xref: /freebsd/contrib/unbound/iterator/iter_utils.h (revision 1f1e2261e341e6ca6862f82261066ef1705f0a7a)
1 /*
2  * iterator/iter_utils.h - iterative resolver module utility functions.
3  *
4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
5  *
6  * This software is open source.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * Redistributions of source code must retain the above copyright notice,
13  * this list of conditions and the following disclaimer.
14  *
15  * Redistributions in binary form must reproduce the above copyright notice,
16  * this list of conditions and the following disclaimer in the documentation
17  * and/or other materials provided with the distribution.
18  *
19  * Neither the name of the NLNET LABS nor the names of its contributors may
20  * be used to endorse or promote products derived from this software without
21  * specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /**
37  * \file
38  *
39  * This file contains functions to assist the iterator module.
40  * Configuration options. Forward zones.
41  */
42 
43 #ifndef ITERATOR_ITER_UTILS_H
44 #define ITERATOR_ITER_UTILS_H
45 #include "iterator/iter_resptype.h"
46 struct sldns_buffer;
47 struct iter_env;
48 struct iter_hints;
49 struct iter_forwards;
50 struct config_file;
51 struct module_env;
52 struct delegpt_addr;
53 struct delegpt;
54 struct regional;
55 struct msg_parse;
56 struct ub_randstate;
57 struct query_info;
58 struct reply_info;
59 struct module_qstate;
60 struct sock_list;
61 struct ub_packed_rrset_key;
62 struct module_stack;
63 struct outside_network;
64 
65 /**
66  * Process config options and set iterator module state.
67  * Sets default values if no config is found.
68  * @param iter_env: iterator module state.
69  * @param cfg: config options.
70  * @return 0 on error.
71  */
72 int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg);
73 
74 /**
75  * Select a valid, nice target to send query to.
76  * Sorting and removing unsuitable targets is combined.
77  *
78  * @param iter_env: iterator module global state, with ip6 enabled and
79  *	do-not-query-addresses.
80  * @param env: environment with infra cache (lameness, rtt info).
81  * @param dp: delegation point with result list.
82  * @param name: zone name (for lameness check).
83  * @param namelen: length of name.
84  * @param qtype: query type that we want to send.
85  * @param dnssec_lame: set to 1, if a known dnssec-lame server is selected
86  *	these are not preferred, but are used as a last resort.
87  * @param chase_to_rd: set to 1 if a known recursion lame server is selected
88  * 	these are not preferred, but are used as a last resort.
89  * @param open_target: number of currently outstanding target queries.
90  * 	If we wait for these, perhaps more server addresses become available.
91  * @param blacklist: the IP blacklist to use.
92  * @param prefetch: if not 0, prefetch is in use for this query.
93  * 	This means the query can have different timing, because prefetch is
94  * 	not waited upon by the downstream client, and thus a good time to
95  * 	perform exploration of other targets.
96  * @return best target or NULL if no target.
97  *	if not null, that target is removed from the result list in the dp.
98  */
99 struct delegpt_addr* iter_server_selection(struct iter_env* iter_env,
100 	struct module_env* env, struct delegpt* dp, uint8_t* name,
101 	size_t namelen, uint16_t qtype, int* dnssec_lame,
102 	int* chase_to_rd, int open_target, struct sock_list* blacklist,
103 	time_t prefetch);
104 
105 /**
106  * Allocate dns_msg from parsed msg, in regional.
107  * @param pkt: packet.
108  * @param msg: parsed message (cleaned and ready for regional allocation).
109  * @param regional: regional to use for allocation.
110  * @return newly allocated dns_msg, or NULL on memory error.
111  */
112 struct dns_msg* dns_alloc_msg(struct sldns_buffer* pkt, struct msg_parse* msg,
113 	struct regional* regional);
114 
115 /**
116  * Copy a dns_msg to this regional.
117  * @param from: dns message, also in regional.
118  * @param regional: regional to use for allocation.
119  * @return newly allocated dns_msg, or NULL on memory error.
120  */
121 struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional);
122 
123 /**
124  * Allocate a dns_msg with malloc/alloc structure and store in dns cache.
125  * @param env: environment, with alloc structure and dns cache.
126  * @param qinf: query info, the query for which answer is stored.
127  * @param rep: reply in dns_msg from dns_alloc_msg for example.
128  * @param is_referral: If true, then the given message to be stored is a
129  *	referral. The cache implementation may use this as a hint.
130  * @param leeway: prefetch TTL leeway to expire old rrsets quicker.
131  * @param pside: true if dp is parentside, thus message is 'fresh' and NS
132  * 	can be prefetch-updates.
133  * @param region: to copy modified (cache is better) rrs back to.
134  * @param flags: with BIT_CD for dns64 AAAA translated queries.
135  * return void, because we are not interested in alloc errors,
136  * 	the iterator and validator can operate on the results in their
137  * 	scratch space (the qstate.region) and are not dependent on the cache.
138  * 	It is useful to log the alloc failure (for the server operator),
139  * 	but the query resolution can continue without cache storage.
140  */
141 void iter_dns_store(struct module_env* env, struct query_info* qinf,
142 	struct reply_info* rep, int is_referral, time_t leeway, int pside,
143 	struct regional* region, uint16_t flags);
144 
145 /**
146  * Select randomly with n/m probability.
147  * For shuffle NS records for address fetching.
148  * @param rnd: random table
149  * @param n: probability.
150  * @param m: divisor for probability.
151  * @return true with n/m probability.
152  */
153 int iter_ns_probability(struct ub_randstate* rnd, int n, int m);
154 
155 /**
156  * Mark targets that result in a dependency cycle as done, so they
157  * will not get selected as targets.
158  * @param qstate: query state.
159  * @param dp: delegpt to mark ns in.
160  */
161 void iter_mark_cycle_targets(struct module_qstate* qstate, struct delegpt* dp);
162 
163 /**
164  * Mark targets that result in a dependency cycle as done, so they
165  * will not get selected as targets.  For the parent-side lookups.
166  * @param qstate: query state.
167  * @param dp: delegpt to mark ns in.
168  */
169 void iter_mark_pside_cycle_targets(struct module_qstate* qstate,
170 	struct delegpt* dp);
171 
172 /**
173  * See if delegation is useful or offers immediately no targets for
174  * further recursion.
175  * @param qinfo: query name and type
176  * @param qflags: query flags with RD flag
177  * @param dp: delegpt to check.
178  * @param supports_ipv4: if we support ipv4 for lookups to the target.
179  * 	if not, then the IPv4 addresses are useless.
180  * @param supports_ipv6: if we support ipv6 for lookups to the target.
181  * 	if not, then the IPv6 addresses are useless.
182  * @return true if dp is useless.
183  */
184 int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
185 	struct delegpt* dp, int supports_ipv4, int supports_ipv6);
186 
187 /**
188  * See if qname has DNSSEC needs.  This is true if there is a trust anchor above
189  * it.  Whether there is an insecure delegation to the data is unknown.
190  * @param env: environment with anchors.
191  * @param qinfo: query name and class.
192  * @return true if trust anchor above qname, false if no anchor or insecure
193  * point above qname.
194  */
195 int iter_qname_indicates_dnssec(struct module_env* env,
196 	struct query_info *qinfo);
197 
198 /**
199  * See if delegation is expected to have DNSSEC information (RRSIGs) in
200  * its answers, or not. Inspects delegation point (name), trust anchors,
201  * and delegation message (DS RRset) to determine this.
202  * @param env: module env with trust anchors.
203  * @param dp: delegation point.
204  * @param msg: delegation message, with DS if a secure referral.
205  * @param dclass: class of query.
206  * @return 1 if dnssec is expected, 0 if not or insecure point above qname.
207  */
208 int iter_indicates_dnssec(struct module_env* env, struct delegpt* dp,
209 	struct dns_msg* msg, uint16_t dclass);
210 
211 /**
212  * See if a message contains DNSSEC.
213  * This is examined by looking for RRSIGs. With DNSSEC a valid answer,
214  * nxdomain, nodata, referral or cname reply has RRSIGs in answer or auth
215  * sections, sigs on answer data, SOA, DS, or NSEC/NSEC3 records.
216  * @param msg: message to examine.
217  * @return true if DNSSEC information was found.
218  */
219 int iter_msg_has_dnssec(struct dns_msg* msg);
220 
221 /**
222  * See if a message is known to be from a certain zone.
223  * This looks for SOA or NS rrsets, for answers.
224  * For referrals, when one label is delegated, the zone is detected.
225  * Does not look at signatures.
226  * @param msg: the message to inspect.
227  * @param dp: delegation point with zone name to look for.
228  * @param type: type of message.
229  * @param dclass: class of query.
230  * @return true if message is certain to be from zone in dp->name.
231  *	false if not sure (empty msg), or not from the zone.
232  */
233 int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp,
234 	enum response_type type, uint16_t dclass);
235 
236 /**
237  * Check if two replies are equal
238  * For fallback procedures
239  * @param p: reply one. The reply has rrset data pointers in region.
240  * 	Does not check rrset-IDs
241  * @param q: reply two
242  * @param region: scratch buffer.
243  * @return if one and two are equal.
244  */
245 int reply_equal(struct reply_info* p, struct reply_info* q, struct regional* region);
246 
247 /**
248  * Remove unused bits from the reply if possible.
249  * So that caps-for-id (0x20) fallback is more likely to be successful.
250  * This removes like, the additional section, and NS record in the authority
251  * section if those records are gratuitous (not for a referral).
252  * @param rep: the reply to strip stuff out of.
253  */
254 void caps_strip_reply(struct reply_info* rep);
255 
256 /**
257  * see if reply has a 'useful' rcode for capsforid comparison, so
258  * not SERVFAIL or REFUSED, and thus NOERROR or NXDOMAIN.
259  * @param rep: reply to check.
260  * @return true if the rcode is a bad type of message.
261  */
262 int caps_failed_rcode(struct reply_info* rep);
263 
264 /**
265  * Store parent-side rrset in separate rrset cache entries for later
266  * last-resort * lookups in case the child-side versions of this information
267  * fails.
268  * @param env: environment with cache, time, ...
269  * @param rrset: the rrset to store (copied).
270  * Failure to store is logged, but otherwise ignored.
271  */
272 void iter_store_parentside_rrset(struct module_env* env,
273 	struct ub_packed_rrset_key* rrset);
274 
275 /**
276  * Store parent-side NS records from a referral message
277  * @param env: environment with cache, time, ...
278  * @param rep: response with NS rrset.
279  * Failure to store is logged, but otherwise ignored.
280  */
281 void iter_store_parentside_NS(struct module_env* env, struct reply_info* rep);
282 
283 /**
284  * Store parent-side negative element, the parentside rrset does not exist,
285  * creates an rrset with empty rdata in the rrset cache with PARENTSIDE flag.
286  * @param env: environment with cache, time, ...
287  * @param qinfo: the identity of the rrset that is missing.
288  * @param rep: delegation response or answer response, to glean TTL from.
289  * (malloc) failure is logged but otherwise ignored.
290  */
291 void iter_store_parentside_neg(struct module_env* env,
292 	struct query_info* qinfo, struct reply_info* rep);
293 
294 /**
295  * Add parent NS record if that exists in the cache.  This is both new
296  * information and acts like a timeout throttle on retries.
297  * @param env: query env with rrset cache and time.
298  * @param dp: delegation point to store result in.  Also this dp is used to
299  *	see which NS name is needed.
300  * @param region: region to alloc result in.
301  * @param qinfo: pertinent information, the qclass.
302  * @return false on malloc failure.
303  *	if true, the routine worked and if such cached information
304  *	existed dp->has_parent_side_NS is set true.
305  */
306 int iter_lookup_parent_NS_from_cache(struct module_env* env,
307 	struct delegpt* dp, struct regional* region, struct query_info* qinfo);
308 
309 /**
310  * Add parent-side glue if that exists in the cache.  This is both new
311  * information and acts like a timeout throttle on retries to fetch them.
312  * @param env: query env with rrset cache and time.
313  * @param dp: delegation point to store result in.  Also this dp is used to
314  *	see which NS name is needed.
315  * @param region: region to alloc result in.
316  * @param qinfo: pertinent information, the qclass.
317  * @return: true, it worked, no malloc failures, and new addresses (lame)
318  *	have been added, giving extra options as query targets.
319  */
320 int iter_lookup_parent_glue_from_cache(struct module_env* env,
321 	struct delegpt* dp, struct regional* region, struct query_info* qinfo);
322 
323 /**
324  * Lookup next root-hint or root-forward entry.
325  * @param hints: the hints.
326  * @param fwd: the forwards.
327  * @param c: the class to start searching at. 0 means find first one.
328  * @return false if no classes found, true if found and returned in c.
329  */
330 int iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd,
331 	uint16_t* c);
332 
333 /**
334  * Remove DS records that are inappropriate before they are cached.
335  * @param msg: the response to scrub.
336  * @param ns: RRSET that is the NS record for the referral.
337  * 	if NULL, then all DS records are removed from the authority section.
338  * @param z: zone name that the response is from.
339  */
340 void iter_scrub_ds(struct dns_msg* msg, struct ub_packed_rrset_key* ns,
341 	uint8_t* z);
342 
343 /**
344  * Prepare an NXDOMAIN message to be used for a subdomain answer by removing all
345  * RRs from the ANSWER section.
346  * @param msg: the response to scrub.
347  */
348 void iter_scrub_nxdomain(struct dns_msg* msg);
349 
350 /**
351  * Remove query attempts from all available ips. For 0x20.
352  * @param dp: delegpt.
353  * @param d: decrease.
354  * @param outbound_msg_retry: number of retries of outgoing queries
355  */
356 void iter_dec_attempts(struct delegpt* dp, int d, int outbound_msg_retry);
357 
358 /**
359  * Add retry counts from older delegpt to newer delegpt.
360  * Does not waste time on timeout'd (or other failing) addresses.
361  * @param dp: new delegationpoint.
362  * @param old: old delegationpoint.
363  * @param outbound_msg_retry: number of retries of outgoing queries
364  */
365 void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old,
366 	int outbound_msg_retry);
367 
368 /**
369  * See if a DS response (type ANSWER) is too low: a nodata answer with
370  * a SOA record in the authority section at-or-below the qchase.qname.
371  * Also returns true if we are not sure (i.e. empty message, CNAME nosig).
372  * @param msg: the response.
373  * @param dp: the dp name is used to check if the RRSIG gives a clue that
374  * 	it was originated from the correct nameserver.
375  * @return true if too low.
376  */
377 int iter_ds_toolow(struct dns_msg* msg, struct delegpt* dp);
378 
379 /**
380  * See if delegpt can go down a step to the qname or not
381  * @param qinfo: the query name looked up.
382  * @param dp: checked if the name can go lower to the qname
383  * @return true if can go down, false if that would not be possible.
384  * the current response seems to be the one and only, best possible, response.
385  */
386 int iter_dp_cangodown(struct query_info* qinfo, struct delegpt* dp);
387 
388 /**
389  * Lookup if no_cache is set in stub or fwd.
390  * @param qstate: query state with env with hints and fwds.
391  * @param qinf: query name to lookup for.
392  * @param retdpname: returns NULL or the deepest enclosing name of fwd or stub.
393  * 	This is the name under which the closest lookup is going to happen.
394  * 	Used for NXDOMAIN checks, above that it is an nxdomain from a
395  * 	different server and zone. You can pass NULL to not get it.
396  * @param retdpnamelen: returns the length of the dpname.
397  * @return true if no_cache is set in stub or fwd.
398  */
399 int iter_stub_fwd_no_cache(struct module_qstate *qstate,
400 	struct query_info *qinf, uint8_t** retdpname, size_t* retdpnamelen);
401 
402 /**
403  * Set support for IP4 and IP6 depending on outgoing interfaces
404  * in the outside network.  If none, no support, so no use to lookup
405  * the AAAA and then attempt to use it if there is no outgoing-interface
406  * for it.
407  * @param mods: modstack to find iterator module in.
408  * @param env: module env, find iterator module (if one) in there.
409  * @param outnet: outside network structure.
410  */
411 void iterator_set_ip46_support(struct module_stack* mods,
412 	struct module_env* env, struct outside_network* outnet);
413 
414 #endif /* ITERATOR_ITER_UTILS_H */
415