1 /*
2 * daemon/daemon.c - collection of workers that handles requests.
3 *
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
5 *
6 * This software is open source.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
14 *
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
18 *
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34 */
35
36 /**
37 * \file
38 *
39 * The daemon consists of global settings and a number of workers.
40 */
41
42 #include "config.h"
43 #ifdef HAVE_OPENSSL_ERR_H
44 #include <openssl/err.h>
45 #endif
46
47 #ifdef HAVE_OPENSSL_RAND_H
48 #include <openssl/rand.h>
49 #endif
50
51 #ifdef HAVE_OPENSSL_CONF_H
52 #include <openssl/conf.h>
53 #endif
54
55 #ifdef HAVE_OPENSSL_ENGINE_H
56 #include <openssl/engine.h>
57 #endif
58
59 #ifdef HAVE_TIME_H
60 #include <time.h>
61 #endif
62 #include <sys/time.h>
63
64 #ifdef HAVE_NSS
65 /* nss3 */
66 #include "nss.h"
67 #endif
68
69 #include "daemon/daemon.h"
70 #include "daemon/worker.h"
71 #include "daemon/remote.h"
72 #include "daemon/acl_list.h"
73 #include "util/log.h"
74 #include "util/config_file.h"
75 #include "util/data/msgreply.h"
76 #include "util/shm_side/shm_main.h"
77 #include "util/storage/lookup3.h"
78 #include "util/storage/slabhash.h"
79 #include "util/tcp_conn_limit.h"
80 #include "util/edns.h"
81 #include "services/listen_dnsport.h"
82 #include "services/outside_network.h"
83 #include "services/cache/rrset.h"
84 #include "services/cache/infra.h"
85 #include "services/localzone.h"
86 #include "services/view.h"
87 #include "services/modstack.h"
88 #include "services/authzone.h"
89 #include "util/module.h"
90 #include "util/random.h"
91 #include "util/tube.h"
92 #include "util/net_help.h"
93 #include "sldns/keyraw.h"
94 #include "respip/respip.h"
95 #include "iterator/iter_fwd.h"
96 #include "iterator/iter_hints.h"
97 #include <signal.h>
98
99 #ifdef HAVE_SYSTEMD
100 #include <systemd/sd-daemon.h>
101 #endif
102 #ifdef HAVE_NETDB_H
103 #include <netdb.h>
104 #endif
105 #ifdef USE_CACHEDB
106 #include "cachedb/cachedb.h"
107 #endif
108
109 /** How many quit requests happened. */
110 static int sig_record_quit = 0;
111 /** How many reload requests happened. */
112 static int sig_record_reload = 0;
113
114 #if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
115 /** cleaner ssl memory freeup */
116 static void* comp_meth = NULL;
117 #endif
118 /** remove buffers for parsing and init */
119 int ub_c_lex_destroy(void);
120
121 /** used when no other sighandling happens, so we don't die
122 * when multiple signals in quick succession are sent to us.
123 * @param sig: signal number.
124 * @return signal handler return type (void or int).
125 */
record_sigh(int sig)126 static RETSIGTYPE record_sigh(int sig)
127 {
128 #ifdef LIBEVENT_SIGNAL_PROBLEM
129 /* cannot log, verbose here because locks may be held */
130 /* quit on signal, no cleanup and statistics,
131 because installed libevent version is not threadsafe */
132 exit(0);
133 #endif
134 switch(sig)
135 {
136 case SIGTERM:
137 #ifdef SIGQUIT
138 case SIGQUIT:
139 #endif
140 #ifdef SIGBREAK
141 case SIGBREAK:
142 #endif
143 case SIGINT:
144 sig_record_quit++;
145 break;
146 #ifdef SIGHUP
147 case SIGHUP:
148 sig_record_reload++;
149 break;
150 #endif
151 #ifdef SIGPIPE
152 case SIGPIPE:
153 break;
154 #endif
155 default:
156 /* ignoring signal */
157 break;
158 }
159 }
160
161 /**
162 * Signal handling during the time when netevent is disabled.
163 * Stores signals to replay later.
164 */
165 static void
signal_handling_record(void)166 signal_handling_record(void)
167 {
168 if( signal(SIGTERM, record_sigh) == SIG_ERR ||
169 #ifdef SIGQUIT
170 signal(SIGQUIT, record_sigh) == SIG_ERR ||
171 #endif
172 #ifdef SIGBREAK
173 signal(SIGBREAK, record_sigh) == SIG_ERR ||
174 #endif
175 #ifdef SIGHUP
176 signal(SIGHUP, record_sigh) == SIG_ERR ||
177 #endif
178 #ifdef SIGPIPE
179 signal(SIGPIPE, SIG_IGN) == SIG_ERR ||
180 #endif
181 signal(SIGINT, record_sigh) == SIG_ERR
182 )
183 log_err("install sighandler: %s", strerror(errno));
184 }
185
186 /**
187 * Replay old signals.
188 * @param wrk: worker that handles signals.
189 */
190 static void
signal_handling_playback(struct worker * wrk)191 signal_handling_playback(struct worker* wrk)
192 {
193 #ifdef SIGHUP
194 if(sig_record_reload)
195 worker_sighandler(SIGHUP, wrk);
196 #endif
197 if(sig_record_quit)
198 worker_sighandler(SIGTERM, wrk);
199 sig_record_quit = 0;
200 sig_record_reload = 0;
201 }
202
203 #ifdef HAVE_SSL
204 /* setup a listening ssl context, fatal_exit() on any failure */
205 static void
setup_listen_sslctx(void ** ctx,int is_dot,int is_doh,struct config_file * cfg,char * chroot)206 setup_listen_sslctx(void** ctx, int is_dot, int is_doh,
207 struct config_file* cfg, char* chroot)
208 {
209 char* key = cfg->ssl_service_key;
210 char* pem = cfg->ssl_service_pem;
211 if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
212 key += strlen(chroot);
213 if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
214 pem += strlen(chroot);
215 if(!(*ctx = listen_sslctx_create(key, pem, NULL,
216 cfg->tls_ciphers, cfg->tls_ciphersuites,
217 (cfg->tls_session_ticket_keys.first &&
218 cfg->tls_session_ticket_keys.first->str[0] != 0),
219 is_dot, is_doh, cfg->tls_protocols))) {
220 log_err("could not set up listen SSL_CTX");
221 *ctx = NULL;
222 }
223 }
224 #endif /* HAVE_SSL */
225
226 #ifdef HAVE_SSL
daemon_setup_listen_dot_sslctx(struct daemon * daemon,struct config_file * cfg)227 void* daemon_setup_listen_dot_sslctx(struct daemon* daemon,
228 struct config_file* cfg)
229 {
230 void* ctx;
231 (void)setup_listen_sslctx(&ctx, 1, 0, cfg, daemon->chroot);
232 return ctx;
233 }
234 #endif /* HAVE_SSL */
235
236 #ifdef HAVE_SSL
237 #ifdef HAVE_NGHTTP2_NGHTTP2_H
daemon_setup_listen_doh_sslctx(struct daemon * daemon,struct config_file * cfg)238 void* daemon_setup_listen_doh_sslctx(struct daemon* daemon,
239 struct config_file* cfg)
240 {
241 void* ctx;
242 (void)setup_listen_sslctx(&ctx, 0, 1, cfg, daemon->chroot);
243 return ctx;
244 }
245 #endif /* HAVE_NGHTTP2_NGHTTP2_H */
246 #endif /* HAVE_SSL */
247
248 #ifdef HAVE_SSL
249 #ifdef HAVE_NGTCP2
daemon_setup_listen_quic_sslctx(struct daemon * daemon,struct config_file * cfg)250 void* daemon_setup_listen_quic_sslctx(struct daemon* daemon,
251 struct config_file* cfg)
252 {
253 void* ctx;
254 char* chroot = daemon->chroot;
255 char* key = cfg->ssl_service_key;
256 char* pem = cfg->ssl_service_pem;
257 if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
258 key += strlen(chroot);
259 if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
260 pem += strlen(chroot);
261
262 if(!(ctx = quic_sslctx_create(key, pem, NULL))) {
263 log_err("could not set up quic SSL_CTX");
264 return NULL;
265 }
266 return ctx;
267 }
268 #endif /* HAVE_NGTCP2 */
269 #endif /* HAVE_SSL */
270
271 #ifdef HAVE_SSL
daemon_setup_connect_dot_sslctx(struct daemon * daemon,struct config_file * cfg)272 void* daemon_setup_connect_dot_sslctx(struct daemon* daemon,
273 struct config_file* cfg)
274 {
275 void* ctx;
276 char* bundle, *chroot = daemon->chroot;
277 bundle = cfg->tls_cert_bundle;
278 if(chroot && bundle && strncmp(bundle, chroot, strlen(chroot)) == 0)
279 bundle += strlen(chroot);
280
281 if(!(ctx = connect_sslctx_create(NULL, NULL, bundle,
282 cfg->tls_win_cert))) {
283 log_err("could not set up connect SSL_CTX");
284 return NULL;
285 }
286 return ctx;
287 }
288 #endif /* HAVE_SSL */
289
290 /* setups the needed ssl contexts, fatal_exit() on any failure */
291 void
daemon_setup_sslctxs(struct daemon * daemon,struct config_file * cfg)292 daemon_setup_sslctxs(struct daemon* daemon, struct config_file* cfg)
293 {
294 #ifdef HAVE_SSL
295 char* chroot = daemon->chroot;
296 if(cfg->ssl_service_key && cfg->ssl_service_key[0]) {
297 char* key = cfg->ssl_service_key;
298 char* pem = cfg->ssl_service_pem;
299 if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
300 key += strlen(chroot);
301 if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
302 pem += strlen(chroot);
303
304 /* setup the session keys; the callback to use them will be
305 * attached to each sslctx separately */
306 if(cfg->tls_session_ticket_keys.first &&
307 cfg->tls_session_ticket_keys.first->str[0] != 0) {
308 if(!listen_sslctx_setup_ticket_keys(
309 cfg->tls_session_ticket_keys.first, chroot)) {
310 fatal_exit("could not set session ticket SSL_CTX");
311 }
312 }
313 daemon->listen_dot_sslctx = daemon_setup_listen_dot_sslctx(
314 daemon, cfg);
315 if(!daemon->listen_dot_sslctx)
316 fatal_exit("Could not set up listen dot sslctx");
317 #ifdef HAVE_NGHTTP2_NGHTTP2_H
318 if(cfg_has_https(cfg)) {
319 daemon->listen_doh_sslctx =
320 daemon_setup_listen_doh_sslctx(daemon, cfg);
321 if(!daemon->listen_doh_sslctx)
322 fatal_exit("Could not set up listen doh sslctx");
323 }
324 #endif
325 #ifdef HAVE_NGTCP2
326 if(cfg_has_quic(cfg)) {
327 daemon->listen_quic_sslctx =
328 daemon_setup_listen_quic_sslctx(daemon, cfg);
329 if(!daemon->listen_quic_sslctx)
330 fatal_exit("Could not set up listen quic sslctx");
331 }
332 #endif /* HAVE_NGTCP2 */
333
334 /* Store the file name and mtime to detect changes later. */
335 daemon->ssl_service_key = strdup(cfg->ssl_service_key);
336 if(!daemon->ssl_service_key)
337 fatal_exit("could not setup ssl ctx: out of memory");
338 if(cfg->ssl_service_pem) {
339 daemon->ssl_service_pem = strdup(cfg->ssl_service_pem);
340 if(!daemon->ssl_service_pem)
341 fatal_exit("could not setup ssl ctx: out of memory");
342 } else {
343 daemon->ssl_service_pem = NULL;
344 }
345 if(!file_get_mtime(key,
346 &daemon->mtime_ssl_service_key,
347 &daemon->mtime_ns_ssl_service_key, NULL))
348 log_err("Could not stat(%s): %s",
349 key, strerror(errno));
350 if(pem) {
351 if(!file_get_mtime(pem,
352 &daemon->mtime_ssl_service_pem,
353 &daemon->mtime_ns_ssl_service_pem, NULL))
354 log_err("Could not stat(%s): %s",
355 pem, strerror(errno));
356 } else {
357 daemon->mtime_ssl_service_pem = 0;
358 daemon->mtime_ns_ssl_service_pem = 0;
359 }
360 }
361 daemon->connect_dot_sslctx = daemon_setup_connect_dot_sslctx(
362 daemon, cfg);
363 if(!daemon->connect_dot_sslctx)
364 fatal_exit("could not setup connect dot sslctx");
365 #else /* HAVE_SSL */
366 (void)daemon;(void)cfg;
367 #endif /* HAVE_SSL */
368 }
369
370 /** Delete the ssl ctxs */
371 static void
daemon_delete_sslctxs(struct daemon * daemon)372 daemon_delete_sslctxs(struct daemon* daemon)
373 {
374 #ifdef HAVE_SSL
375 listen_sslctx_delete_ticket_keys();
376 SSL_CTX_free((SSL_CTX*)daemon->listen_dot_sslctx);
377 daemon->listen_dot_sslctx = NULL;
378 SSL_CTX_free((SSL_CTX*)daemon->listen_doh_sslctx);
379 daemon->listen_doh_sslctx = NULL;
380 SSL_CTX_free((SSL_CTX*)daemon->connect_dot_sslctx);
381 daemon->connect_dot_sslctx = NULL;
382 free(daemon->ssl_service_key);
383 daemon->ssl_service_key = NULL;
384 free(daemon->ssl_service_pem);
385 daemon->ssl_service_pem = NULL;
386 #else
387 (void)daemon;
388 #endif
389 #ifdef HAVE_NGTCP2
390 SSL_CTX_free((SSL_CTX*)daemon->listen_quic_sslctx);
391 daemon->listen_quic_sslctx = NULL;
392 #endif
393 }
394
395 int
ssl_cert_changed(struct daemon * daemon,struct config_file * cfg)396 ssl_cert_changed(struct daemon* daemon, struct config_file* cfg)
397 {
398 time_t mtime = 0;
399 long ns = 0;
400 char* chroot = daemon->chroot;
401 char* key = cfg->ssl_service_key;
402 char* pem = cfg->ssl_service_pem;
403 log_assert(daemon->ssl_service_key && cfg->ssl_service_key);
404 if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
405 key += strlen(chroot);
406 if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
407 pem += strlen(chroot);
408
409 if(strcmp(daemon->ssl_service_key, cfg->ssl_service_key) != 0)
410 return 1;
411 if(daemon->ssl_service_pem && cfg->ssl_service_pem &&
412 strcmp(daemon->ssl_service_pem, cfg->ssl_service_pem) != 0)
413 return 1;
414 if(!file_get_mtime(key, &mtime, &ns, NULL)) {
415 log_err("Could not stat(%s): %s",
416 key, strerror(errno));
417 /* It has probably changed, but file read is likely going to
418 * fail. */
419 return 0;
420 }
421 if(mtime != daemon->mtime_ssl_service_key ||
422 ns != daemon->mtime_ns_ssl_service_key)
423 return 1;
424 if(pem) {
425 if(!file_get_mtime(pem, &mtime, &ns, NULL)) {
426 log_err("Could not stat(%s): %s",
427 pem, strerror(errno));
428 /* It has probably changed, but file read is likely going to
429 * fail. */
430 return 0;
431 }
432 if(mtime != daemon->mtime_ssl_service_pem ||
433 ns != daemon->mtime_ns_ssl_service_pem)
434 return 1;
435 }
436 return 0;
437 }
438
439 /** Reload the sslctxs if they have changed */
440 static void
daemon_reload_sslctxs(struct daemon * daemon)441 daemon_reload_sslctxs(struct daemon* daemon)
442 {
443 #ifdef HAVE_SSL
444 if(daemon->cfg->ssl_service_key && daemon->cfg->ssl_service_key[0]) {
445 /* See if changed */
446 if(!daemon->ssl_service_key ||
447 ssl_cert_changed(daemon,daemon->cfg)) {
448 verbose(VERB_ALGO, "Reloading certificates");
449 daemon_delete_sslctxs(daemon);
450 daemon_setup_sslctxs(daemon, daemon->cfg);
451 }
452 } else {
453 /* See if sslctxs are removed from config. */
454 if(daemon->ssl_service_key) {
455 verbose(VERB_ALGO, "Removing certificates");
456 daemon_delete_sslctxs(daemon);
457 }
458 }
459 #else
460 (void)daemon;
461 #endif
462 }
463
464 struct daemon*
daemon_init(void)465 daemon_init(void)
466 {
467 struct daemon* daemon = (struct daemon*)calloc(1,
468 sizeof(struct daemon));
469 #ifdef USE_WINSOCK
470 int r;
471 WSADATA wsa_data;
472 #endif
473 if(!daemon)
474 return NULL;
475 #ifdef USE_WINSOCK
476 r = WSAStartup(MAKEWORD(2,2), &wsa_data);
477 if(r != 0) {
478 fatal_exit("could not init winsock. WSAStartup: %s",
479 wsa_strerror(r));
480 }
481 #endif /* USE_WINSOCK */
482 signal_handling_record();
483 #ifdef HAVE_SSL
484 # ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
485 ERR_load_crypto_strings();
486 # endif
487 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
488 ERR_load_SSL_strings();
489 #endif
490 # ifdef USE_GOST
491 (void)sldns_key_EVP_load_gost_id();
492 # endif
493 # if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_CRYPTO)
494 # ifndef S_SPLINT_S
495 OpenSSL_add_all_algorithms();
496 # endif
497 # else
498 OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
499 | OPENSSL_INIT_ADD_ALL_DIGESTS
500 | OPENSSL_INIT_LOAD_CRYPTO_STRINGS
501 # if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
502 | OPENSSL_INIT_NO_LOAD_CONFIG
503 # endif
504 , NULL);
505 # endif
506 # if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
507 /* grab the COMP method ptr because openssl leaks it */
508 comp_meth = (void*)SSL_COMP_get_compression_methods();
509 # endif
510 # if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
511 (void)SSL_library_init();
512 # else
513 (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
514 # if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
515 | OPENSSL_INIT_NO_LOAD_CONFIG
516 # endif
517 , NULL);
518 # endif
519 # if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
520 if(!ub_openssl_lock_init())
521 fatal_exit("could not init openssl locks");
522 # endif
523 #elif defined(HAVE_NSS)
524 if(NSS_NoDB_Init(NULL) != SECSuccess)
525 fatal_exit("could not init NSS");
526 #endif /* HAVE_SSL or HAVE_NSS */
527 #ifdef HAVE_TZSET
528 /* init timezone info while we are not chrooted yet */
529 tzset();
530 #endif
531 daemon->need_to_exit = 0;
532 modstack_init(&daemon->mods);
533 if(!(daemon->env = (struct module_env*)calloc(1,
534 sizeof(*daemon->env)))) {
535 free(daemon);
536 return NULL;
537 }
538 daemon->env->modstack = &daemon->mods;
539 /* init edns_known_options */
540 if(!edns_known_options_init(daemon->env)) {
541 free(daemon->env);
542 free(daemon);
543 return NULL;
544 }
545 alloc_init(&daemon->superalloc, NULL, 0);
546 daemon->acl = acl_list_create();
547 if(!daemon->acl) {
548 edns_known_options_delete(daemon->env);
549 free(daemon->env);
550 free(daemon);
551 return NULL;
552 }
553 daemon->acl_interface = acl_list_create();
554 if(!daemon->acl_interface) {
555 acl_list_delete(daemon->acl);
556 edns_known_options_delete(daemon->env);
557 free(daemon->env);
558 free(daemon);
559 return NULL;
560 }
561 daemon->tcl = tcl_list_create();
562 if(!daemon->tcl) {
563 acl_list_delete(daemon->acl_interface);
564 acl_list_delete(daemon->acl);
565 edns_known_options_delete(daemon->env);
566 free(daemon->env);
567 free(daemon);
568 return NULL;
569 }
570 listen_setup_locks();
571 if(gettimeofday(&daemon->time_boot, NULL) < 0)
572 log_err("gettimeofday: %s", strerror(errno));
573 daemon->time_last_stat = daemon->time_boot;
574 if((daemon->env->auth_zones = auth_zones_create()) == 0) {
575 acl_list_delete(daemon->acl_interface);
576 acl_list_delete(daemon->acl);
577 tcl_list_delete(daemon->tcl);
578 edns_known_options_delete(daemon->env);
579 free(daemon->env);
580 free(daemon);
581 return NULL;
582 }
583 if(!(daemon->env->edns_strings = edns_strings_create())) {
584 auth_zones_delete(daemon->env->auth_zones);
585 acl_list_delete(daemon->acl_interface);
586 acl_list_delete(daemon->acl);
587 tcl_list_delete(daemon->tcl);
588 edns_known_options_delete(daemon->env);
589 free(daemon->env);
590 free(daemon);
591 return NULL;
592 }
593 return daemon;
594 }
595
setup_acl_for_ports(struct acl_list * list,struct listen_port * port_list)596 int setup_acl_for_ports(struct acl_list* list, struct listen_port* port_list)
597 {
598 struct acl_addr* acl_node;
599 for(; port_list; port_list=port_list->next) {
600 if(!port_list->socket) {
601 /* This is mainly for testbound where port_list is
602 * empty. */
603 continue;
604 }
605 if(!(acl_node = acl_interface_insert(list,
606 (struct sockaddr_storage*)port_list->socket->addr,
607 port_list->socket->addrlen,
608 acl_refuse))) {
609 return 0;
610 }
611 port_list->socket->acl = acl_node;
612 }
613 return 1;
614 }
615
616 int
daemon_open_shared_ports(struct daemon * daemon)617 daemon_open_shared_ports(struct daemon* daemon)
618 {
619 log_assert(daemon);
620 if(daemon->cfg->port != daemon->listening_port) {
621 char** resif = NULL;
622 int num_resif = 0;
623 size_t i;
624 struct listen_port* p0;
625 daemon->reuseport = 0;
626 /* free and close old ports */
627 if(daemon->ports != NULL) {
628 for(i=0; i<daemon->num_ports; i++)
629 listening_ports_free(daemon->ports[i]);
630 free(daemon->ports);
631 daemon->ports = NULL;
632 }
633 /* clean acl_interface */
634 acl_interface_init(daemon->acl_interface);
635 if(!resolve_interface_names(daemon->cfg->ifs,
636 daemon->cfg->num_ifs, NULL, &resif, &num_resif))
637 return 0;
638 /* see if we want to reuseport */
639 #ifdef SO_REUSEPORT
640 if(daemon->cfg->so_reuseport && daemon->cfg->num_threads > 0)
641 daemon->reuseport = 1;
642 #endif
643 /* try to use reuseport */
644 p0 = listening_ports_open(daemon->cfg, resif, num_resif,
645 &daemon->reuseport);
646 if(!p0) {
647 listening_ports_free(p0);
648 config_del_strarray(resif, num_resif);
649 return 0;
650 }
651 if(daemon->reuseport) {
652 /* reuseport was successful, allocate for it */
653 daemon->num_ports = (size_t)daemon->cfg->num_threads;
654 } else {
655 /* do the normal, singleportslist thing,
656 * reuseport not enabled or did not work */
657 daemon->num_ports = 1;
658 }
659 if(!(daemon->ports = (struct listen_port**)calloc(
660 daemon->num_ports, sizeof(*daemon->ports)))) {
661 listening_ports_free(p0);
662 config_del_strarray(resif, num_resif);
663 return 0;
664 }
665 daemon->ports[0] = p0;
666 if(!setup_acl_for_ports(daemon->acl_interface,
667 daemon->ports[0])) {
668 listening_ports_free(p0);
669 config_del_strarray(resif, num_resif);
670 return 0;
671 }
672 if(daemon->reuseport) {
673 /* continue to use reuseport */
674 for(i=1; i<daemon->num_ports; i++) {
675 if(!(daemon->ports[i]=
676 listening_ports_open(daemon->cfg,
677 resif, num_resif,
678 &daemon->reuseport))
679 || !daemon->reuseport ) {
680 for(i=0; i<daemon->num_ports; i++)
681 listening_ports_free(daemon->ports[i]);
682 free(daemon->ports);
683 daemon->ports = NULL;
684 config_del_strarray(resif, num_resif);
685 return 0;
686 }
687 if(!setup_acl_for_ports(daemon->acl_interface,
688 daemon->ports[i])) {
689 for(i=0; i<daemon->num_ports; i++)
690 listening_ports_free(daemon->ports[i]);
691 free(daemon->ports);
692 daemon->ports = NULL;
693 config_del_strarray(resif, num_resif);
694 return 0;
695 }
696 }
697 }
698 config_del_strarray(resif, num_resif);
699 daemon->listening_port = daemon->cfg->port;
700 }
701 if(!daemon->cfg->remote_control_enable && daemon->rc_port) {
702 listening_ports_free(daemon->rc_ports);
703 daemon->rc_ports = NULL;
704 daemon->rc_port = 0;
705 }
706 if(daemon->cfg->remote_control_enable &&
707 daemon->cfg->control_port != daemon->rc_port) {
708 listening_ports_free(daemon->rc_ports);
709 if(!(daemon->rc_ports=daemon_remote_open_ports(daemon->cfg)))
710 return 0;
711 daemon->rc_port = daemon->cfg->control_port;
712 }
713 return 1;
714 }
715
716 int
daemon_privileged(struct daemon * daemon)717 daemon_privileged(struct daemon* daemon)
718 {
719 daemon->env->cfg = daemon->cfg;
720 daemon->env->alloc = &daemon->superalloc;
721 daemon->env->worker = NULL;
722 if(!modstack_call_startup(&daemon->mods, daemon->cfg->module_conf,
723 daemon->env)) {
724 fatal_exit("failed to startup modules");
725 }
726 return 1;
727 }
728
729 /**
730 * Setup modules. setup module stack.
731 * @param daemon: the daemon
732 */
daemon_setup_modules(struct daemon * daemon)733 static void daemon_setup_modules(struct daemon* daemon)
734 {
735 daemon->env->cfg = daemon->cfg;
736 daemon->env->alloc = &daemon->superalloc;
737 daemon->env->worker = NULL;
738 if(daemon->mods_inited) {
739 modstack_call_deinit(&daemon->mods, daemon->env);
740 }
741 daemon->env->need_to_validate = 0; /* set by module init below */
742 if(!modstack_call_init(&daemon->mods, daemon->cfg->module_conf,
743 daemon->env)) {
744 fatal_exit("failed to init modules");
745 }
746 daemon->mods_inited = 1;
747 log_edns_known_options(VERB_ALGO, daemon->env);
748 }
749
750 /**
751 * Obtain allowed port numbers, concatenate the list, and shuffle them
752 * (ready to be handed out to threads).
753 * @param daemon: the daemon. Uses rand and cfg.
754 * @param shufport: the portlist output.
755 * @return number of ports available.
756 */
daemon_get_shufport(struct daemon * daemon,int * shufport)757 static int daemon_get_shufport(struct daemon* daemon, int* shufport)
758 {
759 int i, n, k, temp;
760 int avail = 0;
761 for(i=0; i<65536; i++) {
762 if(daemon->cfg->outgoing_avail_ports[i]) {
763 shufport[avail++] = daemon->cfg->
764 outgoing_avail_ports[i];
765 }
766 }
767 if(avail == 0)
768 fatal_exit("no ports are permitted for UDP, add "
769 "with outgoing-port-permit");
770 /* Knuth shuffle */
771 n = avail;
772 while(--n > 0) {
773 k = ub_random_max(daemon->rand, n+1); /* 0<= k<= n */
774 temp = shufport[k];
775 shufport[k] = shufport[n];
776 shufport[n] = temp;
777 }
778 return avail;
779 }
780
781 /**
782 * Clear and delete per-worker alloc caches, and free memory maintained in
783 * superalloc.
784 * The rrset and message caches must be empty at the time of call.
785 * @param daemon: the daemon that maintains the alloc caches to be cleared.
786 */
787 static void
daemon_clear_allocs(struct daemon * daemon)788 daemon_clear_allocs(struct daemon* daemon)
789 {
790 int i;
791
792 /* daemon->num may be different during reloads (after configuration
793 * read). Use old_num which has the correct value used to setup the
794 * worker_allocs */
795 for(i=0; i<daemon->old_num; i++) {
796 alloc_clear(daemon->worker_allocs[i]);
797 free(daemon->worker_allocs[i]);
798 }
799 free(daemon->worker_allocs);
800 daemon->worker_allocs = NULL;
801
802 alloc_clear_special(&daemon->superalloc);
803 }
804
805 /**
806 * Allocate empty worker structures. With backptr and thread-number,
807 * from 0..numthread initialised. Used as user arguments to new threads.
808 * Creates the daemon random generator if it does not exist yet.
809 * The random generator stays existing between reloads with a unique state.
810 * @param daemon: the daemon with (new) config settings.
811 */
812 static void
daemon_create_workers(struct daemon * daemon)813 daemon_create_workers(struct daemon* daemon)
814 {
815 int i, numport;
816 int* shufport;
817 log_assert(daemon && daemon->cfg);
818 if(!daemon->rand) {
819 daemon->rand = ub_initstate(NULL);
820 if(!daemon->rand)
821 fatal_exit("could not init random generator");
822 hash_set_raninit((uint32_t)ub_random(daemon->rand));
823 }
824 shufport = (int*)calloc(65536, sizeof(int));
825 if(!shufport)
826 fatal_exit("out of memory during daemon init");
827 numport = daemon_get_shufport(daemon, shufport);
828 verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
829 if(!(daemon->shared_ports = shared_ports_create(daemon->cfg->out_ifs,
830 daemon->cfg->num_out_ifs, daemon->cfg->do_ip4,
831 daemon->cfg->do_ip6, shufport, numport)))
832 fatal_exit("could not setup shared ports: out of memory");
833
834 #ifdef HAVE_NGTCP2
835 if (cfg_has_quic(daemon->cfg)) {
836 daemon->doq_table = doq_table_create(daemon->cfg, daemon->rand);
837 if(!daemon->doq_table)
838 fatal_exit("could not create doq_table: out of memory");
839 }
840 #endif
841
842 daemon->num = (daemon->cfg->num_threads?daemon->cfg->num_threads:1);
843 if(daemon->reuseport && (int)daemon->num < (int)daemon->num_ports) {
844 log_warn("cannot reduce num-threads to %d because so-reuseport "
845 "so continuing with %d threads.", (int)daemon->num,
846 (int)daemon->num_ports);
847 daemon->num = (int)daemon->num_ports;
848 }
849 daemon->workers = (struct worker**)calloc((size_t)daemon->num,
850 sizeof(struct worker*));
851 if(!daemon->workers)
852 fatal_exit("out of memory during daemon init");
853 if(daemon->cfg->dnstap) {
854 #ifdef USE_DNSTAP
855 daemon->dtenv = dt_create(daemon->cfg);
856 if (!daemon->dtenv)
857 fatal_exit("dt_create failed");
858 #else
859 fatal_exit("dnstap enabled in config but not built with dnstap support");
860 #endif
861 }
862 for(i=0; i<daemon->num; i++) {
863 if(!(daemon->workers[i] = worker_create(daemon, i)))
864 fatal_exit("could not create worker");
865 }
866 /* create per-worker alloc caches if not reusing existing ones. */
867 if(!daemon->worker_allocs) {
868 daemon->worker_allocs = (struct alloc_cache**)calloc(
869 (size_t)daemon->num, sizeof(struct alloc_cache*));
870 if(!daemon->worker_allocs)
871 fatal_exit("could not allocate worker allocs");
872 for(i=0; i<daemon->num; i++) {
873 struct alloc_cache* alloc = calloc(1,
874 sizeof(struct alloc_cache));
875 if (!alloc)
876 fatal_exit("could not allocate worker alloc");
877 alloc_init(alloc, &daemon->superalloc, i);
878 daemon->worker_allocs[i] = alloc;
879 }
880 }
881 free(shufport);
882 }
883
884 #ifdef THREADS_DISABLED
885 /**
886 * Close all pipes except for the numbered thread.
887 * @param daemon: daemon to close pipes in.
888 * @param thr: thread number 0..num-1 of thread to skip.
889 */
close_other_pipes(struct daemon * daemon,int thr)890 static void close_other_pipes(struct daemon* daemon, int thr)
891 {
892 int i;
893 for(i=0; i<daemon->num; i++)
894 if(i!=thr) {
895 if(i==0) {
896 /* only close read part, need to write stats */
897 tube_close_read(daemon->workers[i]->cmd);
898 } else {
899 /* complete close channel to others */
900 tube_delete(daemon->workers[i]->cmd);
901 daemon->workers[i]->cmd = NULL;
902 }
903 }
904 }
905 #endif /* THREADS_DISABLED */
906
907 /**
908 * Function to set the thread local log ID.
909 * Either the internal thread number, or the LWP ID on Linux based on
910 * configuration.
911 */
912 static void
set_log_thread_id(struct worker * worker,struct config_file * cfg)913 set_log_thread_id(struct worker* worker, struct config_file* cfg)
914 {
915 (void)cfg;
916 log_assert(worker);
917 #if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
918 worker->thread_tid = gettid();
919 if(cfg->log_thread_id)
920 log_thread_set(&worker->thread_tid);
921 else
922 #endif
923 log_thread_set(&worker->thread_num);
924 }
925
926 /**
927 * Function to start one thread.
928 * @param arg: user argument.
929 * @return: void* user return value could be used for thread_join results.
930 */
931 static void*
thread_start(void * arg)932 thread_start(void* arg)
933 {
934 struct worker* worker = (struct worker*)arg;
935 int port_num = 0;
936 set_log_thread_id(worker, worker->daemon->cfg);
937 {
938 char name[16]; /* seems to be the safest size between
939 different OSes */
940 snprintf(name, sizeof(name), "unbound/%u", worker->thread_num);
941 /* worker->thr_id can be written to after the thread was made
942 * by the creating thread, so this uses pthread_self. */
943 ub_thread_setname(ub_thread_self(), name);
944 }
945 ub_thread_blocksigs();
946 #ifdef THREADS_DISABLED
947 /* close pipe ends used by main */
948 tube_close_write(worker->cmd);
949 close_other_pipes(worker->daemon, worker->thread_num);
950 #endif
951 #ifdef SO_REUSEPORT
952 if(worker->daemon->cfg->so_reuseport)
953 port_num = worker->thread_num % worker->daemon->num_ports;
954 else
955 port_num = 0;
956 #endif
957 if(!worker_init(worker, worker->daemon->cfg,
958 worker->daemon->ports[port_num], 0)) {
959 fatal_exit("Could not initialize thread");
960 }
961
962 worker_work(worker);
963 return NULL;
964 }
965
966 /**
967 * Fork and init the other threads. Main thread returns for special handling.
968 * @param daemon: the daemon with other threads to fork.
969 */
970 static void
daemon_start_others(struct daemon * daemon)971 daemon_start_others(struct daemon* daemon)
972 {
973 int i;
974 log_assert(daemon);
975 verbose(VERB_ALGO, "start threads");
976 /* skip i=0, is this thread */
977 for(i=1; i<daemon->num; i++) {
978 ub_thread_create(&daemon->workers[i]->thr_id,
979 thread_start, daemon->workers[i]);
980 #ifdef THREADS_DISABLED
981 /* close pipe end of child */
982 tube_close_read(daemon->workers[i]->cmd);
983 #endif /* no threads */
984 }
985 }
986
987 /**
988 * Stop the other threads.
989 * @param daemon: the daemon with other threads.
990 */
991 static void
daemon_stop_others(struct daemon * daemon)992 daemon_stop_others(struct daemon* daemon)
993 {
994 int i;
995 log_assert(daemon);
996 verbose(VERB_ALGO, "stop threads");
997 /* skip i=0, is this thread */
998 /* use i=0 buffer for sending cmds; because we are #0 */
999 for(i=1; i<daemon->num; i++) {
1000 worker_send_cmd(daemon->workers[i], worker_cmd_quit);
1001 }
1002 /* wait for them to quit */
1003 for(i=1; i<daemon->num; i++) {
1004 /* join it to make sure its dead */
1005 verbose(VERB_ALGO, "join %d", i);
1006 ub_thread_join(daemon->workers[i]->thr_id);
1007 verbose(VERB_ALGO, "join success %d", i);
1008 }
1009 }
1010
1011 void
daemon_fork(struct daemon * daemon)1012 daemon_fork(struct daemon* daemon)
1013 {
1014 int have_view_respip_cfg = 0;
1015 #ifdef HAVE_SYSTEMD
1016 int ret;
1017 #endif
1018
1019 log_assert(daemon);
1020 daemon_reload_sslctxs(daemon);
1021 if(!(daemon->env->views = views_create()))
1022 fatal_exit("Could not create views: out of memory");
1023 /* create individual views and their localzone/data trees */
1024 if(!views_apply_cfg(daemon->env->views, daemon->cfg))
1025 fatal_exit("Could not set up views");
1026
1027 if(!acl_list_apply_cfg(daemon->acl, daemon->cfg, daemon->env->views))
1028 fatal_exit("Could not setup access control list");
1029 if(!acl_interface_apply_cfg(daemon->acl_interface, daemon->cfg,
1030 daemon->env->views))
1031 fatal_exit("Could not setup interface control list");
1032 if(!tcl_list_apply_cfg(daemon->tcl, daemon->cfg))
1033 fatal_exit("Could not setup TCP connection limits");
1034 if(daemon->cfg->dnscrypt) {
1035 #ifdef USE_DNSCRYPT
1036 daemon->dnscenv = dnsc_create();
1037 if (!daemon->dnscenv)
1038 fatal_exit("dnsc_create failed");
1039 dnsc_apply_cfg(daemon->dnscenv, daemon->cfg);
1040 #else
1041 fatal_exit("dnscrypt enabled in config but unbound was not built with "
1042 "dnscrypt support");
1043 #endif
1044 }
1045 if(daemon->cfg->cookie_secret_file &&
1046 daemon->cfg->cookie_secret_file[0]) {
1047 if(!(daemon->cookie_secrets = cookie_secrets_create()))
1048 fatal_exit("Could not create cookie_secrets: out of memory");
1049 if(!cookie_secrets_apply_cfg(daemon->cookie_secrets,
1050 daemon->cfg->cookie_secret_file))
1051 fatal_exit("Could not setup cookie_secrets");
1052 }
1053 /* create global local_zones */
1054 if(!(daemon->local_zones = local_zones_create()))
1055 fatal_exit("Could not create local zones: out of memory");
1056 if(!local_zones_apply_cfg(daemon->local_zones, daemon->cfg))
1057 fatal_exit("Could not set up local zones");
1058 if(!(daemon->env->fwds = forwards_create()) ||
1059 !forwards_apply_cfg(daemon->env->fwds, daemon->cfg))
1060 fatal_exit("Could not set forward zones");
1061 if(!(daemon->env->hints = hints_create()) ||
1062 !hints_apply_cfg(daemon->env->hints, daemon->cfg))
1063 fatal_exit("Could not set root or stub hints");
1064
1065 /* process raw response-ip configuration data */
1066 if(!(daemon->env->respip_set = respip_set_create()))
1067 fatal_exit("Could not create response IP set");
1068 if(!respip_global_apply_cfg(daemon->env->respip_set, daemon->cfg))
1069 fatal_exit("Could not set up response IP set");
1070 if(!respip_views_apply_cfg(daemon->env->views, daemon->cfg,
1071 &have_view_respip_cfg))
1072 fatal_exit("Could not set up per-view response IP sets");
1073 daemon->use_response_ip = !respip_set_is_empty(
1074 daemon->env->respip_set) || have_view_respip_cfg;
1075
1076 /* setup modules */
1077 daemon_setup_modules(daemon);
1078
1079 /* read auth zonefiles */
1080 if(!auth_zones_apply_cfg(daemon->env->auth_zones, daemon->cfg, 1,
1081 &daemon->use_rpz, daemon->env, &daemon->mods))
1082 fatal_exit("auth_zones could not be setup");
1083
1084 /* Set-up EDNS strings */
1085 if(!edns_strings_apply_cfg(daemon->env->edns_strings, daemon->cfg))
1086 fatal_exit("Could not set up EDNS strings");
1087
1088 #ifdef USE_CACHEDB
1089 daemon->env->cachedb_enabled = cachedb_is_enabled(&daemon->mods,
1090 daemon->env);
1091 #endif
1092 /* response-ip-xxx options don't work as expected without the respip
1093 * module. To avoid run-time operational surprise we reject such
1094 * configuration. */
1095 if(daemon->use_response_ip &&
1096 modstack_find(&daemon->mods, "respip") < 0)
1097 fatal_exit("response-ip options require respip module");
1098 /* RPZ response ip triggers don't work as expected without the respip
1099 * module. To avoid run-time operational surprise we reject such
1100 * configuration. */
1101 if(daemon->use_rpz &&
1102 modstack_find(&daemon->mods, "respip") < 0)
1103 fatal_exit("RPZ requires the respip module");
1104
1105 /* first create all the worker structures, so we can pass
1106 * them to the newly created threads.
1107 */
1108 daemon_create_workers(daemon);
1109 /* Set it for the first (main) worker since it does not take part in
1110 * the thread_start() procedure.
1111 */
1112 set_log_thread_id(daemon->workers[0], daemon->cfg);
1113 /* If shm stats need an offset, calculate it */
1114 if(daemon->cfg->shm_enable && daemon->cfg->stat_interval > 0) {
1115 daemon->stat_time_specific = 1;
1116 daemon->stat_time_offset =
1117 ((int)time(NULL))%daemon->cfg->stat_interval;
1118 }
1119
1120 #if defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
1121 /* in libev the first inited base gets signals */
1122 if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports[0], 1)) {
1123 fatal_exit("Could not initialize main thread");
1124 }
1125 #endif
1126
1127 /* Now create the threads and init the workers.
1128 * By the way, this is thread #0 (the main thread).
1129 */
1130 daemon_start_others(daemon);
1131
1132 /* Special handling for the main thread. This is the thread
1133 * that handles signals and remote control.
1134 */
1135 #if !(defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP))
1136 /* libevent has the last inited base get signals (or any base) */
1137 if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports[0], 1)) {
1138 fatal_exit("Could not initialize main thread");
1139 }
1140 #endif
1141 signal_handling_playback(daemon->workers[0]);
1142
1143 if (!shm_main_init(daemon))
1144 log_warn("SHM has failed");
1145
1146 /* Start resolver service on main thread. */
1147 #ifdef HAVE_SYSTEMD
1148 ret = sd_notify(0, "READY=1");
1149 if(ret <= 0 && getenv("NOTIFY_SOCKET"))
1150 fatal_exit("sd_notify failed %s: %s. Make sure that unbound has "
1151 "access/permission to use the socket presented by systemd.",
1152 getenv("NOTIFY_SOCKET"),
1153 (ret==0?"no $NOTIFY_SOCKET": strerror(-ret)));
1154 #endif
1155 log_info("start of service (%s).", PACKAGE_STRING);
1156 worker_work(daemon->workers[0]);
1157 #ifdef HAVE_SYSTEMD
1158 if (daemon->workers[0]->need_to_exit)
1159 sd_notify(0, "STOPPING=1");
1160 else
1161 sd_notify(0, "RELOADING=1");
1162 #endif
1163 log_info("service stopped (%s).", PACKAGE_STRING);
1164
1165 /* we exited! a signal happened! Stop other threads */
1166 daemon_stop_others(daemon);
1167
1168 /* Shutdown SHM */
1169 shm_main_shutdown(daemon);
1170
1171 daemon->reuse_cache = daemon->workers[0]->reuse_cache;
1172 daemon->need_to_exit = daemon->workers[0]->need_to_exit;
1173 }
1174
1175 void
daemon_cleanup(struct daemon * daemon)1176 daemon_cleanup(struct daemon* daemon)
1177 {
1178 int i;
1179 log_assert(daemon);
1180 /* before stopping main worker, handle signals ourselves, so we
1181 don't die on multiple reload signals for example. */
1182 signal_handling_record();
1183 /* clean up caches because
1184 * a) RRset IDs will be recycled after a reload, causing collisions
1185 * b) validation config can change, thus rrset, msg, keycache clear
1186 *
1187 * If we are trying to keep the cache as long as possible, we should
1188 * defer the cleanup until we know whether the new configuration allows
1189 * the reuse. (If we're exiting, cleanup should be done here). */
1190 if(!daemon->reuse_cache || daemon->need_to_exit) {
1191 slabhash_clear(&daemon->env->rrset_cache->table);
1192 slabhash_clear(daemon->env->msg_cache);
1193 }
1194 daemon->old_num = daemon->num; /* save the current num */
1195 forwards_delete(daemon->env->fwds);
1196 daemon->env->fwds = NULL;
1197 hints_delete(daemon->env->hints);
1198 daemon->env->hints = NULL;
1199 local_zones_delete(daemon->local_zones);
1200 daemon->local_zones = NULL;
1201 respip_set_delete(daemon->env->respip_set);
1202 daemon->env->respip_set = NULL;
1203 views_delete(daemon->env->views);
1204 daemon->env->views = NULL;
1205 if(daemon->env->auth_zones)
1206 auth_zones_cleanup(daemon->env->auth_zones);
1207 /* key cache is cleared by module deinit during next daemon_fork() */
1208 daemon_remote_clear(daemon->rc);
1209 if(daemon->fast_reload_thread)
1210 fast_reload_thread_stop(daemon->fast_reload_thread);
1211 if(daemon->fast_reload_printq_list)
1212 fast_reload_printq_list_delete(daemon->fast_reload_printq_list);
1213 for(i=0; i<daemon->num; i++)
1214 worker_delete(daemon->workers[i]);
1215 free(daemon->workers);
1216 daemon->workers = NULL;
1217 /* Unless we're trying to keep the cache, worker alloc_caches should be
1218 * cleared and freed here. We do this after deleting workers to
1219 * guarantee that the alloc caches are valid throughout the lifetime
1220 * of workers. */
1221 if(!daemon->reuse_cache || daemon->need_to_exit)
1222 daemon_clear_allocs(daemon);
1223 daemon->num = 0;
1224 shared_ports_delete(daemon->shared_ports);
1225 daemon->shared_ports = NULL;
1226 #ifdef USE_DNSTAP
1227 dt_delete(daemon->dtenv);
1228 daemon->dtenv = NULL;
1229 #endif
1230 #ifdef USE_DNSCRYPT
1231 dnsc_delete(daemon->dnscenv);
1232 daemon->dnscenv = NULL;
1233 #endif
1234 #ifdef HAVE_NGTCP2
1235 if (daemon->doq_table) {
1236 doq_table_delete(daemon->doq_table);
1237 daemon->doq_table = NULL;
1238 }
1239 #endif
1240 daemon->cfg = NULL;
1241 }
1242
1243 void
daemon_delete(struct daemon * daemon)1244 daemon_delete(struct daemon* daemon)
1245 {
1246 size_t i;
1247 if(!daemon)
1248 return;
1249 modstack_call_deinit(&daemon->mods, daemon->env);
1250 modstack_call_destartup(&daemon->mods, daemon->env);
1251 modstack_free(&daemon->mods);
1252 daemon_remote_delete(daemon->rc);
1253 for(i = 0; i < daemon->num_ports; i++)
1254 listening_ports_free(daemon->ports[i]);
1255 free(daemon->ports);
1256 listening_ports_free(daemon->rc_ports);
1257 if(daemon->env) {
1258 slabhash_delete(daemon->env->msg_cache);
1259 rrset_cache_delete(daemon->env->rrset_cache);
1260 infra_delete(daemon->env->infra_cache);
1261 edns_known_options_delete(daemon->env);
1262 edns_strings_delete(daemon->env->edns_strings);
1263 auth_zones_delete(daemon->env->auth_zones);
1264 }
1265 ub_randfree(daemon->rand);
1266 alloc_clear(&daemon->superalloc);
1267 acl_list_delete(daemon->acl);
1268 acl_list_delete(daemon->acl_interface);
1269 tcl_list_delete(daemon->tcl);
1270 cookie_secrets_delete(daemon->cookie_secrets);
1271 listen_desetup_locks();
1272 free(daemon->chroot);
1273 free(daemon->pidfile);
1274 free(daemon->cfgfile);
1275 free(daemon->env);
1276 daemon_delete_sslctxs(daemon);
1277 free(daemon);
1278 /* lex cleanup */
1279 ub_c_lex_destroy();
1280 /* libcrypto cleanup */
1281 #ifdef HAVE_SSL
1282 # if defined(USE_GOST)
1283 sldns_key_EVP_unload_gost();
1284 # endif
1285 # if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS && HAVE_DECL_SK_SSL_COMP_POP_FREE
1286 # ifndef S_SPLINT_S
1287 # if OPENSSL_VERSION_NUMBER < 0x10100000
1288 sk_SSL_COMP_pop_free(comp_meth, (void(*)(SSL_COMP*))CRYPTO_free);
1289 # endif
1290 # endif
1291 # endif
1292 # ifdef HAVE_OPENSSL_CONFIG
1293 EVP_cleanup();
1294 # if (OPENSSL_VERSION_NUMBER < 0x10100000) && !defined(OPENSSL_NO_ENGINE) && defined(HAVE_ENGINE_CLEANUP)
1295 ENGINE_cleanup();
1296 # endif
1297 CONF_modules_free();
1298 # endif
1299 # ifdef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
1300 CRYPTO_cleanup_all_ex_data(); /* safe, no more threads right now */
1301 # endif
1302 # ifdef HAVE_ERR_FREE_STRINGS
1303 ERR_free_strings();
1304 # endif
1305 # if OPENSSL_VERSION_NUMBER < 0x10100000
1306 RAND_cleanup();
1307 # endif
1308 # if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
1309 ub_openssl_lock_delete();
1310 # endif
1311 #ifdef HAVE_OPENSSL_CLEANUP
1312 OPENSSL_cleanup();
1313 #endif
1314 #ifndef HAVE_ARC4RANDOM
1315 _ARC4_LOCK_DESTROY();
1316 #endif
1317 #elif defined(HAVE_NSS)
1318 NSS_Shutdown();
1319 #endif /* HAVE_SSL or HAVE_NSS */
1320 checklock_stop();
1321 #ifdef USE_WINSOCK
1322 if(WSACleanup() != 0) {
1323 log_err("Could not WSACleanup: %s",
1324 wsa_strerror(WSAGetLastError()));
1325 }
1326 #endif
1327 }
1328
daemon_apply_cfg(struct daemon * daemon,struct config_file * cfg)1329 void daemon_apply_cfg(struct daemon* daemon, struct config_file* cfg)
1330 {
1331 int new_num = cfg->num_threads?cfg->num_threads:1;
1332
1333 daemon->cfg = cfg;
1334 config_apply(cfg);
1335
1336 /* If this is a reload and we deferred the decision on whether to
1337 * reuse the alloc, RRset, and message caches, then check to see if
1338 * it's safe to keep the caches:
1339 * - changing the number of threads is obviously incompatible with
1340 * keeping the per-thread alloc caches. It also means we have to
1341 * clear RRset and message caches. (note that 'new_num' may be
1342 * adjusted in daemon_create_workers, but for our purpose we can
1343 * simply compare it with 'old_num'; if they are equal here,
1344 * 'new_num' won't be adjusted to a different value than 'old_num').
1345 * - changing RRset cache size effectively clears any remaining cache
1346 * entries. We could keep their keys in alloc caches, but it would
1347 * be more consistent with the sense of the change to clear allocs
1348 * and free memory. To do so we also have to clear message cache.
1349 * - only changing message cache size does not necessarily affect
1350 * RRset or alloc cache. But almost all new subsequent queries will
1351 * require recursive resolution anyway, so it doesn't help much to
1352 * just keep RRset and alloc caches. For simplicity we clear/free
1353 * the other two, too. */
1354 if(daemon->worker_allocs &&
1355 (new_num != daemon->old_num ||
1356 !slabhash_is_size(daemon->env->msg_cache, cfg->msg_cache_size,
1357 cfg->msg_cache_slabs) ||
1358 !slabhash_is_size(&daemon->env->rrset_cache->table,
1359 cfg->rrset_cache_size, cfg->rrset_cache_slabs)))
1360 {
1361 log_warn("cannot reuse caches due to critical config change");
1362 slabhash_clear(&daemon->env->rrset_cache->table);
1363 slabhash_clear(daemon->env->msg_cache);
1364 daemon_clear_allocs(daemon);
1365 }
1366
1367 if(!slabhash_is_size(daemon->env->msg_cache, cfg->msg_cache_size,
1368 cfg->msg_cache_slabs)) {
1369 slabhash_delete(daemon->env->msg_cache);
1370 daemon->env->msg_cache = slabhash_create(cfg->msg_cache_slabs,
1371 HASH_DEFAULT_STARTARRAY, cfg->msg_cache_size,
1372 msgreply_sizefunc, query_info_compare,
1373 query_entry_delete, reply_info_delete, NULL);
1374 if(!daemon->env->msg_cache) {
1375 fatal_exit("malloc failure updating config settings");
1376 }
1377 }
1378 if((daemon->env->rrset_cache = rrset_cache_adjust(
1379 daemon->env->rrset_cache, cfg, &daemon->superalloc)) == 0)
1380 fatal_exit("malloc failure updating config settings");
1381 if((daemon->env->infra_cache = infra_adjust(daemon->env->infra_cache,
1382 cfg))==0)
1383 fatal_exit("malloc failure updating config settings");
1384 }
1385