1 /* 2 * iterator/iter_utils.h - iterative resolver module utility functions. 3 * 4 * Copyright (c) 2007, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains functions to assist the iterator module. 40 * Configuration options. Forward zones. 41 */ 42 43 #ifndef ITERATOR_ITER_UTILS_H 44 #define ITERATOR_ITER_UTILS_H 45 #include "iterator/iter_resptype.h" 46 struct sldns_buffer; 47 struct iter_env; 48 struct iter_hints; 49 struct iter_forwards; 50 struct config_file; 51 struct module_env; 52 struct delegpt_addr; 53 struct delegpt; 54 struct regional; 55 struct msg_parse; 56 struct ub_randstate; 57 struct query_info; 58 struct reply_info; 59 struct module_qstate; 60 struct sock_list; 61 struct ub_packed_rrset_key; 62 struct module_stack; 63 struct outside_network; 64 struct iter_nat64; 65 66 /* max number of lookups in the cache for target nameserver names. 67 * This stops, for large delegations, N*N lookups in the cache. */ 68 #define ITERATOR_NAME_CACHELOOKUP_MAX 3 69 /* max number of lookups in the cache for parentside glue for nameserver names 70 * This stops, for larger delegations, N*N lookups in the cache. 71 * It is a little larger than the nonpside max, so it allows a couple extra 72 * lookups of parent side glue. */ 73 #define ITERATOR_NAME_CACHELOOKUP_MAX_PSIDE 5 74 75 /** 76 * Process config options and set iterator module state. 77 * Sets default values if no config is found. 78 * @param iter_env: iterator module state. 79 * @param cfg: config options. 80 * @return 0 on error. 81 */ 82 int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg); 83 84 /** 85 * Select a valid, nice target to send query to. 86 * Sorting and removing unsuitable targets is combined. 87 * Adds records to the infra cache if not already there. 88 * 89 * @param iter_env: iterator module global state, with ip6 enabled and 90 * do-not-query-addresses. 91 * @param env: environment with infra cache (lameness, rtt info). 92 * @param dp: delegation point with result list. 93 * @param name: zone name (for lameness check). 94 * @param namelen: length of name. 95 * @param qtype: query type that we want to send. 96 * @param dnssec_lame: set to 1, if a known dnssec-lame server is selected 97 * these are not preferred, but are used as a last resort. 98 * @param chase_to_rd: set to 1 if a known recursion lame server is selected 99 * these are not preferred, but are used as a last resort. 100 * @param open_target: number of currently outstanding target queries. 101 * If we wait for these, perhaps more server addresses become available. 102 * @param blacklist: the IP blacklist to use. 103 * @param prefetch: if not 0, prefetch is in use for this query. 104 * This means the query can have different timing, because prefetch is 105 * not waited upon by the downstream client, and thus a good time to 106 * perform exploration of other targets. 107 * @return best target or NULL if no target. 108 * if not null, that target is removed from the result list in the dp. 109 */ 110 struct delegpt_addr* iter_server_selection(struct iter_env* iter_env, 111 struct module_env* env, struct delegpt* dp, uint8_t* name, 112 size_t namelen, uint16_t qtype, int* dnssec_lame, 113 int* chase_to_rd, int open_target, struct sock_list* blacklist, 114 time_t prefetch); 115 116 /** 117 * Allocate dns_msg from parsed msg, in regional. 118 * @param pkt: packet. 119 * @param msg: parsed message (cleaned and ready for regional allocation). 120 * @param regional: regional to use for allocation. 121 * @return newly allocated dns_msg, or NULL on memory error. 122 */ 123 struct dns_msg* dns_alloc_msg(struct sldns_buffer* pkt, struct msg_parse* msg, 124 struct regional* regional); 125 126 /** 127 * Copy a dns_msg to this regional. 128 * @param from: dns message, also in regional. 129 * @param regional: regional to use for allocation. 130 * @return newly allocated dns_msg, or NULL on memory error. 131 */ 132 struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional); 133 134 /** 135 * Allocate a dns_msg with malloc/alloc structure and store in dns cache. 136 * @param env: environment, with alloc structure and dns cache. 137 * @param qinf: query info, the query for which answer is stored. 138 * @param rep: reply in dns_msg from dns_alloc_msg for example. 139 * @param is_referral: If true, then the given message to be stored is a 140 * referral. The cache implementation may use this as a hint. 141 * @param leeway: prefetch TTL leeway to expire old rrsets quicker. 142 * @param pside: true if dp is parentside, thus message is 'fresh' and NS 143 * can be prefetch-updates. 144 * @param region: to copy modified (cache is better) rrs back to. 145 * @param flags: with BIT_CD for dns64 AAAA translated queries. 146 * @param qstarttime: time of query start. 147 * @param is_valrec: if the query is validation recursion and does not get 148 * return void, because we are not interested in alloc errors, 149 * the iterator and validator can operate on the results in their 150 * scratch space (the qstate.region) and are not dependent on the cache. 151 * It is useful to log the alloc failure (for the server operator), 152 * but the query resolution can continue without cache storage. 153 */ 154 void iter_dns_store(struct module_env* env, struct query_info* qinf, 155 struct reply_info* rep, int is_referral, time_t leeway, int pside, 156 struct regional* region, uint16_t flags, time_t qstarttime, 157 int is_valrec); 158 159 /** 160 * Select randomly with n/m probability. 161 * For shuffle NS records for address fetching. 162 * @param rnd: random table 163 * @param n: probability. 164 * @param m: divisor for probability. 165 * @return true with n/m probability. 166 */ 167 int iter_ns_probability(struct ub_randstate* rnd, int n, int m); 168 169 /** 170 * Mark targets that result in a dependency cycle as done, so they 171 * will not get selected as targets. 172 * @param qstate: query state. 173 * @param dp: delegpt to mark ns in. 174 */ 175 void iter_mark_cycle_targets(struct module_qstate* qstate, struct delegpt* dp); 176 177 /** 178 * Mark targets that result in a dependency cycle as done, so they 179 * will not get selected as targets. For the parent-side lookups. 180 * @param qstate: query state. 181 * @param dp: delegpt to mark ns in. 182 */ 183 void iter_mark_pside_cycle_targets(struct module_qstate* qstate, 184 struct delegpt* dp); 185 186 /** 187 * See if delegation is useful or offers immediately no targets for 188 * further recursion. 189 * @param qinfo: query name and type 190 * @param qflags: query flags with RD flag 191 * @param dp: delegpt to check. 192 * @param supports_ipv4: if we support ipv4 for lookups to the target. 193 * if not, then the IPv4 addresses are useless. 194 * @param supports_ipv6: if we support ipv6 for lookups to the target. 195 * if not, then the IPv6 addresses are useless. 196 * @param use_nat64: if we support NAT64 for lookups to the target. 197 * if yes, IPv4 addresses are useful even if we don't support IPv4. 198 * @return true if dp is useless. 199 */ 200 int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, 201 struct delegpt* dp, int supports_ipv4, int supports_ipv6, 202 int use_nat64); 203 204 /** 205 * See if qname has DNSSEC needs. This is true if there is a trust anchor above 206 * it. Whether there is an insecure delegation to the data is unknown. 207 * @param env: environment with anchors. 208 * @param qinfo: query name and class. 209 * @return true if trust anchor above qname, false if no anchor or insecure 210 * point above qname. 211 */ 212 int iter_qname_indicates_dnssec(struct module_env* env, 213 struct query_info *qinfo); 214 215 /** 216 * See if delegation is expected to have DNSSEC information (RRSIGs) in 217 * its answers, or not. Inspects delegation point (name), trust anchors, 218 * and delegation message (DS RRset) to determine this. 219 * @param env: module env with trust anchors. 220 * @param dp: delegation point. 221 * @param msg: delegation message, with DS if a secure referral. 222 * @param dclass: class of query. 223 * @return 1 if dnssec is expected, 0 if not or insecure point above qname. 224 */ 225 int iter_indicates_dnssec(struct module_env* env, struct delegpt* dp, 226 struct dns_msg* msg, uint16_t dclass); 227 228 /** 229 * See if a message contains DNSSEC. 230 * This is examined by looking for RRSIGs. With DNSSEC a valid answer, 231 * nxdomain, nodata, referral or cname reply has RRSIGs in answer or auth 232 * sections, sigs on answer data, SOA, DS, or NSEC/NSEC3 records. 233 * @param msg: message to examine. 234 * @return true if DNSSEC information was found. 235 */ 236 int iter_msg_has_dnssec(struct dns_msg* msg); 237 238 /** 239 * See if a message is known to be from a certain zone. 240 * This looks for SOA or NS rrsets, for answers. 241 * For referrals, when one label is delegated, the zone is detected. 242 * Does not look at signatures. 243 * @param msg: the message to inspect. 244 * @param dp: delegation point with zone name to look for. 245 * @param type: type of message. 246 * @param dclass: class of query. 247 * @return true if message is certain to be from zone in dp->name. 248 * false if not sure (empty msg), or not from the zone. 249 */ 250 int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp, 251 enum response_type type, uint16_t dclass); 252 253 /** 254 * Check if two replies are equal 255 * For fallback procedures 256 * @param p: reply one. The reply has rrset data pointers in region. 257 * Does not check rrset-IDs 258 * @param q: reply two 259 * @param region: scratch buffer. 260 * @return if one and two are equal. 261 */ 262 int reply_equal(struct reply_info* p, struct reply_info* q, struct regional* region); 263 264 /** 265 * Remove unused bits from the reply if possible. 266 * So that caps-for-id (0x20) fallback is more likely to be successful. 267 * This removes like, the additional section, and NS record in the authority 268 * section if those records are gratuitous (not for a referral). 269 * @param rep: the reply to strip stuff out of. 270 */ 271 void caps_strip_reply(struct reply_info* rep); 272 273 /** 274 * see if reply has a 'useful' rcode for capsforid comparison, so 275 * not SERVFAIL or REFUSED, and thus NOERROR or NXDOMAIN. 276 * @param rep: reply to check. 277 * @return true if the rcode is a bad type of message. 278 */ 279 int caps_failed_rcode(struct reply_info* rep); 280 281 /** 282 * Store parent-side rrset in separate rrset cache entries for later 283 * last-resort * lookups in case the child-side versions of this information 284 * fails. 285 * @param env: environment with cache, time, ... 286 * @param rrset: the rrset to store (copied). 287 * Failure to store is logged, but otherwise ignored. 288 */ 289 void iter_store_parentside_rrset(struct module_env* env, 290 struct ub_packed_rrset_key* rrset); 291 292 /** 293 * Store parent-side NS records from a referral message 294 * @param env: environment with cache, time, ... 295 * @param rep: response with NS rrset. 296 * Failure to store is logged, but otherwise ignored. 297 */ 298 void iter_store_parentside_NS(struct module_env* env, struct reply_info* rep); 299 300 /** 301 * Store parent-side negative element, the parentside rrset does not exist, 302 * creates an rrset with empty rdata in the rrset cache with PARENTSIDE flag. 303 * @param env: environment with cache, time, ... 304 * @param qinfo: the identity of the rrset that is missing. 305 * @param rep: delegation response or answer response, to glean TTL from. 306 * (malloc) failure is logged but otherwise ignored. 307 */ 308 void iter_store_parentside_neg(struct module_env* env, 309 struct query_info* qinfo, struct reply_info* rep); 310 311 /** 312 * Add parent NS record if that exists in the cache. This is both new 313 * information and acts like a timeout throttle on retries. 314 * @param env: query env with rrset cache and time. 315 * @param dp: delegation point to store result in. Also this dp is used to 316 * see which NS name is needed. 317 * @param region: region to alloc result in. 318 * @param qinfo: pertinent information, the qclass. 319 * @return false on malloc failure. 320 * if true, the routine worked and if such cached information 321 * existed dp->has_parent_side_NS is set true. 322 */ 323 int iter_lookup_parent_NS_from_cache(struct module_env* env, 324 struct delegpt* dp, struct regional* region, struct query_info* qinfo); 325 326 /** 327 * Add parent-side glue if that exists in the cache. This is both new 328 * information and acts like a timeout throttle on retries to fetch them. 329 * @param env: query env with rrset cache and time. 330 * @param dp: delegation point to store result in. Also this dp is used to 331 * see which NS name is needed. 332 * @param region: region to alloc result in. 333 * @param qinfo: pertinent information, the qclass. 334 * @return: true, it worked, no malloc failures, and new addresses (lame) 335 * have been added, giving extra options as query targets. 336 */ 337 int iter_lookup_parent_glue_from_cache(struct module_env* env, 338 struct delegpt* dp, struct regional* region, struct query_info* qinfo); 339 340 /** 341 * Lookup next root-hint or root-forward entry. 342 * @param hints: the hints. 343 * @param fwd: the forwards. 344 * @param c: the class to start searching at. 0 means find first one. 345 * @return false if no classes found, true if found and returned in c. 346 */ 347 int iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd, 348 uint16_t* c); 349 350 /** 351 * Remove DS records that are inappropriate before they are cached. 352 * @param msg: the response to scrub. 353 * @param ns: RRSET that is the NS record for the referral. 354 * if NULL, then all DS records are removed from the authority section. 355 * @param z: zone name that the response is from. 356 */ 357 void iter_scrub_ds(struct dns_msg* msg, struct ub_packed_rrset_key* ns, 358 uint8_t* z); 359 360 /** 361 * Prepare an NXDOMAIN message to be used for a subdomain answer by removing all 362 * RRs from the ANSWER section. 363 * @param msg: the response to scrub. 364 */ 365 void iter_scrub_nxdomain(struct dns_msg* msg); 366 367 /** 368 * Remove query attempts from all available ips. For 0x20. 369 * @param dp: delegpt. 370 * @param d: decrease. 371 * @param outbound_msg_retry: number of retries of outgoing queries 372 */ 373 void iter_dec_attempts(struct delegpt* dp, int d, int outbound_msg_retry); 374 375 /** 376 * Add retry counts from older delegpt to newer delegpt. 377 * Does not waste time on timeout'd (or other failing) addresses. 378 * @param dp: new delegationpoint. 379 * @param old: old delegationpoint. 380 * @param outbound_msg_retry: number of retries of outgoing queries 381 */ 382 void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old, 383 int outbound_msg_retry); 384 385 /** 386 * See if a DS response (type ANSWER) is too low: a nodata answer with 387 * a SOA record in the authority section at-or-below the qchase.qname. 388 * Also returns true if we are not sure (i.e. empty message, CNAME nosig). 389 * @param msg: the response. 390 * @param dp: the dp name is used to check if the RRSIG gives a clue that 391 * it was originated from the correct nameserver. 392 * @return true if too low. 393 */ 394 int iter_ds_toolow(struct dns_msg* msg, struct delegpt* dp); 395 396 /** 397 * See if delegpt can go down a step to the qname or not 398 * @param qinfo: the query name looked up. 399 * @param dp: checked if the name can go lower to the qname 400 * @return true if can go down, false if that would not be possible. 401 * the current response seems to be the one and only, best possible, response. 402 */ 403 int iter_dp_cangodown(struct query_info* qinfo, struct delegpt* dp); 404 405 /** 406 * Lookup if no_cache is set in stub or fwd. 407 * @param qstate: query state with env with hints and fwds. 408 * @param qinf: query name to lookup for. 409 * @param retdpname: returns NULL or the deepest enclosing name of fwd or stub. 410 * This is the name under which the closest lookup is going to happen. 411 * Used for NXDOMAIN checks, above that it is an nxdomain from a 412 * different server and zone. You can pass NULL to not get it. 413 * @param retdpnamelen: returns the length of the dpname. 414 * @param dpname_storage: this is where the dpname buf is stored, if any. 415 * So that caller can manage the buffer. 416 * @param dpname_storage_len: size of dpname_storage buffer. 417 * @return true if no_cache is set in stub or fwd. 418 */ 419 int iter_stub_fwd_no_cache(struct module_qstate *qstate, 420 struct query_info *qinf, uint8_t** retdpname, size_t* retdpnamelen, 421 uint8_t* dpname_storage, size_t dpname_storage_len); 422 423 /** 424 * Set support for IP4 and IP6 depending on outgoing interfaces 425 * in the outside network. If none, no support, so no use to lookup 426 * the AAAA and then attempt to use it if there is no outgoing-interface 427 * for it. 428 * @param mods: modstack to find iterator module in. 429 * @param env: module env, find iterator module (if one) in there. 430 * @param outnet: outside network structure. 431 */ 432 void iterator_set_ip46_support(struct module_stack* mods, 433 struct module_env* env, struct outside_network* outnet); 434 435 /** 436 * Read config string that represents the target fetch policy. 437 * @param target_fetch_policy: alloced on return. 438 * @param max_dependency_depth: set on return. 439 * @param str: the config string 440 * @return false on failure. 441 */ 442 int read_fetch_policy(int** target_fetch_policy, int* max_dependency_depth, 443 const char* str); 444 445 /** 446 * Create caps exempt data structure. 447 * @return NULL on failure. 448 */ 449 struct rbtree_type* caps_white_create(void); 450 451 /** 452 * Delete caps exempt data structure. 453 * @param caps_white: caps exempt tree. 454 */ 455 void caps_white_delete(struct rbtree_type* caps_white); 456 457 /** 458 * Apply config caps whitelist items to name tree 459 * @param ntree: caps exempt tree. 460 * @param cfg: config with options. 461 */ 462 int caps_white_apply_cfg(struct rbtree_type* ntree, struct config_file* cfg); 463 464 /** 465 * Apply config for nat64 466 * @param nat64: the nat64 state. 467 * @param cfg: config with options. 468 * @return false on failure. 469 */ 470 int nat64_apply_cfg(struct iter_nat64* nat64, struct config_file* cfg); 471 472 /** 473 * Limit NSEC and NSEC3 TTL in response, RFC9077 474 * @param msg: dns message, the SOA record ttl is used to restrict ttls 475 * of NSEC and NSEC3 RRsets. If no SOA record, nothing happens. 476 */ 477 void limit_nsec_ttl(struct dns_msg* msg); 478 479 /** 480 * Make the response minimal. Removed authority and additional section, 481 * that works when there is an answer in the answer section. 482 * @param rep: reply to modify. 483 */ 484 void iter_make_minimal(struct reply_info* rep); 485 486 #endif /* ITERATOR_ITER_UTILS_H */ 487