(ssl, arg, &arg2)) 1619 return; 1620 v = views_find_view(worker->env.views, arg, 1 /* get write lock*/); 1621 if(!v) { 1622 ssl_printf(ssl,"no view with name: %s\n", arg); 1623 return; 1624 } 1625 if(!v->local_zones) { 1626 if(!(v->local_zones = local_zones_create())){ 1627 lock_rw_unlock(&v->lock); 1628 ssl_printf(ssl,"error out of memory\n"); 1629 return; 1630 } 1631 } 1632 do_data_add(ssl, v->local_zones, arg2); 1633 lock_rw_unlock(&v->lock); 1634 } 1635 1636 /** Add new RR data from stdin to view */ 1637 static void 1638 do_view_datas_add(struct daemon_remote* rc, RES* ssl, struct worker* worker, 1639 char* arg) 1640 { 1641 struct view* v; 1642 char buf[MAX_CMD_STRLINE + MAX_STDIN_STRLINE] = "view_local_data "; 1643 size_t cmd_len; 1644 int num = 0, line = 0; 1645 v = views_find_view(worker->env.views, arg, 1 /* get write lock*/); 1646 if(!v) { 1647 ssl_printf(ssl,"no view with name: %s\n", arg); 1648 return; 1649 } 1650 if(!v->local_zones) { 1651 if(!(v->local_zones = local_zones_create())){ 1652 lock_rw_unlock(&v->lock); 1653 ssl_printf(ssl,"error out of memory\n"); 1654 return; 1655 } 1656 } 1657 /* put the view name in the command buf */ 1658 (void)snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf), "%s ", arg); 1659 cmd_len = strlen(buf); 1660 while(ssl_read_line(ssl, buf+cmd_len, MAX_STDIN_STRLINE)) { 1661 if(buf[0+cmd_len] == 0 || 1662 (buf[0+cmd_len] == 0x04 && buf[1+cmd_len] == 0)) 1663 break; /* zero byte line or end of transmission */ 1664 #ifdef THREADS_DISABLED 1665 /* distribute single item command */ 1666 if(rc) distribute_cmd(rc, ssl, buf); 1667 #else 1668 (void)rc; /* unused */ 1669 #endif 1670 line++; 1671 if(perform_data_add(ssl, v->local_zones, buf+cmd_len, line)) 1672 num++; 1673 } 1674 lock_rw_unlock(&v->lock); 1675 (void)ssl_printf(ssl, "added %d datas\n", num); 1676 } 1677 1678 /** Remove RR data from view */ 1679 static void 1680 do_view_data_remove(RES* ssl, struct worker* worker, char* arg) 1681 { 1682 char* arg2; 1683 struct view* v; 1684 if(!find_arg2(ssl, arg, &arg2)) 1685 return; 1686 v = views_find_view(worker->env.views, arg, 1 /* get write lock*/); 1687 if(!v) { 1688 ssl_printf(ssl,"no view with name: %s\n", arg); 1689 return; 1690 } 1691 if(!v->local_zones) { 1692 lock_rw_unlock(&v->lock); 1693 send_ok(ssl); 1694 return; 1695 } 1696 do_data_remove(ssl, v->local_zones, arg2); 1697 lock_rw_unlock(&v->lock); 1698 } 1699 1700 /** Remove RR data from stdin from view */ 1701 static void 1702 do_view_datas_remove(struct daemon_remote* rc, RES* ssl, struct worker* worker, 1703 char* arg) 1704 { 1705 struct view* v; 1706 char buf[MAX_CMD_STRLINE + MAX_STDIN_STRLINE] = "view_local_data_remove "; 1707 int num = 0; 1708 size_t cmd_len; 1709 v = views_find_view(worker->env.views, arg, 1 /* get write lock*/); 1710 if(!v) { 1711 ssl_printf(ssl,"no view with name: %s\n", arg); 1712 return; 1713 } 1714 if(!v->local_zones){ 1715 lock_rw_unlock(&v->lock); 1716 ssl_printf(ssl, "removed 0 datas\n"); 1717 return; 1718 } 1719 /* put the view name in the command buf */ 1720 (void)snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf), "%s ", arg); 1721 cmd_len = strlen(buf); 1722 while(ssl_read_line(ssl, buf+cmd_len, MAX_STDIN_STRLINE)) { 1723 if(buf[0+cmd_len] == 0 || 1724 (buf[0+cmd_len] == 0x04 && buf[1+cmd_len] == 0)) 1725 break; /* zero byte line or end of transmission */ 1726 #ifdef THREADS_DISABLED 1727 /* distribute single item command */ 1728 if(rc) distribute_cmd(rc, ssl, buf); 1729 #else 1730 (void)rc; /* unused */ 1731 #endif 1732 if(!perform_data_remove(ssl, v->local_zones, buf+cmd_len)) { 1733 if(!ssl_printf(ssl, "error for input line: %s\n", 1734 buf+cmd_len)) 1735 return; 1736 } 1737 else num++; 1738 } 1739 lock_rw_unlock(&v->lock); 1740 (void)ssl_printf(ssl, "removed %d datas\n", num); 1741 } 1742 1743 /** cache lookup of nameservers */ 1744 static void 1745 do_lookup(RES* ssl, struct worker* worker, char* arg) 1746 { 1747 uint8_t* nm; 1748 int nmlabs; 1749 size_t nmlen; 1750 if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs)) 1751 return; 1752 (void)print_deleg_lookup(ssl, worker, nm, nmlen, nmlabs); 1753 free(nm); 1754 } 1755 1756 /** flush something from rrset and msg caches */ 1757 static void 1758 do_cache_remove(struct worker* worker, uint8_t* nm, size_t nmlen, 1759 uint16_t t, uint16_t c, int remcachedb) 1760 { 1761 hashvalue_type h; 1762 struct query_info k; 1763 rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, t, c, 0); 1764 if(t == LDNS_RR_TYPE_SOA) 1765 rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, t, c, 1766 PACKED_RRSET_SOA_NEG); 1767 k.qname = nm; 1768 k.qname_len = nmlen; 1769 k.qtype = t; 1770 k.qclass = c; 1771 k.local_alias = NULL; 1772 h = query_info_hash(&k, 0); 1773 slabhash_remove(worker->env.msg_cache, h, &k); 1774 if(t == LDNS_RR_TYPE_AAAA) { 1775 /* for AAAA also flush dns64 bit_cd packet */ 1776 h = query_info_hash(&k, BIT_CD); 1777 slabhash_remove(worker->env.msg_cache, h, &k); 1778 } 1779 #ifdef USE_CACHEDB 1780 if(remcachedb && worker->env.cachedb_enabled) 1781 cachedb_msg_remove_qinfo(&worker->env, &k); 1782 #else 1783 (void)remcachedb; 1784 #endif 1785 } 1786 1787 /** parse '+c' option, modifies string to return remainder. */ 1788 static int 1789 parse_remcachedb(RES* ssl, char** arg, int* pc) 1790 { 1791 *arg = skipwhite(*arg); 1792 if((*arg)[0] == '+' && (*arg)[1] == 'c') { 1793 char* arg2; 1794 *pc = 1; 1795 if(!find_arg2(ssl, *arg, &arg2)) 1796 return 0; 1797 *arg = arg2; 1798 return 1; 1799 } 1800 /* The option was not found, no problem */ 1801 return 1; 1802 } 1803 1804 /** flush a type */ 1805 static void 1806 do_flush_type(RES* ssl, struct worker* worker, char* arg) 1807 { 1808 uint8_t* nm; 1809 int nmlabs; 1810 size_t nmlen; 1811 char* arg2; 1812 uint16_t t; 1813 int pc = 0; /* '+c' option */ 1814 if(!parse_remcachedb(ssl, &arg, &pc)) 1815 return; 1816 if(!find_arg2(ssl, arg, &arg2)) 1817 return; 1818 if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs)) 1819 return; 1820 t = sldns_get_rr_type_by_name(arg2); 1821 if(t == 0 && strcmp(arg2, "TYPE0") != 0) { 1822 (void)ssl_printf(ssl, "error parsing RRset type: '%s'\n", arg2); 1823 free(nm); 1824 return; 1825 } 1826 do_cache_remove(worker, nm, nmlen, t, LDNS_RR_CLASS_IN, pc); 1827 1828 free(nm); 1829 send_ok(ssl); 1830 } 1831 1832 /** flush statistics */ 1833 static void 1834 do_flush_stats(RES* ssl, struct worker* worker) 1835 { 1836 worker_stats_clear(worker); 1837 send_ok(ssl); 1838 } 1839 1840 /** 1841 * Local info for deletion functions 1842 */ 1843 struct del_info { 1844 /** worker */ 1845 struct worker* worker; 1846 /** name to delete */ 1847 uint8_t* name; 1848 /** length */ 1849 size_t len; 1850 /** labels */ 1851 int labs; 1852 /** time to invalidate to */ 1853 time_t expired; 1854 /** number of rrsets removed */ 1855 size_t num_rrsets; 1856 /** number of msgs removed */ 1857 size_t num_msgs; 1858 /** number of key entries removed */ 1859 size_t num_keys; 1860 /** length of addr */ 1861 socklen_t addrlen; 1862 /** socket address for host deletion */ 1863 struct sockaddr_storage addr; 1864 /** if cachedb information should be flushed too */ 1865 int remcachedb; 1866 }; 1867 1868 /** callback to delete hosts in infra cache */ 1869 static void 1870 infra_del_host(struct lruhash_entry* e, void* arg) 1871 { 1872 /* entry is locked */ 1873 struct del_info* inf = (struct del_info*)arg; 1874 struct infra_key* k = (struct infra_key*)e->key; 1875 if(sockaddr_cmp(&inf->addr, inf->addrlen, &k->addr, k->addrlen) == 0) { 1876 struct infra_data* d = (struct infra_data*)e->data; 1877 d->probedelay = 0; 1878 d->timeout_A = 0; 1879 d->timeout_AAAA = 0; 1880 d->timeout_other = 0; 1881 rtt_init(&d->rtt); 1882 if(d->ttl > inf->expired) { 1883 d->ttl = inf->expired; 1884 inf->num_keys++; 1885 } 1886 } 1887 } 1888 1889 /** flush infra cache */ 1890 static void 1891 do_flush_infra(RES* ssl, struct worker* worker, char* arg) 1892 { 1893 struct sockaddr_storage addr; 1894 socklen_t len; 1895 struct del_info inf; 1896 if(strcmp(arg, "all") == 0) { 1897 slabhash_clear(worker->env.infra_cache->hosts); 1898 send_ok(ssl); 1899 return; 1900 } 1901 if(!ipstrtoaddr(arg, UNBOUND_DNS_PORT, &addr, &len)) { 1902 (void)ssl_printf(ssl, "error parsing ip addr: '%s'\n", arg); 1903 return; 1904 } 1905 /* delete all entries from cache */ 1906 /* what we do is to set them all expired */ 1907 inf.worker = worker; 1908 inf.name = 0; 1909 inf.len = 0; 1910 inf.labs = 0; 1911 inf.expired = *worker->env.now; 1912 inf.expired -= 3; /* handle 3 seconds skew between threads */ 1913 inf.num_rrsets = 0; 1914 inf.num_msgs = 0; 1915 inf.num_keys = 0; 1916 inf.addrlen = len; 1917 inf.remcachedb = 0; 1918 memmove(&inf.addr, &addr, len); 1919 slabhash_traverse(worker->env.infra_cache->hosts, 1, &infra_del_host, 1920 &inf); 1921 send_ok(ssl); 1922 } 1923 1924 /** flush requestlist */ 1925 static void 1926 do_flush_requestlist(RES* ssl, struct worker* worker) 1927 { 1928 mesh_delete_all(worker->env.mesh); 1929 send_ok(ssl); 1930 } 1931 1932 /** callback to delete rrsets in a zone */ 1933 static void 1934 zone_del_rrset(struct lruhash_entry* e, void* arg) 1935 { 1936 /* entry is locked */ 1937 struct del_info* inf = (struct del_info*)arg; 1938 struct ub_packed_rrset_key* k = (struct ub_packed_rrset_key*)e->key; 1939 if(dname_subdomain_c(k->rk.dname, inf->name)) { 1940 struct packed_rrset_data* d = 1941 (struct packed_rrset_data*)e->data; 1942 if(d->ttl > inf->expired) { 1943 d->ttl = inf->expired; 1944 inf->num_rrsets++; 1945 } 1946 } 1947 } 1948 1949 /** callback to delete messages in a zone */ 1950 static void 1951 zone_del_msg(struct lruhash_entry* e, void* arg) 1952 { 1953 /* entry is locked */ 1954 struct del_info* inf = (struct del_info*)arg; 1955 struct msgreply_entry* k = (struct msgreply_entry*)e->key; 1956 if(dname_subdomain_c(k->key.qname, inf->name)) { 1957 struct reply_info* d = (struct reply_info*)e->data; 1958 if(d->ttl > inf->expired) { 1959 d->ttl = inf->expired; 1960 d->prefetch_ttl = inf->expired; 1961 d->serve_expired_ttl = inf->expired; 1962 inf->num_msgs++; 1963 } 1964 #ifdef USE_CACHEDB 1965 if(inf->remcachedb && inf->worker->env.cachedb_enabled) 1966 cachedb_msg_remove_qinfo(&inf->worker->env, &k->key); 1967 #endif 1968 } 1969 } 1970 1971 /** callback to delete keys in zone */ 1972 static void 1973 zone_del_kcache(struct lruhash_entry* e, void* arg) 1974 { 1975 /* entry is locked */ 1976 struct del_info* inf = (struct del_info*)arg; 1977 struct key_entry_key* k = (struct key_entry_key*)e->key; 1978 if(dname_subdomain_c(k->name, inf->name)) { 1979 struct key_entry_data* d = (struct key_entry_data*)e->data; 1980 if(d->ttl > inf->expired) { 1981 d->ttl = inf->expired; 1982 inf->num_keys++; 1983 } 1984 } 1985 } 1986 1987 /** remove all rrsets and keys from zone from cache */ 1988 static void 1989 do_flush_zone(RES* ssl, struct worker* worker, char* arg) 1990 { 1991 uint8_t* nm; 1992 int nmlabs; 1993 size_t nmlen; 1994 struct del_info inf; 1995 int pc = 0; /* '+c' option */ 1996 if(!parse_remcachedb(ssl, &arg, &pc)) 1997 return; 1998 if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs)) 1999 return; 2000 /* delete all RRs and key entries from zone */ 2001 /* what we do is to set them all expired */ 2002 inf.worker = worker; 2003 inf.name = nm; 2004 inf.len = nmlen; 2005 inf.labs = nmlabs; 2006 inf.expired = *worker->env.now; 2007 inf.expired -= 3; /* handle 3 seconds skew between threads */ 2008 inf.num_rrsets = 0; 2009 inf.num_msgs = 0; 2010 inf.num_keys = 0; 2011 inf.remcachedb = pc; 2012 slabhash_traverse(&worker->env.rrset_cache->table, 1, 2013 &zone_del_rrset, &inf); 2014 2015 slabhash_traverse(worker->env.msg_cache, 1, &zone_del_msg, &inf); 2016 2017 /* and validator cache */ 2018 if(worker->env.key_cache) { 2019 slabhash_traverse(worker->env.key_cache->slab, 1, 2020 &zone_del_kcache, &inf); 2021 } 2022 2023 free(nm); 2024 2025 (void)ssl_printf(ssl, "ok removed %lu rrsets, %lu messages " 2026 "and %lu key entries\n", (unsigned long)inf.num_rrsets, 2027 (unsigned long)inf.num_msgs, (unsigned long)inf.num_keys); 2028 } 2029 2030 /** callback to delete bogus rrsets */ 2031 static void 2032 bogus_del_rrset(struct lruhash_entry* e, void* arg) 2033 { 2034 /* entry is locked */ 2035 struct del_info* inf = (struct del_info*)arg; 2036 struct packed_rrset_data* d = (struct packed_rrset_data*)e->data; 2037 if(d->security == sec_status_bogus && d->ttl > inf->expired) { 2038 d->ttl = inf->expired; 2039 inf->num_rrsets++; 2040 } 2041 } 2042 2043 /** callback to delete bogus messages */ 2044 static void 2045 bogus_del_msg(struct lruhash_entry* e, void* arg) 2046 { 2047 /* entry is locked */ 2048 struct del_info* inf = (struct del_info*)arg; 2049 struct reply_info* d = (struct reply_info*)e->data; 2050 if(d->security == sec_status_bogus && d->ttl > inf->expired) { 2051 d->ttl = inf->expired; 2052 d->prefetch_ttl = inf->expired; 2053 d->serve_expired_ttl = inf->expired; 2054 inf->num_msgs++; 2055 #ifdef USE_CACHEDB 2056 if(inf->remcachedb && inf->worker->env.cachedb_enabled) 2057 cachedb_msg_remove_qinfo(&inf->worker->env, 2058 &((struct msgreply_entry*)e->key)->key); 2059 #endif 2060 } 2061 } 2062 2063 /** callback to delete bogus keys */ 2064 static void 2065 bogus_del_kcache(struct lruhash_entry* e, void* arg) 2066 { 2067 /* entry is locked */ 2068 struct del_info* inf = (struct del_info*)arg; 2069 struct key_entry_data* d = (struct key_entry_data*)e->data; 2070 if(d->isbad && d->ttl > inf->expired) { 2071 d->ttl = inf->expired; 2072 inf->num_keys++; 2073 } 2074 } 2075 2076 /** remove all bogus rrsets, msgs and keys from cache */ 2077 static void 2078 do_flush_bogus(RES* ssl, struct worker* worker, char* arg) 2079 { 2080 struct del_info inf; 2081 int pc = 0; /* '+c' option */ 2082 if(!parse_remcachedb(ssl, &arg, &pc)) 2083 return; 2084 /* what we do is to set them all expired */ 2085 inf.worker = worker; 2086 inf.expired = *worker->env.now; 2087 inf.expired -= 3; /* handle 3 seconds skew between threads */ 2088 inf.num_rrsets = 0; 2089 inf.num_msgs = 0; 2090 inf.num_keys = 0; 2091 inf.remcachedb = pc; 2092 slabhash_traverse(&worker->env.rrset_cache->table, 1, 2093 &bogus_del_rrset, &inf); 2094 2095 slabhash_traverse(worker->env.msg_cache, 1, &bogus_del_msg, &inf); 2096 2097 /* and validator cache */ 2098 if(worker->env.key_cache) { 2099 slabhash_traverse(worker->env.key_cache->slab, 1, 2100 &bogus_del_kcache, &inf); 2101 } 2102 2103 (void)ssl_printf(ssl, "ok removed %lu rrsets, %lu messages " 2104 "and %lu key entries\n", (unsigned long)inf.num_rrsets, 2105 (unsigned long)inf.num_msgs, (unsigned long)inf.num_keys); 2106 } 2107 2108 /** callback to delete negative and servfail rrsets */ 2109 static void 2110 negative_del_rrset(struct lruhash_entry* e, void* arg) 2111 { 2112 /* entry is locked */ 2113 struct del_info* inf = (struct del_info*)arg; 2114 struct ub_packed_rrset_key* k = (struct ub_packed_rrset_key*)e->key; 2115 struct packed_rrset_data* d = (struct packed_rrset_data*)e->data; 2116 /* delete the parentside negative cache rrsets, 2117 * these are nameserver rrsets that failed lookup, rdata empty */ 2118 if((k->rk.flags & PACKED_RRSET_PARENT_SIDE) && d->count == 1 && 2119 d->rrsig_count == 0 && d->rr_len[0] == 0 && 2120 d->ttl > inf->expired) { 2121 d->ttl = inf->expired; 2122 inf->num_rrsets++; 2123 } 2124 } 2125 2126 /** callback to delete negative and servfail messages */ 2127 static void 2128 negative_del_msg(struct lruhash_entry* e, void* arg) 2129 { 2130 /* entry is locked */ 2131 struct del_info* inf = (struct del_info*)arg; 2132 struct reply_info* d = (struct reply_info*)e->data; 2133 /* rcode not NOERROR: NXDOMAIN, SERVFAIL, ..: an nxdomain or error 2134 * or NOERROR rcode with ANCOUNT==0: a NODATA answer */ 2135 if((FLAGS_GET_RCODE(d->flags) != 0 || d->an_numrrsets == 0) && 2136 d->ttl > inf->expired) { 2137 d->ttl = inf->expired; 2138 d->prefetch_ttl = inf->expired; 2139 d->serve_expired_ttl = inf->expired; 2140 inf->num_msgs++; 2141 #ifdef USE_CACHEDB 2142 if(inf->remcachedb && inf->worker->env.cachedb_enabled) 2143 cachedb_msg_remove_qinfo(&inf->worker->env, 2144 &((struct msgreply_entry*)e->key)->key); 2145 #endif 2146 } 2147 } 2148 2149 /** callback to delete negative key entries */ 2150 static void 2151 negative_del_kcache(struct lruhash_entry* e, void* arg) 2152 { 2153 /* entry is locked */ 2154 struct del_info* inf = (struct del_info*)arg; 2155 struct key_entry_data* d = (struct key_entry_data*)e->data; 2156 /* could be bad because of lookup failure on the DS, DNSKEY, which 2157 * was nxdomain or servfail, and thus a result of negative lookups */ 2158 if(d->isbad && d->ttl > inf->expired) { 2159 d->ttl = inf->expired; 2160 inf->num_keys++; 2161 } 2162 } 2163 2164 /** remove all negative(NODATA,NXDOMAIN), and servfail messages from cache */ 2165 static void 2166 do_flush_negative(RES* ssl, struct worker* worker, char* arg) 2167 { 2168 struct del_info inf; 2169 int pc = 0; /* '+c' option */ 2170 if(!parse_remcachedb(ssl, &arg, &pc)) 2171 return; 2172 /* what we do is to set them all expired */ 2173 inf.worker = worker; 2174 inf.expired = *worker->env.now; 2175 inf.expired -= 3; /* handle 3 seconds skew between threads */ 2176 inf.num_rrsets = 0; 2177 inf.num_msgs = 0; 2178 inf.num_keys = 0; 2179 inf.remcachedb = pc; 2180 slabhash_traverse(&worker->env.rrset_cache->table, 1, 2181 &negative_del_rrset, &inf); 2182 2183 slabhash_traverse(worker->env.msg_cache, 1, &negative_del_msg, &inf); 2184 2185 /* and validator cache */ 2186 if(worker->env.key_cache) { 2187 slabhash_traverse(worker->env.key_cache->slab, 1, 2188 &negative_del_kcache, &inf); 2189 } 2190 2191 (void)ssl_printf(ssl, "ok removed %lu rrsets, %lu messages " 2192 "and %lu key entries\n", (unsigned long)inf.num_rrsets, 2193 (unsigned long)inf.num_msgs, (unsigned long)inf.num_keys); 2194 } 2195 2196 /** remove name rrset from cache */ 2197 static void 2198 do_flush_name(RES* ssl, struct worker* w, char* arg) 2199 { 2200 uint8_t* nm; 2201 int nmlabs; 2202 size_t nmlen; 2203 int pc = 0; /* '+c' option */ 2204 if(!parse_remcachedb(ssl, &arg, &pc)) 2205 return; 2206 if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs)) 2207 return; 2208 do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_A, LDNS_RR_CLASS_IN, pc); 2209 do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_AAAA, LDNS_RR_CLASS_IN, pc); 2210 do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN, pc); 2211 do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SOA, LDNS_RR_CLASS_IN, pc); 2212 do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_CNAME, LDNS_RR_CLASS_IN, pc); 2213 do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_DNAME, LDNS_RR_CLASS_IN, pc); 2214 do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_MX, LDNS_RR_CLASS_IN, pc); 2215 do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_PTR, LDNS_RR_CLASS_IN, pc); 2216 do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SRV, LDNS_RR_CLASS_IN, pc); 2217 do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_NAPTR, LDNS_RR_CLASS_IN, pc); 2218 do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SVCB, LDNS_RR_CLASS_IN, pc); 2219 do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_HTTPS, LDNS_RR_CLASS_IN, pc); 2220 2221 free(nm); 2222 send_ok(ssl); 2223 } 2224 2225 /** printout a delegation point info */ 2226 static int 2227 ssl_print_name_dp(RES* ssl, const char* str, uint8_t* nm, uint16_t dclass, 2228 struct delegpt* dp) 2229 { 2230 char buf[LDNS_MAX_DOMAINLEN]; 2231 struct delegpt_ns* ns; 2232 struct delegpt_addr* a; 2233 int f = 0; 2234 if(str) { /* print header for forward, stub */ 2235 char* c = sldns_wire2str_class(dclass); 2236 dname_str(nm, buf); 2237 if(!ssl_printf(ssl, "%s %s %s ", buf, (c?c:"CLASS??"), str)) { 2238 free(c); 2239 return 0; 2240 } 2241 free(c); 2242 } 2243 for(ns = dp->nslist; ns; ns = ns->next) { 2244 dname_str(ns->name, buf); 2245 if(!ssl_printf(ssl, "%s%s", (f?" ":""), buf)) 2246 return 0; 2247 f = 1; 2248 } 2249 for(a = dp->target_list; a; a = a->next_target) { 2250 addr_to_str(&a->addr, a->addrlen, buf, sizeof(buf)); 2251 if(!ssl_printf(ssl, "%s%s", (f?" ":""), buf)) 2252 return 0; 2253 f = 1; 2254 } 2255 return ssl_printf(ssl, "\n"); 2256 } 2257 2258 2259 /** print root forwards */ 2260 static int 2261 print_root_fwds(RES* ssl, struct iter_forwards* fwds, uint8_t* root) 2262 { 2263 struct delegpt* dp; 2264 int nolock = 0; 2265 dp = forwards_lookup(fwds, root, LDNS_RR_CLASS_IN, nolock); 2266 if(!dp) { 2267 return ssl_printf(ssl, "off (using root hints)\n"); 2268 } 2269 /* if dp is returned it must be the root */ 2270 log_assert(query_dname_compare(dp->name, root)==0); 2271 if(!ssl_print_name_dp(ssl, NULL, root, LDNS_RR_CLASS_IN, dp)) { 2272 lock_rw_unlock(&fwds->lock); 2273 return 0; 2274 } 2275 lock_rw_unlock(&fwds->lock); 2276 return 1; 2277 } 2278 2279 /** parse args into delegpt */ 2280 static struct delegpt* 2281 parse_delegpt(RES* ssl, char* args, uint8_t* nm) 2282 { 2283 /* parse args and add in */ 2284 char* p = args; 2285 char* todo; 2286 struct delegpt* dp = delegpt_create_mlc(nm); 2287 struct sockaddr_storage addr; 2288 socklen_t addrlen; 2289 char* auth_name; 2290 if(!dp) { 2291 (void)ssl_printf(ssl, "error out of memory\n"); 2292 return NULL; 2293 } 2294 while(p) { 2295 todo = p; 2296 p = strchr(p, ' '); /* find next spot, if any */ 2297 if(p) { 2298 *p++ = 0; /* end this spot */ 2299 p = skipwhite(p); /* position at next spot */ 2300 } 2301 /* parse address */ 2302 if(!authextstrtoaddr(todo, &addr, &addrlen, &auth_name)) { 2303 uint8_t* dname= NULL; 2304 int port; 2305 dname = authextstrtodname(todo, &port, &auth_name); 2306 if(!dname) { 2307 (void)ssl_printf(ssl, "error cannot parse" 2308 " '%s'\n", todo); 2309 delegpt_free_mlc(dp); 2310 return NULL; 2311 } 2312 #if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST) 2313 if(auth_name) 2314 log_err("no name verification functionality in " 2315 "ssl library, ignored name for %s", todo); 2316 #endif 2317 if(!delegpt_add_ns_mlc(dp, dname, 0, auth_name, port)) { 2318 (void)ssl_printf(ssl, "error out of memory\n"); 2319 free(dname); 2320 delegpt_free_mlc(dp); 2321 return NULL; 2322 } 2323 } else { 2324 #if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST) 2325 if(auth_name) 2326 log_err("no name verification functionality in " 2327 "ssl library, ignored name for %s", todo); 2328 #endif 2329 /* add address */ 2330 if(!delegpt_add_addr_mlc(dp, &addr, addrlen, 0, 0, 2331 auth_name, -1)) { 2332 (void)ssl_printf(ssl, "error out of memory\n"); 2333 delegpt_free_mlc(dp); 2334 return NULL; 2335 } 2336 } 2337 } 2338 dp->has_parent_side_NS = 1; 2339 return dp; 2340 } 2341 2342 /** do the forward command */ 2343 static void 2344 do_forward(RES* ssl, struct worker* worker, char* args) 2345 { 2346 struct iter_forwards* fwd = worker->env.fwds; 2347 uint8_t* root = (uint8_t*)"\000"; 2348 int nolock = 0; 2349 if(!fwd) { 2350 (void)ssl_printf(ssl, "error: structure not allocated\n"); 2351 return; 2352 } 2353 if(args == NULL || args[0] == 0) { 2354 (void)print_root_fwds(ssl, fwd, root); 2355 return; 2356 } 2357 /* set root forwards for this thread. since we are in remote control 2358 * the actual mesh is not running, so we can freely edit it. */ 2359 /* delete all the existing queries first */ 2360 mesh_delete_all(worker->env.mesh); 2361 if(strcmp(args, "off") == 0) { 2362 forwards_delete_zone(fwd, LDNS_RR_CLASS_IN, root, nolock); 2363 } else { 2364 struct delegpt* dp; 2365 if(!(dp = parse_delegpt(ssl, args, root))) 2366 return; 2367 if(!forwards_add_zone(fwd, LDNS_RR_CLASS_IN, dp, nolock)) { 2368 (void)ssl_printf(ssl, "error out of memory\n"); 2369 return; 2370 } 2371 } 2372 send_ok(ssl); 2373 } 2374 2375 static int 2376 parse_fs_args(RES* ssl, char* args, uint8_t** nm, struct delegpt** dp, 2377 int* insecure, int* prime, int* tls) 2378 { 2379 char* zonename; 2380 char* rest; 2381 size_t nmlen; 2382 int nmlabs; 2383 /* parse all -x args */ 2384 while(args[0] == '+') { 2385 if(!find_arg2(ssl, args, &rest)) 2386 return 0; 2387 while(*(++args) != 0) { 2388 if(*args == 'i' && insecure) 2389 *insecure = 1; 2390 else if(*args == 'p' && prime) 2391 *prime = 1; 2392 else if(*args == 't' && tls) 2393 *tls = 1; 2394 else { 2395 (void)ssl_printf(ssl, "error: unknown option %s\n", args); 2396 return 0; 2397 } 2398 } 2399 args = rest; 2400 } 2401 /* parse name */ 2402 if(dp) { 2403 if(!find_arg2(ssl, args, &rest)) 2404 return 0; 2405 zonename = args; 2406 args = rest; 2407 } else zonename = args; 2408 if(!parse_arg_name(ssl, zonename, nm, &nmlen, &nmlabs)) 2409 return 0; 2410 2411 /* parse dp */ 2412 if(dp) { 2413 if(!(*dp = parse_delegpt(ssl, args, *nm))) { 2414 free(*nm); 2415 return 0; 2416 } 2417 } 2418 return 1; 2419 } 2420 2421 /** do the forward_add command */ 2422 static void 2423 do_forward_add(RES* ssl, struct worker* worker, char* args) 2424 { 2425 struct iter_forwards* fwd = worker->env.fwds; 2426 int insecure = 0, tls = 0; 2427 uint8_t* nm = NULL; 2428 struct delegpt* dp = NULL; 2429 int nolock = 1; 2430 if(!parse_fs_args(ssl, args, &nm, &dp, &insecure, NULL, &tls)) 2431 return; 2432 if(tls) 2433 dp->ssl_upstream = 1; 2434 /* prelock forwarders for atomic operation with anchors */ 2435 lock_rw_wrlock(&fwd->lock); 2436 if(insecure && worker->env.anchors) { 2437 if(!anchors_add_insecure(worker->env.anchors, LDNS_RR_CLASS_IN, 2438 nm)) { 2439 lock_rw_unlock(&fwd->lock); 2440 (void)ssl_printf(ssl, "error out of memory\n"); 2441 delegpt_free_mlc(dp); 2442 free(nm); 2443 return; 2444 } 2445 } 2446 if(!forwards_add_zone(fwd, LDNS_RR_CLASS_IN, dp, nolock)) { 2447 lock_rw_unlock(&fwd->lock); 2448 (void)ssl_printf(ssl, "error out of memory\n"); 2449 free(nm); 2450 return; 2451 } 2452 lock_rw_unlock(&fwd->lock); 2453 free(nm); 2454 send_ok(ssl); 2455 } 2456 2457 /** do the forward_remove command */ 2458 static void 2459 do_forward_remove(RES* ssl, struct worker* worker, char* args) 2460 { 2461 struct iter_forwards* fwd = worker->env.fwds; 2462 int insecure = 0; 2463 uint8_t* nm = NULL; 2464 int nolock = 1; 2465 if(!parse_fs_args(ssl, args, &nm, NULL, &insecure, NULL, NULL)) 2466 return; 2467 /* prelock forwarders for atomic operation with anchors */ 2468 lock_rw_wrlock(&fwd->lock); 2469 if(insecure && worker->env.anchors) 2470 anchors_delete_insecure(worker->env.anchors, LDNS_RR_CLASS_IN, 2471 nm); 2472 forwards_delete_zone(fwd, LDNS_RR_CLASS_IN, nm, nolock); 2473 lock_rw_unlock(&fwd->lock); 2474 free(nm); 2475 send_ok(ssl); 2476 } 2477 2478 /** do the stub_add command */ 2479 static void 2480 do_stub_add(RES* ssl, struct worker* worker, char* args) 2481 { 2482 struct iter_forwards* fwd = worker->env.fwds; 2483 int insecure = 0, prime = 0, tls = 0; 2484 uint8_t* nm = NULL; 2485 struct delegpt* dp = NULL; 2486 int nolock = 1; 2487 if(!parse_fs_args(ssl, args, &nm, &dp, &insecure, &prime, &tls)) 2488 return; 2489 if(tls) 2490 dp->ssl_upstream = 1; 2491 /* prelock forwarders and hints for atomic operation with anchors */ 2492 lock_rw_wrlock(&fwd->lock); 2493 lock_rw_wrlock(&worker->env.hints->lock); 2494 if(insecure && worker->env.anchors) { 2495 if(!anchors_add_insecure(worker->env.anchors, LDNS_RR_CLASS_IN, 2496 nm)) { 2497 lock_rw_unlock(&fwd->lock); 2498 lock_rw_unlock(&worker->env.hints->lock); 2499 (void)ssl_printf(ssl, "error out of memory\n"); 2500 delegpt_free_mlc(dp); 2501 free(nm); 2502 return; 2503 } 2504 } 2505 if(!forwards_add_stub_hole(fwd, LDNS_RR_CLASS_IN, nm, nolock)) { 2506 if(insecure && worker->env.anchors) 2507 anchors_delete_insecure(worker->env.anchors, 2508 LDNS_RR_CLASS_IN, nm); 2509 lock_rw_unlock(&fwd->lock); 2510 lock_rw_unlock(&worker->env.hints->lock); 2511 (void)ssl_printf(ssl, "error out of memory\n"); 2512 delegpt_free_mlc(dp); 2513 free(nm); 2514 return; 2515 } 2516 if(!hints_add_stub(worker->env.hints, LDNS_RR_CLASS_IN, dp, !prime, 2517 nolock)) { 2518 (void)ssl_printf(ssl, "error out of memory\n"); 2519 forwards_delete_stub_hole(fwd, LDNS_RR_CLASS_IN, nm, nolock); 2520 if(insecure && worker->env.anchors) 2521 anchors_delete_insecure(worker->env.anchors, 2522 LDNS_RR_CLASS_IN, nm); 2523 lock_rw_unlock(&fwd->lock); 2524 lock_rw_unlock(&worker->env.hints->lock); 2525 free(nm); 2526 return; 2527 } 2528 lock_rw_unlock(&fwd->lock); 2529 lock_rw_unlock(&worker->env.hints->lock); 2530 free(nm); 2531 send_ok(ssl); 2532 } 2533 2534 /** do the stub_remove command */ 2535 static void 2536 do_stub_remove(RES* ssl, struct worker* worker, char* args) 2537 { 2538 struct iter_forwards* fwd = worker->env.fwds; 2539 int insecure = 0; 2540 uint8_t* nm = NULL; 2541 int nolock = 1; 2542 if(!parse_fs_args(ssl, args, &nm, NULL, &insecure, NULL, NULL)) 2543 return; 2544 /* prelock forwarders and hints for atomic operation with anchors */ 2545 lock_rw_wrlock(&fwd->lock); 2546 lock_rw_wrlock(&worker->env.hints->lock); 2547 if(insecure && worker->env.anchors) 2548 anchors_delete_insecure(worker->env.anchors, LDNS_RR_CLASS_IN, 2549 nm); 2550 forwards_delete_stub_hole(fwd, LDNS_RR_CLASS_IN, nm, nolock); 2551 hints_delete_stub(worker->env.hints, LDNS_RR_CLASS_IN, nm, nolock); 2552 lock_rw_unlock(&fwd->lock); 2553 lock_rw_unlock(&worker->env.hints->lock); 2554 free(nm); 2555 send_ok(ssl); 2556 } 2557 2558 /** do the insecure_add command */ 2559 static void 2560 do_insecure_add(RES* ssl, struct worker* worker, char* arg) 2561 { 2562 size_t nmlen; 2563 int nmlabs; 2564 uint8_t* nm = NULL; 2565 if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs)) 2566 return; 2567 if(worker->env.anchors) { 2568 if(!anchors_add_insecure(worker->env.anchors, 2569 LDNS_RR_CLASS_IN, nm)) { 2570 (void)ssl_printf(ssl, "error out of memory\n"); 2571 free(nm); 2572 return; 2573 } 2574 } 2575 free(nm); 2576 send_ok(ssl); 2577 } 2578 2579 /** do the insecure_remove command */ 2580 static void 2581 do_insecure_remove(RES* ssl, struct worker* worker, char* arg) 2582 { 2583 size_t nmlen; 2584 int nmlabs; 2585 uint8_t* nm = NULL; 2586 if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs)) 2587 return; 2588 if(worker->env.anchors) 2589 anchors_delete_insecure(worker->env.anchors, 2590 LDNS_RR_CLASS_IN, nm); 2591 free(nm); 2592 send_ok(ssl); 2593 } 2594 2595 static void 2596 do_insecure_list(RES* ssl, struct worker* worker) 2597 { 2598 char buf[LDNS_MAX_DOMAINLEN]; 2599 struct trust_anchor* a; 2600 if(worker->env.anchors) { 2601 RBTREE_FOR(a, struct trust_anchor*, worker->env.anchors->tree) { 2602 if(a->numDS == 0 && a->numDNSKEY == 0) { 2603 dname_str(a->name, buf); 2604 ssl_printf(ssl, "%s\n", buf); 2605 } 2606 } 2607 } 2608 } 2609 2610 /** do the status command */ 2611 static void 2612 do_status(RES* ssl, struct worker* worker) 2613 { 2614 int i; 2615 time_t uptime; 2616 if(!ssl_printf(ssl, "version: %s\n", PACKAGE_VERSION)) 2617 return; 2618 if(!ssl_printf(ssl, "verbosity: %d\n", verbosity)) 2619 return; 2620 if(!ssl_printf(ssl, "threads: %d\n", worker->daemon->num)) 2621 return; 2622 if(!ssl_printf(ssl, "modules: %d [", worker->daemon->mods.num)) 2623 return; 2624 for(i=0; i<worker->daemon->mods.num; i++) { 2625 if(!ssl_printf(ssl, " %s", worker->daemon->mods.mod[i]->name)) 2626 return; 2627 } 2628 if(!ssl_printf(ssl, " ]\n")) 2629 return; 2630 uptime = (time_t)time(NULL) - (time_t)worker->daemon->time_boot.tv_sec; 2631 if(!ssl_printf(ssl, "uptime: " ARG_LL "d seconds\n", (long long)uptime)) 2632 return; 2633 if(!ssl_printf(ssl, "options:%s%s%s%s\n" , 2634 (worker->daemon->reuseport?" reuseport":""), 2635 (worker->daemon->rc->accept_list?" control":""), 2636 (worker->daemon->rc->accept_list && worker->daemon->rc->use_cert?"(ssl)":""), 2637 (worker->daemon->rc->accept_list && worker->daemon->cfg->control_ifs.first && worker->daemon->cfg->control_ifs.first->str && worker->daemon->cfg->control_ifs.first->str[0] == '/'?"(namedpipe)":"") 2638 )) 2639 return; 2640 if(!ssl_printf(ssl, "unbound (pid %d) is running...\n", 2641 (int)getpid())) 2642 return; 2643 } 2644 2645 /** get age for the mesh state */ 2646 static void 2647 get_mesh_age(struct mesh_state* m, char* buf, size_t len, 2648 struct module_env* env) 2649 { 2650 if(m->reply_list) { 2651 struct timeval d; 2652 struct mesh_reply* r = m->reply_list; 2653 /* last reply is the oldest */ 2654 while(r && r->next) 2655 r = r->next; 2656 timeval_subtract(&d, env->now_tv, &r->start_time); 2657 snprintf(buf, len, ARG_LL "d.%6.6d", 2658 (long long)d.tv_sec, (int)d.tv_usec); 2659 } else { 2660 snprintf(buf, len, "-"); 2661 } 2662 } 2663 2664 /** get status of a mesh state */ 2665 static void 2666 get_mesh_status(struct mesh_area* mesh, struct mesh_state* m, 2667 char* buf, size_t len) 2668 { 2669 enum module_ext_state s = m->s.ext_state[m->s.curmod]; 2670 const char *modname = mesh->mods.mod[m->s.curmod]->name; 2671 size_t l; 2672 if(strcmp(modname, "iterator") == 0 && s == module_wait_reply && 2673 m->s.minfo[m->s.curmod]) { 2674 /* break into iterator to find out who its waiting for */ 2675 struct iter_qstate* qstate = (struct iter_qstate*) 2676 m->s.minfo[m->s.curmod]; 2677 struct outbound_list* ol = &qstate->outlist; 2678 struct outbound_entry* e; 2679 snprintf(buf, len, "%s wait for", modname); 2680 l = strlen(buf); 2681 buf += l; len -= l; 2682 if(ol->first == NULL) 2683 snprintf(buf, len, " (empty_list)"); 2684 for(e = ol->first; e; e = e->next) { 2685 snprintf(buf, len, " "); 2686 l = strlen(buf); 2687 buf += l; len -= l; 2688 addr_to_str(&e->qsent->addr, e->qsent->addrlen, 2689 buf, len); 2690 l = strlen(buf); 2691 buf += l; len -= l; 2692 } 2693 } else if(s == module_wait_subquery) { 2694 /* look in subs from mesh state to see what */ 2695 char nm[LDNS_MAX_DOMAINLEN]; 2696 struct mesh_state_ref* sub; 2697 snprintf(buf, len, "%s wants", modname); 2698 l = strlen(buf); 2699 buf += l; len -= l; 2700 if(m->sub_set.count == 0) 2701 snprintf(buf, len, " (empty_list)"); 2702 RBTREE_FOR(sub, struct mesh_state_ref*, &m->sub_set) { 2703 char* t = sldns_wire2str_type(sub->s->s.qinfo.qtype); 2704 char* c = sldns_wire2str_class(sub->s->s.qinfo.qclass); 2705 dname_str(sub->s->s.qinfo.qname, nm); 2706 snprintf(buf, len, " %s %s %s", (t?t:"TYPE??"), 2707 (c?c:"CLASS??"), nm); 2708 l = strlen(buf); 2709 buf += l; len -= l; 2710 free(t); 2711 free(c); 2712 } 2713 } else { 2714 snprintf(buf, len, "%s is %s", modname, strextstate(s)); 2715 } 2716 } 2717 2718 /** do the dump_requestlist command */ 2719 static void 2720 do_dump_requestlist(RES* ssl, struct worker* worker) 2721 { 2722 struct mesh_area* mesh; 2723 struct mesh_state* m; 2724 int num = 0; 2725 char buf[LDNS_MAX_DOMAINLEN]; 2726 char timebuf[32]; 2727 char statbuf[10240]; 2728 if(!ssl_printf(ssl, "thread #%d\n", worker->thread_num)) 2729 return; 2730 if(!ssl_printf(ssl, "# type cl name seconds module status\n")) 2731 return; 2732 /* show worker mesh contents */ 2733 mesh = worker->env.mesh; 2734 if(!mesh) return; 2735 RBTREE_FOR(m, struct mesh_state*, &mesh->all) { 2736 char* t = sldns_wire2str_type(m->s.qinfo.qtype); 2737 char* c = sldns_wire2str_class(m->s.qinfo.qclass); 2738 dname_str(m->s.qinfo.qname, buf); 2739 get_mesh_age(m, timebuf, sizeof(timebuf), &worker->env); 2740 get_mesh_status(mesh, m, statbuf, sizeof(statbuf)); 2741 if(!ssl_printf(ssl, "%3d %4s %2s %s %s %s\n", 2742 num, (t?t:"TYPE??"), (c?c:"CLASS??"), buf, timebuf, 2743 statbuf)) { 2744 free(t); 2745 free(c); 2746 return; 2747 } 2748 num++; 2749 free(t); 2750 free(c); 2751 } 2752 } 2753 2754 /** structure for argument data for dump infra host */ 2755 struct infra_arg { 2756 /** the infra cache */ 2757 struct infra_cache* infra; 2758 /** the SSL connection */ 2759 RES* ssl; 2760 /** the time now */ 2761 time_t now; 2762 /** ssl failure? stop writing and skip the rest. If the tcp 2763 * connection is broken, and writes fail, we then stop writing. */ 2764 int ssl_failed; 2765 }; 2766 2767 /** callback for every host element in the infra cache */ 2768 static void 2769 dump_infra_host(struct lruhash_entry* e, void* arg) 2770 { 2771 struct infra_arg* a = (struct infra_arg*)arg; 2772 struct infra_key* k = (struct infra_key*)e->key; 2773 struct infra_data* d = (struct infra_data*)e->data; 2774 char ip_str[1024]; 2775 char name[LDNS_MAX_DOMAINLEN]; 2776 int port; 2777 if(a->ssl_failed) 2778 return; 2779 addr_to_str(&k->addr, k->addrlen, ip_str, sizeof(ip_str)); 2780 dname_str(k->zonename, name); 2781 port = (int)ntohs(((struct sockaddr_in*)&k->addr)->sin_port); 2782 if(port != UNBOUND_DNS_PORT) { 2783 snprintf(ip_str+strlen(ip_str), sizeof(ip_str)-strlen(ip_str), 2784 "@%d", port); 2785 } 2786 /* skip expired stuff (only backed off) */ 2787 if(d->ttl < a->now) { 2788 if(d->rtt.rto >= USEFUL_SERVER_TOP_TIMEOUT) { 2789 if(!ssl_printf(a->ssl, "%s %s expired rto %d\n", ip_str, 2790 name, d->rtt.rto)) { 2791 a->ssl_failed = 1; 2792 return; 2793 } 2794 } 2795 return; 2796 } 2797 if(!ssl_printf(a->ssl, "%s %s ttl %lu ping %d var %d rtt %d rto %d " 2798 "tA %d tAAAA %d tother %d " 2799 "ednsknown %d edns %d delay %d lame dnssec %d rec %d A %d " 2800 "other %d\n", ip_str, name, (unsigned long)(d->ttl - a->now), 2801 d->rtt.srtt, d->rtt.rttvar, rtt_notimeout(&d->rtt), d->rtt.rto, 2802 d->timeout_A, d->timeout_AAAA, d->timeout_other, 2803 (int)d->edns_lame_known, (int)d->edns_version, 2804 (int)(a->now<d->probedelay?(d->probedelay - a->now):0), 2805 (int)d->isdnsseclame, (int)d->rec_lame, (int)d->lame_type_A, 2806 (int)d->lame_other)) { 2807 a->ssl_failed = 1; 2808 return; 2809 } 2810 } 2811 2812 /** do the dump_infra command */ 2813 static void 2814 do_dump_infra(RES* ssl, struct worker* worker) 2815 { 2816 struct infra_arg arg; 2817 arg.infra = worker->env.infra_cache; 2818 arg.ssl = ssl; 2819 arg.now = *worker->env.now; 2820 arg.ssl_failed = 0; 2821 slabhash_traverse(arg.infra->hosts, 0, &dump_infra_host, (void*)&arg); 2822 } 2823 2824 /** do the log_reopen command */ 2825 static void 2826 do_log_reopen(RES* ssl, struct worker* worker) 2827 { 2828 struct config_file* cfg = worker->env.cfg; 2829 send_ok(ssl); 2830 log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir); 2831 } 2832 2833 /** do the auth_zone_reload command */ 2834 static void 2835 do_auth_zone_reload(RES* ssl, struct worker* worker, char* arg) 2836 { 2837 size_t nmlen; 2838 int nmlabs; 2839 uint8_t* nm = NULL; 2840 struct auth_zones* az = worker->env.auth_zones; 2841 struct auth_zone* z = NULL; 2842 struct auth_xfer* xfr = NULL; 2843 char* reason = NULL; 2844 if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs)) 2845 return; 2846 if(az) { 2847 lock_rw_rdlock(&az->lock); 2848 z = auth_zone_find(az, nm, nmlen, LDNS_RR_CLASS_IN); 2849 if(z) { 2850 lock_rw_wrlock(&z->lock); 2851 } 2852 xfr = auth_xfer_find(az, nm, nmlen, LDNS_RR_CLASS_IN); 2853 if(xfr) { 2854 lock_basic_lock(&xfr->lock); 2855 } 2856 lock_rw_unlock(&az->lock); 2857 } 2858 free(nm); 2859 if(!z) { 2860 if(xfr) { 2861 lock_basic_unlock(&xfr->lock); 2862 } 2863 (void)ssl_printf(ssl, "error no auth-zone %s\n", arg); 2864 return; 2865 } 2866 if(!auth_zone_read_zonefile(z, worker->env.cfg)) { 2867 lock_rw_unlock(&z->lock); 2868 if(xfr) { 2869 lock_basic_unlock(&xfr->lock); 2870 } 2871 (void)ssl_printf(ssl, "error failed to read %s\n", arg); 2872 return; 2873 } 2874 2875 z->zone_expired = 0; 2876 if(xfr) { 2877 xfr->zone_expired = 0; 2878 if(!xfr_find_soa(z, xfr)) { 2879 if(z->data.count == 0) { 2880 lock_rw_unlock(&z->lock); 2881 lock_basic_unlock(&xfr->lock); 2882 (void)ssl_printf(ssl, "zone %s has no contents\n", arg); 2883 return; 2884 } 2885 lock_rw_unlock(&z->lock); 2886 lock_basic_unlock(&xfr->lock); 2887 (void)ssl_printf(ssl, "error: no SOA in zone after read %s\n", arg); 2888 return; 2889 } 2890 if(xfr->have_zone) 2891 xfr->lease_time = *worker->env.now; 2892 lock_basic_unlock(&xfr->lock); 2893 } 2894 2895 auth_zone_verify_zonemd(z, &worker->env, &worker->env.mesh->mods, 2896 &reason, 0, 0); 2897 if(reason && z->zone_expired) { 2898 lock_rw_unlock(&z->lock); 2899 (void)ssl_printf(ssl, "error zonemd for %s failed: %s\n", 2900 arg, reason); 2901 free(reason); 2902 return; 2903 } else if(reason && strcmp(reason, "ZONEMD verification successful") 2904 ==0) { 2905 (void)ssl_printf(ssl, "%s: %s\n", arg, reason); 2906 } 2907 lock_rw_unlock(&z->lock); 2908 free(reason); 2909 send_ok(ssl); 2910 } 2911 2912 /** do the auth_zone_transfer command */ 2913 static void 2914 do_auth_zone_transfer(RES* ssl, struct worker* worker, char* arg) 2915 { 2916 size_t nmlen; 2917 int nmlabs; 2918 uint8_t* nm = NULL; 2919 struct auth_zones* az = worker->env.auth_zones; 2920 if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs)) 2921 return; 2922 if(!az || !auth_zones_startprobesequence(az, &worker->env, nm, nmlen, 2923 LDNS_RR_CLASS_IN)) { 2924 (void)ssl_printf(ssl, "error zone xfr task not found %s\n", arg); 2925 free(nm); 2926 return; 2927 } 2928 free(nm); 2929 send_ok(ssl); 2930 } 2931 2932 /** do the set_option command */ 2933 static void 2934 do_set_option(RES* ssl, struct worker* worker, char* arg) 2935 { 2936 char* arg2; 2937 if(!find_arg2(ssl, arg, &arg2)) 2938 return; 2939 if(!config_set_option(worker->env.cfg, arg, arg2)) { 2940 (void)ssl_printf(ssl, "error setting option\n"); 2941 return; 2942 } 2943 /* effectuate some arguments */ 2944 if(strcmp(arg, "val-override-date:") == 0) { 2945 int m = modstack_find(&worker->env.mesh->mods, "validator"); 2946 struct val_env* val_env = NULL; 2947 if(m != -1) val_env = (struct val_env*)worker->env.modinfo[m]; 2948 if(val_env) 2949 val_env->date_override = worker->env.cfg->val_date_override; 2950 } 2951 send_ok(ssl); 2952 } 2953 2954 /* routine to printout option values over SSL */ 2955 void remote_get_opt_ssl(char* line, void* arg) 2956 { 2957 RES* ssl = (RES*)arg; 2958 (void)ssl_printf(ssl, "%s\n", line); 2959 } 2960 2961 /** do the get_option command */ 2962 static void 2963 do_get_option(RES* ssl, struct worker* worker, char* arg) 2964 { 2965 int r; 2966 r = config_get_option(worker->env.cfg, arg, remote_get_opt_ssl, ssl); 2967 if(!r) { 2968 (void)ssl_printf(ssl, "error unknown option\n"); 2969 return; 2970 } 2971 } 2972 2973 /** do the list_forwards command */ 2974 static void 2975 do_list_forwards(RES* ssl, struct worker* worker) 2976 { 2977 /* since its a per-worker structure no locks needed */ 2978 struct iter_forwards* fwds = worker->env.fwds; 2979 struct iter_forward_zone* z; 2980 struct trust_anchor* a; 2981 int insecure; 2982 lock_rw_rdlock(&fwds->lock); 2983 RBTREE_FOR(z, struct iter_forward_zone*, fwds->tree) { 2984 if(!z->dp) continue; /* skip empty marker for stub */ 2985 2986 /* see if it is insecure */ 2987 insecure = 0; 2988 if(worker->env.anchors && 2989 (a=anchor_find(worker->env.anchors, z->name, 2990 z->namelabs, z->namelen, z->dclass))) { 2991 if(!a->keylist && !a->numDS && !a->numDNSKEY) 2992 insecure = 1; 2993 lock_basic_unlock(&a->lock); 2994 } 2995 2996 if(!ssl_print_name_dp(ssl, (insecure?"forward +i":"forward"), 2997 z->name, z->dclass, z->dp)) { 2998 lock_rw_unlock(&fwds->lock); 2999 return; 3000 } 3001 } 3002 lock_rw_unlock(&fwds->lock); 3003 } 3004 3005 /** do the list_stubs command */ 3006 static void 3007 do_list_stubs(RES* ssl, struct worker* worker) 3008 { 3009 struct iter_hints_stub* z; 3010 struct trust_anchor* a; 3011 int insecure; 3012 char str[32]; 3013 lock_rw_rdlock(&worker->env.hints->lock); 3014 RBTREE_FOR(z, struct iter_hints_stub*, &worker->env.hints->tree) { 3015 3016 /* see if it is insecure */ 3017 insecure = 0; 3018 if(worker->env.anchors && 3019 (a=anchor_find(worker->env.anchors, z->node.name, 3020 z->node.labs, z->node.len, z->node.dclass))) { 3021 if(!a->keylist && !a->numDS && !a->numDNSKEY) 3022 insecure = 1; 3023 lock_basic_unlock(&a->lock); 3024 } 3025 3026 snprintf(str, sizeof(str), "stub %sprime%s", 3027 (z->noprime?"no":""), (insecure?" +i":"")); 3028 if(!ssl_print_name_dp(ssl, str, z->node.name, 3029 z->node.dclass, z->dp)) { 3030 lock_rw_unlock(&worker->env.hints->lock); 3031 return; 3032 } 3033 } 3034 lock_rw_unlock(&worker->env.hints->lock); 3035 } 3036 3037 /** do the list_auth_zones command */ 3038 static void 3039 do_list_auth_zones(RES* ssl, struct auth_zones* az) 3040 { 3041 struct auth_zone* z; 3042 char buf[LDNS_MAX_DOMAINLEN], buf2[256]; 3043 lock_rw_rdlock(&az->lock); 3044 RBTREE_FOR(z, struct auth_zone*, &az->ztree) { 3045 lock_rw_rdlock(&z->lock); 3046 dname_str(z->name, buf); 3047 if(z->zone_expired) 3048 snprintf(buf2, sizeof(buf2), "expired"); 3049 else { 3050 uint32_t serial = 0; 3051 if(auth_zone_get_serial(z, &serial)) 3052 snprintf(buf2, sizeof(buf2), "serial %u", 3053 (unsigned)serial); 3054 else snprintf(buf2, sizeof(buf2), "no serial"); 3055 } 3056 if(!ssl_printf(ssl, "%s\t%s\n", buf, buf2)) { 3057 /* failure to print */ 3058 lock_rw_unlock(&z->lock); 3059 lock_rw_unlock(&az->lock); 3060 return; 3061 } 3062 lock_rw_unlock(&z->lock); 3063 } 3064 lock_rw_unlock(&az->lock); 3065 } 3066 3067 /** do the list_local_zones command */ 3068 static void 3069 do_list_local_zones(RES* ssl, struct local_zones* zones) 3070 { 3071 struct local_zone* z; 3072 char buf[LDNS_MAX_DOMAINLEN]; 3073 lock_rw_rdlock(&zones->lock); 3074 RBTREE_FOR(z, struct local_zone*, &zones->ztree) { 3075 lock_rw_rdlock(&z->lock); 3076 dname_str(z->name, buf); 3077 if(!ssl_printf(ssl, "%s %s\n", buf, 3078 local_zone_type2str(z->type))) { 3079 /* failure to print */ 3080 lock_rw_unlock(&z->lock); 3081 lock_rw_unlock(&zones->lock); 3082 return; 3083 } 3084 lock_rw_unlock(&z->lock); 3085 } 3086 lock_rw_unlock(&zones->lock); 3087 } 3088 3089 /** do the list_local_data command */ 3090 static void 3091 do_list_local_data(RES* ssl, struct worker* worker, struct local_zones* zones) 3092 { 3093 struct local_zone* z; 3094 struct local_data* d; 3095 struct local_rrset* p; 3096 char* s = (char*)sldns_buffer_begin(worker->env.scratch_buffer); 3097 size_t slen = sldns_buffer_capacity(worker->env.scratch_buffer); 3098 lock_rw_rdlock(&zones->lock); 3099 RBTREE_FOR(z, struct local_zone*, &zones->ztree) { 3100 lock_rw_rdlock(&z->lock); 3101 RBTREE_FOR(d, struct local_data*, &z->data) { 3102 for(p = d->rrsets; p; p = p->next) { 3103 struct packed_rrset_data* d = 3104 (struct packed_rrset_data*)p->rrset->entry.data; 3105 size_t i; 3106 for(i=0; i<d->count + d->rrsig_count; i++) { 3107 if(!packed_rr_to_string(p->rrset, i, 3108 0, s, slen)) { 3109 if(!ssl_printf(ssl, "BADRR\n")) { 3110 lock_rw_unlock(&z->lock); 3111 lock_rw_unlock(&zones->lock); 3112 return; 3113 } 3114 } 3115 if(!ssl_printf(ssl, "%s\n", s)) { 3116 lock_rw_unlock(&z->lock); 3117 lock_rw_unlock(&zones->lock); 3118 return; 3119 } 3120 } 3121 } 3122 } 3123 lock_rw_unlock(&z->lock); 3124 } 3125 lock_rw_unlock(&zones->lock); 3126 } 3127 3128 /** do the view_list_local_zones command */ 3129 static void 3130 do_view_list_local_zones(RES* ssl, struct worker* worker, char* arg) 3131 { 3132 struct view* v = views_find_view(worker->env.views, 3133 arg, 0 /* get read lock*/); 3134 if(!v) { 3135 ssl_printf(ssl,"no view with name: %s\n", arg); 3136 return; 3137 } 3138 if(v->local_zones) { 3139 do_list_local_zones(ssl, v->local_zones); 3140 } 3141 lock_rw_unlock(&v->lock); 3142 } 3143 3144 /** do the view_list_local_data command */ 3145 static void 3146 do_view_list_local_data(RES* ssl, struct worker* worker, char* arg) 3147 { 3148 struct view* v = views_find_view(worker->env.views, 3149 arg, 0 /* get read lock*/); 3150 if(!v) { 3151 ssl_printf(ssl,"no view with name: %s\n", arg); 3152 return; 3153 } 3154 if(v->local_zones) { 3155 do_list_local_data(ssl, worker, v->local_zones); 3156 } 3157 lock_rw_unlock(&v->lock); 3158 } 3159 3160 /** struct for user arg ratelimit list */ 3161 struct ratelimit_list_arg { 3162 /** the infra cache */ 3163 struct infra_cache* infra; 3164 /** the SSL to print to */ 3165 RES* ssl; 3166 /** all or only ratelimited */ 3167 int all; 3168 /** current time */ 3169 time_t now; 3170 /** if backoff is enabled */ 3171 int backoff; 3172 }; 3173 3174 #define ip_ratelimit_list_arg ratelimit_list_arg 3175 3176 /** list items in the ratelimit table */ 3177 static void 3178 rate_list(struct lruhash_entry* e, void* arg) 3179 { 3180 struct ratelimit_list_arg* a = (struct ratelimit_list_arg*)arg; 3181 struct rate_key* k = (struct rate_key*)e->key; 3182 struct rate_data* d = (struct rate_data*)e->data; 3183 char buf[LDNS_MAX_DOMAINLEN]; 3184 int lim = infra_find_ratelimit(a->infra, k->name, k->namelen); 3185 int max = infra_rate_max(d, a->now, a->backoff); 3186 if(a->all == 0) { 3187 if(max < lim) 3188 return; 3189 } 3190 dname_str(k->name, buf); 3191 ssl_printf(a->ssl, "%s %d limit %d\n", buf, max, lim); 3192 } 3193 3194 /** list items in the ip_ratelimit table */ 3195 static void 3196 ip_rate_list(struct lruhash_entry* e, void* arg) 3197 { 3198 char ip[128]; 3199 struct ip_ratelimit_list_arg* a = (struct ip_ratelimit_list_arg*)arg; 3200 struct ip_rate_key* k = (struct ip_rate_key*)e->key; 3201 struct ip_rate_data* d = (struct ip_rate_data*)e->data; 3202 int lim = infra_ip_ratelimit; 3203 int max = infra_rate_max(d, a->now, a->backoff); 3204 if(a->all == 0) { 3205 if(max < lim) 3206 return; 3207 } 3208 addr_to_str(&k->addr, k->addrlen, ip, sizeof(ip)); 3209 ssl_printf(a->ssl, "%s %d limit %d\n", ip, max, lim); 3210 } 3211 3212 /** do the ratelimit_list command */ 3213 static void 3214 do_ratelimit_list(RES* ssl, struct worker* worker, char* arg) 3215 { 3216 struct ratelimit_list_arg a; 3217 a.all = 0; 3218 a.infra = worker->env.infra_cache; 3219 a.now = *worker->env.now; 3220 a.ssl = ssl; 3221 a.backoff = worker->env.cfg->ratelimit_backoff; 3222 arg = skipwhite(arg); 3223 if(strcmp(arg, "+a") == 0) 3224 a.all = 1; 3225 if(a.infra->domain_rates==NULL || 3226 (a.all == 0 && infra_dp_ratelimit == 0)) 3227 return; 3228 slabhash_traverse(a.infra->domain_rates, 0, rate_list, &a); 3229 } 3230 3231 /** do the ip_ratelimit_list command */ 3232 static void 3233 do_ip_ratelimit_list(RES* ssl, struct worker* worker, char* arg) 3234 { 3235 struct ip_ratelimit_list_arg a; 3236 a.all = 0; 3237 a.infra = worker->env.infra_cache; 3238 a.now = *worker->env.now; 3239 a.ssl = ssl; 3240 a.backoff = worker->env.cfg->ip_ratelimit_backoff; 3241 arg = skipwhite(arg); 3242 if(strcmp(arg, "+a") == 0) 3243 a.all = 1; 3244 if(a.infra->client_ip_rates==NULL || 3245 (a.all == 0 && infra_ip_ratelimit == 0)) 3246 return; 3247 slabhash_traverse(a.infra->client_ip_rates, 0, ip_rate_list, &a); 3248 } 3249 3250 /** do the rpz_enable/disable command */ 3251 static void 3252 do_rpz_enable_disable(RES* ssl, struct worker* worker, char* arg, int enable) { 3253 size_t nmlen; 3254 int nmlabs; 3255 uint8_t *nm = NULL; 3256 struct auth_zones *az = worker->env.auth_zones; 3257 struct auth_zone *z = NULL; 3258 if (!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs)) 3259 return; 3260 if (az) { 3261 lock_rw_rdlock(&az->lock); 3262 z = auth_zone_find(az, nm, nmlen, LDNS_RR_CLASS_IN); 3263 if (z) { 3264 lock_rw_wrlock(&z->lock); 3265 } 3266 lock_rw_unlock(&az->lock); 3267 } 3268 free(nm); 3269 if (!z) { 3270 (void) ssl_printf(ssl, "error no auth-zone %s\n", arg); 3271 return; 3272 } 3273 if (!z->rpz) { 3274 (void) ssl_printf(ssl, "error auth-zone %s not RPZ\n", arg); 3275 lock_rw_unlock(&z->lock); 3276 return; 3277 } 3278 if (enable) { 3279 rpz_enable(z->rpz); 3280 } else { 3281 rpz_disable(z->rpz); 3282 } 3283 lock_rw_unlock(&z->lock); 3284 send_ok(ssl); 3285 } 3286 3287 /** do the rpz_enable command */ 3288 static void 3289 do_rpz_enable(RES* ssl, struct worker* worker, char* arg) 3290 { 3291 do_rpz_enable_disable(ssl, worker, arg, 1); 3292 } 3293 3294 /** do the rpz_disable command */ 3295 static void 3296 do_rpz_disable(RES* ssl, struct worker* worker, char* arg) 3297 { 3298 do_rpz_enable_disable(ssl, worker, arg, 0); 3299 } 3300 3301 /** Write the cookie secrets to file, returns `0` on failure. 3302 * Caller has to hold the lock. */ 3303 static int 3304 cookie_secret_file_dump(RES* ssl, struct worker* worker) { 3305 char const* secret_file = worker->env.cfg->cookie_secret_file; 3306 struct cookie_secrets* cookie_secrets = worker->daemon->cookie_secrets; 3307 char secret_hex[UNBOUND_COOKIE_SECRET_SIZE * 2 + 1]; 3308 FILE* f; 3309 size_t i; 3310 if(secret_file == NULL || secret_file[0]==0) { 3311 (void)ssl_printf(ssl, "error: no cookie secret file configured\n"); 3312 return 0; 3313 } 3314 log_assert( secret_file != NULL ); 3315 3316 /* open write only and truncate */ 3317 if((f = fopen(secret_file, "w")) == NULL ) { 3318 (void)ssl_printf(ssl, "unable to open cookie secret file %s: %s", 3319 secret_file, strerror(errno)); 3320 return 0; 3321 } 3322 if(cookie_secrets == NULL) { 3323 /* nothing to write */ 3324 fclose(f); 3325 return 1; 3326 } 3327 3328 for(i = 0; i < cookie_secrets->cookie_count; i++) { 3329 struct cookie_secret const* cs = &cookie_secrets-> 3330 cookie_secrets[i]; 3331 ssize_t const len = hex_ntop(cs->cookie_secret, 3332 UNBOUND_COOKIE_SECRET_SIZE, secret_hex, 3333 sizeof(secret_hex)); 3334 (void)len; /* silence unused variable warning with -DNDEBUG */ 3335 log_assert( len == UNBOUND_COOKIE_SECRET_SIZE * 2 ); 3336 secret_hex[UNBOUND_COOKIE_SECRET_SIZE * 2] = '\0'; 3337 fprintf(f, "%s\n", secret_hex); 3338 } 3339 explicit_bzero(secret_hex, sizeof(secret_hex)); 3340 fclose(f); 3341 return 1; 3342 } 3343 3344 /** Activate cookie secret */ 3345 static void 3346 do_activate_cookie_secret(RES* ssl, struct worker* worker) { 3347 char const* secret_file = worker->env.cfg->cookie_secret_file; 3348 struct cookie_secrets* cookie_secrets = worker->daemon->cookie_secrets; 3349 3350 if(secret_file == NULL || secret_file[0] == 0) { 3351 (void)ssl_printf(ssl, "error: no cookie secret file configured\n"); 3352 return; 3353 } 3354 if(cookie_secrets == NULL) { 3355 (void)ssl_printf(ssl, "error: there are no cookie_secrets."); 3356 return; 3357 } 3358 lock_basic_lock(&cookie_secrets->lock); 3359 3360 if(cookie_secrets->cookie_count <= 1 ) { 3361 lock_basic_unlock(&cookie_secrets->lock); 3362 (void)ssl_printf(ssl, "error: no staging cookie secret to activate\n"); 3363 return; 3364 } 3365 /* Only the worker 0 writes to file, the others update state. */ 3366 if(worker->thread_num == 0 && !cookie_secret_file_dump(ssl, worker)) { 3367 lock_basic_unlock(&cookie_secrets->lock); 3368 (void)ssl_printf(ssl, "error: writing to cookie secret file: \"%s\"\n", 3369 secret_file); 3370 return; 3371 } 3372 activate_cookie_secret(cookie_secrets); 3373 if(worker->thread_num == 0) 3374 (void)cookie_secret_file_dump(ssl, worker); 3375 lock_basic_unlock(&cookie_secrets->lock); 3376 send_ok(ssl); 3377 } 3378 3379 /** Drop cookie secret */ 3380 static void 3381 do_drop_cookie_secret(RES* ssl, struct worker* worker) { 3382 char const* secret_file = worker->env.cfg->cookie_secret_file; 3383 struct cookie_secrets* cookie_secrets = worker->daemon->cookie_secrets; 3384 3385 if(secret_file == NULL || secret_file[0] == 0) { 3386 (void)ssl_printf(ssl, "error: no cookie secret file configured\n"); 3387 return; 3388 } 3389 if(cookie_secrets == NULL) { 3390 (void)ssl_printf(ssl, "error: there are no cookie_secrets."); 3391 return; 3392 } 3393 lock_basic_lock(&cookie_secrets->lock); 3394 3395 if(cookie_secrets->cookie_count <= 1 ) { 3396 lock_basic_unlock(&cookie_secrets->lock); 3397 (void)ssl_printf(ssl, "error: can not drop the currently active cookie secret\n"); 3398 return; 3399 } 3400 /* Only the worker 0 writes to file, the others update state. */ 3401 if(worker->thread_num == 0 && !cookie_secret_file_dump(ssl, worker)) { 3402 lock_basic_unlock(&cookie_secrets->lock); 3403 (void)ssl_printf(ssl, "error: writing to cookie secret file: \"%s\"\n", 3404 secret_file); 3405 return; 3406 } 3407 drop_cookie_secret(cookie_secrets); 3408 if(worker->thread_num == 0) 3409 (void)cookie_secret_file_dump(ssl, worker); 3410 lock_basic_unlock(&cookie_secrets->lock); 3411 send_ok(ssl); 3412 } 3413 3414 /** Add cookie secret */ 3415 static void 3416 do_add_cookie_secret(RES* ssl, struct worker* worker, char* arg) { 3417 uint8_t secret[UNBOUND_COOKIE_SECRET_SIZE]; 3418 char const* secret_file = worker->env.cfg->cookie_secret_file; 3419 struct cookie_secrets* cookie_secrets = worker->daemon->cookie_secrets; 3420 3421 if(secret_file == NULL || secret_file[0] == 0) { 3422 (void)ssl_printf(ssl, "error: no cookie secret file configured\n"); 3423 return; 3424 } 3425 if(cookie_secrets == NULL) { 3426 worker->daemon->cookie_secrets = cookie_secrets_create(); 3427 if(!worker->daemon->cookie_secrets) { 3428 (void)ssl_printf(ssl, "error: out of memory"); 3429 return; 3430 } 3431 cookie_secrets = worker->daemon->cookie_secrets; 3432 } 3433 lock_basic_lock(&cookie_secrets->lock); 3434 3435 if(*arg == '\0') { 3436 lock_basic_unlock(&cookie_secrets->lock); 3437 (void)ssl_printf(ssl, "error: missing argument (cookie_secret)\n"); 3438 return; 3439 } 3440 if(strlen(arg) != 32) { 3441 lock_basic_unlock(&cookie_secrets->lock); 3442 explicit_bzero(arg, strlen(arg)); 3443 (void)ssl_printf(ssl, "invalid cookie secret: invalid argument length\n"); 3444 (void)ssl_printf(ssl, "please provide a 128bit hex encoded secret\n"); 3445 return; 3446 } 3447 if(hex_pton(arg, secret, UNBOUND_COOKIE_SECRET_SIZE) != 3448 UNBOUND_COOKIE_SECRET_SIZE ) { 3449 lock_basic_unlock(&cookie_secrets->lock); 3450 explicit_bzero(secret, UNBOUND_COOKIE_SECRET_SIZE); 3451 explicit_bzero(arg, strlen(arg)); 3452 (void)ssl_printf(ssl, "invalid cookie secret: parse error\n"); 3453 (void)ssl_printf(ssl, "please provide a 128bit hex encoded secret\n"); 3454 return; 3455 } 3456 /* Only the worker 0 writes to file, the others update state. */ 3457 if(worker->thread_num == 0 && !cookie_secret_file_dump(ssl, worker)) { 3458 lock_basic_unlock(&cookie_secrets->lock); 3459 explicit_bzero(secret, UNBOUND_COOKIE_SECRET_SIZE); 3460 explicit_bzero(arg, strlen(arg)); 3461 (void)ssl_printf(ssl, "error: writing to cookie secret file: \"%s\"\n", 3462 secret_file); 3463 return; 3464 } 3465 add_cookie_secret(cookie_secrets, secret, UNBOUND_COOKIE_SECRET_SIZE); 3466 explicit_bzero(secret, UNBOUND_COOKIE_SECRET_SIZE); 3467 if(worker->thread_num == 0) 3468 (void)cookie_secret_file_dump(ssl, worker); 3469 lock_basic_unlock(&cookie_secrets->lock); 3470 explicit_bzero(arg, strlen(arg)); 3471 send_ok(ssl); 3472 } 3473 3474 /** Print cookie secrets */ 3475 static void 3476 do_print_cookie_secrets(RES* ssl, struct worker* worker) { 3477 struct cookie_secrets* cookie_secrets = worker->daemon->cookie_secrets; 3478 char secret_hex[UNBOUND_COOKIE_SECRET_SIZE * 2 + 1]; 3479 int i; 3480 3481 if(!cookie_secrets) 3482 return; /* Output is empty. */ 3483 lock_basic_lock(&cookie_secrets->lock); 3484 for(i = 0; (size_t)i < cookie_secrets->cookie_count; i++) { 3485 struct cookie_secret const* cs = &cookie_secrets-> 3486 cookie_secrets[i]; 3487 ssize_t const len = hex_ntop(cs->cookie_secret, 3488 UNBOUND_COOKIE_SECRET_SIZE, secret_hex, 3489 sizeof(secret_hex)); 3490 (void)len; /* silence unused variable warning with -DNDEBUG */ 3491 log_assert( len == UNBOUND_COOKIE_SECRET_SIZE * 2 ); 3492 secret_hex[UNBOUND_COOKIE_SECRET_SIZE * 2] = '\0'; 3493 if (i == 0) 3494 (void)ssl_printf(ssl, "active : %s\n", secret_hex); 3495 else if (cookie_secrets->cookie_count == 2) 3496 (void)ssl_printf(ssl, "staging: %s\n", secret_hex); 3497 else 3498 (void)ssl_printf(ssl, "staging[%d]: %s\n", i, 3499 secret_hex); 3500 } 3501 lock_basic_unlock(&cookie_secrets->lock); 3502 explicit_bzero(secret_hex, sizeof(secret_hex)); 3503 } 3504 3505 /** check for name with end-of-string, space or tab after it */ 3506 static int 3507 cmdcmp(char* p, const char* cmd, size_t len) 3508 { 3509 return strncmp(p,cmd,len)==0 && (p[len]==0||p[len]==' '||p[len]=='\t'); 3510 } 3511 3512 /** execute a remote control command */ 3513 static void 3514 execute_cmd(struct daemon_remote* rc, struct rc_state* s, RES* ssl, char* cmd, 3515 struct worker* worker) 3516 { 3517 char* p = skipwhite(cmd); 3518 /* compare command */ 3519 if(cmdcmp(p, "stop", 4)) { 3520 do_stop(ssl, worker); 3521 return; 3522 } else if(cmdcmp(p, "reload_keep_cache", 17)) { 3523 do_reload(ssl, worker, 1); 3524 return; 3525 } else if(cmdcmp(p, "reload", 6)) { 3526 do_reload(ssl, worker, 0); 3527 return; 3528 } else if(cmdcmp(p, "fast_reload", 11)) { 3529 do_fast_reload(ssl, worker, s, skipwhite(p+11)); 3530 return; 3531 } else if(cmdcmp(p, "stats_noreset", 13)) { 3532 do_stats(ssl, worker, 0); 3533 return; 3534 } else if(cmdcmp(p, "stats", 5)) { 3535 do_stats(ssl, worker, 1); 3536 return; 3537 } else if(cmdcmp(p, "status", 6)) { 3538 do_status(ssl, worker); 3539 return; 3540 } else if(cmdcmp(p, "dump_cache", 10)) { 3541 #ifdef THREADS_DISABLED 3542 if(worker->daemon->num > 1) { 3543 (void)ssl_printf(ssl, "dump_cache/load_cache is not " 3544 "supported in multi-process operation\n"); 3545 return; 3546 } 3547 #endif 3548 (void)dump_cache(ssl, worker); 3549 return; 3550 } else if(cmdcmp(p, "load_cache", 10)) { 3551 #ifdef THREADS_DISABLED 3552 if(worker->daemon->num > 1) { 3553 /* The warning can't be printed when stdin is sending 3554 * data; just return */ 3555 return; 3556 } 3557 #endif 3558 if(load_cache(ssl, worker)) send_ok(ssl); 3559 return; 3560 } else if(cmdcmp(p, "list_forwards", 13)) { 3561 do_list_forwards(ssl, worker); 3562 return; 3563 } else if(cmdcmp(p, "list_stubs", 10)) { 3564 do_list_stubs(ssl, worker); 3565 return; 3566 } else if(cmdcmp(p, "list_insecure", 13)) { 3567 do_insecure_list(ssl, worker); 3568 return; 3569 } else if(cmdcmp(p, "list_local_zones", 16)) { 3570 do_list_local_zones(ssl, worker->daemon->local_zones); 3571 return; 3572 } else if(cmdcmp(p, "list_local_data", 15)) { 3573 do_list_local_data(ssl, worker, worker->daemon->local_zones); 3574 return; 3575 } else if(cmdcmp(p, "view_list_local_zones", 21)) { 3576 do_view_list_local_zones(ssl, worker, skipwhite(p+21)); 3577 return; 3578 } else if(cmdcmp(p, "view_list_local_data", 20)) { 3579 do_view_list_local_data(ssl, worker, skipwhite(p+20)); 3580 return; 3581 } else if(cmdcmp(p, "ratelimit_list", 14)) { 3582 do_ratelimit_list(ssl, worker, p+14); 3583 return; 3584 } else if(cmdcmp(p, "ip_ratelimit_list", 17)) { 3585 do_ip_ratelimit_list(ssl, worker, p+17); 3586 return; 3587 } else if(cmdcmp(p, "list_auth_zones", 15)) { 3588 do_list_auth_zones(ssl, worker->env.auth_zones); 3589 return; 3590 } else if(cmdcmp(p, "auth_zone_reload", 16)) { 3591 do_auth_zone_reload(ssl, worker, skipwhite(p+16)); 3592 return; 3593 } else if(cmdcmp(p, "auth_zone_transfer", 18)) { 3594 do_auth_zone_transfer(ssl, worker, skipwhite(p+18)); 3595 return; 3596 } else if(cmdcmp(p, "insecure_add", 12)) { 3597 /* must always distribute this cmd */ 3598 if(rc) distribute_cmd(rc, ssl, cmd); 3599 do_insecure_add(ssl, worker, skipwhite(p+12)); 3600 return; 3601 } else if(cmdcmp(p, "insecure_remove", 15)) { 3602 /* must always distribute this cmd */ 3603 if(rc) distribute_cmd(rc, ssl, cmd); 3604 do_insecure_remove(ssl, worker, skipwhite(p+15)); 3605 return; 3606 } else if(cmdcmp(p, "flush_stats", 11)) { 3607 /* must always distribute this cmd */ 3608 if(rc) distribute_cmd(rc, ssl, cmd); 3609 do_flush_stats(ssl, worker); 3610 return; 3611 } else if(cmdcmp(p, "flush_requestlist", 17)) { 3612 /* must always distribute this cmd */ 3613 if(rc) distribute_cmd(rc, ssl, cmd); 3614 do_flush_requestlist(ssl, worker); 3615 return; 3616 } else if(cmdcmp(p, "lookup", 6)) { 3617 do_lookup(ssl, worker, skipwhite(p+6)); 3618 return; 3619 /* The following are commands that read stdin. 3620 * Each line needs to be distributed if THREADS_DISABLED. 3621 */ 3622 } else if(cmdcmp(p, "local_zones_remove", 18)) { 3623 do_zones_remove(rc, ssl, worker); 3624 return; 3625 } else if(cmdcmp(p, "local_zones", 11)) { 3626 do_zones_add(rc, ssl, worker); 3627 return; 3628 } else if(cmdcmp(p, "local_datas_remove", 18)) { 3629 do_datas_remove(rc, ssl, worker); 3630 return; 3631 } else if(cmdcmp(p, "local_datas", 11)) { 3632 do_datas_add(rc, ssl, worker); 3633 return; 3634 } else if(cmdcmp(p, "view_local_datas_remove", 23)){ 3635 do_view_datas_remove(rc, ssl, worker, skipwhite(p+23)); 3636 return; 3637 } else if(cmdcmp(p, "view_local_datas", 16)) { 3638 do_view_datas_add(rc, ssl, worker, skipwhite(p+16)); 3639 return; 3640 } else if(cmdcmp(p, "print_cookie_secrets", 20)) { 3641 do_print_cookie_secrets(ssl, worker); 3642 return; 3643 } 3644 3645 #ifdef THREADS_DISABLED 3646 /* other processes must execute the command as well */ 3647 /* commands that should not be distributed, returned above. */ 3648 if(rc) { /* only if this thread is the master (rc) thread */ 3649 /* done before the code below, which may split the string */ 3650 distribute_cmd(rc, ssl, cmd); 3651 } 3652 #endif 3653 if(cmdcmp(p, "verbosity", 9)) { 3654 do_verbosity(ssl, skipwhite(p+9)); 3655 } else if(cmdcmp(p, "local_zone_remove", 17)) { 3656 do_zone_remove(ssl, worker->daemon->local_zones, skipwhite(p+17)); 3657 } else if(cmdcmp(p, "local_zone", 10)) { 3658 do_zone_add(ssl, worker->daemon->local_zones, skipwhite(p+10)); 3659 } else if(cmdcmp(p, "local_data_remove", 17)) { 3660 do_data_remove(ssl, worker->daemon->local_zones, skipwhite(p+17)); 3661 } else if(cmdcmp(p, "local_data", 10)) { 3662 do_data_add(ssl, worker->daemon->local_zones, skipwhite(p+10)); 3663 } else if(cmdcmp(p, "forward_add", 11)) { 3664 do_forward_add(ssl, worker, skipwhite(p+11)); 3665 } else if(cmdcmp(p, "forward_remove", 14)) { 3666 do_forward_remove(ssl, worker, skipwhite(p+14)); 3667 } else if(cmdcmp(p, "forward", 7)) { 3668 do_forward(ssl, worker, skipwhite(p+7)); 3669 } else if(cmdcmp(p, "stub_add", 8)) { 3670 do_stub_add(ssl, worker, skipwhite(p+8)); 3671 } else if(cmdcmp(p, "stub_remove", 11)) { 3672 do_stub_remove(ssl, worker, skipwhite(p+11)); 3673 } else if(cmdcmp(p, "view_local_zone_remove", 22)) { 3674 do_view_zone_remove(ssl, worker, skipwhite(p+22)); 3675 } else if(cmdcmp(p, "view_local_zone", 15)) { 3676 do_view_zone_add(ssl, worker, skipwhite(p+15)); 3677 } else if(cmdcmp(p, "view_local_data_remove", 22)) { 3678 do_view_data_remove(ssl, worker, skipwhite(p+22)); 3679 } else if(cmdcmp(p, "view_local_data", 15)) { 3680 do_view_data_add(ssl, worker, skipwhite(p+15)); 3681 } else if(cmdcmp(p, "flush_zone", 10)) { 3682 do_flush_zone(ssl, worker, skipwhite(p+10)); 3683 } else if(cmdcmp(p, "flush_type", 10)) { 3684 do_flush_type(ssl, worker, skipwhite(p+10)); 3685 } else if(cmdcmp(p, "flush_infra", 11)) { 3686 do_flush_infra(ssl, worker, skipwhite(p+11)); 3687 } else if(cmdcmp(p, "flush", 5)) { 3688 do_flush_name(ssl, worker, skipwhite(p+5)); 3689 } else if(cmdcmp(p, "dump_requestlist", 16)) { 3690 do_dump_requestlist(ssl, worker); 3691 } else if(cmdcmp(p, "dump_infra", 10)) { 3692 do_dump_infra(ssl, worker); 3693 } else if(cmdcmp(p, "log_reopen", 10)) { 3694 do_log_reopen(ssl, worker); 3695 } else if(cmdcmp(p, "set_option", 10)) { 3696 do_set_option(ssl, worker, skipwhite(p+10)); 3697 } else if(cmdcmp(p, "get_option", 10)) { 3698 do_get_option(ssl, worker, skipwhite(p+10)); 3699 } else if(cmdcmp(p, "flush_bogus", 11)) { 3700 do_flush_bogus(ssl, worker, skipwhite(p+11)); 3701 } else if(cmdcmp(p, "flush_negative", 14)) { 3702 do_flush_negative(ssl, worker, skipwhite(p+14)); 3703 } else if(cmdcmp(p, "rpz_enable", 10)) { 3704 do_rpz_enable(ssl, worker, skipwhite(p+10)); 3705 } else if(cmdcmp(p, "rpz_disable", 11)) { 3706 do_rpz_disable(ssl, worker, skipwhite(p+11)); 3707 } else if(cmdcmp(p, "add_cookie_secret", 17)) { 3708 do_add_cookie_secret(ssl, worker, skipwhite(p+17)); 3709 } else if(cmdcmp(p, "drop_cookie_secret", 18)) { 3710 do_drop_cookie_secret(ssl, worker); 3711 } else if(cmdcmp(p, "activate_cookie_secret", 22)) { 3712 do_activate_cookie_secret(ssl, worker); 3713 } else { 3714 (void)ssl_printf(ssl, "error unknown command '%s'\n", p); 3715 } 3716 } 3717 3718 void 3719 daemon_remote_exec(struct worker* worker) 3720 { 3721 /* read the cmd string */ 3722 uint8_t* msg = NULL; 3723 uint32_t len = 0; 3724 if(!tube_read_msg(worker->cmd, &msg, &len, 0)) { 3725 log_err("daemon_remote_exec: tube_read_msg failed"); 3726 return; 3727 } 3728 verbose(VERB_ALGO, "remote exec distributed: %s", (char*)msg); 3729 execute_cmd(NULL, NULL, NULL, (char*)msg, worker); 3730 free(msg); 3731 } 3732 3733 /** handle remote control request */ 3734 static void 3735 handle_req(struct daemon_remote* rc, struct rc_state* s, RES* res) 3736 { 3737 int r; 3738 char pre[10]; 3739 char magic[7]; 3740 char buf[MAX_CMD_STRLINE]; 3741 #ifdef USE_WINSOCK 3742 /* makes it possible to set the socket blocking again. */ 3743 /* basically removes it from winsock_event ... */ 3744 WSAEventSelect(s->c->fd, NULL, 0); 3745 #endif 3746 fd_set_block(s->c->fd); 3747 3748 /* try to read magic UBCT[version]_space_ string */ 3749 if(res->ssl) { 3750 ERR_clear_error(); 3751 if((r=SSL_read(res->ssl, magic, (int)sizeof(magic)-1)) <= 0) { 3752 int r2; 3753 if((r2=SSL_get_error(res->ssl, r)) == SSL_ERROR_ZERO_RETURN) 3754 return; 3755 log_crypto_err_io("could not SSL_read", r2); 3756 return; 3757 } 3758 } else { 3759 while(1) { 3760 ssize_t rr = recv(res->fd, magic, sizeof(magic)-1, 0); 3761 if(rr <= 0) { 3762 if(rr == 0) return; 3763 if(errno == EINTR || errno == EAGAIN) 3764 continue; 3765 log_err("could not recv: %s", sock_strerror(errno)); 3766 return; 3767 } 3768 r = (int)rr; 3769 break; 3770 } 3771 } 3772 magic[6] = 0; 3773 if( r != 6 || strncmp(magic, "UBCT", 4) != 0) { 3774 verbose(VERB_QUERY, "control connection has bad magic string"); 3775 /* probably wrong tool connected, ignore it completely */ 3776 return; 3777 } 3778 3779 /* read the command line */ 3780 if(!ssl_read_line(res, buf, sizeof(buf))) { 3781 return; 3782 } 3783 snprintf(pre, sizeof(pre), "UBCT%d ", UNBOUND_CONTROL_VERSION); 3784 if(strcmp(magic, pre) != 0) { 3785 verbose(VERB_QUERY, "control connection had bad " 3786 "version %s, cmd: %s", magic, buf); 3787 ssl_printf(res, "error version mismatch\n"); 3788 return; 3789 } 3790 verbose(VERB_DETAIL, "control cmd: %s", buf); 3791 3792 /* figure out what to do */ 3793 execute_cmd(rc, s, res, buf, rc->worker); 3794 } 3795 3796 /** handle SSL_do_handshake changes to the file descriptor to wait for later */ 3797 static int 3798 remote_handshake_later(struct daemon_remote* rc, struct rc_state* s, 3799 struct comm_point* c, int r, int r2) 3800 { 3801 if(r2 == SSL_ERROR_WANT_READ) { 3802 if(s->shake_state == rc_hs_read) { 3803 /* try again later */ 3804 return 0; 3805 } 3806 s->shake_state = rc_hs_read; 3807 comm_point_listen_for_rw(c, 1, 0); 3808 return 0; 3809 } else if(r2 == SSL_ERROR_WANT_WRITE) { 3810 if(s->shake_state == rc_hs_write) { 3811 /* try again later */ 3812 return 0; 3813 } 3814 s->shake_state = rc_hs_write; 3815 comm_point_listen_for_rw(c, 0, 1); 3816 return 0; 3817 } else { 3818 if(r == 0) 3819 log_err("remote control connection closed prematurely"); 3820 log_addr(VERB_OPS, "failed connection from", 3821 &s->c->repinfo.remote_addr, s->c->repinfo.remote_addrlen); 3822 log_crypto_err_io("remote control failed ssl", r2); 3823 clean_point(rc, s); 3824 } 3825 return 0; 3826 } 3827 3828 int remote_control_callback(struct comm_point* c, void* arg, int err, 3829 struct comm_reply* ATTR_UNUSED(rep)) 3830 { 3831 RES res; 3832 struct rc_state* s = (struct rc_state*)arg; 3833 struct daemon_remote* rc = s->rc; 3834 int r; 3835 if(err != NETEVENT_NOERROR) { 3836 if(err==NETEVENT_TIMEOUT) 3837 log_err("remote control timed out"); 3838 clean_point(rc, s); 3839 return 0; 3840 } 3841 if(s->ssl) { 3842 /* (continue to) setup the SSL connection */ 3843 ERR_clear_error(); 3844 r = SSL_do_handshake(s->ssl); 3845 if(r != 1) { 3846 int r2 = SSL_get_error(s->ssl, r); 3847 return remote_handshake_later(rc, s, c, r, r2); 3848 } 3849 s->shake_state = rc_none; 3850 } 3851 3852 /* once handshake has completed, check authentication */ 3853 if (!rc->use_cert) { 3854 verbose(VERB_ALGO, "unauthenticated remote control connection"); 3855 } else if(SSL_get_verify_result(s->ssl) == X509_V_OK) { 3856 #ifdef HAVE_SSL_GET1_PEER_CERTIFICATE 3857 X509* x = SSL_get1_peer_certificate(s->ssl); 3858 #else 3859 X509* x = SSL_get_peer_certificate(s->ssl); 3860 #endif 3861 if(!x) { 3862 verbose(VERB_DETAIL, "remote control connection " 3863 "provided no client certificate"); 3864 clean_point(rc, s); 3865 return 0; 3866 } 3867 verbose(VERB_ALGO, "remote control connection authenticated"); 3868 X509_free(x); 3869 } else { 3870 verbose(VERB_DETAIL, "remote control connection failed to " 3871 "authenticate with client certificate"); 3872 clean_point(rc, s); 3873 return 0; 3874 } 3875 3876 /* if OK start to actually handle the request */ 3877 res.ssl = s->ssl; 3878 res.fd = c->fd; 3879 handle_req(rc, s, &res); 3880 3881 verbose(VERB_ALGO, "remote control operation completed"); 3882 clean_point(rc, s); 3883 return 0; 3884 } 3885 3886 /** 3887 * This routine polls a socket for readiness. 3888 * @param fd: file descriptor, -1 uses no fd for a timer only. 3889 * @param timeout: time in msec to wait. 0 means nonblocking test, 3890 * -1 waits blocking for events. 3891 * @param pollin: check for input event. 3892 * @param pollout: check for output event. 3893 * @param event: output variable, set to true if the event happens. 3894 * It is false if there was an error or timeout. 3895 * @return false is system call failure, also logged. 3896 */ 3897 static int 3898 sock_poll_timeout(int fd, int timeout, int pollin, int pollout, int* event) 3899 { 3900 int loopcount = 0; 3901 /* Loop if the system call returns an errno to do so, like EINTR. */ 3902 log_assert(pollin || pollout); 3903 while(1) { 3904 struct pollfd p, *fds; 3905 int nfds, ret; 3906 if(++loopcount > IPC_LOOP_MAX) { 3907 log_err("sock_poll_timeout: loop"); 3908 if(event) 3909 *event = 0; 3910 return 0; 3911 } 3912 if(fd == -1) { 3913 fds = NULL; 3914 nfds = 0; 3915 } else { 3916 fds = &p; 3917 nfds = 1; 3918 memset(&p, 0, sizeof(p)); 3919 p.fd = fd; 3920 #ifndef USE_WINSOCK 3921 p.events = POLLERR 3922 | POLLHUP 3923 ; 3924 #endif 3925 if(pollin) 3926 p.events |= POLLIN; 3927 if(pollout) 3928 p.events |= POLLOUT; 3929 } 3930 #ifndef USE_WINSOCK 3931 ret = poll(fds, nfds, timeout); 3932 #else 3933 if(fds == NULL) { 3934 Sleep(timeout); 3935 ret = 0; 3936 } else { 3937 ret = WSAPoll(fds, nfds, timeout); 3938 } 3939 #endif 3940 if(ret == -1) { 3941 #ifndef USE_WINSOCK 3942 if( 3943 errno == EINTR || errno == EAGAIN 3944 # ifdef EWOULDBLOCK 3945 || errno == EWOULDBLOCK 3946 # endif 3947 ) continue; /* Try again. */ 3948 #endif 3949 /* For WSAPoll we only get errors here: 3950 * o WSAENETDOWN 3951 * o WSAEFAULT 3952 * o WSAEINVAL 3953 * o WSAENOBUFS 3954 */ 3955 log_err("poll: %s", sock_strerror(errno)); 3956 if(event) 3957 *event = 0; 3958 return 0; 3959 } else if(ret == 0) { 3960 /* Timeout */ 3961 if(event) 3962 *event = 0; 3963 return 1; 3964 } 3965 break; 3966 } 3967 if(event) 3968 *event = 1; 3969 return 1; 3970 } 3971 3972 /** fast reload convert fast reload notification status to string */ 3973 static const char* 3974 fr_notification_to_string(enum fast_reload_notification status) 3975 { 3976 switch(status) { 3977 case fast_reload_notification_none: 3978 return "none"; 3979 case fast_reload_notification_done: 3980 return "done"; 3981 case fast_reload_notification_done_error: 3982 return "done_error"; 3983 case fast_reload_notification_exit: 3984 return "exit"; 3985 case fast_reload_notification_exited: 3986 return "exited"; 3987 case fast_reload_notification_printout: 3988 return "printout"; 3989 case fast_reload_notification_reload_stop: 3990 return "reload_stop"; 3991 case fast_reload_notification_reload_ack: 3992 return "reload_ack"; 3993 case fast_reload_notification_reload_nopause_poll: 3994 return "reload_nopause_poll"; 3995 case fast_reload_notification_reload_start: 3996 return "reload_start"; 3997 default: 3998 break; 3999 } 4000 return "unknown"; 4001 } 4002 4003 #ifndef THREADS_DISABLED 4004 /** fast reload, poll for notification incoming. True if quit */ 4005 static int 4006 fr_poll_for_quit(struct fast_reload_thread* fr) 4007 { 4008 int inevent, loopexit = 0, bcount = 0; 4009 uint32_t cmd; 4010 ssize_t ret; 4011 4012 if(fr->need_to_quit) 4013 return 1; 4014 /* Is there data? */ 4015 if(!sock_poll_timeout(fr->commpair[1], 0, 1, 0, &inevent)) { 4016 log_err("fr_poll_for_quit: poll failed"); 4017 return 0; 4018 } 4019 if(!inevent) 4020 return 0; 4021 4022 /* Read the data */ 4023 while(1) { 4024 if(++loopexit > IPC_LOOP_MAX) { 4025 log_err("fr_poll_for_quit: recv loops %s", 4026 sock_strerror(errno)); 4027 return 0; 4028 } 4029 ret = recv(fr->commpair[1], ((char*)&cmd)+bcount, 4030 sizeof(cmd)-bcount, 0); 4031 if(ret == -1) { 4032 if( 4033 #ifndef USE_WINSOCK 4034 errno == EINTR || errno == EAGAIN 4035 # ifdef EWOULDBLOCK 4036 || errno == EWOULDBLOCK 4037 # endif 4038 #else 4039 WSAGetLastError() == WSAEINTR || 4040 WSAGetLastError() == WSAEINPROGRESS || 4041 WSAGetLastError() == WSAEWOULDBLOCK 4042 #endif 4043 ) 4044 continue; /* Try again. */ 4045 log_err("fr_poll_for_quit: recv: %s", 4046 sock_strerror(errno)); 4047 return 0; 4048 } else if(ret+(ssize_t)bcount != sizeof(cmd)) { 4049 bcount += ret; 4050 if((size_t)bcount < sizeof(cmd)) 4051 continue; 4052 } 4053 break; 4054 } 4055 if(cmd == fast_reload_notification_exit) { 4056 fr->need_to_quit = 1; 4057 verbose(VERB_ALGO, "fast reload: exit notification received"); 4058 return 1; 4059 } 4060 log_err("fr_poll_for_quit: unknown notification status received: %d %s", 4061 cmd, fr_notification_to_string(cmd)); 4062 return 0; 4063 } 4064 4065 /** fast reload thread. Send notification from the fast reload thread */ 4066 static void 4067 fr_send_notification(struct fast_reload_thread* fr, 4068 enum fast_reload_notification status) 4069 { 4070 int outevent, loopexit = 0, bcount = 0; 4071 uint32_t cmd; 4072 ssize_t ret; 4073 verbose(VERB_ALGO, "fast reload: send notification %s", 4074 fr_notification_to_string(status)); 4075 /* Make a blocking attempt to send. But meanwhile stay responsive, 4076 * once in a while for quit commands. In case the server has to quit. */ 4077 /* see if there is incoming quit signals */ 4078 if(fr_poll_for_quit(fr)) 4079 return; 4080 cmd = status; 4081 while(1) { 4082 if(++loopexit > IPC_LOOP_MAX) { 4083 log_err("fast reload: could not send notification"); 4084 return; 4085 } 4086 /* wait for socket to become writable */ 4087 if(!sock_poll_timeout(fr->commpair[1], IPC_NOTIFICATION_WAIT, 4088 0, 1, &outevent)) { 4089 log_err("fast reload: poll failed"); 4090 return; 4091 } 4092 if(fr_poll_for_quit(fr)) 4093 return; 4094 if(!outevent) 4095 continue; 4096 ret = send(fr->commpair[1], ((char*)&cmd)+bcount, 4097 sizeof(cmd)-bcount, 0); 4098 if(ret == -1) { 4099 if( 4100 #ifndef USE_WINSOCK 4101 errno == EINTR || errno == EAGAIN 4102 # ifdef EWOULDBLOCK 4103 || errno == EWOULDBLOCK 4104 # endif 4105 #else 4106 WSAGetLastError() == WSAEINTR || 4107 WSAGetLastError() == WSAEINPROGRESS || 4108 WSAGetLastError() == WSAEWOULDBLOCK 4109 #endif 4110 ) 4111 continue; /* Try again. */ 4112 log_err("fast reload send notification: send: %s", 4113 sock_strerror(errno)); 4114 return; 4115 } else if(ret+(ssize_t)bcount != sizeof(cmd)) { 4116 bcount += ret; 4117 if((size_t)bcount < sizeof(cmd)) 4118 continue; 4119 } 4120 break; 4121 } 4122 } 4123 4124 /** fast reload thread queue up text string for output */ 4125 static int 4126 fr_output_text(struct fast_reload_thread* fr, const char* msg) 4127 { 4128 char* item = strdup(msg); 4129 if(!item) { 4130 log_err("fast reload output text: strdup out of memory"); 4131 return 0; 4132 } 4133 lock_basic_lock(&fr->fr_output_lock); 4134 if(!cfg_strlist_append(fr->fr_output, item)) { 4135 lock_basic_unlock(&fr->fr_output_lock); 4136 /* The item is freed by cfg_strlist_append on failure. */ 4137 log_err("fast reload output text: append out of memory"); 4138 return 0; 4139 } 4140 lock_basic_unlock(&fr->fr_output_lock); 4141 return 1; 4142 } 4143 4144 /** fast reload thread output vmsg function */ 4145 static int 4146 fr_output_vmsg(struct fast_reload_thread* fr, const char* format, va_list args) 4147 { 4148 char msg[1024]; 4149 vsnprintf(msg, sizeof(msg), format, args); 4150 return fr_output_text(fr, msg); 4151 } 4152 4153 /** fast reload thread printout function, with printf arguments */ 4154 static int fr_output_printf(struct fast_reload_thread* fr, 4155 const char* format, ...) ATTR_FORMAT(printf, 2, 3); 4156 4157 /** fast reload thread printout function, prints to list and signals 4158 * the remote control thread to move that to get written to the socket 4159 * of the remote control connection. */ 4160 static int 4161 fr_output_printf(struct fast_reload_thread* fr, const char* format, ...) 4162 { 4163 va_list args; 4164 int ret; 4165 va_start(args, format); 4166 ret = fr_output_vmsg(fr, format, args); 4167 va_end(args); 4168 return ret; 4169 } 4170 4171 /** fast reload thread, init time counters */ 4172 static void 4173 fr_init_time(struct timeval* time_start, struct timeval* time_read, 4174 struct timeval* time_construct, struct timeval* time_reload, 4175 struct timeval* time_end) 4176 { 4177 memset(time_start, 0, sizeof(*time_start)); 4178 memset(time_read, 0, sizeof(*time_read)); 4179 memset(time_construct, 0, sizeof(*time_construct)); 4180 memset(time_reload, 0, sizeof(*time_reload)); 4181 memset(time_end, 0, sizeof(*time_end)); 4182 if(gettimeofday(time_start, NULL) < 0) 4183 log_err("gettimeofday: %s", strerror(errno)); 4184 } 4185 4186 /** 4187 * Structure with constructed elements for use during fast reload. 4188 * At the start it contains the tree items for the new config. 4189 * After the tree items are swapped into the server, the old elements 4190 * are kept in here. They can then be deleted. 4191 */ 4192 struct fast_reload_construct { 4193 /** construct for views */ 4194 struct views* views; 4195 /** construct for auth zones */ 4196 struct auth_zones* auth_zones; 4197 /** construct for forwards */ 4198 struct iter_forwards* fwds; 4199 /** construct for stubs */ 4200 struct iter_hints* hints; 4201 /** construct for respip_set */ 4202 struct respip_set* respip_set; 4203 /** construct for access control */ 4204 struct acl_list* acl; 4205 /** construct for access control interface */ 4206 struct acl_list* acl_interface; 4207 /** construct for tcp connection limit */ 4208 struct tcl_list* tcl; 4209 /** construct for local zones */ 4210 struct local_zones* local_zones; 4211 /** if there is response ip configuration in use */ 4212 int use_response_ip; 4213 /** if there is an rpz zone */ 4214 int use_rpz; 4215 /** construct for edns strings */ 4216 struct edns_strings* edns_strings; 4217 /** construct for trust anchors */ 4218 struct val_anchors* anchors; 4219 /** construct for nsec3 key size */ 4220 size_t* nsec3_keysize; 4221 /** construct for nsec3 max iter */ 4222 size_t* nsec3_maxiter; 4223 /** construct for nsec3 keyiter count */ 4224 int nsec3_keyiter_count; 4225 /** construct for target fetch policy */ 4226 int* target_fetch_policy; 4227 /** construct for max dependency depth */ 4228 int max_dependency_depth; 4229 /** construct for donotquery addresses */ 4230 struct iter_donotq* donotq; 4231 /** construct for private addresses and domains */ 4232 struct iter_priv* priv; 4233 /** construct whitelist for capsforid names */ 4234 struct rbtree_type* caps_white; 4235 /** construct for nat64 */ 4236 struct iter_nat64 nat64; 4237 /** construct for wait_limits_netblock */ 4238 struct rbtree_type wait_limits_netblock; 4239 /** construct for wait_limits_cookie_netblock */ 4240 struct rbtree_type wait_limits_cookie_netblock; 4241 /** construct for domain limits */ 4242 struct rbtree_type domain_limits; 4243 /** storage for the old configuration elements. The outer struct 4244 * is allocated with malloc here, the items are from config. */ 4245 struct config_file* oldcfg; 4246 }; 4247 4248 /** fast reload thread, read config */ 4249 static int 4250 fr_read_config(struct fast_reload_thread* fr, struct config_file** newcfg) 4251 { 4252 /* Create new config structure. */ 4253 *newcfg = config_create(); 4254 if(!*newcfg) { 4255 if(!fr_output_printf(fr, "config_create failed: out of memory\n")) 4256 return 0; 4257 fr_send_notification(fr, fast_reload_notification_printout); 4258 return 0; 4259 } 4260 if(fr_poll_for_quit(fr)) 4261 return 1; 4262 4263 /* Read new config from file */ 4264 if(!config_read(*newcfg, fr->worker->daemon->cfgfile, 4265 fr->worker->daemon->chroot)) { 4266 config_delete(*newcfg); 4267 if(!fr_output_printf(fr, "config_read %s%s%s%s failed: %s\n", 4268 (fr->worker->daemon->chroot?"<chroot:":""), 4269 (fr->worker->daemon->chroot?fr->worker->daemon->chroot:""), 4270 (fr->worker->daemon->chroot?"> ":""), 4271 fr->worker->daemon->cfgfile, strerror(errno))) 4272 return 0; 4273 fr_send_notification(fr, fast_reload_notification_printout); 4274 return 0; 4275 } 4276 if(fr_poll_for_quit(fr)) 4277 return 1; 4278 if(fr->fr_verb >= 1) { 4279 if(!fr_output_printf(fr, "done read config file %s%s%s%s\n", 4280 (fr->worker->daemon->chroot?"<chroot:":""), 4281 (fr->worker->daemon->chroot?fr->worker->daemon->chroot:""), 4282 (fr->worker->daemon->chroot?"> ":""), 4283 fr->worker->daemon->cfgfile)) 4284 return 0; 4285 fr_send_notification(fr, fast_reload_notification_printout); 4286 } 4287 4288 return 1; 4289 } 4290 4291 /** Check if two taglists are equal. */ 4292 static int 4293 taglist_equal(char** tagname_a, int num_tags_a, char** tagname_b, 4294 int num_tags_b) 4295 { 4296 int i; 4297 if(num_tags_a != num_tags_b) 4298 return 0; 4299 for(i=0; i<num_tags_a; i++) { 4300 if(strcmp(tagname_a[i], tagname_b[i]) != 0) 4301 return 0; 4302 } 4303 return 1; 4304 } 4305 4306 /** Check the change from a to b is only new entries at the end. */ 4307 static int 4308 taglist_change_at_end(char** tagname_a, int num_tags_a, char** tagname_b, 4309 int num_tags_b) 4310 { 4311 if(num_tags_a < 0 || num_tags_b < 0) 4312 return 0; 4313 if(num_tags_a >= num_tags_b) 4314 return 0; 4315 /* So, b is longer than a. Check if the initial start of the two 4316 * taglists is the same. */ 4317 if(!taglist_equal(tagname_a, num_tags_a, tagname_b, num_tags_a)) 4318 return 0; 4319 return 1; 4320 } 4321 4322 /** fast reload thread, check tag defines. */ 4323 static int 4324 fr_check_tag_defines(struct fast_reload_thread* fr, struct config_file* newcfg) 4325 { 4326 /* The tags are kept in a bitlist for items. Some of them are stored 4327 * in query info. If the tags change, then the old values are 4328 * inaccurate. The solution is to then flush the query list. 4329 * Unless the change only involves adding new tags at the end, that 4330 * needs no changes. */ 4331 if(!taglist_equal(fr->worker->daemon->cfg->tagname, 4332 fr->worker->daemon->cfg->num_tags, newcfg->tagname, 4333 newcfg->num_tags) && 4334 !taglist_change_at_end(fr->worker->daemon->cfg->tagname, 4335 fr->worker->daemon->cfg->num_tags, newcfg->tagname, 4336 newcfg->num_tags)) { 4337 /* The tags have changed too much, the define-tag config. */ 4338 if(fr->fr_drop_mesh) 4339 return 1; /* already dropping queries */ 4340 fr->fr_drop_mesh = 1; 4341 fr->worker->daemon->fast_reload_drop_mesh = fr->fr_drop_mesh; 4342 if(!fr_output_printf(fr, "tags have changed, with " 4343 "'define-tag', and the queries have to be dropped " 4344 "for consistency, setting '+d'\n")) 4345 return 0; 4346 fr_send_notification(fr, fast_reload_notification_printout); 4347 } 4348 return 1; 4349 } 4350 4351 /** fast reload thread, check if config item has changed, if not add to 4352 * the explanatory string. */ 4353 static void 4354 fr_check_changed_cfg(int cmp, const char* desc, char* str, size_t len) 4355 { 4356 if(cmp) { 4357 size_t slen = strlen(str); 4358 size_t desclen = strlen(desc); 4359 if(slen == 0) { 4360 snprintf(str, len, "%s", desc); 4361 return; 4362 } 4363 if(len - slen < desclen+2) 4364 return; /* It does not fit */ 4365 snprintf(str+slen, len-slen, " %s", desc); 4366 } 4367 } 4368 4369 /** fast reload thread, check if config string has changed, checks NULLs. */ 4370 static void 4371 fr_check_changed_cfg_str(char* cmp1, char* cmp2, const char* desc, char* str, 4372 size_t len) 4373 { 4374 if((!cmp1 && cmp2) || 4375 (cmp1 && !cmp2) || 4376 (cmp1 && cmp2 && strcmp(cmp1, cmp2) != 0)) { 4377 fr_check_changed_cfg(1, desc, str, len); 4378 } 4379 } 4380 4381 /** fast reload thread, check if config strlist has changed. */ 4382 static void 4383 fr_check_changed_cfg_strlist(struct config_strlist* cmp1, 4384 struct config_strlist* cmp2, const char* desc, char* str, size_t len) 4385 { 4386 struct config_strlist* p1 = cmp1, *p2 = cmp2; 4387 while(p1 && p2) { 4388 if((!p1->str && p2->str) || 4389 (p1->str && !p2->str) || 4390 (p1->str && p2->str && strcmp(p1->str, p2->str) != 0)) { 4391 /* The strlist is different. */ 4392 fr_check_changed_cfg(1, desc, str, len); 4393 return; 4394 } 4395 p1 = p1->next; 4396 p2 = p2->next; 4397 } 4398 if((!p1 && p2) || (p1 && !p2)) { 4399 fr_check_changed_cfg(1, desc, str, len); 4400 } 4401 } 4402 4403 /** fast reload thread, check if config str2list has changed. */ 4404 static void 4405 fr_check_changed_cfg_str2list(struct config_str2list* cmp1, 4406 struct config_str2list* cmp2, const char* desc, char* str, size_t len) 4407 { 4408 struct config_str2list* p1 = cmp1, *p2 = cmp2; 4409 while(p1 && p2) { 4410 if((!p1->str && p2->str) || 4411 (p1->str && !p2->str) || 4412 (p1->str && p2->str && strcmp(p1->str, p2->str) != 0)) { 4413 /* The str2list is different. */ 4414 fr_check_changed_cfg(1, desc, str, len); 4415 return; 4416 } 4417 if((!p1->str2 && p2->str2) || 4418 (p1->str2 && !p2->str2) || 4419 (p1->str2 && p2->str2 && 4420 strcmp(p1->str2, p2->str2) != 0)) { 4421 /* The str2list is different. */ 4422 fr_check_changed_cfg(1, desc, str, len); 4423 return; 4424 } 4425 p1 = p1->next; 4426 p2 = p2->next; 4427 } 4428 if((!p1 && p2) || (p1 && !p2)) { 4429 fr_check_changed_cfg(1, desc, str, len); 4430 } 4431 } 4432 4433 /** fast reload thread, check compatible config items */ 4434 static int 4435 fr_check_compat_cfg(struct fast_reload_thread* fr, struct config_file* newcfg) 4436 { 4437 int i; 4438 char changed_str[1024]; 4439 struct config_file* cfg = fr->worker->env.cfg; 4440 changed_str[0]=0; 4441 4442 /* Find incompatible options, and if so, print an error. */ 4443 fr_check_changed_cfg(cfg->num_threads != newcfg->num_threads, 4444 "num-threads", changed_str, sizeof(changed_str)); 4445 fr_check_changed_cfg(cfg->do_ip4 != newcfg->do_ip4, 4446 "do-ip4", changed_str, sizeof(changed_str)); 4447 fr_check_changed_cfg(cfg->do_ip6 != newcfg->do_ip6, 4448 "do-ip6", changed_str, sizeof(changed_str)); 4449 fr_check_changed_cfg(cfg->do_udp != newcfg->do_udp, 4450 "do-udp", changed_str, sizeof(changed_str)); 4451 fr_check_changed_cfg(cfg->do_tcp != newcfg->do_tcp, 4452 "do-tcp", changed_str, sizeof(changed_str)); 4453 fr_check_changed_cfg(cfg->port != newcfg->port, 4454 "port", changed_str, sizeof(changed_str)); 4455 /* But cfg->outgoing_num_ports has been changed at startup, 4456 * possibly to reduce it, so do not check it here. */ 4457 fr_check_changed_cfg(cfg->outgoing_num_tcp != newcfg->outgoing_num_tcp, 4458 "outgoing-num-tcp", changed_str, sizeof(changed_str)); 4459 fr_check_changed_cfg(cfg->incoming_num_tcp != newcfg->incoming_num_tcp, 4460 "incoming-num-tcp", changed_str, sizeof(changed_str)); 4461 fr_check_changed_cfg(cfg->num_out_ifs != newcfg->num_out_ifs, 4462 "outgoing-interface", changed_str, sizeof(changed_str)); 4463 if(cfg->num_out_ifs == newcfg->num_out_ifs) { 4464 for(i=0; i<cfg->num_out_ifs; i++) 4465 fr_check_changed_cfg(strcmp(cfg->out_ifs[i], 4466 newcfg->out_ifs[i]) != 0, "outgoing-interface", 4467 changed_str, sizeof(changed_str)); 4468 } 4469 fr_check_changed_cfg(cfg->num_ifs != newcfg->num_ifs, 4470 "interface", changed_str, sizeof(changed_str)); 4471 if(cfg->num_ifs == newcfg->num_ifs) { 4472 for(i=0; i<cfg->num_ifs; i++) 4473 fr_check_changed_cfg(strcmp(cfg->ifs[i], 4474 newcfg->ifs[i]) != 0, "interface", 4475 changed_str, sizeof(changed_str)); 4476 } 4477 fr_check_changed_cfg(cfg->if_automatic != newcfg->if_automatic, 4478 "interface-automatic", changed_str, sizeof(changed_str)); 4479 fr_check_changed_cfg(cfg->so_rcvbuf != newcfg->so_rcvbuf, 4480 "so-rcvbuf", changed_str, sizeof(changed_str)); 4481 fr_check_changed_cfg(cfg->so_sndbuf != newcfg->so_sndbuf, 4482 "so-sndbuf", changed_str, sizeof(changed_str)); 4483 fr_check_changed_cfg(cfg->so_reuseport != newcfg->so_reuseport, 4484 "so-reuseport", changed_str, sizeof(changed_str)); 4485 fr_check_changed_cfg(cfg->ip_transparent != newcfg->ip_transparent, 4486 "ip-transparent", changed_str, sizeof(changed_str)); 4487 fr_check_changed_cfg(cfg->ip_freebind != newcfg->ip_freebind, 4488 "ip-freebind", changed_str, sizeof(changed_str)); 4489 fr_check_changed_cfg(cfg->udp_connect != newcfg->udp_connect, 4490 "udp-connect", changed_str, sizeof(changed_str)); 4491 fr_check_changed_cfg(cfg->msg_buffer_size != newcfg->msg_buffer_size, 4492 "msg-buffer-size", changed_str, sizeof(changed_str)); 4493 fr_check_changed_cfg(cfg->do_tcp_keepalive != newcfg->do_tcp_keepalive, 4494 "edns-tcp-keepalive", changed_str, sizeof(changed_str)); 4495 fr_check_changed_cfg( 4496 cfg->tcp_keepalive_timeout != newcfg->tcp_keepalive_timeout, 4497 "edns-tcp-keepalive-timeout", changed_str, sizeof(changed_str)); 4498 fr_check_changed_cfg(cfg->tcp_idle_timeout != newcfg->tcp_idle_timeout, 4499 "tcp-idle-timeout", changed_str, sizeof(changed_str)); 4500 /* Not changed, only if DoH is used, it is then stored in commpoints, 4501 * as well as used from cfg. */ 4502 fr_check_changed_cfg( 4503 cfg->harden_large_queries != newcfg->harden_large_queries, 4504 "harden-large-queries", changed_str, sizeof(changed_str)); 4505 fr_check_changed_cfg(cfg->http_max_streams != newcfg->http_max_streams, 4506 "http-max-streams", changed_str, sizeof(changed_str)); 4507 fr_check_changed_cfg_str(cfg->http_endpoint, newcfg->http_endpoint, 4508 "http-endpoint", changed_str, sizeof(changed_str)); 4509 fr_check_changed_cfg( 4510 cfg->http_notls_downstream != newcfg->http_notls_downstream, 4511 "http_notls_downstream", changed_str, sizeof(changed_str)); 4512 fr_check_changed_cfg(cfg->https_port != newcfg->https_port, 4513 "https-port", changed_str, sizeof(changed_str)); 4514 fr_check_changed_cfg(cfg->ssl_port != newcfg->ssl_port, 4515 "tls-port", changed_str, sizeof(changed_str)); 4516 fr_check_changed_cfg_str(cfg->ssl_service_key, newcfg->ssl_service_key, 4517 "tls-service-key", changed_str, sizeof(changed_str)); 4518 fr_check_changed_cfg_str(cfg->ssl_service_pem, newcfg->ssl_service_pem, 4519 "tls-service-pem", changed_str, sizeof(changed_str)); 4520 fr_check_changed_cfg_str(cfg->tls_cert_bundle, newcfg->tls_cert_bundle, 4521 "tls-cert-bundle", changed_str, sizeof(changed_str)); 4522 fr_check_changed_cfg_strlist(cfg->proxy_protocol_port, 4523 newcfg->proxy_protocol_port, "proxy-protocol-port", 4524 changed_str, sizeof(changed_str)); 4525 fr_check_changed_cfg_strlist(cfg->tls_additional_port, 4526 newcfg->tls_additional_port, "tls-additional-port", 4527 changed_str, sizeof(changed_str)); 4528 fr_check_changed_cfg_str(cfg->if_automatic_ports, 4529 newcfg->if_automatic_ports, "interface-automatic-ports", 4530 changed_str, sizeof(changed_str)); 4531 fr_check_changed_cfg(cfg->udp_upstream_without_downstream != 4532 newcfg->udp_upstream_without_downstream, 4533 "udp-upstream-without-downstream", changed_str, 4534 sizeof(changed_str)); 4535 4536 if(changed_str[0] != 0) { 4537 /* The new config changes some items that do not work with 4538 * fast reload. */ 4539 if(!fr_output_printf(fr, "The config changes items that are " 4540 "not compatible with fast_reload, perhaps do reload " 4541 "or restart: %s", changed_str) || 4542 !fr_output_printf(fr, "\n")) 4543 return 0; 4544 fr_send_notification(fr, fast_reload_notification_printout); 4545 return 0; 4546 } 4547 return 1; 4548 } 4549 4550 /** fast reload thread, check nopause config items */ 4551 static int 4552 fr_check_nopause_cfg(struct fast_reload_thread* fr, struct config_file* newcfg) 4553 { 4554 char changed_str[1024]; 4555 struct config_file* cfg = fr->worker->env.cfg; 4556 if(!fr->fr_nopause) 4557 return 1; /* The nopause is not enabled, so no problem. */ 4558 changed_str[0]=0; 4559 4560 /* Check for iter_env. */ 4561 fr_check_changed_cfg( 4562 cfg->outbound_msg_retry != newcfg->outbound_msg_retry, 4563 "outbound-msg-retry", changed_str, sizeof(changed_str)); 4564 fr_check_changed_cfg(cfg->max_sent_count != newcfg->max_sent_count, 4565 "max-sent-count", changed_str, sizeof(changed_str)); 4566 fr_check_changed_cfg( 4567 cfg->max_query_restarts != newcfg->max_query_restarts, 4568 "max-query-restarts", changed_str, sizeof(changed_str)); 4569 fr_check_changed_cfg(strcmp(cfg->target_fetch_policy, 4570 newcfg->target_fetch_policy) != 0, 4571 "target-fetch-policy", changed_str, sizeof(changed_str)); 4572 fr_check_changed_cfg( 4573 cfg->donotquery_localhost != newcfg->donotquery_localhost, 4574 "do-not-query-localhost", changed_str, sizeof(changed_str)); 4575 fr_check_changed_cfg_strlist(cfg->donotqueryaddrs, 4576 newcfg->donotqueryaddrs, "do-not-query-localhost", 4577 changed_str, sizeof(changed_str)); 4578 fr_check_changed_cfg_strlist(cfg->private_address, 4579 newcfg->private_address, "private-address", 4580 changed_str, sizeof(changed_str)); 4581 fr_check_changed_cfg_strlist(cfg->private_domain, 4582 newcfg->private_domain, "private-domain", 4583 changed_str, sizeof(changed_str)); 4584 fr_check_changed_cfg_strlist(cfg->caps_whitelist, 4585 newcfg->caps_whitelist, "caps-exempt", 4586 changed_str, sizeof(changed_str)); 4587 fr_check_changed_cfg(cfg->do_nat64 != newcfg->do_nat64, 4588 "do-nat64", changed_str, sizeof(changed_str)); 4589 fr_check_changed_cfg_str(cfg->nat64_prefix, newcfg->nat64_prefix, 4590 "nat64-prefix", changed_str, sizeof(changed_str)); 4591 4592 /* Check for val_env. */ 4593 fr_check_changed_cfg(cfg->bogus_ttl != newcfg->bogus_ttl, 4594 "val-bogus-ttl", changed_str, sizeof(changed_str)); 4595 fr_check_changed_cfg( 4596 cfg->val_date_override != newcfg->val_date_override, 4597 "val-date-override", changed_str, sizeof(changed_str)); 4598 fr_check_changed_cfg(cfg->val_sig_skew_min != newcfg->val_sig_skew_min, 4599 "val-sig-skew-min", changed_str, sizeof(changed_str)); 4600 fr_check_changed_cfg(cfg->val_sig_skew_max != newcfg->val_sig_skew_max, 4601 "val-sig-skew-max", changed_str, sizeof(changed_str)); 4602 fr_check_changed_cfg(cfg->val_max_restart != newcfg->val_max_restart, 4603 "val-max-restart", changed_str, sizeof(changed_str)); 4604 fr_check_changed_cfg(strcmp(cfg->val_nsec3_key_iterations, 4605 newcfg->val_nsec3_key_iterations) != 0, 4606 "val-nsec3-keysize-iterations", changed_str, 4607 sizeof(changed_str)); 4608 4609 /* Check for infra. */ 4610 fr_check_changed_cfg(cfg->host_ttl != newcfg->host_ttl, 4611 "infra-host-ttl", changed_str, sizeof(changed_str)); 4612 fr_check_changed_cfg( 4613 cfg->infra_keep_probing != newcfg->infra_keep_probing, 4614 "infra-keep-probing", changed_str, sizeof(changed_str)); 4615 fr_check_changed_cfg( 4616 cfg->ratelimit != newcfg->ratelimit, 4617 "ratelimit", changed_str, sizeof(changed_str)); 4618 fr_check_changed_cfg( 4619 cfg->ip_ratelimit != newcfg->ip_ratelimit, 4620 "ip-ratelimit", changed_str, sizeof(changed_str)); 4621 fr_check_changed_cfg( 4622 cfg->ip_ratelimit_cookie != newcfg->ip_ratelimit_cookie, 4623 "ip-ratelimit-cookie", changed_str, sizeof(changed_str)); 4624 fr_check_changed_cfg_str2list(cfg->wait_limit_netblock, 4625 newcfg->wait_limit_netblock, "wait-limit-netblock", 4626 changed_str, sizeof(changed_str)); 4627 fr_check_changed_cfg_str2list(cfg->wait_limit_cookie_netblock, 4628 newcfg->wait_limit_cookie_netblock, 4629 "wait-limit-cookie-netblock", changed_str, 4630 sizeof(changed_str)); 4631 fr_check_changed_cfg_str2list(cfg->ratelimit_below_domain, 4632 newcfg->ratelimit_below_domain, "ratelimit-below-domain", 4633 changed_str, sizeof(changed_str)); 4634 fr_check_changed_cfg_str2list(cfg->ratelimit_for_domain, 4635 newcfg->ratelimit_for_domain, "ratelimit-for-domain", 4636 changed_str, sizeof(changed_str)); 4637 4638 /* Check for dnstap. */ 4639 fr_check_changed_cfg( 4640 cfg->dnstap_send_identity != newcfg->dnstap_send_identity, 4641 "dnstap-send-identity", changed_str, sizeof(changed_str)); 4642 fr_check_changed_cfg( 4643 cfg->dnstap_send_version != newcfg->dnstap_send_version, 4644 "dnstap-send-version", changed_str, sizeof(changed_str)); 4645 fr_check_changed_cfg_str(cfg->dnstap_identity, newcfg->dnstap_identity, 4646 "dnstap-identity", changed_str, sizeof(changed_str)); 4647 fr_check_changed_cfg_str(cfg->dnstap_version, newcfg->dnstap_version, 4648 "dnstap-version", changed_str, sizeof(changed_str)); 4649 4650 if(changed_str[0] != 0) { 4651 /* The new config changes some items that need a pause, 4652 * to be able to update the variables. */ 4653 if(!fr_output_printf(fr, "The config changes items that need " 4654 "the fast_reload +p option, for nopause, " 4655 "disabled to be reloaded: %s", changed_str) || 4656 !fr_output_printf(fr, "\n")) 4657 return 0; 4658 fr_send_notification(fr, fast_reload_notification_printout); 4659 return 0; 4660 } 4661 return 1; 4662 } 4663 4664 /** fast reload thread, clear construct information, deletes items */ 4665 static void 4666 fr_construct_clear(struct fast_reload_construct* ct) 4667 { 4668 if(!ct) 4669 return; 4670 auth_zones_delete(ct->auth_zones); 4671 forwards_delete(ct->fwds); 4672 hints_delete(ct->hints); 4673 respip_set_delete(ct->respip_set); 4674 local_zones_delete(ct->local_zones); 4675 acl_list_delete(ct->acl); 4676 acl_list_delete(ct->acl_interface); 4677 tcl_list_delete(ct->tcl); 4678 edns_strings_delete(ct->edns_strings); 4679 anchors_delete(ct->anchors); 4680 views_delete(ct->views); 4681 free(ct->nsec3_keysize); 4682 free(ct->nsec3_maxiter); 4683 free(ct->target_fetch_policy); 4684 donotq_delete(ct->donotq); 4685 priv_delete(ct->priv); 4686 caps_white_delete(ct->caps_white); 4687 wait_limits_free(&ct->wait_limits_netblock); 4688 wait_limits_free(&ct->wait_limits_cookie_netblock); 4689 domain_limits_free(&ct->domain_limits); 4690 /* Delete the log identity here so that the global value is not 4691 * reset by config_delete. */ 4692 if(ct->oldcfg && ct->oldcfg->log_identity) { 4693 free(ct->oldcfg->log_identity); 4694 ct->oldcfg->log_identity = NULL; 4695 } 4696 config_delete(ct->oldcfg); 4697 } 4698 4699 /** get memory for strlist */ 4700 static size_t 4701 getmem_config_strlist(struct config_strlist* p) 4702 { 4703 size_t m = 0; 4704 struct config_strlist* s; 4705 for(s = p; s; s = s->next) 4706 m += sizeof(*s) + getmem_str(s->str); 4707 return m; 4708 } 4709 4710 /** get memory for str2list */ 4711 static size_t 4712 getmem_config_str2list(struct config_str2list* p) 4713 { 4714 size_t m = 0; 4715 struct config_str2list* s; 4716 for(s = p; s; s = s->next) 4717 m += sizeof(*s) + getmem_str(s->str) + getmem_str(s->str2); 4718 return m; 4719 } 4720 4721 /** get memory for str3list */ 4722 static size_t 4723 getmem_config_str3list(struct config_str3list* p) 4724 { 4725 size_t m = 0; 4726 struct config_str3list* s; 4727 for(s = p; s; s = s->next) 4728 m += sizeof(*s) + getmem_str(s->str) + getmem_str(s->str2) 4729 + getmem_str(s->str3); 4730 return m; 4731 } 4732 4733 /** get memory for strbytelist */ 4734 static size_t 4735 getmem_config_strbytelist(struct config_strbytelist* p) 4736 { 4737 size_t m = 0; 4738 struct config_strbytelist* s; 4739 for(s = p; s; s = s->next) 4740 m += sizeof(*s) + getmem_str(s->str) + (s->str2?s->str2len:0); 4741 return m; 4742 } 4743 4744 /** get memory used by ifs array */ 4745 static size_t 4746 getmem_ifs(int numifs, char** ifs) 4747 { 4748 size_t m = 0; 4749 int i; 4750 m += numifs * sizeof(char*); 4751 for(i=0; i<numifs; i++) 4752 m += getmem_str(ifs[i]); 4753 return m; 4754 } 4755 4756 /** get memory for config_stub */ 4757 static size_t 4758 getmem_config_stub(struct config_stub* p) 4759 { 4760 size_t m = 0; 4761 struct config_stub* s; 4762 for(s = p; s; s = s->next) 4763 m += sizeof(*s) + getmem_str(s->name) 4764 + getmem_config_strlist(s->hosts) 4765 + getmem_config_strlist(s->addrs); 4766 return m; 4767 } 4768 4769 /** get memory for config_auth */ 4770 static size_t 4771 getmem_config_auth(struct config_auth* p) 4772 { 4773 size_t m = 0; 4774 struct config_auth* s; 4775 for(s = p; s; s = s->next) 4776 m += sizeof(*s) + getmem_str(s->name) 4777 + getmem_config_strlist(s->masters) 4778 + getmem_config_strlist(s->urls) 4779 + getmem_config_strlist(s->allow_notify) 4780 + getmem_str(s->zonefile) 4781 + s->rpz_taglistlen 4782 + getmem_str(s->rpz_action_override) 4783 + getmem_str(s->rpz_log_name) 4784 + getmem_str(s->rpz_cname); 4785 return m; 4786 } 4787 4788 /** get memory for config_view */ 4789 static size_t 4790 getmem_config_view(struct config_view* p) 4791 { 4792 size_t m = 0; 4793 struct config_view* s; 4794 for(s = p; s; s = s->next) 4795 m += sizeof(*s) + getmem_str(s->name) 4796 + getmem_config_str2list(s->local_zones) 4797 + getmem_config_strlist(s->local_data) 4798 + getmem_config_strlist(s->local_zones_nodefault) 4799 #ifdef USE_IPSET 4800 + getmem_config_strlist(s->local_zones_ipset) 4801 #endif 4802 + getmem_config_str2list(s->respip_actions) 4803 + getmem_config_str2list(s->respip_data); 4804 4805 return m; 4806 } 4807 4808 /** get memory used by config_file item, estimate */ 4809 static size_t 4810 config_file_getmem(struct config_file* cfg) 4811 { 4812 size_t m = 0; 4813 m += sizeof(*cfg); 4814 m += getmem_config_strlist(cfg->proxy_protocol_port); 4815 m += getmem_str(cfg->ssl_service_key); 4816 m += getmem_str(cfg->ssl_service_pem); 4817 m += getmem_str(cfg->tls_cert_bundle); 4818 m += getmem_config_strlist(cfg->tls_additional_port); 4819 m += getmem_config_strlist(cfg->tls_session_ticket_keys.first); 4820 m += getmem_str(cfg->tls_ciphers); 4821 m += getmem_str(cfg->tls_ciphersuites); 4822 m += getmem_str(cfg->http_endpoint); 4823 m += (cfg->outgoing_avail_ports?65536*sizeof(int):0); 4824 m += getmem_str(cfg->target_fetch_policy); 4825 m += getmem_str(cfg->if_automatic_ports); 4826 m += getmem_ifs(cfg->num_ifs, cfg->ifs); 4827 m += getmem_ifs(cfg->num_out_ifs, cfg->out_ifs); 4828 m += getmem_config_strlist(cfg->root_hints); 4829 m += getmem_config_stub(cfg->stubs); 4830 m += getmem_config_stub(cfg->forwards); 4831 m += getmem_config_auth(cfg->auths); 4832 m += getmem_config_view(cfg->views); 4833 m += getmem_config_strlist(cfg->donotqueryaddrs); 4834 #ifdef CLIENT_SUBNET 4835 m += getmem_config_strlist(cfg->client_subnet); 4836 m += getmem_config_strlist(cfg->client_subnet_zone); 4837 #endif 4838 m += getmem_config_str2list(cfg->acls); 4839 m += getmem_config_str2list(cfg->tcp_connection_limits); 4840 m += getmem_config_strlist(cfg->caps_whitelist); 4841 m += getmem_config_strlist(cfg->private_address); 4842 m += getmem_config_strlist(cfg->private_domain); 4843 m += getmem_str(cfg->chrootdir); 4844 m += getmem_str(cfg->username); 4845 m += getmem_str(cfg->directory); 4846 m += getmem_str(cfg->logfile); 4847 m += getmem_str(cfg->pidfile); 4848 m += getmem_str(cfg->log_identity); 4849 m += getmem_str(cfg->identity); 4850 m += getmem_str(cfg->version); 4851 m += getmem_str(cfg->http_user_agent); 4852 m += getmem_str(cfg->nsid_cfg_str); 4853 m += (cfg->nsid?cfg->nsid_len:0); 4854 m += getmem_str(cfg->module_conf); 4855 m += getmem_config_strlist(cfg->trust_anchor_file_list); 4856 m += getmem_config_strlist(cfg->trust_anchor_list); 4857 m += getmem_config_strlist(cfg->auto_trust_anchor_file_list); 4858 m += getmem_config_strlist(cfg->trusted_keys_file_list); 4859 m += getmem_config_strlist(cfg->domain_insecure); 4860 m += getmem_str(cfg->val_nsec3_key_iterations); 4861 m += getmem_config_str2list(cfg->local_zones); 4862 m += getmem_config_strlist(cfg->local_zones_nodefault); 4863 #ifdef USE_IPSET 4864 m += getmem_config_strlist(cfg->local_zones_ipset); 4865 #endif 4866 m += getmem_config_strlist(cfg->local_data); 4867 m += getmem_config_str3list(cfg->local_zone_overrides); 4868 m += getmem_config_strbytelist(cfg->local_zone_tags); 4869 m += getmem_config_strbytelist(cfg->acl_tags); 4870 m += getmem_config_str3list(cfg->acl_tag_actions); 4871 m += getmem_config_str3list(cfg->acl_tag_datas); 4872 m += getmem_config_str2list(cfg->acl_view); 4873 m += getmem_config_str2list(cfg->interface_actions); 4874 m += getmem_config_strbytelist(cfg->interface_tags); 4875 m += getmem_config_str3list(cfg->interface_tag_actions); 4876 m += getmem_config_str3list(cfg->interface_tag_datas); 4877 m += getmem_config_str2list(cfg->interface_view); 4878 m += getmem_config_strbytelist(cfg->respip_tags); 4879 m += getmem_config_str2list(cfg->respip_actions); 4880 m += getmem_config_str2list(cfg->respip_data); 4881 m += getmem_ifs(cfg->num_tags, cfg->tagname); 4882 m += getmem_config_strlist(cfg->control_ifs.first); 4883 m += getmem_str(cfg->server_key_file); 4884 m += getmem_str(cfg->server_cert_file); 4885 m += getmem_str(cfg->control_key_file); 4886 m += getmem_str(cfg->control_cert_file); 4887 m += getmem_config_strlist(cfg->python_script); 4888 m += getmem_config_strlist(cfg->dynlib_file); 4889 m += getmem_str(cfg->dns64_prefix); 4890 m += getmem_config_strlist(cfg->dns64_ignore_aaaa); 4891 m += getmem_str(cfg->nat64_prefix); 4892 m += getmem_str(cfg->dnstap_socket_path); 4893 m += getmem_str(cfg->dnstap_ip); 4894 m += getmem_str(cfg->dnstap_tls_server_name); 4895 m += getmem_str(cfg->dnstap_tls_cert_bundle); 4896 m += getmem_str(cfg->dnstap_tls_client_key_file); 4897 m += getmem_str(cfg->dnstap_tls_client_cert_file); 4898 m += getmem_str(cfg->dnstap_identity); 4899 m += getmem_str(cfg->dnstap_version); 4900 m += getmem_config_str2list(cfg->ratelimit_for_domain); 4901 m += getmem_config_str2list(cfg->ratelimit_below_domain); 4902 m += getmem_config_str2list(cfg->edns_client_strings); 4903 m += getmem_str(cfg->dnscrypt_provider); 4904 m += getmem_config_strlist(cfg->dnscrypt_secret_key); 4905 m += getmem_config_strlist(cfg->dnscrypt_provider_cert); 4906 m += getmem_config_strlist(cfg->dnscrypt_provider_cert_rotated); 4907 #ifdef USE_IPSECMOD 4908 m += getmem_config_strlist(cfg->ipsecmod_whitelist); 4909 m += getmem_str(cfg->ipsecmod_hook); 4910 #endif 4911 #ifdef USE_CACHEDB 4912 m += getmem_str(cfg->cachedb_backend); 4913 m += getmem_str(cfg->cachedb_secret); 4914 #ifdef USE_REDIS 4915 m += getmem_str(cfg->redis_server_host); 4916 m += getmem_str(cfg->redis_replica_server_host); 4917 m += getmem_str(cfg->redis_server_path); 4918 m += getmem_str(cfg->redis_replica_server_path); 4919 m += getmem_str(cfg->redis_server_password); 4920 m += getmem_str(cfg->redis_replica_server_password); 4921 #endif 4922 #endif 4923 #ifdef USE_IPSET 4924 m += getmem_str(cfg->ipset_name_v4); 4925 m += getmem_str(cfg->ipset_name_v6); 4926 #endif 4927 return m; 4928 } 4929 4930 /** fast reload thread, print memory used by construct of items. */ 4931 static int 4932 fr_printmem(struct fast_reload_thread* fr, 4933 struct config_file* newcfg, struct fast_reload_construct* ct) 4934 { 4935 size_t mem = 0; 4936 if(fr_poll_for_quit(fr)) 4937 return 1; 4938 mem += views_get_mem(ct->views); 4939 mem += respip_set_get_mem(ct->respip_set); 4940 mem += auth_zones_get_mem(ct->auth_zones); 4941 mem += forwards_get_mem(ct->fwds); 4942 mem += hints_get_mem(ct->hints); 4943 mem += local_zones_get_mem(ct->local_zones); 4944 mem += acl_list_get_mem(ct->acl); 4945 mem += acl_list_get_mem(ct->acl_interface); 4946 mem += tcl_list_get_mem(ct->tcl); 4947 mem += edns_strings_get_mem(ct->edns_strings); 4948 mem += anchors_get_mem(ct->anchors); 4949 mem += sizeof(*ct->oldcfg); 4950 mem += config_file_getmem(newcfg); 4951 4952 if(!fr_output_printf(fr, "memory use %d bytes\n", (int)mem)) 4953 return 0; 4954 fr_send_notification(fr, fast_reload_notification_printout); 4955 4956 return 1; 4957 } 4958 4959 /** fast reload thread, setup the acl_interface for the ports that 4960 * the server has. */ 4961 static int 4962 ct_acl_interface_setup_ports(struct acl_list* acl_interface, 4963 struct daemon* daemon) 4964 { 4965 /* clean acl_interface */ 4966 acl_interface_init(acl_interface); 4967 if(!setup_acl_for_ports(acl_interface, daemon->ports[0])) 4968 return 0; 4969 if(daemon->reuseport) { 4970 size_t i; 4971 for(i=1; i<daemon->num_ports; i++) { 4972 if(!setup_acl_for_ports(acl_interface, 4973 daemon->ports[i])) 4974 return 0; 4975 } 4976 } 4977 return 1; 4978 } 4979 4980 /** fast reload, add new change to list of auth zones */ 4981 static int 4982 fr_add_auth_zone_change(struct fast_reload_thread* fr, struct auth_zone* old_z, 4983 struct auth_zone* new_z, int is_deleted, int is_added, int is_changed) 4984 { 4985 struct fast_reload_auth_change* item; 4986 item = calloc(1, sizeof(*item)); 4987 if(!item) { 4988 log_err("malloc failure in add auth zone change"); 4989 return 0; 4990 } 4991 item->old_z = old_z; 4992 item->new_z = new_z; 4993 item->is_deleted = is_deleted; 4994 item->is_added = is_added; 4995 item->is_changed = is_changed; 4996 4997 item->next = fr->auth_zone_change_list; 4998 fr->auth_zone_change_list = item; 4999 return 1; 5000 } 5001 5002 /** See if auth master is equal */ 5003 static int 5004 xfr_auth_master_equal(struct auth_master* m1, struct auth_master* m2) 5005 { 5006 if(!m1 && !m2) 5007 return 1; 5008 if(!m1 || !m2) 5009 return 0; 5010 5011 if((m1->host && !m2->host) || (!m1->host && m2->host)) 5012 return 0; 5013 if(m1->host && m2->host && strcmp(m1->host, m2->host) != 0) 5014 return 0; 5015 5016 if((m1->file && !m2->file) || (!m1->file && m2->file)) 5017 return 0; 5018 if(m1->file && m2->file && strcmp(m1->file, m2->file) != 0) 5019 return 0; 5020 5021 if((m1->http && !m2->http) || (!m1->http && m2->http)) 5022 return 0; 5023 if((m1->ixfr && !m2->ixfr) || (!m1->ixfr && m2->ixfr)) 5024 return 0; 5025 if((m1->allow_notify && !m2->allow_notify) || (!m1->allow_notify && m2->allow_notify)) 5026 return 0; 5027 if((m1->ssl && !m2->ssl) || (!m1->ssl && m2->ssl)) 5028 return 0; 5029 if(m1->port != m2->port) 5030 return 0; 5031 return 1; 5032 } 5033 5034 /** See if list of auth masters is equal */ 5035 static int 5036 xfr_masterlist_equal(struct auth_master* list1, struct auth_master* list2) 5037 { 5038 struct auth_master* p1 = list1, *p2 = list2; 5039 while(p1 && p2) { 5040 if(!xfr_auth_master_equal(p1, p2)) 5041 return 0; 5042 p1 = p1->next; 5043 p2 = p2->next; 5044 } 5045 if(!p1 && !p2) 5046 return 1; 5047 return 0; 5048 } 5049 5050 /** See if the list of masters has changed. */ 5051 static int 5052 xfr_masters_equal(struct auth_xfer* xfr1, struct auth_xfer* xfr2) 5053 { 5054 if(xfr1 == NULL && xfr2 == NULL) 5055 return 1; 5056 if(xfr1 == NULL && xfr2 != NULL) 5057 return 0; 5058 if(xfr1 != NULL && xfr2 == NULL) 5059 return 0; 5060 if(xfr_masterlist_equal(xfr1->task_probe->masters, 5061 xfr2->task_probe->masters) && 5062 xfr_masterlist_equal(xfr1->task_transfer->masters, 5063 xfr2->task_transfer->masters)) 5064 return 1; 5065 return 0; 5066 } 5067 5068 /** Check what has changed in auth zones, like added and deleted zones */ 5069 static int 5070 auth_zones_check_changes(struct fast_reload_thread* fr, 5071 struct fast_reload_construct* ct) 5072 { 5073 /* Check every zone in turn. */ 5074 struct auth_zone* new_z, *old_z; 5075 struct module_env* env = &fr->worker->env; 5076 5077 fr->old_auth_zones = ct->auth_zones; 5078 /* Nobody is using the new ct version yet. 5079 * Also the ct lock is picked up before the env lock for auth_zones. */ 5080 lock_rw_rdlock(&ct->auth_zones->lock); 5081 5082 /* Find deleted zones by looping over the current list and looking 5083 * up in the new tree. */ 5084 lock_rw_rdlock(&env->auth_zones->lock); 5085 RBTREE_FOR(old_z, struct auth_zone*, &env->auth_zones->ztree) { 5086 new_z = auth_zone_find(ct->auth_zones, old_z->name, 5087 old_z->namelen, old_z->dclass); 5088 if(!new_z) { 5089 /* The zone has been removed. */ 5090 if(!fr_add_auth_zone_change(fr, old_z, NULL, 1, 0, 5091 0)) { 5092 lock_rw_unlock(&env->auth_zones->lock); 5093 lock_rw_unlock(&ct->auth_zones->lock); 5094 return 0; 5095 } 5096 } 5097 } 5098 lock_rw_unlock(&env->auth_zones->lock); 5099 5100 /* Find added zones by looping over new list and lookup in current. */ 5101 RBTREE_FOR(new_z, struct auth_zone*, &ct->auth_zones->ztree) { 5102 lock_rw_rdlock(&env->auth_zones->lock); 5103 old_z = auth_zone_find(env->auth_zones, new_z->name, 5104 new_z->namelen, new_z->dclass); 5105 if(!old_z) { 5106 /* The zone has been added. */ 5107 lock_rw_unlock(&env->auth_zones->lock); 5108 if(!fr_add_auth_zone_change(fr, NULL, new_z, 0, 1, 5109 0)) { 5110 lock_rw_unlock(&ct->auth_zones->lock); 5111 return 0; 5112 } 5113 } else { 5114 uint32_t old_serial = 0, new_serial = 0; 5115 int have_old = 0, have_new = 0; 5116 struct auth_xfer* old_xfr, *new_xfr; 5117 lock_rw_rdlock(&new_z->lock); 5118 lock_rw_rdlock(&old_z->lock); 5119 new_xfr = auth_xfer_find(ct->auth_zones, new_z->name, 5120 new_z->namelen, new_z->dclass); 5121 old_xfr = auth_xfer_find(env->auth_zones, old_z->name, 5122 old_z->namelen, old_z->dclass); 5123 if(new_xfr) { 5124 lock_basic_lock(&new_xfr->lock); 5125 } 5126 if(old_xfr) { 5127 lock_basic_lock(&old_xfr->lock); 5128 } 5129 lock_rw_unlock(&env->auth_zones->lock); 5130 5131 /* Change in the auth zone can be detected. */ 5132 /* A change in serial number means that auth_xfer 5133 * has to be updated. */ 5134 have_old = (auth_zone_get_serial(old_z, 5135 &old_serial)!=0); 5136 have_new = (auth_zone_get_serial(new_z, 5137 &new_serial)!=0); 5138 if(have_old != have_new || old_serial != new_serial 5139 || !xfr_masters_equal(old_xfr, new_xfr)) { 5140 /* The zone has been changed. */ 5141 if(!fr_add_auth_zone_change(fr, old_z, new_z, 5142 0, 0, 1)) { 5143 lock_rw_unlock(&old_z->lock); 5144 lock_rw_unlock(&new_z->lock); 5145 lock_rw_unlock(&ct->auth_zones->lock); 5146 if(new_xfr) { 5147 lock_basic_unlock(&new_xfr->lock); 5148 } 5149 if(old_xfr) { 5150 lock_basic_unlock(&old_xfr->lock); 5151 } 5152 return 0; 5153 } 5154 } 5155 5156 if(new_xfr) { 5157 lock_basic_unlock(&new_xfr->lock); 5158 } 5159 if(old_xfr) { 5160 lock_basic_unlock(&old_xfr->lock); 5161 } 5162 lock_rw_unlock(&old_z->lock); 5163 lock_rw_unlock(&new_z->lock); 5164 } 5165 } 5166 5167 lock_rw_unlock(&ct->auth_zones->lock); 5168 return 1; 5169 } 5170 5171 /** fast reload thread, construct from config the new items */ 5172 static int 5173 fr_construct_from_config(struct fast_reload_thread* fr, 5174 struct config_file* newcfg, struct fast_reload_construct* ct) 5175 { 5176 int have_view_respip_cfg = 0; 5177 5178 if(!(ct->views = views_create())) { 5179 fr_construct_clear(ct); 5180 return 0; 5181 } 5182 if(!views_apply_cfg(ct->views, newcfg)) { 5183 fr_construct_clear(ct); 5184 return 0; 5185 } 5186 if(fr_poll_for_quit(fr)) 5187 return 1; 5188 5189 if(!(ct->acl = acl_list_create())) { 5190 fr_construct_clear(ct); 5191 return 0; 5192 } 5193 if(!acl_list_apply_cfg(ct->acl, newcfg, ct->views)) { 5194 fr_construct_clear(ct); 5195 return 0; 5196 } 5197 if(fr_poll_for_quit(fr)) 5198 return 1; 5199 5200 if(!(ct->acl_interface = acl_list_create())) { 5201 fr_construct_clear(ct); 5202 return 0; 5203 } 5204 if(!ct_acl_interface_setup_ports(ct->acl_interface, 5205 fr->worker->daemon)) { 5206 fr_construct_clear(ct); 5207 return 0; 5208 } 5209 if(!acl_interface_apply_cfg(ct->acl_interface, newcfg, ct->views)) { 5210 fr_construct_clear(ct); 5211 return 0; 5212 } 5213 if(fr_poll_for_quit(fr)) 5214 return 1; 5215 5216 if(!(ct->tcl = tcl_list_create())) { 5217 fr_construct_clear(ct); 5218 return 0; 5219 } 5220 if(!tcl_list_apply_cfg(ct->tcl, newcfg)) { 5221 fr_construct_clear(ct); 5222 return 0; 5223 } 5224 if(fr->worker->daemon->tcl->tree.count != 0) 5225 fr->worker->daemon->fast_reload_tcl_has_changes = 1; 5226 else fr->worker->daemon->fast_reload_tcl_has_changes = 0; 5227 if(fr_poll_for_quit(fr)) 5228 return 1; 5229 5230 if(!(ct->auth_zones = auth_zones_create())) { 5231 fr_construct_clear(ct); 5232 return 0; 5233 } 5234 if(!auth_zones_apply_cfg(ct->auth_zones, newcfg, 1, &ct->use_rpz, 5235 fr->worker->daemon->env, &fr->worker->daemon->mods)) { 5236 fr_construct_clear(ct); 5237 return 0; 5238 } 5239 if(!auth_zones_check_changes(fr, ct)) { 5240 fr_construct_clear(ct); 5241 return 0; 5242 } 5243 if(fr_poll_for_quit(fr)) 5244 return 1; 5245 5246 if(!(ct->fwds = forwards_create())) { 5247 fr_construct_clear(ct); 5248 return 0; 5249 } 5250 if(!forwards_apply_cfg(ct->fwds, newcfg)) { 5251 fr_construct_clear(ct); 5252 return 0; 5253 } 5254 if(fr_poll_for_quit(fr)) 5255 return 1; 5256 5257 if(!(ct->hints = hints_create())) { 5258 fr_construct_clear(ct); 5259 return 0; 5260 } 5261 if(!hints_apply_cfg(ct->hints, newcfg)) { 5262 fr_construct_clear(ct); 5263 return 0; 5264 } 5265 if(fr_poll_for_quit(fr)) 5266 return 1; 5267 5268 if(!(ct->local_zones = local_zones_create())) { 5269 fr_construct_clear(ct); 5270 return 0; 5271 } 5272 if(!local_zones_apply_cfg(ct->local_zones, newcfg)) { 5273 fr_construct_clear(ct); 5274 return 0; 5275 } 5276 if(fr_poll_for_quit(fr)) 5277 return 1; 5278 5279 if(!(ct->respip_set = respip_set_create())) { 5280 fr_construct_clear(ct); 5281 return 0; 5282 } 5283 if(!respip_global_apply_cfg(ct->respip_set, newcfg)) { 5284 fr_construct_clear(ct); 5285 return 0; 5286 } 5287 if(fr_poll_for_quit(fr)) 5288 return 1; 5289 if(!respip_views_apply_cfg(ct->views, newcfg, &have_view_respip_cfg)) { 5290 fr_construct_clear(ct); 5291 return 0; 5292 } 5293 ct->use_response_ip = !respip_set_is_empty(ct->respip_set) || 5294 have_view_respip_cfg; 5295 if(fr_poll_for_quit(fr)) 5296 return 1; 5297 5298 if(!(ct->edns_strings = edns_strings_create())) { 5299 fr_construct_clear(ct); 5300 return 0; 5301 } 5302 if(!edns_strings_apply_cfg(ct->edns_strings, newcfg)) { 5303 fr_construct_clear(ct); 5304 return 0; 5305 } 5306 if(fr_poll_for_quit(fr)) 5307 return 1; 5308 5309 if(fr->worker->env.anchors) { 5310 /* There are trust anchors already, so create it for reload. */ 5311 if(!(ct->anchors = anchors_create())) { 5312 fr_construct_clear(ct); 5313 return 0; 5314 } 5315 if(!anchors_apply_cfg(ct->anchors, newcfg)) { 5316 fr_construct_clear(ct); 5317 return 0; 5318 } 5319 if(fr_poll_for_quit(fr)) 5320 return 1; 5321 } 5322 5323 if(!val_env_parse_key_iter(newcfg->val_nsec3_key_iterations, 5324 &ct->nsec3_keysize, &ct->nsec3_maxiter, 5325 &ct->nsec3_keyiter_count)) { 5326 fr_construct_clear(ct); 5327 return 0; 5328 } 5329 if(fr_poll_for_quit(fr)) 5330 return 1; 5331 5332 if(!read_fetch_policy(&ct->target_fetch_policy, 5333 &ct->max_dependency_depth, newcfg->target_fetch_policy)) { 5334 fr_construct_clear(ct); 5335 return 0; 5336 } 5337 if(!(ct->donotq = donotq_create())) { 5338 fr_construct_clear(ct); 5339 return 0; 5340 } 5341 if(!donotq_apply_cfg(ct->donotq, newcfg)) { 5342 fr_construct_clear(ct); 5343 return 0; 5344 } 5345 if(!(ct->priv = priv_create())) { 5346 fr_construct_clear(ct); 5347 return 0; 5348 } 5349 if(!priv_apply_cfg(ct->priv, newcfg)) { 5350 fr_construct_clear(ct); 5351 return 0; 5352 } 5353 if(newcfg->caps_whitelist) { 5354 if(!(ct->caps_white = caps_white_create())) { 5355 fr_construct_clear(ct); 5356 return 0; 5357 } 5358 if(!caps_white_apply_cfg(ct->caps_white, newcfg)) { 5359 fr_construct_clear(ct); 5360 return 0; 5361 } 5362 } 5363 if(!nat64_apply_cfg(&ct->nat64, newcfg)) { 5364 fr_construct_clear(ct); 5365 return 0; 5366 } 5367 if(fr_poll_for_quit(fr)) 5368 return 1; 5369 5370 if(!setup_wait_limits(&ct->wait_limits_netblock, 5371 &ct->wait_limits_cookie_netblock, newcfg)) { 5372 fr_construct_clear(ct); 5373 return 0; 5374 } 5375 if(!setup_domain_limits(&ct->domain_limits, newcfg)) { 5376 fr_construct_clear(ct); 5377 return 0; 5378 } 5379 if(fr_poll_for_quit(fr)) 5380 return 1; 5381 5382 if(!(ct->oldcfg = (struct config_file*)calloc(1, 5383 sizeof(*ct->oldcfg)))) { 5384 fr_construct_clear(ct); 5385 log_err("out of memory"); 5386 return 0; 5387 } 5388 if(fr->fr_verb >= 2) { 5389 if(!fr_printmem(fr, newcfg, ct)) 5390 return 0; 5391 } 5392 return 1; 5393 } 5394 5395 /** fast reload thread, finish timers */ 5396 static int 5397 fr_finish_time(struct fast_reload_thread* fr, struct timeval* time_start, 5398 struct timeval* time_read, struct timeval* time_construct, 5399 struct timeval* time_reload, struct timeval* time_end) 5400 { 5401 struct timeval total, readtime, constructtime, reloadtime, deletetime; 5402 if(gettimeofday(time_end, NULL) < 0) 5403 log_err("gettimeofday: %s", strerror(errno)); 5404 5405 timeval_subtract(&total, time_end, time_start); 5406 timeval_subtract(&readtime, time_read, time_start); 5407 timeval_subtract(&constructtime, time_construct, time_read); 5408 timeval_subtract(&reloadtime, time_reload, time_construct); 5409 timeval_subtract(&deletetime, time_end, time_reload); 5410 if(!fr_output_printf(fr, "read disk %3d.%6.6ds\n", 5411 (int)readtime.tv_sec, (int)readtime.tv_usec)) 5412 return 0; 5413 if(!fr_output_printf(fr, "construct %3d.%6.6ds\n", 5414 (int)constructtime.tv_sec, (int)constructtime.tv_usec)) 5415 return 0; 5416 if(!fr_output_printf(fr, "reload %3d.%6.6ds\n", 5417 (int)reloadtime.tv_sec, (int)reloadtime.tv_usec)) 5418 return 0; 5419 if(!fr_output_printf(fr, "deletes %3d.%6.6ds\n", 5420 (int)deletetime.tv_sec, (int)deletetime.tv_usec)) 5421 return 0; 5422 if(!fr_output_printf(fr, "total time %3d.%6.6ds\n", (int)total.tv_sec, 5423 (int)total.tv_usec)) 5424 return 0; 5425 fr_send_notification(fr, fast_reload_notification_printout); 5426 return 1; 5427 } 5428 5429 /** Swap auth zone information */ 5430 static void 5431 auth_zones_swap(struct auth_zones* az, struct auth_zones* data) 5432 { 5433 rbtree_type oldztree = az->ztree; 5434 int old_have_downstream = az->have_downstream; 5435 struct auth_zone* old_rpz_first = az->rpz_first; 5436 5437 az->ztree = data->ztree; 5438 data->ztree = oldztree; 5439 5440 az->have_downstream = data->have_downstream; 5441 data->have_downstream = old_have_downstream; 5442 5443 /* Leave num_query_up and num_query_down, the statistics can 5444 * remain counted. */ 5445 5446 az->rpz_first = data->rpz_first; 5447 data->rpz_first = old_rpz_first; 5448 5449 /* The xtree is not swapped. This contains the auth_xfer elements 5450 * that contain tasks in progress, like zone transfers. 5451 * The unchanged zones can keep their tasks in the tree, and thus 5452 * the xfer elements can continue to be their callbacks. */ 5453 } 5454 5455 #if defined(ATOMIC_POINTER_LOCK_FREE) && defined(HAVE_LINK_ATOMIC_STORE) 5456 /** Fast reload thread, if atomics are available, copy the config items 5457 * one by one with atomic store operations. */ 5458 static void 5459 fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg, 5460 struct config_file* newcfg) 5461 { 5462 #define COPY_VAR_int(var) oldcfg->var = cfg->var; atomic_store((_Atomic int*)&cfg->var, newcfg->var); newcfg->var = 0; 5463 #define COPY_VAR_ptr(var) oldcfg->var = cfg->var; atomic_store((void* _Atomic*)&cfg->var, newcfg->var); newcfg->var = 0; 5464 #define COPY_VAR_unsigned_int(var) oldcfg->var = cfg->var; atomic_store((_Atomic unsigned*)&cfg->var, newcfg->var); newcfg->var = 0; 5465 #define COPY_VAR_size_t(var) oldcfg->var = cfg->var; atomic_store((_Atomic size_t*)&cfg->var, newcfg->var); newcfg->var = 0; 5466 #define COPY_VAR_uint8_t(var) oldcfg->var = cfg->var; atomic_store((_Atomic uint8_t*)&cfg->var, newcfg->var); newcfg->var = 0; 5467 #define COPY_VAR_uint16_t(var) oldcfg->var = cfg->var; atomic_store((_Atomic uint16_t*)&cfg->var, newcfg->var); newcfg->var = 0; 5468 #define COPY_VAR_uint32_t(var) oldcfg->var = cfg->var; atomic_store((_Atomic uint32_t*)&cfg->var, newcfg->var); newcfg->var = 0; 5469 #define COPY_VAR_int32_t(var) oldcfg->var = cfg->var; atomic_store((_Atomic int32_t*)&cfg->var, newcfg->var); newcfg->var = 0; 5470 /* If config file items are missing from this list, they are 5471 * not updated by fast-reload +p. */ 5472 /* For missing items, the oldcfg item is not updated, still NULL, 5473 * and the cfg stays the same. The newcfg item is untouched. 5474 * The newcfg item is then deleted later. */ 5475 /* Items that need synchronisation are omitted from the list. 5476 * Use fast-reload without +p to update them together. */ 5477 COPY_VAR_int(verbosity); 5478 COPY_VAR_int(stat_interval); 5479 COPY_VAR_int(stat_cumulative); 5480 COPY_VAR_int(stat_extended); 5481 COPY_VAR_int(stat_inhibit_zero); 5482 COPY_VAR_int(num_threads); 5483 COPY_VAR_int(port); 5484 COPY_VAR_int(do_ip4); 5485 COPY_VAR_int(do_ip6); 5486 COPY_VAR_int(do_nat64); 5487 COPY_VAR_int(prefer_ip4); 5488 COPY_VAR_int(prefer_ip6); 5489 COPY_VAR_int(do_udp); 5490 COPY_VAR_int(do_tcp); 5491 COPY_VAR_size_t(max_reuse_tcp_queries); 5492 COPY_VAR_int(tcp_reuse_timeout); 5493 COPY_VAR_int(tcp_auth_query_timeout); 5494 COPY_VAR_int(tcp_upstream); 5495 COPY_VAR_int(udp_upstream_without_downstream); 5496 COPY_VAR_int(tcp_mss); 5497 COPY_VAR_int(outgoing_tcp_mss); 5498 COPY_VAR_int(tcp_idle_timeout); 5499 COPY_VAR_int(do_tcp_keepalive); 5500 COPY_VAR_int(tcp_keepalive_timeout); 5501 COPY_VAR_int(sock_queue_timeout); 5502 COPY_VAR_ptr(proxy_protocol_port); 5503 COPY_VAR_ptr(ssl_service_key); 5504 COPY_VAR_ptr(ssl_service_pem); 5505 COPY_VAR_int(ssl_port); 5506 COPY_VAR_int(ssl_upstream); 5507 COPY_VAR_ptr(tls_cert_bundle); 5508 COPY_VAR_int(tls_win_cert); 5509 COPY_VAR_ptr(tls_additional_port); 5510 /* The first is used to walk throught the list but last is 5511 * only used during config read. */ 5512 COPY_VAR_ptr(tls_session_ticket_keys.first); 5513 COPY_VAR_ptr(tls_session_ticket_keys.last); 5514 COPY_VAR_ptr(tls_ciphers); 5515 COPY_VAR_ptr(tls_ciphersuites); 5516 COPY_VAR_int(tls_use_sni); 5517 COPY_VAR_int(https_port); 5518 COPY_VAR_ptr(http_endpoint); 5519 COPY_VAR_uint32_t(http_max_streams); 5520 COPY_VAR_size_t(http_query_buffer_size); 5521 COPY_VAR_size_t(http_response_buffer_size); 5522 COPY_VAR_int(http_nodelay); 5523 COPY_VAR_int(http_notls_downstream); 5524 COPY_VAR_int(outgoing_num_ports); 5525 COPY_VAR_size_t(outgoing_num_tcp); 5526 COPY_VAR_size_t(incoming_num_tcp); 5527 COPY_VAR_ptr(outgoing_avail_ports); 5528 COPY_VAR_size_t(edns_buffer_size); 5529 COPY_VAR_size_t(stream_wait_size); 5530 COPY_VAR_size_t(msg_buffer_size); 5531 COPY_VAR_size_t(msg_cache_size); 5532 COPY_VAR_size_t(msg_cache_slabs); 5533 COPY_VAR_size_t(num_queries_per_thread); 5534 COPY_VAR_size_t(jostle_time); 5535 COPY_VAR_size_t(rrset_cache_size); 5536 COPY_VAR_size_t(rrset_cache_slabs); 5537 COPY_VAR_int(host_ttl); 5538 COPY_VAR_size_t(infra_cache_slabs); 5539 COPY_VAR_size_t(infra_cache_numhosts); 5540 COPY_VAR_int(infra_cache_min_rtt); 5541 COPY_VAR_int(infra_cache_max_rtt); 5542 COPY_VAR_int(infra_keep_probing); 5543 COPY_VAR_int(delay_close); 5544 COPY_VAR_int(udp_connect); 5545 COPY_VAR_ptr(target_fetch_policy); 5546 COPY_VAR_int(fast_server_permil); 5547 COPY_VAR_size_t(fast_server_num); 5548 COPY_VAR_int(if_automatic); 5549 COPY_VAR_ptr(if_automatic_ports); 5550 COPY_VAR_size_t(so_rcvbuf); 5551 COPY_VAR_size_t(so_sndbuf); 5552 COPY_VAR_int(so_reuseport); 5553 COPY_VAR_int(ip_transparent); 5554 COPY_VAR_int(ip_freebind); 5555 COPY_VAR_int(ip_dscp); 5556 /* Not copied because the length and items could then not match. 5557 num_ifs, ifs, num_out_ifs, out_ifs 5558 */ 5559 COPY_VAR_ptr(root_hints); 5560 COPY_VAR_ptr(stubs); 5561 COPY_VAR_ptr(forwards); 5562 COPY_VAR_ptr(auths); 5563 COPY_VAR_ptr(views); 5564 COPY_VAR_ptr(donotqueryaddrs); 5565 #ifdef CLIENT_SUBNET 5566 COPY_VAR_ptr(client_subnet); 5567 COPY_VAR_ptr(client_subnet_zone); 5568 COPY_VAR_uint16_t(client_subnet_opcode); 5569 COPY_VAR_int(client_subnet_always_forward); 5570 COPY_VAR_uint8_t(max_client_subnet_ipv4); 5571 COPY_VAR_uint8_t(max_client_subnet_ipv6); 5572 COPY_VAR_uint8_t(min_client_subnet_ipv4); 5573 COPY_VAR_uint8_t(min_client_subnet_ipv6); 5574 COPY_VAR_uint32_t(max_ecs_tree_size_ipv4); 5575 COPY_VAR_uint32_t(max_ecs_tree_size_ipv6); 5576 #endif 5577 COPY_VAR_ptr(acls); 5578 COPY_VAR_int(donotquery_localhost); 5579 COPY_VAR_ptr(tcp_connection_limits); 5580 COPY_VAR_int(harden_short_bufsize); 5581 COPY_VAR_int(harden_large_queries); 5582 COPY_VAR_int(harden_glue); 5583 COPY_VAR_int(harden_dnssec_stripped); 5584 COPY_VAR_int(harden_below_nxdomain); 5585 COPY_VAR_int(harden_referral_path); 5586 COPY_VAR_int(harden_algo_downgrade); 5587 COPY_VAR_int(harden_unknown_additional); 5588 COPY_VAR_int(use_caps_bits_for_id); 5589 COPY_VAR_ptr(caps_whitelist); 5590 COPY_VAR_ptr(private_address); 5591 COPY_VAR_ptr(private_domain); 5592 COPY_VAR_size_t(unwanted_threshold); 5593 COPY_VAR_int(max_ttl); 5594 COPY_VAR_int(min_ttl); 5595 COPY_VAR_int(max_negative_ttl); 5596 COPY_VAR_int(min_negative_ttl); 5597 COPY_VAR_int(prefetch); 5598 COPY_VAR_int(prefetch_key); 5599 COPY_VAR_int(deny_any); 5600 COPY_VAR_ptr(chrootdir); 5601 COPY_VAR_ptr(username); 5602 COPY_VAR_ptr(directory); 5603 COPY_VAR_ptr(logfile); 5604 COPY_VAR_ptr(pidfile); 5605 COPY_VAR_int(use_syslog); 5606 COPY_VAR_int(log_time_ascii); 5607 COPY_VAR_int(log_queries); 5608 COPY_VAR_int(log_replies); 5609 COPY_VAR_int(log_tag_queryreply); 5610 COPY_VAR_int(log_local_actions); 5611 COPY_VAR_int(log_servfail); 5612 COPY_VAR_ptr(log_identity); 5613 COPY_VAR_int(log_destaddr); 5614 COPY_VAR_int(hide_identity); 5615 COPY_VAR_int(hide_version); 5616 COPY_VAR_int(hide_trustanchor); 5617 COPY_VAR_int(hide_http_user_agent); 5618 COPY_VAR_ptr(identity); 5619 COPY_VAR_ptr(version); 5620 COPY_VAR_ptr(http_user_agent); 5621 COPY_VAR_ptr(nsid_cfg_str); 5622 /* Not copied because the length and items could then not match. 5623 nsid; 5624 nsid_len; 5625 */ 5626 COPY_VAR_ptr(module_conf); 5627 COPY_VAR_ptr(trust_anchor_file_list); 5628 COPY_VAR_ptr(trust_anchor_list); 5629 COPY_VAR_ptr(auto_trust_anchor_file_list); 5630 COPY_VAR_ptr(trusted_keys_file_list); 5631 COPY_VAR_ptr(domain_insecure); 5632 COPY_VAR_int(trust_anchor_signaling); 5633 COPY_VAR_int(root_key_sentinel); 5634 COPY_VAR_int32_t(val_date_override); 5635 COPY_VAR_int32_t(val_sig_skew_min); 5636 COPY_VAR_int32_t(val_sig_skew_max); 5637 COPY_VAR_int32_t(val_max_restart); 5638 COPY_VAR_int(bogus_ttl); 5639 COPY_VAR_int(val_clean_additional); 5640 COPY_VAR_int(val_log_level); 5641 COPY_VAR_int(val_log_squelch); 5642 COPY_VAR_int(val_permissive_mode); 5643 COPY_VAR_int(aggressive_nsec); 5644 COPY_VAR_int(ignore_cd); 5645 COPY_VAR_int(disable_edns_do); 5646 COPY_VAR_int(serve_expired); 5647 COPY_VAR_int(serve_expired_ttl); 5648 COPY_VAR_int(serve_expired_ttl_reset); 5649 COPY_VAR_int(serve_expired_reply_ttl); 5650 COPY_VAR_int(serve_expired_client_timeout); 5651 COPY_VAR_int(ede_serve_expired); 5652 COPY_VAR_int(dns_error_reporting); 5653 COPY_VAR_int(serve_original_ttl); 5654 COPY_VAR_ptr(val_nsec3_key_iterations); 5655 COPY_VAR_int(zonemd_permissive_mode); 5656 COPY_VAR_unsigned_int(add_holddown); 5657 COPY_VAR_unsigned_int(del_holddown); 5658 COPY_VAR_unsigned_int(keep_missing); 5659 COPY_VAR_int(permit_small_holddown); 5660 COPY_VAR_size_t(key_cache_size); 5661 COPY_VAR_size_t(key_cache_slabs); 5662 COPY_VAR_size_t(neg_cache_size); 5663 COPY_VAR_ptr(local_zones); 5664 COPY_VAR_ptr(local_zones_nodefault); 5665 #ifdef USE_IPSET 5666 COPY_VAR_ptr(local_zones_ipset); 5667 #endif 5668 COPY_VAR_int(local_zones_disable_default); 5669 COPY_VAR_ptr(local_data); 5670 COPY_VAR_ptr(local_zone_overrides); 5671 COPY_VAR_int(unblock_lan_zones); 5672 COPY_VAR_int(insecure_lan_zones); 5673 /* These reference tags 5674 COPY_VAR_ptr(local_zone_tags); 5675 COPY_VAR_ptr(acl_tags); 5676 COPY_VAR_ptr(acl_tag_actions); 5677 COPY_VAR_ptr(acl_tag_datas); 5678 */ 5679 COPY_VAR_ptr(acl_view); 5680 COPY_VAR_ptr(interface_actions); 5681 /* These reference tags 5682 COPY_VAR_ptr(interface_tags); 5683 COPY_VAR_ptr(interface_tag_actions); 5684 COPY_VAR_ptr(interface_tag_datas); 5685 */ 5686 COPY_VAR_ptr(interface_view); 5687 /* This references tags 5688 COPY_VAR_ptr(respip_tags); 5689 */ 5690 COPY_VAR_ptr(respip_actions); 5691 COPY_VAR_ptr(respip_data); 5692 /* Not copied because the length and items could then not match. 5693 * also the respip module keeps a pointer to the array in its state. 5694 tagname, num_tags 5695 */ 5696 COPY_VAR_int(remote_control_enable); 5697 /* The first is used to walk throught the list but last is 5698 * only used during config read. */ 5699 COPY_VAR_ptr(control_ifs.first); 5700 COPY_VAR_ptr(control_ifs.last); 5701 COPY_VAR_int(control_use_cert); 5702 COPY_VAR_int(control_port); 5703 COPY_VAR_ptr(server_key_file); 5704 COPY_VAR_ptr(server_cert_file); 5705 COPY_VAR_ptr(control_key_file); 5706 COPY_VAR_ptr(control_cert_file); 5707 COPY_VAR_ptr(python_script); 5708 COPY_VAR_ptr(dynlib_file); 5709 COPY_VAR_int(use_systemd); 5710 COPY_VAR_int(do_daemonize); 5711 COPY_VAR_int(minimal_responses); 5712 COPY_VAR_int(rrset_roundrobin); 5713 COPY_VAR_int(unknown_server_time_limit); 5714 COPY_VAR_int(discard_timeout); 5715 COPY_VAR_int(wait_limit); 5716 COPY_VAR_int(wait_limit_cookie); 5717 COPY_VAR_ptr(wait_limit_netblock); 5718 COPY_VAR_ptr(wait_limit_cookie_netblock); 5719 COPY_VAR_size_t(max_udp_size); 5720 COPY_VAR_ptr(dns64_prefix); 5721 COPY_VAR_int(dns64_synthall); 5722 COPY_VAR_ptr(dns64_ignore_aaaa); 5723 COPY_VAR_ptr(nat64_prefix); 5724 COPY_VAR_int(dnstap); 5725 COPY_VAR_int(dnstap_bidirectional); 5726 COPY_VAR_ptr(dnstap_socket_path); 5727 COPY_VAR_ptr(dnstap_ip); 5728 COPY_VAR_int(dnstap_tls); 5729 COPY_VAR_ptr(dnstap_tls_server_name); 5730 COPY_VAR_ptr(dnstap_tls_cert_bundle); 5731 COPY_VAR_ptr(dnstap_tls_client_key_file); 5732 COPY_VAR_ptr(dnstap_tls_client_cert_file); 5733 COPY_VAR_int(dnstap_send_identity); 5734 COPY_VAR_int(dnstap_send_version); 5735 COPY_VAR_ptr(dnstap_identity); 5736 COPY_VAR_ptr(dnstap_version); 5737 COPY_VAR_int(dnstap_sample_rate); 5738 COPY_VAR_int(dnstap_log_resolver_query_messages); 5739 COPY_VAR_int(dnstap_log_resolver_response_messages); 5740 COPY_VAR_int(dnstap_log_client_query_messages); 5741 COPY_VAR_int(dnstap_log_client_response_messages); 5742 COPY_VAR_int(dnstap_log_forwarder_query_messages); 5743 COPY_VAR_int(dnstap_log_forwarder_response_messages); 5744 COPY_VAR_int(disable_dnssec_lame_check); 5745 COPY_VAR_int(ip_ratelimit); 5746 COPY_VAR_int(ip_ratelimit_cookie); 5747 COPY_VAR_size_t(ip_ratelimit_slabs); 5748 COPY_VAR_size_t(ip_ratelimit_size); 5749 COPY_VAR_int(ip_ratelimit_factor); 5750 COPY_VAR_int(ip_ratelimit_backoff); 5751 COPY_VAR_int(ratelimit); 5752 COPY_VAR_size_t(ratelimit_slabs); 5753 COPY_VAR_size_t(ratelimit_size); 5754 COPY_VAR_ptr(ratelimit_for_domain); 5755 COPY_VAR_ptr(ratelimit_below_domain); 5756 COPY_VAR_int(ratelimit_factor); 5757 COPY_VAR_int(ratelimit_backoff); 5758 COPY_VAR_int(outbound_msg_retry); 5759 COPY_VAR_int(max_sent_count); 5760 COPY_VAR_int(max_query_restarts); 5761 COPY_VAR_int(qname_minimisation); 5762 COPY_VAR_int(qname_minimisation_strict); 5763 COPY_VAR_int(shm_enable); 5764 COPY_VAR_int(shm_key); 5765 COPY_VAR_ptr(edns_client_strings); 5766 COPY_VAR_uint16_t(edns_client_string_opcode); 5767 COPY_VAR_int(dnscrypt); 5768 COPY_VAR_int(dnscrypt_port); 5769 COPY_VAR_ptr(dnscrypt_provider); 5770 COPY_VAR_ptr(dnscrypt_secret_key); 5771 COPY_VAR_ptr(dnscrypt_provider_cert); 5772 COPY_VAR_ptr(dnscrypt_provider_cert_rotated); 5773 COPY_VAR_size_t(dnscrypt_shared_secret_cache_size); 5774 COPY_VAR_size_t(dnscrypt_shared_secret_cache_slabs); 5775 COPY_VAR_size_t(dnscrypt_nonce_cache_size); 5776 COPY_VAR_size_t(dnscrypt_nonce_cache_slabs); 5777 COPY_VAR_int(pad_responses); 5778 COPY_VAR_size_t(pad_responses_block_size); 5779 COPY_VAR_int(pad_queries); 5780 COPY_VAR_size_t(pad_queries_block_size); 5781 #ifdef USE_IPSECMOD 5782 COPY_VAR_int(ipsecmod_enabled); 5783 COPY_VAR_ptr(ipsecmod_whitelist); 5784 COPY_VAR_ptr(ipsecmod_hook); 5785 COPY_VAR_int(ipsecmod_ignore_bogus); 5786 COPY_VAR_int(ipsecmod_max_ttl); 5787 COPY_VAR_int(ipsecmod_strict); 5788 #endif 5789 #ifdef USE_CACHEDB 5790 COPY_VAR_ptr(cachedb_backend); 5791 COPY_VAR_ptr(cachedb_secret); 5792 COPY_VAR_int(cachedb_no_store); 5793 COPY_VAR_int(cachedb_check_when_serve_expired); 5794 #ifdef USE_REDIS 5795 COPY_VAR_ptr(redis_server_host); 5796 COPY_VAR_ptr(redis_replica_server_host); 5797 COPY_VAR_int(redis_server_port); 5798 COPY_VAR_int(redis_replica_server_port); 5799 COPY_VAR_ptr(redis_server_path); 5800 COPY_VAR_ptr(redis_replica_server_path); 5801 COPY_VAR_ptr(redis_server_password); 5802 COPY_VAR_ptr(redis_replica_server_password); 5803 COPY_VAR_int(redis_timeout); 5804 COPY_VAR_int(redis_replica_timeout); 5805 COPY_VAR_int(redis_command_timeout); 5806 COPY_VAR_int(redis_replica_command_timeout); 5807 COPY_VAR_int(redis_connect_timeout); 5808 COPY_VAR_int(redis_replica_connect_timeout); 5809 COPY_VAR_int(redis_expire_records); 5810 COPY_VAR_int(redis_logical_db); 5811 COPY_VAR_int(redis_replica_logical_db); 5812 #endif 5813 #endif 5814 COPY_VAR_int(do_answer_cookie); 5815 /* Not copied because the length and content could then not match. 5816 cookie_secret[40], cookie_secret_len 5817 */ 5818 #ifdef USE_IPSET 5819 COPY_VAR_ptr(ipset_name_v4); 5820 COPY_VAR_ptr(ipset_name_v6); 5821 #endif 5822 COPY_VAR_int(ede); 5823 } 5824 #endif /* ATOMIC_POINTER_LOCK_FREE && HAVE_LINK_ATOMIC_STORE */ 5825 5826 /** fast reload thread, adjust the cache sizes */ 5827 static void 5828 fr_adjust_cache(struct module_env* env, struct config_file* oldcfg) 5829 { 5830 if(env->cfg->msg_cache_size != oldcfg->msg_cache_size) 5831 slabhash_adjust_size(env->msg_cache, env->cfg->msg_cache_size); 5832 if(env->cfg->rrset_cache_size != oldcfg->rrset_cache_size) 5833 slabhash_adjust_size(&env->rrset_cache->table, 5834 env->cfg->rrset_cache_size); 5835 if(env->key_cache && 5836 env->cfg->key_cache_size != oldcfg->key_cache_size) 5837 slabhash_adjust_size(env->key_cache->slab, 5838 env->cfg->key_cache_size); 5839 if(env->cfg->infra_cache_numhosts != oldcfg->infra_cache_numhosts) { 5840 size_t inframem = env->cfg->infra_cache_numhosts * 5841 (sizeof(struct infra_key) + sizeof(struct infra_data) 5842 + INFRA_BYTES_NAME); 5843 slabhash_adjust_size(env->infra_cache->hosts, inframem); 5844 } 5845 if(env->cfg->ratelimit_size != oldcfg->ratelimit_size) { 5846 slabhash_adjust_size(env->infra_cache->domain_rates, 5847 env->cfg->ratelimit_size); 5848 slabhash_adjust_size(env->infra_cache->client_ip_rates, 5849 env->cfg->ratelimit_size); 5850 } 5851 if(env->neg_cache && 5852 env->cfg->neg_cache_size != oldcfg->neg_cache_size) { 5853 val_neg_adjust_size(env->neg_cache, env->cfg->neg_cache_size); 5854 } 5855 } 5856 5857 /** fast reload thread, adjust the iterator env */ 5858 static void 5859 fr_adjust_iter_env(struct module_env* env, struct fast_reload_construct* ct) 5860 { 5861 int m; 5862 struct iter_env* iter_env = NULL; 5863 /* There is no comparison here to see if no options changed and thus 5864 * no swap is needed, the trees with addresses and domains can be 5865 * large and that would take too long. Instead the trees are 5866 * swapped in. */ 5867 5868 /* Because the iterator env is not locked, the update cannot happen 5869 * when fr nopause is used. Without it the fast reload pauses the 5870 * other threads, so they are not currently using the structure. */ 5871 m = modstack_find(env->modstack, "iterator"); 5872 if(m != -1) iter_env = (struct iter_env*)env->modinfo[m]; 5873 if(iter_env) { 5874 /* Swap the data so that the delete happens afterwards. */ 5875 int* oldtargetfetchpolicy = iter_env->target_fetch_policy; 5876 int oldmaxdependencydepth = iter_env->max_dependency_depth; 5877 struct iter_donotq* olddonotq = iter_env->donotq; 5878 struct iter_priv* oldpriv = iter_env->priv; 5879 struct rbtree_type* oldcapswhite = iter_env->caps_white; 5880 struct iter_nat64 oldnat64 = iter_env->nat64; 5881 5882 iter_env->target_fetch_policy = ct->target_fetch_policy; 5883 iter_env->max_dependency_depth = ct->max_dependency_depth; 5884 iter_env->donotq = ct->donotq; 5885 iter_env->priv = ct->priv; 5886 iter_env->caps_white = ct->caps_white; 5887 iter_env->nat64 = ct->nat64; 5888 iter_env->outbound_msg_retry = env->cfg->outbound_msg_retry; 5889 iter_env->max_sent_count = env->cfg->max_sent_count; 5890 iter_env->max_query_restarts = env->cfg->max_query_restarts; 5891 5892 ct->target_fetch_policy = oldtargetfetchpolicy; 5893 ct->max_dependency_depth = oldmaxdependencydepth; 5894 ct->donotq = olddonotq; 5895 ct->priv = oldpriv; 5896 ct->caps_white = oldcapswhite; 5897 ct->nat64 = oldnat64; 5898 } 5899 } 5900 5901 /** fast reload thread, adjust the validator env */ 5902 static void 5903 fr_adjust_val_env(struct module_env* env, struct fast_reload_construct* ct, 5904 struct config_file* oldcfg) 5905 { 5906 int m; 5907 struct val_env* val_env = NULL; 5908 if(env->cfg->bogus_ttl == oldcfg->bogus_ttl && 5909 env->cfg->val_date_override == oldcfg->val_date_override && 5910 env->cfg->val_sig_skew_min == oldcfg->val_sig_skew_min && 5911 env->cfg->val_sig_skew_max == oldcfg->val_sig_skew_max && 5912 env->cfg->val_max_restart == oldcfg->val_max_restart && 5913 strcmp(env->cfg->val_nsec3_key_iterations, 5914 oldcfg->val_nsec3_key_iterations) == 0) 5915 return; /* no changes */ 5916 5917 /* Because the validator env is not locked, the update cannot happen 5918 * when fr nopause is used. Without it the fast reload pauses the 5919 * other threads, so they are not currently using the structure. */ 5920 m = modstack_find(env->modstack, "validator"); 5921 if(m != -1) val_env = (struct val_env*)env->modinfo[m]; 5922 if(val_env) { 5923 /* Swap the arrays so that the delete happens afterwards. */ 5924 size_t* oldkeysize = val_env->nsec3_keysize; 5925 size_t* oldmaxiter = val_env->nsec3_maxiter; 5926 val_env->nsec3_keysize = NULL; 5927 val_env->nsec3_maxiter = NULL; 5928 val_env_apply_cfg(val_env, env->cfg, ct->nsec3_keysize, 5929 ct->nsec3_maxiter, ct->nsec3_keyiter_count); 5930 ct->nsec3_keysize = oldkeysize; 5931 ct->nsec3_maxiter = oldmaxiter; 5932 if(env->neg_cache) { 5933 lock_basic_lock(&env->neg_cache->lock); 5934 env->neg_cache->nsec3_max_iter = val_env-> 5935 nsec3_maxiter[val_env->nsec3_keyiter_count-1]; 5936 lock_basic_unlock(&env->neg_cache->lock); 5937 } 5938 } 5939 } 5940 5941 /** fast reload thread, adjust the infra cache parameters */ 5942 static void 5943 fr_adjust_infra(struct module_env* env, struct fast_reload_construct* ct) 5944 { 5945 struct infra_cache* infra = env->infra_cache; 5946 struct config_file* cfg = env->cfg; 5947 struct rbtree_type oldwaitlim = infra->wait_limits_netblock; 5948 struct rbtree_type oldwaitlimcookie = 5949 infra->wait_limits_cookie_netblock; 5950 struct rbtree_type olddomainlim = infra->domain_limits; 5951 5952 /* The size of the infra cache and ip rates is changed 5953 * in fr_adjust_cache. */ 5954 infra->host_ttl = cfg->host_ttl; 5955 infra->infra_keep_probing = cfg->infra_keep_probing; 5956 infra_dp_ratelimit = cfg->ratelimit; 5957 infra_ip_ratelimit = cfg->ip_ratelimit; 5958 infra_ip_ratelimit_cookie = cfg->ip_ratelimit_cookie; 5959 infra->wait_limits_netblock = ct->wait_limits_netblock; 5960 infra->wait_limits_cookie_netblock = ct->wait_limits_cookie_netblock; 5961 infra->domain_limits = ct->domain_limits; 5962 5963 ct->wait_limits_netblock = oldwaitlim; 5964 ct->wait_limits_cookie_netblock = oldwaitlimcookie; 5965 ct->domain_limits = olddomainlim; 5966 } 5967 5968 /** fast reload thread, reload config with putting the new config items 5969 * in place and swapping out the old items. */ 5970 static int 5971 fr_reload_config(struct fast_reload_thread* fr, struct config_file* newcfg, 5972 struct fast_reload_construct* ct) 5973 { 5974 struct daemon* daemon = fr->worker->daemon; 5975 struct module_env* env = daemon->env; 5976 5977 /* These are constructed in the fr_construct_from_config routine. */ 5978 log_assert(ct->oldcfg); 5979 log_assert(ct->fwds); 5980 log_assert(ct->hints); 5981 5982 /* Grab big locks to satisfy lock conditions. */ 5983 lock_rw_wrlock(&ct->views->lock); 5984 lock_rw_wrlock(&env->views->lock); 5985 lock_rw_wrlock(&ct->respip_set->lock); 5986 lock_rw_wrlock(&env->respip_set->lock); 5987 lock_rw_wrlock(&ct->local_zones->lock); 5988 lock_rw_wrlock(&daemon->local_zones->lock); 5989 lock_rw_wrlock(&ct->auth_zones->rpz_lock); 5990 lock_rw_wrlock(&env->auth_zones->rpz_lock); 5991 lock_rw_wrlock(&ct->auth_zones->lock); 5992 lock_rw_wrlock(&env->auth_zones->lock); 5993 lock_rw_wrlock(&ct->fwds->lock); 5994 lock_rw_wrlock(&env->fwds->lock); 5995 lock_rw_wrlock(&ct->hints->lock); 5996 lock_rw_wrlock(&env->hints->lock); 5997 if(ct->anchors) { 5998 lock_basic_lock(&ct->anchors->lock); 5999 lock_basic_lock(&env->anchors->lock); 6000 } 6001 6002 #if defined(ATOMIC_POINTER_LOCK_FREE) && defined(HAVE_LINK_ATOMIC_STORE) 6003 if(fr->fr_nopause) { 6004 fr_atomic_copy_cfg(ct->oldcfg, env->cfg, newcfg); 6005 } else { 6006 #endif 6007 /* Store old config elements. */ 6008 *ct->oldcfg = *env->cfg; 6009 /* Insert new config elements. */ 6010 *env->cfg = *newcfg; 6011 #if defined(ATOMIC_POINTER_LOCK_FREE) && defined(HAVE_LINK_ATOMIC_STORE) 6012 } 6013 #endif 6014 6015 if(env->cfg->log_identity || ct->oldcfg->log_identity) { 6016 /* pick up new log_identity string to use for log output. */ 6017 log_ident_set_or_default(env->cfg->log_identity); 6018 } 6019 /* the newcfg elements are in env->cfg, so should not be freed here. */ 6020 #if defined(ATOMIC_POINTER_LOCK_FREE) && defined(HAVE_LINK_ATOMIC_STORE) 6021 /* if used, the routine that copies the config has zeroed items. */ 6022 if(!fr->fr_nopause) 6023 #endif 6024 memset(newcfg, 0, sizeof(*newcfg)); 6025 6026 /* Quickly swap the tree roots themselves with the already allocated 6027 * elements. This is a quick swap operation on the pointer. 6028 * The other threads are stopped and locks are held, so that a 6029 * consistent view of the configuration, before, and after, exists 6030 * towards the state machine for query resolution. */ 6031 forwards_swap_tree(env->fwds, ct->fwds); 6032 hints_swap_tree(env->hints, ct->hints); 6033 views_swap_tree(env->views, ct->views); 6034 acl_list_swap_tree(daemon->acl, ct->acl); 6035 acl_list_swap_tree(daemon->acl_interface, ct->acl_interface); 6036 tcl_list_swap_tree(daemon->tcl, ct->tcl); 6037 local_zones_swap_tree(daemon->local_zones, ct->local_zones); 6038 respip_set_swap_tree(env->respip_set, ct->respip_set); 6039 daemon->use_response_ip = ct->use_response_ip; 6040 daemon->use_rpz = ct->use_rpz; 6041 auth_zones_swap(env->auth_zones, ct->auth_zones); 6042 edns_strings_swap_tree(env->edns_strings, ct->edns_strings); 6043 anchors_swap_tree(env->anchors, ct->anchors); 6044 #ifdef USE_CACHEDB 6045 daemon->env->cachedb_enabled = cachedb_is_enabled(&daemon->mods, 6046 daemon->env); 6047 #endif 6048 #ifdef USE_DNSTAP 6049 if(env->cfg->dnstap) { 6050 if(!fr->fr_nopause) 6051 dt_apply_cfg(daemon->dtenv, env->cfg); 6052 else dt_apply_logcfg(daemon->dtenv, env->cfg); 6053 } 6054 #endif 6055 fr_adjust_cache(env, ct->oldcfg); 6056 if(!fr->fr_nopause) { 6057 fr_adjust_iter_env(env, ct); 6058 fr_adjust_val_env(env, ct, ct->oldcfg); 6059 fr_adjust_infra(env, ct); 6060 } 6061 6062 /* Set globals with new config. */ 6063 config_apply(env->cfg); 6064 6065 lock_rw_unlock(&ct->views->lock); 6066 lock_rw_unlock(&env->views->lock); 6067 lock_rw_unlock(&ct->respip_set->lock); 6068 lock_rw_unlock(&env->respip_set->lock); 6069 lock_rw_unlock(&ct->local_zones->lock); 6070 lock_rw_unlock(&daemon->local_zones->lock); 6071 lock_rw_unlock(&ct->auth_zones->lock); 6072 lock_rw_unlock(&env->auth_zones->lock); 6073 lock_rw_unlock(&ct->auth_zones->rpz_lock); 6074 lock_rw_unlock(&env->auth_zones->rpz_lock); 6075 lock_rw_unlock(&ct->fwds->lock); 6076 lock_rw_unlock(&env->fwds->lock); 6077 lock_rw_unlock(&ct->hints->lock); 6078 lock_rw_unlock(&env->hints->lock); 6079 if(ct->anchors) { 6080 lock_basic_unlock(&ct->anchors->lock); 6081 lock_basic_unlock(&env->anchors->lock); 6082 } 6083 6084 return 1; 6085 } 6086 6087 /** fast reload, poll for ack incoming. */ 6088 static void 6089 fr_poll_for_ack(struct fast_reload_thread* fr) 6090 { 6091 int loopexit = 0, bcount = 0; 6092 uint32_t cmd; 6093 ssize_t ret; 6094 6095 if(fr->need_to_quit) 6096 return; 6097 /* Is there data? */ 6098 if(!sock_poll_timeout(fr->commpair[1], -1, 1, 0, NULL)) { 6099 log_err("fr_poll_for_ack: poll failed"); 6100 return; 6101 } 6102 6103 /* Read the data */ 6104 while(1) { 6105 if(++loopexit > IPC_LOOP_MAX) { 6106 log_err("fr_poll_for_ack: recv loops %s", 6107 sock_strerror(errno)); 6108 return; 6109 } 6110 ret = recv(fr->commpair[1], ((char*)&cmd)+bcount, 6111 sizeof(cmd)-bcount, 0); 6112 if(ret == -1) { 6113 if( 6114 #ifndef USE_WINSOCK 6115 errno == EINTR || errno == EAGAIN 6116 # ifdef EWOULDBLOCK 6117 || errno == EWOULDBLOCK 6118 # endif 6119 #else 6120 WSAGetLastError() == WSAEINTR || 6121 WSAGetLastError() == WSAEINPROGRESS || 6122 WSAGetLastError() == WSAEWOULDBLOCK 6123 #endif 6124 ) 6125 continue; /* Try again. */ 6126 log_err("fr_poll_for_ack: recv: %s", 6127 sock_strerror(errno)); 6128 return; 6129 } else if(ret+(ssize_t)bcount != sizeof(cmd)) { 6130 bcount += ret; 6131 if((size_t)bcount < sizeof(cmd)) 6132 continue; 6133 } 6134 break; 6135 } 6136 if(cmd == fast_reload_notification_exit) { 6137 fr->need_to_quit = 1; 6138 verbose(VERB_ALGO, "fast reload wait for ack: " 6139 "exit notification received"); 6140 return; 6141 } 6142 if(cmd != fast_reload_notification_reload_ack) { 6143 verbose(VERB_ALGO, "fast reload wait for ack: " 6144 "wrong notification %d", (int)cmd); 6145 } 6146 } 6147 6148 /** fast reload thread, reload ipc communication to stop and start threads. */ 6149 static int 6150 fr_reload_ipc(struct fast_reload_thread* fr, struct config_file* newcfg, 6151 struct fast_reload_construct* ct) 6152 { 6153 int result = 1; 6154 if(!fr->fr_nopause) { 6155 fr_send_notification(fr, fast_reload_notification_reload_stop); 6156 fr_poll_for_ack(fr); 6157 } 6158 if(!fr_reload_config(fr, newcfg, ct)) { 6159 result = 0; 6160 } 6161 if(!fr->fr_nopause) { 6162 fr_send_notification(fr, fast_reload_notification_reload_start); 6163 fr_poll_for_ack(fr); 6164 } 6165 return result; 6166 } 6167 6168 /** fast reload thread, load config */ 6169 static int 6170 fr_load_config(struct fast_reload_thread* fr, struct timeval* time_read, 6171 struct timeval* time_construct, struct timeval* time_reload) 6172 { 6173 struct fast_reload_construct ct; 6174 struct config_file* newcfg = NULL; 6175 memset(&ct, 0, sizeof(ct)); 6176 6177 /* Read file. */ 6178 if(!fr_read_config(fr, &newcfg)) 6179 return 0; 6180 if(gettimeofday(time_read, NULL) < 0) 6181 log_err("gettimeofday: %s", strerror(errno)); 6182 if(fr_poll_for_quit(fr)) { 6183 config_delete(newcfg); 6184 return 1; 6185 } 6186 6187 /* Check if the config can be loaded */ 6188 if(!fr_check_tag_defines(fr, newcfg)) { 6189 config_delete(newcfg); 6190 return 0; 6191 } 6192 if(!fr_check_compat_cfg(fr, newcfg)) { 6193 config_delete(newcfg); 6194 return 0; 6195 } 6196 if(!fr_check_nopause_cfg(fr, newcfg)) { 6197 config_delete(newcfg); 6198 return 0; 6199 } 6200 if(fr_poll_for_quit(fr)) { 6201 config_delete(newcfg); 6202 return 1; 6203 } 6204 6205 /* Construct items. */ 6206 if(!fr_construct_from_config(fr, newcfg, &ct)) { 6207 config_delete(newcfg); 6208 if(!fr_output_printf(fr, "Could not construct from the " 6209 "config, check for errors with unbound-checkconf, or " 6210 "out of memory. The parse errors are printed in " 6211 "the log.\n")) 6212 return 0; 6213 fr_send_notification(fr, fast_reload_notification_printout); 6214 return 0; 6215 } 6216 if(gettimeofday(time_construct, NULL) < 0) 6217 log_err("gettimeofday: %s", strerror(errno)); 6218 if(fr_poll_for_quit(fr)) { 6219 config_delete(newcfg); 6220 fr_construct_clear(&ct); 6221 return 1; 6222 } 6223 6224 /* Reload server. */ 6225 if(!fr_reload_ipc(fr, newcfg, &ct)) { 6226 config_delete(newcfg); 6227 fr_construct_clear(&ct); 6228 if(!fr_output_printf(fr, "error: reload failed\n")) 6229 return 0; 6230 fr_send_notification(fr, fast_reload_notification_printout); 6231 return 0; 6232 } 6233 if(gettimeofday(time_reload, NULL) < 0) 6234 log_err("gettimeofday: %s", strerror(errno)); 6235 6236 if(fr_poll_for_quit(fr)) { 6237 config_delete(newcfg); 6238 fr_construct_clear(&ct); 6239 return 1; 6240 } 6241 if(fr->fr_nopause) { 6242 /* Poll every thread, with a no-work poll item over the 6243 * command pipe. This makes the worker thread surely move 6244 * to deal with that event, and thus the thread is no longer 6245 * holding, eg. a string item from the old config struct. 6246 * And then the old config struct can safely be deleted. 6247 * Only needed when nopause is used, because without that 6248 * the worker threads are already waiting on a command pipe 6249 * item. This nopause command pipe item does not take work, 6250 * it returns immediately, so it does not delay the workers. 6251 * They can be polled one at a time. But its processing causes 6252 * the worker to have released data items from old config. 6253 * This also makes sure the threads are not holding locks on 6254 * individual items in the local_zones, views, respip_set. */ 6255 fr_send_notification(fr, 6256 fast_reload_notification_reload_nopause_poll); 6257 fr_poll_for_ack(fr); 6258 } 6259 6260 /* Delete old. */ 6261 config_delete(newcfg); 6262 fr_construct_clear(&ct); 6263 return 1; 6264 } 6265 6266 /** fast reload thread. the thread main function */ 6267 static void* fast_reload_thread_main(void* arg) 6268 { 6269 struct fast_reload_thread* fast_reload_thread = (struct fast_reload_thread*)arg; 6270 struct timeval time_start, time_read, time_construct, time_reload, 6271 time_end; 6272 log_thread_set(&fast_reload_thread->threadnum); 6273 6274 verbose(VERB_ALGO, "start fast reload thread"); 6275 if(fast_reload_thread->fr_verb >= 1) { 6276 fr_init_time(&time_start, &time_read, &time_construct, 6277 &time_reload, &time_end); 6278 if(fr_poll_for_quit(fast_reload_thread)) 6279 goto done; 6280 } 6281 6282 /* print output to the client */ 6283 if(fast_reload_thread->fr_verb >= 1) { 6284 if(!fr_output_printf(fast_reload_thread, "thread started\n")) 6285 goto done_error; 6286 fr_send_notification(fast_reload_thread, 6287 fast_reload_notification_printout); 6288 if(fr_poll_for_quit(fast_reload_thread)) 6289 goto done; 6290 } 6291 6292 if(!fr_load_config(fast_reload_thread, &time_read, &time_construct, 6293 &time_reload)) 6294 goto done_error; 6295 if(fr_poll_for_quit(fast_reload_thread)) 6296 goto done; 6297 6298 if(fast_reload_thread->fr_verb >= 1) { 6299 if(!fr_finish_time(fast_reload_thread, &time_start, &time_read, 6300 &time_construct, &time_reload, &time_end)) 6301 goto done_error; 6302 if(fr_poll_for_quit(fast_reload_thread)) 6303 goto done; 6304 } 6305 6306 if(!fr_output_printf(fast_reload_thread, "ok\n")) 6307 goto done_error; 6308 fr_send_notification(fast_reload_thread, 6309 fast_reload_notification_printout); 6310 verbose(VERB_ALGO, "stop fast reload thread"); 6311 /* If this is not an exit due to quit earlier, send regular done. */ 6312 if(!fast_reload_thread->need_to_quit) 6313 fr_send_notification(fast_reload_thread, 6314 fast_reload_notification_done); 6315 /* If during the fast_reload_notification_done send, 6316 * fast_reload_notification_exit was received, ack it. If the 6317 * thread is exiting due to quit received earlier, also ack it.*/ 6318 done: 6319 if(fast_reload_thread->need_to_quit) 6320 fr_send_notification(fast_reload_thread, 6321 fast_reload_notification_exited); 6322 return NULL; 6323 done_error: 6324 verbose(VERB_ALGO, "stop fast reload thread with done_error"); 6325 fr_send_notification(fast_reload_thread, 6326 fast_reload_notification_done_error); 6327 return NULL; 6328 } 6329 #endif /* !THREADS_DISABLED */ 6330 6331 /** create a socketpair for bidirectional communication, false on failure */ 6332 static int 6333 create_socketpair(int* pair, struct ub_randstate* rand) 6334 { 6335 #ifndef USE_WINSOCK 6336 if(socketpair(AF_UNIX, SOCK_STREAM, 0, pair) == -1) { 6337 log_err("socketpair: %s", strerror(errno)); 6338 return 0; 6339 } 6340 (void)rand; 6341 #else 6342 struct sockaddr_in addr, baddr, accaddr, connaddr; 6343 socklen_t baddrlen, accaddrlen, connaddrlen; 6344 uint8_t localhost[] = {127, 0, 0, 1}; 6345 uint8_t nonce[16], recvnonce[16]; 6346 size_t i; 6347 int lst, pollin_event, bcount, loopcount; 6348 int connect_poll_timeout = 200; /* msec to wait for connection */ 6349 ssize_t ret; 6350 pair[0] = -1; 6351 pair[1] = -1; 6352 for(i=0; i<sizeof(nonce); i++) { 6353 nonce[i] = ub_random_max(rand, 256); 6354 } 6355 lst = socket(AF_INET, SOCK_STREAM, 0); 6356 if(lst == -1) { 6357 log_err("create_socketpair: socket: %s", sock_strerror(errno)); 6358 return 0; 6359 } 6360 memset(&addr, 0, sizeof(addr)); 6361 addr.sin_family = AF_INET; 6362 addr.sin_port = 0; 6363 memcpy(&addr.sin_addr, localhost, 4); 6364 if(bind(lst, (struct sockaddr*)&addr, (socklen_t)sizeof(addr)) 6365 == -1) { 6366 log_err("create socketpair: bind: %s", sock_strerror(errno)); 6367 sock_close(lst); 6368 return 0; 6369 } 6370 if(listen(lst, 12) == -1) { 6371 log_err("create socketpair: listen: %s", sock_strerror(errno)); 6372 sock_close(lst); 6373 return 0; 6374 } 6375 6376 pair[1] = socket(AF_INET, SOCK_STREAM, 0); 6377 if(pair[1] == -1) { 6378 log_err("create socketpair: socket: %s", sock_strerror(errno)); 6379 sock_close(lst); 6380 return 0; 6381 } 6382 baddrlen = (socklen_t)sizeof(baddr); 6383 if(getsockname(lst, (struct sockaddr*)&baddr, &baddrlen) == -1) { 6384 log_err("create socketpair: getsockname: %s", 6385 sock_strerror(errno)); 6386 sock_close(lst); 6387 sock_close(pair[1]); 6388 pair[1] = -1; 6389 return 0; 6390 } 6391 if(baddrlen > (socklen_t)sizeof(baddr)) { 6392 log_err("create socketpair: getsockname returned addr too big"); 6393 sock_close(lst); 6394 sock_close(pair[1]); 6395 pair[1] = -1; 6396 return 0; 6397 } 6398 /* the socket is blocking */ 6399 if(connect(pair[1], (struct sockaddr*)&baddr, baddrlen) == -1) { 6400 log_err("create socketpair: connect: %s", 6401 sock_strerror(errno)); 6402 sock_close(lst); 6403 sock_close(pair[1]); 6404 pair[1] = -1; 6405 return 0; 6406 } 6407 if(!sock_poll_timeout(lst, connect_poll_timeout, 1, 0, &pollin_event)) { 6408 log_err("create socketpair: poll for accept failed: %s", 6409 sock_strerror(errno)); 6410 sock_close(lst); 6411 sock_close(pair[1]); 6412 pair[1] = -1; 6413 return 0; 6414 } 6415 if(!pollin_event) { 6416 log_err("create socketpair: poll timeout for accept"); 6417 sock_close(lst); 6418 sock_close(pair[1]); 6419 pair[1] = -1; 6420 return 0; 6421 } 6422 accaddrlen = (socklen_t)sizeof(accaddr); 6423 pair[0] = accept(lst, (struct sockaddr*)&accaddr, &accaddrlen); 6424 if(pair[0] == -1) { 6425 log_err("create socketpair: accept: %s", sock_strerror(errno)); 6426 sock_close(lst); 6427 sock_close(pair[1]); 6428 pair[1] = -1; 6429 return 0; 6430 } 6431 if(accaddrlen > (socklen_t)sizeof(accaddr)) { 6432 log_err("create socketpair: accept returned addr too big"); 6433 sock_close(lst); 6434 sock_close(pair[0]); 6435 sock_close(pair[1]); 6436 pair[0] = -1; 6437 pair[1] = -1; 6438 return 0; 6439 } 6440 if(accaddr.sin_family != AF_INET || 6441 memcmp(localhost, &accaddr.sin_addr, 4) != 0) { 6442 log_err("create socketpair: accept from wrong address"); 6443 sock_close(lst); 6444 sock_close(pair[0]); 6445 sock_close(pair[1]); 6446 pair[0] = -1; 6447 pair[1] = -1; 6448 return 0; 6449 } 6450 connaddrlen = (socklen_t)sizeof(connaddr); 6451 if(getsockname(pair[1], (struct sockaddr*)&connaddr, &connaddrlen) 6452 == -1) { 6453 log_err("create socketpair: getsockname connectedaddr: %s", 6454 sock_strerror(errno)); 6455 sock_close(lst); 6456 sock_close(pair[0]); 6457 sock_close(pair[1]); 6458 pair[0] = -1; 6459 pair[1] = -1; 6460 return 0; 6461 } 6462 if(connaddrlen > (socklen_t)sizeof(connaddr)) { 6463 log_err("create socketpair: getsockname connectedaddr returned addr too big"); 6464 sock_close(lst); 6465 sock_close(pair[0]); 6466 sock_close(pair[1]); 6467 pair[0] = -1; 6468 pair[1] = -1; 6469 return 0; 6470 } 6471 if(connaddr.sin_family != AF_INET || 6472 memcmp(localhost, &connaddr.sin_addr, 4) != 0) { 6473 log_err("create socketpair: getsockname connectedaddr returned wrong address"); 6474 sock_close(lst); 6475 sock_close(pair[0]); 6476 sock_close(pair[1]); 6477 pair[0] = -1; 6478 pair[1] = -1; 6479 return 0; 6480 } 6481 if(accaddr.sin_port != connaddr.sin_port) { 6482 log_err("create socketpair: accept from wrong port"); 6483 sock_close(lst); 6484 sock_close(pair[0]); 6485 sock_close(pair[1]); 6486 pair[0] = -1; 6487 pair[1] = -1; 6488 return 0; 6489 } 6490 sock_close(lst); 6491 6492 loopcount = 0; 6493 bcount = 0; 6494 while(1) { 6495 if(++loopcount > IPC_LOOP_MAX) { 6496 log_err("create socketpair: send failed due to loop"); 6497 sock_close(pair[0]); 6498 sock_close(pair[1]); 6499 pair[0] = -1; 6500 pair[1] = -1; 6501 return 0; 6502 } 6503 ret = send(pair[1], (void*)(nonce+bcount), 6504 sizeof(nonce)-bcount, 0); 6505 if(ret == -1) { 6506 if( 6507 #ifndef USE_WINSOCK 6508 errno == EINTR || errno == EAGAIN 6509 # ifdef EWOULDBLOCK 6510 || errno == EWOULDBLOCK 6511 # endif 6512 #else 6513 WSAGetLastError() == WSAEINTR || 6514 WSAGetLastError() == WSAEINPROGRESS || 6515 WSAGetLastError() == WSAEWOULDBLOCK 6516 #endif 6517 ) 6518 continue; /* Try again. */ 6519 log_err("create socketpair: send: %s", sock_strerror(errno)); 6520 sock_close(pair[0]); 6521 sock_close(pair[1]); 6522 pair[0] = -1; 6523 pair[1] = -1; 6524 return 0; 6525 } else if(ret+(ssize_t)bcount != sizeof(nonce)) { 6526 bcount += ret; 6527 if((size_t)bcount < sizeof(nonce)) 6528 continue; 6529 } 6530 break; 6531 } 6532 6533 if(!sock_poll_timeout(pair[0], connect_poll_timeout, 1, 0, &pollin_event)) { 6534 log_err("create socketpair: poll failed: %s", 6535 sock_strerror(errno)); 6536 sock_close(pair[0]); 6537 sock_close(pair[1]); 6538 pair[0] = -1; 6539 pair[1] = -1; 6540 return 0; 6541 } 6542 if(!pollin_event) { 6543 log_err("create socketpair: poll timeout for recv"); 6544 sock_close(pair[0]); 6545 sock_close(pair[1]); 6546 pair[0] = -1; 6547 pair[1] = -1; 6548 return 0; 6549 } 6550 6551 loopcount = 0; 6552 bcount = 0; 6553 while(1) { 6554 if(++loopcount > IPC_LOOP_MAX) { 6555 log_err("create socketpair: recv failed due to loop"); 6556 sock_close(pair[0]); 6557 sock_close(pair[1]); 6558 pair[0] = -1; 6559 pair[1] = -1; 6560 return 0; 6561 } 6562 ret = recv(pair[0], (void*)(recvnonce+bcount), 6563 sizeof(nonce)-bcount, 0); 6564 if(ret == -1) { 6565 if( 6566 #ifndef USE_WINSOCK 6567 errno == EINTR || errno == EAGAIN 6568 # ifdef EWOULDBLOCK 6569 || errno == EWOULDBLOCK 6570 # endif 6571 #else 6572 WSAGetLastError() == WSAEINTR || 6573 WSAGetLastError() == WSAEINPROGRESS || 6574 WSAGetLastError() == WSAEWOULDBLOCK 6575 #endif 6576 ) 6577 continue; /* Try again. */ 6578 log_err("create socketpair: recv: %s", sock_strerror(errno)); 6579 sock_close(pair[0]); 6580 sock_close(pair[1]); 6581 pair[0] = -1; 6582 pair[1] = -1; 6583 return 0; 6584 } else if(ret == 0) { 6585 log_err("create socketpair: stream closed"); 6586 sock_close(pair[0]); 6587 sock_close(pair[1]); 6588 pair[0] = -1; 6589 pair[1] = -1; 6590 return 0; 6591 } else if(ret+(ssize_t)bcount != sizeof(nonce)) { 6592 bcount += ret; 6593 if((size_t)bcount < sizeof(nonce)) 6594 continue; 6595 } 6596 break; 6597 } 6598 6599 if(memcmp(nonce, recvnonce, sizeof(nonce)) != 0) { 6600 log_err("create socketpair: recv wrong nonce"); 6601 sock_close(pair[0]); 6602 sock_close(pair[1]); 6603 pair[0] = -1; 6604 pair[1] = -1; 6605 return 0; 6606 } 6607 #endif 6608 return 1; 6609 } 6610 6611 /** fast reload thread. setup the thread info */ 6612 static int 6613 fast_reload_thread_setup(struct worker* worker, int fr_verb, int fr_nopause, 6614 int fr_drop_mesh) 6615 { 6616 struct fast_reload_thread* fr; 6617 int numworkers = worker->daemon->num; 6618 worker->daemon->fast_reload_thread = (struct fast_reload_thread*) 6619 calloc(1, sizeof(*worker->daemon->fast_reload_thread)); 6620 if(!worker->daemon->fast_reload_thread) 6621 return 0; 6622 fr = worker->daemon->fast_reload_thread; 6623 fr->fr_verb = fr_verb; 6624 fr->fr_nopause = fr_nopause; 6625 fr->fr_drop_mesh = fr_drop_mesh; 6626 worker->daemon->fast_reload_drop_mesh = fr->fr_drop_mesh; 6627 /* The thread id printed in logs, numworker+1 is the dnstap thread. 6628 * This is numworkers+2. */ 6629 fr->threadnum = numworkers+2; 6630 fr->commpair[0] = -1; 6631 fr->commpair[1] = -1; 6632 fr->commreload[0] = -1; 6633 fr->commreload[1] = -1; 6634 if(!create_socketpair(fr->commpair, worker->daemon->rand)) { 6635 free(fr); 6636 worker->daemon->fast_reload_thread = NULL; 6637 return 0; 6638 } 6639 fr->worker = worker; 6640 fr->fr_output = (struct config_strlist_head*)calloc(1, 6641 sizeof(*fr->fr_output)); 6642 if(!fr->fr_output) { 6643 sock_close(fr->commpair[0]); 6644 sock_close(fr->commpair[1]); 6645 free(fr); 6646 worker->daemon->fast_reload_thread = NULL; 6647 return 0; 6648 } 6649 if(!create_socketpair(fr->commreload, worker->daemon->rand)) { 6650 sock_close(fr->commpair[0]); 6651 sock_close(fr->commpair[1]); 6652 free(fr->fr_output); 6653 free(fr); 6654 worker->daemon->fast_reload_thread = NULL; 6655 return 0; 6656 } 6657 lock_basic_init(&fr->fr_output_lock); 6658 lock_protect(&fr->fr_output_lock, fr->fr_output, 6659 sizeof(*fr->fr_output)); 6660 return 1; 6661 } 6662 6663 /** fast reload, delete auth zone change list */ 6664 static void 6665 fr_auth_change_list_delete( 6666 struct fast_reload_auth_change* auth_zone_change_list) 6667 { 6668 struct fast_reload_auth_change* item, *next; 6669 item = auth_zone_change_list; 6670 while(item) { 6671 next = item->next; 6672 free(item); 6673 item = next; 6674 } 6675 } 6676 6677 /** fast reload thread. desetup and delete the thread info. */ 6678 static void 6679 fast_reload_thread_desetup(struct fast_reload_thread* fast_reload_thread) 6680 { 6681 if(!fast_reload_thread) 6682 return; 6683 if(fast_reload_thread->service_event && 6684 fast_reload_thread->service_event_is_added) { 6685 ub_event_del(fast_reload_thread->service_event); 6686 fast_reload_thread->service_event_is_added = 0; 6687 } 6688 if(fast_reload_thread->service_event) 6689 ub_event_free(fast_reload_thread->service_event); 6690 sock_close(fast_reload_thread->commpair[0]); 6691 sock_close(fast_reload_thread->commpair[1]); 6692 sock_close(fast_reload_thread->commreload[0]); 6693 sock_close(fast_reload_thread->commreload[1]); 6694 if(fast_reload_thread->printq) { 6695 fr_main_perform_printout(fast_reload_thread); 6696 /* If it is empty now, there is nothing to print on fd. */ 6697 if(fr_printq_empty(fast_reload_thread->printq)) { 6698 fr_printq_delete(fast_reload_thread->printq); 6699 } else { 6700 /* Keep the printq around to printout the remaining 6701 * text to the remote client. Until it is done, it 6702 * sits on a list, that is in the daemon struct. 6703 * The event can then spool the remaining text to the 6704 * remote client and eventually delete itself from the 6705 * callback. */ 6706 fr_printq_list_insert(fast_reload_thread->printq, 6707 fast_reload_thread->worker->daemon); 6708 fast_reload_thread->printq = NULL; 6709 } 6710 } 6711 lock_basic_destroy(&fast_reload_thread->fr_output_lock); 6712 if(fast_reload_thread->fr_output) { 6713 config_delstrlist(fast_reload_thread->fr_output->first); 6714 free(fast_reload_thread->fr_output); 6715 } 6716 fr_auth_change_list_delete(fast_reload_thread->auth_zone_change_list); 6717 6718 free(fast_reload_thread); 6719 } 6720 6721 /** 6722 * Fast reload thread, send a command to the thread. Blocking on timeout. 6723 * It handles received input from the thread, if any is received. 6724 */ 6725 static void 6726 fr_send_cmd_to(struct fast_reload_thread* fr, 6727 enum fast_reload_notification status, int check_cmds, int blocking) 6728 { 6729 int outevent, loopexit = 0, bcount = 0; 6730 uint32_t cmd; 6731 ssize_t ret; 6732 verbose(VERB_ALGO, "send notification to fast reload thread: %s", 6733 fr_notification_to_string(status)); 6734 cmd = status; 6735 while(1) { 6736 if(++loopexit > IPC_LOOP_MAX) { 6737 log_err("send notification to fast reload: could not send notification: loop"); 6738 return; 6739 } 6740 if(check_cmds) 6741 fr_check_cmd_from_thread(fr); 6742 /* wait for socket to become writable */ 6743 if(!sock_poll_timeout(fr->commpair[0], 6744 (blocking?-1:IPC_NOTIFICATION_WAIT), 6745 0, 1, &outevent)) { 6746 log_err("send notification to fast reload: poll failed"); 6747 return; 6748 } 6749 if(!outevent) 6750 continue; 6751 /* keep static analyzer happy; send(-1,..) */ 6752 log_assert(fr->commpair[0] >= 0); 6753 ret = send(fr->commpair[0], ((char*)&cmd)+bcount, 6754 sizeof(cmd)-bcount, 0); 6755 if(ret == -1) { 6756 if( 6757 #ifndef USE_WINSOCK 6758 errno == EINTR || errno == EAGAIN 6759 # ifdef EWOULDBLOCK 6760 || errno == EWOULDBLOCK 6761 # endif 6762 #else 6763 WSAGetLastError() == WSAEINTR || 6764 WSAGetLastError() == WSAEINPROGRESS || 6765 WSAGetLastError() == WSAEWOULDBLOCK 6766 #endif 6767 ) 6768 continue; /* Try again. */ 6769 log_err("send notification to fast reload: send: %s", 6770 sock_strerror(errno)); 6771 return; 6772 } else if(ret+(ssize_t)bcount != sizeof(cmd)) { 6773 bcount += ret; 6774 if((size_t)bcount < sizeof(cmd)) 6775 continue; 6776 } 6777 break; 6778 } 6779 } 6780 6781 /** Fast reload, the main thread handles that the fast reload thread has 6782 * exited. */ 6783 static void 6784 fr_main_perform_done(struct fast_reload_thread* fr) 6785 { 6786 struct worker* worker = fr->worker; 6787 verbose(VERB_ALGO, "join with fastreload thread"); 6788 ub_thread_join(fr->tid); 6789 verbose(VERB_ALGO, "joined with fastreload thread"); 6790 fast_reload_thread_desetup(fr); 6791 worker->daemon->fast_reload_thread = NULL; 6792 } 6793 6794 /** Append strlist after strlist */ 6795 static void 6796 cfg_strlist_append_listhead(struct config_strlist_head* list, 6797 struct config_strlist_head* more) 6798 { 6799 if(!more->first) 6800 return; 6801 if(list->last) 6802 list->last->next = more->first; 6803 else 6804 list->first = more->first; 6805 list->last = more->last; 6806 } 6807 6808 /** Fast reload, the remote control thread handles that the fast reload thread 6809 * has output to be printed, on the linked list that is locked. */ 6810 static void 6811 fr_main_perform_printout(struct fast_reload_thread* fr) 6812 { 6813 struct config_strlist_head out; 6814 6815 /* Fetch the list of items to be printed */ 6816 lock_basic_lock(&fr->fr_output_lock); 6817 out.first = fr->fr_output->first; 6818 out.last = fr->fr_output->last; 6819 fr->fr_output->first = NULL; 6820 fr->fr_output->last = NULL; 6821 lock_basic_unlock(&fr->fr_output_lock); 6822 6823 if(!fr->printq || !fr->printq->client_cp) { 6824 /* There is no output socket, delete it. */ 6825 config_delstrlist(out.first); 6826 return; 6827 } 6828 6829 /* Put them on the output list, not locked because the list 6830 * producer and consumer are both owned by the remote control thread, 6831 * it moves the items to the list for printing in the event callback 6832 * for the client_cp. */ 6833 cfg_strlist_append_listhead(fr->printq->to_print, &out); 6834 6835 /* Set the client_cp to output if not already */ 6836 if(!fr->printq->client_cp->event_added) 6837 comm_point_listen_for_rw(fr->printq->client_cp, 0, 1); 6838 } 6839 6840 /** fast reload, receive ack from workers that they are waiting, run 6841 * by the mainthr after sending them reload_stop. */ 6842 static void 6843 fr_read_ack_from_workers(struct fast_reload_thread* fr) 6844 { 6845 struct daemon* daemon = fr->worker->daemon; 6846 /* Every worker sends one byte, wait for num-1 bytes. */ 6847 int count=0, total=daemon->num-1; 6848 while(count < total) { 6849 uint8_t r; 6850 ssize_t ret; 6851 ret = recv(fr->commreload[0], (void*)&r, 1, 0); 6852 if(ret == -1) { 6853 if( 6854 #ifndef USE_WINSOCK 6855 errno == EINTR || errno == EAGAIN 6856 # ifdef EWOULDBLOCK 6857 || errno == EWOULDBLOCK 6858 # endif 6859 #else 6860 WSAGetLastError() == WSAEINTR || 6861 WSAGetLastError() == WSAEINPROGRESS || 6862 WSAGetLastError() == WSAEWOULDBLOCK 6863 #endif 6864 ) 6865 continue; /* Try again */ 6866 log_err("worker reload ack: recv failed: %s", 6867 sock_strerror(errno)); 6868 return; 6869 } 6870 count++; 6871 verbose(VERB_ALGO, "worker reload ack from (uint8_t)%d", 6872 (int)r); 6873 } 6874 } 6875 6876 /** fast reload, poll for reload_start in mainthr waiting on a notification 6877 * from the fast reload thread. */ 6878 static void 6879 fr_poll_for_reload_start(struct fast_reload_thread* fr) 6880 { 6881 int loopexit = 0, bcount = 0; 6882 uint32_t cmd; 6883 ssize_t ret; 6884 6885 /* Is there data? */ 6886 if(!sock_poll_timeout(fr->commpair[0], -1, 1, 0, NULL)) { 6887 log_err("fr_poll_for_reload_start: poll failed"); 6888 return; 6889 } 6890 6891 /* Read the data */ 6892 while(1) { 6893 if(++loopexit > IPC_LOOP_MAX) { 6894 log_err("fr_poll_for_reload_start: recv loops %s", 6895 sock_strerror(errno)); 6896 return; 6897 } 6898 ret = recv(fr->commpair[0], ((char*)&cmd)+bcount, 6899 sizeof(cmd)-bcount, 0); 6900 if(ret == -1) { 6901 if( 6902 #ifndef USE_WINSOCK 6903 errno == EINTR || errno == EAGAIN 6904 # ifdef EWOULDBLOCK 6905 || errno == EWOULDBLOCK 6906 # endif 6907 #else 6908 WSAGetLastError() == WSAEINTR || 6909 WSAGetLastError() == WSAEINPROGRESS || 6910 WSAGetLastError() == WSAEWOULDBLOCK 6911 #endif 6912 ) 6913 continue; /* Try again. */ 6914 log_err("fr_poll_for_reload_start: recv: %s", 6915 sock_strerror(errno)); 6916 return; 6917 } else if(ret+(ssize_t)bcount != sizeof(cmd)) { 6918 bcount += ret; 6919 if((size_t)bcount < sizeof(cmd)) 6920 continue; 6921 } 6922 break; 6923 } 6924 if(cmd != fast_reload_notification_reload_start) { 6925 verbose(VERB_ALGO, "fast reload wait for ack: " 6926 "wrong notification %d", (int)cmd); 6927 } 6928 } 6929 6930 /** Pick up the worker mesh changes, after fast reload. */ 6931 static void 6932 fr_worker_pickup_mesh(struct worker* worker) 6933 { 6934 struct mesh_area* mesh = worker->env.mesh; 6935 struct config_file* cfg = worker->env.cfg; 6936 mesh->use_response_ip = worker->daemon->use_response_ip; 6937 mesh->use_rpz = worker->daemon->use_rpz; 6938 mesh->max_reply_states = cfg->num_queries_per_thread; 6939 mesh->max_forever_states = (mesh->max_reply_states+1)/2; 6940 #ifndef S_SPLINT_S 6941 mesh->jostle_max.tv_sec = (time_t)(cfg->jostle_time / 1000); 6942 mesh->jostle_max.tv_usec = (time_t)((cfg->jostle_time % 1000)*1000); 6943 #endif 6944 } 6945 6946 /** 6947 * Remove the old tcl_addr entries from the open connections. 6948 * They are only incremented when an accept is performed on a tcp comm point. 6949 * @param front: listening comm ports of the worker. 6950 */ 6951 static void 6952 tcl_remove_old(struct listen_dnsport* front) 6953 { 6954 struct listen_list* l; 6955 l = front->cps; 6956 while(l) { 6957 if(l->com->type == comm_tcp_accept) { 6958 int i; 6959 for(i=0; i<l->com->max_tcp_count; i++) { 6960 if(l->com->tcp_handlers[i]->tcl_addr) { 6961 /* Because the increment of the 6962 * connection limit was in the old 6963 * tcl list, the new list does not 6964 * need a decrement. With NULL it is 6965 * not decremented when the connection 6966 * is done, and also there is no 6967 * reference to the old connection 6968 * limit structure. */ 6969 l->com->tcp_handlers[i]->tcl_addr = 6970 NULL; 6971 } 6972 } 6973 } 6974 l = l->next; 6975 } 6976 } 6977 6978 /** Stop zonemd lookup */ 6979 static void 6980 auth_zone_zonemd_stop_lookup(struct auth_zone* z, struct mesh_area* mesh) 6981 { 6982 struct query_info qinfo; 6983 uint16_t qflags = BIT_RD; 6984 qinfo.qname_len = z->namelen; 6985 qinfo.qname = z->name; 6986 qinfo.qclass = z->dclass; 6987 qinfo.qtype = z->zonemd_callback_qtype; 6988 qinfo.local_alias = NULL; 6989 6990 mesh_remove_callback(mesh, &qinfo, qflags, 6991 &auth_zonemd_dnskey_lookup_callback, z); 6992 } 6993 6994 /** Pick up the auth zone locks. */ 6995 static void 6996 fr_pickup_auth_locks(struct worker* worker, struct auth_zone* namez, 6997 struct auth_zone* old_z, struct auth_zone* new_z, 6998 struct auth_xfer** xfr, struct auth_xfer** loadxfr) 6999 { 7000 uint8_t nm[LDNS_MAX_DOMAINLEN+1]; 7001 size_t nmlen; 7002 uint16_t dclass; 7003 7004 log_assert(namez->namelen <= sizeof(nm)); 7005 lock_rw_rdlock(&namez->lock); 7006 nmlen = namez->namelen; 7007 dclass = namez->dclass; 7008 memmove(nm, namez->name, nmlen); 7009 lock_rw_unlock(&namez->lock); 7010 7011 lock_rw_wrlock(&worker->daemon->fast_reload_thread->old_auth_zones->lock); 7012 lock_rw_wrlock(&worker->env.auth_zones->lock); 7013 if(new_z) { 7014 lock_rw_wrlock(&new_z->lock); 7015 } 7016 if(old_z) { 7017 lock_rw_wrlock(&old_z->lock); 7018 } 7019 if(loadxfr) 7020 *loadxfr = auth_xfer_find(worker->daemon->fast_reload_thread-> 7021 old_auth_zones, nm, nmlen, dclass); 7022 if(xfr) 7023 *xfr = auth_xfer_find(worker->env.auth_zones, nm, nmlen, 7024 dclass); 7025 if(loadxfr && *loadxfr) { 7026 lock_basic_lock(&(*loadxfr)->lock); 7027 } 7028 if(xfr && *xfr) { 7029 lock_basic_lock(&(*xfr)->lock); 7030 } 7031 } 7032 7033 /** Fast reload, worker picks up deleted auth zone */ 7034 static void 7035 fr_worker_auth_del(struct worker* worker, struct fast_reload_auth_change* item, 7036 int for_change) 7037 { 7038 int released = 0; /* Did this routine release callbacks. */ 7039 struct auth_xfer* xfr = NULL; 7040 7041 lock_rw_wrlock(&item->old_z->lock); 7042 if(item->old_z->zonemd_callback_env && 7043 item->old_z->zonemd_callback_env->worker == worker){ 7044 /* This worker was performing a zonemd lookup, 7045 * stop the lookup and remove that entry. */ 7046 auth_zone_zonemd_stop_lookup(item->old_z, worker->env.mesh); 7047 item->old_z->zonemd_callback_env = NULL; 7048 } 7049 lock_rw_unlock(&item->old_z->lock); 7050 7051 fr_pickup_auth_locks(worker, item->old_z, item->old_z, NULL, &xfr, 7052 NULL); 7053 lock_rw_unlock(&worker->daemon->fast_reload_thread->old_auth_zones->lock); 7054 lock_rw_unlock(&worker->env.auth_zones->lock); 7055 lock_rw_unlock(&item->old_z->lock); 7056 if(xfr) { 7057 /* Release callbacks on the xfr, if this worker holds them. */ 7058 if(xfr->task_nextprobe->worker == worker || 7059 xfr->task_probe->worker == worker || 7060 xfr->task_transfer->worker == worker) { 7061 released = 1; 7062 xfr_disown_tasks(xfr, worker); 7063 } 7064 lock_basic_unlock(&xfr->lock); 7065 } 7066 7067 if(!for_change && (released || worker->thread_num == 0)) { 7068 /* See if the xfr item can be deleted. */ 7069 xfr = NULL; 7070 fr_pickup_auth_locks(worker, item->old_z, item->old_z, NULL, 7071 &xfr, NULL); 7072 lock_rw_unlock(&worker->daemon->fast_reload_thread->old_auth_zones->lock); 7073 lock_rw_unlock(&item->old_z->lock); 7074 if(xfr && xfr->task_nextprobe->worker == NULL && 7075 xfr->task_probe->worker == NULL && 7076 xfr->task_transfer->worker == NULL) { 7077 (void)rbtree_delete(&worker->env.auth_zones->xtree, 7078 &xfr->node); 7079 lock_rw_unlock(&worker->env.auth_zones->lock); 7080 lock_basic_unlock(&xfr->lock); 7081 auth_xfer_delete(xfr); 7082 } else { 7083 lock_rw_unlock(&worker->env.auth_zones->lock); 7084 if(xfr) { 7085 lock_basic_unlock(&xfr->lock); 7086 } 7087 } 7088 } 7089 } 7090 7091 /** Fast reload, auth xfer config is picked up */ 7092 static void 7093 auth_xfr_pickup_config(struct auth_xfer* loadxfr, struct auth_xfer* xfr) 7094 { 7095 struct auth_master *probe_masters, *transfer_masters; 7096 log_assert(loadxfr->namelen == xfr->namelen); 7097 log_assert(loadxfr->namelabs == xfr->namelabs); 7098 log_assert(loadxfr->dclass == xfr->dclass); 7099 7100 /* The lists can be swapped in, the other xfr struct will be deleted 7101 * afterwards. */ 7102 probe_masters = xfr->task_probe->masters; 7103 transfer_masters = xfr->task_transfer->masters; 7104 xfr->task_probe->masters = loadxfr->task_probe->masters; 7105 xfr->task_transfer->masters = loadxfr->task_transfer->masters; 7106 loadxfr->task_probe->masters = probe_masters; 7107 loadxfr->task_transfer->masters = transfer_masters; 7108 } 7109 7110 /** Fast reload, worker picks up added auth zone */ 7111 static void 7112 fr_worker_auth_add(struct worker* worker, struct fast_reload_auth_change* item, 7113 int for_change) 7114 { 7115 struct auth_xfer* xfr = NULL, *loadxfr = NULL; 7116 7117 /* Start zone transfers and lookups. */ 7118 fr_pickup_auth_locks(worker, item->new_z, NULL, item->new_z, &xfr, 7119 &loadxfr); 7120 if(xfr == NULL && item->new_z->zone_is_slave) { 7121 /* The xfr item needs to be created. The auth zones lock 7122 * is held to make this possible. */ 7123 xfr = auth_xfer_create(worker->env.auth_zones, item->new_z); 7124 auth_xfr_pickup_config(loadxfr, xfr); 7125 /* Serial information is copied into the xfr struct. */ 7126 if(!xfr_find_soa(item->new_z, xfr)) { 7127 xfr->serial = 0; 7128 } 7129 } else if(for_change && xfr) { 7130 if(!xfr_find_soa(item->new_z, xfr)) { 7131 xfr->serial = 0; 7132 } 7133 } 7134 lock_rw_unlock(&item->new_z->lock); 7135 lock_rw_unlock(&worker->env.auth_zones->lock); 7136 lock_rw_unlock(&worker->daemon->fast_reload_thread->old_auth_zones->lock); 7137 if(loadxfr) { 7138 lock_basic_unlock(&loadxfr->lock); 7139 } 7140 if(xfr) { 7141 auth_xfer_pickup_initial_zone(xfr, &worker->env); 7142 if(for_change) { 7143 xfr->task_probe->only_lookup = 0; 7144 } 7145 lock_basic_unlock(&xfr->lock); 7146 } 7147 7148 /* Perform ZONEMD verification lookups. */ 7149 lock_rw_wrlock(&item->new_z->lock); 7150 /* holding only the new_z lock */ 7151 auth_zone_verify_zonemd(item->new_z, &worker->env, 7152 &worker->env.mesh->mods, NULL, 0, 1); 7153 lock_rw_unlock(&item->new_z->lock); 7154 } 7155 7156 /** Fast reload, worker picks up changed auth zone */ 7157 static void 7158 fr_worker_auth_cha(struct worker* worker, struct fast_reload_auth_change* item) 7159 { 7160 int todelete = 0; 7161 struct auth_xfer* loadxfr = NULL, *xfr = NULL; 7162 /* Since the zone has been changed, by rereading it from zone file, 7163 * existing transfers and probes are likely for the old version. 7164 * Stop them, and start new ones if needed. */ 7165 fr_worker_auth_del(worker, item, 1); 7166 7167 if(worker->thread_num != 0) 7168 return; 7169 7170 /* The old callbacks are stopped, tasks have been disowned. The 7171 * new config contents can be picked up. SOA information is picked 7172 * up in the auth_add routine, as it has the new_z ready. */ 7173 7174 fr_pickup_auth_locks(worker, item->new_z, item->old_z, item->new_z, 7175 &xfr, &loadxfr); 7176 7177 /* The xfr is not there any more if the zone is not set to have 7178 * zone transfers. Or the xfr needs to be created if it is set to 7179 * have zone transfers. */ 7180 if(loadxfr && xfr) { 7181 /* Copy the config from loadxfr to the xfr in current use. */ 7182 auth_xfr_pickup_config(loadxfr, xfr); 7183 } else if(!loadxfr && xfr) { 7184 /* Delete the xfr. */ 7185 (void)rbtree_delete(&worker->env.auth_zones->xtree, 7186 &xfr->node); 7187 todelete = 1; 7188 item->new_z->zone_is_slave = 0; 7189 } else if(loadxfr && !xfr) { 7190 /* Create the xfr. */ 7191 xfr = auth_xfer_create(worker->env.auth_zones, item->new_z); 7192 auth_xfr_pickup_config(loadxfr, xfr); 7193 item->new_z->zone_is_slave = 1; 7194 } 7195 lock_rw_unlock(&item->new_z->lock); 7196 lock_rw_unlock(&item->old_z->lock); 7197 lock_rw_unlock(&worker->daemon->fast_reload_thread->old_auth_zones->lock); 7198 lock_rw_unlock(&worker->env.auth_zones->lock); 7199 if(loadxfr) { 7200 lock_basic_unlock(&loadxfr->lock); 7201 } 7202 if(xfr) { 7203 lock_basic_unlock(&xfr->lock); 7204 } 7205 if(todelete) { 7206 auth_xfer_delete(xfr); 7207 } 7208 7209 fr_worker_auth_add(worker, item, 1); 7210 } 7211 7212 /** Fast reload, the worker picks up changes in auth zones. */ 7213 static void 7214 fr_worker_pickup_auth_changes(struct worker* worker, 7215 struct fast_reload_auth_change* auth_zone_change_list) 7216 { 7217 struct fast_reload_auth_change* item; 7218 for(item = auth_zone_change_list; item; item = item->next) { 7219 if(item->is_deleted) { 7220 fr_worker_auth_del(worker, item, 0); 7221 } 7222 if(item->is_added) { 7223 if(worker->thread_num == 0) { 7224 fr_worker_auth_add(worker, item, 0); 7225 } 7226 } 7227 if(item->is_changed) { 7228 fr_worker_auth_cha(worker, item); 7229 } 7230 } 7231 } 7232 7233 /** Fast reload, the worker picks up changes in outside_network. */ 7234 static void 7235 fr_worker_pickup_outside_network(struct worker* worker) 7236 { 7237 struct outside_network* outnet = worker->back; 7238 struct config_file* cfg = worker->env.cfg; 7239 outnet->use_caps_for_id = cfg->use_caps_bits_for_id; 7240 outnet->unwanted_threshold = cfg->unwanted_threshold; 7241 outnet->tls_use_sni = cfg->tls_use_sni; 7242 outnet->tcp_mss = cfg->outgoing_tcp_mss; 7243 outnet->ip_dscp = cfg->ip_dscp; 7244 outnet->max_reuse_tcp_queries = cfg->max_reuse_tcp_queries; 7245 outnet->tcp_reuse_timeout = cfg->tcp_reuse_timeout; 7246 outnet->tcp_auth_query_timeout = cfg->tcp_auth_query_timeout; 7247 outnet->delayclose = cfg->delay_close; 7248 if(outnet->delayclose) { 7249 #ifndef S_SPLINT_S 7250 outnet->delay_tv.tv_sec = cfg->delay_close/1000; 7251 outnet->delay_tv.tv_usec = (cfg->delay_close%1000)*1000; 7252 #endif 7253 } 7254 } 7255 7256 void 7257 fast_reload_worker_pickup_changes(struct worker* worker) 7258 { 7259 /* The pickup of changes is called when the fast reload has 7260 * a syncronized moment, and all the threads are paused and the 7261 * reload has been applied. Then the worker can pick up the new 7262 * changes and store them in worker-specific structs. 7263 * The pickup is also called when there is no pause, and then 7264 * it is called after the reload has completed, and the worker 7265 * get a signal to release old information, it can then pick 7266 * up the new information. But in the mean time, the reload has 7267 * swapped in trees, and the worker has been running with the 7268 * older information for some time. */ 7269 fr_worker_pickup_mesh(worker); 7270 7271 /* If the tcp connection limit has changed, the open connections 7272 * need to remove their reference for the old tcp limits counters. */ 7273 if(worker->daemon->fast_reload_tcl_has_changes) 7274 tcl_remove_old(worker->front); 7275 7276 /* If there are zonemd lookups, but the zone was deleted, the 7277 * lookups should be cancelled. */ 7278 fr_worker_pickup_auth_changes(worker, 7279 worker->daemon->fast_reload_thread->auth_zone_change_list); 7280 #ifdef USE_CACHEDB 7281 worker->env.cachedb_enabled = worker->daemon->env->cachedb_enabled; 7282 #endif 7283 fr_worker_pickup_outside_network(worker); 7284 } 7285 7286 /** fast reload thread, handle reload_stop notification, send reload stop 7287 * to other threads over IPC and collect their ack. When that is done, 7288 * ack to the caller, the fast reload thread, and wait for it to send start. */ 7289 static void 7290 fr_main_perform_reload_stop(struct fast_reload_thread* fr) 7291 { 7292 struct daemon* daemon = fr->worker->daemon; 7293 int i; 7294 7295 /* Send reload_stop to other threads. */ 7296 for(i=0; i<daemon->num; i++) { 7297 if(i == fr->worker->thread_num) 7298 continue; /* Do not send to ourselves. */ 7299 worker_send_cmd(daemon->workers[i], worker_cmd_reload_stop); 7300 } 7301 7302 /* Wait for the other threads to ack. */ 7303 fr_read_ack_from_workers(fr); 7304 7305 /* Send ack to fast reload thread. */ 7306 fr_send_cmd_to(fr, fast_reload_notification_reload_ack, 0, 1); 7307 7308 /* Wait for reload_start from fast reload thread to resume. */ 7309 fr_poll_for_reload_start(fr); 7310 7311 /* Send reload_start to other threads */ 7312 for(i=0; i<daemon->num; i++) { 7313 if(i == fr->worker->thread_num) 7314 continue; /* Do not send to ourselves. */ 7315 worker_send_cmd(daemon->workers[i], worker_cmd_reload_start); 7316 } 7317 7318 /* Pick up changes for this worker. */ 7319 if(fr->worker->daemon->fast_reload_drop_mesh) { 7320 verbose(VERB_ALGO, "worker: drop mesh queries after reload"); 7321 mesh_delete_all(fr->worker->env.mesh); 7322 } 7323 fast_reload_worker_pickup_changes(fr->worker); 7324 7325 /* Wait for the other threads to ack. */ 7326 fr_read_ack_from_workers(fr); 7327 7328 /* Send ack to fast reload thread. */ 7329 fr_send_cmd_to(fr, fast_reload_notification_reload_ack, 0, 1); 7330 7331 verbose(VERB_ALGO, "worker resume after reload"); 7332 } 7333 7334 /** Fast reload, the main thread performs the nopause poll. It polls every 7335 * other worker thread briefly over the command pipe ipc. The command takes 7336 * no time for the worker, it can return immediately. After that it sends 7337 * an acknowledgement to the fastreload thread. */ 7338 static void 7339 fr_main_perform_reload_nopause_poll(struct fast_reload_thread* fr) 7340 { 7341 struct daemon* daemon = fr->worker->daemon; 7342 int i; 7343 7344 /* Send the reload_poll to other threads. They can respond 7345 * one at a time. */ 7346 for(i=0; i<daemon->num; i++) { 7347 if(i == fr->worker->thread_num) 7348 continue; /* Do not send to ourselves. */ 7349 worker_send_cmd(daemon->workers[i], worker_cmd_reload_poll); 7350 } 7351 7352 /* Wait for the other threads to ack. */ 7353 fr_read_ack_from_workers(fr); 7354 fast_reload_worker_pickup_changes(fr->worker); 7355 7356 /* Send ack to fast reload thread. */ 7357 fr_send_cmd_to(fr, fast_reload_notification_reload_ack, 0, 1); 7358 } 7359 7360 /** Fast reload, perform the command received from the fast reload thread */ 7361 static void 7362 fr_main_perform_cmd(struct fast_reload_thread* fr, 7363 enum fast_reload_notification status) 7364 { 7365 verbose(VERB_ALGO, "main perform fast reload status: %s", 7366 fr_notification_to_string(status)); 7367 if(status == fast_reload_notification_printout) { 7368 fr_main_perform_printout(fr); 7369 } else if(status == fast_reload_notification_done || 7370 status == fast_reload_notification_done_error || 7371 status == fast_reload_notification_exited) { 7372 fr_main_perform_done(fr); 7373 } else if(status == fast_reload_notification_reload_stop) { 7374 fr_main_perform_reload_stop(fr); 7375 } else if(status == fast_reload_notification_reload_nopause_poll) { 7376 fr_main_perform_reload_nopause_poll(fr); 7377 } else { 7378 log_err("main received unknown status from fast reload: %d %s", 7379 (int)status, fr_notification_to_string(status)); 7380 } 7381 } 7382 7383 /** Fast reload, handle command from fast reload to the main thread. */ 7384 static void 7385 fr_main_handle_cmd(struct fast_reload_thread* fr) 7386 { 7387 enum fast_reload_notification status; 7388 ssize_t ret; 7389 /* keep static analyzer happy; recv(-1,..) */ 7390 log_assert(fr->commpair[0] >= 0); 7391 ret = recv(fr->commpair[0], 7392 ((char*)&fr->service_read_cmd)+fr->service_read_cmd_count, 7393 sizeof(fr->service_read_cmd)-fr->service_read_cmd_count, 0); 7394 if(ret == -1) { 7395 if( 7396 #ifndef USE_WINSOCK 7397 errno == EINTR || errno == EAGAIN 7398 # ifdef EWOULDBLOCK 7399 || errno == EWOULDBLOCK 7400 # endif 7401 #else 7402 WSAGetLastError() == WSAEINTR || 7403 WSAGetLastError() == WSAEINPROGRESS 7404 #endif 7405 ) 7406 return; /* Continue later. */ 7407 #ifdef USE_WINSOCK 7408 if(WSAGetLastError() == WSAEWOULDBLOCK) { 7409 ub_winsock_tcp_wouldblock(fr->service_event, 7410 UB_EV_READ); 7411 return; /* Continue later. */ 7412 } 7413 #endif 7414 log_err("read cmd from fast reload thread, recv: %s", 7415 sock_strerror(errno)); 7416 return; 7417 } else if(ret == 0) { 7418 verbose(VERB_ALGO, "closed connection from fast reload thread"); 7419 fr->service_read_cmd_count = 0; 7420 /* handle this like an error */ 7421 fr->service_read_cmd = fast_reload_notification_done_error; 7422 } else if(ret + (ssize_t)fr->service_read_cmd_count < 7423 (ssize_t)sizeof(fr->service_read_cmd)) { 7424 fr->service_read_cmd_count += ret; 7425 /* Continue later. */ 7426 return; 7427 } 7428 status = fr->service_read_cmd; 7429 fr->service_read_cmd = 0; 7430 fr->service_read_cmd_count = 0; 7431 fr_main_perform_cmd(fr, status); 7432 } 7433 7434 /** Fast reload, poll for and handle cmd from fast reload thread. */ 7435 static void 7436 fr_check_cmd_from_thread(struct fast_reload_thread* fr) 7437 { 7438 int inevent = 0; 7439 struct worker* worker = fr->worker; 7440 /* Stop in case the thread has exited, or there is no read event. */ 7441 while(worker->daemon->fast_reload_thread) { 7442 if(!sock_poll_timeout(fr->commpair[0], 0, 1, 0, &inevent)) { 7443 log_err("check for cmd from fast reload thread: " 7444 "poll failed"); 7445 #ifdef USE_WINSOCK 7446 if(worker->daemon->fast_reload_thread) 7447 ub_winsock_tcp_wouldblock(worker->daemon-> 7448 fast_reload_thread->service_event, 7449 UB_EV_READ); 7450 #endif 7451 return; 7452 } 7453 if(!inevent) { 7454 #ifdef USE_WINSOCK 7455 if(worker->daemon->fast_reload_thread) 7456 ub_winsock_tcp_wouldblock(worker->daemon-> 7457 fast_reload_thread->service_event, 7458 UB_EV_READ); 7459 #endif 7460 return; 7461 } 7462 fr_main_handle_cmd(fr); 7463 } 7464 } 7465 7466 void fast_reload_service_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), 7467 void* arg) 7468 { 7469 struct fast_reload_thread* fast_reload_thread = 7470 (struct fast_reload_thread*)arg; 7471 struct worker* worker = fast_reload_thread->worker; 7472 7473 /* Read and handle the command */ 7474 fr_main_handle_cmd(fast_reload_thread); 7475 if(worker->daemon->fast_reload_thread != NULL) { 7476 /* If not exited, see if there are more pending statuses 7477 * from the fast reload thread. */ 7478 fr_check_cmd_from_thread(fast_reload_thread); 7479 } 7480 } 7481 7482 #ifdef HAVE_SSL 7483 /** fast reload, send client item over SSL. Returns number of bytes 7484 * printed, 0 on wait later, or -1 on failure. */ 7485 static int 7486 fr_client_send_item_ssl(struct fast_reload_printq* printq) 7487 { 7488 int r; 7489 ERR_clear_error(); 7490 r = SSL_write(printq->remote.ssl, 7491 printq->client_item+printq->client_byte_count, 7492 printq->client_len - printq->client_byte_count); 7493 if(r <= 0) { 7494 int want = SSL_get_error(printq->remote.ssl, r); 7495 if(want == SSL_ERROR_ZERO_RETURN) { 7496 log_err("fast_reload print to remote client: " 7497 "SSL_write says connection closed."); 7498 return -1; 7499 } else if(want == SSL_ERROR_WANT_READ) { 7500 /* wait for read condition */ 7501 printq->client_cp->ssl_shake_state = comm_ssl_shake_hs_read; 7502 comm_point_listen_for_rw(printq->client_cp, 1, 0); 7503 return 0; 7504 } else if(want == SSL_ERROR_WANT_WRITE) { 7505 #ifdef USE_WINSOCK 7506 ub_winsock_tcp_wouldblock(comm_point_internal(printq->client_cp), UB_EV_WRITE); 7507 #endif 7508 return 0; /* write more later */ 7509 } else if(want == SSL_ERROR_SYSCALL) { 7510 #ifdef EPIPE 7511 if(errno == EPIPE && verbosity < 2) { 7512 /* silence 'broken pipe' */ 7513 return -1; 7514 } 7515 #endif 7516 if(errno != 0) 7517 log_err("fast_reload print to remote client: " 7518 "SSL_write syscall: %s", 7519 sock_strerror(errno)); 7520 return -1; 7521 } 7522 log_crypto_err_io("fast_reload print to remote client: " 7523 "could not SSL_write", want); 7524 return -1; 7525 } 7526 return r; 7527 } 7528 #endif /* HAVE_SSL */ 7529 7530 /** fast reload, send client item for fd, returns bytes sent, or 0 for wait 7531 * later, or -1 on failure. */ 7532 static int 7533 fr_client_send_item_fd(struct fast_reload_printq* printq) 7534 { 7535 int r; 7536 r = (int)send(printq->remote.fd, 7537 printq->client_item+printq->client_byte_count, 7538 printq->client_len - printq->client_byte_count, 0); 7539 if(r == -1) { 7540 if( 7541 #ifndef USE_WINSOCK 7542 errno == EINTR || errno == EAGAIN 7543 # ifdef EWOULDBLOCK 7544 || errno == EWOULDBLOCK 7545 # endif 7546 #else 7547 WSAGetLastError() == WSAEINTR || 7548 WSAGetLastError() == WSAEINPROGRESS || 7549 WSAGetLastError() == WSAEWOULDBLOCK 7550 #endif 7551 ) { 7552 #ifdef USE_WINSOCK 7553 ub_winsock_tcp_wouldblock(comm_point_internal(printq->client_cp), UB_EV_WRITE); 7554 #endif 7555 return 0; /* Try again. */ 7556 } 7557 log_err("fast_reload print to remote client: send failed: %s", 7558 sock_strerror(errno)); 7559 return -1; 7560 } 7561 return r; 7562 } 7563 7564 /** fast reload, send current client item. false on failure or wait later. */ 7565 static int 7566 fr_client_send_item(struct fast_reload_printq* printq) 7567 { 7568 int r; 7569 #ifdef HAVE_SSL 7570 if(printq->remote.ssl) { 7571 r = fr_client_send_item_ssl(printq); 7572 } else { 7573 #endif 7574 r = fr_client_send_item_fd(printq); 7575 #ifdef HAVE_SSL 7576 } 7577 #endif 7578 if(r == 0) { 7579 /* Wait for later. */ 7580 return 0; 7581 } else if(r == -1) { 7582 /* It failed, close comm point and stop sending. */ 7583 fr_printq_remove(printq); 7584 return 0; 7585 } 7586 printq->client_byte_count += r; 7587 if(printq->client_byte_count < printq->client_len) 7588 return 0; /* Print more later. */ 7589 return 1; 7590 } 7591 7592 /** fast reload, pick up the next item to print */ 7593 static void 7594 fr_client_pickup_next_item(struct fast_reload_printq* printq) 7595 { 7596 struct config_strlist* item; 7597 /* Pop first off the list. */ 7598 if(!printq->to_print->first) { 7599 printq->client_item = NULL; 7600 printq->client_len = 0; 7601 printq->client_byte_count = 0; 7602 return; 7603 } 7604 item = printq->to_print->first; 7605 if(item->next) { 7606 printq->to_print->first = item->next; 7607 } else { 7608 printq->to_print->first = NULL; 7609 printq->to_print->last = NULL; 7610 } 7611 item->next = NULL; 7612 printq->client_len = 0; 7613 printq->client_byte_count = 0; 7614 printq->client_item = item->str; 7615 item->str = NULL; 7616 free(item); 7617 /* The len is the number of bytes to print out, and thus excludes 7618 * the terminator zero. */ 7619 if(printq->client_item) 7620 printq->client_len = (int)strlen(printq->client_item); 7621 } 7622 7623 int fast_reload_client_callback(struct comm_point* ATTR_UNUSED(c), void* arg, 7624 int err, struct comm_reply* ATTR_UNUSED(rep)) 7625 { 7626 struct fast_reload_printq* printq = (struct fast_reload_printq*)arg; 7627 if(!printq->client_cp) { 7628 fr_printq_remove(printq); 7629 return 0; /* the output is closed and deleted */ 7630 } 7631 if(err != NETEVENT_NOERROR) { 7632 verbose(VERB_ALGO, "fast reload client: error, close it"); 7633 fr_printq_remove(printq); 7634 return 0; 7635 } 7636 #ifdef HAVE_SSL 7637 if(printq->client_cp->ssl_shake_state == comm_ssl_shake_hs_read) { 7638 /* read condition satisfied back to writing */ 7639 comm_point_listen_for_rw(printq->client_cp, 0, 1); 7640 printq->client_cp->ssl_shake_state = comm_ssl_shake_none; 7641 } 7642 #endif /* HAVE_SSL */ 7643 7644 /* Pickup an item if there are none */ 7645 if(!printq->client_item) { 7646 fr_client_pickup_next_item(printq); 7647 } 7648 if(!printq->client_item) { 7649 if(printq->in_list) { 7650 /* Nothing more to print, it can be removed. */ 7651 fr_printq_remove(printq); 7652 return 0; 7653 } 7654 /* Done with printing for now. */ 7655 comm_point_stop_listening(printq->client_cp); 7656 return 0; 7657 } 7658 7659 /* Try to print out a number of items, if they can print in full. */ 7660 while(printq->client_item) { 7661 /* Send current item, if any. */ 7662 if(printq->client_item && printq->client_len != 0 && 7663 printq->client_byte_count < printq->client_len) { 7664 if(!fr_client_send_item(printq)) 7665 return 0; 7666 } 7667 7668 /* The current item is done. */ 7669 if(printq->client_item) { 7670 free(printq->client_item); 7671 printq->client_item = NULL; 7672 printq->client_len = 0; 7673 printq->client_byte_count = 0; 7674 } 7675 if(!printq->to_print->first) { 7676 if(printq->in_list) { 7677 /* Nothing more to print, it can be removed. */ 7678 fr_printq_remove(printq); 7679 return 0; 7680 } 7681 /* Done with printing for now. */ 7682 comm_point_stop_listening(printq->client_cp); 7683 return 0; 7684 } 7685 fr_client_pickup_next_item(printq); 7686 } 7687 7688 return 0; 7689 } 7690 7691 #ifndef THREADS_DISABLED 7692 /** fast reload printq create */ 7693 static struct fast_reload_printq* 7694 fr_printq_create(struct comm_point* c, struct worker* worker) 7695 { 7696 struct fast_reload_printq* printq = calloc(1, sizeof(*printq)); 7697 if(!printq) 7698 return NULL; 7699 printq->to_print = calloc(1, sizeof(*printq->to_print)); 7700 if(!printq->to_print) { 7701 free(printq); 7702 return NULL; 7703 } 7704 printq->worker = worker; 7705 printq->client_cp = c; 7706 printq->client_cp->callback = fast_reload_client_callback; 7707 printq->client_cp->cb_arg = printq; 7708 return printq; 7709 } 7710 #endif /* !THREADS_DISABLED */ 7711 7712 /** fast reload printq delete */ 7713 static void 7714 fr_printq_delete(struct fast_reload_printq* printq) 7715 { 7716 if(!printq) 7717 return; 7718 #ifdef HAVE_SSL 7719 if(printq->remote.ssl) { 7720 SSL_shutdown(printq->remote.ssl); 7721 SSL_free(printq->remote.ssl); 7722 } 7723 #endif 7724 comm_point_delete(printq->client_cp); 7725 if(printq->to_print) { 7726 config_delstrlist(printq->to_print->first); 7727 free(printq->to_print); 7728 } 7729 free(printq); 7730 } 7731 7732 /** fast reload printq, returns true if the list is empty and no item */ 7733 static int 7734 fr_printq_empty(struct fast_reload_printq* printq) 7735 { 7736 if(printq->to_print->first == NULL && printq->client_item == NULL) 7737 return 1; 7738 return 0; 7739 } 7740 7741 /** fast reload printq, insert onto list */ 7742 static void 7743 fr_printq_list_insert(struct fast_reload_printq* printq, struct daemon* daemon) 7744 { 7745 if(printq->in_list) 7746 return; 7747 printq->next = daemon->fast_reload_printq_list; 7748 if(printq->next) 7749 printq->next->prev = printq; 7750 printq->prev = NULL; 7751 printq->in_list = 1; 7752 daemon->fast_reload_printq_list = printq; 7753 } 7754 7755 /** fast reload printq delete list */ 7756 void 7757 fast_reload_printq_list_delete(struct fast_reload_printq* list) 7758 { 7759 struct fast_reload_printq* printq = list, *next; 7760 while(printq) { 7761 next = printq->next; 7762 fr_printq_delete(printq); 7763 printq = next; 7764 } 7765 } 7766 7767 /** fast reload printq remove the item from the printq list */ 7768 static void 7769 fr_printq_list_remove(struct fast_reload_printq* printq) 7770 { 7771 struct daemon* daemon = printq->worker->daemon; 7772 if(printq->prev == NULL) 7773 daemon->fast_reload_printq_list = printq->next; 7774 else printq->prev->next = printq->next; 7775 if(printq->next) 7776 printq->next->prev = printq->prev; 7777 printq->in_list = 0; 7778 } 7779 7780 /** fast reload printq, remove the printq when no longer needed, 7781 * like the stream is closed. */ 7782 static void 7783 fr_printq_remove(struct fast_reload_printq* printq) 7784 { 7785 if(!printq) 7786 return; 7787 if(printq->worker->daemon->fast_reload_thread && 7788 printq->worker->daemon->fast_reload_thread->printq == printq) 7789 printq->worker->daemon->fast_reload_thread->printq = NULL; 7790 if(printq->in_list) 7791 fr_printq_list_remove(printq); 7792 fr_printq_delete(printq); 7793 } 7794 7795 /** fast reload thread, send stop command to the thread, from the main thread. 7796 */ 7797 static void 7798 fr_send_stop(struct fast_reload_thread* fr) 7799 { 7800 fr_send_cmd_to(fr, fast_reload_notification_exit, 1, 0); 7801 } 7802 7803 void 7804 fast_reload_thread_start(RES* ssl, struct worker* worker, struct rc_state* s, 7805 int fr_verb, int fr_nopause, int fr_drop_mesh) 7806 { 7807 if(worker->daemon->fast_reload_thread) { 7808 log_err("fast reload thread already running"); 7809 return; 7810 } 7811 if(!fast_reload_thread_setup(worker, fr_verb, fr_nopause, 7812 fr_drop_mesh)) { 7813 if(!ssl_printf(ssl, "error could not setup thread\n")) 7814 return; 7815 return; 7816 } 7817 worker->daemon->fast_reload_thread->started = 1; 7818 7819 #ifndef THREADS_DISABLED 7820 /* Setup command listener in remote servicing thread */ 7821 /* The listener has to be nonblocking, so the the remote servicing 7822 * thread can continue to service DNS queries, the fast reload 7823 * thread is going to read the config from disk and apply it. */ 7824 /* The commpair[1] element can stay blocking, it is used by the 7825 * fast reload thread to communicate back. The thread needs to wait 7826 * at these times, when it has to check briefly it can use poll. */ 7827 fd_set_nonblock(worker->daemon->fast_reload_thread->commpair[0]); 7828 worker->daemon->fast_reload_thread->service_event = ub_event_new( 7829 comm_base_internal(worker->base), 7830 worker->daemon->fast_reload_thread->commpair[0], 7831 UB_EV_READ | UB_EV_PERSIST, fast_reload_service_cb, 7832 worker->daemon->fast_reload_thread); 7833 if(!worker->daemon->fast_reload_thread->service_event) { 7834 fast_reload_thread_desetup(worker->daemon->fast_reload_thread); 7835 if(!ssl_printf(ssl, "error out of memory\n")) 7836 return; 7837 return; 7838 } 7839 if(ub_event_add(worker->daemon->fast_reload_thread->service_event, 7840 NULL) != 0) { 7841 fast_reload_thread_desetup(worker->daemon->fast_reload_thread); 7842 if(!ssl_printf(ssl, "error out of memory adding service event\n")) 7843 return; 7844 return; 7845 } 7846 worker->daemon->fast_reload_thread->service_event_is_added = 1; 7847 7848 /* Setup the comm point to the remote control client as an event 7849 * on the remote servicing thread, which it already is. 7850 * It needs a new callback to service it. */ 7851 log_assert(s); 7852 state_list_remove_elem(&s->rc->busy_list, s->c); 7853 s->rc->active --; 7854 /* Set the comm point file descriptor to nonblocking. So that 7855 * printout to the remote control client does not block the 7856 * server thread from servicing DNS queries. */ 7857 fd_set_nonblock(s->c->fd); 7858 worker->daemon->fast_reload_thread->printq = fr_printq_create(s->c, 7859 worker); 7860 if(!worker->daemon->fast_reload_thread->printq) { 7861 fast_reload_thread_desetup(worker->daemon->fast_reload_thread); 7862 if(!ssl_printf(ssl, "error out of memory create printq\n")) 7863 return; 7864 return; 7865 } 7866 worker->daemon->fast_reload_thread->printq->remote = *ssl; 7867 s->rc = NULL; /* move away the rc state */ 7868 /* Nothing to print right now, so no need to have it active. */ 7869 comm_point_stop_listening(worker->daemon->fast_reload_thread->printq->client_cp); 7870 7871 /* Start fast reload thread */ 7872 ub_thread_create(&worker->daemon->fast_reload_thread->tid, 7873 fast_reload_thread_main, worker->daemon->fast_reload_thread); 7874 #else 7875 (void)s; 7876 #endif 7877 } 7878 7879 void 7880 fast_reload_thread_stop(struct fast_reload_thread* fast_reload_thread) 7881 { 7882 struct worker* worker = fast_reload_thread->worker; 7883 if(!fast_reload_thread) 7884 return; 7885 fr_send_stop(fast_reload_thread); 7886 if(worker->daemon->fast_reload_thread != NULL) { 7887 /* If it did not exit yet, join with the thread now. It is 7888 * going to exit because the exit command is sent to it. */ 7889 fr_main_perform_done(fast_reload_thread); 7890 } 7891 } 7892