1 /* 2 * services/authzone.c - authoritative zone that is locally hosted. 3 * 4 * Copyright (c) 2017, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains the functions for an authority zone. This zone 40 * is queried by the iterator, just like a stub or forward zone, but then 41 * the data is locally held. 42 */ 43 44 #include "config.h" 45 #include "services/authzone.h" 46 #include "util/data/dname.h" 47 #include "util/data/msgparse.h" 48 #include "util/data/msgreply.h" 49 #include "util/data/msgencode.h" 50 #include "util/data/packed_rrset.h" 51 #include "util/regional.h" 52 #include "util/net_help.h" 53 #include "util/netevent.h" 54 #include "util/config_file.h" 55 #include "util/log.h" 56 #include "util/module.h" 57 #include "util/random.h" 58 #include "services/cache/dns.h" 59 #include "services/outside_network.h" 60 #include "services/listen_dnsport.h" 61 #include "services/mesh.h" 62 #include "sldns/rrdef.h" 63 #include "sldns/pkthdr.h" 64 #include "sldns/sbuffer.h" 65 #include "sldns/str2wire.h" 66 #include "sldns/wire2str.h" 67 #include "sldns/parseutil.h" 68 #include "sldns/keyraw.h" 69 #include "validator/val_nsec3.h" 70 #include "validator/val_secalgo.h" 71 #include <ctype.h> 72 73 /** bytes to use for NSEC3 hash buffer. 20 for sha1 */ 74 #define N3HASHBUFLEN 32 75 /** max number of CNAMEs we are willing to follow (in one answer) */ 76 #define MAX_CNAME_CHAIN 8 77 /** timeout for probe packets for SOA */ 78 #define AUTH_PROBE_TIMEOUT 100 /* msec */ 79 /** when to stop with SOA probes (when exponential timeouts exceed this) */ 80 #define AUTH_PROBE_TIMEOUT_STOP 1000 /* msec */ 81 /* auth transfer timeout for TCP connections, in msec */ 82 #define AUTH_TRANSFER_TIMEOUT 10000 /* msec */ 83 /* auth transfer max backoff for failed tranfers and probes */ 84 #define AUTH_TRANSFER_MAX_BACKOFF 86400 /* sec */ 85 /* auth http port number */ 86 #define AUTH_HTTP_PORT 80 87 /* auth https port number */ 88 #define AUTH_HTTPS_PORT 443 89 /* max depth for nested $INCLUDEs */ 90 #define MAX_INCLUDE_DEPTH 10 91 /** number of timeouts before we fallback from IXFR to AXFR, 92 * because some versions of servers (eg. dnsmasq) drop IXFR packets. */ 93 #define NUM_TIMEOUTS_FALLBACK_IXFR 3 94 95 /** pick up nextprobe task to start waiting to perform transfer actions */ 96 static void xfr_set_timeout(struct auth_xfer* xfr, struct module_env* env, 97 int failure, int lookup_only); 98 /** move to sending the probe packets, next if fails. task_probe */ 99 static void xfr_probe_send_or_end(struct auth_xfer* xfr, 100 struct module_env* env); 101 /** pick up probe task with specified(or NULL) destination first, 102 * or transfer task if nothing to probe, or false if already in progress */ 103 static int xfr_start_probe(struct auth_xfer* xfr, struct module_env* env, 104 struct auth_master* spec); 105 /** delete xfer structure (not its tree entry) */ 106 static void auth_xfer_delete(struct auth_xfer* xfr); 107 108 /** create new dns_msg */ 109 static struct dns_msg* 110 msg_create(struct regional* region, struct query_info* qinfo) 111 { 112 struct dns_msg* msg = (struct dns_msg*)regional_alloc(region, 113 sizeof(struct dns_msg)); 114 if(!msg) 115 return NULL; 116 msg->qinfo.qname = regional_alloc_init(region, qinfo->qname, 117 qinfo->qname_len); 118 if(!msg->qinfo.qname) 119 return NULL; 120 msg->qinfo.qname_len = qinfo->qname_len; 121 msg->qinfo.qtype = qinfo->qtype; 122 msg->qinfo.qclass = qinfo->qclass; 123 msg->qinfo.local_alias = NULL; 124 /* non-packed reply_info, because it needs to grow the array */ 125 msg->rep = (struct reply_info*)regional_alloc_zero(region, 126 sizeof(struct reply_info)-sizeof(struct rrset_ref)); 127 if(!msg->rep) 128 return NULL; 129 msg->rep->flags = (uint16_t)(BIT_QR | BIT_AA); 130 msg->rep->authoritative = 1; 131 msg->rep->qdcount = 1; 132 /* rrsets is NULL, no rrsets yet */ 133 return msg; 134 } 135 136 /** grow rrset array by one in msg */ 137 static int 138 msg_grow_array(struct regional* region, struct dns_msg* msg) 139 { 140 if(msg->rep->rrsets == NULL) { 141 msg->rep->rrsets = regional_alloc_zero(region, 142 sizeof(struct ub_packed_rrset_key*)*(msg->rep->rrset_count+1)); 143 if(!msg->rep->rrsets) 144 return 0; 145 } else { 146 struct ub_packed_rrset_key** rrsets_old = msg->rep->rrsets; 147 msg->rep->rrsets = regional_alloc_zero(region, 148 sizeof(struct ub_packed_rrset_key*)*(msg->rep->rrset_count+1)); 149 if(!msg->rep->rrsets) 150 return 0; 151 memmove(msg->rep->rrsets, rrsets_old, 152 sizeof(struct ub_packed_rrset_key*)*msg->rep->rrset_count); 153 } 154 return 1; 155 } 156 157 /** get ttl of rrset */ 158 static time_t 159 get_rrset_ttl(struct ub_packed_rrset_key* k) 160 { 161 struct packed_rrset_data* d = (struct packed_rrset_data*) 162 k->entry.data; 163 return d->ttl; 164 } 165 166 /** Copy rrset into region from domain-datanode and packet rrset */ 167 static struct ub_packed_rrset_key* 168 auth_packed_rrset_copy_region(struct auth_zone* z, struct auth_data* node, 169 struct auth_rrset* rrset, struct regional* region, time_t adjust) 170 { 171 struct ub_packed_rrset_key key; 172 memset(&key, 0, sizeof(key)); 173 key.entry.key = &key; 174 key.entry.data = rrset->data; 175 key.rk.dname = node->name; 176 key.rk.dname_len = node->namelen; 177 key.rk.type = htons(rrset->type); 178 key.rk.rrset_class = htons(z->dclass); 179 key.entry.hash = rrset_key_hash(&key.rk); 180 return packed_rrset_copy_region(&key, region, adjust); 181 } 182 183 /** fix up msg->rep TTL and prefetch ttl */ 184 static void 185 msg_ttl(struct dns_msg* msg) 186 { 187 if(msg->rep->rrset_count == 0) return; 188 if(msg->rep->rrset_count == 1) { 189 msg->rep->ttl = get_rrset_ttl(msg->rep->rrsets[0]); 190 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 191 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 192 } else if(get_rrset_ttl(msg->rep->rrsets[msg->rep->rrset_count-1]) < 193 msg->rep->ttl) { 194 msg->rep->ttl = get_rrset_ttl(msg->rep->rrsets[ 195 msg->rep->rrset_count-1]); 196 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 197 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 198 } 199 } 200 201 /** see if rrset is a duplicate in the answer message */ 202 static int 203 msg_rrset_duplicate(struct dns_msg* msg, uint8_t* nm, size_t nmlen, 204 uint16_t type, uint16_t dclass) 205 { 206 size_t i; 207 for(i=0; i<msg->rep->rrset_count; i++) { 208 struct ub_packed_rrset_key* k = msg->rep->rrsets[i]; 209 if(ntohs(k->rk.type) == type && k->rk.dname_len == nmlen && 210 ntohs(k->rk.rrset_class) == dclass && 211 query_dname_compare(k->rk.dname, nm) == 0) 212 return 1; 213 } 214 return 0; 215 } 216 217 /** add rrset to answer section (no auth, add rrsets yet) */ 218 static int 219 msg_add_rrset_an(struct auth_zone* z, struct regional* region, 220 struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset) 221 { 222 log_assert(msg->rep->ns_numrrsets == 0); 223 log_assert(msg->rep->ar_numrrsets == 0); 224 if(!rrset || !node) 225 return 1; 226 if(msg_rrset_duplicate(msg, node->name, node->namelen, rrset->type, 227 z->dclass)) 228 return 1; 229 /* grow array */ 230 if(!msg_grow_array(region, msg)) 231 return 0; 232 /* copy it */ 233 if(!(msg->rep->rrsets[msg->rep->rrset_count] = 234 auth_packed_rrset_copy_region(z, node, rrset, region, 0))) 235 return 0; 236 msg->rep->rrset_count++; 237 msg->rep->an_numrrsets++; 238 msg_ttl(msg); 239 return 1; 240 } 241 242 /** add rrset to authority section (no additonal section rrsets yet) */ 243 static int 244 msg_add_rrset_ns(struct auth_zone* z, struct regional* region, 245 struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset) 246 { 247 log_assert(msg->rep->ar_numrrsets == 0); 248 if(!rrset || !node) 249 return 1; 250 if(msg_rrset_duplicate(msg, node->name, node->namelen, rrset->type, 251 z->dclass)) 252 return 1; 253 /* grow array */ 254 if(!msg_grow_array(region, msg)) 255 return 0; 256 /* copy it */ 257 if(!(msg->rep->rrsets[msg->rep->rrset_count] = 258 auth_packed_rrset_copy_region(z, node, rrset, region, 0))) 259 return 0; 260 msg->rep->rrset_count++; 261 msg->rep->ns_numrrsets++; 262 msg_ttl(msg); 263 return 1; 264 } 265 266 /** add rrset to additional section */ 267 static int 268 msg_add_rrset_ar(struct auth_zone* z, struct regional* region, 269 struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset) 270 { 271 if(!rrset || !node) 272 return 1; 273 if(msg_rrset_duplicate(msg, node->name, node->namelen, rrset->type, 274 z->dclass)) 275 return 1; 276 /* grow array */ 277 if(!msg_grow_array(region, msg)) 278 return 0; 279 /* copy it */ 280 if(!(msg->rep->rrsets[msg->rep->rrset_count] = 281 auth_packed_rrset_copy_region(z, node, rrset, region, 0))) 282 return 0; 283 msg->rep->rrset_count++; 284 msg->rep->ar_numrrsets++; 285 msg_ttl(msg); 286 return 1; 287 } 288 289 struct auth_zones* auth_zones_create(void) 290 { 291 struct auth_zones* az = (struct auth_zones*)calloc(1, sizeof(*az)); 292 if(!az) { 293 log_err("out of memory"); 294 return NULL; 295 } 296 rbtree_init(&az->ztree, &auth_zone_cmp); 297 rbtree_init(&az->xtree, &auth_xfer_cmp); 298 lock_rw_init(&az->lock); 299 lock_protect(&az->lock, &az->ztree, sizeof(az->ztree)); 300 lock_protect(&az->lock, &az->xtree, sizeof(az->xtree)); 301 /* also lock protects the rbnode's in struct auth_zone, auth_xfer */ 302 lock_rw_init(&az->rpz_lock); 303 lock_protect(&az->rpz_lock, &az->rpz_first, sizeof(az->rpz_first)); 304 return az; 305 } 306 307 int auth_zone_cmp(const void* z1, const void* z2) 308 { 309 /* first sort on class, so that hierarchy can be maintained within 310 * a class */ 311 struct auth_zone* a = (struct auth_zone*)z1; 312 struct auth_zone* b = (struct auth_zone*)z2; 313 int m; 314 if(a->dclass != b->dclass) { 315 if(a->dclass < b->dclass) 316 return -1; 317 return 1; 318 } 319 /* sorted such that higher zones sort before lower zones (their 320 * contents) */ 321 return dname_lab_cmp(a->name, a->namelabs, b->name, b->namelabs, &m); 322 } 323 324 int auth_data_cmp(const void* z1, const void* z2) 325 { 326 struct auth_data* a = (struct auth_data*)z1; 327 struct auth_data* b = (struct auth_data*)z2; 328 int m; 329 /* canonical sort, because DNSSEC needs that */ 330 return dname_canon_lab_cmp(a->name, a->namelabs, b->name, 331 b->namelabs, &m); 332 } 333 334 int auth_xfer_cmp(const void* z1, const void* z2) 335 { 336 /* first sort on class, so that hierarchy can be maintained within 337 * a class */ 338 struct auth_xfer* a = (struct auth_xfer*)z1; 339 struct auth_xfer* b = (struct auth_xfer*)z2; 340 int m; 341 if(a->dclass != b->dclass) { 342 if(a->dclass < b->dclass) 343 return -1; 344 return 1; 345 } 346 /* sorted such that higher zones sort before lower zones (their 347 * contents) */ 348 return dname_lab_cmp(a->name, a->namelabs, b->name, b->namelabs, &m); 349 } 350 351 /** delete auth rrset node */ 352 static void 353 auth_rrset_delete(struct auth_rrset* rrset) 354 { 355 if(!rrset) return; 356 free(rrset->data); 357 free(rrset); 358 } 359 360 /** delete auth data domain node */ 361 static void 362 auth_data_delete(struct auth_data* n) 363 { 364 struct auth_rrset* p, *np; 365 if(!n) return; 366 p = n->rrsets; 367 while(p) { 368 np = p->next; 369 auth_rrset_delete(p); 370 p = np; 371 } 372 free(n->name); 373 free(n); 374 } 375 376 /** helper traverse to delete zones */ 377 static void 378 auth_data_del(rbnode_type* n, void* ATTR_UNUSED(arg)) 379 { 380 struct auth_data* z = (struct auth_data*)n->key; 381 auth_data_delete(z); 382 } 383 384 /** delete an auth zone structure (tree remove must be done elsewhere) */ 385 static void 386 auth_zone_delete(struct auth_zone* z, struct auth_zones* az) 387 { 388 if(!z) return; 389 lock_rw_destroy(&z->lock); 390 traverse_postorder(&z->data, auth_data_del, NULL); 391 392 if(az && z->rpz) { 393 /* keep RPZ linked list intact */ 394 lock_rw_wrlock(&az->rpz_lock); 395 if(z->rpz_az_prev) 396 z->rpz_az_prev->rpz_az_next = z->rpz_az_next; 397 else 398 az->rpz_first = z->rpz_az_next; 399 if(z->rpz_az_next) 400 z->rpz_az_next->rpz_az_prev = z->rpz_az_prev; 401 lock_rw_unlock(&az->rpz_lock); 402 } 403 if(z->rpz) 404 rpz_delete(z->rpz); 405 free(z->name); 406 free(z->zonefile); 407 free(z); 408 } 409 410 struct auth_zone* 411 auth_zone_create(struct auth_zones* az, uint8_t* nm, size_t nmlen, 412 uint16_t dclass) 413 { 414 struct auth_zone* z = (struct auth_zone*)calloc(1, sizeof(*z)); 415 if(!z) { 416 return NULL; 417 } 418 z->node.key = z; 419 z->dclass = dclass; 420 z->namelen = nmlen; 421 z->namelabs = dname_count_labels(nm); 422 z->name = memdup(nm, nmlen); 423 if(!z->name) { 424 free(z); 425 return NULL; 426 } 427 rbtree_init(&z->data, &auth_data_cmp); 428 lock_rw_init(&z->lock); 429 lock_protect(&z->lock, &z->name, sizeof(*z)-sizeof(rbnode_type)- 430 sizeof(&z->rpz_az_next)-sizeof(&z->rpz_az_prev)); 431 lock_rw_wrlock(&z->lock); 432 /* z lock protects all, except rbtree itself and the rpz linked list 433 * pointers, which are protected using az->lock */ 434 if(!rbtree_insert(&az->ztree, &z->node)) { 435 lock_rw_unlock(&z->lock); 436 auth_zone_delete(z, NULL); 437 log_warn("duplicate auth zone"); 438 return NULL; 439 } 440 return z; 441 } 442 443 struct auth_zone* 444 auth_zone_find(struct auth_zones* az, uint8_t* nm, size_t nmlen, 445 uint16_t dclass) 446 { 447 struct auth_zone key; 448 key.node.key = &key; 449 key.dclass = dclass; 450 key.name = nm; 451 key.namelen = nmlen; 452 key.namelabs = dname_count_labels(nm); 453 return (struct auth_zone*)rbtree_search(&az->ztree, &key); 454 } 455 456 struct auth_xfer* 457 auth_xfer_find(struct auth_zones* az, uint8_t* nm, size_t nmlen, 458 uint16_t dclass) 459 { 460 struct auth_xfer key; 461 key.node.key = &key; 462 key.dclass = dclass; 463 key.name = nm; 464 key.namelen = nmlen; 465 key.namelabs = dname_count_labels(nm); 466 return (struct auth_xfer*)rbtree_search(&az->xtree, &key); 467 } 468 469 /** find an auth zone or sorted less-or-equal, return true if exact */ 470 static int 471 auth_zone_find_less_equal(struct auth_zones* az, uint8_t* nm, size_t nmlen, 472 uint16_t dclass, struct auth_zone** z) 473 { 474 struct auth_zone key; 475 key.node.key = &key; 476 key.dclass = dclass; 477 key.name = nm; 478 key.namelen = nmlen; 479 key.namelabs = dname_count_labels(nm); 480 return rbtree_find_less_equal(&az->ztree, &key, (rbnode_type**)z); 481 } 482 483 484 /** find the auth zone that is above the given name */ 485 struct auth_zone* 486 auth_zones_find_zone(struct auth_zones* az, uint8_t* name, size_t name_len, 487 uint16_t dclass) 488 { 489 uint8_t* nm = name; 490 size_t nmlen = name_len; 491 struct auth_zone* z; 492 if(auth_zone_find_less_equal(az, nm, nmlen, dclass, &z)) { 493 /* exact match */ 494 return z; 495 } else { 496 /* less-or-nothing */ 497 if(!z) return NULL; /* nothing smaller, nothing above it */ 498 /* we found smaller name; smaller may be above the name, 499 * but not below it. */ 500 nm = dname_get_shared_topdomain(z->name, name); 501 dname_count_size_labels(nm, &nmlen); 502 z = NULL; 503 } 504 505 /* search up */ 506 while(!z) { 507 z = auth_zone_find(az, nm, nmlen, dclass); 508 if(z) return z; 509 if(dname_is_root(nm)) break; 510 dname_remove_label(&nm, &nmlen); 511 } 512 return NULL; 513 } 514 515 /** find or create zone with name str. caller must have lock on az. 516 * returns a wrlocked zone */ 517 static struct auth_zone* 518 auth_zones_find_or_add_zone(struct auth_zones* az, char* name) 519 { 520 uint8_t nm[LDNS_MAX_DOMAINLEN+1]; 521 size_t nmlen = sizeof(nm); 522 struct auth_zone* z; 523 524 if(sldns_str2wire_dname_buf(name, nm, &nmlen) != 0) { 525 log_err("cannot parse auth zone name: %s", name); 526 return 0; 527 } 528 z = auth_zone_find(az, nm, nmlen, LDNS_RR_CLASS_IN); 529 if(!z) { 530 /* not found, create the zone */ 531 z = auth_zone_create(az, nm, nmlen, LDNS_RR_CLASS_IN); 532 } else { 533 lock_rw_wrlock(&z->lock); 534 } 535 return z; 536 } 537 538 /** find or create xfer zone with name str. caller must have lock on az. 539 * returns a locked xfer */ 540 static struct auth_xfer* 541 auth_zones_find_or_add_xfer(struct auth_zones* az, struct auth_zone* z) 542 { 543 struct auth_xfer* x; 544 x = auth_xfer_find(az, z->name, z->namelen, z->dclass); 545 if(!x) { 546 /* not found, create the zone */ 547 x = auth_xfer_create(az, z); 548 } else { 549 lock_basic_lock(&x->lock); 550 } 551 return x; 552 } 553 554 int 555 auth_zone_set_zonefile(struct auth_zone* z, char* zonefile) 556 { 557 if(z->zonefile) free(z->zonefile); 558 if(zonefile == NULL) { 559 z->zonefile = NULL; 560 } else { 561 z->zonefile = strdup(zonefile); 562 if(!z->zonefile) { 563 log_err("malloc failure"); 564 return 0; 565 } 566 } 567 return 1; 568 } 569 570 /** set auth zone fallback. caller must have lock on zone */ 571 int 572 auth_zone_set_fallback(struct auth_zone* z, char* fallbackstr) 573 { 574 if(strcmp(fallbackstr, "yes") != 0 && strcmp(fallbackstr, "no") != 0){ 575 log_err("auth zone fallback, expected yes or no, got %s", 576 fallbackstr); 577 return 0; 578 } 579 z->fallback_enabled = (strcmp(fallbackstr, "yes")==0); 580 return 1; 581 } 582 583 /** create domain with the given name */ 584 static struct auth_data* 585 az_domain_create(struct auth_zone* z, uint8_t* nm, size_t nmlen) 586 { 587 struct auth_data* n = (struct auth_data*)malloc(sizeof(*n)); 588 if(!n) return NULL; 589 memset(n, 0, sizeof(*n)); 590 n->node.key = n; 591 n->name = memdup(nm, nmlen); 592 if(!n->name) { 593 free(n); 594 return NULL; 595 } 596 n->namelen = nmlen; 597 n->namelabs = dname_count_labels(nm); 598 if(!rbtree_insert(&z->data, &n->node)) { 599 log_warn("duplicate auth domain name"); 600 free(n->name); 601 free(n); 602 return NULL; 603 } 604 return n; 605 } 606 607 /** find domain with exactly the given name */ 608 static struct auth_data* 609 az_find_name(struct auth_zone* z, uint8_t* nm, size_t nmlen) 610 { 611 struct auth_zone key; 612 key.node.key = &key; 613 key.name = nm; 614 key.namelen = nmlen; 615 key.namelabs = dname_count_labels(nm); 616 return (struct auth_data*)rbtree_search(&z->data, &key); 617 } 618 619 /** Find domain name (or closest match) */ 620 static void 621 az_find_domain(struct auth_zone* z, struct query_info* qinfo, int* node_exact, 622 struct auth_data** node) 623 { 624 struct auth_zone key; 625 key.node.key = &key; 626 key.name = qinfo->qname; 627 key.namelen = qinfo->qname_len; 628 key.namelabs = dname_count_labels(key.name); 629 *node_exact = rbtree_find_less_equal(&z->data, &key, 630 (rbnode_type**)node); 631 } 632 633 /** find or create domain with name in zone */ 634 static struct auth_data* 635 az_domain_find_or_create(struct auth_zone* z, uint8_t* dname, 636 size_t dname_len) 637 { 638 struct auth_data* n = az_find_name(z, dname, dname_len); 639 if(!n) { 640 n = az_domain_create(z, dname, dname_len); 641 } 642 return n; 643 } 644 645 /** find rrset of given type in the domain */ 646 static struct auth_rrset* 647 az_domain_rrset(struct auth_data* n, uint16_t t) 648 { 649 struct auth_rrset* rrset; 650 if(!n) return NULL; 651 rrset = n->rrsets; 652 while(rrset) { 653 if(rrset->type == t) 654 return rrset; 655 rrset = rrset->next; 656 } 657 return NULL; 658 } 659 660 /** remove rrset of this type from domain */ 661 static void 662 domain_remove_rrset(struct auth_data* node, uint16_t rr_type) 663 { 664 struct auth_rrset* rrset, *prev; 665 if(!node) return; 666 prev = NULL; 667 rrset = node->rrsets; 668 while(rrset) { 669 if(rrset->type == rr_type) { 670 /* found it, now delete it */ 671 if(prev) prev->next = rrset->next; 672 else node->rrsets = rrset->next; 673 auth_rrset_delete(rrset); 674 return; 675 } 676 prev = rrset; 677 rrset = rrset->next; 678 } 679 } 680 681 /** find an rrsig index in the rrset. returns true if found */ 682 static int 683 az_rrset_find_rrsig(struct packed_rrset_data* d, uint8_t* rdata, size_t len, 684 size_t* index) 685 { 686 size_t i; 687 for(i=d->count; i<d->count + d->rrsig_count; i++) { 688 if(d->rr_len[i] != len) 689 continue; 690 if(memcmp(d->rr_data[i], rdata, len) == 0) { 691 *index = i; 692 return 1; 693 } 694 } 695 return 0; 696 } 697 698 /** see if rdata is duplicate */ 699 static int 700 rdata_duplicate(struct packed_rrset_data* d, uint8_t* rdata, size_t len) 701 { 702 size_t i; 703 for(i=0; i<d->count + d->rrsig_count; i++) { 704 if(d->rr_len[i] != len) 705 continue; 706 if(memcmp(d->rr_data[i], rdata, len) == 0) 707 return 1; 708 } 709 return 0; 710 } 711 712 /** get rrsig type covered from rdata. 713 * @param rdata: rdata in wireformat, starting with 16bit rdlength. 714 * @param rdatalen: length of rdata buffer. 715 * @return type covered (or 0). 716 */ 717 static uint16_t 718 rrsig_rdata_get_type_covered(uint8_t* rdata, size_t rdatalen) 719 { 720 if(rdatalen < 4) 721 return 0; 722 return sldns_read_uint16(rdata+2); 723 } 724 725 /** remove RR from existing RRset. Also sig, if it is a signature. 726 * reallocates the packed rrset for a new one, false on alloc failure */ 727 static int 728 rrset_remove_rr(struct auth_rrset* rrset, size_t index) 729 { 730 struct packed_rrset_data* d, *old = rrset->data; 731 size_t i; 732 if(index >= old->count + old->rrsig_count) 733 return 0; /* index out of bounds */ 734 d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old) - ( 735 sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t) + 736 old->rr_len[index])); 737 if(!d) { 738 log_err("malloc failure"); 739 return 0; 740 } 741 d->ttl = old->ttl; 742 d->count = old->count; 743 d->rrsig_count = old->rrsig_count; 744 if(index < d->count) d->count--; 745 else d->rrsig_count--; 746 d->trust = old->trust; 747 d->security = old->security; 748 749 /* set rr_len, needed for ptr_fixup */ 750 d->rr_len = (size_t*)((uint8_t*)d + 751 sizeof(struct packed_rrset_data)); 752 if(index > 0) 753 memmove(d->rr_len, old->rr_len, (index)*sizeof(size_t)); 754 if(index+1 < old->count+old->rrsig_count) 755 memmove(&d->rr_len[index], &old->rr_len[index+1], 756 (old->count+old->rrsig_count - (index+1))*sizeof(size_t)); 757 packed_rrset_ptr_fixup(d); 758 759 /* move over ttls */ 760 if(index > 0) 761 memmove(d->rr_ttl, old->rr_ttl, (index)*sizeof(time_t)); 762 if(index+1 < old->count+old->rrsig_count) 763 memmove(&d->rr_ttl[index], &old->rr_ttl[index+1], 764 (old->count+old->rrsig_count - (index+1))*sizeof(time_t)); 765 766 /* move over rr_data */ 767 for(i=0; i<d->count+d->rrsig_count; i++) { 768 size_t oldi; 769 if(i < index) oldi = i; 770 else oldi = i+1; 771 memmove(d->rr_data[i], old->rr_data[oldi], d->rr_len[i]); 772 } 773 774 /* recalc ttl (lowest of remaining RR ttls) */ 775 if(d->count + d->rrsig_count > 0) 776 d->ttl = d->rr_ttl[0]; 777 for(i=0; i<d->count+d->rrsig_count; i++) { 778 if(d->rr_ttl[i] < d->ttl) 779 d->ttl = d->rr_ttl[i]; 780 } 781 782 free(rrset->data); 783 rrset->data = d; 784 return 1; 785 } 786 787 /** add RR to existing RRset. If insert_sig is true, add to rrsigs. 788 * This reallocates the packed rrset for a new one */ 789 static int 790 rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata, 791 size_t rdatalen, int insert_sig) 792 { 793 struct packed_rrset_data* d, *old = rrset->data; 794 size_t total, old_total; 795 796 d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old) 797 + sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t) 798 + rdatalen); 799 if(!d) { 800 log_err("out of memory"); 801 return 0; 802 } 803 /* copy base values */ 804 memcpy(d, old, sizeof(struct packed_rrset_data)); 805 if(!insert_sig) { 806 d->count++; 807 } else { 808 d->rrsig_count++; 809 } 810 old_total = old->count + old->rrsig_count; 811 total = d->count + d->rrsig_count; 812 /* set rr_len, needed for ptr_fixup */ 813 d->rr_len = (size_t*)((uint8_t*)d + 814 sizeof(struct packed_rrset_data)); 815 if(old->count != 0) 816 memmove(d->rr_len, old->rr_len, old->count*sizeof(size_t)); 817 if(old->rrsig_count != 0) 818 memmove(d->rr_len+d->count, old->rr_len+old->count, 819 old->rrsig_count*sizeof(size_t)); 820 if(!insert_sig) 821 d->rr_len[d->count-1] = rdatalen; 822 else d->rr_len[total-1] = rdatalen; 823 packed_rrset_ptr_fixup(d); 824 if((time_t)rr_ttl < d->ttl) 825 d->ttl = rr_ttl; 826 827 /* copy old values into new array */ 828 if(old->count != 0) { 829 memmove(d->rr_ttl, old->rr_ttl, old->count*sizeof(time_t)); 830 /* all the old rr pieces are allocated sequential, so we 831 * can copy them in one go */ 832 memmove(d->rr_data[0], old->rr_data[0], 833 (old->rr_data[old->count-1] - old->rr_data[0]) + 834 old->rr_len[old->count-1]); 835 } 836 if(old->rrsig_count != 0) { 837 memmove(d->rr_ttl+d->count, old->rr_ttl+old->count, 838 old->rrsig_count*sizeof(time_t)); 839 memmove(d->rr_data[d->count], old->rr_data[old->count], 840 (old->rr_data[old_total-1] - old->rr_data[old->count]) + 841 old->rr_len[old_total-1]); 842 } 843 844 /* insert new value */ 845 if(!insert_sig) { 846 d->rr_ttl[d->count-1] = rr_ttl; 847 memmove(d->rr_data[d->count-1], rdata, rdatalen); 848 } else { 849 d->rr_ttl[total-1] = rr_ttl; 850 memmove(d->rr_data[total-1], rdata, rdatalen); 851 } 852 853 rrset->data = d; 854 free(old); 855 return 1; 856 } 857 858 /** Create new rrset for node with packed rrset with one RR element */ 859 static struct auth_rrset* 860 rrset_create(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl, 861 uint8_t* rdata, size_t rdatalen) 862 { 863 struct auth_rrset* rrset = (struct auth_rrset*)calloc(1, 864 sizeof(*rrset)); 865 struct auth_rrset* p, *prev; 866 struct packed_rrset_data* d; 867 if(!rrset) { 868 log_err("out of memory"); 869 return NULL; 870 } 871 rrset->type = rr_type; 872 873 /* the rrset data structure, with one RR */ 874 d = (struct packed_rrset_data*)calloc(1, 875 sizeof(struct packed_rrset_data) + sizeof(size_t) + 876 sizeof(uint8_t*) + sizeof(time_t) + rdatalen); 877 if(!d) { 878 free(rrset); 879 log_err("out of memory"); 880 return NULL; 881 } 882 rrset->data = d; 883 d->ttl = rr_ttl; 884 d->trust = rrset_trust_prim_noglue; 885 d->rr_len = (size_t*)((uint8_t*)d + sizeof(struct packed_rrset_data)); 886 d->rr_data = (uint8_t**)&(d->rr_len[1]); 887 d->rr_ttl = (time_t*)&(d->rr_data[1]); 888 d->rr_data[0] = (uint8_t*)&(d->rr_ttl[1]); 889 890 /* insert the RR */ 891 d->rr_len[0] = rdatalen; 892 d->rr_ttl[0] = rr_ttl; 893 memmove(d->rr_data[0], rdata, rdatalen); 894 d->count++; 895 896 /* insert rrset into linked list for domain */ 897 /* find sorted place to link the rrset into the list */ 898 prev = NULL; 899 p = node->rrsets; 900 while(p && p->type<=rr_type) { 901 prev = p; 902 p = p->next; 903 } 904 /* so, prev is smaller, and p is larger than rr_type */ 905 rrset->next = p; 906 if(prev) prev->next = rrset; 907 else node->rrsets = rrset; 908 return rrset; 909 } 910 911 /** count number (and size) of rrsigs that cover a type */ 912 static size_t 913 rrsig_num_that_cover(struct auth_rrset* rrsig, uint16_t rr_type, size_t* sigsz) 914 { 915 struct packed_rrset_data* d = rrsig->data; 916 size_t i, num = 0; 917 *sigsz = 0; 918 log_assert(d && rrsig->type == LDNS_RR_TYPE_RRSIG); 919 for(i=0; i<d->count+d->rrsig_count; i++) { 920 if(rrsig_rdata_get_type_covered(d->rr_data[i], 921 d->rr_len[i]) == rr_type) { 922 num++; 923 (*sigsz) += d->rr_len[i]; 924 } 925 } 926 return num; 927 } 928 929 /** See if rrsig set has covered sigs for rrset and move them over */ 930 static int 931 rrset_moveover_rrsigs(struct auth_data* node, uint16_t rr_type, 932 struct auth_rrset* rrset, struct auth_rrset* rrsig) 933 { 934 size_t sigs, sigsz, i, j, total; 935 struct packed_rrset_data* sigold = rrsig->data; 936 struct packed_rrset_data* old = rrset->data; 937 struct packed_rrset_data* d, *sigd; 938 939 log_assert(rrset->type == rr_type); 940 log_assert(rrsig->type == LDNS_RR_TYPE_RRSIG); 941 sigs = rrsig_num_that_cover(rrsig, rr_type, &sigsz); 942 if(sigs == 0) { 943 /* 0 rrsigs to move over, done */ 944 return 1; 945 } 946 947 /* allocate rrset sigsz larger for extra sigs elements, and 948 * allocate rrsig sigsz smaller for less sigs elements. */ 949 d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old) 950 + sigs*(sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t)) 951 + sigsz); 952 if(!d) { 953 log_err("out of memory"); 954 return 0; 955 } 956 /* copy base values */ 957 total = old->count + old->rrsig_count; 958 memcpy(d, old, sizeof(struct packed_rrset_data)); 959 d->rrsig_count += sigs; 960 /* setup rr_len */ 961 d->rr_len = (size_t*)((uint8_t*)d + 962 sizeof(struct packed_rrset_data)); 963 if(total != 0) 964 memmove(d->rr_len, old->rr_len, total*sizeof(size_t)); 965 j = d->count+d->rrsig_count-sigs; 966 for(i=0; i<sigold->count+sigold->rrsig_count; i++) { 967 if(rrsig_rdata_get_type_covered(sigold->rr_data[i], 968 sigold->rr_len[i]) == rr_type) { 969 d->rr_len[j] = sigold->rr_len[i]; 970 j++; 971 } 972 } 973 packed_rrset_ptr_fixup(d); 974 975 /* copy old values into new array */ 976 if(total != 0) { 977 memmove(d->rr_ttl, old->rr_ttl, total*sizeof(time_t)); 978 /* all the old rr pieces are allocated sequential, so we 979 * can copy them in one go */ 980 memmove(d->rr_data[0], old->rr_data[0], 981 (old->rr_data[total-1] - old->rr_data[0]) + 982 old->rr_len[total-1]); 983 } 984 985 /* move over the rrsigs to the larger rrset*/ 986 j = d->count+d->rrsig_count-sigs; 987 for(i=0; i<sigold->count+sigold->rrsig_count; i++) { 988 if(rrsig_rdata_get_type_covered(sigold->rr_data[i], 989 sigold->rr_len[i]) == rr_type) { 990 /* move this one over to location j */ 991 d->rr_ttl[j] = sigold->rr_ttl[i]; 992 memmove(d->rr_data[j], sigold->rr_data[i], 993 sigold->rr_len[i]); 994 if(d->rr_ttl[j] < d->ttl) 995 d->ttl = d->rr_ttl[j]; 996 j++; 997 } 998 } 999 1000 /* put it in and deallocate the old rrset */ 1001 rrset->data = d; 1002 free(old); 1003 1004 /* now make rrsig set smaller */ 1005 if(sigold->count+sigold->rrsig_count == sigs) { 1006 /* remove all sigs from rrsig, remove it entirely */ 1007 domain_remove_rrset(node, LDNS_RR_TYPE_RRSIG); 1008 return 1; 1009 } 1010 log_assert(packed_rrset_sizeof(sigold) > sigs*(sizeof(size_t) + 1011 sizeof(uint8_t*) + sizeof(time_t)) + sigsz); 1012 sigd = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(sigold) 1013 - sigs*(sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t)) 1014 - sigsz); 1015 if(!sigd) { 1016 /* no need to free up d, it has already been placed in the 1017 * node->rrset structure */ 1018 log_err("out of memory"); 1019 return 0; 1020 } 1021 /* copy base values */ 1022 memcpy(sigd, sigold, sizeof(struct packed_rrset_data)); 1023 /* in sigd the RRSIGs are stored in the base of the RR, in count */ 1024 sigd->count -= sigs; 1025 /* setup rr_len */ 1026 sigd->rr_len = (size_t*)((uint8_t*)sigd + 1027 sizeof(struct packed_rrset_data)); 1028 j = 0; 1029 for(i=0; i<sigold->count+sigold->rrsig_count; i++) { 1030 if(rrsig_rdata_get_type_covered(sigold->rr_data[i], 1031 sigold->rr_len[i]) != rr_type) { 1032 sigd->rr_len[j] = sigold->rr_len[i]; 1033 j++; 1034 } 1035 } 1036 packed_rrset_ptr_fixup(sigd); 1037 1038 /* copy old values into new rrsig array */ 1039 j = 0; 1040 for(i=0; i<sigold->count+sigold->rrsig_count; i++) { 1041 if(rrsig_rdata_get_type_covered(sigold->rr_data[i], 1042 sigold->rr_len[i]) != rr_type) { 1043 /* move this one over to location j */ 1044 sigd->rr_ttl[j] = sigold->rr_ttl[i]; 1045 memmove(sigd->rr_data[j], sigold->rr_data[i], 1046 sigold->rr_len[i]); 1047 if(j==0) sigd->ttl = sigd->rr_ttl[j]; 1048 else { 1049 if(sigd->rr_ttl[j] < sigd->ttl) 1050 sigd->ttl = sigd->rr_ttl[j]; 1051 } 1052 j++; 1053 } 1054 } 1055 1056 /* put it in and deallocate the old rrset */ 1057 rrsig->data = sigd; 1058 free(sigold); 1059 1060 return 1; 1061 } 1062 1063 /** copy the rrsigs from the rrset to the rrsig rrset, because the rrset 1064 * is going to be deleted. reallocates the RRSIG rrset data. */ 1065 static int 1066 rrsigs_copy_from_rrset_to_rrsigset(struct auth_rrset* rrset, 1067 struct auth_rrset* rrsigset) 1068 { 1069 size_t i; 1070 if(rrset->data->rrsig_count == 0) 1071 return 1; 1072 1073 /* move them over one by one, because there might be duplicates, 1074 * duplicates are ignored */ 1075 for(i=rrset->data->count; 1076 i<rrset->data->count+rrset->data->rrsig_count; i++) { 1077 uint8_t* rdata = rrset->data->rr_data[i]; 1078 size_t rdatalen = rrset->data->rr_len[i]; 1079 time_t rr_ttl = rrset->data->rr_ttl[i]; 1080 1081 if(rdata_duplicate(rrsigset->data, rdata, rdatalen)) { 1082 continue; 1083 } 1084 if(!rrset_add_rr(rrsigset, rr_ttl, rdata, rdatalen, 0)) 1085 return 0; 1086 } 1087 return 1; 1088 } 1089 1090 /** Add rr to node, ignores duplicate RRs, 1091 * rdata points to buffer with rdatalen octets, starts with 2bytelength. */ 1092 static int 1093 az_domain_add_rr(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl, 1094 uint8_t* rdata, size_t rdatalen, int* duplicate) 1095 { 1096 struct auth_rrset* rrset; 1097 /* packed rrsets have their rrsigs along with them, sort them out */ 1098 if(rr_type == LDNS_RR_TYPE_RRSIG) { 1099 uint16_t ctype = rrsig_rdata_get_type_covered(rdata, rdatalen); 1100 if((rrset=az_domain_rrset(node, ctype))!= NULL) { 1101 /* a node of the correct type exists, add the RRSIG 1102 * to the rrset of the covered data type */ 1103 if(rdata_duplicate(rrset->data, rdata, rdatalen)) { 1104 if(duplicate) *duplicate = 1; 1105 return 1; 1106 } 1107 if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 1)) 1108 return 0; 1109 } else if((rrset=az_domain_rrset(node, rr_type))!= NULL) { 1110 /* add RRSIG to rrset of type RRSIG */ 1111 if(rdata_duplicate(rrset->data, rdata, rdatalen)) { 1112 if(duplicate) *duplicate = 1; 1113 return 1; 1114 } 1115 if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 0)) 1116 return 0; 1117 } else { 1118 /* create rrset of type RRSIG */ 1119 if(!rrset_create(node, rr_type, rr_ttl, rdata, 1120 rdatalen)) 1121 return 0; 1122 } 1123 } else { 1124 /* normal RR type */ 1125 if((rrset=az_domain_rrset(node, rr_type))!= NULL) { 1126 /* add data to existing node with data type */ 1127 if(rdata_duplicate(rrset->data, rdata, rdatalen)) { 1128 if(duplicate) *duplicate = 1; 1129 return 1; 1130 } 1131 if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 0)) 1132 return 0; 1133 } else { 1134 struct auth_rrset* rrsig; 1135 /* create new node with data type */ 1136 if(!(rrset=rrset_create(node, rr_type, rr_ttl, rdata, 1137 rdatalen))) 1138 return 0; 1139 1140 /* see if node of type RRSIG has signatures that 1141 * cover the data type, and move them over */ 1142 /* and then make the RRSIG type smaller */ 1143 if((rrsig=az_domain_rrset(node, LDNS_RR_TYPE_RRSIG)) 1144 != NULL) { 1145 if(!rrset_moveover_rrsigs(node, rr_type, 1146 rrset, rrsig)) 1147 return 0; 1148 } 1149 } 1150 } 1151 return 1; 1152 } 1153 1154 /** insert RR into zone, ignore duplicates */ 1155 static int 1156 az_insert_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len, 1157 size_t dname_len, int* duplicate) 1158 { 1159 struct auth_data* node; 1160 uint8_t* dname = rr; 1161 uint16_t rr_type = sldns_wirerr_get_type(rr, rr_len, dname_len); 1162 uint16_t rr_class = sldns_wirerr_get_class(rr, rr_len, dname_len); 1163 uint32_t rr_ttl = sldns_wirerr_get_ttl(rr, rr_len, dname_len); 1164 size_t rdatalen = ((size_t)sldns_wirerr_get_rdatalen(rr, rr_len, 1165 dname_len))+2; 1166 /* rdata points to rdata prefixed with uint16 rdatalength */ 1167 uint8_t* rdata = sldns_wirerr_get_rdatawl(rr, rr_len, dname_len); 1168 1169 if(rr_class != z->dclass) { 1170 log_err("wrong class for RR"); 1171 return 0; 1172 } 1173 if(!(node=az_domain_find_or_create(z, dname, dname_len))) { 1174 log_err("cannot create domain"); 1175 return 0; 1176 } 1177 if(!az_domain_add_rr(node, rr_type, rr_ttl, rdata, rdatalen, 1178 duplicate)) { 1179 log_err("cannot add RR to domain"); 1180 return 0; 1181 } 1182 if(z->rpz) { 1183 if(!(rpz_insert_rr(z->rpz, z->name, z->namelen, dname, 1184 dname_len, rr_type, rr_class, rr_ttl, rdata, rdatalen, 1185 rr, rr_len))) 1186 return 0; 1187 } 1188 return 1; 1189 } 1190 1191 /** Remove rr from node, ignores nonexisting RRs, 1192 * rdata points to buffer with rdatalen octets, starts with 2bytelength. */ 1193 static int 1194 az_domain_remove_rr(struct auth_data* node, uint16_t rr_type, 1195 uint8_t* rdata, size_t rdatalen, int* nonexist) 1196 { 1197 struct auth_rrset* rrset; 1198 size_t index = 0; 1199 1200 /* find the plain RR of the given type */ 1201 if((rrset=az_domain_rrset(node, rr_type))!= NULL) { 1202 if(packed_rrset_find_rr(rrset->data, rdata, rdatalen, &index)) { 1203 if(rrset->data->count == 1 && 1204 rrset->data->rrsig_count == 0) { 1205 /* last RR, delete the rrset */ 1206 domain_remove_rrset(node, rr_type); 1207 } else if(rrset->data->count == 1 && 1208 rrset->data->rrsig_count != 0) { 1209 /* move RRSIGs to the RRSIG rrset, or 1210 * this one becomes that RRset */ 1211 struct auth_rrset* rrsigset = az_domain_rrset( 1212 node, LDNS_RR_TYPE_RRSIG); 1213 if(rrsigset) { 1214 /* move left over rrsigs to the 1215 * existing rrset of type RRSIG */ 1216 rrsigs_copy_from_rrset_to_rrsigset( 1217 rrset, rrsigset); 1218 /* and then delete the rrset */ 1219 domain_remove_rrset(node, rr_type); 1220 } else { 1221 /* no rrset of type RRSIG, this 1222 * set is now of that type, 1223 * just remove the rr */ 1224 if(!rrset_remove_rr(rrset, index)) 1225 return 0; 1226 rrset->type = LDNS_RR_TYPE_RRSIG; 1227 rrset->data->count = rrset->data->rrsig_count; 1228 rrset->data->rrsig_count = 0; 1229 } 1230 } else { 1231 /* remove the RR from the rrset */ 1232 if(!rrset_remove_rr(rrset, index)) 1233 return 0; 1234 } 1235 return 1; 1236 } 1237 /* rr not found in rrset */ 1238 } 1239 1240 /* is it a type RRSIG, look under the covered type */ 1241 if(rr_type == LDNS_RR_TYPE_RRSIG) { 1242 uint16_t ctype = rrsig_rdata_get_type_covered(rdata, rdatalen); 1243 if((rrset=az_domain_rrset(node, ctype))!= NULL) { 1244 if(az_rrset_find_rrsig(rrset->data, rdata, rdatalen, 1245 &index)) { 1246 /* rrsig should have d->count > 0, be 1247 * over some rr of that type */ 1248 /* remove the rrsig from the rrsigs list of the 1249 * rrset */ 1250 if(!rrset_remove_rr(rrset, index)) 1251 return 0; 1252 return 1; 1253 } 1254 } 1255 /* also RRSIG not found */ 1256 } 1257 1258 /* nothing found to delete */ 1259 if(nonexist) *nonexist = 1; 1260 return 1; 1261 } 1262 1263 /** remove RR from zone, ignore if it does not exist, false on alloc failure*/ 1264 static int 1265 az_remove_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len, 1266 size_t dname_len, int* nonexist) 1267 { 1268 struct auth_data* node; 1269 uint8_t* dname = rr; 1270 uint16_t rr_type = sldns_wirerr_get_type(rr, rr_len, dname_len); 1271 uint16_t rr_class = sldns_wirerr_get_class(rr, rr_len, dname_len); 1272 size_t rdatalen = ((size_t)sldns_wirerr_get_rdatalen(rr, rr_len, 1273 dname_len))+2; 1274 /* rdata points to rdata prefixed with uint16 rdatalength */ 1275 uint8_t* rdata = sldns_wirerr_get_rdatawl(rr, rr_len, dname_len); 1276 1277 if(rr_class != z->dclass) { 1278 log_err("wrong class for RR"); 1279 /* really also a nonexisting entry, because no records 1280 * of that class in the zone, but return an error because 1281 * getting records of the wrong class is a failure of the 1282 * zone transfer */ 1283 return 0; 1284 } 1285 node = az_find_name(z, dname, dname_len); 1286 if(!node) { 1287 /* node with that name does not exist */ 1288 /* nonexisting entry, because no such name */ 1289 *nonexist = 1; 1290 return 1; 1291 } 1292 if(!az_domain_remove_rr(node, rr_type, rdata, rdatalen, nonexist)) { 1293 /* alloc failure or so */ 1294 return 0; 1295 } 1296 /* remove the node, if necessary */ 1297 /* an rrsets==NULL entry is not kept around for empty nonterminals, 1298 * and also parent nodes are not kept around, so we just delete it */ 1299 if(node->rrsets == NULL) { 1300 (void)rbtree_delete(&z->data, node); 1301 auth_data_delete(node); 1302 } 1303 if(z->rpz) { 1304 rpz_remove_rr(z->rpz, z->namelen, dname, dname_len, rr_type, 1305 rr_class, rdata, rdatalen); 1306 } 1307 return 1; 1308 } 1309 1310 /** decompress an RR into the buffer where it'll be an uncompressed RR 1311 * with uncompressed dname and uncompressed rdata (dnames) */ 1312 static int 1313 decompress_rr_into_buffer(struct sldns_buffer* buf, uint8_t* pkt, 1314 size_t pktlen, uint8_t* dname, uint16_t rr_type, uint16_t rr_class, 1315 uint32_t rr_ttl, uint8_t* rr_data, uint16_t rr_rdlen) 1316 { 1317 sldns_buffer pktbuf; 1318 size_t dname_len = 0; 1319 size_t rdlenpos; 1320 size_t rdlen; 1321 uint8_t* rd; 1322 const sldns_rr_descriptor* desc; 1323 sldns_buffer_init_frm_data(&pktbuf, pkt, pktlen); 1324 sldns_buffer_clear(buf); 1325 1326 /* decompress dname */ 1327 sldns_buffer_set_position(&pktbuf, 1328 (size_t)(dname - sldns_buffer_current(&pktbuf))); 1329 dname_len = pkt_dname_len(&pktbuf); 1330 if(dname_len == 0) return 0; /* parse fail on dname */ 1331 if(!sldns_buffer_available(buf, dname_len)) return 0; 1332 dname_pkt_copy(&pktbuf, sldns_buffer_current(buf), dname); 1333 sldns_buffer_skip(buf, (ssize_t)dname_len); 1334 1335 /* type, class, ttl and rdatalength fields */ 1336 if(!sldns_buffer_available(buf, 10)) return 0; 1337 sldns_buffer_write_u16(buf, rr_type); 1338 sldns_buffer_write_u16(buf, rr_class); 1339 sldns_buffer_write_u32(buf, rr_ttl); 1340 rdlenpos = sldns_buffer_position(buf); 1341 sldns_buffer_write_u16(buf, 0); /* rd length position */ 1342 1343 /* decompress rdata */ 1344 desc = sldns_rr_descript(rr_type); 1345 rd = rr_data; 1346 rdlen = rr_rdlen; 1347 if(rdlen > 0 && desc && desc->_dname_count > 0) { 1348 int count = (int)desc->_dname_count; 1349 int rdf = 0; 1350 size_t len; /* how much rdata to plain copy */ 1351 size_t uncompressed_len, compressed_len; 1352 size_t oldpos; 1353 /* decompress dnames. */ 1354 while(rdlen > 0 && count) { 1355 switch(desc->_wireformat[rdf]) { 1356 case LDNS_RDF_TYPE_DNAME: 1357 sldns_buffer_set_position(&pktbuf, 1358 (size_t)(rd - 1359 sldns_buffer_begin(&pktbuf))); 1360 oldpos = sldns_buffer_position(&pktbuf); 1361 /* moves pktbuf to right after the 1362 * compressed dname, and returns uncompressed 1363 * dname length */ 1364 uncompressed_len = pkt_dname_len(&pktbuf); 1365 if(!uncompressed_len) 1366 return 0; /* parse error in dname */ 1367 if(!sldns_buffer_available(buf, 1368 uncompressed_len)) 1369 /* dname too long for buffer */ 1370 return 0; 1371 dname_pkt_copy(&pktbuf, 1372 sldns_buffer_current(buf), rd); 1373 sldns_buffer_skip(buf, (ssize_t)uncompressed_len); 1374 compressed_len = sldns_buffer_position( 1375 &pktbuf) - oldpos; 1376 rd += compressed_len; 1377 rdlen -= compressed_len; 1378 count--; 1379 len = 0; 1380 break; 1381 case LDNS_RDF_TYPE_STR: 1382 len = rd[0] + 1; 1383 break; 1384 default: 1385 len = get_rdf_size(desc->_wireformat[rdf]); 1386 break; 1387 } 1388 if(len) { 1389 if(!sldns_buffer_available(buf, len)) 1390 return 0; /* too long for buffer */ 1391 sldns_buffer_write(buf, rd, len); 1392 rd += len; 1393 rdlen -= len; 1394 } 1395 rdf++; 1396 } 1397 } 1398 /* copy remaining data */ 1399 if(rdlen > 0) { 1400 if(!sldns_buffer_available(buf, rdlen)) return 0; 1401 sldns_buffer_write(buf, rd, rdlen); 1402 } 1403 /* fixup rdlength */ 1404 sldns_buffer_write_u16_at(buf, rdlenpos, 1405 sldns_buffer_position(buf)-rdlenpos-2); 1406 sldns_buffer_flip(buf); 1407 return 1; 1408 } 1409 1410 /** insert RR into zone, from packet, decompress RR, 1411 * if duplicate is nonNULL set the flag but otherwise ignore duplicates */ 1412 static int 1413 az_insert_rr_decompress(struct auth_zone* z, uint8_t* pkt, size_t pktlen, 1414 struct sldns_buffer* scratch_buffer, uint8_t* dname, uint16_t rr_type, 1415 uint16_t rr_class, uint32_t rr_ttl, uint8_t* rr_data, 1416 uint16_t rr_rdlen, int* duplicate) 1417 { 1418 uint8_t* rr; 1419 size_t rr_len; 1420 size_t dname_len; 1421 if(!decompress_rr_into_buffer(scratch_buffer, pkt, pktlen, dname, 1422 rr_type, rr_class, rr_ttl, rr_data, rr_rdlen)) { 1423 log_err("could not decompress RR"); 1424 return 0; 1425 } 1426 rr = sldns_buffer_begin(scratch_buffer); 1427 rr_len = sldns_buffer_limit(scratch_buffer); 1428 dname_len = dname_valid(rr, rr_len); 1429 return az_insert_rr(z, rr, rr_len, dname_len, duplicate); 1430 } 1431 1432 /** remove RR from zone, from packet, decompress RR, 1433 * if nonexist is nonNULL set the flag but otherwise ignore nonexisting entries*/ 1434 static int 1435 az_remove_rr_decompress(struct auth_zone* z, uint8_t* pkt, size_t pktlen, 1436 struct sldns_buffer* scratch_buffer, uint8_t* dname, uint16_t rr_type, 1437 uint16_t rr_class, uint32_t rr_ttl, uint8_t* rr_data, 1438 uint16_t rr_rdlen, int* nonexist) 1439 { 1440 uint8_t* rr; 1441 size_t rr_len; 1442 size_t dname_len; 1443 if(!decompress_rr_into_buffer(scratch_buffer, pkt, pktlen, dname, 1444 rr_type, rr_class, rr_ttl, rr_data, rr_rdlen)) { 1445 log_err("could not decompress RR"); 1446 return 0; 1447 } 1448 rr = sldns_buffer_begin(scratch_buffer); 1449 rr_len = sldns_buffer_limit(scratch_buffer); 1450 dname_len = dname_valid(rr, rr_len); 1451 return az_remove_rr(z, rr, rr_len, dname_len, nonexist); 1452 } 1453 1454 /** 1455 * Parse zonefile 1456 * @param z: zone to read in. 1457 * @param in: file to read from (just opened). 1458 * @param rr: buffer to use for RRs, 64k. 1459 * passed so that recursive includes can use the same buffer and do 1460 * not grow the stack too much. 1461 * @param rrbuflen: sizeof rr buffer. 1462 * @param state: parse state with $ORIGIN, $TTL and 'prev-dname' and so on, 1463 * that is kept between includes. 1464 * The lineno is set at 1 and then increased by the function. 1465 * @param fname: file name. 1466 * @param depth: recursion depth for includes 1467 * @param cfg: config for chroot. 1468 * returns false on failure, has printed an error message 1469 */ 1470 static int 1471 az_parse_file(struct auth_zone* z, FILE* in, uint8_t* rr, size_t rrbuflen, 1472 struct sldns_file_parse_state* state, char* fname, int depth, 1473 struct config_file* cfg) 1474 { 1475 size_t rr_len, dname_len; 1476 int status; 1477 state->lineno = 1; 1478 1479 while(!feof(in)) { 1480 rr_len = rrbuflen; 1481 dname_len = 0; 1482 status = sldns_fp2wire_rr_buf(in, rr, &rr_len, &dname_len, 1483 state); 1484 if(status == LDNS_WIREPARSE_ERR_INCLUDE && rr_len == 0) { 1485 /* we have $INCLUDE or $something */ 1486 if(strncmp((char*)rr, "$INCLUDE ", 9) == 0 || 1487 strncmp((char*)rr, "$INCLUDE\t", 9) == 0) { 1488 FILE* inc; 1489 int lineno_orig = state->lineno; 1490 char* incfile = (char*)rr + 8; 1491 if(depth > MAX_INCLUDE_DEPTH) { 1492 log_err("%s:%d max include depth" 1493 "exceeded", fname, state->lineno); 1494 return 0; 1495 } 1496 /* skip spaces */ 1497 while(*incfile == ' ' || *incfile == '\t') 1498 incfile++; 1499 /* adjust for chroot on include file */ 1500 if(cfg->chrootdir && cfg->chrootdir[0] && 1501 strncmp(incfile, cfg->chrootdir, 1502 strlen(cfg->chrootdir)) == 0) 1503 incfile += strlen(cfg->chrootdir); 1504 incfile = strdup(incfile); 1505 if(!incfile) { 1506 log_err("malloc failure"); 1507 return 0; 1508 } 1509 verbose(VERB_ALGO, "opening $INCLUDE %s", 1510 incfile); 1511 inc = fopen(incfile, "r"); 1512 if(!inc) { 1513 log_err("%s:%d cannot open include " 1514 "file %s: %s", fname, 1515 lineno_orig, incfile, 1516 strerror(errno)); 1517 free(incfile); 1518 return 0; 1519 } 1520 /* recurse read that file now */ 1521 if(!az_parse_file(z, inc, rr, rrbuflen, 1522 state, incfile, depth+1, cfg)) { 1523 log_err("%s:%d cannot parse include " 1524 "file %s", fname, 1525 lineno_orig, incfile); 1526 fclose(inc); 1527 free(incfile); 1528 return 0; 1529 } 1530 fclose(inc); 1531 verbose(VERB_ALGO, "done with $INCLUDE %s", 1532 incfile); 1533 free(incfile); 1534 state->lineno = lineno_orig; 1535 } 1536 continue; 1537 } 1538 if(status != 0) { 1539 log_err("parse error %s %d:%d: %s", fname, 1540 state->lineno, LDNS_WIREPARSE_OFFSET(status), 1541 sldns_get_errorstr_parse(status)); 1542 return 0; 1543 } 1544 if(rr_len == 0) { 1545 /* EMPTY line, TTL or ORIGIN */ 1546 continue; 1547 } 1548 /* insert wirerr in rrbuf */ 1549 if(!az_insert_rr(z, rr, rr_len, dname_len, NULL)) { 1550 char buf[17]; 1551 sldns_wire2str_type_buf(sldns_wirerr_get_type(rr, 1552 rr_len, dname_len), buf, sizeof(buf)); 1553 log_err("%s:%d cannot insert RR of type %s", 1554 fname, state->lineno, buf); 1555 return 0; 1556 } 1557 } 1558 return 1; 1559 } 1560 1561 int 1562 auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg) 1563 { 1564 uint8_t rr[LDNS_RR_BUF_SIZE]; 1565 struct sldns_file_parse_state state; 1566 char* zfilename; 1567 FILE* in; 1568 if(!z || !z->zonefile || z->zonefile[0]==0) 1569 return 1; /* no file, or "", nothing to read */ 1570 1571 zfilename = z->zonefile; 1572 if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(zfilename, 1573 cfg->chrootdir, strlen(cfg->chrootdir)) == 0) 1574 zfilename += strlen(cfg->chrootdir); 1575 if(verbosity >= VERB_ALGO) { 1576 char nm[255+1]; 1577 dname_str(z->name, nm); 1578 verbose(VERB_ALGO, "read zonefile %s for %s", zfilename, nm); 1579 } 1580 in = fopen(zfilename, "r"); 1581 if(!in) { 1582 char* n = sldns_wire2str_dname(z->name, z->namelen); 1583 if(z->zone_is_slave && errno == ENOENT) { 1584 /* we fetch the zone contents later, no file yet */ 1585 verbose(VERB_ALGO, "no zonefile %s for %s", 1586 zfilename, n?n:"error"); 1587 free(n); 1588 return 1; 1589 } 1590 log_err("cannot open zonefile %s for %s: %s", 1591 zfilename, n?n:"error", strerror(errno)); 1592 free(n); 1593 return 0; 1594 } 1595 1596 /* clear the data tree */ 1597 traverse_postorder(&z->data, auth_data_del, NULL); 1598 rbtree_init(&z->data, &auth_data_cmp); 1599 /* clear the RPZ policies */ 1600 if(z->rpz) 1601 rpz_clear(z->rpz); 1602 1603 memset(&state, 0, sizeof(state)); 1604 /* default TTL to 3600 */ 1605 state.default_ttl = 3600; 1606 /* set $ORIGIN to the zone name */ 1607 if(z->namelen <= sizeof(state.origin)) { 1608 memcpy(state.origin, z->name, z->namelen); 1609 state.origin_len = z->namelen; 1610 } 1611 /* parse the (toplevel) file */ 1612 if(!az_parse_file(z, in, rr, sizeof(rr), &state, zfilename, 0, cfg)) { 1613 char* n = sldns_wire2str_dname(z->name, z->namelen); 1614 log_err("error parsing zonefile %s for %s", 1615 zfilename, n?n:"error"); 1616 free(n); 1617 fclose(in); 1618 return 0; 1619 } 1620 fclose(in); 1621 1622 if(z->rpz) 1623 rpz_finish_config(z->rpz); 1624 return 1; 1625 } 1626 1627 /** write buffer to file and check return codes */ 1628 static int 1629 write_out(FILE* out, const char* str, size_t len) 1630 { 1631 size_t r; 1632 if(len == 0) 1633 return 1; 1634 r = fwrite(str, 1, len, out); 1635 if(r == 0) { 1636 log_err("write failed: %s", strerror(errno)); 1637 return 0; 1638 } else if(r < len) { 1639 log_err("write failed: too short (disk full?)"); 1640 return 0; 1641 } 1642 return 1; 1643 } 1644 1645 /** convert auth rr to string */ 1646 static int 1647 auth_rr_to_string(uint8_t* nm, size_t nmlen, uint16_t tp, uint16_t cl, 1648 struct packed_rrset_data* data, size_t i, char* s, size_t buflen) 1649 { 1650 int w = 0; 1651 size_t slen = buflen, datlen; 1652 uint8_t* dat; 1653 if(i >= data->count) tp = LDNS_RR_TYPE_RRSIG; 1654 dat = nm; 1655 datlen = nmlen; 1656 w += sldns_wire2str_dname_scan(&dat, &datlen, &s, &slen, NULL, 0, NULL); 1657 w += sldns_str_print(&s, &slen, "\t"); 1658 w += sldns_str_print(&s, &slen, "%lu\t", (unsigned long)data->rr_ttl[i]); 1659 w += sldns_wire2str_class_print(&s, &slen, cl); 1660 w += sldns_str_print(&s, &slen, "\t"); 1661 w += sldns_wire2str_type_print(&s, &slen, tp); 1662 w += sldns_str_print(&s, &slen, "\t"); 1663 datlen = data->rr_len[i]-2; 1664 dat = data->rr_data[i]+2; 1665 w += sldns_wire2str_rdata_scan(&dat, &datlen, &s, &slen, tp, NULL, 0, NULL); 1666 1667 if(tp == LDNS_RR_TYPE_DNSKEY) { 1668 w += sldns_str_print(&s, &slen, " ;{id = %u}", 1669 sldns_calc_keytag_raw(data->rr_data[i]+2, 1670 data->rr_len[i]-2)); 1671 } 1672 w += sldns_str_print(&s, &slen, "\n"); 1673 1674 if(w >= (int)buflen) { 1675 log_nametypeclass(NO_VERBOSE, "RR too long to print", nm, tp, cl); 1676 return 0; 1677 } 1678 return 1; 1679 } 1680 1681 /** write rrset to file */ 1682 static int 1683 auth_zone_write_rrset(struct auth_zone* z, struct auth_data* node, 1684 struct auth_rrset* r, FILE* out) 1685 { 1686 size_t i, count = r->data->count + r->data->rrsig_count; 1687 char buf[LDNS_RR_BUF_SIZE]; 1688 for(i=0; i<count; i++) { 1689 if(!auth_rr_to_string(node->name, node->namelen, r->type, 1690 z->dclass, r->data, i, buf, sizeof(buf))) { 1691 verbose(VERB_ALGO, "failed to rr2str rr %d", (int)i); 1692 continue; 1693 } 1694 if(!write_out(out, buf, strlen(buf))) 1695 return 0; 1696 } 1697 return 1; 1698 } 1699 1700 /** write domain to file */ 1701 static int 1702 auth_zone_write_domain(struct auth_zone* z, struct auth_data* n, FILE* out) 1703 { 1704 struct auth_rrset* r; 1705 /* if this is zone apex, write SOA first */ 1706 if(z->namelen == n->namelen) { 1707 struct auth_rrset* soa = az_domain_rrset(n, LDNS_RR_TYPE_SOA); 1708 if(soa) { 1709 if(!auth_zone_write_rrset(z, n, soa, out)) 1710 return 0; 1711 } 1712 } 1713 /* write all the RRsets for this domain */ 1714 for(r = n->rrsets; r; r = r->next) { 1715 if(z->namelen == n->namelen && 1716 r->type == LDNS_RR_TYPE_SOA) 1717 continue; /* skip SOA here */ 1718 if(!auth_zone_write_rrset(z, n, r, out)) 1719 return 0; 1720 } 1721 return 1; 1722 } 1723 1724 int auth_zone_write_file(struct auth_zone* z, const char* fname) 1725 { 1726 FILE* out; 1727 struct auth_data* n; 1728 out = fopen(fname, "w"); 1729 if(!out) { 1730 log_err("could not open %s: %s", fname, strerror(errno)); 1731 return 0; 1732 } 1733 RBTREE_FOR(n, struct auth_data*, &z->data) { 1734 if(!auth_zone_write_domain(z, n, out)) { 1735 log_err("could not write domain to %s", fname); 1736 fclose(out); 1737 return 0; 1738 } 1739 } 1740 fclose(out); 1741 return 1; 1742 } 1743 1744 /** read all auth zones from file (if they have) */ 1745 static int 1746 auth_zones_read_zones(struct auth_zones* az, struct config_file* cfg) 1747 { 1748 struct auth_zone* z; 1749 lock_rw_wrlock(&az->lock); 1750 RBTREE_FOR(z, struct auth_zone*, &az->ztree) { 1751 lock_rw_wrlock(&z->lock); 1752 if(!auth_zone_read_zonefile(z, cfg)) { 1753 lock_rw_unlock(&z->lock); 1754 lock_rw_unlock(&az->lock); 1755 return 0; 1756 } 1757 lock_rw_unlock(&z->lock); 1758 } 1759 lock_rw_unlock(&az->lock); 1760 return 1; 1761 } 1762 1763 /** find serial number of zone or false if none */ 1764 int 1765 auth_zone_get_serial(struct auth_zone* z, uint32_t* serial) 1766 { 1767 struct auth_data* apex; 1768 struct auth_rrset* soa; 1769 struct packed_rrset_data* d; 1770 apex = az_find_name(z, z->name, z->namelen); 1771 if(!apex) return 0; 1772 soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA); 1773 if(!soa || soa->data->count==0) 1774 return 0; /* no RRset or no RRs in rrset */ 1775 if(soa->data->rr_len[0] < 2+4*5) return 0; /* SOA too short */ 1776 d = soa->data; 1777 *serial = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-20)); 1778 return 1; 1779 } 1780 1781 /** Find auth_zone SOA and populate the values in xfr(soa values). */ 1782 static int 1783 xfr_find_soa(struct auth_zone* z, struct auth_xfer* xfr) 1784 { 1785 struct auth_data* apex; 1786 struct auth_rrset* soa; 1787 struct packed_rrset_data* d; 1788 apex = az_find_name(z, z->name, z->namelen); 1789 if(!apex) return 0; 1790 soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA); 1791 if(!soa || soa->data->count==0) 1792 return 0; /* no RRset or no RRs in rrset */ 1793 if(soa->data->rr_len[0] < 2+4*5) return 0; /* SOA too short */ 1794 /* SOA record ends with serial, refresh, retry, expiry, minimum, 1795 * as 4 byte fields */ 1796 d = soa->data; 1797 xfr->have_zone = 1; 1798 xfr->serial = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-20)); 1799 xfr->refresh = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-16)); 1800 xfr->retry = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-12)); 1801 xfr->expiry = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-8)); 1802 /* soa minimum at d->rr_len[0]-4 */ 1803 return 1; 1804 } 1805 1806 /** 1807 * Setup auth_xfer zone 1808 * This populates the have_zone, soa values, and so on times. 1809 * Doesn't do network traffic yet, can set option flags. 1810 * @param z: locked by caller, and modified for setup 1811 * @param x: locked by caller, and modified. 1812 * @return false on failure. 1813 */ 1814 static int 1815 auth_xfer_setup(struct auth_zone* z, struct auth_xfer* x) 1816 { 1817 /* for a zone without zone transfers, x==NULL, so skip them, 1818 * i.e. the zone config is fixed with no masters or urls */ 1819 if(!z || !x) return 1; 1820 if(!xfr_find_soa(z, x)) { 1821 return 1; 1822 } 1823 /* nothing for probe, nextprobe and transfer tasks */ 1824 return 1; 1825 } 1826 1827 /** 1828 * Setup all zones 1829 * @param az: auth zones structure 1830 * @return false on failure. 1831 */ 1832 static int 1833 auth_zones_setup_zones(struct auth_zones* az) 1834 { 1835 struct auth_zone* z; 1836 struct auth_xfer* x; 1837 lock_rw_wrlock(&az->lock); 1838 RBTREE_FOR(z, struct auth_zone*, &az->ztree) { 1839 lock_rw_wrlock(&z->lock); 1840 x = auth_xfer_find(az, z->name, z->namelen, z->dclass); 1841 if(x) { 1842 lock_basic_lock(&x->lock); 1843 } 1844 if(!auth_xfer_setup(z, x)) { 1845 if(x) { 1846 lock_basic_unlock(&x->lock); 1847 } 1848 lock_rw_unlock(&z->lock); 1849 lock_rw_unlock(&az->lock); 1850 return 0; 1851 } 1852 if(x) { 1853 lock_basic_unlock(&x->lock); 1854 } 1855 lock_rw_unlock(&z->lock); 1856 } 1857 lock_rw_unlock(&az->lock); 1858 return 1; 1859 } 1860 1861 /** set config items and create zones */ 1862 static int 1863 auth_zones_cfg(struct auth_zones* az, struct config_auth* c) 1864 { 1865 struct auth_zone* z; 1866 struct auth_xfer* x = NULL; 1867 1868 /* create zone */ 1869 if(c->isrpz) { 1870 /* if the rpz lock is needed, grab it before the other 1871 * locks to avoid a lock dependency cycle */ 1872 lock_rw_wrlock(&az->rpz_lock); 1873 } 1874 lock_rw_wrlock(&az->lock); 1875 if(!(z=auth_zones_find_or_add_zone(az, c->name))) { 1876 lock_rw_unlock(&az->lock); 1877 if(c->isrpz) { 1878 lock_rw_unlock(&az->rpz_lock); 1879 } 1880 return 0; 1881 } 1882 if(c->masters || c->urls) { 1883 if(!(x=auth_zones_find_or_add_xfer(az, z))) { 1884 lock_rw_unlock(&az->lock); 1885 lock_rw_unlock(&z->lock); 1886 if(c->isrpz) { 1887 lock_rw_unlock(&az->rpz_lock); 1888 } 1889 return 0; 1890 } 1891 } 1892 if(c->for_downstream) 1893 az->have_downstream = 1; 1894 lock_rw_unlock(&az->lock); 1895 1896 /* set options */ 1897 z->zone_deleted = 0; 1898 if(!auth_zone_set_zonefile(z, c->zonefile)) { 1899 if(x) { 1900 lock_basic_unlock(&x->lock); 1901 } 1902 lock_rw_unlock(&z->lock); 1903 if(c->isrpz) { 1904 lock_rw_unlock(&az->rpz_lock); 1905 } 1906 return 0; 1907 } 1908 z->for_downstream = c->for_downstream; 1909 z->for_upstream = c->for_upstream; 1910 z->fallback_enabled = c->fallback_enabled; 1911 if(c->isrpz && !z->rpz){ 1912 if(!(z->rpz = rpz_create(c))){ 1913 fatal_exit("Could not setup RPZ zones"); 1914 return 0; 1915 } 1916 lock_protect(&z->lock, &z->rpz->local_zones, sizeof(*z->rpz)); 1917 /* the az->rpz_lock is locked above */ 1918 z->rpz_az_next = az->rpz_first; 1919 if(az->rpz_first) 1920 az->rpz_first->rpz_az_prev = z; 1921 az->rpz_first = z; 1922 } 1923 if(c->isrpz) { 1924 lock_rw_unlock(&az->rpz_lock); 1925 } 1926 1927 /* xfer zone */ 1928 if(x) { 1929 z->zone_is_slave = 1; 1930 /* set options on xfer zone */ 1931 if(!xfer_set_masters(&x->task_probe->masters, c, 0)) { 1932 lock_basic_unlock(&x->lock); 1933 lock_rw_unlock(&z->lock); 1934 return 0; 1935 } 1936 if(!xfer_set_masters(&x->task_transfer->masters, c, 1)) { 1937 lock_basic_unlock(&x->lock); 1938 lock_rw_unlock(&z->lock); 1939 return 0; 1940 } 1941 lock_basic_unlock(&x->lock); 1942 } 1943 1944 lock_rw_unlock(&z->lock); 1945 return 1; 1946 } 1947 1948 /** set all auth zones deleted, then in auth_zones_cfg, it marks them 1949 * as nondeleted (if they are still in the config), and then later 1950 * we can find deleted zones */ 1951 static void 1952 az_setall_deleted(struct auth_zones* az) 1953 { 1954 struct auth_zone* z; 1955 lock_rw_wrlock(&az->lock); 1956 RBTREE_FOR(z, struct auth_zone*, &az->ztree) { 1957 lock_rw_wrlock(&z->lock); 1958 z->zone_deleted = 1; 1959 lock_rw_unlock(&z->lock); 1960 } 1961 lock_rw_unlock(&az->lock); 1962 } 1963 1964 /** find zones that are marked deleted and delete them. 1965 * This is called from apply_cfg, and there are no threads and no 1966 * workers, so the xfr can just be deleted. */ 1967 static void 1968 az_delete_deleted_zones(struct auth_zones* az) 1969 { 1970 struct auth_zone* z; 1971 struct auth_zone* delete_list = NULL, *next; 1972 struct auth_xfer* xfr; 1973 lock_rw_wrlock(&az->lock); 1974 RBTREE_FOR(z, struct auth_zone*, &az->ztree) { 1975 lock_rw_wrlock(&z->lock); 1976 if(z->zone_deleted) { 1977 /* we cannot alter the rbtree right now, but 1978 * we can put it on a linked list and then 1979 * delete it */ 1980 z->delete_next = delete_list; 1981 delete_list = z; 1982 } 1983 lock_rw_unlock(&z->lock); 1984 } 1985 /* now we are out of the tree loop and we can loop and delete 1986 * the zones */ 1987 z = delete_list; 1988 while(z) { 1989 next = z->delete_next; 1990 xfr = auth_xfer_find(az, z->name, z->namelen, z->dclass); 1991 if(xfr) { 1992 (void)rbtree_delete(&az->xtree, &xfr->node); 1993 auth_xfer_delete(xfr); 1994 } 1995 (void)rbtree_delete(&az->ztree, &z->node); 1996 auth_zone_delete(z, az); 1997 z = next; 1998 } 1999 lock_rw_unlock(&az->lock); 2000 } 2001 2002 int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg, 2003 int setup, int* is_rpz) 2004 { 2005 struct config_auth* p; 2006 az_setall_deleted(az); 2007 for(p = cfg->auths; p; p = p->next) { 2008 if(!p->name || p->name[0] == 0) { 2009 log_warn("auth-zone without a name, skipped"); 2010 continue; 2011 } 2012 *is_rpz = (*is_rpz || p->isrpz); 2013 if(!auth_zones_cfg(az, p)) { 2014 log_err("cannot config auth zone %s", p->name); 2015 return 0; 2016 } 2017 } 2018 az_delete_deleted_zones(az); 2019 if(!auth_zones_read_zones(az, cfg)) 2020 return 0; 2021 if(setup) { 2022 if(!auth_zones_setup_zones(az)) 2023 return 0; 2024 } 2025 return 1; 2026 } 2027 2028 /** delete chunks 2029 * @param at: transfer structure with chunks list. The chunks and their 2030 * data are freed. 2031 */ 2032 static void 2033 auth_chunks_delete(struct auth_transfer* at) 2034 { 2035 if(at->chunks_first) { 2036 struct auth_chunk* c, *cn; 2037 c = at->chunks_first; 2038 while(c) { 2039 cn = c->next; 2040 free(c->data); 2041 free(c); 2042 c = cn; 2043 } 2044 } 2045 at->chunks_first = NULL; 2046 at->chunks_last = NULL; 2047 } 2048 2049 /** free master addr list */ 2050 static void 2051 auth_free_master_addrs(struct auth_addr* list) 2052 { 2053 struct auth_addr *n; 2054 while(list) { 2055 n = list->next; 2056 free(list); 2057 list = n; 2058 } 2059 } 2060 2061 /** free the masters list */ 2062 static void 2063 auth_free_masters(struct auth_master* list) 2064 { 2065 struct auth_master* n; 2066 while(list) { 2067 n = list->next; 2068 auth_free_master_addrs(list->list); 2069 free(list->host); 2070 free(list->file); 2071 free(list); 2072 list = n; 2073 } 2074 } 2075 2076 /** delete auth xfer structure 2077 * @param xfr: delete this xfer and its tasks. 2078 */ 2079 static void 2080 auth_xfer_delete(struct auth_xfer* xfr) 2081 { 2082 if(!xfr) return; 2083 lock_basic_destroy(&xfr->lock); 2084 free(xfr->name); 2085 if(xfr->task_nextprobe) { 2086 comm_timer_delete(xfr->task_nextprobe->timer); 2087 free(xfr->task_nextprobe); 2088 } 2089 if(xfr->task_probe) { 2090 auth_free_masters(xfr->task_probe->masters); 2091 comm_point_delete(xfr->task_probe->cp); 2092 comm_timer_delete(xfr->task_probe->timer); 2093 free(xfr->task_probe); 2094 } 2095 if(xfr->task_transfer) { 2096 auth_free_masters(xfr->task_transfer->masters); 2097 comm_point_delete(xfr->task_transfer->cp); 2098 comm_timer_delete(xfr->task_transfer->timer); 2099 if(xfr->task_transfer->chunks_first) { 2100 auth_chunks_delete(xfr->task_transfer); 2101 } 2102 free(xfr->task_transfer); 2103 } 2104 auth_free_masters(xfr->allow_notify_list); 2105 free(xfr); 2106 } 2107 2108 /** helper traverse to delete zones */ 2109 static void 2110 auth_zone_del(rbnode_type* n, void* ATTR_UNUSED(arg)) 2111 { 2112 struct auth_zone* z = (struct auth_zone*)n->key; 2113 auth_zone_delete(z, NULL); 2114 } 2115 2116 /** helper traverse to delete xfer zones */ 2117 static void 2118 auth_xfer_del(rbnode_type* n, void* ATTR_UNUSED(arg)) 2119 { 2120 struct auth_xfer* z = (struct auth_xfer*)n->key; 2121 auth_xfer_delete(z); 2122 } 2123 2124 void auth_zones_delete(struct auth_zones* az) 2125 { 2126 if(!az) return; 2127 lock_rw_destroy(&az->lock); 2128 lock_rw_destroy(&az->rpz_lock); 2129 traverse_postorder(&az->ztree, auth_zone_del, NULL); 2130 traverse_postorder(&az->xtree, auth_xfer_del, NULL); 2131 free(az); 2132 } 2133 2134 /** true if domain has only nsec3 */ 2135 static int 2136 domain_has_only_nsec3(struct auth_data* n) 2137 { 2138 struct auth_rrset* rrset = n->rrsets; 2139 int nsec3_seen = 0; 2140 while(rrset) { 2141 if(rrset->type == LDNS_RR_TYPE_NSEC3) { 2142 nsec3_seen = 1; 2143 } else if(rrset->type != LDNS_RR_TYPE_RRSIG) { 2144 return 0; 2145 } 2146 rrset = rrset->next; 2147 } 2148 return nsec3_seen; 2149 } 2150 2151 /** see if the domain has a wildcard child '*.domain' */ 2152 static struct auth_data* 2153 az_find_wildcard_domain(struct auth_zone* z, uint8_t* nm, size_t nmlen) 2154 { 2155 uint8_t wc[LDNS_MAX_DOMAINLEN]; 2156 if(nmlen+2 > sizeof(wc)) 2157 return NULL; /* result would be too long */ 2158 wc[0] = 1; /* length of wildcard label */ 2159 wc[1] = (uint8_t)'*'; /* wildcard label */ 2160 memmove(wc+2, nm, nmlen); 2161 return az_find_name(z, wc, nmlen+2); 2162 } 2163 2164 /** find wildcard between qname and cename */ 2165 static struct auth_data* 2166 az_find_wildcard(struct auth_zone* z, struct query_info* qinfo, 2167 struct auth_data* ce) 2168 { 2169 uint8_t* nm = qinfo->qname; 2170 size_t nmlen = qinfo->qname_len; 2171 struct auth_data* node; 2172 if(!dname_subdomain_c(nm, z->name)) 2173 return NULL; /* out of zone */ 2174 while((node=az_find_wildcard_domain(z, nm, nmlen))==NULL) { 2175 /* see if we can go up to find the wildcard */ 2176 if(nmlen == z->namelen) 2177 return NULL; /* top of zone reached */ 2178 if(ce && nmlen == ce->namelen) 2179 return NULL; /* ce reached */ 2180 if(dname_is_root(nm)) 2181 return NULL; /* cannot go up */ 2182 dname_remove_label(&nm, &nmlen); 2183 } 2184 return node; 2185 } 2186 2187 /** domain is not exact, find first candidate ce (name that matches 2188 * a part of qname) in tree */ 2189 static struct auth_data* 2190 az_find_candidate_ce(struct auth_zone* z, struct query_info* qinfo, 2191 struct auth_data* n) 2192 { 2193 uint8_t* nm; 2194 size_t nmlen; 2195 if(n) { 2196 nm = dname_get_shared_topdomain(qinfo->qname, n->name); 2197 } else { 2198 nm = qinfo->qname; 2199 } 2200 dname_count_size_labels(nm, &nmlen); 2201 n = az_find_name(z, nm, nmlen); 2202 /* delete labels and go up on name */ 2203 while(!n) { 2204 if(dname_is_root(nm)) 2205 return NULL; /* cannot go up */ 2206 dname_remove_label(&nm, &nmlen); 2207 n = az_find_name(z, nm, nmlen); 2208 } 2209 return n; 2210 } 2211 2212 /** go up the auth tree to next existing name. */ 2213 static struct auth_data* 2214 az_domain_go_up(struct auth_zone* z, struct auth_data* n) 2215 { 2216 uint8_t* nm = n->name; 2217 size_t nmlen = n->namelen; 2218 while(!dname_is_root(nm)) { 2219 dname_remove_label(&nm, &nmlen); 2220 if((n=az_find_name(z, nm, nmlen)) != NULL) 2221 return n; 2222 } 2223 return NULL; 2224 } 2225 2226 /** Find the closest encloser, an name that exists and is above the 2227 * qname. 2228 * return true if the node (param node) is existing, nonobscured and 2229 * can be used to generate answers from. It is then also node_exact. 2230 * returns false if the node is not good enough (or it wasn't node_exact) 2231 * in this case the ce can be filled. 2232 * if ce is NULL, no ce exists, and likely the zone is completely empty, 2233 * not even with a zone apex. 2234 * if ce is nonNULL it is the closest enclosing upper name (that exists 2235 * itself for answer purposes). That name may have DNAME, NS or wildcard 2236 * rrset is the closest DNAME or NS rrset that was found. 2237 */ 2238 static int 2239 az_find_ce(struct auth_zone* z, struct query_info* qinfo, 2240 struct auth_data* node, int node_exact, struct auth_data** ce, 2241 struct auth_rrset** rrset) 2242 { 2243 struct auth_data* n = node; 2244 *ce = NULL; 2245 *rrset = NULL; 2246 if(!node_exact) { 2247 /* if not exact, lookup closest exact match */ 2248 n = az_find_candidate_ce(z, qinfo, n); 2249 } else { 2250 /* if exact, the node itself is the first candidate ce */ 2251 *ce = n; 2252 } 2253 2254 /* no direct answer from nsec3-only domains */ 2255 if(n && domain_has_only_nsec3(n)) { 2256 node_exact = 0; 2257 *ce = NULL; 2258 } 2259 2260 /* with exact matches, walk up the labels until we find the 2261 * delegation, or DNAME or zone end */ 2262 while(n) { 2263 /* see if the current candidate has issues */ 2264 /* not zone apex and has type NS */ 2265 if(n->namelen != z->namelen && 2266 (*rrset=az_domain_rrset(n, LDNS_RR_TYPE_NS)) && 2267 /* delegate here, but DS at exact the dp has notype */ 2268 (qinfo->qtype != LDNS_RR_TYPE_DS || 2269 n->namelen != qinfo->qname_len)) { 2270 /* referral */ 2271 /* this is ce and the lowernode is nonexisting */ 2272 *ce = n; 2273 return 0; 2274 } 2275 /* not equal to qname and has type DNAME */ 2276 if(n->namelen != qinfo->qname_len && 2277 (*rrset=az_domain_rrset(n, LDNS_RR_TYPE_DNAME))) { 2278 /* this is ce and the lowernode is nonexisting */ 2279 *ce = n; 2280 return 0; 2281 } 2282 2283 if(*ce == NULL && !domain_has_only_nsec3(n)) { 2284 /* if not found yet, this exact name must be 2285 * our lowest match (but not nsec3onlydomain) */ 2286 *ce = n; 2287 } 2288 2289 /* walk up the tree by removing labels from name and lookup */ 2290 n = az_domain_go_up(z, n); 2291 } 2292 /* found no problems, if it was an exact node, it is fine to use */ 2293 return node_exact; 2294 } 2295 2296 /** add additional A/AAAA from domain names in rrset rdata (+offset) 2297 * offset is number of bytes in rdata where the dname is located. */ 2298 static int 2299 az_add_additionals_from(struct auth_zone* z, struct regional* region, 2300 struct dns_msg* msg, struct auth_rrset* rrset, size_t offset) 2301 { 2302 struct packed_rrset_data* d = rrset->data; 2303 size_t i; 2304 if(!d) return 0; 2305 for(i=0; i<d->count; i++) { 2306 size_t dlen; 2307 struct auth_data* domain; 2308 struct auth_rrset* ref; 2309 if(d->rr_len[i] < 2+offset) 2310 continue; /* too short */ 2311 if(!(dlen = dname_valid(d->rr_data[i]+2+offset, 2312 d->rr_len[i]-2-offset))) 2313 continue; /* malformed */ 2314 domain = az_find_name(z, d->rr_data[i]+2+offset, dlen); 2315 if(!domain) 2316 continue; 2317 if((ref=az_domain_rrset(domain, LDNS_RR_TYPE_A)) != NULL) { 2318 if(!msg_add_rrset_ar(z, region, msg, domain, ref)) 2319 return 0; 2320 } 2321 if((ref=az_domain_rrset(domain, LDNS_RR_TYPE_AAAA)) != NULL) { 2322 if(!msg_add_rrset_ar(z, region, msg, domain, ref)) 2323 return 0; 2324 } 2325 } 2326 return 1; 2327 } 2328 2329 /** add negative SOA record (with negative TTL) */ 2330 static int 2331 az_add_negative_soa(struct auth_zone* z, struct regional* region, 2332 struct dns_msg* msg) 2333 { 2334 time_t minimum; 2335 size_t i; 2336 struct packed_rrset_data* d; 2337 struct auth_rrset* soa; 2338 struct auth_data* apex = az_find_name(z, z->name, z->namelen); 2339 if(!apex) return 0; 2340 soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA); 2341 if(!soa) return 0; 2342 /* must be first to put in message; we want to fix the TTL with 2343 * one RRset here, otherwise we'd need to loop over the RRs to get 2344 * the resulting lower TTL */ 2345 log_assert(msg->rep->rrset_count == 0); 2346 if(!msg_add_rrset_ns(z, region, msg, apex, soa)) return 0; 2347 /* fixup TTL */ 2348 d = (struct packed_rrset_data*)msg->rep->rrsets[msg->rep->rrset_count-1]->entry.data; 2349 /* last 4 bytes are minimum ttl in network format */ 2350 if(d->count == 0) return 0; 2351 if(d->rr_len[0] < 2+4) return 0; 2352 minimum = (time_t)sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-4)); 2353 minimum = d->ttl<minimum?d->ttl:minimum; 2354 d->ttl = minimum; 2355 for(i=0; i < d->count + d->rrsig_count; i++) 2356 d->rr_ttl[i] = minimum; 2357 msg->rep->ttl = get_rrset_ttl(msg->rep->rrsets[0]); 2358 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 2359 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 2360 return 1; 2361 } 2362 2363 /** See if the query goes to empty nonterminal (that has no auth_data, 2364 * but there are nodes underneath. We already checked that there are 2365 * not NS, or DNAME above, so that we only need to check if some node 2366 * exists below (with nonempty rr list), return true if emptynonterminal */ 2367 static int 2368 az_empty_nonterminal(struct auth_zone* z, struct query_info* qinfo, 2369 struct auth_data* node) 2370 { 2371 struct auth_data* next; 2372 if(!node) { 2373 /* no smaller was found, use first (smallest) node as the 2374 * next one */ 2375 next = (struct auth_data*)rbtree_first(&z->data); 2376 } else { 2377 next = (struct auth_data*)rbtree_next(&node->node); 2378 } 2379 while(next && (rbnode_type*)next != RBTREE_NULL && next->rrsets == NULL) { 2380 /* the next name has empty rrsets, is an empty nonterminal 2381 * itself, see if there exists something below it */ 2382 next = (struct auth_data*)rbtree_next(&node->node); 2383 } 2384 if((rbnode_type*)next == RBTREE_NULL || !next) { 2385 /* there is no next node, so something below it cannot 2386 * exist */ 2387 return 0; 2388 } 2389 /* a next node exists, if there was something below the query, 2390 * this node has to be it. See if it is below the query name */ 2391 if(dname_strict_subdomain_c(next->name, qinfo->qname)) 2392 return 1; 2393 return 0; 2394 } 2395 2396 /** create synth cname target name in buffer, or fail if too long */ 2397 static size_t 2398 synth_cname_buf(uint8_t* qname, size_t qname_len, size_t dname_len, 2399 uint8_t* dtarg, size_t dtarglen, uint8_t* buf, size_t buflen) 2400 { 2401 size_t newlen = qname_len + dtarglen - dname_len; 2402 if(newlen > buflen) { 2403 /* YXDOMAIN error */ 2404 return 0; 2405 } 2406 /* new name is concatenation of qname front (without DNAME owner) 2407 * and DNAME target name */ 2408 memcpy(buf, qname, qname_len-dname_len); 2409 memmove(buf+(qname_len-dname_len), dtarg, dtarglen); 2410 return newlen; 2411 } 2412 2413 /** create synthetic CNAME rrset for in a DNAME answer in region, 2414 * false on alloc failure, cname==NULL when name too long. */ 2415 static int 2416 create_synth_cname(uint8_t* qname, size_t qname_len, struct regional* region, 2417 struct auth_data* node, struct auth_rrset* dname, uint16_t dclass, 2418 struct ub_packed_rrset_key** cname) 2419 { 2420 uint8_t buf[LDNS_MAX_DOMAINLEN]; 2421 uint8_t* dtarg; 2422 size_t dtarglen, newlen; 2423 struct packed_rrset_data* d; 2424 2425 /* get DNAME target name */ 2426 if(dname->data->count < 1) return 0; 2427 if(dname->data->rr_len[0] < 3) return 0; /* at least rdatalen +1 */ 2428 dtarg = dname->data->rr_data[0]+2; 2429 dtarglen = dname->data->rr_len[0]-2; 2430 if(sldns_read_uint16(dname->data->rr_data[0]) != dtarglen) 2431 return 0; /* rdatalen in DNAME rdata is malformed */ 2432 if(dname_valid(dtarg, dtarglen) != dtarglen) 2433 return 0; /* DNAME RR has malformed rdata */ 2434 if(qname_len == 0) 2435 return 0; /* too short */ 2436 if(qname_len <= node->namelen) 2437 return 0; /* qname too short for dname removal */ 2438 2439 /* synthesize a CNAME */ 2440 newlen = synth_cname_buf(qname, qname_len, node->namelen, 2441 dtarg, dtarglen, buf, sizeof(buf)); 2442 if(newlen == 0) { 2443 /* YXDOMAIN error */ 2444 *cname = NULL; 2445 return 1; 2446 } 2447 *cname = (struct ub_packed_rrset_key*)regional_alloc(region, 2448 sizeof(struct ub_packed_rrset_key)); 2449 if(!*cname) 2450 return 0; /* out of memory */ 2451 memset(&(*cname)->entry, 0, sizeof((*cname)->entry)); 2452 (*cname)->entry.key = (*cname); 2453 (*cname)->rk.type = htons(LDNS_RR_TYPE_CNAME); 2454 (*cname)->rk.rrset_class = htons(dclass); 2455 (*cname)->rk.flags = 0; 2456 (*cname)->rk.dname = regional_alloc_init(region, qname, qname_len); 2457 if(!(*cname)->rk.dname) 2458 return 0; /* out of memory */ 2459 (*cname)->rk.dname_len = qname_len; 2460 (*cname)->entry.hash = rrset_key_hash(&(*cname)->rk); 2461 d = (struct packed_rrset_data*)regional_alloc_zero(region, 2462 sizeof(struct packed_rrset_data) + sizeof(size_t) + 2463 sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t) 2464 + newlen); 2465 if(!d) 2466 return 0; /* out of memory */ 2467 (*cname)->entry.data = d; 2468 d->ttl = 0; /* 0 for synthesized CNAME TTL */ 2469 d->count = 1; 2470 d->rrsig_count = 0; 2471 d->trust = rrset_trust_ans_noAA; 2472 d->rr_len = (size_t*)((uint8_t*)d + 2473 sizeof(struct packed_rrset_data)); 2474 d->rr_len[0] = newlen + sizeof(uint16_t); 2475 packed_rrset_ptr_fixup(d); 2476 d->rr_ttl[0] = d->ttl; 2477 sldns_write_uint16(d->rr_data[0], newlen); 2478 memmove(d->rr_data[0] + sizeof(uint16_t), buf, newlen); 2479 return 1; 2480 } 2481 2482 /** add a synthesized CNAME to the answer section */ 2483 static int 2484 add_synth_cname(struct auth_zone* z, uint8_t* qname, size_t qname_len, 2485 struct regional* region, struct dns_msg* msg, struct auth_data* dname, 2486 struct auth_rrset* rrset) 2487 { 2488 struct ub_packed_rrset_key* cname; 2489 /* synthesize a CNAME */ 2490 if(!create_synth_cname(qname, qname_len, region, dname, rrset, 2491 z->dclass, &cname)) { 2492 /* out of memory */ 2493 return 0; 2494 } 2495 if(!cname) { 2496 /* cname cannot be create because of YXDOMAIN */ 2497 msg->rep->flags |= LDNS_RCODE_YXDOMAIN; 2498 return 1; 2499 } 2500 /* add cname to message */ 2501 if(!msg_grow_array(region, msg)) 2502 return 0; 2503 msg->rep->rrsets[msg->rep->rrset_count] = cname; 2504 msg->rep->rrset_count++; 2505 msg->rep->an_numrrsets++; 2506 msg_ttl(msg); 2507 return 1; 2508 } 2509 2510 /** Change a dname to a different one, for wildcard namechange */ 2511 static void 2512 az_change_dnames(struct dns_msg* msg, uint8_t* oldname, uint8_t* newname, 2513 size_t newlen, int an_only) 2514 { 2515 size_t i; 2516 size_t start = 0, end = msg->rep->rrset_count; 2517 if(!an_only) start = msg->rep->an_numrrsets; 2518 if(an_only) end = msg->rep->an_numrrsets; 2519 for(i=start; i<end; i++) { 2520 /* allocated in region so we can change the ptrs */ 2521 if(query_dname_compare(msg->rep->rrsets[i]->rk.dname, oldname) 2522 == 0) { 2523 msg->rep->rrsets[i]->rk.dname = newname; 2524 msg->rep->rrsets[i]->rk.dname_len = newlen; 2525 } 2526 } 2527 } 2528 2529 /** find NSEC record covering the query */ 2530 static struct auth_rrset* 2531 az_find_nsec_cover(struct auth_zone* z, struct auth_data** node) 2532 { 2533 uint8_t* nm = (*node)->name; 2534 size_t nmlen = (*node)->namelen; 2535 struct auth_rrset* rrset; 2536 /* find the NSEC for the smallest-or-equal node */ 2537 /* if node == NULL, we did not find a smaller name. But the zone 2538 * name is the smallest name and should have an NSEC. So there is 2539 * no NSEC to return (for a properly signed zone) */ 2540 /* for empty nonterminals, the auth-data node should not exist, 2541 * and thus we don't need to go rbtree_previous here to find 2542 * a domain with an NSEC record */ 2543 /* but there could be glue, and if this is node, then it has no NSEC. 2544 * Go up to find nonglue (previous) NSEC-holding nodes */ 2545 while((rrset=az_domain_rrset(*node, LDNS_RR_TYPE_NSEC)) == NULL) { 2546 if(dname_is_root(nm)) return NULL; 2547 if(nmlen == z->namelen) return NULL; 2548 dname_remove_label(&nm, &nmlen); 2549 /* adjust *node for the nsec rrset to find in */ 2550 *node = az_find_name(z, nm, nmlen); 2551 } 2552 return rrset; 2553 } 2554 2555 /** Find NSEC and add for wildcard denial */ 2556 static int 2557 az_nsec_wildcard_denial(struct auth_zone* z, struct regional* region, 2558 struct dns_msg* msg, uint8_t* cenm, size_t cenmlen) 2559 { 2560 struct query_info qinfo; 2561 int node_exact; 2562 struct auth_data* node; 2563 struct auth_rrset* nsec; 2564 uint8_t wc[LDNS_MAX_DOMAINLEN]; 2565 if(cenmlen+2 > sizeof(wc)) 2566 return 0; /* result would be too long */ 2567 wc[0] = 1; /* length of wildcard label */ 2568 wc[1] = (uint8_t)'*'; /* wildcard label */ 2569 memmove(wc+2, cenm, cenmlen); 2570 2571 /* we have '*.ce' in wc wildcard name buffer */ 2572 /* get nsec cover for that */ 2573 qinfo.qname = wc; 2574 qinfo.qname_len = cenmlen+2; 2575 qinfo.qtype = 0; 2576 qinfo.qclass = 0; 2577 az_find_domain(z, &qinfo, &node_exact, &node); 2578 if((nsec=az_find_nsec_cover(z, &node)) != NULL) { 2579 if(!msg_add_rrset_ns(z, region, msg, node, nsec)) return 0; 2580 } 2581 return 1; 2582 } 2583 2584 /** Find the NSEC3PARAM rrset (if any) and if true you have the parameters */ 2585 static int 2586 az_nsec3_param(struct auth_zone* z, int* algo, size_t* iter, uint8_t** salt, 2587 size_t* saltlen) 2588 { 2589 struct auth_data* apex; 2590 struct auth_rrset* param; 2591 size_t i; 2592 apex = az_find_name(z, z->name, z->namelen); 2593 if(!apex) return 0; 2594 param = az_domain_rrset(apex, LDNS_RR_TYPE_NSEC3PARAM); 2595 if(!param || param->data->count==0) 2596 return 0; /* no RRset or no RRs in rrset */ 2597 /* find out which NSEC3PARAM RR has supported parameters */ 2598 /* skip unknown flags (dynamic signer is recalculating nsec3 chain) */ 2599 for(i=0; i<param->data->count; i++) { 2600 uint8_t* rdata = param->data->rr_data[i]+2; 2601 size_t rdatalen = param->data->rr_len[i]; 2602 if(rdatalen < 2+5) 2603 continue; /* too short */ 2604 if(!nsec3_hash_algo_size_supported((int)(rdata[0]))) 2605 continue; /* unsupported algo */ 2606 if(rdatalen < (size_t)(2+5+(size_t)rdata[4])) 2607 continue; /* salt missing */ 2608 if((rdata[1]&NSEC3_UNKNOWN_FLAGS)!=0) 2609 continue; /* unknown flags */ 2610 *algo = (int)(rdata[0]); 2611 *iter = sldns_read_uint16(rdata+2); 2612 *saltlen = rdata[4]; 2613 if(*saltlen == 0) 2614 *salt = NULL; 2615 else *salt = rdata+5; 2616 return 1; 2617 } 2618 /* no supported params */ 2619 return 0; 2620 } 2621 2622 /** Hash a name with nsec3param into buffer, it has zone name appended. 2623 * return length of hash */ 2624 static size_t 2625 az_nsec3_hash(uint8_t* buf, size_t buflen, uint8_t* nm, size_t nmlen, 2626 int algo, size_t iter, uint8_t* salt, size_t saltlen) 2627 { 2628 size_t hlen = nsec3_hash_algo_size_supported(algo); 2629 /* buffer has domain name, nsec3hash, and 256 is for max saltlen 2630 * (salt has 0-255 length) */ 2631 unsigned char p[LDNS_MAX_DOMAINLEN+1+N3HASHBUFLEN+256]; 2632 size_t i; 2633 if(nmlen+saltlen > sizeof(p) || hlen+saltlen > sizeof(p)) 2634 return 0; 2635 if(hlen > buflen) 2636 return 0; /* somehow too large for destination buffer */ 2637 /* hashfunc(name, salt) */ 2638 memmove(p, nm, nmlen); 2639 query_dname_tolower(p); 2640 if(salt && saltlen > 0) 2641 memmove(p+nmlen, salt, saltlen); 2642 (void)secalgo_nsec3_hash(algo, p, nmlen+saltlen, (unsigned char*)buf); 2643 for(i=0; i<iter; i++) { 2644 /* hashfunc(hash, salt) */ 2645 memmove(p, buf, hlen); 2646 if(salt && saltlen > 0) 2647 memmove(p+hlen, salt, saltlen); 2648 (void)secalgo_nsec3_hash(algo, p, hlen+saltlen, 2649 (unsigned char*)buf); 2650 } 2651 return hlen; 2652 } 2653 2654 /** Hash name and return b32encoded hashname for lookup, zone name appended */ 2655 static int 2656 az_nsec3_hashname(struct auth_zone* z, uint8_t* hashname, size_t* hashnmlen, 2657 uint8_t* nm, size_t nmlen, int algo, size_t iter, uint8_t* salt, 2658 size_t saltlen) 2659 { 2660 uint8_t hash[N3HASHBUFLEN]; 2661 size_t hlen; 2662 int ret; 2663 hlen = az_nsec3_hash(hash, sizeof(hash), nm, nmlen, algo, iter, 2664 salt, saltlen); 2665 if(!hlen) return 0; 2666 /* b32 encode */ 2667 if(*hashnmlen < hlen*2+1+z->namelen) /* approx b32 as hexb16 */ 2668 return 0; 2669 ret = sldns_b32_ntop_extended_hex(hash, hlen, (char*)(hashname+1), 2670 (*hashnmlen)-1); 2671 if(ret<1) 2672 return 0; 2673 hashname[0] = (uint8_t)ret; 2674 ret++; 2675 if((*hashnmlen) - ret < z->namelen) 2676 return 0; 2677 memmove(hashname+ret, z->name, z->namelen); 2678 *hashnmlen = z->namelen+(size_t)ret; 2679 return 1; 2680 } 2681 2682 /** Find the datanode that covers the nsec3hash-name */ 2683 static struct auth_data* 2684 az_nsec3_findnode(struct auth_zone* z, uint8_t* hashnm, size_t hashnmlen) 2685 { 2686 struct query_info qinfo; 2687 struct auth_data* node; 2688 int node_exact; 2689 qinfo.qclass = 0; 2690 qinfo.qtype = 0; 2691 qinfo.qname = hashnm; 2692 qinfo.qname_len = hashnmlen; 2693 /* because canonical ordering and b32 nsec3 ordering are the same. 2694 * this is a good lookup to find the nsec3 name. */ 2695 az_find_domain(z, &qinfo, &node_exact, &node); 2696 /* but we may have to skip non-nsec3 nodes */ 2697 /* this may be a lot, the way to speed that up is to have a 2698 * separate nsec3 tree with nsec3 nodes */ 2699 while(node && (rbnode_type*)node != RBTREE_NULL && 2700 !az_domain_rrset(node, LDNS_RR_TYPE_NSEC3)) { 2701 node = (struct auth_data*)rbtree_previous(&node->node); 2702 } 2703 if((rbnode_type*)node == RBTREE_NULL) 2704 node = NULL; 2705 return node; 2706 } 2707 2708 /** Find cover for hashed(nm, nmlen) (or NULL) */ 2709 static struct auth_data* 2710 az_nsec3_find_cover(struct auth_zone* z, uint8_t* nm, size_t nmlen, 2711 int algo, size_t iter, uint8_t* salt, size_t saltlen) 2712 { 2713 struct auth_data* node; 2714 uint8_t hname[LDNS_MAX_DOMAINLEN]; 2715 size_t hlen = sizeof(hname); 2716 if(!az_nsec3_hashname(z, hname, &hlen, nm, nmlen, algo, iter, 2717 salt, saltlen)) 2718 return NULL; 2719 node = az_nsec3_findnode(z, hname, hlen); 2720 if(node) 2721 return node; 2722 /* we did not find any, perhaps because the NSEC3 hash is before 2723 * the first hash, we have to find the 'last hash' in the zone */ 2724 node = (struct auth_data*)rbtree_last(&z->data); 2725 while(node && (rbnode_type*)node != RBTREE_NULL && 2726 !az_domain_rrset(node, LDNS_RR_TYPE_NSEC3)) { 2727 node = (struct auth_data*)rbtree_previous(&node->node); 2728 } 2729 if((rbnode_type*)node == RBTREE_NULL) 2730 node = NULL; 2731 return node; 2732 } 2733 2734 /** Find exact match for hashed(nm, nmlen) NSEC3 record or NULL */ 2735 static struct auth_data* 2736 az_nsec3_find_exact(struct auth_zone* z, uint8_t* nm, size_t nmlen, 2737 int algo, size_t iter, uint8_t* salt, size_t saltlen) 2738 { 2739 struct auth_data* node; 2740 uint8_t hname[LDNS_MAX_DOMAINLEN]; 2741 size_t hlen = sizeof(hname); 2742 if(!az_nsec3_hashname(z, hname, &hlen, nm, nmlen, algo, iter, 2743 salt, saltlen)) 2744 return NULL; 2745 node = az_find_name(z, hname, hlen); 2746 if(az_domain_rrset(node, LDNS_RR_TYPE_NSEC3)) 2747 return node; 2748 return NULL; 2749 } 2750 2751 /** Return nextcloser name (as a ref into the qname). This is one label 2752 * more than the cenm (cename must be a suffix of qname) */ 2753 static void 2754 az_nsec3_get_nextcloser(uint8_t* cenm, uint8_t* qname, size_t qname_len, 2755 uint8_t** nx, size_t* nxlen) 2756 { 2757 int celabs = dname_count_labels(cenm); 2758 int qlabs = dname_count_labels(qname); 2759 int strip = qlabs - celabs -1; 2760 log_assert(dname_strict_subdomain(qname, qlabs, cenm, celabs)); 2761 *nx = qname; 2762 *nxlen = qname_len; 2763 if(strip>0) 2764 dname_remove_labels(nx, nxlen, strip); 2765 } 2766 2767 /** Find the closest encloser that has exact NSEC3. 2768 * updated cenm to the new name. If it went up no-exact-ce is true. */ 2769 static struct auth_data* 2770 az_nsec3_find_ce(struct auth_zone* z, uint8_t** cenm, size_t* cenmlen, 2771 int* no_exact_ce, int algo, size_t iter, uint8_t* salt, size_t saltlen) 2772 { 2773 struct auth_data* node; 2774 while((node = az_nsec3_find_exact(z, *cenm, *cenmlen, 2775 algo, iter, salt, saltlen)) == NULL) { 2776 if(*cenmlen == z->namelen) { 2777 /* next step up would take us out of the zone. fail */ 2778 return NULL; 2779 } 2780 *no_exact_ce = 1; 2781 dname_remove_label(cenm, cenmlen); 2782 } 2783 return node; 2784 } 2785 2786 /* Insert NSEC3 record in authority section, if NULL does nothing */ 2787 static int 2788 az_nsec3_insert(struct auth_zone* z, struct regional* region, 2789 struct dns_msg* msg, struct auth_data* node) 2790 { 2791 struct auth_rrset* nsec3; 2792 if(!node) return 1; /* no node, skip this */ 2793 nsec3 = az_domain_rrset(node, LDNS_RR_TYPE_NSEC3); 2794 if(!nsec3) return 1; /* if no nsec3 RR, skip it */ 2795 if(!msg_add_rrset_ns(z, region, msg, node, nsec3)) return 0; 2796 return 1; 2797 } 2798 2799 /** add NSEC3 records to the zone for the nsec3 proof. 2800 * Specify with the flags with parts of the proof are required. 2801 * the ce is the exact matching name (for notype) but also delegation points. 2802 * qname is the one where the nextcloser name can be derived from. 2803 * If NSEC3 is not properly there (in the zone) nothing is added. 2804 * always enabled: include nsec3 proving about the Closest Encloser. 2805 * that is an exact match that should exist for it. 2806 * If that does not exist, a higher exact match + nxproof is enabled 2807 * (for some sort of opt-out empty nonterminal cases). 2808 * nodataproof: search for exact match and include that instead. 2809 * ceproof: include ce proof NSEC3 (omitted for wildcard replies). 2810 * nxproof: include denial of the qname. 2811 * wcproof: include denial of wildcard (wildcard.ce). 2812 */ 2813 static int 2814 az_add_nsec3_proof(struct auth_zone* z, struct regional* region, 2815 struct dns_msg* msg, uint8_t* cenm, size_t cenmlen, uint8_t* qname, 2816 size_t qname_len, int nodataproof, int ceproof, int nxproof, 2817 int wcproof) 2818 { 2819 int algo; 2820 size_t iter, saltlen; 2821 uint8_t* salt; 2822 int no_exact_ce = 0; 2823 struct auth_data* node; 2824 2825 /* find parameters of nsec3 proof */ 2826 if(!az_nsec3_param(z, &algo, &iter, &salt, &saltlen)) 2827 return 1; /* no nsec3 */ 2828 if(nodataproof) { 2829 /* see if the node has a hash of itself for the nodata 2830 * proof nsec3, this has to be an exact match nsec3. */ 2831 struct auth_data* match; 2832 match = az_nsec3_find_exact(z, qname, qname_len, algo, 2833 iter, salt, saltlen); 2834 if(match) { 2835 if(!az_nsec3_insert(z, region, msg, match)) 2836 return 0; 2837 /* only nodata NSEC3 needed, no CE or others. */ 2838 return 1; 2839 } 2840 } 2841 /* find ce that has an NSEC3 */ 2842 if(ceproof) { 2843 node = az_nsec3_find_ce(z, &cenm, &cenmlen, &no_exact_ce, 2844 algo, iter, salt, saltlen); 2845 if(no_exact_ce) nxproof = 1; 2846 if(!az_nsec3_insert(z, region, msg, node)) 2847 return 0; 2848 } 2849 2850 if(nxproof) { 2851 uint8_t* nx; 2852 size_t nxlen; 2853 /* create nextcloser domain name */ 2854 az_nsec3_get_nextcloser(cenm, qname, qname_len, &nx, &nxlen); 2855 /* find nsec3 that matches or covers it */ 2856 node = az_nsec3_find_cover(z, nx, nxlen, algo, iter, salt, 2857 saltlen); 2858 if(!az_nsec3_insert(z, region, msg, node)) 2859 return 0; 2860 } 2861 if(wcproof) { 2862 /* create wildcard name *.ce */ 2863 uint8_t wc[LDNS_MAX_DOMAINLEN]; 2864 size_t wclen; 2865 if(cenmlen+2 > sizeof(wc)) 2866 return 0; /* result would be too long */ 2867 wc[0] = 1; /* length of wildcard label */ 2868 wc[1] = (uint8_t)'*'; /* wildcard label */ 2869 memmove(wc+2, cenm, cenmlen); 2870 wclen = cenmlen+2; 2871 /* find nsec3 that matches or covers it */ 2872 node = az_nsec3_find_cover(z, wc, wclen, algo, iter, salt, 2873 saltlen); 2874 if(!az_nsec3_insert(z, region, msg, node)) 2875 return 0; 2876 } 2877 return 1; 2878 } 2879 2880 /** generate answer for positive answer */ 2881 static int 2882 az_generate_positive_answer(struct auth_zone* z, struct regional* region, 2883 struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset) 2884 { 2885 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 2886 /* see if we want additional rrs */ 2887 if(rrset->type == LDNS_RR_TYPE_MX) { 2888 if(!az_add_additionals_from(z, region, msg, rrset, 2)) 2889 return 0; 2890 } else if(rrset->type == LDNS_RR_TYPE_SRV) { 2891 if(!az_add_additionals_from(z, region, msg, rrset, 6)) 2892 return 0; 2893 } else if(rrset->type == LDNS_RR_TYPE_NS) { 2894 if(!az_add_additionals_from(z, region, msg, rrset, 0)) 2895 return 0; 2896 } 2897 return 1; 2898 } 2899 2900 /** generate answer for type ANY answer */ 2901 static int 2902 az_generate_any_answer(struct auth_zone* z, struct regional* region, 2903 struct dns_msg* msg, struct auth_data* node) 2904 { 2905 struct auth_rrset* rrset; 2906 int added = 0; 2907 /* add a couple (at least one) RRs */ 2908 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_SOA)) != NULL) { 2909 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 2910 added++; 2911 } 2912 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_MX)) != NULL) { 2913 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 2914 added++; 2915 } 2916 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_A)) != NULL) { 2917 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 2918 added++; 2919 } 2920 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_AAAA)) != NULL) { 2921 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 2922 added++; 2923 } 2924 if(added == 0 && node && node->rrsets) { 2925 if(!msg_add_rrset_an(z, region, msg, node, 2926 node->rrsets)) return 0; 2927 } 2928 return 1; 2929 } 2930 2931 /** follow cname chain and add more data to the answer section */ 2932 static int 2933 follow_cname_chain(struct auth_zone* z, uint16_t qtype, 2934 struct regional* region, struct dns_msg* msg, 2935 struct packed_rrset_data* d) 2936 { 2937 int maxchain = 0; 2938 /* see if we can add the target of the CNAME into the answer */ 2939 while(maxchain++ < MAX_CNAME_CHAIN) { 2940 struct auth_data* node; 2941 struct auth_rrset* rrset; 2942 size_t clen; 2943 /* d has cname rdata */ 2944 if(d->count == 0) break; /* no CNAME */ 2945 if(d->rr_len[0] < 2+1) break; /* too small */ 2946 if((clen=dname_valid(d->rr_data[0]+2, d->rr_len[0]-2))==0) 2947 break; /* malformed */ 2948 if(!dname_subdomain_c(d->rr_data[0]+2, z->name)) 2949 break; /* target out of zone */ 2950 if((node = az_find_name(z, d->rr_data[0]+2, clen))==NULL) 2951 break; /* no such target name */ 2952 if((rrset=az_domain_rrset(node, qtype))!=NULL) { 2953 /* done we found the target */ 2954 if(!msg_add_rrset_an(z, region, msg, node, rrset)) 2955 return 0; 2956 break; 2957 } 2958 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_CNAME))==NULL) 2959 break; /* no further CNAME chain, notype */ 2960 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 2961 d = rrset->data; 2962 } 2963 return 1; 2964 } 2965 2966 /** generate answer for cname answer */ 2967 static int 2968 az_generate_cname_answer(struct auth_zone* z, struct query_info* qinfo, 2969 struct regional* region, struct dns_msg* msg, 2970 struct auth_data* node, struct auth_rrset* rrset) 2971 { 2972 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 2973 if(!rrset) return 1; 2974 if(!follow_cname_chain(z, qinfo->qtype, region, msg, rrset->data)) 2975 return 0; 2976 return 1; 2977 } 2978 2979 /** generate answer for notype answer */ 2980 static int 2981 az_generate_notype_answer(struct auth_zone* z, struct regional* region, 2982 struct dns_msg* msg, struct auth_data* node) 2983 { 2984 struct auth_rrset* rrset; 2985 if(!az_add_negative_soa(z, region, msg)) return 0; 2986 /* DNSSEC denial NSEC */ 2987 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_NSEC))!=NULL) { 2988 if(!msg_add_rrset_ns(z, region, msg, node, rrset)) return 0; 2989 } else if(node) { 2990 /* DNSSEC denial NSEC3 */ 2991 if(!az_add_nsec3_proof(z, region, msg, node->name, 2992 node->namelen, msg->qinfo.qname, 2993 msg->qinfo.qname_len, 1, 1, 0, 0)) 2994 return 0; 2995 } 2996 return 1; 2997 } 2998 2999 /** generate answer for referral answer */ 3000 static int 3001 az_generate_referral_answer(struct auth_zone* z, struct regional* region, 3002 struct dns_msg* msg, struct auth_data* ce, struct auth_rrset* rrset) 3003 { 3004 struct auth_rrset* ds, *nsec; 3005 /* turn off AA flag, referral is nonAA because it leaves the zone */ 3006 log_assert(ce); 3007 msg->rep->flags &= ~BIT_AA; 3008 if(!msg_add_rrset_ns(z, region, msg, ce, rrset)) return 0; 3009 /* add DS or deny it */ 3010 if((ds=az_domain_rrset(ce, LDNS_RR_TYPE_DS))!=NULL) { 3011 if(!msg_add_rrset_ns(z, region, msg, ce, ds)) return 0; 3012 } else { 3013 /* deny the DS */ 3014 if((nsec=az_domain_rrset(ce, LDNS_RR_TYPE_NSEC))!=NULL) { 3015 if(!msg_add_rrset_ns(z, region, msg, ce, nsec)) 3016 return 0; 3017 } else { 3018 if(!az_add_nsec3_proof(z, region, msg, ce->name, 3019 ce->namelen, msg->qinfo.qname, 3020 msg->qinfo.qname_len, 1, 1, 0, 0)) 3021 return 0; 3022 } 3023 } 3024 /* add additional rrs for type NS */ 3025 if(!az_add_additionals_from(z, region, msg, rrset, 0)) return 0; 3026 return 1; 3027 } 3028 3029 /** generate answer for DNAME answer */ 3030 static int 3031 az_generate_dname_answer(struct auth_zone* z, struct query_info* qinfo, 3032 struct regional* region, struct dns_msg* msg, struct auth_data* ce, 3033 struct auth_rrset* rrset) 3034 { 3035 log_assert(ce); 3036 /* add the DNAME and then a CNAME */ 3037 if(!msg_add_rrset_an(z, region, msg, ce, rrset)) return 0; 3038 if(!add_synth_cname(z, qinfo->qname, qinfo->qname_len, region, 3039 msg, ce, rrset)) return 0; 3040 if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_YXDOMAIN) 3041 return 1; 3042 if(msg->rep->rrset_count == 0 || 3043 !msg->rep->rrsets[msg->rep->rrset_count-1]) 3044 return 0; 3045 if(!follow_cname_chain(z, qinfo->qtype, region, msg, 3046 (struct packed_rrset_data*)msg->rep->rrsets[ 3047 msg->rep->rrset_count-1]->entry.data)) 3048 return 0; 3049 return 1; 3050 } 3051 3052 /** generate answer for wildcard answer */ 3053 static int 3054 az_generate_wildcard_answer(struct auth_zone* z, struct query_info* qinfo, 3055 struct regional* region, struct dns_msg* msg, struct auth_data* ce, 3056 struct auth_data* wildcard, struct auth_data* node) 3057 { 3058 struct auth_rrset* rrset, *nsec; 3059 int insert_ce = 0; 3060 if((rrset=az_domain_rrset(wildcard, qinfo->qtype)) != NULL) { 3061 /* wildcard has type, add it */ 3062 if(!msg_add_rrset_an(z, region, msg, wildcard, rrset)) 3063 return 0; 3064 az_change_dnames(msg, wildcard->name, msg->qinfo.qname, 3065 msg->qinfo.qname_len, 1); 3066 } else if((rrset=az_domain_rrset(wildcard, LDNS_RR_TYPE_CNAME))!=NULL) { 3067 /* wildcard has cname instead, do that */ 3068 if(!msg_add_rrset_an(z, region, msg, wildcard, rrset)) 3069 return 0; 3070 az_change_dnames(msg, wildcard->name, msg->qinfo.qname, 3071 msg->qinfo.qname_len, 1); 3072 if(!follow_cname_chain(z, qinfo->qtype, region, msg, 3073 rrset->data)) 3074 return 0; 3075 } else if(qinfo->qtype == LDNS_RR_TYPE_ANY && wildcard->rrsets) { 3076 /* add ANY rrsets from wildcard node */ 3077 if(!az_generate_any_answer(z, region, msg, wildcard)) 3078 return 0; 3079 az_change_dnames(msg, wildcard->name, msg->qinfo.qname, 3080 msg->qinfo.qname_len, 1); 3081 } else { 3082 /* wildcard has nodata, notype answer */ 3083 /* call other notype routine for dnssec notype denials */ 3084 if(!az_generate_notype_answer(z, region, msg, wildcard)) 3085 return 0; 3086 /* because the notype, there is no positive data with an 3087 * RRSIG that indicates the wildcard position. Thus the 3088 * wildcard qname denial needs to have a CE nsec3. */ 3089 insert_ce = 1; 3090 } 3091 3092 /* ce and node for dnssec denial of wildcard original name */ 3093 if((nsec=az_find_nsec_cover(z, &node)) != NULL) { 3094 if(!msg_add_rrset_ns(z, region, msg, node, nsec)) return 0; 3095 } else if(ce) { 3096 uint8_t* wildup = wildcard->name; 3097 size_t wilduplen= wildcard->namelen; 3098 dname_remove_label(&wildup, &wilduplen); 3099 if(!az_add_nsec3_proof(z, region, msg, wildup, 3100 wilduplen, msg->qinfo.qname, 3101 msg->qinfo.qname_len, 0, insert_ce, 1, 0)) 3102 return 0; 3103 } 3104 3105 /* fixup name of wildcard from *.zone to qname, use already allocated 3106 * pointer to msg qname */ 3107 az_change_dnames(msg, wildcard->name, msg->qinfo.qname, 3108 msg->qinfo.qname_len, 0); 3109 return 1; 3110 } 3111 3112 /** generate answer for nxdomain answer */ 3113 static int 3114 az_generate_nxdomain_answer(struct auth_zone* z, struct regional* region, 3115 struct dns_msg* msg, struct auth_data* ce, struct auth_data* node) 3116 { 3117 struct auth_rrset* nsec; 3118 msg->rep->flags |= LDNS_RCODE_NXDOMAIN; 3119 if(!az_add_negative_soa(z, region, msg)) return 0; 3120 if((nsec=az_find_nsec_cover(z, &node)) != NULL) { 3121 if(!msg_add_rrset_ns(z, region, msg, node, nsec)) return 0; 3122 if(ce && !az_nsec_wildcard_denial(z, region, msg, ce->name, 3123 ce->namelen)) return 0; 3124 } else if(ce) { 3125 if(!az_add_nsec3_proof(z, region, msg, ce->name, 3126 ce->namelen, msg->qinfo.qname, 3127 msg->qinfo.qname_len, 0, 1, 1, 1)) 3128 return 0; 3129 } 3130 return 1; 3131 } 3132 3133 /** Create answers when an exact match exists for the domain name */ 3134 static int 3135 az_generate_answer_with_node(struct auth_zone* z, struct query_info* qinfo, 3136 struct regional* region, struct dns_msg* msg, struct auth_data* node) 3137 { 3138 struct auth_rrset* rrset; 3139 /* positive answer, rrset we are looking for exists */ 3140 if((rrset=az_domain_rrset(node, qinfo->qtype)) != NULL) { 3141 return az_generate_positive_answer(z, region, msg, node, rrset); 3142 } 3143 /* CNAME? */ 3144 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_CNAME)) != NULL) { 3145 return az_generate_cname_answer(z, qinfo, region, msg, 3146 node, rrset); 3147 } 3148 /* type ANY ? */ 3149 if(qinfo->qtype == LDNS_RR_TYPE_ANY) { 3150 return az_generate_any_answer(z, region, msg, node); 3151 } 3152 /* NOERROR/NODATA (no such type at domain name) */ 3153 return az_generate_notype_answer(z, region, msg, node); 3154 } 3155 3156 /** Generate answer without an existing-node that we can use. 3157 * So it'll be a referral, DNAME or nxdomain */ 3158 static int 3159 az_generate_answer_nonexistnode(struct auth_zone* z, struct query_info* qinfo, 3160 struct regional* region, struct dns_msg* msg, struct auth_data* ce, 3161 struct auth_rrset* rrset, struct auth_data* node) 3162 { 3163 struct auth_data* wildcard; 3164 3165 /* we do not have an exact matching name (that exists) */ 3166 /* see if we have a NS or DNAME in the ce */ 3167 if(ce && rrset && rrset->type == LDNS_RR_TYPE_NS) { 3168 return az_generate_referral_answer(z, region, msg, ce, rrset); 3169 } 3170 if(ce && rrset && rrset->type == LDNS_RR_TYPE_DNAME) { 3171 return az_generate_dname_answer(z, qinfo, region, msg, ce, 3172 rrset); 3173 } 3174 /* if there is an empty nonterminal, wildcard and nxdomain don't 3175 * happen, it is a notype answer */ 3176 if(az_empty_nonterminal(z, qinfo, node)) { 3177 return az_generate_notype_answer(z, region, msg, node); 3178 } 3179 /* see if we have a wildcard under the ce */ 3180 if((wildcard=az_find_wildcard(z, qinfo, ce)) != NULL) { 3181 return az_generate_wildcard_answer(z, qinfo, region, msg, 3182 ce, wildcard, node); 3183 } 3184 /* generate nxdomain answer */ 3185 return az_generate_nxdomain_answer(z, region, msg, ce, node); 3186 } 3187 3188 /** Lookup answer in a zone. */ 3189 static int 3190 auth_zone_generate_answer(struct auth_zone* z, struct query_info* qinfo, 3191 struct regional* region, struct dns_msg** msg, int* fallback) 3192 { 3193 struct auth_data* node, *ce; 3194 struct auth_rrset* rrset; 3195 int node_exact, node_exists; 3196 /* does the zone want fallback in case of failure? */ 3197 *fallback = z->fallback_enabled; 3198 if(!(*msg=msg_create(region, qinfo))) return 0; 3199 3200 /* lookup if there is a matching domain name for the query */ 3201 az_find_domain(z, qinfo, &node_exact, &node); 3202 3203 /* see if node exists for generating answers from (i.e. not glue and 3204 * obscured by NS or DNAME or NSEC3-only), and also return the 3205 * closest-encloser from that, closest node that should be used 3206 * to generate answers from that is above the query */ 3207 node_exists = az_find_ce(z, qinfo, node, node_exact, &ce, &rrset); 3208 3209 if(verbosity >= VERB_ALGO) { 3210 char zname[256], qname[256], nname[256], cename[256], 3211 tpstr[32], rrstr[32]; 3212 sldns_wire2str_dname_buf(qinfo->qname, qinfo->qname_len, qname, 3213 sizeof(qname)); 3214 sldns_wire2str_type_buf(qinfo->qtype, tpstr, sizeof(tpstr)); 3215 sldns_wire2str_dname_buf(z->name, z->namelen, zname, 3216 sizeof(zname)); 3217 if(node) 3218 sldns_wire2str_dname_buf(node->name, node->namelen, 3219 nname, sizeof(nname)); 3220 else snprintf(nname, sizeof(nname), "NULL"); 3221 if(ce) 3222 sldns_wire2str_dname_buf(ce->name, ce->namelen, 3223 cename, sizeof(cename)); 3224 else snprintf(cename, sizeof(cename), "NULL"); 3225 if(rrset) sldns_wire2str_type_buf(rrset->type, rrstr, 3226 sizeof(rrstr)); 3227 else snprintf(rrstr, sizeof(rrstr), "NULL"); 3228 log_info("auth_zone %s query %s %s, domain %s %s %s, " 3229 "ce %s, rrset %s", zname, qname, tpstr, nname, 3230 (node_exact?"exact":"notexact"), 3231 (node_exists?"exist":"notexist"), cename, rrstr); 3232 } 3233 3234 if(node_exists) { 3235 /* the node is fine, generate answer from node */ 3236 return az_generate_answer_with_node(z, qinfo, region, *msg, 3237 node); 3238 } 3239 return az_generate_answer_nonexistnode(z, qinfo, region, *msg, 3240 ce, rrset, node); 3241 } 3242 3243 int auth_zones_lookup(struct auth_zones* az, struct query_info* qinfo, 3244 struct regional* region, struct dns_msg** msg, int* fallback, 3245 uint8_t* dp_nm, size_t dp_nmlen) 3246 { 3247 int r; 3248 struct auth_zone* z; 3249 /* find the zone that should contain the answer. */ 3250 lock_rw_rdlock(&az->lock); 3251 z = auth_zone_find(az, dp_nm, dp_nmlen, qinfo->qclass); 3252 if(!z) { 3253 lock_rw_unlock(&az->lock); 3254 /* no auth zone, fallback to internet */ 3255 *fallback = 1; 3256 return 0; 3257 } 3258 lock_rw_rdlock(&z->lock); 3259 lock_rw_unlock(&az->lock); 3260 3261 /* if not for upstream queries, fallback */ 3262 if(!z->for_upstream) { 3263 lock_rw_unlock(&z->lock); 3264 *fallback = 1; 3265 return 0; 3266 } 3267 if(z->zone_expired) { 3268 *fallback = z->fallback_enabled; 3269 lock_rw_unlock(&z->lock); 3270 return 0; 3271 } 3272 /* see what answer that zone would generate */ 3273 r = auth_zone_generate_answer(z, qinfo, region, msg, fallback); 3274 lock_rw_unlock(&z->lock); 3275 return r; 3276 } 3277 3278 /** encode auth answer */ 3279 static void 3280 auth_answer_encode(struct query_info* qinfo, struct module_env* env, 3281 struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf, 3282 struct regional* temp, struct dns_msg* msg) 3283 { 3284 uint16_t udpsize; 3285 udpsize = edns->udp_size; 3286 edns->edns_version = EDNS_ADVERTISED_VERSION; 3287 edns->udp_size = EDNS_ADVERTISED_SIZE; 3288 edns->ext_rcode = 0; 3289 edns->bits &= EDNS_DO; 3290 3291 if(!inplace_cb_reply_local_call(env, qinfo, NULL, msg->rep, 3292 (int)FLAGS_GET_RCODE(msg->rep->flags), edns, repinfo, temp, env->now_tv) 3293 || !reply_info_answer_encode(qinfo, msg->rep, 3294 *(uint16_t*)sldns_buffer_begin(buf), 3295 sldns_buffer_read_u16_at(buf, 2), 3296 buf, 0, 0, temp, udpsize, edns, 3297 (int)(edns->bits&EDNS_DO), 0)) { 3298 error_encode(buf, (LDNS_RCODE_SERVFAIL|BIT_AA), qinfo, 3299 *(uint16_t*)sldns_buffer_begin(buf), 3300 sldns_buffer_read_u16_at(buf, 2), edns); 3301 } 3302 } 3303 3304 /** encode auth error answer */ 3305 static void 3306 auth_error_encode(struct query_info* qinfo, struct module_env* env, 3307 struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf, 3308 struct regional* temp, int rcode) 3309 { 3310 edns->edns_version = EDNS_ADVERTISED_VERSION; 3311 edns->udp_size = EDNS_ADVERTISED_SIZE; 3312 edns->ext_rcode = 0; 3313 edns->bits &= EDNS_DO; 3314 3315 if(!inplace_cb_reply_local_call(env, qinfo, NULL, NULL, 3316 rcode, edns, repinfo, temp, env->now_tv)) 3317 edns->opt_list = NULL; 3318 error_encode(buf, rcode|BIT_AA, qinfo, 3319 *(uint16_t*)sldns_buffer_begin(buf), 3320 sldns_buffer_read_u16_at(buf, 2), edns); 3321 } 3322 3323 int auth_zones_answer(struct auth_zones* az, struct module_env* env, 3324 struct query_info* qinfo, struct edns_data* edns, 3325 struct comm_reply* repinfo, struct sldns_buffer* buf, struct regional* temp) 3326 { 3327 struct dns_msg* msg = NULL; 3328 struct auth_zone* z; 3329 int r; 3330 int fallback = 0; 3331 3332 lock_rw_rdlock(&az->lock); 3333 if(!az->have_downstream) { 3334 /* no downstream auth zones */ 3335 lock_rw_unlock(&az->lock); 3336 return 0; 3337 } 3338 if(qinfo->qtype == LDNS_RR_TYPE_DS) { 3339 uint8_t* delname = qinfo->qname; 3340 size_t delnamelen = qinfo->qname_len; 3341 dname_remove_label(&delname, &delnamelen); 3342 z = auth_zones_find_zone(az, delname, delnamelen, 3343 qinfo->qclass); 3344 } else { 3345 z = auth_zones_find_zone(az, qinfo->qname, qinfo->qname_len, 3346 qinfo->qclass); 3347 } 3348 if(!z) { 3349 /* no zone above it */ 3350 lock_rw_unlock(&az->lock); 3351 return 0; 3352 } 3353 lock_rw_rdlock(&z->lock); 3354 lock_rw_unlock(&az->lock); 3355 if(!z->for_downstream) { 3356 lock_rw_unlock(&z->lock); 3357 return 0; 3358 } 3359 if(z->zone_expired) { 3360 if(z->fallback_enabled) { 3361 lock_rw_unlock(&z->lock); 3362 return 0; 3363 } 3364 lock_rw_unlock(&z->lock); 3365 lock_rw_wrlock(&az->lock); 3366 az->num_query_down++; 3367 lock_rw_unlock(&az->lock); 3368 auth_error_encode(qinfo, env, edns, repinfo, buf, temp, 3369 LDNS_RCODE_SERVFAIL); 3370 return 1; 3371 } 3372 3373 /* answer it from zone z */ 3374 r = auth_zone_generate_answer(z, qinfo, temp, &msg, &fallback); 3375 lock_rw_unlock(&z->lock); 3376 if(!r && fallback) { 3377 /* fallback to regular answering (recursive) */ 3378 return 0; 3379 } 3380 lock_rw_wrlock(&az->lock); 3381 az->num_query_down++; 3382 lock_rw_unlock(&az->lock); 3383 3384 /* encode answer */ 3385 if(!r) 3386 auth_error_encode(qinfo, env, edns, repinfo, buf, temp, 3387 LDNS_RCODE_SERVFAIL); 3388 else auth_answer_encode(qinfo, env, edns, repinfo, buf, temp, msg); 3389 3390 return 1; 3391 } 3392 3393 int auth_zones_can_fallback(struct auth_zones* az, uint8_t* nm, size_t nmlen, 3394 uint16_t dclass) 3395 { 3396 int r; 3397 struct auth_zone* z; 3398 lock_rw_rdlock(&az->lock); 3399 z = auth_zone_find(az, nm, nmlen, dclass); 3400 if(!z) { 3401 lock_rw_unlock(&az->lock); 3402 /* no such auth zone, fallback */ 3403 return 1; 3404 } 3405 lock_rw_rdlock(&z->lock); 3406 lock_rw_unlock(&az->lock); 3407 r = z->fallback_enabled || (!z->for_upstream); 3408 lock_rw_unlock(&z->lock); 3409 return r; 3410 } 3411 3412 int 3413 auth_zone_parse_notify_serial(sldns_buffer* pkt, uint32_t *serial) 3414 { 3415 struct query_info q; 3416 uint16_t rdlen; 3417 memset(&q, 0, sizeof(q)); 3418 sldns_buffer_set_position(pkt, 0); 3419 if(!query_info_parse(&q, pkt)) return 0; 3420 if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) == 0) return 0; 3421 /* skip name of RR in answer section */ 3422 if(sldns_buffer_remaining(pkt) < 1) return 0; 3423 if(pkt_dname_len(pkt) == 0) return 0; 3424 /* check type */ 3425 if(sldns_buffer_remaining(pkt) < 10 /* type,class,ttl,rdatalen*/) 3426 return 0; 3427 if(sldns_buffer_read_u16(pkt) != LDNS_RR_TYPE_SOA) return 0; 3428 sldns_buffer_skip(pkt, 2); /* class */ 3429 sldns_buffer_skip(pkt, 4); /* ttl */ 3430 rdlen = sldns_buffer_read_u16(pkt); /* rdatalen */ 3431 if(sldns_buffer_remaining(pkt) < rdlen) return 0; 3432 if(rdlen < 22) return 0; /* bad soa length */ 3433 sldns_buffer_skip(pkt, (ssize_t)(rdlen-20)); 3434 *serial = sldns_buffer_read_u32(pkt); 3435 /* return true when has serial in answer section */ 3436 return 1; 3437 } 3438 3439 /** see if addr appears in the list */ 3440 static int 3441 addr_in_list(struct auth_addr* list, struct sockaddr_storage* addr, 3442 socklen_t addrlen) 3443 { 3444 struct auth_addr* p; 3445 for(p=list; p; p=p->next) { 3446 if(sockaddr_cmp_addr(addr, addrlen, &p->addr, p->addrlen)==0) 3447 return 1; 3448 } 3449 return 0; 3450 } 3451 3452 /** check if an address matches a master specification (or one of its 3453 * addresses in the addr list) */ 3454 static int 3455 addr_matches_master(struct auth_master* master, struct sockaddr_storage* addr, 3456 socklen_t addrlen, struct auth_master** fromhost) 3457 { 3458 struct sockaddr_storage a; 3459 socklen_t alen = 0; 3460 int net = 0; 3461 if(addr_in_list(master->list, addr, addrlen)) { 3462 *fromhost = master; 3463 return 1; 3464 } 3465 /* compare address (but not port number, that is the destination 3466 * port of the master, the port number of the received notify is 3467 * allowed to by any port on that master) */ 3468 if(extstrtoaddr(master->host, &a, &alen) && 3469 sockaddr_cmp_addr(addr, addrlen, &a, alen)==0) { 3470 *fromhost = master; 3471 return 1; 3472 } 3473 /* prefixes, addr/len, like 10.0.0.0/8 */ 3474 /* not http and has a / and there is one / */ 3475 if(master->allow_notify && !master->http && 3476 strchr(master->host, '/') != NULL && 3477 strchr(master->host, '/') == strrchr(master->host, '/') && 3478 netblockstrtoaddr(master->host, UNBOUND_DNS_PORT, &a, &alen, 3479 &net) && alen == addrlen) { 3480 if(addr_in_common(addr, (addr_is_ip6(addr, addrlen)?128:32), 3481 &a, net, alen) >= net) { 3482 *fromhost = NULL; /* prefix does not have destination 3483 to send the probe or transfer with */ 3484 return 1; /* matches the netblock */ 3485 } 3486 } 3487 return 0; 3488 } 3489 3490 /** check access list for notifies */ 3491 static int 3492 az_xfr_allowed_notify(struct auth_xfer* xfr, struct sockaddr_storage* addr, 3493 socklen_t addrlen, struct auth_master** fromhost) 3494 { 3495 struct auth_master* p; 3496 for(p=xfr->allow_notify_list; p; p=p->next) { 3497 if(addr_matches_master(p, addr, addrlen, fromhost)) { 3498 return 1; 3499 } 3500 } 3501 return 0; 3502 } 3503 3504 /** see if the serial means the zone has to be updated, i.e. the serial 3505 * is newer than the zone serial, or we have no zone */ 3506 static int 3507 xfr_serial_means_update(struct auth_xfer* xfr, uint32_t serial) 3508 { 3509 if(!xfr->have_zone) 3510 return 1; /* no zone, anything is better */ 3511 if(xfr->zone_expired) 3512 return 1; /* expired, the sent serial is better than expired 3513 data */ 3514 if(compare_serial(xfr->serial, serial) < 0) 3515 return 1; /* our serial is smaller than the sent serial, 3516 the data is newer, fetch it */ 3517 return 0; 3518 } 3519 3520 /** note notify serial, updates the notify information in the xfr struct */ 3521 static void 3522 xfr_note_notify_serial(struct auth_xfer* xfr, int has_serial, uint32_t serial) 3523 { 3524 if(xfr->notify_received && xfr->notify_has_serial && has_serial) { 3525 /* see if this serial is newer */ 3526 if(compare_serial(xfr->notify_serial, serial) < 0) 3527 xfr->notify_serial = serial; 3528 } else if(xfr->notify_received && xfr->notify_has_serial && 3529 !has_serial) { 3530 /* remove serial, we have notify without serial */ 3531 xfr->notify_has_serial = 0; 3532 xfr->notify_serial = 0; 3533 } else if(xfr->notify_received && !xfr->notify_has_serial) { 3534 /* we already have notify without serial, keep it 3535 * that way; no serial check when current operation 3536 * is done */ 3537 } else { 3538 xfr->notify_received = 1; 3539 xfr->notify_has_serial = has_serial; 3540 xfr->notify_serial = serial; 3541 } 3542 } 3543 3544 /** process a notify serial, start new probe or note serial. xfr is locked */ 3545 static void 3546 xfr_process_notify(struct auth_xfer* xfr, struct module_env* env, 3547 int has_serial, uint32_t serial, struct auth_master* fromhost) 3548 { 3549 /* if the serial of notify is older than we have, don't fetch 3550 * a zone, we already have it */ 3551 if(has_serial && !xfr_serial_means_update(xfr, serial)) { 3552 lock_basic_unlock(&xfr->lock); 3553 return; 3554 } 3555 /* start new probe with this addr src, or note serial */ 3556 if(!xfr_start_probe(xfr, env, fromhost)) { 3557 /* not started because already in progress, note the serial */ 3558 xfr_note_notify_serial(xfr, has_serial, serial); 3559 lock_basic_unlock(&xfr->lock); 3560 } 3561 /* successful end of start_probe unlocked xfr->lock */ 3562 } 3563 3564 int auth_zones_notify(struct auth_zones* az, struct module_env* env, 3565 uint8_t* nm, size_t nmlen, uint16_t dclass, 3566 struct sockaddr_storage* addr, socklen_t addrlen, int has_serial, 3567 uint32_t serial, int* refused) 3568 { 3569 struct auth_xfer* xfr; 3570 struct auth_master* fromhost = NULL; 3571 /* see which zone this is */ 3572 lock_rw_rdlock(&az->lock); 3573 xfr = auth_xfer_find(az, nm, nmlen, dclass); 3574 if(!xfr) { 3575 lock_rw_unlock(&az->lock); 3576 /* no such zone, refuse the notify */ 3577 *refused = 1; 3578 return 0; 3579 } 3580 lock_basic_lock(&xfr->lock); 3581 lock_rw_unlock(&az->lock); 3582 3583 /* check access list for notifies */ 3584 if(!az_xfr_allowed_notify(xfr, addr, addrlen, &fromhost)) { 3585 lock_basic_unlock(&xfr->lock); 3586 /* notify not allowed, refuse the notify */ 3587 *refused = 1; 3588 return 0; 3589 } 3590 3591 /* process the notify */ 3592 xfr_process_notify(xfr, env, has_serial, serial, fromhost); 3593 return 1; 3594 } 3595 3596 int auth_zones_startprobesequence(struct auth_zones* az, 3597 struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t dclass) 3598 { 3599 struct auth_xfer* xfr; 3600 lock_rw_rdlock(&az->lock); 3601 xfr = auth_xfer_find(az, nm, nmlen, dclass); 3602 if(!xfr) { 3603 lock_rw_unlock(&az->lock); 3604 return 0; 3605 } 3606 lock_basic_lock(&xfr->lock); 3607 lock_rw_unlock(&az->lock); 3608 3609 xfr_process_notify(xfr, env, 0, 0, NULL); 3610 return 1; 3611 } 3612 3613 /** set a zone expired */ 3614 static void 3615 auth_xfer_set_expired(struct auth_xfer* xfr, struct module_env* env, 3616 int expired) 3617 { 3618 struct auth_zone* z; 3619 3620 /* expire xfr */ 3621 lock_basic_lock(&xfr->lock); 3622 xfr->zone_expired = expired; 3623 lock_basic_unlock(&xfr->lock); 3624 3625 /* find auth_zone */ 3626 lock_rw_rdlock(&env->auth_zones->lock); 3627 z = auth_zone_find(env->auth_zones, xfr->name, xfr->namelen, 3628 xfr->dclass); 3629 if(!z) { 3630 lock_rw_unlock(&env->auth_zones->lock); 3631 return; 3632 } 3633 lock_rw_wrlock(&z->lock); 3634 lock_rw_unlock(&env->auth_zones->lock); 3635 3636 /* expire auth_zone */ 3637 z->zone_expired = expired; 3638 lock_rw_unlock(&z->lock); 3639 } 3640 3641 /** find master (from notify or probe) in list of masters */ 3642 static struct auth_master* 3643 find_master_by_host(struct auth_master* list, char* host) 3644 { 3645 struct auth_master* p; 3646 for(p=list; p; p=p->next) { 3647 if(strcmp(p->host, host) == 0) 3648 return p; 3649 } 3650 return NULL; 3651 } 3652 3653 /** delete the looked up auth_addrs for all the masters in the list */ 3654 static void 3655 xfr_masterlist_free_addrs(struct auth_master* list) 3656 { 3657 struct auth_master* m; 3658 for(m=list; m; m=m->next) { 3659 if(m->list) { 3660 auth_free_master_addrs(m->list); 3661 m->list = NULL; 3662 } 3663 } 3664 } 3665 3666 /** copy a list of auth_addrs */ 3667 static struct auth_addr* 3668 auth_addr_list_copy(struct auth_addr* source) 3669 { 3670 struct auth_addr* list = NULL, *last = NULL; 3671 struct auth_addr* p; 3672 for(p=source; p; p=p->next) { 3673 struct auth_addr* a = (struct auth_addr*)memdup(p, sizeof(*p)); 3674 if(!a) { 3675 log_err("malloc failure"); 3676 auth_free_master_addrs(list); 3677 return NULL; 3678 } 3679 a->next = NULL; 3680 if(last) last->next = a; 3681 if(!list) list = a; 3682 last = a; 3683 } 3684 return list; 3685 } 3686 3687 /** copy a master to a new structure, NULL on alloc failure */ 3688 static struct auth_master* 3689 auth_master_copy(struct auth_master* o) 3690 { 3691 struct auth_master* m; 3692 if(!o) return NULL; 3693 m = (struct auth_master*)memdup(o, sizeof(*o)); 3694 if(!m) { 3695 log_err("malloc failure"); 3696 return NULL; 3697 } 3698 m->next = NULL; 3699 if(m->host) { 3700 m->host = strdup(m->host); 3701 if(!m->host) { 3702 free(m); 3703 log_err("malloc failure"); 3704 return NULL; 3705 } 3706 } 3707 if(m->file) { 3708 m->file = strdup(m->file); 3709 if(!m->file) { 3710 free(m->host); 3711 free(m); 3712 log_err("malloc failure"); 3713 return NULL; 3714 } 3715 } 3716 if(m->list) { 3717 m->list = auth_addr_list_copy(m->list); 3718 if(!m->list) { 3719 free(m->file); 3720 free(m->host); 3721 free(m); 3722 return NULL; 3723 } 3724 } 3725 return m; 3726 } 3727 3728 /** copy the master addresses from the task_probe lookups to the allow_notify 3729 * list of masters */ 3730 static void 3731 probe_copy_masters_for_allow_notify(struct auth_xfer* xfr) 3732 { 3733 struct auth_master* list = NULL, *last = NULL; 3734 struct auth_master* p; 3735 /* build up new list with copies */ 3736 for(p = xfr->task_probe->masters; p; p=p->next) { 3737 struct auth_master* m = auth_master_copy(p); 3738 if(!m) { 3739 auth_free_masters(list); 3740 /* failed because of malloc failure, use old list */ 3741 return; 3742 } 3743 m->next = NULL; 3744 if(last) last->next = m; 3745 if(!list) list = m; 3746 last = m; 3747 } 3748 /* success, replace list */ 3749 auth_free_masters(xfr->allow_notify_list); 3750 xfr->allow_notify_list = list; 3751 } 3752 3753 /** start the lookups for task_transfer */ 3754 static void 3755 xfr_transfer_start_lookups(struct auth_xfer* xfr) 3756 { 3757 /* delete all the looked up addresses in the list */ 3758 xfr->task_transfer->scan_addr = NULL; 3759 xfr_masterlist_free_addrs(xfr->task_transfer->masters); 3760 3761 /* start lookup at the first master */ 3762 xfr->task_transfer->lookup_target = xfr->task_transfer->masters; 3763 xfr->task_transfer->lookup_aaaa = 0; 3764 } 3765 3766 /** move to the next lookup of hostname for task_transfer */ 3767 static void 3768 xfr_transfer_move_to_next_lookup(struct auth_xfer* xfr, struct module_env* env) 3769 { 3770 if(!xfr->task_transfer->lookup_target) 3771 return; /* already at end of list */ 3772 if(!xfr->task_transfer->lookup_aaaa && env->cfg->do_ip6) { 3773 /* move to lookup AAAA */ 3774 xfr->task_transfer->lookup_aaaa = 1; 3775 return; 3776 } 3777 xfr->task_transfer->lookup_target = 3778 xfr->task_transfer->lookup_target->next; 3779 xfr->task_transfer->lookup_aaaa = 0; 3780 if(!env->cfg->do_ip4 && xfr->task_transfer->lookup_target!=NULL) 3781 xfr->task_transfer->lookup_aaaa = 1; 3782 } 3783 3784 /** start the lookups for task_probe */ 3785 static void 3786 xfr_probe_start_lookups(struct auth_xfer* xfr) 3787 { 3788 /* delete all the looked up addresses in the list */ 3789 xfr->task_probe->scan_addr = NULL; 3790 xfr_masterlist_free_addrs(xfr->task_probe->masters); 3791 3792 /* start lookup at the first master */ 3793 xfr->task_probe->lookup_target = xfr->task_probe->masters; 3794 xfr->task_probe->lookup_aaaa = 0; 3795 } 3796 3797 /** move to the next lookup of hostname for task_probe */ 3798 static void 3799 xfr_probe_move_to_next_lookup(struct auth_xfer* xfr, struct module_env* env) 3800 { 3801 if(!xfr->task_probe->lookup_target) 3802 return; /* already at end of list */ 3803 if(!xfr->task_probe->lookup_aaaa && env->cfg->do_ip6) { 3804 /* move to lookup AAAA */ 3805 xfr->task_probe->lookup_aaaa = 1; 3806 return; 3807 } 3808 xfr->task_probe->lookup_target = xfr->task_probe->lookup_target->next; 3809 xfr->task_probe->lookup_aaaa = 0; 3810 if(!env->cfg->do_ip4 && xfr->task_probe->lookup_target!=NULL) 3811 xfr->task_probe->lookup_aaaa = 1; 3812 } 3813 3814 /** start the iteration of the task_transfer list of masters */ 3815 static void 3816 xfr_transfer_start_list(struct auth_xfer* xfr, struct auth_master* spec) 3817 { 3818 if(spec) { 3819 xfr->task_transfer->scan_specific = find_master_by_host( 3820 xfr->task_transfer->masters, spec->host); 3821 if(xfr->task_transfer->scan_specific) { 3822 xfr->task_transfer->scan_target = NULL; 3823 xfr->task_transfer->scan_addr = NULL; 3824 if(xfr->task_transfer->scan_specific->list) 3825 xfr->task_transfer->scan_addr = 3826 xfr->task_transfer->scan_specific->list; 3827 return; 3828 } 3829 } 3830 /* no specific (notified) host to scan */ 3831 xfr->task_transfer->scan_specific = NULL; 3832 xfr->task_transfer->scan_addr = NULL; 3833 /* pick up first scan target */ 3834 xfr->task_transfer->scan_target = xfr->task_transfer->masters; 3835 if(xfr->task_transfer->scan_target && xfr->task_transfer-> 3836 scan_target->list) 3837 xfr->task_transfer->scan_addr = 3838 xfr->task_transfer->scan_target->list; 3839 } 3840 3841 /** start the iteration of the task_probe list of masters */ 3842 static void 3843 xfr_probe_start_list(struct auth_xfer* xfr, struct auth_master* spec) 3844 { 3845 if(spec) { 3846 xfr->task_probe->scan_specific = find_master_by_host( 3847 xfr->task_probe->masters, spec->host); 3848 if(xfr->task_probe->scan_specific) { 3849 xfr->task_probe->scan_target = NULL; 3850 xfr->task_probe->scan_addr = NULL; 3851 if(xfr->task_probe->scan_specific->list) 3852 xfr->task_probe->scan_addr = 3853 xfr->task_probe->scan_specific->list; 3854 return; 3855 } 3856 } 3857 /* no specific (notified) host to scan */ 3858 xfr->task_probe->scan_specific = NULL; 3859 xfr->task_probe->scan_addr = NULL; 3860 /* pick up first scan target */ 3861 xfr->task_probe->scan_target = xfr->task_probe->masters; 3862 if(xfr->task_probe->scan_target && xfr->task_probe->scan_target->list) 3863 xfr->task_probe->scan_addr = 3864 xfr->task_probe->scan_target->list; 3865 } 3866 3867 /** pick up the master that is being scanned right now, task_transfer */ 3868 static struct auth_master* 3869 xfr_transfer_current_master(struct auth_xfer* xfr) 3870 { 3871 if(xfr->task_transfer->scan_specific) 3872 return xfr->task_transfer->scan_specific; 3873 return xfr->task_transfer->scan_target; 3874 } 3875 3876 /** pick up the master that is being scanned right now, task_probe */ 3877 static struct auth_master* 3878 xfr_probe_current_master(struct auth_xfer* xfr) 3879 { 3880 if(xfr->task_probe->scan_specific) 3881 return xfr->task_probe->scan_specific; 3882 return xfr->task_probe->scan_target; 3883 } 3884 3885 /** true if at end of list, task_transfer */ 3886 static int 3887 xfr_transfer_end_of_list(struct auth_xfer* xfr) 3888 { 3889 return !xfr->task_transfer->scan_specific && 3890 !xfr->task_transfer->scan_target; 3891 } 3892 3893 /** true if at end of list, task_probe */ 3894 static int 3895 xfr_probe_end_of_list(struct auth_xfer* xfr) 3896 { 3897 return !xfr->task_probe->scan_specific && !xfr->task_probe->scan_target; 3898 } 3899 3900 /** move to next master in list, task_transfer */ 3901 static void 3902 xfr_transfer_nextmaster(struct auth_xfer* xfr) 3903 { 3904 if(!xfr->task_transfer->scan_specific && 3905 !xfr->task_transfer->scan_target) 3906 return; 3907 if(xfr->task_transfer->scan_addr) { 3908 xfr->task_transfer->scan_addr = 3909 xfr->task_transfer->scan_addr->next; 3910 if(xfr->task_transfer->scan_addr) 3911 return; 3912 } 3913 if(xfr->task_transfer->scan_specific) { 3914 xfr->task_transfer->scan_specific = NULL; 3915 xfr->task_transfer->scan_target = xfr->task_transfer->masters; 3916 if(xfr->task_transfer->scan_target && xfr->task_transfer-> 3917 scan_target->list) 3918 xfr->task_transfer->scan_addr = 3919 xfr->task_transfer->scan_target->list; 3920 return; 3921 } 3922 if(!xfr->task_transfer->scan_target) 3923 return; 3924 xfr->task_transfer->scan_target = xfr->task_transfer->scan_target->next; 3925 if(xfr->task_transfer->scan_target && xfr->task_transfer-> 3926 scan_target->list) 3927 xfr->task_transfer->scan_addr = 3928 xfr->task_transfer->scan_target->list; 3929 return; 3930 } 3931 3932 /** move to next master in list, task_probe */ 3933 static void 3934 xfr_probe_nextmaster(struct auth_xfer* xfr) 3935 { 3936 if(!xfr->task_probe->scan_specific && !xfr->task_probe->scan_target) 3937 return; 3938 if(xfr->task_probe->scan_addr) { 3939 xfr->task_probe->scan_addr = xfr->task_probe->scan_addr->next; 3940 if(xfr->task_probe->scan_addr) 3941 return; 3942 } 3943 if(xfr->task_probe->scan_specific) { 3944 xfr->task_probe->scan_specific = NULL; 3945 xfr->task_probe->scan_target = xfr->task_probe->masters; 3946 if(xfr->task_probe->scan_target && xfr->task_probe-> 3947 scan_target->list) 3948 xfr->task_probe->scan_addr = 3949 xfr->task_probe->scan_target->list; 3950 return; 3951 } 3952 if(!xfr->task_probe->scan_target) 3953 return; 3954 xfr->task_probe->scan_target = xfr->task_probe->scan_target->next; 3955 if(xfr->task_probe->scan_target && xfr->task_probe-> 3956 scan_target->list) 3957 xfr->task_probe->scan_addr = 3958 xfr->task_probe->scan_target->list; 3959 return; 3960 } 3961 3962 /** create SOA probe packet for xfr */ 3963 static void 3964 xfr_create_soa_probe_packet(struct auth_xfer* xfr, sldns_buffer* buf, 3965 uint16_t id) 3966 { 3967 struct query_info qinfo; 3968 3969 memset(&qinfo, 0, sizeof(qinfo)); 3970 qinfo.qname = xfr->name; 3971 qinfo.qname_len = xfr->namelen; 3972 qinfo.qtype = LDNS_RR_TYPE_SOA; 3973 qinfo.qclass = xfr->dclass; 3974 qinfo_query_encode(buf, &qinfo); 3975 sldns_buffer_write_u16_at(buf, 0, id); 3976 } 3977 3978 /** create IXFR/AXFR packet for xfr */ 3979 static void 3980 xfr_create_ixfr_packet(struct auth_xfer* xfr, sldns_buffer* buf, uint16_t id, 3981 struct auth_master* master) 3982 { 3983 struct query_info qinfo; 3984 uint32_t serial; 3985 int have_zone; 3986 have_zone = xfr->have_zone; 3987 serial = xfr->serial; 3988 3989 memset(&qinfo, 0, sizeof(qinfo)); 3990 qinfo.qname = xfr->name; 3991 qinfo.qname_len = xfr->namelen; 3992 xfr->task_transfer->got_xfr_serial = 0; 3993 xfr->task_transfer->rr_scan_num = 0; 3994 xfr->task_transfer->incoming_xfr_serial = 0; 3995 xfr->task_transfer->on_ixfr_is_axfr = 0; 3996 xfr->task_transfer->on_ixfr = 1; 3997 qinfo.qtype = LDNS_RR_TYPE_IXFR; 3998 if(!have_zone || xfr->task_transfer->ixfr_fail || !master->ixfr) { 3999 qinfo.qtype = LDNS_RR_TYPE_AXFR; 4000 xfr->task_transfer->ixfr_fail = 0; 4001 xfr->task_transfer->on_ixfr = 0; 4002 } 4003 4004 qinfo.qclass = xfr->dclass; 4005 qinfo_query_encode(buf, &qinfo); 4006 sldns_buffer_write_u16_at(buf, 0, id); 4007 4008 /* append serial for IXFR */ 4009 if(qinfo.qtype == LDNS_RR_TYPE_IXFR) { 4010 size_t end = sldns_buffer_limit(buf); 4011 sldns_buffer_clear(buf); 4012 sldns_buffer_set_position(buf, end); 4013 /* auth section count 1 */ 4014 sldns_buffer_write_u16_at(buf, LDNS_NSCOUNT_OFF, 1); 4015 /* write SOA */ 4016 sldns_buffer_write_u8(buf, 0xC0); /* compressed ptr to qname */ 4017 sldns_buffer_write_u8(buf, 0x0C); 4018 sldns_buffer_write_u16(buf, LDNS_RR_TYPE_SOA); 4019 sldns_buffer_write_u16(buf, qinfo.qclass); 4020 sldns_buffer_write_u32(buf, 0); /* ttl */ 4021 sldns_buffer_write_u16(buf, 22); /* rdata length */ 4022 sldns_buffer_write_u8(buf, 0); /* . */ 4023 sldns_buffer_write_u8(buf, 0); /* . */ 4024 sldns_buffer_write_u32(buf, serial); /* serial */ 4025 sldns_buffer_write_u32(buf, 0); /* refresh */ 4026 sldns_buffer_write_u32(buf, 0); /* retry */ 4027 sldns_buffer_write_u32(buf, 0); /* expire */ 4028 sldns_buffer_write_u32(buf, 0); /* minimum */ 4029 sldns_buffer_flip(buf); 4030 } 4031 } 4032 4033 /** check if returned packet is OK */ 4034 static int 4035 check_packet_ok(sldns_buffer* pkt, uint16_t qtype, struct auth_xfer* xfr, 4036 uint32_t* serial) 4037 { 4038 /* parse to see if packet worked, valid reply */ 4039 4040 /* check serial number of SOA */ 4041 if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) 4042 return 0; 4043 4044 /* check ID */ 4045 if(LDNS_ID_WIRE(sldns_buffer_begin(pkt)) != xfr->task_probe->id) 4046 return 0; 4047 4048 /* check flag bits and rcode */ 4049 if(!LDNS_QR_WIRE(sldns_buffer_begin(pkt))) 4050 return 0; 4051 if(LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_QUERY) 4052 return 0; 4053 if(LDNS_RCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_RCODE_NOERROR) 4054 return 0; 4055 4056 /* check qname */ 4057 if(LDNS_QDCOUNT(sldns_buffer_begin(pkt)) != 1) 4058 return 0; 4059 sldns_buffer_skip(pkt, LDNS_HEADER_SIZE); 4060 if(sldns_buffer_remaining(pkt) < xfr->namelen) 4061 return 0; 4062 if(query_dname_compare(sldns_buffer_current(pkt), xfr->name) != 0) 4063 return 0; 4064 sldns_buffer_skip(pkt, (ssize_t)xfr->namelen); 4065 4066 /* check qtype, qclass */ 4067 if(sldns_buffer_remaining(pkt) < 4) 4068 return 0; 4069 if(sldns_buffer_read_u16(pkt) != qtype) 4070 return 0; 4071 if(sldns_buffer_read_u16(pkt) != xfr->dclass) 4072 return 0; 4073 4074 if(serial) { 4075 uint16_t rdlen; 4076 /* read serial number, from answer section SOA */ 4077 if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) == 0) 4078 return 0; 4079 /* read from first record SOA record */ 4080 if(sldns_buffer_remaining(pkt) < 1) 4081 return 0; 4082 if(dname_pkt_compare(pkt, sldns_buffer_current(pkt), 4083 xfr->name) != 0) 4084 return 0; 4085 if(!pkt_dname_len(pkt)) 4086 return 0; 4087 /* type, class, ttl, rdatalen */ 4088 if(sldns_buffer_remaining(pkt) < 4+4+2) 4089 return 0; 4090 if(sldns_buffer_read_u16(pkt) != qtype) 4091 return 0; 4092 if(sldns_buffer_read_u16(pkt) != xfr->dclass) 4093 return 0; 4094 sldns_buffer_skip(pkt, 4); /* ttl */ 4095 rdlen = sldns_buffer_read_u16(pkt); 4096 if(sldns_buffer_remaining(pkt) < rdlen) 4097 return 0; 4098 if(sldns_buffer_remaining(pkt) < 1) 4099 return 0; 4100 if(!pkt_dname_len(pkt)) /* soa name */ 4101 return 0; 4102 if(sldns_buffer_remaining(pkt) < 1) 4103 return 0; 4104 if(!pkt_dname_len(pkt)) /* soa name */ 4105 return 0; 4106 if(sldns_buffer_remaining(pkt) < 20) 4107 return 0; 4108 *serial = sldns_buffer_read_u32(pkt); 4109 } 4110 return 1; 4111 } 4112 4113 /** read one line from chunks into buffer at current position */ 4114 static int 4115 chunkline_get_line(struct auth_chunk** chunk, size_t* chunk_pos, 4116 sldns_buffer* buf) 4117 { 4118 int readsome = 0; 4119 while(*chunk) { 4120 /* more text in this chunk? */ 4121 if(*chunk_pos < (*chunk)->len) { 4122 readsome = 1; 4123 while(*chunk_pos < (*chunk)->len) { 4124 char c = (char)((*chunk)->data[*chunk_pos]); 4125 (*chunk_pos)++; 4126 if(sldns_buffer_remaining(buf) < 2) { 4127 /* buffer too short */ 4128 verbose(VERB_ALGO, "http chunkline, " 4129 "line too long"); 4130 return 0; 4131 } 4132 sldns_buffer_write_u8(buf, (uint8_t)c); 4133 if(c == '\n') { 4134 /* we are done */ 4135 return 1; 4136 } 4137 } 4138 } 4139 /* move to next chunk */ 4140 *chunk = (*chunk)->next; 4141 *chunk_pos = 0; 4142 } 4143 /* no more text */ 4144 if(readsome) return 1; 4145 return 0; 4146 } 4147 4148 /** count number of open and closed parenthesis in a chunkline */ 4149 static int 4150 chunkline_count_parens(sldns_buffer* buf, size_t start) 4151 { 4152 size_t end = sldns_buffer_position(buf); 4153 size_t i; 4154 int count = 0; 4155 int squote = 0, dquote = 0; 4156 for(i=start; i<end; i++) { 4157 char c = (char)sldns_buffer_read_u8_at(buf, i); 4158 if(squote && c != '\'') continue; 4159 if(dquote && c != '"') continue; 4160 if(c == '"') 4161 dquote = !dquote; /* skip quoted part */ 4162 else if(c == '\'') 4163 squote = !squote; /* skip quoted part */ 4164 else if(c == '(') 4165 count ++; 4166 else if(c == ')') 4167 count --; 4168 else if(c == ';') { 4169 /* rest is a comment */ 4170 return count; 4171 } 4172 } 4173 return count; 4174 } 4175 4176 /** remove trailing ;... comment from a line in the chunkline buffer */ 4177 static void 4178 chunkline_remove_trailcomment(sldns_buffer* buf, size_t start) 4179 { 4180 size_t end = sldns_buffer_position(buf); 4181 size_t i; 4182 int squote = 0, dquote = 0; 4183 for(i=start; i<end; i++) { 4184 char c = (char)sldns_buffer_read_u8_at(buf, i); 4185 if(squote && c != '\'') continue; 4186 if(dquote && c != '"') continue; 4187 if(c == '"') 4188 dquote = !dquote; /* skip quoted part */ 4189 else if(c == '\'') 4190 squote = !squote; /* skip quoted part */ 4191 else if(c == ';') { 4192 /* rest is a comment */ 4193 sldns_buffer_set_position(buf, i); 4194 return; 4195 } 4196 } 4197 /* nothing to remove */ 4198 } 4199 4200 /** see if a chunkline is a comment line (or empty line) */ 4201 static int 4202 chunkline_is_comment_line_or_empty(sldns_buffer* buf) 4203 { 4204 size_t i, end = sldns_buffer_limit(buf); 4205 for(i=0; i<end; i++) { 4206 char c = (char)sldns_buffer_read_u8_at(buf, i); 4207 if(c == ';') 4208 return 1; /* comment */ 4209 else if(c != ' ' && c != '\t' && c != '\r' && c != '\n') 4210 return 0; /* not a comment */ 4211 } 4212 return 1; /* empty */ 4213 } 4214 4215 /** find a line with ( ) collated */ 4216 static int 4217 chunkline_get_line_collated(struct auth_chunk** chunk, size_t* chunk_pos, 4218 sldns_buffer* buf) 4219 { 4220 size_t pos; 4221 int parens = 0; 4222 sldns_buffer_clear(buf); 4223 pos = sldns_buffer_position(buf); 4224 if(!chunkline_get_line(chunk, chunk_pos, buf)) { 4225 if(sldns_buffer_position(buf) < sldns_buffer_limit(buf)) 4226 sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0); 4227 else sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf)-1, 0); 4228 sldns_buffer_flip(buf); 4229 return 0; 4230 } 4231 parens += chunkline_count_parens(buf, pos); 4232 while(parens > 0) { 4233 chunkline_remove_trailcomment(buf, pos); 4234 pos = sldns_buffer_position(buf); 4235 if(!chunkline_get_line(chunk, chunk_pos, buf)) { 4236 if(sldns_buffer_position(buf) < sldns_buffer_limit(buf)) 4237 sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0); 4238 else sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf)-1, 0); 4239 sldns_buffer_flip(buf); 4240 return 0; 4241 } 4242 parens += chunkline_count_parens(buf, pos); 4243 } 4244 4245 if(sldns_buffer_remaining(buf) < 1) { 4246 verbose(VERB_ALGO, "http chunkline: " 4247 "line too long"); 4248 return 0; 4249 } 4250 sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0); 4251 sldns_buffer_flip(buf); 4252 return 1; 4253 } 4254 4255 /** process $ORIGIN for http */ 4256 static int 4257 http_parse_origin(sldns_buffer* buf, struct sldns_file_parse_state* pstate) 4258 { 4259 char* line = (char*)sldns_buffer_begin(buf); 4260 if(strncmp(line, "$ORIGIN", 7) == 0 && 4261 isspace((unsigned char)line[7])) { 4262 int s; 4263 pstate->origin_len = sizeof(pstate->origin); 4264 s = sldns_str2wire_dname_buf(sldns_strip_ws(line+8), 4265 pstate->origin, &pstate->origin_len); 4266 if(s) pstate->origin_len = 0; 4267 return 1; 4268 } 4269 return 0; 4270 } 4271 4272 /** process $TTL for http */ 4273 static int 4274 http_parse_ttl(sldns_buffer* buf, struct sldns_file_parse_state* pstate) 4275 { 4276 char* line = (char*)sldns_buffer_begin(buf); 4277 if(strncmp(line, "$TTL", 4) == 0 && 4278 isspace((unsigned char)line[4])) { 4279 const char* end = NULL; 4280 pstate->default_ttl = sldns_str2period( 4281 sldns_strip_ws(line+5), &end); 4282 return 1; 4283 } 4284 return 0; 4285 } 4286 4287 /** find noncomment RR line in chunks, collates lines if ( ) format */ 4288 static int 4289 chunkline_non_comment_RR(struct auth_chunk** chunk, size_t* chunk_pos, 4290 sldns_buffer* buf, struct sldns_file_parse_state* pstate) 4291 { 4292 while(chunkline_get_line_collated(chunk, chunk_pos, buf)) { 4293 if(chunkline_is_comment_line_or_empty(buf)) { 4294 /* a comment, go to next line */ 4295 continue; 4296 } 4297 if(http_parse_origin(buf, pstate)) { 4298 continue; /* $ORIGIN has been handled */ 4299 } 4300 if(http_parse_ttl(buf, pstate)) { 4301 continue; /* $TTL has been handled */ 4302 } 4303 return 1; 4304 } 4305 /* no noncomments, fail */ 4306 return 0; 4307 } 4308 4309 /** check syntax of chunklist zonefile, parse first RR, return false on 4310 * failure and return a string in the scratch buffer (first RR string) 4311 * on failure. */ 4312 static int 4313 http_zonefile_syntax_check(struct auth_xfer* xfr, sldns_buffer* buf) 4314 { 4315 uint8_t rr[LDNS_RR_BUF_SIZE]; 4316 size_t rr_len, dname_len = 0; 4317 struct sldns_file_parse_state pstate; 4318 struct auth_chunk* chunk; 4319 size_t chunk_pos; 4320 int e; 4321 memset(&pstate, 0, sizeof(pstate)); 4322 pstate.default_ttl = 3600; 4323 if(xfr->namelen < sizeof(pstate.origin)) { 4324 pstate.origin_len = xfr->namelen; 4325 memmove(pstate.origin, xfr->name, xfr->namelen); 4326 } 4327 chunk = xfr->task_transfer->chunks_first; 4328 chunk_pos = 0; 4329 if(!chunkline_non_comment_RR(&chunk, &chunk_pos, buf, &pstate)) { 4330 return 0; 4331 } 4332 rr_len = sizeof(rr); 4333 e=sldns_str2wire_rr_buf((char*)sldns_buffer_begin(buf), rr, &rr_len, 4334 &dname_len, pstate.default_ttl, 4335 pstate.origin_len?pstate.origin:NULL, pstate.origin_len, 4336 pstate.prev_rr_len?pstate.prev_rr:NULL, pstate.prev_rr_len); 4337 if(e != 0) { 4338 log_err("parse failure on first RR[%d]: %s", 4339 LDNS_WIREPARSE_OFFSET(e), 4340 sldns_get_errorstr_parse(LDNS_WIREPARSE_ERROR(e))); 4341 return 0; 4342 } 4343 /* check that class is correct */ 4344 if(sldns_wirerr_get_class(rr, rr_len, dname_len) != xfr->dclass) { 4345 log_err("parse failure: first record in downloaded zonefile " 4346 "from wrong RR class"); 4347 return 0; 4348 } 4349 return 1; 4350 } 4351 4352 /** sum sizes of chunklist */ 4353 static size_t 4354 chunklist_sum(struct auth_chunk* list) 4355 { 4356 struct auth_chunk* p; 4357 size_t s = 0; 4358 for(p=list; p; p=p->next) { 4359 s += p->len; 4360 } 4361 return s; 4362 } 4363 4364 /** remove newlines from collated line */ 4365 static void 4366 chunkline_newline_removal(sldns_buffer* buf) 4367 { 4368 size_t i, end=sldns_buffer_limit(buf); 4369 for(i=0; i<end; i++) { 4370 char c = (char)sldns_buffer_read_u8_at(buf, i); 4371 if(c == '\n' && i==end-1) { 4372 sldns_buffer_write_u8_at(buf, i, 0); 4373 sldns_buffer_set_limit(buf, end-1); 4374 return; 4375 } 4376 if(c == '\n') 4377 sldns_buffer_write_u8_at(buf, i, (uint8_t)' '); 4378 } 4379 } 4380 4381 /** for http download, parse and add RR to zone */ 4382 static int 4383 http_parse_add_rr(struct auth_xfer* xfr, struct auth_zone* z, 4384 sldns_buffer* buf, struct sldns_file_parse_state* pstate) 4385 { 4386 uint8_t rr[LDNS_RR_BUF_SIZE]; 4387 size_t rr_len, dname_len = 0; 4388 int e; 4389 char* line = (char*)sldns_buffer_begin(buf); 4390 rr_len = sizeof(rr); 4391 e = sldns_str2wire_rr_buf(line, rr, &rr_len, &dname_len, 4392 pstate->default_ttl, 4393 pstate->origin_len?pstate->origin:NULL, pstate->origin_len, 4394 pstate->prev_rr_len?pstate->prev_rr:NULL, pstate->prev_rr_len); 4395 if(e != 0) { 4396 log_err("%s/%s parse failure RR[%d]: %s in '%s'", 4397 xfr->task_transfer->master->host, 4398 xfr->task_transfer->master->file, 4399 LDNS_WIREPARSE_OFFSET(e), 4400 sldns_get_errorstr_parse(LDNS_WIREPARSE_ERROR(e)), 4401 line); 4402 return 0; 4403 } 4404 if(rr_len == 0) 4405 return 1; /* empty line or so */ 4406 4407 /* set prev */ 4408 if(dname_len < sizeof(pstate->prev_rr)) { 4409 memmove(pstate->prev_rr, rr, dname_len); 4410 pstate->prev_rr_len = dname_len; 4411 } 4412 4413 return az_insert_rr(z, rr, rr_len, dname_len, NULL); 4414 } 4415 4416 /** RR list iterator, returns RRs from answer section one by one from the 4417 * dns packets in the chunklist */ 4418 static void 4419 chunk_rrlist_start(struct auth_xfer* xfr, struct auth_chunk** rr_chunk, 4420 int* rr_num, size_t* rr_pos) 4421 { 4422 *rr_chunk = xfr->task_transfer->chunks_first; 4423 *rr_num = 0; 4424 *rr_pos = 0; 4425 } 4426 4427 /** RR list iterator, see if we are at the end of the list */ 4428 static int 4429 chunk_rrlist_end(struct auth_chunk* rr_chunk, int rr_num) 4430 { 4431 while(rr_chunk) { 4432 if(rr_chunk->len < LDNS_HEADER_SIZE) 4433 return 1; 4434 if(rr_num < (int)LDNS_ANCOUNT(rr_chunk->data)) 4435 return 0; 4436 /* no more RRs in this chunk */ 4437 /* continue with next chunk, see if it has RRs */ 4438 rr_chunk = rr_chunk->next; 4439 rr_num = 0; 4440 } 4441 return 1; 4442 } 4443 4444 /** RR list iterator, move to next RR */ 4445 static void 4446 chunk_rrlist_gonext(struct auth_chunk** rr_chunk, int* rr_num, 4447 size_t* rr_pos, size_t rr_nextpos) 4448 { 4449 /* already at end of chunks? */ 4450 if(!*rr_chunk) 4451 return; 4452 /* move within this chunk */ 4453 if((*rr_chunk)->len >= LDNS_HEADER_SIZE && 4454 (*rr_num)+1 < (int)LDNS_ANCOUNT((*rr_chunk)->data)) { 4455 (*rr_num) += 1; 4456 *rr_pos = rr_nextpos; 4457 return; 4458 } 4459 /* no more RRs in this chunk */ 4460 /* continue with next chunk, see if it has RRs */ 4461 if(*rr_chunk) 4462 *rr_chunk = (*rr_chunk)->next; 4463 while(*rr_chunk) { 4464 *rr_num = 0; 4465 *rr_pos = 0; 4466 if((*rr_chunk)->len >= LDNS_HEADER_SIZE && 4467 LDNS_ANCOUNT((*rr_chunk)->data) > 0) { 4468 return; 4469 } 4470 *rr_chunk = (*rr_chunk)->next; 4471 } 4472 } 4473 4474 /** RR iterator, get current RR information, false on parse error */ 4475 static int 4476 chunk_rrlist_get_current(struct auth_chunk* rr_chunk, int rr_num, 4477 size_t rr_pos, uint8_t** rr_dname, uint16_t* rr_type, 4478 uint16_t* rr_class, uint32_t* rr_ttl, uint16_t* rr_rdlen, 4479 uint8_t** rr_rdata, size_t* rr_nextpos) 4480 { 4481 sldns_buffer pkt; 4482 /* integrity checks on position */ 4483 if(!rr_chunk) return 0; 4484 if(rr_chunk->len < LDNS_HEADER_SIZE) return 0; 4485 if(rr_num >= (int)LDNS_ANCOUNT(rr_chunk->data)) return 0; 4486 if(rr_pos >= rr_chunk->len) return 0; 4487 4488 /* fetch rr information */ 4489 sldns_buffer_init_frm_data(&pkt, rr_chunk->data, rr_chunk->len); 4490 if(rr_pos == 0) { 4491 size_t i; 4492 /* skip question section */ 4493 sldns_buffer_set_position(&pkt, LDNS_HEADER_SIZE); 4494 for(i=0; i<LDNS_QDCOUNT(rr_chunk->data); i++) { 4495 if(pkt_dname_len(&pkt) == 0) return 0; 4496 if(sldns_buffer_remaining(&pkt) < 4) return 0; 4497 sldns_buffer_skip(&pkt, 4); /* type and class */ 4498 } 4499 } else { 4500 sldns_buffer_set_position(&pkt, rr_pos); 4501 } 4502 *rr_dname = sldns_buffer_current(&pkt); 4503 if(pkt_dname_len(&pkt) == 0) return 0; 4504 if(sldns_buffer_remaining(&pkt) < 10) return 0; 4505 *rr_type = sldns_buffer_read_u16(&pkt); 4506 *rr_class = sldns_buffer_read_u16(&pkt); 4507 *rr_ttl = sldns_buffer_read_u32(&pkt); 4508 *rr_rdlen = sldns_buffer_read_u16(&pkt); 4509 if(sldns_buffer_remaining(&pkt) < (*rr_rdlen)) return 0; 4510 *rr_rdata = sldns_buffer_current(&pkt); 4511 sldns_buffer_skip(&pkt, (ssize_t)(*rr_rdlen)); 4512 *rr_nextpos = sldns_buffer_position(&pkt); 4513 return 1; 4514 } 4515 4516 /** print log message where we are in parsing the zone transfer */ 4517 static void 4518 log_rrlist_position(const char* label, struct auth_chunk* rr_chunk, 4519 uint8_t* rr_dname, uint16_t rr_type, size_t rr_counter) 4520 { 4521 sldns_buffer pkt; 4522 size_t dlen; 4523 uint8_t buf[256]; 4524 char str[256]; 4525 char typestr[32]; 4526 sldns_buffer_init_frm_data(&pkt, rr_chunk->data, rr_chunk->len); 4527 sldns_buffer_set_position(&pkt, (size_t)(rr_dname - 4528 sldns_buffer_begin(&pkt))); 4529 if((dlen=pkt_dname_len(&pkt)) == 0) return; 4530 if(dlen >= sizeof(buf)) return; 4531 dname_pkt_copy(&pkt, buf, rr_dname); 4532 dname_str(buf, str); 4533 (void)sldns_wire2str_type_buf(rr_type, typestr, sizeof(typestr)); 4534 verbose(VERB_ALGO, "%s at[%d] %s %s", label, (int)rr_counter, 4535 str, typestr); 4536 } 4537 4538 /** check that start serial is OK for ixfr. we are at rr_counter == 0, 4539 * and we are going to check rr_counter == 1 (has to be type SOA) serial */ 4540 static int 4541 ixfr_start_serial(struct auth_chunk* rr_chunk, int rr_num, size_t rr_pos, 4542 uint8_t* rr_dname, uint16_t rr_type, uint16_t rr_class, 4543 uint32_t rr_ttl, uint16_t rr_rdlen, uint8_t* rr_rdata, 4544 size_t rr_nextpos, uint32_t transfer_serial, uint32_t xfr_serial) 4545 { 4546 uint32_t startserial; 4547 /* move forward on RR */ 4548 chunk_rrlist_gonext(&rr_chunk, &rr_num, &rr_pos, rr_nextpos); 4549 if(chunk_rrlist_end(rr_chunk, rr_num)) { 4550 /* no second SOA */ 4551 verbose(VERB_OPS, "IXFR has no second SOA record"); 4552 return 0; 4553 } 4554 if(!chunk_rrlist_get_current(rr_chunk, rr_num, rr_pos, 4555 &rr_dname, &rr_type, &rr_class, &rr_ttl, &rr_rdlen, 4556 &rr_rdata, &rr_nextpos)) { 4557 verbose(VERB_OPS, "IXFR cannot parse second SOA record"); 4558 /* failed to parse RR */ 4559 return 0; 4560 } 4561 if(rr_type != LDNS_RR_TYPE_SOA) { 4562 verbose(VERB_OPS, "IXFR second record is not type SOA"); 4563 return 0; 4564 } 4565 if(rr_rdlen < 22) { 4566 verbose(VERB_OPS, "IXFR, second SOA has short rdlength"); 4567 return 0; /* bad SOA rdlen */ 4568 } 4569 startserial = sldns_read_uint32(rr_rdata+rr_rdlen-20); 4570 if(startserial == transfer_serial) { 4571 /* empty AXFR, not an IXFR */ 4572 verbose(VERB_OPS, "IXFR second serial same as first"); 4573 return 0; 4574 } 4575 if(startserial != xfr_serial) { 4576 /* wrong start serial, it does not match the serial in 4577 * memory */ 4578 verbose(VERB_OPS, "IXFR is from serial %u to %u but %u " 4579 "in memory, rejecting the zone transfer", 4580 (unsigned)startserial, (unsigned)transfer_serial, 4581 (unsigned)xfr_serial); 4582 return 0; 4583 } 4584 /* everything OK in second SOA serial */ 4585 return 1; 4586 } 4587 4588 /** apply IXFR to zone in memory. z is locked. false on failure(mallocfail) */ 4589 static int 4590 apply_ixfr(struct auth_xfer* xfr, struct auth_zone* z, 4591 struct sldns_buffer* scratch_buffer) 4592 { 4593 struct auth_chunk* rr_chunk; 4594 int rr_num; 4595 size_t rr_pos; 4596 uint8_t* rr_dname, *rr_rdata; 4597 uint16_t rr_type, rr_class, rr_rdlen; 4598 uint32_t rr_ttl; 4599 size_t rr_nextpos; 4600 int have_transfer_serial = 0; 4601 uint32_t transfer_serial = 0; 4602 size_t rr_counter = 0; 4603 int delmode = 0; 4604 int softfail = 0; 4605 4606 /* start RR iterator over chunklist of packets */ 4607 chunk_rrlist_start(xfr, &rr_chunk, &rr_num, &rr_pos); 4608 while(!chunk_rrlist_end(rr_chunk, rr_num)) { 4609 if(!chunk_rrlist_get_current(rr_chunk, rr_num, rr_pos, 4610 &rr_dname, &rr_type, &rr_class, &rr_ttl, &rr_rdlen, 4611 &rr_rdata, &rr_nextpos)) { 4612 /* failed to parse RR */ 4613 return 0; 4614 } 4615 if(verbosity>=7) log_rrlist_position("apply ixfr", 4616 rr_chunk, rr_dname, rr_type, rr_counter); 4617 /* twiddle add/del mode and check for start and end */ 4618 if(rr_counter == 0 && rr_type != LDNS_RR_TYPE_SOA) 4619 return 0; 4620 if(rr_counter == 1 && rr_type != LDNS_RR_TYPE_SOA) { 4621 /* this is an AXFR returned from the IXFR master */ 4622 /* but that should already have been detected, by 4623 * on_ixfr_is_axfr */ 4624 return 0; 4625 } 4626 if(rr_type == LDNS_RR_TYPE_SOA) { 4627 uint32_t serial; 4628 if(rr_rdlen < 22) return 0; /* bad SOA rdlen */ 4629 serial = sldns_read_uint32(rr_rdata+rr_rdlen-20); 4630 if(have_transfer_serial == 0) { 4631 have_transfer_serial = 1; 4632 transfer_serial = serial; 4633 delmode = 1; /* gets negated below */ 4634 /* check second RR before going any further */ 4635 if(!ixfr_start_serial(rr_chunk, rr_num, rr_pos, 4636 rr_dname, rr_type, rr_class, rr_ttl, 4637 rr_rdlen, rr_rdata, rr_nextpos, 4638 transfer_serial, xfr->serial)) { 4639 return 0; 4640 } 4641 } else if(transfer_serial == serial) { 4642 have_transfer_serial++; 4643 if(rr_counter == 1) { 4644 /* empty AXFR, with SOA; SOA; */ 4645 /* should have been detected by 4646 * on_ixfr_is_axfr */ 4647 return 0; 4648 } 4649 if(have_transfer_serial == 3) { 4650 /* see serial three times for end */ 4651 /* eg. IXFR: 4652 * SOA 3 start 4653 * SOA 1 second RR, followed by del 4654 * SOA 2 followed by add 4655 * SOA 2 followed by del 4656 * SOA 3 followed by add 4657 * SOA 3 end */ 4658 /* ended by SOA record */ 4659 xfr->serial = transfer_serial; 4660 break; 4661 } 4662 } 4663 /* twiddle add/del mode */ 4664 /* switch from delete part to add part and back again 4665 * just before the soa, it gets deleted and added too 4666 * this means we switch to delete mode for the final 4667 * SOA(so skip that one) */ 4668 delmode = !delmode; 4669 } 4670 /* process this RR */ 4671 /* if the RR is deleted twice or added twice, then we 4672 * softfail, and continue with the rest of the IXFR, so 4673 * that we serve something fairly nice during the refetch */ 4674 if(verbosity>=7) log_rrlist_position((delmode?"del":"add"), 4675 rr_chunk, rr_dname, rr_type, rr_counter); 4676 if(delmode) { 4677 /* delete this RR */ 4678 int nonexist = 0; 4679 if(!az_remove_rr_decompress(z, rr_chunk->data, 4680 rr_chunk->len, scratch_buffer, rr_dname, 4681 rr_type, rr_class, rr_ttl, rr_rdata, rr_rdlen, 4682 &nonexist)) { 4683 /* failed, malloc error or so */ 4684 return 0; 4685 } 4686 if(nonexist) { 4687 /* it was removal of a nonexisting RR */ 4688 if(verbosity>=4) log_rrlist_position( 4689 "IXFR error nonexistent RR", 4690 rr_chunk, rr_dname, rr_type, rr_counter); 4691 softfail = 1; 4692 } 4693 } else if(rr_counter != 0) { 4694 /* skip first SOA RR for addition, it is added in 4695 * the addition part near the end of the ixfr, when 4696 * that serial is seen the second time. */ 4697 int duplicate = 0; 4698 /* add this RR */ 4699 if(!az_insert_rr_decompress(z, rr_chunk->data, 4700 rr_chunk->len, scratch_buffer, rr_dname, 4701 rr_type, rr_class, rr_ttl, rr_rdata, rr_rdlen, 4702 &duplicate)) { 4703 /* failed, malloc error or so */ 4704 return 0; 4705 } 4706 if(duplicate) { 4707 /* it was a duplicate */ 4708 if(verbosity>=4) log_rrlist_position( 4709 "IXFR error duplicate RR", 4710 rr_chunk, rr_dname, rr_type, rr_counter); 4711 softfail = 1; 4712 } 4713 } 4714 4715 rr_counter++; 4716 chunk_rrlist_gonext(&rr_chunk, &rr_num, &rr_pos, rr_nextpos); 4717 } 4718 if(softfail) { 4719 verbose(VERB_ALGO, "IXFR did not apply cleanly, fetching full zone"); 4720 return 0; 4721 } 4722 return 1; 4723 } 4724 4725 /** apply AXFR to zone in memory. z is locked. false on failure(mallocfail) */ 4726 static int 4727 apply_axfr(struct auth_xfer* xfr, struct auth_zone* z, 4728 struct sldns_buffer* scratch_buffer) 4729 { 4730 struct auth_chunk* rr_chunk; 4731 int rr_num; 4732 size_t rr_pos; 4733 uint8_t* rr_dname, *rr_rdata; 4734 uint16_t rr_type, rr_class, rr_rdlen; 4735 uint32_t rr_ttl; 4736 uint32_t serial = 0; 4737 size_t rr_nextpos; 4738 size_t rr_counter = 0; 4739 int have_end_soa = 0; 4740 4741 /* clear the data tree */ 4742 traverse_postorder(&z->data, auth_data_del, NULL); 4743 rbtree_init(&z->data, &auth_data_cmp); 4744 /* clear the RPZ policies */ 4745 if(z->rpz) 4746 rpz_clear(z->rpz); 4747 4748 xfr->have_zone = 0; 4749 xfr->serial = 0; 4750 4751 /* insert all RRs in to the zone */ 4752 /* insert the SOA only once, skip the last one */ 4753 /* start RR iterator over chunklist of packets */ 4754 chunk_rrlist_start(xfr, &rr_chunk, &rr_num, &rr_pos); 4755 while(!chunk_rrlist_end(rr_chunk, rr_num)) { 4756 if(!chunk_rrlist_get_current(rr_chunk, rr_num, rr_pos, 4757 &rr_dname, &rr_type, &rr_class, &rr_ttl, &rr_rdlen, 4758 &rr_rdata, &rr_nextpos)) { 4759 /* failed to parse RR */ 4760 return 0; 4761 } 4762 if(verbosity>=7) log_rrlist_position("apply_axfr", 4763 rr_chunk, rr_dname, rr_type, rr_counter); 4764 if(rr_type == LDNS_RR_TYPE_SOA) { 4765 if(rr_counter != 0) { 4766 /* end of the axfr */ 4767 have_end_soa = 1; 4768 break; 4769 } 4770 if(rr_rdlen < 22) return 0; /* bad SOA rdlen */ 4771 serial = sldns_read_uint32(rr_rdata+rr_rdlen-20); 4772 } 4773 4774 /* add this RR */ 4775 if(!az_insert_rr_decompress(z, rr_chunk->data, rr_chunk->len, 4776 scratch_buffer, rr_dname, rr_type, rr_class, rr_ttl, 4777 rr_rdata, rr_rdlen, NULL)) { 4778 /* failed, malloc error or so */ 4779 return 0; 4780 } 4781 4782 rr_counter++; 4783 chunk_rrlist_gonext(&rr_chunk, &rr_num, &rr_pos, rr_nextpos); 4784 } 4785 if(!have_end_soa) { 4786 log_err("no end SOA record for AXFR"); 4787 return 0; 4788 } 4789 4790 xfr->serial = serial; 4791 xfr->have_zone = 1; 4792 return 1; 4793 } 4794 4795 /** apply HTTP to zone in memory. z is locked. false on failure(mallocfail) */ 4796 static int 4797 apply_http(struct auth_xfer* xfr, struct auth_zone* z, 4798 struct sldns_buffer* scratch_buffer) 4799 { 4800 /* parse data in chunks */ 4801 /* parse RR's and read into memory. ignore $INCLUDE from the 4802 * downloaded file*/ 4803 struct sldns_file_parse_state pstate; 4804 struct auth_chunk* chunk; 4805 size_t chunk_pos; 4806 memset(&pstate, 0, sizeof(pstate)); 4807 pstate.default_ttl = 3600; 4808 if(xfr->namelen < sizeof(pstate.origin)) { 4809 pstate.origin_len = xfr->namelen; 4810 memmove(pstate.origin, xfr->name, xfr->namelen); 4811 } 4812 4813 if(verbosity >= VERB_ALGO) 4814 verbose(VERB_ALGO, "http download %s of size %d", 4815 xfr->task_transfer->master->file, 4816 (int)chunklist_sum(xfr->task_transfer->chunks_first)); 4817 if(xfr->task_transfer->chunks_first && verbosity >= VERB_ALGO) { 4818 char preview[1024]; 4819 if(xfr->task_transfer->chunks_first->len+1 > sizeof(preview)) { 4820 memmove(preview, xfr->task_transfer->chunks_first->data, 4821 sizeof(preview)-1); 4822 preview[sizeof(preview)-1]=0; 4823 } else { 4824 memmove(preview, xfr->task_transfer->chunks_first->data, 4825 xfr->task_transfer->chunks_first->len); 4826 preview[xfr->task_transfer->chunks_first->len]=0; 4827 } 4828 log_info("auth zone http downloaded content preview: %s", 4829 preview); 4830 } 4831 4832 /* perhaps a little syntax check before we try to apply the data? */ 4833 if(!http_zonefile_syntax_check(xfr, scratch_buffer)) { 4834 log_err("http download %s/%s does not contain a zonefile, " 4835 "but got '%s'", xfr->task_transfer->master->host, 4836 xfr->task_transfer->master->file, 4837 sldns_buffer_begin(scratch_buffer)); 4838 return 0; 4839 } 4840 4841 /* clear the data tree */ 4842 traverse_postorder(&z->data, auth_data_del, NULL); 4843 rbtree_init(&z->data, &auth_data_cmp); 4844 /* clear the RPZ policies */ 4845 if(z->rpz) 4846 rpz_clear(z->rpz); 4847 4848 xfr->have_zone = 0; 4849 xfr->serial = 0; 4850 4851 chunk = xfr->task_transfer->chunks_first; 4852 chunk_pos = 0; 4853 pstate.lineno = 0; 4854 while(chunkline_get_line_collated(&chunk, &chunk_pos, scratch_buffer)) { 4855 /* process this line */ 4856 pstate.lineno++; 4857 chunkline_newline_removal(scratch_buffer); 4858 if(chunkline_is_comment_line_or_empty(scratch_buffer)) { 4859 continue; 4860 } 4861 /* parse line and add RR */ 4862 if(http_parse_origin(scratch_buffer, &pstate)) { 4863 continue; /* $ORIGIN has been handled */ 4864 } 4865 if(http_parse_ttl(scratch_buffer, &pstate)) { 4866 continue; /* $TTL has been handled */ 4867 } 4868 if(!http_parse_add_rr(xfr, z, scratch_buffer, &pstate)) { 4869 verbose(VERB_ALGO, "error parsing line [%s:%d] %s", 4870 xfr->task_transfer->master->file, 4871 pstate.lineno, 4872 sldns_buffer_begin(scratch_buffer)); 4873 return 0; 4874 } 4875 } 4876 return 1; 4877 } 4878 4879 /** write http chunks to zonefile to create downloaded file */ 4880 static int 4881 auth_zone_write_chunks(struct auth_xfer* xfr, const char* fname) 4882 { 4883 FILE* out; 4884 struct auth_chunk* p; 4885 out = fopen(fname, "w"); 4886 if(!out) { 4887 log_err("could not open %s: %s", fname, strerror(errno)); 4888 return 0; 4889 } 4890 for(p = xfr->task_transfer->chunks_first; p ; p = p->next) { 4891 if(!write_out(out, (char*)p->data, p->len)) { 4892 log_err("could not write http download to %s", fname); 4893 fclose(out); 4894 return 0; 4895 } 4896 } 4897 fclose(out); 4898 return 1; 4899 } 4900 4901 /** write to zonefile after zone has been updated */ 4902 static void 4903 xfr_write_after_update(struct auth_xfer* xfr, struct module_env* env) 4904 { 4905 struct config_file* cfg = env->cfg; 4906 struct auth_zone* z; 4907 char tmpfile[1024]; 4908 char* zfilename; 4909 lock_basic_unlock(&xfr->lock); 4910 4911 /* get lock again, so it is a readlock and concurrently queries 4912 * can be answered */ 4913 lock_rw_rdlock(&env->auth_zones->lock); 4914 z = auth_zone_find(env->auth_zones, xfr->name, xfr->namelen, 4915 xfr->dclass); 4916 if(!z) { 4917 lock_rw_unlock(&env->auth_zones->lock); 4918 /* the zone is gone, ignore xfr results */ 4919 lock_basic_lock(&xfr->lock); 4920 return; 4921 } 4922 lock_rw_rdlock(&z->lock); 4923 lock_basic_lock(&xfr->lock); 4924 lock_rw_unlock(&env->auth_zones->lock); 4925 4926 if(z->zonefile == NULL || z->zonefile[0] == 0) { 4927 lock_rw_unlock(&z->lock); 4928 /* no write needed, no zonefile set */ 4929 return; 4930 } 4931 zfilename = z->zonefile; 4932 if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(zfilename, 4933 cfg->chrootdir, strlen(cfg->chrootdir)) == 0) 4934 zfilename += strlen(cfg->chrootdir); 4935 if(verbosity >= VERB_ALGO) { 4936 char nm[255+1]; 4937 dname_str(z->name, nm); 4938 verbose(VERB_ALGO, "write zonefile %s for %s", zfilename, nm); 4939 } 4940 4941 /* write to tempfile first */ 4942 if((size_t)strlen(zfilename) + 16 > sizeof(tmpfile)) { 4943 verbose(VERB_ALGO, "tmpfilename too long, cannot update " 4944 " zonefile %s", zfilename); 4945 lock_rw_unlock(&z->lock); 4946 return; 4947 } 4948 snprintf(tmpfile, sizeof(tmpfile), "%s.tmp%u", zfilename, 4949 (unsigned)getpid()); 4950 if(xfr->task_transfer->master->http) { 4951 /* use the stored chunk list to write them */ 4952 if(!auth_zone_write_chunks(xfr, tmpfile)) { 4953 unlink(tmpfile); 4954 lock_rw_unlock(&z->lock); 4955 return; 4956 } 4957 } else if(!auth_zone_write_file(z, tmpfile)) { 4958 unlink(tmpfile); 4959 lock_rw_unlock(&z->lock); 4960 return; 4961 } 4962 if(rename(tmpfile, zfilename) < 0) { 4963 log_err("could not rename(%s, %s): %s", tmpfile, zfilename, 4964 strerror(errno)); 4965 unlink(tmpfile); 4966 lock_rw_unlock(&z->lock); 4967 return; 4968 } 4969 lock_rw_unlock(&z->lock); 4970 } 4971 4972 /** process chunk list and update zone in memory, 4973 * return false if it did not work */ 4974 static int 4975 xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env, 4976 int* ixfr_fail) 4977 { 4978 struct auth_zone* z; 4979 4980 /* obtain locks and structures */ 4981 /* release xfr lock, then, while holding az->lock grab both 4982 * z->lock and xfr->lock */ 4983 lock_basic_unlock(&xfr->lock); 4984 lock_rw_rdlock(&env->auth_zones->lock); 4985 z = auth_zone_find(env->auth_zones, xfr->name, xfr->namelen, 4986 xfr->dclass); 4987 if(!z) { 4988 lock_rw_unlock(&env->auth_zones->lock); 4989 /* the zone is gone, ignore xfr results */ 4990 lock_basic_lock(&xfr->lock); 4991 return 0; 4992 } 4993 lock_rw_wrlock(&z->lock); 4994 lock_basic_lock(&xfr->lock); 4995 lock_rw_unlock(&env->auth_zones->lock); 4996 4997 /* apply data */ 4998 if(xfr->task_transfer->master->http) { 4999 if(!apply_http(xfr, z, env->scratch_buffer)) { 5000 lock_rw_unlock(&z->lock); 5001 verbose(VERB_ALGO, "http from %s: could not store data", 5002 xfr->task_transfer->master->host); 5003 return 0; 5004 } 5005 } else if(xfr->task_transfer->on_ixfr && 5006 !xfr->task_transfer->on_ixfr_is_axfr) { 5007 if(!apply_ixfr(xfr, z, env->scratch_buffer)) { 5008 lock_rw_unlock(&z->lock); 5009 verbose(VERB_ALGO, "xfr from %s: could not store IXFR" 5010 " data", xfr->task_transfer->master->host); 5011 *ixfr_fail = 1; 5012 return 0; 5013 } 5014 } else { 5015 if(!apply_axfr(xfr, z, env->scratch_buffer)) { 5016 lock_rw_unlock(&z->lock); 5017 verbose(VERB_ALGO, "xfr from %s: could not store AXFR" 5018 " data", xfr->task_transfer->master->host); 5019 return 0; 5020 } 5021 } 5022 xfr->zone_expired = 0; 5023 z->zone_expired = 0; 5024 if(!xfr_find_soa(z, xfr)) { 5025 lock_rw_unlock(&z->lock); 5026 verbose(VERB_ALGO, "xfr from %s: no SOA in zone after update" 5027 " (or malformed RR)", xfr->task_transfer->master->host); 5028 return 0; 5029 } 5030 if(xfr->have_zone) 5031 xfr->lease_time = *env->now; 5032 5033 if(z->rpz) 5034 rpz_finish_config(z->rpz); 5035 5036 /* unlock */ 5037 lock_rw_unlock(&z->lock); 5038 5039 if(verbosity >= VERB_QUERY && xfr->have_zone) { 5040 char zname[256]; 5041 dname_str(xfr->name, zname); 5042 verbose(VERB_QUERY, "auth zone %s updated to serial %u", zname, 5043 (unsigned)xfr->serial); 5044 } 5045 /* see if we need to write to a zonefile */ 5046 xfr_write_after_update(xfr, env); 5047 return 1; 5048 } 5049 5050 /** disown task_transfer. caller must hold xfr.lock */ 5051 static void 5052 xfr_transfer_disown(struct auth_xfer* xfr) 5053 { 5054 /* remove timer (from this worker's event base) */ 5055 comm_timer_delete(xfr->task_transfer->timer); 5056 xfr->task_transfer->timer = NULL; 5057 /* remove the commpoint */ 5058 comm_point_delete(xfr->task_transfer->cp); 5059 xfr->task_transfer->cp = NULL; 5060 /* we don't own this item anymore */ 5061 xfr->task_transfer->worker = NULL; 5062 xfr->task_transfer->env = NULL; 5063 } 5064 5065 /** lookup a host name for its addresses, if needed */ 5066 static int 5067 xfr_transfer_lookup_host(struct auth_xfer* xfr, struct module_env* env) 5068 { 5069 struct sockaddr_storage addr; 5070 socklen_t addrlen = 0; 5071 struct auth_master* master = xfr->task_transfer->lookup_target; 5072 struct query_info qinfo; 5073 uint16_t qflags = BIT_RD; 5074 uint8_t dname[LDNS_MAX_DOMAINLEN+1]; 5075 struct edns_data edns; 5076 sldns_buffer* buf = env->scratch_buffer; 5077 if(!master) return 0; 5078 if(extstrtoaddr(master->host, &addr, &addrlen)) { 5079 /* not needed, host is in IP addr format */ 5080 return 0; 5081 } 5082 if(master->allow_notify) 5083 return 0; /* allow-notifies are not transferred from, no 5084 lookup is needed */ 5085 5086 /* use mesh_new_callback to probe for non-addr hosts, 5087 * and then wait for them to be looked up (in cache, or query) */ 5088 qinfo.qname_len = sizeof(dname); 5089 if(sldns_str2wire_dname_buf(master->host, dname, &qinfo.qname_len) 5090 != 0) { 5091 log_err("cannot parse host name of master %s", master->host); 5092 return 0; 5093 } 5094 qinfo.qname = dname; 5095 qinfo.qclass = xfr->dclass; 5096 qinfo.qtype = LDNS_RR_TYPE_A; 5097 if(xfr->task_transfer->lookup_aaaa) 5098 qinfo.qtype = LDNS_RR_TYPE_AAAA; 5099 qinfo.local_alias = NULL; 5100 if(verbosity >= VERB_ALGO) { 5101 char buf1[512]; 5102 char buf2[LDNS_MAX_DOMAINLEN+1]; 5103 dname_str(xfr->name, buf2); 5104 snprintf(buf1, sizeof(buf1), "auth zone %s: master lookup" 5105 " for task_transfer", buf2); 5106 log_query_info(VERB_ALGO, buf1, &qinfo); 5107 } 5108 edns.edns_present = 1; 5109 edns.ext_rcode = 0; 5110 edns.edns_version = 0; 5111 edns.bits = EDNS_DO; 5112 edns.opt_list = NULL; 5113 edns.padding_block_size = 0; 5114 if(sldns_buffer_capacity(buf) < 65535) 5115 edns.udp_size = (uint16_t)sldns_buffer_capacity(buf); 5116 else edns.udp_size = 65535; 5117 5118 /* unlock xfr during mesh_new_callback() because the callback can be 5119 * called straight away */ 5120 lock_basic_unlock(&xfr->lock); 5121 if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0, 5122 &auth_xfer_transfer_lookup_callback, xfr)) { 5123 lock_basic_lock(&xfr->lock); 5124 log_err("out of memory lookup up master %s", master->host); 5125 return 0; 5126 } 5127 lock_basic_lock(&xfr->lock); 5128 return 1; 5129 } 5130 5131 /** initiate TCP to the target and fetch zone. 5132 * returns true if that was successfully started, and timeout setup. */ 5133 static int 5134 xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env) 5135 { 5136 struct sockaddr_storage addr; 5137 socklen_t addrlen = 0; 5138 struct auth_master* master = xfr->task_transfer->master; 5139 char *auth_name = NULL; 5140 struct timeval t; 5141 int timeout; 5142 if(!master) return 0; 5143 if(master->allow_notify) return 0; /* only for notify */ 5144 5145 /* get master addr */ 5146 if(xfr->task_transfer->scan_addr) { 5147 addrlen = xfr->task_transfer->scan_addr->addrlen; 5148 memmove(&addr, &xfr->task_transfer->scan_addr->addr, addrlen); 5149 } else { 5150 if(!authextstrtoaddr(master->host, &addr, &addrlen, &auth_name)) { 5151 /* the ones that are not in addr format are supposed 5152 * to be looked up. The lookup has failed however, 5153 * so skip them */ 5154 char zname[255+1]; 5155 dname_str(xfr->name, zname); 5156 log_err("%s: failed lookup, cannot transfer from master %s", 5157 zname, master->host); 5158 return 0; 5159 } 5160 } 5161 5162 /* remove previous TCP connection (if any) */ 5163 if(xfr->task_transfer->cp) { 5164 comm_point_delete(xfr->task_transfer->cp); 5165 xfr->task_transfer->cp = NULL; 5166 } 5167 if(!xfr->task_transfer->timer) { 5168 xfr->task_transfer->timer = comm_timer_create(env->worker_base, 5169 auth_xfer_transfer_timer_callback, xfr); 5170 if(!xfr->task_transfer->timer) { 5171 log_err("malloc failure"); 5172 return 0; 5173 } 5174 } 5175 timeout = AUTH_TRANSFER_TIMEOUT; 5176 #ifndef S_SPLINT_S 5177 t.tv_sec = timeout/1000; 5178 t.tv_usec = (timeout%1000)*1000; 5179 #endif 5180 5181 if(master->http) { 5182 /* perform http fetch */ 5183 /* store http port number into sockaddr, 5184 * unless someone used unbound's host@port notation */ 5185 xfr->task_transfer->on_ixfr = 0; 5186 if(strchr(master->host, '@') == NULL) 5187 sockaddr_store_port(&addr, addrlen, master->port); 5188 xfr->task_transfer->cp = outnet_comm_point_for_http( 5189 env->outnet, auth_xfer_transfer_http_callback, xfr, 5190 &addr, addrlen, -1, master->ssl, master->host, 5191 master->file); 5192 if(!xfr->task_transfer->cp) { 5193 char zname[255+1], as[256]; 5194 dname_str(xfr->name, zname); 5195 addr_to_str(&addr, addrlen, as, sizeof(as)); 5196 verbose(VERB_ALGO, "cannot create http cp " 5197 "connection for %s to %s", zname, as); 5198 return 0; 5199 } 5200 comm_timer_set(xfr->task_transfer->timer, &t); 5201 if(verbosity >= VERB_ALGO) { 5202 char zname[255+1], as[256]; 5203 dname_str(xfr->name, zname); 5204 addr_to_str(&addr, addrlen, as, sizeof(as)); 5205 verbose(VERB_ALGO, "auth zone %s transfer next HTTP fetch from %s started", zname, as); 5206 } 5207 return 1; 5208 } 5209 5210 /* perform AXFR/IXFR */ 5211 /* set the packet to be written */ 5212 /* create new ID */ 5213 xfr->task_transfer->id = (uint16_t)(ub_random(env->rnd)&0xffff); 5214 xfr_create_ixfr_packet(xfr, env->scratch_buffer, 5215 xfr->task_transfer->id, master); 5216 5217 /* connect on fd */ 5218 xfr->task_transfer->cp = outnet_comm_point_for_tcp(env->outnet, 5219 auth_xfer_transfer_tcp_callback, xfr, &addr, addrlen, 5220 env->scratch_buffer, -1, 5221 auth_name != NULL, auth_name); 5222 if(!xfr->task_transfer->cp) { 5223 char zname[255+1], as[256]; 5224 dname_str(xfr->name, zname); 5225 addr_to_str(&addr, addrlen, as, sizeof(as)); 5226 verbose(VERB_ALGO, "cannot create tcp cp connection for " 5227 "xfr %s to %s", zname, as); 5228 return 0; 5229 } 5230 comm_timer_set(xfr->task_transfer->timer, &t); 5231 if(verbosity >= VERB_ALGO) { 5232 char zname[255+1], as[256]; 5233 dname_str(xfr->name, zname); 5234 addr_to_str(&addr, addrlen, as, sizeof(as)); 5235 verbose(VERB_ALGO, "auth zone %s transfer next %s fetch from %s started", zname, 5236 (xfr->task_transfer->on_ixfr?"IXFR":"AXFR"), as); 5237 } 5238 return 1; 5239 } 5240 5241 /** perform next lookup, next transfer TCP, or end and resume wait time task */ 5242 static void 5243 xfr_transfer_nexttarget_or_end(struct auth_xfer* xfr, struct module_env* env) 5244 { 5245 log_assert(xfr->task_transfer->worker == env->worker); 5246 5247 /* are we performing lookups? */ 5248 while(xfr->task_transfer->lookup_target) { 5249 if(xfr_transfer_lookup_host(xfr, env)) { 5250 /* wait for lookup to finish, 5251 * note that the hostname may be in unbound's cache 5252 * and we may then get an instant cache response, 5253 * and that calls the callback just like a full 5254 * lookup and lookup failures also call callback */ 5255 if(verbosity >= VERB_ALGO) { 5256 char zname[255+1]; 5257 dname_str(xfr->name, zname); 5258 verbose(VERB_ALGO, "auth zone %s transfer next target lookup", zname); 5259 } 5260 lock_basic_unlock(&xfr->lock); 5261 return; 5262 } 5263 xfr_transfer_move_to_next_lookup(xfr, env); 5264 } 5265 5266 /* initiate TCP and fetch the zone from the master */ 5267 /* and set timeout on it */ 5268 while(!xfr_transfer_end_of_list(xfr)) { 5269 xfr->task_transfer->master = xfr_transfer_current_master(xfr); 5270 if(xfr_transfer_init_fetch(xfr, env)) { 5271 /* successfully started, wait for callback */ 5272 lock_basic_unlock(&xfr->lock); 5273 return; 5274 } 5275 /* failed to fetch, next master */ 5276 xfr_transfer_nextmaster(xfr); 5277 } 5278 if(verbosity >= VERB_ALGO) { 5279 char zname[255+1]; 5280 dname_str(xfr->name, zname); 5281 verbose(VERB_ALGO, "auth zone %s transfer failed, wait", zname); 5282 } 5283 5284 /* we failed to fetch the zone, move to wait task 5285 * use the shorter retry timeout */ 5286 xfr_transfer_disown(xfr); 5287 5288 /* pick up the nextprobe task and wait */ 5289 if(xfr->task_nextprobe->worker == NULL) 5290 xfr_set_timeout(xfr, env, 1, 0); 5291 lock_basic_unlock(&xfr->lock); 5292 } 5293 5294 /** add addrs from A or AAAA rrset to the master */ 5295 static void 5296 xfr_master_add_addrs(struct auth_master* m, struct ub_packed_rrset_key* rrset, 5297 uint16_t rrtype) 5298 { 5299 size_t i; 5300 struct packed_rrset_data* data; 5301 if(!m || !rrset) return; 5302 if(rrtype != LDNS_RR_TYPE_A && rrtype != LDNS_RR_TYPE_AAAA) 5303 return; 5304 data = (struct packed_rrset_data*)rrset->entry.data; 5305 for(i=0; i<data->count; i++) { 5306 struct auth_addr* a; 5307 size_t len = data->rr_len[i] - 2; 5308 uint8_t* rdata = data->rr_data[i]+2; 5309 if(rrtype == LDNS_RR_TYPE_A && len != INET_SIZE) 5310 continue; /* wrong length for A */ 5311 if(rrtype == LDNS_RR_TYPE_AAAA && len != INET6_SIZE) 5312 continue; /* wrong length for AAAA */ 5313 5314 /* add and alloc it */ 5315 a = (struct auth_addr*)calloc(1, sizeof(*a)); 5316 if(!a) { 5317 log_err("out of memory"); 5318 return; 5319 } 5320 if(rrtype == LDNS_RR_TYPE_A) { 5321 struct sockaddr_in* sa; 5322 a->addrlen = (socklen_t)sizeof(*sa); 5323 sa = (struct sockaddr_in*)&a->addr; 5324 sa->sin_family = AF_INET; 5325 sa->sin_port = (in_port_t)htons(UNBOUND_DNS_PORT); 5326 memmove(&sa->sin_addr, rdata, INET_SIZE); 5327 } else { 5328 struct sockaddr_in6* sa; 5329 a->addrlen = (socklen_t)sizeof(*sa); 5330 sa = (struct sockaddr_in6*)&a->addr; 5331 sa->sin6_family = AF_INET6; 5332 sa->sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT); 5333 memmove(&sa->sin6_addr, rdata, INET6_SIZE); 5334 } 5335 if(verbosity >= VERB_ALGO) { 5336 char s[64]; 5337 addr_to_str(&a->addr, a->addrlen, s, sizeof(s)); 5338 verbose(VERB_ALGO, "auth host %s lookup %s", 5339 m->host, s); 5340 } 5341 /* append to list */ 5342 a->next = m->list; 5343 m->list = a; 5344 } 5345 } 5346 5347 /** callback for task_transfer lookup of host name, of A or AAAA */ 5348 void auth_xfer_transfer_lookup_callback(void* arg, int rcode, sldns_buffer* buf, 5349 enum sec_status ATTR_UNUSED(sec), char* ATTR_UNUSED(why_bogus), 5350 int ATTR_UNUSED(was_ratelimited)) 5351 { 5352 struct auth_xfer* xfr = (struct auth_xfer*)arg; 5353 struct module_env* env; 5354 log_assert(xfr->task_transfer); 5355 lock_basic_lock(&xfr->lock); 5356 env = xfr->task_transfer->env; 5357 if(!env || env->outnet->want_to_quit) { 5358 lock_basic_unlock(&xfr->lock); 5359 return; /* stop on quit */ 5360 } 5361 5362 /* process result */ 5363 if(rcode == LDNS_RCODE_NOERROR) { 5364 uint16_t wanted_qtype = LDNS_RR_TYPE_A; 5365 struct regional* temp = env->scratch; 5366 struct query_info rq; 5367 struct reply_info* rep; 5368 if(xfr->task_transfer->lookup_aaaa) 5369 wanted_qtype = LDNS_RR_TYPE_AAAA; 5370 memset(&rq, 0, sizeof(rq)); 5371 rep = parse_reply_in_temp_region(buf, temp, &rq); 5372 if(rep && rq.qtype == wanted_qtype && 5373 FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR) { 5374 /* parsed successfully */ 5375 struct ub_packed_rrset_key* answer = 5376 reply_find_answer_rrset(&rq, rep); 5377 if(answer) { 5378 xfr_master_add_addrs(xfr->task_transfer-> 5379 lookup_target, answer, wanted_qtype); 5380 } else { 5381 if(verbosity >= VERB_ALGO) { 5382 char zname[255+1]; 5383 dname_str(xfr->name, zname); 5384 verbose(VERB_ALGO, "auth zone %s host %s type %s transfer lookup has nodata", zname, xfr->task_transfer->lookup_target->host, (xfr->task_transfer->lookup_aaaa?"AAAA":"A")); 5385 } 5386 } 5387 } else { 5388 if(verbosity >= VERB_ALGO) { 5389 char zname[255+1]; 5390 dname_str(xfr->name, zname); 5391 verbose(VERB_ALGO, "auth zone %s host %s type %s transfer lookup has no answer", zname, xfr->task_transfer->lookup_target->host, (xfr->task_transfer->lookup_aaaa?"AAAA":"A")); 5392 } 5393 } 5394 regional_free_all(temp); 5395 } else { 5396 if(verbosity >= VERB_ALGO) { 5397 char zname[255+1]; 5398 dname_str(xfr->name, zname); 5399 verbose(VERB_ALGO, "auth zone %s host %s type %s transfer lookup failed", zname, xfr->task_transfer->lookup_target->host, (xfr->task_transfer->lookup_aaaa?"AAAA":"A")); 5400 } 5401 } 5402 if(xfr->task_transfer->lookup_target->list && 5403 xfr->task_transfer->lookup_target == xfr_transfer_current_master(xfr)) 5404 xfr->task_transfer->scan_addr = xfr->task_transfer->lookup_target->list; 5405 5406 /* move to lookup AAAA after A lookup, move to next hostname lookup, 5407 * or move to fetch the zone, or, if nothing to do, end task_transfer */ 5408 xfr_transfer_move_to_next_lookup(xfr, env); 5409 xfr_transfer_nexttarget_or_end(xfr, env); 5410 } 5411 5412 /** check if xfer (AXFR or IXFR) packet is OK. 5413 * return false if we lost connection (SERVFAIL, or unreadable). 5414 * return false if we need to move from IXFR to AXFR, with gonextonfail 5415 * set to false, so the same master is tried again, but with AXFR. 5416 * return true if fine to link into data. 5417 * return true with transferdone=true when the transfer has ended. 5418 */ 5419 static int 5420 check_xfer_packet(sldns_buffer* pkt, struct auth_xfer* xfr, 5421 int* gonextonfail, int* transferdone) 5422 { 5423 uint8_t* wire = sldns_buffer_begin(pkt); 5424 int i; 5425 if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) { 5426 verbose(VERB_ALGO, "xfr to %s failed, packet too small", 5427 xfr->task_transfer->master->host); 5428 return 0; 5429 } 5430 if(!LDNS_QR_WIRE(wire)) { 5431 verbose(VERB_ALGO, "xfr to %s failed, packet has no QR flag", 5432 xfr->task_transfer->master->host); 5433 return 0; 5434 } 5435 if(LDNS_TC_WIRE(wire)) { 5436 verbose(VERB_ALGO, "xfr to %s failed, packet has TC flag", 5437 xfr->task_transfer->master->host); 5438 return 0; 5439 } 5440 /* check ID */ 5441 if(LDNS_ID_WIRE(wire) != xfr->task_transfer->id) { 5442 verbose(VERB_ALGO, "xfr to %s failed, packet wrong ID", 5443 xfr->task_transfer->master->host); 5444 return 0; 5445 } 5446 if(LDNS_RCODE_WIRE(wire) != LDNS_RCODE_NOERROR) { 5447 char rcode[32]; 5448 sldns_wire2str_rcode_buf((int)LDNS_RCODE_WIRE(wire), rcode, 5449 sizeof(rcode)); 5450 /* if we are doing IXFR, check for fallback */ 5451 if(xfr->task_transfer->on_ixfr) { 5452 if(LDNS_RCODE_WIRE(wire) == LDNS_RCODE_NOTIMPL || 5453 LDNS_RCODE_WIRE(wire) == LDNS_RCODE_SERVFAIL || 5454 LDNS_RCODE_WIRE(wire) == LDNS_RCODE_REFUSED || 5455 LDNS_RCODE_WIRE(wire) == LDNS_RCODE_FORMERR) { 5456 verbose(VERB_ALGO, "xfr to %s, fallback " 5457 "from IXFR to AXFR (with rcode %s)", 5458 xfr->task_transfer->master->host, 5459 rcode); 5460 xfr->task_transfer->ixfr_fail = 1; 5461 *gonextonfail = 0; 5462 return 0; 5463 } 5464 } 5465 verbose(VERB_ALGO, "xfr to %s failed, packet with rcode %s", 5466 xfr->task_transfer->master->host, rcode); 5467 return 0; 5468 } 5469 if(LDNS_OPCODE_WIRE(wire) != LDNS_PACKET_QUERY) { 5470 verbose(VERB_ALGO, "xfr to %s failed, packet with bad opcode", 5471 xfr->task_transfer->master->host); 5472 return 0; 5473 } 5474 if(LDNS_QDCOUNT(wire) > 1) { 5475 verbose(VERB_ALGO, "xfr to %s failed, packet has qdcount %d", 5476 xfr->task_transfer->master->host, 5477 (int)LDNS_QDCOUNT(wire)); 5478 return 0; 5479 } 5480 5481 /* check qname */ 5482 sldns_buffer_set_position(pkt, LDNS_HEADER_SIZE); 5483 for(i=0; i<(int)LDNS_QDCOUNT(wire); i++) { 5484 size_t pos = sldns_buffer_position(pkt); 5485 uint16_t qtype, qclass; 5486 if(pkt_dname_len(pkt) == 0) { 5487 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5488 "malformed dname", 5489 xfr->task_transfer->master->host); 5490 return 0; 5491 } 5492 if(dname_pkt_compare(pkt, sldns_buffer_at(pkt, pos), 5493 xfr->name) != 0) { 5494 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5495 "wrong qname", 5496 xfr->task_transfer->master->host); 5497 return 0; 5498 } 5499 if(sldns_buffer_remaining(pkt) < 4) { 5500 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5501 "truncated query RR", 5502 xfr->task_transfer->master->host); 5503 return 0; 5504 } 5505 qtype = sldns_buffer_read_u16(pkt); 5506 qclass = sldns_buffer_read_u16(pkt); 5507 if(qclass != xfr->dclass) { 5508 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5509 "wrong qclass", 5510 xfr->task_transfer->master->host); 5511 return 0; 5512 } 5513 if(xfr->task_transfer->on_ixfr) { 5514 if(qtype != LDNS_RR_TYPE_IXFR) { 5515 verbose(VERB_ALGO, "xfr to %s failed, packet " 5516 "with wrong qtype, expected IXFR", 5517 xfr->task_transfer->master->host); 5518 return 0; 5519 } 5520 } else { 5521 if(qtype != LDNS_RR_TYPE_AXFR) { 5522 verbose(VERB_ALGO, "xfr to %s failed, packet " 5523 "with wrong qtype, expected AXFR", 5524 xfr->task_transfer->master->host); 5525 return 0; 5526 } 5527 } 5528 } 5529 5530 /* check parse of RRs in packet, store first SOA serial 5531 * to be able to detect last SOA (with that serial) to see if done */ 5532 /* also check for IXFR 'zone up to date' reply */ 5533 for(i=0; i<(int)LDNS_ANCOUNT(wire); i++) { 5534 size_t pos = sldns_buffer_position(pkt); 5535 uint16_t tp, rdlen; 5536 if(pkt_dname_len(pkt) == 0) { 5537 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5538 "malformed dname in answer section", 5539 xfr->task_transfer->master->host); 5540 return 0; 5541 } 5542 if(sldns_buffer_remaining(pkt) < 10) { 5543 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5544 "truncated RR", 5545 xfr->task_transfer->master->host); 5546 return 0; 5547 } 5548 tp = sldns_buffer_read_u16(pkt); 5549 (void)sldns_buffer_read_u16(pkt); /* class */ 5550 (void)sldns_buffer_read_u32(pkt); /* ttl */ 5551 rdlen = sldns_buffer_read_u16(pkt); 5552 if(sldns_buffer_remaining(pkt) < rdlen) { 5553 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5554 "truncated RR rdata", 5555 xfr->task_transfer->master->host); 5556 return 0; 5557 } 5558 5559 /* RR parses (haven't checked rdata itself), now look at 5560 * SOA records to see serial number */ 5561 if(xfr->task_transfer->rr_scan_num == 0 && 5562 tp != LDNS_RR_TYPE_SOA) { 5563 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5564 "malformed zone transfer, no start SOA", 5565 xfr->task_transfer->master->host); 5566 return 0; 5567 } 5568 if(xfr->task_transfer->rr_scan_num == 1 && 5569 tp != LDNS_RR_TYPE_SOA) { 5570 /* second RR is not a SOA record, this is not an IXFR 5571 * the master is replying with an AXFR */ 5572 xfr->task_transfer->on_ixfr_is_axfr = 1; 5573 } 5574 if(tp == LDNS_RR_TYPE_SOA) { 5575 uint32_t serial; 5576 if(rdlen < 22) { 5577 verbose(VERB_ALGO, "xfr to %s failed, packet " 5578 "with SOA with malformed rdata", 5579 xfr->task_transfer->master->host); 5580 return 0; 5581 } 5582 if(dname_pkt_compare(pkt, sldns_buffer_at(pkt, pos), 5583 xfr->name) != 0) { 5584 verbose(VERB_ALGO, "xfr to %s failed, packet " 5585 "with SOA with wrong dname", 5586 xfr->task_transfer->master->host); 5587 return 0; 5588 } 5589 5590 /* read serial number of SOA */ 5591 serial = sldns_buffer_read_u32_at(pkt, 5592 sldns_buffer_position(pkt)+rdlen-20); 5593 5594 /* check for IXFR 'zone has SOA x' reply */ 5595 if(xfr->task_transfer->on_ixfr && 5596 xfr->task_transfer->rr_scan_num == 0 && 5597 LDNS_ANCOUNT(wire)==1) { 5598 verbose(VERB_ALGO, "xfr to %s ended, " 5599 "IXFR reply that zone has serial %u," 5600 " fallback from IXFR to AXFR", 5601 xfr->task_transfer->master->host, 5602 (unsigned)serial); 5603 xfr->task_transfer->ixfr_fail = 1; 5604 *gonextonfail = 0; 5605 return 0; 5606 } 5607 5608 /* if first SOA, store serial number */ 5609 if(xfr->task_transfer->got_xfr_serial == 0) { 5610 xfr->task_transfer->got_xfr_serial = 1; 5611 xfr->task_transfer->incoming_xfr_serial = 5612 serial; 5613 verbose(VERB_ALGO, "xfr %s: contains " 5614 "SOA serial %u", 5615 xfr->task_transfer->master->host, 5616 (unsigned)serial); 5617 /* see if end of AXFR */ 5618 } else if(!xfr->task_transfer->on_ixfr || 5619 xfr->task_transfer->on_ixfr_is_axfr) { 5620 /* second SOA with serial is the end 5621 * for AXFR */ 5622 *transferdone = 1; 5623 verbose(VERB_ALGO, "xfr %s: last AXFR packet", 5624 xfr->task_transfer->master->host); 5625 /* for IXFR, count SOA records with that serial */ 5626 } else if(xfr->task_transfer->incoming_xfr_serial == 5627 serial && xfr->task_transfer->got_xfr_serial 5628 == 1) { 5629 xfr->task_transfer->got_xfr_serial++; 5630 /* if not first soa, if serial==firstserial, the 5631 * third time we are at the end, for IXFR */ 5632 } else if(xfr->task_transfer->incoming_xfr_serial == 5633 serial && xfr->task_transfer->got_xfr_serial 5634 == 2) { 5635 verbose(VERB_ALGO, "xfr %s: last IXFR packet", 5636 xfr->task_transfer->master->host); 5637 *transferdone = 1; 5638 /* continue parse check, if that succeeds, 5639 * transfer is done */ 5640 } 5641 } 5642 xfr->task_transfer->rr_scan_num++; 5643 5644 /* skip over RR rdata to go to the next RR */ 5645 sldns_buffer_skip(pkt, (ssize_t)rdlen); 5646 } 5647 5648 /* check authority section */ 5649 /* we skip over the RRs checking packet format */ 5650 for(i=0; i<(int)LDNS_NSCOUNT(wire); i++) { 5651 uint16_t rdlen; 5652 if(pkt_dname_len(pkt) == 0) { 5653 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5654 "malformed dname in authority section", 5655 xfr->task_transfer->master->host); 5656 return 0; 5657 } 5658 if(sldns_buffer_remaining(pkt) < 10) { 5659 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5660 "truncated RR", 5661 xfr->task_transfer->master->host); 5662 return 0; 5663 } 5664 (void)sldns_buffer_read_u16(pkt); /* type */ 5665 (void)sldns_buffer_read_u16(pkt); /* class */ 5666 (void)sldns_buffer_read_u32(pkt); /* ttl */ 5667 rdlen = sldns_buffer_read_u16(pkt); 5668 if(sldns_buffer_remaining(pkt) < rdlen) { 5669 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5670 "truncated RR rdata", 5671 xfr->task_transfer->master->host); 5672 return 0; 5673 } 5674 /* skip over RR rdata to go to the next RR */ 5675 sldns_buffer_skip(pkt, (ssize_t)rdlen); 5676 } 5677 5678 /* check additional section */ 5679 for(i=0; i<(int)LDNS_ARCOUNT(wire); i++) { 5680 uint16_t rdlen; 5681 if(pkt_dname_len(pkt) == 0) { 5682 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5683 "malformed dname in additional section", 5684 xfr->task_transfer->master->host); 5685 return 0; 5686 } 5687 if(sldns_buffer_remaining(pkt) < 10) { 5688 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5689 "truncated RR", 5690 xfr->task_transfer->master->host); 5691 return 0; 5692 } 5693 (void)sldns_buffer_read_u16(pkt); /* type */ 5694 (void)sldns_buffer_read_u16(pkt); /* class */ 5695 (void)sldns_buffer_read_u32(pkt); /* ttl */ 5696 rdlen = sldns_buffer_read_u16(pkt); 5697 if(sldns_buffer_remaining(pkt) < rdlen) { 5698 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5699 "truncated RR rdata", 5700 xfr->task_transfer->master->host); 5701 return 0; 5702 } 5703 /* skip over RR rdata to go to the next RR */ 5704 sldns_buffer_skip(pkt, (ssize_t)rdlen); 5705 } 5706 5707 return 1; 5708 } 5709 5710 /** Link the data from this packet into the worklist of transferred data */ 5711 static int 5712 xfer_link_data(sldns_buffer* pkt, struct auth_xfer* xfr) 5713 { 5714 /* alloc it */ 5715 struct auth_chunk* e; 5716 e = (struct auth_chunk*)calloc(1, sizeof(*e)); 5717 if(!e) return 0; 5718 e->next = NULL; 5719 e->len = sldns_buffer_limit(pkt); 5720 e->data = memdup(sldns_buffer_begin(pkt), e->len); 5721 if(!e->data) { 5722 free(e); 5723 return 0; 5724 } 5725 5726 /* alloc succeeded, link into list */ 5727 if(!xfr->task_transfer->chunks_first) 5728 xfr->task_transfer->chunks_first = e; 5729 if(xfr->task_transfer->chunks_last) 5730 xfr->task_transfer->chunks_last->next = e; 5731 xfr->task_transfer->chunks_last = e; 5732 return 1; 5733 } 5734 5735 /** task transfer. the list of data is complete. process it and if failed 5736 * move to next master, if succeeded, end the task transfer */ 5737 static void 5738 process_list_end_transfer(struct auth_xfer* xfr, struct module_env* env) 5739 { 5740 int ixfr_fail = 0; 5741 if(xfr_process_chunk_list(xfr, env, &ixfr_fail)) { 5742 /* it worked! */ 5743 auth_chunks_delete(xfr->task_transfer); 5744 5745 /* we fetched the zone, move to wait task */ 5746 xfr_transfer_disown(xfr); 5747 5748 if(xfr->notify_received && (!xfr->notify_has_serial || 5749 (xfr->notify_has_serial && 5750 xfr_serial_means_update(xfr, xfr->notify_serial)))) { 5751 uint32_t sr = xfr->notify_serial; 5752 int has_sr = xfr->notify_has_serial; 5753 /* we received a notify while probe/transfer was 5754 * in progress. start a new probe and transfer */ 5755 xfr->notify_received = 0; 5756 xfr->notify_has_serial = 0; 5757 xfr->notify_serial = 0; 5758 if(!xfr_start_probe(xfr, env, NULL)) { 5759 /* if we couldn't start it, already in 5760 * progress; restore notify serial, 5761 * while xfr still locked */ 5762 xfr->notify_received = 1; 5763 xfr->notify_has_serial = has_sr; 5764 xfr->notify_serial = sr; 5765 lock_basic_unlock(&xfr->lock); 5766 } 5767 return; 5768 } else { 5769 /* pick up the nextprobe task and wait (normail wait time) */ 5770 if(xfr->task_nextprobe->worker == NULL) 5771 xfr_set_timeout(xfr, env, 0, 0); 5772 } 5773 lock_basic_unlock(&xfr->lock); 5774 return; 5775 } 5776 /* processing failed */ 5777 /* when done, delete data from list */ 5778 auth_chunks_delete(xfr->task_transfer); 5779 if(ixfr_fail) { 5780 xfr->task_transfer->ixfr_fail = 1; 5781 } else { 5782 xfr_transfer_nextmaster(xfr); 5783 } 5784 xfr_transfer_nexttarget_or_end(xfr, env); 5785 } 5786 5787 /** callback for the task_transfer timer */ 5788 void 5789 auth_xfer_transfer_timer_callback(void* arg) 5790 { 5791 struct auth_xfer* xfr = (struct auth_xfer*)arg; 5792 struct module_env* env; 5793 int gonextonfail = 1; 5794 log_assert(xfr->task_transfer); 5795 lock_basic_lock(&xfr->lock); 5796 env = xfr->task_transfer->env; 5797 if(!env || env->outnet->want_to_quit) { 5798 lock_basic_unlock(&xfr->lock); 5799 return; /* stop on quit */ 5800 } 5801 5802 verbose(VERB_ALGO, "xfr stopped, connection timeout to %s", 5803 xfr->task_transfer->master->host); 5804 5805 /* see if IXFR caused the failure, if so, try AXFR */ 5806 if(xfr->task_transfer->on_ixfr) { 5807 xfr->task_transfer->ixfr_possible_timeout_count++; 5808 if(xfr->task_transfer->ixfr_possible_timeout_count >= 5809 NUM_TIMEOUTS_FALLBACK_IXFR) { 5810 verbose(VERB_ALGO, "xfr to %s, fallback " 5811 "from IXFR to AXFR (because of timeouts)", 5812 xfr->task_transfer->master->host); 5813 xfr->task_transfer->ixfr_fail = 1; 5814 gonextonfail = 0; 5815 } 5816 } 5817 5818 /* delete transferred data from list */ 5819 auth_chunks_delete(xfr->task_transfer); 5820 comm_point_delete(xfr->task_transfer->cp); 5821 xfr->task_transfer->cp = NULL; 5822 if(gonextonfail) 5823 xfr_transfer_nextmaster(xfr); 5824 xfr_transfer_nexttarget_or_end(xfr, env); 5825 } 5826 5827 /** callback for task_transfer tcp connections */ 5828 int 5829 auth_xfer_transfer_tcp_callback(struct comm_point* c, void* arg, int err, 5830 struct comm_reply* ATTR_UNUSED(repinfo)) 5831 { 5832 struct auth_xfer* xfr = (struct auth_xfer*)arg; 5833 struct module_env* env; 5834 int gonextonfail = 1; 5835 int transferdone = 0; 5836 log_assert(xfr->task_transfer); 5837 lock_basic_lock(&xfr->lock); 5838 env = xfr->task_transfer->env; 5839 if(!env || env->outnet->want_to_quit) { 5840 lock_basic_unlock(&xfr->lock); 5841 return 0; /* stop on quit */ 5842 } 5843 /* stop the timer */ 5844 comm_timer_disable(xfr->task_transfer->timer); 5845 5846 if(err != NETEVENT_NOERROR) { 5847 /* connection failed, closed, or timeout */ 5848 /* stop this transfer, cleanup 5849 * and continue task_transfer*/ 5850 verbose(VERB_ALGO, "xfr stopped, connection lost to %s", 5851 xfr->task_transfer->master->host); 5852 5853 /* see if IXFR caused the failure, if so, try AXFR */ 5854 if(xfr->task_transfer->on_ixfr) { 5855 xfr->task_transfer->ixfr_possible_timeout_count++; 5856 if(xfr->task_transfer->ixfr_possible_timeout_count >= 5857 NUM_TIMEOUTS_FALLBACK_IXFR) { 5858 verbose(VERB_ALGO, "xfr to %s, fallback " 5859 "from IXFR to AXFR (because of timeouts)", 5860 xfr->task_transfer->master->host); 5861 xfr->task_transfer->ixfr_fail = 1; 5862 gonextonfail = 0; 5863 } 5864 } 5865 5866 failed: 5867 /* delete transferred data from list */ 5868 auth_chunks_delete(xfr->task_transfer); 5869 comm_point_delete(xfr->task_transfer->cp); 5870 xfr->task_transfer->cp = NULL; 5871 if(gonextonfail) 5872 xfr_transfer_nextmaster(xfr); 5873 xfr_transfer_nexttarget_or_end(xfr, env); 5874 return 0; 5875 } 5876 /* note that IXFR worked without timeout */ 5877 if(xfr->task_transfer->on_ixfr) 5878 xfr->task_transfer->ixfr_possible_timeout_count = 0; 5879 5880 /* handle returned packet */ 5881 /* if it fails, cleanup and end this transfer */ 5882 /* if it needs to fallback from IXFR to AXFR, do that */ 5883 if(!check_xfer_packet(c->buffer, xfr, &gonextonfail, &transferdone)) { 5884 goto failed; 5885 } 5886 /* if it is good, link it into the list of data */ 5887 /* if the link into list of data fails (malloc fail) cleanup and end */ 5888 if(!xfer_link_data(c->buffer, xfr)) { 5889 verbose(VERB_ALGO, "xfr stopped to %s, malloc failed", 5890 xfr->task_transfer->master->host); 5891 goto failed; 5892 } 5893 /* if the transfer is done now, disconnect and process the list */ 5894 if(transferdone) { 5895 comm_point_delete(xfr->task_transfer->cp); 5896 xfr->task_transfer->cp = NULL; 5897 process_list_end_transfer(xfr, env); 5898 return 0; 5899 } 5900 5901 /* if we want to read more messages, setup the commpoint to read 5902 * a DNS packet, and the timeout */ 5903 lock_basic_unlock(&xfr->lock); 5904 c->tcp_is_reading = 1; 5905 sldns_buffer_clear(c->buffer); 5906 comm_point_start_listening(c, -1, AUTH_TRANSFER_TIMEOUT); 5907 return 0; 5908 } 5909 5910 /** callback for task_transfer http connections */ 5911 int 5912 auth_xfer_transfer_http_callback(struct comm_point* c, void* arg, int err, 5913 struct comm_reply* repinfo) 5914 { 5915 struct auth_xfer* xfr = (struct auth_xfer*)arg; 5916 struct module_env* env; 5917 log_assert(xfr->task_transfer); 5918 lock_basic_lock(&xfr->lock); 5919 env = xfr->task_transfer->env; 5920 if(!env || env->outnet->want_to_quit) { 5921 lock_basic_unlock(&xfr->lock); 5922 return 0; /* stop on quit */ 5923 } 5924 verbose(VERB_ALGO, "auth zone transfer http callback"); 5925 /* stop the timer */ 5926 comm_timer_disable(xfr->task_transfer->timer); 5927 5928 if(err != NETEVENT_NOERROR && err != NETEVENT_DONE) { 5929 /* connection failed, closed, or timeout */ 5930 /* stop this transfer, cleanup 5931 * and continue task_transfer*/ 5932 verbose(VERB_ALGO, "http stopped, connection lost to %s", 5933 xfr->task_transfer->master->host); 5934 failed: 5935 /* delete transferred data from list */ 5936 auth_chunks_delete(xfr->task_transfer); 5937 if(repinfo) repinfo->c = NULL; /* signal cp deleted to 5938 the routine calling this callback */ 5939 comm_point_delete(xfr->task_transfer->cp); 5940 xfr->task_transfer->cp = NULL; 5941 xfr_transfer_nextmaster(xfr); 5942 xfr_transfer_nexttarget_or_end(xfr, env); 5943 return 0; 5944 } 5945 5946 /* if it is good, link it into the list of data */ 5947 /* if the link into list of data fails (malloc fail) cleanup and end */ 5948 if(sldns_buffer_limit(c->buffer) > 0) { 5949 verbose(VERB_ALGO, "auth zone http queued up %d bytes", 5950 (int)sldns_buffer_limit(c->buffer)); 5951 if(!xfer_link_data(c->buffer, xfr)) { 5952 verbose(VERB_ALGO, "http stopped to %s, malloc failed", 5953 xfr->task_transfer->master->host); 5954 goto failed; 5955 } 5956 } 5957 /* if the transfer is done now, disconnect and process the list */ 5958 if(err == NETEVENT_DONE) { 5959 if(repinfo) repinfo->c = NULL; /* signal cp deleted to 5960 the routine calling this callback */ 5961 comm_point_delete(xfr->task_transfer->cp); 5962 xfr->task_transfer->cp = NULL; 5963 process_list_end_transfer(xfr, env); 5964 return 0; 5965 } 5966 5967 /* if we want to read more messages, setup the commpoint to read 5968 * a DNS packet, and the timeout */ 5969 lock_basic_unlock(&xfr->lock); 5970 c->tcp_is_reading = 1; 5971 sldns_buffer_clear(c->buffer); 5972 comm_point_start_listening(c, -1, AUTH_TRANSFER_TIMEOUT); 5973 return 0; 5974 } 5975 5976 5977 /** start transfer task by this worker , xfr is locked. */ 5978 static void 5979 xfr_start_transfer(struct auth_xfer* xfr, struct module_env* env, 5980 struct auth_master* master) 5981 { 5982 log_assert(xfr->task_transfer != NULL); 5983 log_assert(xfr->task_transfer->worker == NULL); 5984 log_assert(xfr->task_transfer->chunks_first == NULL); 5985 log_assert(xfr->task_transfer->chunks_last == NULL); 5986 xfr->task_transfer->worker = env->worker; 5987 xfr->task_transfer->env = env; 5988 5989 /* init transfer process */ 5990 /* find that master in the transfer's list of masters? */ 5991 xfr_transfer_start_list(xfr, master); 5992 /* start lookup for hostnames in transfer master list */ 5993 xfr_transfer_start_lookups(xfr); 5994 5995 /* initiate TCP, and set timeout on it */ 5996 xfr_transfer_nexttarget_or_end(xfr, env); 5997 } 5998 5999 /** disown task_probe. caller must hold xfr.lock */ 6000 static void 6001 xfr_probe_disown(struct auth_xfer* xfr) 6002 { 6003 /* remove timer (from this worker's event base) */ 6004 comm_timer_delete(xfr->task_probe->timer); 6005 xfr->task_probe->timer = NULL; 6006 /* remove the commpoint */ 6007 comm_point_delete(xfr->task_probe->cp); 6008 xfr->task_probe->cp = NULL; 6009 /* we don't own this item anymore */ 6010 xfr->task_probe->worker = NULL; 6011 xfr->task_probe->env = NULL; 6012 } 6013 6014 /** send the UDP probe to the master, this is part of task_probe */ 6015 static int 6016 xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env, 6017 int timeout) 6018 { 6019 struct sockaddr_storage addr; 6020 socklen_t addrlen = 0; 6021 struct timeval t; 6022 /* pick master */ 6023 struct auth_master* master = xfr_probe_current_master(xfr); 6024 char *auth_name = NULL; 6025 if(!master) return 0; 6026 if(master->allow_notify) return 0; /* only for notify */ 6027 if(master->http) return 0; /* only masters get SOA UDP probe, 6028 not urls, if those are in this list */ 6029 6030 /* get master addr */ 6031 if(xfr->task_probe->scan_addr) { 6032 addrlen = xfr->task_probe->scan_addr->addrlen; 6033 memmove(&addr, &xfr->task_probe->scan_addr->addr, addrlen); 6034 } else { 6035 if(!authextstrtoaddr(master->host, &addr, &addrlen, &auth_name)) { 6036 /* the ones that are not in addr format are supposed 6037 * to be looked up. The lookup has failed however, 6038 * so skip them */ 6039 char zname[255+1]; 6040 dname_str(xfr->name, zname); 6041 log_err("%s: failed lookup, cannot probe to master %s", 6042 zname, master->host); 6043 return 0; 6044 } 6045 if (auth_name != NULL) { 6046 if (addr.ss_family == AF_INET 6047 && (int)ntohs(((struct sockaddr_in *)&addr)->sin_port) 6048 == env->cfg->ssl_port) 6049 ((struct sockaddr_in *)&addr)->sin_port 6050 = htons((uint16_t)env->cfg->port); 6051 else if (addr.ss_family == AF_INET6 6052 && (int)ntohs(((struct sockaddr_in6 *)&addr)->sin6_port) 6053 == env->cfg->ssl_port) 6054 ((struct sockaddr_in6 *)&addr)->sin6_port 6055 = htons((uint16_t)env->cfg->port); 6056 } 6057 } 6058 6059 /* create packet */ 6060 /* create new ID for new probes, but not on timeout retries, 6061 * this means we'll accept replies to previous retries to same ip */ 6062 if(timeout == AUTH_PROBE_TIMEOUT) 6063 xfr->task_probe->id = (uint16_t)(ub_random(env->rnd)&0xffff); 6064 xfr_create_soa_probe_packet(xfr, env->scratch_buffer, 6065 xfr->task_probe->id); 6066 /* we need to remove the cp if we have a different ip4/ip6 type now */ 6067 if(xfr->task_probe->cp && 6068 ((xfr->task_probe->cp_is_ip6 && !addr_is_ip6(&addr, addrlen)) || 6069 (!xfr->task_probe->cp_is_ip6 && addr_is_ip6(&addr, addrlen))) 6070 ) { 6071 comm_point_delete(xfr->task_probe->cp); 6072 xfr->task_probe->cp = NULL; 6073 } 6074 if(!xfr->task_probe->cp) { 6075 if(addr_is_ip6(&addr, addrlen)) 6076 xfr->task_probe->cp_is_ip6 = 1; 6077 else xfr->task_probe->cp_is_ip6 = 0; 6078 xfr->task_probe->cp = outnet_comm_point_for_udp(env->outnet, 6079 auth_xfer_probe_udp_callback, xfr, &addr, addrlen); 6080 if(!xfr->task_probe->cp) { 6081 char zname[255+1], as[256]; 6082 dname_str(xfr->name, zname); 6083 addr_to_str(&addr, addrlen, as, sizeof(as)); 6084 verbose(VERB_ALGO, "cannot create udp cp for " 6085 "probe %s to %s", zname, as); 6086 return 0; 6087 } 6088 } 6089 if(!xfr->task_probe->timer) { 6090 xfr->task_probe->timer = comm_timer_create(env->worker_base, 6091 auth_xfer_probe_timer_callback, xfr); 6092 if(!xfr->task_probe->timer) { 6093 log_err("malloc failure"); 6094 return 0; 6095 } 6096 } 6097 6098 /* send udp packet */ 6099 if(!comm_point_send_udp_msg(xfr->task_probe->cp, env->scratch_buffer, 6100 (struct sockaddr*)&addr, addrlen, 0)) { 6101 char zname[255+1], as[256]; 6102 dname_str(xfr->name, zname); 6103 addr_to_str(&addr, addrlen, as, sizeof(as)); 6104 verbose(VERB_ALGO, "failed to send soa probe for %s to %s", 6105 zname, as); 6106 return 0; 6107 } 6108 if(verbosity >= VERB_ALGO) { 6109 char zname[255+1], as[256]; 6110 dname_str(xfr->name, zname); 6111 addr_to_str(&addr, addrlen, as, sizeof(as)); 6112 verbose(VERB_ALGO, "auth zone %s soa probe sent to %s", zname, 6113 as); 6114 } 6115 xfr->task_probe->timeout = timeout; 6116 #ifndef S_SPLINT_S 6117 t.tv_sec = timeout/1000; 6118 t.tv_usec = (timeout%1000)*1000; 6119 #endif 6120 comm_timer_set(xfr->task_probe->timer, &t); 6121 6122 return 1; 6123 } 6124 6125 /** callback for task_probe timer */ 6126 void 6127 auth_xfer_probe_timer_callback(void* arg) 6128 { 6129 struct auth_xfer* xfr = (struct auth_xfer*)arg; 6130 struct module_env* env; 6131 log_assert(xfr->task_probe); 6132 lock_basic_lock(&xfr->lock); 6133 env = xfr->task_probe->env; 6134 if(!env || env->outnet->want_to_quit) { 6135 lock_basic_unlock(&xfr->lock); 6136 return; /* stop on quit */ 6137 } 6138 6139 if(verbosity >= VERB_ALGO) { 6140 char zname[255+1]; 6141 dname_str(xfr->name, zname); 6142 verbose(VERB_ALGO, "auth zone %s soa probe timeout", zname); 6143 } 6144 if(xfr->task_probe->timeout <= AUTH_PROBE_TIMEOUT_STOP) { 6145 /* try again with bigger timeout */ 6146 if(xfr_probe_send_probe(xfr, env, xfr->task_probe->timeout*2)) { 6147 lock_basic_unlock(&xfr->lock); 6148 return; 6149 } 6150 } 6151 /* delete commpoint so a new one is created, with a fresh port nr */ 6152 comm_point_delete(xfr->task_probe->cp); 6153 xfr->task_probe->cp = NULL; 6154 6155 /* too many timeouts (or fail to send), move to next or end */ 6156 xfr_probe_nextmaster(xfr); 6157 xfr_probe_send_or_end(xfr, env); 6158 } 6159 6160 /** callback for task_probe udp packets */ 6161 int 6162 auth_xfer_probe_udp_callback(struct comm_point* c, void* arg, int err, 6163 struct comm_reply* repinfo) 6164 { 6165 struct auth_xfer* xfr = (struct auth_xfer*)arg; 6166 struct module_env* env; 6167 log_assert(xfr->task_probe); 6168 lock_basic_lock(&xfr->lock); 6169 env = xfr->task_probe->env; 6170 if(!env || env->outnet->want_to_quit) { 6171 lock_basic_unlock(&xfr->lock); 6172 return 0; /* stop on quit */ 6173 } 6174 6175 /* the comm_point_udp_callback is in a for loop for NUM_UDP_PER_SELECT 6176 * and we set rep.c=NULL to stop if from looking inside the commpoint*/ 6177 repinfo->c = NULL; 6178 /* stop the timer */ 6179 comm_timer_disable(xfr->task_probe->timer); 6180 6181 /* see if we got a packet and what that means */ 6182 if(err == NETEVENT_NOERROR) { 6183 uint32_t serial = 0; 6184 if(check_packet_ok(c->buffer, LDNS_RR_TYPE_SOA, xfr, 6185 &serial)) { 6186 /* successful lookup */ 6187 if(verbosity >= VERB_ALGO) { 6188 char buf[256]; 6189 dname_str(xfr->name, buf); 6190 verbose(VERB_ALGO, "auth zone %s: soa probe " 6191 "serial is %u", buf, (unsigned)serial); 6192 } 6193 /* see if this serial indicates that the zone has 6194 * to be updated */ 6195 if(xfr_serial_means_update(xfr, serial)) { 6196 /* if updated, start the transfer task, if needed */ 6197 verbose(VERB_ALGO, "auth_zone updated, start transfer"); 6198 if(xfr->task_transfer->worker == NULL) { 6199 struct auth_master* master = 6200 xfr_probe_current_master(xfr); 6201 /* if we have download URLs use them 6202 * in preference to this master we 6203 * just probed the SOA from */ 6204 if(xfr->task_transfer->masters && 6205 xfr->task_transfer->masters->http) 6206 master = NULL; 6207 xfr_probe_disown(xfr); 6208 xfr_start_transfer(xfr, env, master); 6209 return 0; 6210 6211 } 6212 /* other tasks are running, we don't do this anymore */ 6213 xfr_probe_disown(xfr); 6214 lock_basic_unlock(&xfr->lock); 6215 /* return, we don't sent a reply to this udp packet, 6216 * and we setup the tasks to do next */ 6217 return 0; 6218 } else { 6219 verbose(VERB_ALGO, "auth_zone master reports unchanged soa serial"); 6220 /* we if cannot find updates amongst the 6221 * masters, this means we then have a new lease 6222 * on the zone */ 6223 xfr->task_probe->have_new_lease = 1; 6224 } 6225 } else { 6226 if(verbosity >= VERB_ALGO) { 6227 char buf[256]; 6228 dname_str(xfr->name, buf); 6229 verbose(VERB_ALGO, "auth zone %s: bad reply to soa probe", buf); 6230 } 6231 } 6232 } else { 6233 if(verbosity >= VERB_ALGO) { 6234 char buf[256]; 6235 dname_str(xfr->name, buf); 6236 verbose(VERB_ALGO, "auth zone %s: soa probe failed", buf); 6237 } 6238 } 6239 6240 /* failed lookup or not an update */ 6241 /* delete commpoint so a new one is created, with a fresh port nr */ 6242 comm_point_delete(xfr->task_probe->cp); 6243 xfr->task_probe->cp = NULL; 6244 6245 /* if the result was not a successfull probe, we need 6246 * to send the next one */ 6247 xfr_probe_nextmaster(xfr); 6248 xfr_probe_send_or_end(xfr, env); 6249 return 0; 6250 } 6251 6252 /** lookup a host name for its addresses, if needed */ 6253 static int 6254 xfr_probe_lookup_host(struct auth_xfer* xfr, struct module_env* env) 6255 { 6256 struct sockaddr_storage addr; 6257 socklen_t addrlen = 0; 6258 struct auth_master* master = xfr->task_probe->lookup_target; 6259 struct query_info qinfo; 6260 uint16_t qflags = BIT_RD; 6261 uint8_t dname[LDNS_MAX_DOMAINLEN+1]; 6262 struct edns_data edns; 6263 sldns_buffer* buf = env->scratch_buffer; 6264 if(!master) return 0; 6265 if(extstrtoaddr(master->host, &addr, &addrlen)) { 6266 /* not needed, host is in IP addr format */ 6267 return 0; 6268 } 6269 if(master->allow_notify && !master->http && 6270 strchr(master->host, '/') != NULL && 6271 strchr(master->host, '/') == strrchr(master->host, '/')) { 6272 return 0; /* is IP/prefix format, not something to look up */ 6273 } 6274 6275 /* use mesh_new_callback to probe for non-addr hosts, 6276 * and then wait for them to be looked up (in cache, or query) */ 6277 qinfo.qname_len = sizeof(dname); 6278 if(sldns_str2wire_dname_buf(master->host, dname, &qinfo.qname_len) 6279 != 0) { 6280 log_err("cannot parse host name of master %s", master->host); 6281 return 0; 6282 } 6283 qinfo.qname = dname; 6284 qinfo.qclass = xfr->dclass; 6285 qinfo.qtype = LDNS_RR_TYPE_A; 6286 if(xfr->task_probe->lookup_aaaa) 6287 qinfo.qtype = LDNS_RR_TYPE_AAAA; 6288 qinfo.local_alias = NULL; 6289 if(verbosity >= VERB_ALGO) { 6290 char buf1[512]; 6291 char buf2[LDNS_MAX_DOMAINLEN+1]; 6292 dname_str(xfr->name, buf2); 6293 snprintf(buf1, sizeof(buf1), "auth zone %s: master lookup" 6294 " for task_probe", buf2); 6295 log_query_info(VERB_ALGO, buf1, &qinfo); 6296 } 6297 edns.edns_present = 1; 6298 edns.ext_rcode = 0; 6299 edns.edns_version = 0; 6300 edns.bits = EDNS_DO; 6301 edns.opt_list = NULL; 6302 edns.padding_block_size = 0; 6303 if(sldns_buffer_capacity(buf) < 65535) 6304 edns.udp_size = (uint16_t)sldns_buffer_capacity(buf); 6305 else edns.udp_size = 65535; 6306 6307 /* unlock xfr during mesh_new_callback() because the callback can be 6308 * called straight away */ 6309 lock_basic_unlock(&xfr->lock); 6310 if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0, 6311 &auth_xfer_probe_lookup_callback, xfr)) { 6312 lock_basic_lock(&xfr->lock); 6313 log_err("out of memory lookup up master %s", master->host); 6314 return 0; 6315 } 6316 lock_basic_lock(&xfr->lock); 6317 return 1; 6318 } 6319 6320 /** move to sending the probe packets, next if fails. task_probe */ 6321 static void 6322 xfr_probe_send_or_end(struct auth_xfer* xfr, struct module_env* env) 6323 { 6324 /* are we doing hostname lookups? */ 6325 while(xfr->task_probe->lookup_target) { 6326 if(xfr_probe_lookup_host(xfr, env)) { 6327 /* wait for lookup to finish, 6328 * note that the hostname may be in unbound's cache 6329 * and we may then get an instant cache response, 6330 * and that calls the callback just like a full 6331 * lookup and lookup failures also call callback */ 6332 if(verbosity >= VERB_ALGO) { 6333 char zname[255+1]; 6334 dname_str(xfr->name, zname); 6335 verbose(VERB_ALGO, "auth zone %s probe next target lookup", zname); 6336 } 6337 lock_basic_unlock(&xfr->lock); 6338 return; 6339 } 6340 xfr_probe_move_to_next_lookup(xfr, env); 6341 } 6342 /* probe of list has ended. Create or refresh the list of of 6343 * allow_notify addrs */ 6344 probe_copy_masters_for_allow_notify(xfr); 6345 if(verbosity >= VERB_ALGO) { 6346 char zname[255+1]; 6347 dname_str(xfr->name, zname); 6348 verbose(VERB_ALGO, "auth zone %s probe: notify addrs updated", zname); 6349 } 6350 if(xfr->task_probe->only_lookup) { 6351 /* only wanted lookups for copy, stop probe and start wait */ 6352 xfr->task_probe->only_lookup = 0; 6353 if(verbosity >= VERB_ALGO) { 6354 char zname[255+1]; 6355 dname_str(xfr->name, zname); 6356 verbose(VERB_ALGO, "auth zone %s probe: finished only_lookup", zname); 6357 } 6358 xfr_probe_disown(xfr); 6359 if(xfr->task_nextprobe->worker == NULL) 6360 xfr_set_timeout(xfr, env, 0, 0); 6361 lock_basic_unlock(&xfr->lock); 6362 return; 6363 } 6364 6365 /* send probe packets */ 6366 while(!xfr_probe_end_of_list(xfr)) { 6367 if(xfr_probe_send_probe(xfr, env, AUTH_PROBE_TIMEOUT)) { 6368 /* successfully sent probe, wait for callback */ 6369 lock_basic_unlock(&xfr->lock); 6370 return; 6371 } 6372 /* failed to send probe, next master */ 6373 xfr_probe_nextmaster(xfr); 6374 } 6375 6376 /* done with probe sequence, wait */ 6377 if(xfr->task_probe->have_new_lease) { 6378 /* if zone not updated, start the wait timer again */ 6379 if(verbosity >= VERB_ALGO) { 6380 char zname[255+1]; 6381 dname_str(xfr->name, zname); 6382 verbose(VERB_ALGO, "auth_zone %s unchanged, new lease, wait", zname); 6383 } 6384 xfr_probe_disown(xfr); 6385 if(xfr->have_zone) 6386 xfr->lease_time = *env->now; 6387 if(xfr->task_nextprobe->worker == NULL) 6388 xfr_set_timeout(xfr, env, 0, 0); 6389 } else { 6390 if(verbosity >= VERB_ALGO) { 6391 char zname[255+1]; 6392 dname_str(xfr->name, zname); 6393 verbose(VERB_ALGO, "auth zone %s soa probe failed, wait to retry", zname); 6394 } 6395 /* we failed to send this as well, move to the wait task, 6396 * use the shorter retry timeout */ 6397 xfr_probe_disown(xfr); 6398 /* pick up the nextprobe task and wait */ 6399 if(xfr->task_nextprobe->worker == NULL) 6400 xfr_set_timeout(xfr, env, 1, 0); 6401 } 6402 6403 lock_basic_unlock(&xfr->lock); 6404 } 6405 6406 /** callback for task_probe lookup of host name, of A or AAAA */ 6407 void auth_xfer_probe_lookup_callback(void* arg, int rcode, sldns_buffer* buf, 6408 enum sec_status ATTR_UNUSED(sec), char* ATTR_UNUSED(why_bogus), 6409 int ATTR_UNUSED(was_ratelimited)) 6410 { 6411 struct auth_xfer* xfr = (struct auth_xfer*)arg; 6412 struct module_env* env; 6413 log_assert(xfr->task_probe); 6414 lock_basic_lock(&xfr->lock); 6415 env = xfr->task_probe->env; 6416 if(!env || env->outnet->want_to_quit) { 6417 lock_basic_unlock(&xfr->lock); 6418 return; /* stop on quit */ 6419 } 6420 6421 /* process result */ 6422 if(rcode == LDNS_RCODE_NOERROR) { 6423 uint16_t wanted_qtype = LDNS_RR_TYPE_A; 6424 struct regional* temp = env->scratch; 6425 struct query_info rq; 6426 struct reply_info* rep; 6427 if(xfr->task_probe->lookup_aaaa) 6428 wanted_qtype = LDNS_RR_TYPE_AAAA; 6429 memset(&rq, 0, sizeof(rq)); 6430 rep = parse_reply_in_temp_region(buf, temp, &rq); 6431 if(rep && rq.qtype == wanted_qtype && 6432 FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR) { 6433 /* parsed successfully */ 6434 struct ub_packed_rrset_key* answer = 6435 reply_find_answer_rrset(&rq, rep); 6436 if(answer) { 6437 xfr_master_add_addrs(xfr->task_probe-> 6438 lookup_target, answer, wanted_qtype); 6439 } else { 6440 if(verbosity >= VERB_ALGO) { 6441 char zname[255+1]; 6442 dname_str(xfr->name, zname); 6443 verbose(VERB_ALGO, "auth zone %s host %s type %s probe lookup has nodata", zname, xfr->task_probe->lookup_target->host, (xfr->task_probe->lookup_aaaa?"AAAA":"A")); 6444 } 6445 } 6446 } else { 6447 if(verbosity >= VERB_ALGO) { 6448 char zname[255+1]; 6449 dname_str(xfr->name, zname); 6450 verbose(VERB_ALGO, "auth zone %s host %s type %s probe lookup has no address", zname, xfr->task_probe->lookup_target->host, (xfr->task_probe->lookup_aaaa?"AAAA":"A")); 6451 } 6452 } 6453 regional_free_all(temp); 6454 } else { 6455 if(verbosity >= VERB_ALGO) { 6456 char zname[255+1]; 6457 dname_str(xfr->name, zname); 6458 verbose(VERB_ALGO, "auth zone %s host %s type %s probe lookup failed", zname, xfr->task_probe->lookup_target->host, (xfr->task_probe->lookup_aaaa?"AAAA":"A")); 6459 } 6460 } 6461 if(xfr->task_probe->lookup_target->list && 6462 xfr->task_probe->lookup_target == xfr_probe_current_master(xfr)) 6463 xfr->task_probe->scan_addr = xfr->task_probe->lookup_target->list; 6464 6465 /* move to lookup AAAA after A lookup, move to next hostname lookup, 6466 * or move to send the probes, or, if nothing to do, end task_probe */ 6467 xfr_probe_move_to_next_lookup(xfr, env); 6468 xfr_probe_send_or_end(xfr, env); 6469 } 6470 6471 /** disown task_nextprobe. caller must hold xfr.lock */ 6472 static void 6473 xfr_nextprobe_disown(struct auth_xfer* xfr) 6474 { 6475 /* delete the timer, because the next worker to pick this up may 6476 * not have the same event base */ 6477 comm_timer_delete(xfr->task_nextprobe->timer); 6478 xfr->task_nextprobe->timer = NULL; 6479 xfr->task_nextprobe->next_probe = 0; 6480 /* we don't own this item anymore */ 6481 xfr->task_nextprobe->worker = NULL; 6482 xfr->task_nextprobe->env = NULL; 6483 } 6484 6485 /** xfer nextprobe timeout callback, this is part of task_nextprobe */ 6486 void 6487 auth_xfer_timer(void* arg) 6488 { 6489 struct auth_xfer* xfr = (struct auth_xfer*)arg; 6490 struct module_env* env; 6491 log_assert(xfr->task_nextprobe); 6492 lock_basic_lock(&xfr->lock); 6493 env = xfr->task_nextprobe->env; 6494 if(!env || env->outnet->want_to_quit) { 6495 lock_basic_unlock(&xfr->lock); 6496 return; /* stop on quit */ 6497 } 6498 6499 /* see if zone has expired, and if so, also set auth_zone expired */ 6500 if(xfr->have_zone && !xfr->zone_expired && 6501 *env->now >= xfr->lease_time + xfr->expiry) { 6502 lock_basic_unlock(&xfr->lock); 6503 auth_xfer_set_expired(xfr, env, 1); 6504 lock_basic_lock(&xfr->lock); 6505 } 6506 6507 xfr_nextprobe_disown(xfr); 6508 6509 if(!xfr_start_probe(xfr, env, NULL)) { 6510 /* not started because already in progress */ 6511 lock_basic_unlock(&xfr->lock); 6512 } 6513 } 6514 6515 /** return true if there are probe (SOA UDP query) targets in the master list*/ 6516 static int 6517 have_probe_targets(struct auth_master* list) 6518 { 6519 struct auth_master* p; 6520 for(p=list; p; p = p->next) { 6521 if(!p->allow_notify && p->host) 6522 return 1; 6523 } 6524 return 0; 6525 } 6526 6527 /** start task_probe if possible, if no masters for probe start task_transfer 6528 * returns true if task has been started, and false if the task is already 6529 * in progress. */ 6530 static int 6531 xfr_start_probe(struct auth_xfer* xfr, struct module_env* env, 6532 struct auth_master* spec) 6533 { 6534 /* see if we need to start a probe (or maybe it is already in 6535 * progress (due to notify)) */ 6536 if(xfr->task_probe->worker == NULL) { 6537 if(!have_probe_targets(xfr->task_probe->masters) && 6538 !(xfr->task_probe->only_lookup && 6539 xfr->task_probe->masters != NULL)) { 6540 /* useless to pick up task_probe, no masters to 6541 * probe. Instead attempt to pick up task transfer */ 6542 if(xfr->task_transfer->worker == NULL) { 6543 xfr_start_transfer(xfr, env, spec); 6544 return 1; 6545 } 6546 /* task transfer already in progress */ 6547 return 0; 6548 } 6549 6550 /* pick up the probe task ourselves */ 6551 xfr->task_probe->worker = env->worker; 6552 xfr->task_probe->env = env; 6553 xfr->task_probe->cp = NULL; 6554 6555 /* start the task */ 6556 /* have not seen a new lease yet, this scan */ 6557 xfr->task_probe->have_new_lease = 0; 6558 /* if this was a timeout, no specific first master to scan */ 6559 /* otherwise, spec is nonNULL the notified master, scan 6560 * first and also transfer first from it */ 6561 xfr_probe_start_list(xfr, spec); 6562 /* setup to start the lookup of hostnames of masters afresh */ 6563 xfr_probe_start_lookups(xfr); 6564 /* send the probe packet or next send, or end task */ 6565 xfr_probe_send_or_end(xfr, env); 6566 return 1; 6567 } 6568 return 0; 6569 } 6570 6571 /** for task_nextprobe. 6572 * determine next timeout for auth_xfer. Also (re)sets timer. 6573 * @param xfr: task structure 6574 * @param env: module environment, with worker and time. 6575 * @param failure: set true if timer should be set for failure retry. 6576 * @param lookup_only: only perform lookups when timer done, 0 sec timeout 6577 */ 6578 static void 6579 xfr_set_timeout(struct auth_xfer* xfr, struct module_env* env, 6580 int failure, int lookup_only) 6581 { 6582 struct timeval tv; 6583 log_assert(xfr->task_nextprobe != NULL); 6584 log_assert(xfr->task_nextprobe->worker == NULL || 6585 xfr->task_nextprobe->worker == env->worker); 6586 /* normally, nextprobe = startoflease + refresh, 6587 * but if expiry is sooner, use that one. 6588 * after a failure, use the retry timer instead. */ 6589 xfr->task_nextprobe->next_probe = *env->now; 6590 if(xfr->lease_time && !failure) 6591 xfr->task_nextprobe->next_probe = xfr->lease_time; 6592 6593 if(!failure) { 6594 xfr->task_nextprobe->backoff = 0; 6595 } else { 6596 if(xfr->task_nextprobe->backoff == 0) 6597 xfr->task_nextprobe->backoff = 3; 6598 else xfr->task_nextprobe->backoff *= 2; 6599 if(xfr->task_nextprobe->backoff > AUTH_TRANSFER_MAX_BACKOFF) 6600 xfr->task_nextprobe->backoff = 6601 AUTH_TRANSFER_MAX_BACKOFF; 6602 } 6603 6604 if(xfr->have_zone) { 6605 time_t wait = xfr->refresh; 6606 if(failure) wait = xfr->retry; 6607 if(xfr->expiry < wait) 6608 xfr->task_nextprobe->next_probe += xfr->expiry; 6609 else xfr->task_nextprobe->next_probe += wait; 6610 if(failure) 6611 xfr->task_nextprobe->next_probe += 6612 xfr->task_nextprobe->backoff; 6613 /* put the timer exactly on expiry, if possible */ 6614 if(xfr->lease_time && xfr->lease_time+xfr->expiry < 6615 xfr->task_nextprobe->next_probe && 6616 xfr->lease_time+xfr->expiry > *env->now) 6617 xfr->task_nextprobe->next_probe = 6618 xfr->lease_time+xfr->expiry; 6619 } else { 6620 xfr->task_nextprobe->next_probe += 6621 xfr->task_nextprobe->backoff; 6622 } 6623 6624 if(!xfr->task_nextprobe->timer) { 6625 xfr->task_nextprobe->timer = comm_timer_create( 6626 env->worker_base, auth_xfer_timer, xfr); 6627 if(!xfr->task_nextprobe->timer) { 6628 /* failed to malloc memory. likely zone transfer 6629 * also fails for that. skip the timeout */ 6630 char zname[255+1]; 6631 dname_str(xfr->name, zname); 6632 log_err("cannot allocate timer, no refresh for %s", 6633 zname); 6634 return; 6635 } 6636 } 6637 xfr->task_nextprobe->worker = env->worker; 6638 xfr->task_nextprobe->env = env; 6639 if(*(xfr->task_nextprobe->env->now) <= xfr->task_nextprobe->next_probe) 6640 tv.tv_sec = xfr->task_nextprobe->next_probe - 6641 *(xfr->task_nextprobe->env->now); 6642 else tv.tv_sec = 0; 6643 if(tv.tv_sec != 0 && lookup_only && xfr->task_probe->masters) { 6644 /* don't lookup_only, if lookup timeout is 0 anyway, 6645 * or if we don't have masters to lookup */ 6646 tv.tv_sec = 0; 6647 if(xfr->task_probe->worker == NULL) 6648 xfr->task_probe->only_lookup = 1; 6649 } 6650 if(verbosity >= VERB_ALGO) { 6651 char zname[255+1]; 6652 dname_str(xfr->name, zname); 6653 verbose(VERB_ALGO, "auth zone %s timeout in %d seconds", 6654 zname, (int)tv.tv_sec); 6655 } 6656 tv.tv_usec = 0; 6657 comm_timer_set(xfr->task_nextprobe->timer, &tv); 6658 } 6659 6660 /** initial pick up of worker timeouts, ties events to worker event loop */ 6661 void 6662 auth_xfer_pickup_initial(struct auth_zones* az, struct module_env* env) 6663 { 6664 struct auth_xfer* x; 6665 lock_rw_wrlock(&az->lock); 6666 RBTREE_FOR(x, struct auth_xfer*, &az->xtree) { 6667 lock_basic_lock(&x->lock); 6668 /* set lease_time, because we now have timestamp in env, 6669 * (not earlier during startup and apply_cfg), and this 6670 * notes the start time when the data was acquired */ 6671 if(x->have_zone) 6672 x->lease_time = *env->now; 6673 if(x->task_nextprobe && x->task_nextprobe->worker == NULL) { 6674 xfr_set_timeout(x, env, 0, 1); 6675 } 6676 lock_basic_unlock(&x->lock); 6677 } 6678 lock_rw_unlock(&az->lock); 6679 } 6680 6681 void auth_zones_cleanup(struct auth_zones* az) 6682 { 6683 struct auth_xfer* x; 6684 lock_rw_wrlock(&az->lock); 6685 RBTREE_FOR(x, struct auth_xfer*, &az->xtree) { 6686 lock_basic_lock(&x->lock); 6687 if(x->task_nextprobe && x->task_nextprobe->worker != NULL) { 6688 xfr_nextprobe_disown(x); 6689 } 6690 if(x->task_probe && x->task_probe->worker != NULL) { 6691 xfr_probe_disown(x); 6692 } 6693 if(x->task_transfer && x->task_transfer->worker != NULL) { 6694 auth_chunks_delete(x->task_transfer); 6695 xfr_transfer_disown(x); 6696 } 6697 lock_basic_unlock(&x->lock); 6698 } 6699 lock_rw_unlock(&az->lock); 6700 } 6701 6702 /** 6703 * malloc the xfer and tasks 6704 * @param z: auth_zone with name of zone. 6705 */ 6706 static struct auth_xfer* 6707 auth_xfer_new(struct auth_zone* z) 6708 { 6709 struct auth_xfer* xfr; 6710 xfr = (struct auth_xfer*)calloc(1, sizeof(*xfr)); 6711 if(!xfr) return NULL; 6712 xfr->name = memdup(z->name, z->namelen); 6713 if(!xfr->name) { 6714 free(xfr); 6715 return NULL; 6716 } 6717 xfr->node.key = xfr; 6718 xfr->namelen = z->namelen; 6719 xfr->namelabs = z->namelabs; 6720 xfr->dclass = z->dclass; 6721 6722 xfr->task_nextprobe = (struct auth_nextprobe*)calloc(1, 6723 sizeof(struct auth_nextprobe)); 6724 if(!xfr->task_nextprobe) { 6725 free(xfr->name); 6726 free(xfr); 6727 return NULL; 6728 } 6729 xfr->task_probe = (struct auth_probe*)calloc(1, 6730 sizeof(struct auth_probe)); 6731 if(!xfr->task_probe) { 6732 free(xfr->task_nextprobe); 6733 free(xfr->name); 6734 free(xfr); 6735 return NULL; 6736 } 6737 xfr->task_transfer = (struct auth_transfer*)calloc(1, 6738 sizeof(struct auth_transfer)); 6739 if(!xfr->task_transfer) { 6740 free(xfr->task_probe); 6741 free(xfr->task_nextprobe); 6742 free(xfr->name); 6743 free(xfr); 6744 return NULL; 6745 } 6746 6747 lock_basic_init(&xfr->lock); 6748 lock_protect(&xfr->lock, &xfr->name, sizeof(xfr->name)); 6749 lock_protect(&xfr->lock, &xfr->namelen, sizeof(xfr->namelen)); 6750 lock_protect(&xfr->lock, xfr->name, xfr->namelen); 6751 lock_protect(&xfr->lock, &xfr->namelabs, sizeof(xfr->namelabs)); 6752 lock_protect(&xfr->lock, &xfr->dclass, sizeof(xfr->dclass)); 6753 lock_protect(&xfr->lock, &xfr->notify_received, sizeof(xfr->notify_received)); 6754 lock_protect(&xfr->lock, &xfr->notify_serial, sizeof(xfr->notify_serial)); 6755 lock_protect(&xfr->lock, &xfr->zone_expired, sizeof(xfr->zone_expired)); 6756 lock_protect(&xfr->lock, &xfr->have_zone, sizeof(xfr->have_zone)); 6757 lock_protect(&xfr->lock, &xfr->serial, sizeof(xfr->serial)); 6758 lock_protect(&xfr->lock, &xfr->retry, sizeof(xfr->retry)); 6759 lock_protect(&xfr->lock, &xfr->refresh, sizeof(xfr->refresh)); 6760 lock_protect(&xfr->lock, &xfr->expiry, sizeof(xfr->expiry)); 6761 lock_protect(&xfr->lock, &xfr->lease_time, sizeof(xfr->lease_time)); 6762 lock_protect(&xfr->lock, &xfr->task_nextprobe->worker, 6763 sizeof(xfr->task_nextprobe->worker)); 6764 lock_protect(&xfr->lock, &xfr->task_probe->worker, 6765 sizeof(xfr->task_probe->worker)); 6766 lock_protect(&xfr->lock, &xfr->task_transfer->worker, 6767 sizeof(xfr->task_transfer->worker)); 6768 lock_basic_lock(&xfr->lock); 6769 return xfr; 6770 } 6771 6772 /** Create auth_xfer structure. 6773 * This populates the have_zone, soa values, and so on times. 6774 * and sets the timeout, if a zone transfer is needed a short timeout is set. 6775 * For that the auth_zone itself must exist (and read in zonefile) 6776 * returns false on alloc failure. */ 6777 struct auth_xfer* 6778 auth_xfer_create(struct auth_zones* az, struct auth_zone* z) 6779 { 6780 struct auth_xfer* xfr; 6781 6782 /* malloc it */ 6783 xfr = auth_xfer_new(z); 6784 if(!xfr) { 6785 log_err("malloc failure"); 6786 return NULL; 6787 } 6788 /* insert in tree */ 6789 (void)rbtree_insert(&az->xtree, &xfr->node); 6790 return xfr; 6791 } 6792 6793 /** create new auth_master structure */ 6794 static struct auth_master* 6795 auth_master_new(struct auth_master*** list) 6796 { 6797 struct auth_master *m; 6798 m = (struct auth_master*)calloc(1, sizeof(*m)); 6799 if(!m) { 6800 log_err("malloc failure"); 6801 return NULL; 6802 } 6803 /* set first pointer to m, or next pointer of previous element to m */ 6804 (**list) = m; 6805 /* store m's next pointer as future point to store at */ 6806 (*list) = &(m->next); 6807 return m; 6808 } 6809 6810 /** dup_prefix : create string from initial part of other string, malloced */ 6811 static char* 6812 dup_prefix(char* str, size_t num) 6813 { 6814 char* result; 6815 size_t len = strlen(str); 6816 if(len < num) num = len; /* not more than strlen */ 6817 result = (char*)malloc(num+1); 6818 if(!result) { 6819 log_err("malloc failure"); 6820 return result; 6821 } 6822 memmove(result, str, num); 6823 result[num] = 0; 6824 return result; 6825 } 6826 6827 /** dup string and print error on error */ 6828 static char* 6829 dup_all(char* str) 6830 { 6831 char* result = strdup(str); 6832 if(!result) { 6833 log_err("malloc failure"); 6834 return NULL; 6835 } 6836 return result; 6837 } 6838 6839 /** find first of two characters */ 6840 static char* 6841 str_find_first_of_chars(char* s, char a, char b) 6842 { 6843 char* ra = strchr(s, a); 6844 char* rb = strchr(s, b); 6845 if(!ra) return rb; 6846 if(!rb) return ra; 6847 if(ra < rb) return ra; 6848 return rb; 6849 } 6850 6851 /** parse URL into host and file parts, false on malloc or parse error */ 6852 static int 6853 parse_url(char* url, char** host, char** file, int* port, int* ssl) 6854 { 6855 char* p = url; 6856 /* parse http://www.example.com/file.htm 6857 * or http://127.0.0.1 (index.html) 6858 * or https://[::1@1234]/a/b/c/d */ 6859 *ssl = 1; 6860 *port = AUTH_HTTPS_PORT; 6861 6862 /* parse http:// or https:// */ 6863 if(strncmp(p, "http://", 7) == 0) { 6864 p += 7; 6865 *ssl = 0; 6866 *port = AUTH_HTTP_PORT; 6867 } else if(strncmp(p, "https://", 8) == 0) { 6868 p += 8; 6869 } else if(strstr(p, "://") && strchr(p, '/') > strstr(p, "://") && 6870 strchr(p, ':') >= strstr(p, "://")) { 6871 char* uri = dup_prefix(p, (size_t)(strstr(p, "://")-p)); 6872 log_err("protocol %s:// not supported (for url %s)", 6873 uri?uri:"", p); 6874 free(uri); 6875 return 0; 6876 } 6877 6878 /* parse hostname part */ 6879 if(p[0] == '[') { 6880 char* end = strchr(p, ']'); 6881 p++; /* skip over [ */ 6882 if(end) { 6883 *host = dup_prefix(p, (size_t)(end-p)); 6884 if(!*host) return 0; 6885 p = end+1; /* skip over ] */ 6886 } else { 6887 *host = dup_all(p); 6888 if(!*host) return 0; 6889 p = end; 6890 } 6891 } else { 6892 char* end = str_find_first_of_chars(p, ':', '/'); 6893 if(end) { 6894 *host = dup_prefix(p, (size_t)(end-p)); 6895 if(!*host) return 0; 6896 } else { 6897 *host = dup_all(p); 6898 if(!*host) return 0; 6899 } 6900 p = end; /* at next : or / or NULL */ 6901 } 6902 6903 /* parse port number */ 6904 if(p && p[0] == ':') { 6905 char* end = NULL; 6906 *port = strtol(p+1, &end, 10); 6907 p = end; 6908 } 6909 6910 /* parse filename part */ 6911 while(p && *p == '/') 6912 p++; 6913 if(!p || p[0] == 0) 6914 *file = strdup("index.html"); 6915 else *file = strdup(p); 6916 if(!*file) { 6917 log_err("malloc failure"); 6918 return 0; 6919 } 6920 return 1; 6921 } 6922 6923 int 6924 xfer_set_masters(struct auth_master** list, struct config_auth* c, 6925 int with_http) 6926 { 6927 struct auth_master* m; 6928 struct config_strlist* p; 6929 /* list points to the first, or next pointer for the new element */ 6930 while(*list) { 6931 list = &( (*list)->next ); 6932 } 6933 if(with_http) 6934 for(p = c->urls; p; p = p->next) { 6935 m = auth_master_new(&list); 6936 m->http = 1; 6937 if(!parse_url(p->str, &m->host, &m->file, &m->port, &m->ssl)) 6938 return 0; 6939 } 6940 for(p = c->masters; p; p = p->next) { 6941 m = auth_master_new(&list); 6942 m->ixfr = 1; /* this flag is not configurable */ 6943 m->host = strdup(p->str); 6944 if(!m->host) { 6945 log_err("malloc failure"); 6946 return 0; 6947 } 6948 } 6949 for(p = c->allow_notify; p; p = p->next) { 6950 m = auth_master_new(&list); 6951 m->allow_notify = 1; 6952 m->host = strdup(p->str); 6953 if(!m->host) { 6954 log_err("malloc failure"); 6955 return 0; 6956 } 6957 } 6958 return 1; 6959 } 6960 6961 #define SERIAL_BITS 32 6962 int 6963 compare_serial(uint32_t a, uint32_t b) 6964 { 6965 const uint32_t cutoff = ((uint32_t) 1 << (SERIAL_BITS - 1)); 6966 6967 if (a == b) { 6968 return 0; 6969 } else if ((a < b && b - a < cutoff) || (a > b && a - b > cutoff)) { 6970 return -1; 6971 } else { 6972 return 1; 6973 } 6974 } 6975