1 /* 2 * services/authzone.c - authoritative zone that is locally hosted. 3 * 4 * Copyright (c) 2017, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains the functions for an authority zone. This zone 40 * is queried by the iterator, just like a stub or forward zone, but then 41 * the data is locally held. 42 */ 43 44 #include "config.h" 45 #include "services/authzone.h" 46 #include "util/data/dname.h" 47 #include "util/data/msgparse.h" 48 #include "util/data/msgreply.h" 49 #include "util/data/msgencode.h" 50 #include "util/data/packed_rrset.h" 51 #include "util/regional.h" 52 #include "util/net_help.h" 53 #include "util/netevent.h" 54 #include "util/config_file.h" 55 #include "util/log.h" 56 #include "util/module.h" 57 #include "util/random.h" 58 #include "services/cache/dns.h" 59 #include "services/outside_network.h" 60 #include "services/listen_dnsport.h" 61 #include "services/mesh.h" 62 #include "sldns/rrdef.h" 63 #include "sldns/pkthdr.h" 64 #include "sldns/sbuffer.h" 65 #include "sldns/str2wire.h" 66 #include "sldns/wire2str.h" 67 #include "sldns/parseutil.h" 68 #include "sldns/keyraw.h" 69 #include "validator/val_nsec3.h" 70 #include "validator/val_secalgo.h" 71 #include <ctype.h> 72 73 /** bytes to use for NSEC3 hash buffer. 20 for sha1 */ 74 #define N3HASHBUFLEN 32 75 /** max number of CNAMEs we are willing to follow (in one answer) */ 76 #define MAX_CNAME_CHAIN 8 77 /** timeout for probe packets for SOA */ 78 #define AUTH_PROBE_TIMEOUT 100 /* msec */ 79 /** when to stop with SOA probes (when exponential timeouts exceed this) */ 80 #define AUTH_PROBE_TIMEOUT_STOP 1000 /* msec */ 81 /* auth transfer timeout for TCP connections, in msec */ 82 #define AUTH_TRANSFER_TIMEOUT 10000 /* msec */ 83 /* auth transfer max backoff for failed tranfers and probes */ 84 #define AUTH_TRANSFER_MAX_BACKOFF 86400 /* sec */ 85 /* auth http port number */ 86 #define AUTH_HTTP_PORT 80 87 /* auth https port number */ 88 #define AUTH_HTTPS_PORT 443 89 /* max depth for nested $INCLUDEs */ 90 #define MAX_INCLUDE_DEPTH 10 91 /** number of timeouts before we fallback from IXFR to AXFR, 92 * because some versions of servers (eg. dnsmasq) drop IXFR packets. */ 93 #define NUM_TIMEOUTS_FALLBACK_IXFR 3 94 95 /** pick up nextprobe task to start waiting to perform transfer actions */ 96 static void xfr_set_timeout(struct auth_xfer* xfr, struct module_env* env, 97 int failure, int lookup_only); 98 /** move to sending the probe packets, next if fails. task_probe */ 99 static void xfr_probe_send_or_end(struct auth_xfer* xfr, 100 struct module_env* env); 101 /** pick up probe task with specified(or NULL) destination first, 102 * or transfer task if nothing to probe, or false if already in progress */ 103 static int xfr_start_probe(struct auth_xfer* xfr, struct module_env* env, 104 struct auth_master* spec); 105 /** delete xfer structure (not its tree entry) */ 106 static void auth_xfer_delete(struct auth_xfer* xfr); 107 108 /** create new dns_msg */ 109 static struct dns_msg* 110 msg_create(struct regional* region, struct query_info* qinfo) 111 { 112 struct dns_msg* msg = (struct dns_msg*)regional_alloc(region, 113 sizeof(struct dns_msg)); 114 if(!msg) 115 return NULL; 116 msg->qinfo.qname = regional_alloc_init(region, qinfo->qname, 117 qinfo->qname_len); 118 if(!msg->qinfo.qname) 119 return NULL; 120 msg->qinfo.qname_len = qinfo->qname_len; 121 msg->qinfo.qtype = qinfo->qtype; 122 msg->qinfo.qclass = qinfo->qclass; 123 msg->qinfo.local_alias = NULL; 124 /* non-packed reply_info, because it needs to grow the array */ 125 msg->rep = (struct reply_info*)regional_alloc_zero(region, 126 sizeof(struct reply_info)-sizeof(struct rrset_ref)); 127 if(!msg->rep) 128 return NULL; 129 msg->rep->flags = (uint16_t)(BIT_QR | BIT_AA); 130 msg->rep->authoritative = 1; 131 msg->rep->qdcount = 1; 132 /* rrsets is NULL, no rrsets yet */ 133 return msg; 134 } 135 136 /** grow rrset array by one in msg */ 137 static int 138 msg_grow_array(struct regional* region, struct dns_msg* msg) 139 { 140 if(msg->rep->rrsets == NULL) { 141 msg->rep->rrsets = regional_alloc_zero(region, 142 sizeof(struct ub_packed_rrset_key*)*(msg->rep->rrset_count+1)); 143 if(!msg->rep->rrsets) 144 return 0; 145 } else { 146 struct ub_packed_rrset_key** rrsets_old = msg->rep->rrsets; 147 msg->rep->rrsets = regional_alloc_zero(region, 148 sizeof(struct ub_packed_rrset_key*)*(msg->rep->rrset_count+1)); 149 if(!msg->rep->rrsets) 150 return 0; 151 memmove(msg->rep->rrsets, rrsets_old, 152 sizeof(struct ub_packed_rrset_key*)*msg->rep->rrset_count); 153 } 154 return 1; 155 } 156 157 /** get ttl of rrset */ 158 static time_t 159 get_rrset_ttl(struct ub_packed_rrset_key* k) 160 { 161 struct packed_rrset_data* d = (struct packed_rrset_data*) 162 k->entry.data; 163 return d->ttl; 164 } 165 166 /** Copy rrset into region from domain-datanode and packet rrset */ 167 static struct ub_packed_rrset_key* 168 auth_packed_rrset_copy_region(struct auth_zone* z, struct auth_data* node, 169 struct auth_rrset* rrset, struct regional* region, time_t adjust) 170 { 171 struct ub_packed_rrset_key key; 172 memset(&key, 0, sizeof(key)); 173 key.entry.key = &key; 174 key.entry.data = rrset->data; 175 key.rk.dname = node->name; 176 key.rk.dname_len = node->namelen; 177 key.rk.type = htons(rrset->type); 178 key.rk.rrset_class = htons(z->dclass); 179 key.entry.hash = rrset_key_hash(&key.rk); 180 return packed_rrset_copy_region(&key, region, adjust); 181 } 182 183 /** fix up msg->rep TTL and prefetch ttl */ 184 static void 185 msg_ttl(struct dns_msg* msg) 186 { 187 if(msg->rep->rrset_count == 0) return; 188 if(msg->rep->rrset_count == 1) { 189 msg->rep->ttl = get_rrset_ttl(msg->rep->rrsets[0]); 190 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 191 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 192 } else if(get_rrset_ttl(msg->rep->rrsets[msg->rep->rrset_count-1]) < 193 msg->rep->ttl) { 194 msg->rep->ttl = get_rrset_ttl(msg->rep->rrsets[ 195 msg->rep->rrset_count-1]); 196 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 197 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 198 } 199 } 200 201 /** see if rrset is a duplicate in the answer message */ 202 static int 203 msg_rrset_duplicate(struct dns_msg* msg, uint8_t* nm, size_t nmlen, 204 uint16_t type, uint16_t dclass) 205 { 206 size_t i; 207 for(i=0; i<msg->rep->rrset_count; i++) { 208 struct ub_packed_rrset_key* k = msg->rep->rrsets[i]; 209 if(ntohs(k->rk.type) == type && k->rk.dname_len == nmlen && 210 ntohs(k->rk.rrset_class) == dclass && 211 query_dname_compare(k->rk.dname, nm) == 0) 212 return 1; 213 } 214 return 0; 215 } 216 217 /** add rrset to answer section (no auth, add rrsets yet) */ 218 static int 219 msg_add_rrset_an(struct auth_zone* z, struct regional* region, 220 struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset) 221 { 222 log_assert(msg->rep->ns_numrrsets == 0); 223 log_assert(msg->rep->ar_numrrsets == 0); 224 if(!rrset || !node) 225 return 1; 226 if(msg_rrset_duplicate(msg, node->name, node->namelen, rrset->type, 227 z->dclass)) 228 return 1; 229 /* grow array */ 230 if(!msg_grow_array(region, msg)) 231 return 0; 232 /* copy it */ 233 if(!(msg->rep->rrsets[msg->rep->rrset_count] = 234 auth_packed_rrset_copy_region(z, node, rrset, region, 0))) 235 return 0; 236 msg->rep->rrset_count++; 237 msg->rep->an_numrrsets++; 238 msg_ttl(msg); 239 return 1; 240 } 241 242 /** add rrset to authority section (no additonal section rrsets yet) */ 243 static int 244 msg_add_rrset_ns(struct auth_zone* z, struct regional* region, 245 struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset) 246 { 247 log_assert(msg->rep->ar_numrrsets == 0); 248 if(!rrset || !node) 249 return 1; 250 if(msg_rrset_duplicate(msg, node->name, node->namelen, rrset->type, 251 z->dclass)) 252 return 1; 253 /* grow array */ 254 if(!msg_grow_array(region, msg)) 255 return 0; 256 /* copy it */ 257 if(!(msg->rep->rrsets[msg->rep->rrset_count] = 258 auth_packed_rrset_copy_region(z, node, rrset, region, 0))) 259 return 0; 260 msg->rep->rrset_count++; 261 msg->rep->ns_numrrsets++; 262 msg_ttl(msg); 263 return 1; 264 } 265 266 /** add rrset to additional section */ 267 static int 268 msg_add_rrset_ar(struct auth_zone* z, struct regional* region, 269 struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset) 270 { 271 if(!rrset || !node) 272 return 1; 273 if(msg_rrset_duplicate(msg, node->name, node->namelen, rrset->type, 274 z->dclass)) 275 return 1; 276 /* grow array */ 277 if(!msg_grow_array(region, msg)) 278 return 0; 279 /* copy it */ 280 if(!(msg->rep->rrsets[msg->rep->rrset_count] = 281 auth_packed_rrset_copy_region(z, node, rrset, region, 0))) 282 return 0; 283 msg->rep->rrset_count++; 284 msg->rep->ar_numrrsets++; 285 msg_ttl(msg); 286 return 1; 287 } 288 289 struct auth_zones* auth_zones_create(void) 290 { 291 struct auth_zones* az = (struct auth_zones*)calloc(1, sizeof(*az)); 292 if(!az) { 293 log_err("out of memory"); 294 return NULL; 295 } 296 rbtree_init(&az->ztree, &auth_zone_cmp); 297 rbtree_init(&az->xtree, &auth_xfer_cmp); 298 lock_rw_init(&az->lock); 299 lock_protect(&az->lock, &az->ztree, sizeof(az->ztree)); 300 lock_protect(&az->lock, &az->xtree, sizeof(az->xtree)); 301 /* also lock protects the rbnode's in struct auth_zone, auth_xfer */ 302 return az; 303 } 304 305 int auth_zone_cmp(const void* z1, const void* z2) 306 { 307 /* first sort on class, so that hierarchy can be maintained within 308 * a class */ 309 struct auth_zone* a = (struct auth_zone*)z1; 310 struct auth_zone* b = (struct auth_zone*)z2; 311 int m; 312 if(a->dclass != b->dclass) { 313 if(a->dclass < b->dclass) 314 return -1; 315 return 1; 316 } 317 /* sorted such that higher zones sort before lower zones (their 318 * contents) */ 319 return dname_lab_cmp(a->name, a->namelabs, b->name, b->namelabs, &m); 320 } 321 322 int auth_data_cmp(const void* z1, const void* z2) 323 { 324 struct auth_data* a = (struct auth_data*)z1; 325 struct auth_data* b = (struct auth_data*)z2; 326 int m; 327 /* canonical sort, because DNSSEC needs that */ 328 return dname_canon_lab_cmp(a->name, a->namelabs, b->name, 329 b->namelabs, &m); 330 } 331 332 int auth_xfer_cmp(const void* z1, const void* z2) 333 { 334 /* first sort on class, so that hierarchy can be maintained within 335 * a class */ 336 struct auth_xfer* a = (struct auth_xfer*)z1; 337 struct auth_xfer* b = (struct auth_xfer*)z2; 338 int m; 339 if(a->dclass != b->dclass) { 340 if(a->dclass < b->dclass) 341 return -1; 342 return 1; 343 } 344 /* sorted such that higher zones sort before lower zones (their 345 * contents) */ 346 return dname_lab_cmp(a->name, a->namelabs, b->name, b->namelabs, &m); 347 } 348 349 /** delete auth rrset node */ 350 static void 351 auth_rrset_delete(struct auth_rrset* rrset) 352 { 353 if(!rrset) return; 354 free(rrset->data); 355 free(rrset); 356 } 357 358 /** delete auth data domain node */ 359 static void 360 auth_data_delete(struct auth_data* n) 361 { 362 struct auth_rrset* p, *np; 363 if(!n) return; 364 p = n->rrsets; 365 while(p) { 366 np = p->next; 367 auth_rrset_delete(p); 368 p = np; 369 } 370 free(n->name); 371 free(n); 372 } 373 374 /** helper traverse to delete zones */ 375 static void 376 auth_data_del(rbnode_type* n, void* ATTR_UNUSED(arg)) 377 { 378 struct auth_data* z = (struct auth_data*)n->key; 379 auth_data_delete(z); 380 } 381 382 /** delete an auth zone structure (tree remove must be done elsewhere) */ 383 static void 384 auth_zone_delete(struct auth_zone* z) 385 { 386 if(!z) return; 387 lock_rw_destroy(&z->lock); 388 traverse_postorder(&z->data, auth_data_del, NULL); 389 free(z->name); 390 free(z->zonefile); 391 free(z); 392 } 393 394 struct auth_zone* 395 auth_zone_create(struct auth_zones* az, uint8_t* nm, size_t nmlen, 396 uint16_t dclass) 397 { 398 struct auth_zone* z = (struct auth_zone*)calloc(1, sizeof(*z)); 399 if(!z) { 400 return NULL; 401 } 402 z->node.key = z; 403 z->dclass = dclass; 404 z->namelen = nmlen; 405 z->namelabs = dname_count_labels(nm); 406 z->name = memdup(nm, nmlen); 407 if(!z->name) { 408 free(z); 409 return NULL; 410 } 411 rbtree_init(&z->data, &auth_data_cmp); 412 lock_rw_init(&z->lock); 413 lock_protect(&z->lock, &z->name, sizeof(*z)-sizeof(rbnode_type)); 414 lock_rw_wrlock(&z->lock); 415 /* z lock protects all, except rbtree itself, which is az->lock */ 416 if(!rbtree_insert(&az->ztree, &z->node)) { 417 lock_rw_unlock(&z->lock); 418 auth_zone_delete(z); 419 log_warn("duplicate auth zone"); 420 return NULL; 421 } 422 return z; 423 } 424 425 struct auth_zone* 426 auth_zone_find(struct auth_zones* az, uint8_t* nm, size_t nmlen, 427 uint16_t dclass) 428 { 429 struct auth_zone key; 430 key.node.key = &key; 431 key.dclass = dclass; 432 key.name = nm; 433 key.namelen = nmlen; 434 key.namelabs = dname_count_labels(nm); 435 return (struct auth_zone*)rbtree_search(&az->ztree, &key); 436 } 437 438 struct auth_xfer* 439 auth_xfer_find(struct auth_zones* az, uint8_t* nm, size_t nmlen, 440 uint16_t dclass) 441 { 442 struct auth_xfer key; 443 key.node.key = &key; 444 key.dclass = dclass; 445 key.name = nm; 446 key.namelen = nmlen; 447 key.namelabs = dname_count_labels(nm); 448 return (struct auth_xfer*)rbtree_search(&az->xtree, &key); 449 } 450 451 /** find an auth zone or sorted less-or-equal, return true if exact */ 452 static int 453 auth_zone_find_less_equal(struct auth_zones* az, uint8_t* nm, size_t nmlen, 454 uint16_t dclass, struct auth_zone** z) 455 { 456 struct auth_zone key; 457 key.node.key = &key; 458 key.dclass = dclass; 459 key.name = nm; 460 key.namelen = nmlen; 461 key.namelabs = dname_count_labels(nm); 462 return rbtree_find_less_equal(&az->ztree, &key, (rbnode_type**)z); 463 } 464 465 466 /** find the auth zone that is above the given name */ 467 struct auth_zone* 468 auth_zones_find_zone(struct auth_zones* az, uint8_t* name, size_t name_len, 469 uint16_t dclass) 470 { 471 uint8_t* nm = name; 472 size_t nmlen = name_len; 473 struct auth_zone* z; 474 if(auth_zone_find_less_equal(az, nm, nmlen, dclass, &z)) { 475 /* exact match */ 476 return z; 477 } else { 478 /* less-or-nothing */ 479 if(!z) return NULL; /* nothing smaller, nothing above it */ 480 /* we found smaller name; smaller may be above the name, 481 * but not below it. */ 482 nm = dname_get_shared_topdomain(z->name, name); 483 dname_count_size_labels(nm, &nmlen); 484 z = NULL; 485 } 486 487 /* search up */ 488 while(!z) { 489 z = auth_zone_find(az, nm, nmlen, dclass); 490 if(z) return z; 491 if(dname_is_root(nm)) break; 492 dname_remove_label(&nm, &nmlen); 493 } 494 return NULL; 495 } 496 497 /** find or create zone with name str. caller must have lock on az. 498 * returns a wrlocked zone */ 499 static struct auth_zone* 500 auth_zones_find_or_add_zone(struct auth_zones* az, char* name) 501 { 502 uint8_t nm[LDNS_MAX_DOMAINLEN+1]; 503 size_t nmlen = sizeof(nm); 504 struct auth_zone* z; 505 506 if(sldns_str2wire_dname_buf(name, nm, &nmlen) != 0) { 507 log_err("cannot parse auth zone name: %s", name); 508 return 0; 509 } 510 z = auth_zone_find(az, nm, nmlen, LDNS_RR_CLASS_IN); 511 if(!z) { 512 /* not found, create the zone */ 513 z = auth_zone_create(az, nm, nmlen, LDNS_RR_CLASS_IN); 514 } else { 515 lock_rw_wrlock(&z->lock); 516 } 517 return z; 518 } 519 520 /** find or create xfer zone with name str. caller must have lock on az. 521 * returns a locked xfer */ 522 static struct auth_xfer* 523 auth_zones_find_or_add_xfer(struct auth_zones* az, struct auth_zone* z) 524 { 525 struct auth_xfer* x; 526 x = auth_xfer_find(az, z->name, z->namelen, z->dclass); 527 if(!x) { 528 /* not found, create the zone */ 529 x = auth_xfer_create(az, z); 530 } else { 531 lock_basic_lock(&x->lock); 532 } 533 return x; 534 } 535 536 int 537 auth_zone_set_zonefile(struct auth_zone* z, char* zonefile) 538 { 539 if(z->zonefile) free(z->zonefile); 540 if(zonefile == NULL) { 541 z->zonefile = NULL; 542 } else { 543 z->zonefile = strdup(zonefile); 544 if(!z->zonefile) { 545 log_err("malloc failure"); 546 return 0; 547 } 548 } 549 return 1; 550 } 551 552 /** set auth zone fallback. caller must have lock on zone */ 553 int 554 auth_zone_set_fallback(struct auth_zone* z, char* fallbackstr) 555 { 556 if(strcmp(fallbackstr, "yes") != 0 && strcmp(fallbackstr, "no") != 0){ 557 log_err("auth zone fallback, expected yes or no, got %s", 558 fallbackstr); 559 return 0; 560 } 561 z->fallback_enabled = (strcmp(fallbackstr, "yes")==0); 562 return 1; 563 } 564 565 /** create domain with the given name */ 566 static struct auth_data* 567 az_domain_create(struct auth_zone* z, uint8_t* nm, size_t nmlen) 568 { 569 struct auth_data* n = (struct auth_data*)malloc(sizeof(*n)); 570 if(!n) return NULL; 571 memset(n, 0, sizeof(*n)); 572 n->node.key = n; 573 n->name = memdup(nm, nmlen); 574 if(!n->name) { 575 free(n); 576 return NULL; 577 } 578 n->namelen = nmlen; 579 n->namelabs = dname_count_labels(nm); 580 if(!rbtree_insert(&z->data, &n->node)) { 581 log_warn("duplicate auth domain name"); 582 free(n->name); 583 free(n); 584 return NULL; 585 } 586 return n; 587 } 588 589 /** find domain with exactly the given name */ 590 static struct auth_data* 591 az_find_name(struct auth_zone* z, uint8_t* nm, size_t nmlen) 592 { 593 struct auth_zone key; 594 key.node.key = &key; 595 key.name = nm; 596 key.namelen = nmlen; 597 key.namelabs = dname_count_labels(nm); 598 return (struct auth_data*)rbtree_search(&z->data, &key); 599 } 600 601 /** Find domain name (or closest match) */ 602 static void 603 az_find_domain(struct auth_zone* z, struct query_info* qinfo, int* node_exact, 604 struct auth_data** node) 605 { 606 struct auth_zone key; 607 key.node.key = &key; 608 key.name = qinfo->qname; 609 key.namelen = qinfo->qname_len; 610 key.namelabs = dname_count_labels(key.name); 611 *node_exact = rbtree_find_less_equal(&z->data, &key, 612 (rbnode_type**)node); 613 } 614 615 /** find or create domain with name in zone */ 616 static struct auth_data* 617 az_domain_find_or_create(struct auth_zone* z, uint8_t* dname, 618 size_t dname_len) 619 { 620 struct auth_data* n = az_find_name(z, dname, dname_len); 621 if(!n) { 622 n = az_domain_create(z, dname, dname_len); 623 } 624 return n; 625 } 626 627 /** find rrset of given type in the domain */ 628 static struct auth_rrset* 629 az_domain_rrset(struct auth_data* n, uint16_t t) 630 { 631 struct auth_rrset* rrset; 632 if(!n) return NULL; 633 rrset = n->rrsets; 634 while(rrset) { 635 if(rrset->type == t) 636 return rrset; 637 rrset = rrset->next; 638 } 639 return NULL; 640 } 641 642 /** remove rrset of this type from domain */ 643 static void 644 domain_remove_rrset(struct auth_data* node, uint16_t rr_type) 645 { 646 struct auth_rrset* rrset, *prev; 647 if(!node) return; 648 prev = NULL; 649 rrset = node->rrsets; 650 while(rrset) { 651 if(rrset->type == rr_type) { 652 /* found it, now delete it */ 653 if(prev) prev->next = rrset->next; 654 else node->rrsets = rrset->next; 655 auth_rrset_delete(rrset); 656 return; 657 } 658 prev = rrset; 659 rrset = rrset->next; 660 } 661 } 662 663 /** find an rr index in the rrset. returns true if found */ 664 static int 665 az_rrset_find_rr(struct packed_rrset_data* d, uint8_t* rdata, size_t len, 666 size_t* index) 667 { 668 size_t i; 669 for(i=0; i<d->count; i++) { 670 if(d->rr_len[i] != len) 671 continue; 672 if(memcmp(d->rr_data[i], rdata, len) == 0) { 673 *index = i; 674 return 1; 675 } 676 } 677 return 0; 678 } 679 680 /** find an rrsig index in the rrset. returns true if found */ 681 static int 682 az_rrset_find_rrsig(struct packed_rrset_data* d, uint8_t* rdata, size_t len, 683 size_t* index) 684 { 685 size_t i; 686 for(i=d->count; i<d->count + d->rrsig_count; i++) { 687 if(d->rr_len[i] != len) 688 continue; 689 if(memcmp(d->rr_data[i], rdata, len) == 0) { 690 *index = i; 691 return 1; 692 } 693 } 694 return 0; 695 } 696 697 /** see if rdata is duplicate */ 698 static int 699 rdata_duplicate(struct packed_rrset_data* d, uint8_t* rdata, size_t len) 700 { 701 size_t i; 702 for(i=0; i<d->count + d->rrsig_count; i++) { 703 if(d->rr_len[i] != len) 704 continue; 705 if(memcmp(d->rr_data[i], rdata, len) == 0) 706 return 1; 707 } 708 return 0; 709 } 710 711 /** get rrsig type covered from rdata. 712 * @param rdata: rdata in wireformat, starting with 16bit rdlength. 713 * @param rdatalen: length of rdata buffer. 714 * @return type covered (or 0). 715 */ 716 static uint16_t 717 rrsig_rdata_get_type_covered(uint8_t* rdata, size_t rdatalen) 718 { 719 if(rdatalen < 4) 720 return 0; 721 return sldns_read_uint16(rdata+2); 722 } 723 724 /** remove RR from existing RRset. Also sig, if it is a signature. 725 * reallocates the packed rrset for a new one, false on alloc failure */ 726 static int 727 rrset_remove_rr(struct auth_rrset* rrset, size_t index) 728 { 729 struct packed_rrset_data* d, *old = rrset->data; 730 size_t i; 731 if(index >= old->count + old->rrsig_count) 732 return 0; /* index out of bounds */ 733 d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old) - ( 734 sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t) + 735 old->rr_len[index])); 736 if(!d) { 737 log_err("malloc failure"); 738 return 0; 739 } 740 d->ttl = old->ttl; 741 d->count = old->count; 742 d->rrsig_count = old->rrsig_count; 743 if(index < d->count) d->count--; 744 else d->rrsig_count--; 745 d->trust = old->trust; 746 d->security = old->security; 747 748 /* set rr_len, needed for ptr_fixup */ 749 d->rr_len = (size_t*)((uint8_t*)d + 750 sizeof(struct packed_rrset_data)); 751 if(index > 0) 752 memmove(d->rr_len, old->rr_len, (index)*sizeof(size_t)); 753 if(index+1 < old->count+old->rrsig_count) 754 memmove(&d->rr_len[index], &old->rr_len[index+1], 755 (old->count+old->rrsig_count - (index+1))*sizeof(size_t)); 756 packed_rrset_ptr_fixup(d); 757 758 /* move over ttls */ 759 if(index > 0) 760 memmove(d->rr_ttl, old->rr_ttl, (index)*sizeof(time_t)); 761 if(index+1 < old->count+old->rrsig_count) 762 memmove(&d->rr_ttl[index], &old->rr_ttl[index+1], 763 (old->count+old->rrsig_count - (index+1))*sizeof(time_t)); 764 765 /* move over rr_data */ 766 for(i=0; i<d->count+d->rrsig_count; i++) { 767 size_t oldi; 768 if(i < index) oldi = i; 769 else oldi = i+1; 770 memmove(d->rr_data[i], old->rr_data[oldi], d->rr_len[i]); 771 } 772 773 /* recalc ttl (lowest of remaining RR ttls) */ 774 if(d->count + d->rrsig_count > 0) 775 d->ttl = d->rr_ttl[0]; 776 for(i=0; i<d->count+d->rrsig_count; i++) { 777 if(d->rr_ttl[i] < d->ttl) 778 d->ttl = d->rr_ttl[i]; 779 } 780 781 free(rrset->data); 782 rrset->data = d; 783 return 1; 784 } 785 786 /** add RR to existing RRset. If insert_sig is true, add to rrsigs. 787 * This reallocates the packed rrset for a new one */ 788 static int 789 rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata, 790 size_t rdatalen, int insert_sig) 791 { 792 struct packed_rrset_data* d, *old = rrset->data; 793 size_t total, old_total; 794 795 d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old) 796 + sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t) 797 + rdatalen); 798 if(!d) { 799 log_err("out of memory"); 800 return 0; 801 } 802 /* copy base values */ 803 memcpy(d, old, sizeof(struct packed_rrset_data)); 804 if(!insert_sig) { 805 d->count++; 806 } else { 807 d->rrsig_count++; 808 } 809 old_total = old->count + old->rrsig_count; 810 total = d->count + d->rrsig_count; 811 /* set rr_len, needed for ptr_fixup */ 812 d->rr_len = (size_t*)((uint8_t*)d + 813 sizeof(struct packed_rrset_data)); 814 if(old->count != 0) 815 memmove(d->rr_len, old->rr_len, old->count*sizeof(size_t)); 816 if(old->rrsig_count != 0) 817 memmove(d->rr_len+d->count, old->rr_len+old->count, 818 old->rrsig_count*sizeof(size_t)); 819 if(!insert_sig) 820 d->rr_len[d->count-1] = rdatalen; 821 else d->rr_len[total-1] = rdatalen; 822 packed_rrset_ptr_fixup(d); 823 if((time_t)rr_ttl < d->ttl) 824 d->ttl = rr_ttl; 825 826 /* copy old values into new array */ 827 if(old->count != 0) { 828 memmove(d->rr_ttl, old->rr_ttl, old->count*sizeof(time_t)); 829 /* all the old rr pieces are allocated sequential, so we 830 * can copy them in one go */ 831 memmove(d->rr_data[0], old->rr_data[0], 832 (old->rr_data[old->count-1] - old->rr_data[0]) + 833 old->rr_len[old->count-1]); 834 } 835 if(old->rrsig_count != 0) { 836 memmove(d->rr_ttl+d->count, old->rr_ttl+old->count, 837 old->rrsig_count*sizeof(time_t)); 838 memmove(d->rr_data[d->count], old->rr_data[old->count], 839 (old->rr_data[old_total-1] - old->rr_data[old->count]) + 840 old->rr_len[old_total-1]); 841 } 842 843 /* insert new value */ 844 if(!insert_sig) { 845 d->rr_ttl[d->count-1] = rr_ttl; 846 memmove(d->rr_data[d->count-1], rdata, rdatalen); 847 } else { 848 d->rr_ttl[total-1] = rr_ttl; 849 memmove(d->rr_data[total-1], rdata, rdatalen); 850 } 851 852 rrset->data = d; 853 free(old); 854 return 1; 855 } 856 857 /** Create new rrset for node with packed rrset with one RR element */ 858 static struct auth_rrset* 859 rrset_create(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl, 860 uint8_t* rdata, size_t rdatalen) 861 { 862 struct auth_rrset* rrset = (struct auth_rrset*)calloc(1, 863 sizeof(*rrset)); 864 struct auth_rrset* p, *prev; 865 struct packed_rrset_data* d; 866 if(!rrset) { 867 log_err("out of memory"); 868 return NULL; 869 } 870 rrset->type = rr_type; 871 872 /* the rrset data structure, with one RR */ 873 d = (struct packed_rrset_data*)calloc(1, 874 sizeof(struct packed_rrset_data) + sizeof(size_t) + 875 sizeof(uint8_t*) + sizeof(time_t) + rdatalen); 876 if(!d) { 877 free(rrset); 878 log_err("out of memory"); 879 return NULL; 880 } 881 rrset->data = d; 882 d->ttl = rr_ttl; 883 d->trust = rrset_trust_prim_noglue; 884 d->rr_len = (size_t*)((uint8_t*)d + sizeof(struct packed_rrset_data)); 885 d->rr_data = (uint8_t**)&(d->rr_len[1]); 886 d->rr_ttl = (time_t*)&(d->rr_data[1]); 887 d->rr_data[0] = (uint8_t*)&(d->rr_ttl[1]); 888 889 /* insert the RR */ 890 d->rr_len[0] = rdatalen; 891 d->rr_ttl[0] = rr_ttl; 892 memmove(d->rr_data[0], rdata, rdatalen); 893 d->count++; 894 895 /* insert rrset into linked list for domain */ 896 /* find sorted place to link the rrset into the list */ 897 prev = NULL; 898 p = node->rrsets; 899 while(p && p->type<=rr_type) { 900 prev = p; 901 p = p->next; 902 } 903 /* so, prev is smaller, and p is larger than rr_type */ 904 rrset->next = p; 905 if(prev) prev->next = rrset; 906 else node->rrsets = rrset; 907 return rrset; 908 } 909 910 /** count number (and size) of rrsigs that cover a type */ 911 static size_t 912 rrsig_num_that_cover(struct auth_rrset* rrsig, uint16_t rr_type, size_t* sigsz) 913 { 914 struct packed_rrset_data* d = rrsig->data; 915 size_t i, num = 0; 916 *sigsz = 0; 917 log_assert(d && rrsig->type == LDNS_RR_TYPE_RRSIG); 918 for(i=0; i<d->count+d->rrsig_count; i++) { 919 if(rrsig_rdata_get_type_covered(d->rr_data[i], 920 d->rr_len[i]) == rr_type) { 921 num++; 922 (*sigsz) += d->rr_len[i]; 923 } 924 } 925 return num; 926 } 927 928 /** See if rrsig set has covered sigs for rrset and move them over */ 929 static int 930 rrset_moveover_rrsigs(struct auth_data* node, uint16_t rr_type, 931 struct auth_rrset* rrset, struct auth_rrset* rrsig) 932 { 933 size_t sigs, sigsz, i, j, total; 934 struct packed_rrset_data* sigold = rrsig->data; 935 struct packed_rrset_data* old = rrset->data; 936 struct packed_rrset_data* d, *sigd; 937 938 log_assert(rrset->type == rr_type); 939 log_assert(rrsig->type == LDNS_RR_TYPE_RRSIG); 940 sigs = rrsig_num_that_cover(rrsig, rr_type, &sigsz); 941 if(sigs == 0) { 942 /* 0 rrsigs to move over, done */ 943 return 1; 944 } 945 946 /* allocate rrset sigsz larger for extra sigs elements, and 947 * allocate rrsig sigsz smaller for less sigs elements. */ 948 d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old) 949 + sigs*(sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t)) 950 + sigsz); 951 if(!d) { 952 log_err("out of memory"); 953 return 0; 954 } 955 /* copy base values */ 956 total = old->count + old->rrsig_count; 957 memcpy(d, old, sizeof(struct packed_rrset_data)); 958 d->rrsig_count += sigs; 959 /* setup rr_len */ 960 d->rr_len = (size_t*)((uint8_t*)d + 961 sizeof(struct packed_rrset_data)); 962 if(total != 0) 963 memmove(d->rr_len, old->rr_len, total*sizeof(size_t)); 964 j = d->count+d->rrsig_count-sigs; 965 for(i=0; i<sigold->count+sigold->rrsig_count; i++) { 966 if(rrsig_rdata_get_type_covered(sigold->rr_data[i], 967 sigold->rr_len[i]) == rr_type) { 968 d->rr_len[j] = sigold->rr_len[i]; 969 j++; 970 } 971 } 972 packed_rrset_ptr_fixup(d); 973 974 /* copy old values into new array */ 975 if(total != 0) { 976 memmove(d->rr_ttl, old->rr_ttl, total*sizeof(time_t)); 977 /* all the old rr pieces are allocated sequential, so we 978 * can copy them in one go */ 979 memmove(d->rr_data[0], old->rr_data[0], 980 (old->rr_data[total-1] - old->rr_data[0]) + 981 old->rr_len[total-1]); 982 } 983 984 /* move over the rrsigs to the larger rrset*/ 985 j = d->count+d->rrsig_count-sigs; 986 for(i=0; i<sigold->count+sigold->rrsig_count; i++) { 987 if(rrsig_rdata_get_type_covered(sigold->rr_data[i], 988 sigold->rr_len[i]) == rr_type) { 989 /* move this one over to location j */ 990 d->rr_ttl[j] = sigold->rr_ttl[i]; 991 memmove(d->rr_data[j], sigold->rr_data[i], 992 sigold->rr_len[i]); 993 if(d->rr_ttl[j] < d->ttl) 994 d->ttl = d->rr_ttl[j]; 995 j++; 996 } 997 } 998 999 /* put it in and deallocate the old rrset */ 1000 rrset->data = d; 1001 free(old); 1002 1003 /* now make rrsig set smaller */ 1004 if(sigold->count+sigold->rrsig_count == sigs) { 1005 /* remove all sigs from rrsig, remove it entirely */ 1006 domain_remove_rrset(node, LDNS_RR_TYPE_RRSIG); 1007 return 1; 1008 } 1009 log_assert(packed_rrset_sizeof(sigold) > sigs*(sizeof(size_t) + 1010 sizeof(uint8_t*) + sizeof(time_t)) + sigsz); 1011 sigd = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(sigold) 1012 - sigs*(sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t)) 1013 - sigsz); 1014 if(!sigd) { 1015 /* no need to free up d, it has already been placed in the 1016 * node->rrset structure */ 1017 log_err("out of memory"); 1018 return 0; 1019 } 1020 /* copy base values */ 1021 memcpy(sigd, sigold, sizeof(struct packed_rrset_data)); 1022 /* in sigd the RRSIGs are stored in the base of the RR, in count */ 1023 sigd->count -= sigs; 1024 /* setup rr_len */ 1025 sigd->rr_len = (size_t*)((uint8_t*)sigd + 1026 sizeof(struct packed_rrset_data)); 1027 j = 0; 1028 for(i=0; i<sigold->count+sigold->rrsig_count; i++) { 1029 if(rrsig_rdata_get_type_covered(sigold->rr_data[i], 1030 sigold->rr_len[i]) != rr_type) { 1031 sigd->rr_len[j] = sigold->rr_len[i]; 1032 j++; 1033 } 1034 } 1035 packed_rrset_ptr_fixup(sigd); 1036 1037 /* copy old values into new rrsig array */ 1038 j = 0; 1039 for(i=0; i<sigold->count+sigold->rrsig_count; i++) { 1040 if(rrsig_rdata_get_type_covered(sigold->rr_data[i], 1041 sigold->rr_len[i]) != rr_type) { 1042 /* move this one over to location j */ 1043 sigd->rr_ttl[j] = sigold->rr_ttl[i]; 1044 memmove(sigd->rr_data[j], sigold->rr_data[i], 1045 sigold->rr_len[i]); 1046 if(j==0) sigd->ttl = sigd->rr_ttl[j]; 1047 else { 1048 if(sigd->rr_ttl[j] < sigd->ttl) 1049 sigd->ttl = sigd->rr_ttl[j]; 1050 } 1051 j++; 1052 } 1053 } 1054 1055 /* put it in and deallocate the old rrset */ 1056 rrsig->data = sigd; 1057 free(sigold); 1058 1059 return 1; 1060 } 1061 1062 /** copy the rrsigs from the rrset to the rrsig rrset, because the rrset 1063 * is going to be deleted. reallocates the RRSIG rrset data. */ 1064 static int 1065 rrsigs_copy_from_rrset_to_rrsigset(struct auth_rrset* rrset, 1066 struct auth_rrset* rrsigset) 1067 { 1068 size_t i; 1069 if(rrset->data->rrsig_count == 0) 1070 return 1; 1071 1072 /* move them over one by one, because there might be duplicates, 1073 * duplicates are ignored */ 1074 for(i=rrset->data->count; 1075 i<rrset->data->count+rrset->data->rrsig_count; i++) { 1076 uint8_t* rdata = rrset->data->rr_data[i]; 1077 size_t rdatalen = rrset->data->rr_len[i]; 1078 time_t rr_ttl = rrset->data->rr_ttl[i]; 1079 1080 if(rdata_duplicate(rrsigset->data, rdata, rdatalen)) { 1081 continue; 1082 } 1083 if(!rrset_add_rr(rrsigset, rr_ttl, rdata, rdatalen, 0)) 1084 return 0; 1085 } 1086 return 1; 1087 } 1088 1089 /** Add rr to node, ignores duplicate RRs, 1090 * rdata points to buffer with rdatalen octets, starts with 2bytelength. */ 1091 static int 1092 az_domain_add_rr(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl, 1093 uint8_t* rdata, size_t rdatalen, int* duplicate) 1094 { 1095 struct auth_rrset* rrset; 1096 /* packed rrsets have their rrsigs along with them, sort them out */ 1097 if(rr_type == LDNS_RR_TYPE_RRSIG) { 1098 uint16_t ctype = rrsig_rdata_get_type_covered(rdata, rdatalen); 1099 if((rrset=az_domain_rrset(node, ctype))!= NULL) { 1100 /* a node of the correct type exists, add the RRSIG 1101 * to the rrset of the covered data type */ 1102 if(rdata_duplicate(rrset->data, rdata, rdatalen)) { 1103 if(duplicate) *duplicate = 1; 1104 return 1; 1105 } 1106 if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 1)) 1107 return 0; 1108 } else if((rrset=az_domain_rrset(node, rr_type))!= NULL) { 1109 /* add RRSIG to rrset of type RRSIG */ 1110 if(rdata_duplicate(rrset->data, rdata, rdatalen)) { 1111 if(duplicate) *duplicate = 1; 1112 return 1; 1113 } 1114 if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 0)) 1115 return 0; 1116 } else { 1117 /* create rrset of type RRSIG */ 1118 if(!rrset_create(node, rr_type, rr_ttl, rdata, 1119 rdatalen)) 1120 return 0; 1121 } 1122 } else { 1123 /* normal RR type */ 1124 if((rrset=az_domain_rrset(node, rr_type))!= NULL) { 1125 /* add data to existing node with data type */ 1126 if(rdata_duplicate(rrset->data, rdata, rdatalen)) { 1127 if(duplicate) *duplicate = 1; 1128 return 1; 1129 } 1130 if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 0)) 1131 return 0; 1132 } else { 1133 struct auth_rrset* rrsig; 1134 /* create new node with data type */ 1135 if(!(rrset=rrset_create(node, rr_type, rr_ttl, rdata, 1136 rdatalen))) 1137 return 0; 1138 1139 /* see if node of type RRSIG has signatures that 1140 * cover the data type, and move them over */ 1141 /* and then make the RRSIG type smaller */ 1142 if((rrsig=az_domain_rrset(node, LDNS_RR_TYPE_RRSIG)) 1143 != NULL) { 1144 if(!rrset_moveover_rrsigs(node, rr_type, 1145 rrset, rrsig)) 1146 return 0; 1147 } 1148 } 1149 } 1150 return 1; 1151 } 1152 1153 /** insert RR into zone, ignore duplicates */ 1154 static int 1155 az_insert_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len, 1156 size_t dname_len, int* duplicate) 1157 { 1158 struct auth_data* node; 1159 uint8_t* dname = rr; 1160 uint16_t rr_type = sldns_wirerr_get_type(rr, rr_len, dname_len); 1161 uint16_t rr_class = sldns_wirerr_get_class(rr, rr_len, dname_len); 1162 uint32_t rr_ttl = sldns_wirerr_get_ttl(rr, rr_len, dname_len); 1163 size_t rdatalen = ((size_t)sldns_wirerr_get_rdatalen(rr, rr_len, 1164 dname_len))+2; 1165 /* rdata points to rdata prefixed with uint16 rdatalength */ 1166 uint8_t* rdata = sldns_wirerr_get_rdatawl(rr, rr_len, dname_len); 1167 1168 if(rr_class != z->dclass) { 1169 log_err("wrong class for RR"); 1170 return 0; 1171 } 1172 if(!(node=az_domain_find_or_create(z, dname, dname_len))) { 1173 log_err("cannot create domain"); 1174 return 0; 1175 } 1176 if(!az_domain_add_rr(node, rr_type, rr_ttl, rdata, rdatalen, 1177 duplicate)) { 1178 log_err("cannot add RR to domain"); 1179 return 0; 1180 } 1181 return 1; 1182 } 1183 1184 /** Remove rr from node, ignores nonexisting RRs, 1185 * rdata points to buffer with rdatalen octets, starts with 2bytelength. */ 1186 static int 1187 az_domain_remove_rr(struct auth_data* node, uint16_t rr_type, 1188 uint8_t* rdata, size_t rdatalen, int* nonexist) 1189 { 1190 struct auth_rrset* rrset; 1191 size_t index = 0; 1192 1193 /* find the plain RR of the given type */ 1194 if((rrset=az_domain_rrset(node, rr_type))!= NULL) { 1195 if(az_rrset_find_rr(rrset->data, rdata, rdatalen, &index)) { 1196 if(rrset->data->count == 1 && 1197 rrset->data->rrsig_count == 0) { 1198 /* last RR, delete the rrset */ 1199 domain_remove_rrset(node, rr_type); 1200 } else if(rrset->data->count == 1 && 1201 rrset->data->rrsig_count != 0) { 1202 /* move RRSIGs to the RRSIG rrset, or 1203 * this one becomes that RRset */ 1204 struct auth_rrset* rrsigset = az_domain_rrset( 1205 node, LDNS_RR_TYPE_RRSIG); 1206 if(rrsigset) { 1207 /* move left over rrsigs to the 1208 * existing rrset of type RRSIG */ 1209 rrsigs_copy_from_rrset_to_rrsigset( 1210 rrset, rrsigset); 1211 /* and then delete the rrset */ 1212 domain_remove_rrset(node, rr_type); 1213 } else { 1214 /* no rrset of type RRSIG, this 1215 * set is now of that type, 1216 * just remove the rr */ 1217 if(!rrset_remove_rr(rrset, index)) 1218 return 0; 1219 rrset->type = LDNS_RR_TYPE_RRSIG; 1220 rrset->data->count = rrset->data->rrsig_count; 1221 rrset->data->rrsig_count = 0; 1222 } 1223 } else { 1224 /* remove the RR from the rrset */ 1225 if(!rrset_remove_rr(rrset, index)) 1226 return 0; 1227 } 1228 return 1; 1229 } 1230 /* rr not found in rrset */ 1231 } 1232 1233 /* is it a type RRSIG, look under the covered type */ 1234 if(rr_type == LDNS_RR_TYPE_RRSIG) { 1235 uint16_t ctype = rrsig_rdata_get_type_covered(rdata, rdatalen); 1236 if((rrset=az_domain_rrset(node, ctype))!= NULL) { 1237 if(az_rrset_find_rrsig(rrset->data, rdata, rdatalen, 1238 &index)) { 1239 /* rrsig should have d->count > 0, be 1240 * over some rr of that type */ 1241 /* remove the rrsig from the rrsigs list of the 1242 * rrset */ 1243 if(!rrset_remove_rr(rrset, index)) 1244 return 0; 1245 return 1; 1246 } 1247 } 1248 /* also RRSIG not found */ 1249 } 1250 1251 /* nothing found to delete */ 1252 if(nonexist) *nonexist = 1; 1253 return 1; 1254 } 1255 1256 /** remove RR from zone, ignore if it does not exist, false on alloc failure*/ 1257 static int 1258 az_remove_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len, 1259 size_t dname_len, int* nonexist) 1260 { 1261 struct auth_data* node; 1262 uint8_t* dname = rr; 1263 uint16_t rr_type = sldns_wirerr_get_type(rr, rr_len, dname_len); 1264 uint16_t rr_class = sldns_wirerr_get_class(rr, rr_len, dname_len); 1265 size_t rdatalen = ((size_t)sldns_wirerr_get_rdatalen(rr, rr_len, 1266 dname_len))+2; 1267 /* rdata points to rdata prefixed with uint16 rdatalength */ 1268 uint8_t* rdata = sldns_wirerr_get_rdatawl(rr, rr_len, dname_len); 1269 1270 if(rr_class != z->dclass) { 1271 log_err("wrong class for RR"); 1272 /* really also a nonexisting entry, because no records 1273 * of that class in the zone, but return an error because 1274 * getting records of the wrong class is a failure of the 1275 * zone transfer */ 1276 return 0; 1277 } 1278 node = az_find_name(z, dname, dname_len); 1279 if(!node) { 1280 /* node with that name does not exist */ 1281 /* nonexisting entry, because no such name */ 1282 *nonexist = 1; 1283 return 1; 1284 } 1285 if(!az_domain_remove_rr(node, rr_type, rdata, rdatalen, nonexist)) { 1286 /* alloc failure or so */ 1287 return 0; 1288 } 1289 /* remove the node, if necessary */ 1290 /* an rrsets==NULL entry is not kept around for empty nonterminals, 1291 * and also parent nodes are not kept around, so we just delete it */ 1292 if(node->rrsets == NULL) { 1293 (void)rbtree_delete(&z->data, node); 1294 auth_data_delete(node); 1295 } 1296 return 1; 1297 } 1298 1299 /** decompress an RR into the buffer where it'll be an uncompressed RR 1300 * with uncompressed dname and uncompressed rdata (dnames) */ 1301 static int 1302 decompress_rr_into_buffer(struct sldns_buffer* buf, uint8_t* pkt, 1303 size_t pktlen, uint8_t* dname, uint16_t rr_type, uint16_t rr_class, 1304 uint32_t rr_ttl, uint8_t* rr_data, uint16_t rr_rdlen) 1305 { 1306 sldns_buffer pktbuf; 1307 size_t dname_len = 0; 1308 size_t rdlenpos; 1309 size_t rdlen; 1310 uint8_t* rd; 1311 const sldns_rr_descriptor* desc; 1312 sldns_buffer_init_frm_data(&pktbuf, pkt, pktlen); 1313 sldns_buffer_clear(buf); 1314 1315 /* decompress dname */ 1316 sldns_buffer_set_position(&pktbuf, 1317 (size_t)(dname - sldns_buffer_current(&pktbuf))); 1318 dname_len = pkt_dname_len(&pktbuf); 1319 if(dname_len == 0) return 0; /* parse fail on dname */ 1320 if(!sldns_buffer_available(buf, dname_len)) return 0; 1321 dname_pkt_copy(&pktbuf, sldns_buffer_current(buf), dname); 1322 sldns_buffer_skip(buf, (ssize_t)dname_len); 1323 1324 /* type, class, ttl and rdatalength fields */ 1325 if(!sldns_buffer_available(buf, 10)) return 0; 1326 sldns_buffer_write_u16(buf, rr_type); 1327 sldns_buffer_write_u16(buf, rr_class); 1328 sldns_buffer_write_u32(buf, rr_ttl); 1329 rdlenpos = sldns_buffer_position(buf); 1330 sldns_buffer_write_u16(buf, 0); /* rd length position */ 1331 1332 /* decompress rdata */ 1333 desc = sldns_rr_descript(rr_type); 1334 rd = rr_data; 1335 rdlen = rr_rdlen; 1336 if(rdlen > 0 && desc && desc->_dname_count > 0) { 1337 int count = (int)desc->_dname_count; 1338 int rdf = 0; 1339 size_t len; /* how much rdata to plain copy */ 1340 size_t uncompressed_len, compressed_len; 1341 size_t oldpos; 1342 /* decompress dnames. */ 1343 while(rdlen > 0 && count) { 1344 switch(desc->_wireformat[rdf]) { 1345 case LDNS_RDF_TYPE_DNAME: 1346 sldns_buffer_set_position(&pktbuf, 1347 (size_t)(rd - 1348 sldns_buffer_begin(&pktbuf))); 1349 oldpos = sldns_buffer_position(&pktbuf); 1350 /* moves pktbuf to right after the 1351 * compressed dname, and returns uncompressed 1352 * dname length */ 1353 uncompressed_len = pkt_dname_len(&pktbuf); 1354 if(!uncompressed_len) 1355 return 0; /* parse error in dname */ 1356 if(!sldns_buffer_available(buf, 1357 uncompressed_len)) 1358 /* dname too long for buffer */ 1359 return 0; 1360 dname_pkt_copy(&pktbuf, 1361 sldns_buffer_current(buf), rd); 1362 sldns_buffer_skip(buf, (ssize_t)uncompressed_len); 1363 compressed_len = sldns_buffer_position( 1364 &pktbuf) - oldpos; 1365 rd += compressed_len; 1366 rdlen -= compressed_len; 1367 count--; 1368 len = 0; 1369 break; 1370 case LDNS_RDF_TYPE_STR: 1371 len = rd[0] + 1; 1372 break; 1373 default: 1374 len = get_rdf_size(desc->_wireformat[rdf]); 1375 break; 1376 } 1377 if(len) { 1378 if(!sldns_buffer_available(buf, len)) 1379 return 0; /* too long for buffer */ 1380 sldns_buffer_write(buf, rd, len); 1381 rd += len; 1382 rdlen -= len; 1383 } 1384 rdf++; 1385 } 1386 } 1387 /* copy remaining data */ 1388 if(rdlen > 0) { 1389 if(!sldns_buffer_available(buf, rdlen)) return 0; 1390 sldns_buffer_write(buf, rd, rdlen); 1391 } 1392 /* fixup rdlength */ 1393 sldns_buffer_write_u16_at(buf, rdlenpos, 1394 sldns_buffer_position(buf)-rdlenpos-2); 1395 sldns_buffer_flip(buf); 1396 return 1; 1397 } 1398 1399 /** insert RR into zone, from packet, decompress RR, 1400 * if duplicate is nonNULL set the flag but otherwise ignore duplicates */ 1401 static int 1402 az_insert_rr_decompress(struct auth_zone* z, uint8_t* pkt, size_t pktlen, 1403 struct sldns_buffer* scratch_buffer, uint8_t* dname, uint16_t rr_type, 1404 uint16_t rr_class, uint32_t rr_ttl, uint8_t* rr_data, 1405 uint16_t rr_rdlen, int* duplicate) 1406 { 1407 uint8_t* rr; 1408 size_t rr_len; 1409 size_t dname_len; 1410 if(!decompress_rr_into_buffer(scratch_buffer, pkt, pktlen, dname, 1411 rr_type, rr_class, rr_ttl, rr_data, rr_rdlen)) { 1412 log_err("could not decompress RR"); 1413 return 0; 1414 } 1415 rr = sldns_buffer_begin(scratch_buffer); 1416 rr_len = sldns_buffer_limit(scratch_buffer); 1417 dname_len = dname_valid(rr, rr_len); 1418 return az_insert_rr(z, rr, rr_len, dname_len, duplicate); 1419 } 1420 1421 /** remove RR from zone, from packet, decompress RR, 1422 * if nonexist is nonNULL set the flag but otherwise ignore nonexisting entries*/ 1423 static int 1424 az_remove_rr_decompress(struct auth_zone* z, uint8_t* pkt, size_t pktlen, 1425 struct sldns_buffer* scratch_buffer, uint8_t* dname, uint16_t rr_type, 1426 uint16_t rr_class, uint32_t rr_ttl, uint8_t* rr_data, 1427 uint16_t rr_rdlen, int* nonexist) 1428 { 1429 uint8_t* rr; 1430 size_t rr_len; 1431 size_t dname_len; 1432 if(!decompress_rr_into_buffer(scratch_buffer, pkt, pktlen, dname, 1433 rr_type, rr_class, rr_ttl, rr_data, rr_rdlen)) { 1434 log_err("could not decompress RR"); 1435 return 0; 1436 } 1437 rr = sldns_buffer_begin(scratch_buffer); 1438 rr_len = sldns_buffer_limit(scratch_buffer); 1439 dname_len = dname_valid(rr, rr_len); 1440 return az_remove_rr(z, rr, rr_len, dname_len, nonexist); 1441 } 1442 1443 /** 1444 * Parse zonefile 1445 * @param z: zone to read in. 1446 * @param in: file to read from (just opened). 1447 * @param rr: buffer to use for RRs, 64k. 1448 * passed so that recursive includes can use the same buffer and do 1449 * not grow the stack too much. 1450 * @param rrbuflen: sizeof rr buffer. 1451 * @param state: parse state with $ORIGIN, $TTL and 'prev-dname' and so on, 1452 * that is kept between includes. 1453 * The lineno is set at 1 and then increased by the function. 1454 * @param fname: file name. 1455 * @param depth: recursion depth for includes 1456 * @param cfg: config for chroot. 1457 * returns false on failure, has printed an error message 1458 */ 1459 static int 1460 az_parse_file(struct auth_zone* z, FILE* in, uint8_t* rr, size_t rrbuflen, 1461 struct sldns_file_parse_state* state, char* fname, int depth, 1462 struct config_file* cfg) 1463 { 1464 size_t rr_len, dname_len; 1465 int status; 1466 state->lineno = 1; 1467 1468 while(!feof(in)) { 1469 rr_len = rrbuflen; 1470 dname_len = 0; 1471 status = sldns_fp2wire_rr_buf(in, rr, &rr_len, &dname_len, 1472 state); 1473 if(status == LDNS_WIREPARSE_ERR_INCLUDE && rr_len == 0) { 1474 /* we have $INCLUDE or $something */ 1475 if(strncmp((char*)rr, "$INCLUDE ", 9) == 0 || 1476 strncmp((char*)rr, "$INCLUDE\t", 9) == 0) { 1477 FILE* inc; 1478 int lineno_orig = state->lineno; 1479 char* incfile = (char*)rr + 8; 1480 if(depth > MAX_INCLUDE_DEPTH) { 1481 log_err("%s:%d max include depth" 1482 "exceeded", fname, state->lineno); 1483 return 0; 1484 } 1485 /* skip spaces */ 1486 while(*incfile == ' ' || *incfile == '\t') 1487 incfile++; 1488 /* adjust for chroot on include file */ 1489 if(cfg->chrootdir && cfg->chrootdir[0] && 1490 strncmp(incfile, cfg->chrootdir, 1491 strlen(cfg->chrootdir)) == 0) 1492 incfile += strlen(cfg->chrootdir); 1493 incfile = strdup(incfile); 1494 if(!incfile) { 1495 log_err("malloc failure"); 1496 return 0; 1497 } 1498 verbose(VERB_ALGO, "opening $INCLUDE %s", 1499 incfile); 1500 inc = fopen(incfile, "r"); 1501 if(!inc) { 1502 log_err("%s:%d cannot open include " 1503 "file %s: %s", fname, 1504 lineno_orig, incfile, 1505 strerror(errno)); 1506 free(incfile); 1507 return 0; 1508 } 1509 /* recurse read that file now */ 1510 if(!az_parse_file(z, inc, rr, rrbuflen, 1511 state, incfile, depth+1, cfg)) { 1512 log_err("%s:%d cannot parse include " 1513 "file %s", fname, 1514 lineno_orig, incfile); 1515 fclose(inc); 1516 free(incfile); 1517 return 0; 1518 } 1519 fclose(inc); 1520 verbose(VERB_ALGO, "done with $INCLUDE %s", 1521 incfile); 1522 free(incfile); 1523 state->lineno = lineno_orig; 1524 } 1525 continue; 1526 } 1527 if(status != 0) { 1528 log_err("parse error %s %d:%d: %s", fname, 1529 state->lineno, LDNS_WIREPARSE_OFFSET(status), 1530 sldns_get_errorstr_parse(status)); 1531 return 0; 1532 } 1533 if(rr_len == 0) { 1534 /* EMPTY line, TTL or ORIGIN */ 1535 continue; 1536 } 1537 /* insert wirerr in rrbuf */ 1538 if(!az_insert_rr(z, rr, rr_len, dname_len, NULL)) { 1539 char buf[17]; 1540 sldns_wire2str_type_buf(sldns_wirerr_get_type(rr, 1541 rr_len, dname_len), buf, sizeof(buf)); 1542 log_err("%s:%d cannot insert RR of type %s", 1543 fname, state->lineno, buf); 1544 return 0; 1545 } 1546 } 1547 return 1; 1548 } 1549 1550 int 1551 auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg) 1552 { 1553 uint8_t rr[LDNS_RR_BUF_SIZE]; 1554 struct sldns_file_parse_state state; 1555 char* zfilename; 1556 FILE* in; 1557 if(!z || !z->zonefile || z->zonefile[0]==0) 1558 return 1; /* no file, or "", nothing to read */ 1559 1560 zfilename = z->zonefile; 1561 if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(zfilename, 1562 cfg->chrootdir, strlen(cfg->chrootdir)) == 0) 1563 zfilename += strlen(cfg->chrootdir); 1564 if(verbosity >= VERB_ALGO) { 1565 char nm[255+1]; 1566 dname_str(z->name, nm); 1567 verbose(VERB_ALGO, "read zonefile %s for %s", zfilename, nm); 1568 } 1569 in = fopen(zfilename, "r"); 1570 if(!in) { 1571 char* n = sldns_wire2str_dname(z->name, z->namelen); 1572 if(z->zone_is_slave && errno == ENOENT) { 1573 /* we fetch the zone contents later, no file yet */ 1574 verbose(VERB_ALGO, "no zonefile %s for %s", 1575 zfilename, n?n:"error"); 1576 free(n); 1577 return 1; 1578 } 1579 log_err("cannot open zonefile %s for %s: %s", 1580 zfilename, n?n:"error", strerror(errno)); 1581 free(n); 1582 return 0; 1583 } 1584 1585 /* clear the data tree */ 1586 traverse_postorder(&z->data, auth_data_del, NULL); 1587 rbtree_init(&z->data, &auth_data_cmp); 1588 1589 memset(&state, 0, sizeof(state)); 1590 /* default TTL to 3600 */ 1591 state.default_ttl = 3600; 1592 /* set $ORIGIN to the zone name */ 1593 if(z->namelen <= sizeof(state.origin)) { 1594 memcpy(state.origin, z->name, z->namelen); 1595 state.origin_len = z->namelen; 1596 } 1597 /* parse the (toplevel) file */ 1598 if(!az_parse_file(z, in, rr, sizeof(rr), &state, zfilename, 0, cfg)) { 1599 char* n = sldns_wire2str_dname(z->name, z->namelen); 1600 log_err("error parsing zonefile %s for %s", 1601 zfilename, n?n:"error"); 1602 free(n); 1603 fclose(in); 1604 return 0; 1605 } 1606 fclose(in); 1607 return 1; 1608 } 1609 1610 /** write buffer to file and check return codes */ 1611 static int 1612 write_out(FILE* out, const char* str, size_t len) 1613 { 1614 size_t r; 1615 if(len == 0) 1616 return 1; 1617 r = fwrite(str, 1, len, out); 1618 if(r == 0) { 1619 log_err("write failed: %s", strerror(errno)); 1620 return 0; 1621 } else if(r < len) { 1622 log_err("write failed: too short (disk full?)"); 1623 return 0; 1624 } 1625 return 1; 1626 } 1627 1628 /** convert auth rr to string */ 1629 static int 1630 auth_rr_to_string(uint8_t* nm, size_t nmlen, uint16_t tp, uint16_t cl, 1631 struct packed_rrset_data* data, size_t i, char* s, size_t buflen) 1632 { 1633 int w = 0; 1634 size_t slen = buflen, datlen; 1635 uint8_t* dat; 1636 if(i >= data->count) tp = LDNS_RR_TYPE_RRSIG; 1637 dat = nm; 1638 datlen = nmlen; 1639 w += sldns_wire2str_dname_scan(&dat, &datlen, &s, &slen, NULL, 0, NULL); 1640 w += sldns_str_print(&s, &slen, "\t"); 1641 w += sldns_str_print(&s, &slen, "%lu\t", (unsigned long)data->rr_ttl[i]); 1642 w += sldns_wire2str_class_print(&s, &slen, cl); 1643 w += sldns_str_print(&s, &slen, "\t"); 1644 w += sldns_wire2str_type_print(&s, &slen, tp); 1645 w += sldns_str_print(&s, &slen, "\t"); 1646 datlen = data->rr_len[i]-2; 1647 dat = data->rr_data[i]+2; 1648 w += sldns_wire2str_rdata_scan(&dat, &datlen, &s, &slen, tp, NULL, 0, NULL); 1649 1650 if(tp == LDNS_RR_TYPE_DNSKEY) { 1651 w += sldns_str_print(&s, &slen, " ;{id = %u}", 1652 sldns_calc_keytag_raw(data->rr_data[i]+2, 1653 data->rr_len[i]-2)); 1654 } 1655 w += sldns_str_print(&s, &slen, "\n"); 1656 1657 if(w >= (int)buflen) { 1658 log_nametypeclass(NO_VERBOSE, "RR too long to print", nm, tp, cl); 1659 return 0; 1660 } 1661 return 1; 1662 } 1663 1664 /** write rrset to file */ 1665 static int 1666 auth_zone_write_rrset(struct auth_zone* z, struct auth_data* node, 1667 struct auth_rrset* r, FILE* out) 1668 { 1669 size_t i, count = r->data->count + r->data->rrsig_count; 1670 char buf[LDNS_RR_BUF_SIZE]; 1671 for(i=0; i<count; i++) { 1672 if(!auth_rr_to_string(node->name, node->namelen, r->type, 1673 z->dclass, r->data, i, buf, sizeof(buf))) { 1674 verbose(VERB_ALGO, "failed to rr2str rr %d", (int)i); 1675 continue; 1676 } 1677 if(!write_out(out, buf, strlen(buf))) 1678 return 0; 1679 } 1680 return 1; 1681 } 1682 1683 /** write domain to file */ 1684 static int 1685 auth_zone_write_domain(struct auth_zone* z, struct auth_data* n, FILE* out) 1686 { 1687 struct auth_rrset* r; 1688 /* if this is zone apex, write SOA first */ 1689 if(z->namelen == n->namelen) { 1690 struct auth_rrset* soa = az_domain_rrset(n, LDNS_RR_TYPE_SOA); 1691 if(soa) { 1692 if(!auth_zone_write_rrset(z, n, soa, out)) 1693 return 0; 1694 } 1695 } 1696 /* write all the RRsets for this domain */ 1697 for(r = n->rrsets; r; r = r->next) { 1698 if(z->namelen == n->namelen && 1699 r->type == LDNS_RR_TYPE_SOA) 1700 continue; /* skip SOA here */ 1701 if(!auth_zone_write_rrset(z, n, r, out)) 1702 return 0; 1703 } 1704 return 1; 1705 } 1706 1707 int auth_zone_write_file(struct auth_zone* z, const char* fname) 1708 { 1709 FILE* out; 1710 struct auth_data* n; 1711 out = fopen(fname, "w"); 1712 if(!out) { 1713 log_err("could not open %s: %s", fname, strerror(errno)); 1714 return 0; 1715 } 1716 RBTREE_FOR(n, struct auth_data*, &z->data) { 1717 if(!auth_zone_write_domain(z, n, out)) { 1718 log_err("could not write domain to %s", fname); 1719 fclose(out); 1720 return 0; 1721 } 1722 } 1723 fclose(out); 1724 return 1; 1725 } 1726 1727 /** read all auth zones from file (if they have) */ 1728 static int 1729 auth_zones_read_zones(struct auth_zones* az, struct config_file* cfg) 1730 { 1731 struct auth_zone* z; 1732 lock_rw_wrlock(&az->lock); 1733 RBTREE_FOR(z, struct auth_zone*, &az->ztree) { 1734 lock_rw_wrlock(&z->lock); 1735 if(!auth_zone_read_zonefile(z, cfg)) { 1736 lock_rw_unlock(&z->lock); 1737 lock_rw_unlock(&az->lock); 1738 return 0; 1739 } 1740 lock_rw_unlock(&z->lock); 1741 } 1742 lock_rw_unlock(&az->lock); 1743 return 1; 1744 } 1745 1746 /** find serial number of zone or false if none */ 1747 int 1748 auth_zone_get_serial(struct auth_zone* z, uint32_t* serial) 1749 { 1750 struct auth_data* apex; 1751 struct auth_rrset* soa; 1752 struct packed_rrset_data* d; 1753 apex = az_find_name(z, z->name, z->namelen); 1754 if(!apex) return 0; 1755 soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA); 1756 if(!soa || soa->data->count==0) 1757 return 0; /* no RRset or no RRs in rrset */ 1758 if(soa->data->rr_len[0] < 2+4*5) return 0; /* SOA too short */ 1759 d = soa->data; 1760 *serial = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-20)); 1761 return 1; 1762 } 1763 1764 /** Find auth_zone SOA and populate the values in xfr(soa values). */ 1765 static int 1766 xfr_find_soa(struct auth_zone* z, struct auth_xfer* xfr) 1767 { 1768 struct auth_data* apex; 1769 struct auth_rrset* soa; 1770 struct packed_rrset_data* d; 1771 apex = az_find_name(z, z->name, z->namelen); 1772 if(!apex) return 0; 1773 soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA); 1774 if(!soa || soa->data->count==0) 1775 return 0; /* no RRset or no RRs in rrset */ 1776 if(soa->data->rr_len[0] < 2+4*5) return 0; /* SOA too short */ 1777 /* SOA record ends with serial, refresh, retry, expiry, minimum, 1778 * as 4 byte fields */ 1779 d = soa->data; 1780 xfr->have_zone = 1; 1781 xfr->serial = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-20)); 1782 xfr->refresh = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-16)); 1783 xfr->retry = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-12)); 1784 xfr->expiry = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-8)); 1785 /* soa minimum at d->rr_len[0]-4 */ 1786 return 1; 1787 } 1788 1789 /** 1790 * Setup auth_xfer zone 1791 * This populates the have_zone, soa values, and so on times. 1792 * Doesn't do network traffic yet, can set option flags. 1793 * @param z: locked by caller, and modified for setup 1794 * @param x: locked by caller, and modified. 1795 * @return false on failure. 1796 */ 1797 static int 1798 auth_xfer_setup(struct auth_zone* z, struct auth_xfer* x) 1799 { 1800 /* for a zone without zone transfers, x==NULL, so skip them, 1801 * i.e. the zone config is fixed with no masters or urls */ 1802 if(!z || !x) return 1; 1803 if(!xfr_find_soa(z, x)) { 1804 return 1; 1805 } 1806 /* nothing for probe, nextprobe and transfer tasks */ 1807 return 1; 1808 } 1809 1810 /** 1811 * Setup all zones 1812 * @param az: auth zones structure 1813 * @return false on failure. 1814 */ 1815 static int 1816 auth_zones_setup_zones(struct auth_zones* az) 1817 { 1818 struct auth_zone* z; 1819 struct auth_xfer* x; 1820 lock_rw_wrlock(&az->lock); 1821 RBTREE_FOR(z, struct auth_zone*, &az->ztree) { 1822 lock_rw_wrlock(&z->lock); 1823 x = auth_xfer_find(az, z->name, z->namelen, z->dclass); 1824 if(x) { 1825 lock_basic_lock(&x->lock); 1826 } 1827 if(!auth_xfer_setup(z, x)) { 1828 if(x) { 1829 lock_basic_unlock(&x->lock); 1830 } 1831 lock_rw_unlock(&z->lock); 1832 lock_rw_unlock(&az->lock); 1833 return 0; 1834 } 1835 if(x) { 1836 lock_basic_unlock(&x->lock); 1837 } 1838 lock_rw_unlock(&z->lock); 1839 } 1840 lock_rw_unlock(&az->lock); 1841 return 1; 1842 } 1843 1844 /** set config items and create zones */ 1845 static int 1846 auth_zones_cfg(struct auth_zones* az, struct config_auth* c) 1847 { 1848 struct auth_zone* z; 1849 struct auth_xfer* x = NULL; 1850 1851 /* create zone */ 1852 lock_rw_wrlock(&az->lock); 1853 if(!(z=auth_zones_find_or_add_zone(az, c->name))) { 1854 lock_rw_unlock(&az->lock); 1855 return 0; 1856 } 1857 if(c->masters || c->urls) { 1858 if(!(x=auth_zones_find_or_add_xfer(az, z))) { 1859 lock_rw_unlock(&az->lock); 1860 lock_rw_unlock(&z->lock); 1861 return 0; 1862 } 1863 } 1864 if(c->for_downstream) 1865 az->have_downstream = 1; 1866 lock_rw_unlock(&az->lock); 1867 1868 /* set options */ 1869 z->zone_deleted = 0; 1870 if(!auth_zone_set_zonefile(z, c->zonefile)) { 1871 if(x) { 1872 lock_basic_unlock(&x->lock); 1873 } 1874 lock_rw_unlock(&z->lock); 1875 return 0; 1876 } 1877 z->for_downstream = c->for_downstream; 1878 z->for_upstream = c->for_upstream; 1879 z->fallback_enabled = c->fallback_enabled; 1880 1881 /* xfer zone */ 1882 if(x) { 1883 z->zone_is_slave = 1; 1884 /* set options on xfer zone */ 1885 if(!xfer_set_masters(&x->task_probe->masters, c, 0)) { 1886 lock_basic_unlock(&x->lock); 1887 lock_rw_unlock(&z->lock); 1888 return 0; 1889 } 1890 if(!xfer_set_masters(&x->task_transfer->masters, c, 1)) { 1891 lock_basic_unlock(&x->lock); 1892 lock_rw_unlock(&z->lock); 1893 return 0; 1894 } 1895 lock_basic_unlock(&x->lock); 1896 } 1897 1898 lock_rw_unlock(&z->lock); 1899 return 1; 1900 } 1901 1902 /** set all auth zones deleted, then in auth_zones_cfg, it marks them 1903 * as nondeleted (if they are still in the config), and then later 1904 * we can find deleted zones */ 1905 static void 1906 az_setall_deleted(struct auth_zones* az) 1907 { 1908 struct auth_zone* z; 1909 lock_rw_wrlock(&az->lock); 1910 RBTREE_FOR(z, struct auth_zone*, &az->ztree) { 1911 lock_rw_wrlock(&z->lock); 1912 z->zone_deleted = 1; 1913 lock_rw_unlock(&z->lock); 1914 } 1915 lock_rw_unlock(&az->lock); 1916 } 1917 1918 /** find zones that are marked deleted and delete them. 1919 * This is called from apply_cfg, and there are no threads and no 1920 * workers, so the xfr can just be deleted. */ 1921 static void 1922 az_delete_deleted_zones(struct auth_zones* az) 1923 { 1924 struct auth_zone* z; 1925 struct auth_zone* delete_list = NULL, *next; 1926 struct auth_xfer* xfr; 1927 lock_rw_wrlock(&az->lock); 1928 RBTREE_FOR(z, struct auth_zone*, &az->ztree) { 1929 lock_rw_wrlock(&z->lock); 1930 if(z->zone_deleted) { 1931 /* we cannot alter the rbtree right now, but 1932 * we can put it on a linked list and then 1933 * delete it */ 1934 z->delete_next = delete_list; 1935 delete_list = z; 1936 } 1937 lock_rw_unlock(&z->lock); 1938 } 1939 /* now we are out of the tree loop and we can loop and delete 1940 * the zones */ 1941 z = delete_list; 1942 while(z) { 1943 next = z->delete_next; 1944 xfr = auth_xfer_find(az, z->name, z->namelen, z->dclass); 1945 if(xfr) { 1946 (void)rbtree_delete(&az->xtree, &xfr->node); 1947 auth_xfer_delete(xfr); 1948 } 1949 (void)rbtree_delete(&az->ztree, &z->node); 1950 auth_zone_delete(z); 1951 z = next; 1952 } 1953 lock_rw_unlock(&az->lock); 1954 } 1955 1956 int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg, 1957 int setup) 1958 { 1959 struct config_auth* p; 1960 az_setall_deleted(az); 1961 for(p = cfg->auths; p; p = p->next) { 1962 if(!p->name || p->name[0] == 0) { 1963 log_warn("auth-zone without a name, skipped"); 1964 continue; 1965 } 1966 if(!auth_zones_cfg(az, p)) { 1967 log_err("cannot config auth zone %s", p->name); 1968 return 0; 1969 } 1970 } 1971 az_delete_deleted_zones(az); 1972 if(!auth_zones_read_zones(az, cfg)) 1973 return 0; 1974 if(setup) { 1975 if(!auth_zones_setup_zones(az)) 1976 return 0; 1977 } 1978 return 1; 1979 } 1980 1981 /** delete chunks 1982 * @param at: transfer structure with chunks list. The chunks and their 1983 * data are freed. 1984 */ 1985 static void 1986 auth_chunks_delete(struct auth_transfer* at) 1987 { 1988 if(at->chunks_first) { 1989 struct auth_chunk* c, *cn; 1990 c = at->chunks_first; 1991 while(c) { 1992 cn = c->next; 1993 free(c->data); 1994 free(c); 1995 c = cn; 1996 } 1997 } 1998 at->chunks_first = NULL; 1999 at->chunks_last = NULL; 2000 } 2001 2002 /** free master addr list */ 2003 static void 2004 auth_free_master_addrs(struct auth_addr* list) 2005 { 2006 struct auth_addr *n; 2007 while(list) { 2008 n = list->next; 2009 free(list); 2010 list = n; 2011 } 2012 } 2013 2014 /** free the masters list */ 2015 static void 2016 auth_free_masters(struct auth_master* list) 2017 { 2018 struct auth_master* n; 2019 while(list) { 2020 n = list->next; 2021 auth_free_master_addrs(list->list); 2022 free(list->host); 2023 free(list->file); 2024 free(list); 2025 list = n; 2026 } 2027 } 2028 2029 /** delete auth xfer structure 2030 * @param xfr: delete this xfer and its tasks. 2031 */ 2032 static void 2033 auth_xfer_delete(struct auth_xfer* xfr) 2034 { 2035 if(!xfr) return; 2036 lock_basic_destroy(&xfr->lock); 2037 free(xfr->name); 2038 if(xfr->task_nextprobe) { 2039 comm_timer_delete(xfr->task_nextprobe->timer); 2040 free(xfr->task_nextprobe); 2041 } 2042 if(xfr->task_probe) { 2043 auth_free_masters(xfr->task_probe->masters); 2044 comm_point_delete(xfr->task_probe->cp); 2045 comm_timer_delete(xfr->task_probe->timer); 2046 free(xfr->task_probe); 2047 } 2048 if(xfr->task_transfer) { 2049 auth_free_masters(xfr->task_transfer->masters); 2050 comm_point_delete(xfr->task_transfer->cp); 2051 comm_timer_delete(xfr->task_transfer->timer); 2052 if(xfr->task_transfer->chunks_first) { 2053 auth_chunks_delete(xfr->task_transfer); 2054 } 2055 free(xfr->task_transfer); 2056 } 2057 auth_free_masters(xfr->allow_notify_list); 2058 free(xfr); 2059 } 2060 2061 /** helper traverse to delete zones */ 2062 static void 2063 auth_zone_del(rbnode_type* n, void* ATTR_UNUSED(arg)) 2064 { 2065 struct auth_zone* z = (struct auth_zone*)n->key; 2066 auth_zone_delete(z); 2067 } 2068 2069 /** helper traverse to delete xfer zones */ 2070 static void 2071 auth_xfer_del(rbnode_type* n, void* ATTR_UNUSED(arg)) 2072 { 2073 struct auth_xfer* z = (struct auth_xfer*)n->key; 2074 auth_xfer_delete(z); 2075 } 2076 2077 void auth_zones_delete(struct auth_zones* az) 2078 { 2079 if(!az) return; 2080 lock_rw_destroy(&az->lock); 2081 traverse_postorder(&az->ztree, auth_zone_del, NULL); 2082 traverse_postorder(&az->xtree, auth_xfer_del, NULL); 2083 free(az); 2084 } 2085 2086 /** true if domain has only nsec3 */ 2087 static int 2088 domain_has_only_nsec3(struct auth_data* n) 2089 { 2090 struct auth_rrset* rrset = n->rrsets; 2091 int nsec3_seen = 0; 2092 while(rrset) { 2093 if(rrset->type == LDNS_RR_TYPE_NSEC3) { 2094 nsec3_seen = 1; 2095 } else if(rrset->type != LDNS_RR_TYPE_RRSIG) { 2096 return 0; 2097 } 2098 rrset = rrset->next; 2099 } 2100 return nsec3_seen; 2101 } 2102 2103 /** see if the domain has a wildcard child '*.domain' */ 2104 static struct auth_data* 2105 az_find_wildcard_domain(struct auth_zone* z, uint8_t* nm, size_t nmlen) 2106 { 2107 uint8_t wc[LDNS_MAX_DOMAINLEN]; 2108 if(nmlen+2 > sizeof(wc)) 2109 return NULL; /* result would be too long */ 2110 wc[0] = 1; /* length of wildcard label */ 2111 wc[1] = (uint8_t)'*'; /* wildcard label */ 2112 memmove(wc+2, nm, nmlen); 2113 return az_find_name(z, wc, nmlen+2); 2114 } 2115 2116 /** find wildcard between qname and cename */ 2117 static struct auth_data* 2118 az_find_wildcard(struct auth_zone* z, struct query_info* qinfo, 2119 struct auth_data* ce) 2120 { 2121 uint8_t* nm = qinfo->qname; 2122 size_t nmlen = qinfo->qname_len; 2123 struct auth_data* node; 2124 if(!dname_subdomain_c(nm, z->name)) 2125 return NULL; /* out of zone */ 2126 while((node=az_find_wildcard_domain(z, nm, nmlen))==NULL) { 2127 /* see if we can go up to find the wildcard */ 2128 if(nmlen == z->namelen) 2129 return NULL; /* top of zone reached */ 2130 if(ce && nmlen == ce->namelen) 2131 return NULL; /* ce reached */ 2132 if(dname_is_root(nm)) 2133 return NULL; /* cannot go up */ 2134 dname_remove_label(&nm, &nmlen); 2135 } 2136 return node; 2137 } 2138 2139 /** domain is not exact, find first candidate ce (name that matches 2140 * a part of qname) in tree */ 2141 static struct auth_data* 2142 az_find_candidate_ce(struct auth_zone* z, struct query_info* qinfo, 2143 struct auth_data* n) 2144 { 2145 uint8_t* nm; 2146 size_t nmlen; 2147 if(n) { 2148 nm = dname_get_shared_topdomain(qinfo->qname, n->name); 2149 } else { 2150 nm = qinfo->qname; 2151 } 2152 dname_count_size_labels(nm, &nmlen); 2153 n = az_find_name(z, nm, nmlen); 2154 /* delete labels and go up on name */ 2155 while(!n) { 2156 if(dname_is_root(nm)) 2157 return NULL; /* cannot go up */ 2158 dname_remove_label(&nm, &nmlen); 2159 n = az_find_name(z, nm, nmlen); 2160 } 2161 return n; 2162 } 2163 2164 /** go up the auth tree to next existing name. */ 2165 static struct auth_data* 2166 az_domain_go_up(struct auth_zone* z, struct auth_data* n) 2167 { 2168 uint8_t* nm = n->name; 2169 size_t nmlen = n->namelen; 2170 while(!dname_is_root(nm)) { 2171 dname_remove_label(&nm, &nmlen); 2172 if((n=az_find_name(z, nm, nmlen)) != NULL) 2173 return n; 2174 } 2175 return NULL; 2176 } 2177 2178 /** Find the closest encloser, an name that exists and is above the 2179 * qname. 2180 * return true if the node (param node) is existing, nonobscured and 2181 * can be used to generate answers from. It is then also node_exact. 2182 * returns false if the node is not good enough (or it wasn't node_exact) 2183 * in this case the ce can be filled. 2184 * if ce is NULL, no ce exists, and likely the zone is completely empty, 2185 * not even with a zone apex. 2186 * if ce is nonNULL it is the closest enclosing upper name (that exists 2187 * itself for answer purposes). That name may have DNAME, NS or wildcard 2188 * rrset is the closest DNAME or NS rrset that was found. 2189 */ 2190 static int 2191 az_find_ce(struct auth_zone* z, struct query_info* qinfo, 2192 struct auth_data* node, int node_exact, struct auth_data** ce, 2193 struct auth_rrset** rrset) 2194 { 2195 struct auth_data* n = node; 2196 *ce = NULL; 2197 *rrset = NULL; 2198 if(!node_exact) { 2199 /* if not exact, lookup closest exact match */ 2200 n = az_find_candidate_ce(z, qinfo, n); 2201 } else { 2202 /* if exact, the node itself is the first candidate ce */ 2203 *ce = n; 2204 } 2205 2206 /* no direct answer from nsec3-only domains */ 2207 if(n && domain_has_only_nsec3(n)) { 2208 node_exact = 0; 2209 *ce = NULL; 2210 } 2211 2212 /* with exact matches, walk up the labels until we find the 2213 * delegation, or DNAME or zone end */ 2214 while(n) { 2215 /* see if the current candidate has issues */ 2216 /* not zone apex and has type NS */ 2217 if(n->namelen != z->namelen && 2218 (*rrset=az_domain_rrset(n, LDNS_RR_TYPE_NS)) && 2219 /* delegate here, but DS at exact the dp has notype */ 2220 (qinfo->qtype != LDNS_RR_TYPE_DS || 2221 n->namelen != qinfo->qname_len)) { 2222 /* referral */ 2223 /* this is ce and the lowernode is nonexisting */ 2224 *ce = n; 2225 return 0; 2226 } 2227 /* not equal to qname and has type DNAME */ 2228 if(n->namelen != qinfo->qname_len && 2229 (*rrset=az_domain_rrset(n, LDNS_RR_TYPE_DNAME))) { 2230 /* this is ce and the lowernode is nonexisting */ 2231 *ce = n; 2232 return 0; 2233 } 2234 2235 if(*ce == NULL && !domain_has_only_nsec3(n)) { 2236 /* if not found yet, this exact name must be 2237 * our lowest match (but not nsec3onlydomain) */ 2238 *ce = n; 2239 } 2240 2241 /* walk up the tree by removing labels from name and lookup */ 2242 n = az_domain_go_up(z, n); 2243 } 2244 /* found no problems, if it was an exact node, it is fine to use */ 2245 return node_exact; 2246 } 2247 2248 /** add additional A/AAAA from domain names in rrset rdata (+offset) 2249 * offset is number of bytes in rdata where the dname is located. */ 2250 static int 2251 az_add_additionals_from(struct auth_zone* z, struct regional* region, 2252 struct dns_msg* msg, struct auth_rrset* rrset, size_t offset) 2253 { 2254 struct packed_rrset_data* d = rrset->data; 2255 size_t i; 2256 if(!d) return 0; 2257 for(i=0; i<d->count; i++) { 2258 size_t dlen; 2259 struct auth_data* domain; 2260 struct auth_rrset* ref; 2261 if(d->rr_len[i] < 2+offset) 2262 continue; /* too short */ 2263 if(!(dlen = dname_valid(d->rr_data[i]+2+offset, 2264 d->rr_len[i]-2-offset))) 2265 continue; /* malformed */ 2266 domain = az_find_name(z, d->rr_data[i]+2+offset, dlen); 2267 if(!domain) 2268 continue; 2269 if((ref=az_domain_rrset(domain, LDNS_RR_TYPE_A)) != NULL) { 2270 if(!msg_add_rrset_ar(z, region, msg, domain, ref)) 2271 return 0; 2272 } 2273 if((ref=az_domain_rrset(domain, LDNS_RR_TYPE_AAAA)) != NULL) { 2274 if(!msg_add_rrset_ar(z, region, msg, domain, ref)) 2275 return 0; 2276 } 2277 } 2278 return 1; 2279 } 2280 2281 /** add negative SOA record (with negative TTL) */ 2282 static int 2283 az_add_negative_soa(struct auth_zone* z, struct regional* region, 2284 struct dns_msg* msg) 2285 { 2286 uint32_t minimum; 2287 struct packed_rrset_data* d; 2288 struct auth_rrset* soa; 2289 struct auth_data* apex = az_find_name(z, z->name, z->namelen); 2290 if(!apex) return 0; 2291 soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA); 2292 if(!soa) return 0; 2293 /* must be first to put in message; we want to fix the TTL with 2294 * one RRset here, otherwise we'd need to loop over the RRs to get 2295 * the resulting lower TTL */ 2296 log_assert(msg->rep->rrset_count == 0); 2297 if(!msg_add_rrset_ns(z, region, msg, apex, soa)) return 0; 2298 /* fixup TTL */ 2299 d = (struct packed_rrset_data*)msg->rep->rrsets[msg->rep->rrset_count-1]->entry.data; 2300 /* last 4 bytes are minimum ttl in network format */ 2301 if(d->count == 0) return 0; 2302 if(d->rr_len[0] < 2+4) return 0; 2303 minimum = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-4)); 2304 d->ttl = (time_t)minimum; 2305 d->rr_ttl[0] = (time_t)minimum; 2306 msg->rep->ttl = get_rrset_ttl(msg->rep->rrsets[0]); 2307 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 2308 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 2309 return 1; 2310 } 2311 2312 /** See if the query goes to empty nonterminal (that has no auth_data, 2313 * but there are nodes underneath. We already checked that there are 2314 * not NS, or DNAME above, so that we only need to check if some node 2315 * exists below (with nonempty rr list), return true if emptynonterminal */ 2316 static int 2317 az_empty_nonterminal(struct auth_zone* z, struct query_info* qinfo, 2318 struct auth_data* node) 2319 { 2320 struct auth_data* next; 2321 if(!node) { 2322 /* no smaller was found, use first (smallest) node as the 2323 * next one */ 2324 next = (struct auth_data*)rbtree_first(&z->data); 2325 } else { 2326 next = (struct auth_data*)rbtree_next(&node->node); 2327 } 2328 while(next && (rbnode_type*)next != RBTREE_NULL && next->rrsets == NULL) { 2329 /* the next name has empty rrsets, is an empty nonterminal 2330 * itself, see if there exists something below it */ 2331 next = (struct auth_data*)rbtree_next(&node->node); 2332 } 2333 if((rbnode_type*)next == RBTREE_NULL || !next) { 2334 /* there is no next node, so something below it cannot 2335 * exist */ 2336 return 0; 2337 } 2338 /* a next node exists, if there was something below the query, 2339 * this node has to be it. See if it is below the query name */ 2340 if(dname_strict_subdomain_c(next->name, qinfo->qname)) 2341 return 1; 2342 return 0; 2343 } 2344 2345 /** create synth cname target name in buffer, or fail if too long */ 2346 static size_t 2347 synth_cname_buf(uint8_t* qname, size_t qname_len, size_t dname_len, 2348 uint8_t* dtarg, size_t dtarglen, uint8_t* buf, size_t buflen) 2349 { 2350 size_t newlen = qname_len + dtarglen - dname_len; 2351 if(newlen > buflen) { 2352 /* YXDOMAIN error */ 2353 return 0; 2354 } 2355 /* new name is concatenation of qname front (without DNAME owner) 2356 * and DNAME target name */ 2357 memcpy(buf, qname, qname_len-dname_len); 2358 memmove(buf+(qname_len-dname_len), dtarg, dtarglen); 2359 return newlen; 2360 } 2361 2362 /** create synthetic CNAME rrset for in a DNAME answer in region, 2363 * false on alloc failure, cname==NULL when name too long. */ 2364 static int 2365 create_synth_cname(uint8_t* qname, size_t qname_len, struct regional* region, 2366 struct auth_data* node, struct auth_rrset* dname, uint16_t dclass, 2367 struct ub_packed_rrset_key** cname) 2368 { 2369 uint8_t buf[LDNS_MAX_DOMAINLEN]; 2370 uint8_t* dtarg; 2371 size_t dtarglen, newlen; 2372 struct packed_rrset_data* d; 2373 2374 /* get DNAME target name */ 2375 if(dname->data->count < 1) return 0; 2376 if(dname->data->rr_len[0] < 3) return 0; /* at least rdatalen +1 */ 2377 dtarg = dname->data->rr_data[0]+2; 2378 dtarglen = dname->data->rr_len[0]-2; 2379 if(sldns_read_uint16(dname->data->rr_data[0]) != dtarglen) 2380 return 0; /* rdatalen in DNAME rdata is malformed */ 2381 if(dname_valid(dtarg, dtarglen) != dtarglen) 2382 return 0; /* DNAME RR has malformed rdata */ 2383 if(qname_len == 0) 2384 return 0; /* too short */ 2385 if(qname_len <= node->namelen) 2386 return 0; /* qname too short for dname removal */ 2387 2388 /* synthesize a CNAME */ 2389 newlen = synth_cname_buf(qname, qname_len, node->namelen, 2390 dtarg, dtarglen, buf, sizeof(buf)); 2391 if(newlen == 0) { 2392 /* YXDOMAIN error */ 2393 *cname = NULL; 2394 return 1; 2395 } 2396 *cname = (struct ub_packed_rrset_key*)regional_alloc(region, 2397 sizeof(struct ub_packed_rrset_key)); 2398 if(!*cname) 2399 return 0; /* out of memory */ 2400 memset(&(*cname)->entry, 0, sizeof((*cname)->entry)); 2401 (*cname)->entry.key = (*cname); 2402 (*cname)->rk.type = htons(LDNS_RR_TYPE_CNAME); 2403 (*cname)->rk.rrset_class = htons(dclass); 2404 (*cname)->rk.flags = 0; 2405 (*cname)->rk.dname = regional_alloc_init(region, qname, qname_len); 2406 if(!(*cname)->rk.dname) 2407 return 0; /* out of memory */ 2408 (*cname)->rk.dname_len = qname_len; 2409 (*cname)->entry.hash = rrset_key_hash(&(*cname)->rk); 2410 d = (struct packed_rrset_data*)regional_alloc_zero(region, 2411 sizeof(struct packed_rrset_data) + sizeof(size_t) + 2412 sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t) 2413 + newlen); 2414 if(!d) 2415 return 0; /* out of memory */ 2416 (*cname)->entry.data = d; 2417 d->ttl = 0; /* 0 for synthesized CNAME TTL */ 2418 d->count = 1; 2419 d->rrsig_count = 0; 2420 d->trust = rrset_trust_ans_noAA; 2421 d->rr_len = (size_t*)((uint8_t*)d + 2422 sizeof(struct packed_rrset_data)); 2423 d->rr_len[0] = newlen + sizeof(uint16_t); 2424 packed_rrset_ptr_fixup(d); 2425 d->rr_ttl[0] = d->ttl; 2426 sldns_write_uint16(d->rr_data[0], newlen); 2427 memmove(d->rr_data[0] + sizeof(uint16_t), buf, newlen); 2428 return 1; 2429 } 2430 2431 /** add a synthesized CNAME to the answer section */ 2432 static int 2433 add_synth_cname(struct auth_zone* z, uint8_t* qname, size_t qname_len, 2434 struct regional* region, struct dns_msg* msg, struct auth_data* dname, 2435 struct auth_rrset* rrset) 2436 { 2437 struct ub_packed_rrset_key* cname; 2438 /* synthesize a CNAME */ 2439 if(!create_synth_cname(qname, qname_len, region, dname, rrset, 2440 z->dclass, &cname)) { 2441 /* out of memory */ 2442 return 0; 2443 } 2444 if(!cname) { 2445 /* cname cannot be create because of YXDOMAIN */ 2446 msg->rep->flags |= LDNS_RCODE_YXDOMAIN; 2447 return 1; 2448 } 2449 /* add cname to message */ 2450 if(!msg_grow_array(region, msg)) 2451 return 0; 2452 msg->rep->rrsets[msg->rep->rrset_count] = cname; 2453 msg->rep->rrset_count++; 2454 msg->rep->an_numrrsets++; 2455 msg_ttl(msg); 2456 return 1; 2457 } 2458 2459 /** Change a dname to a different one, for wildcard namechange */ 2460 static void 2461 az_change_dnames(struct dns_msg* msg, uint8_t* oldname, uint8_t* newname, 2462 size_t newlen, int an_only) 2463 { 2464 size_t i; 2465 size_t start = 0, end = msg->rep->rrset_count; 2466 if(!an_only) start = msg->rep->an_numrrsets; 2467 if(an_only) end = msg->rep->an_numrrsets; 2468 for(i=start; i<end; i++) { 2469 /* allocated in region so we can change the ptrs */ 2470 if(query_dname_compare(msg->rep->rrsets[i]->rk.dname, oldname) 2471 == 0) { 2472 msg->rep->rrsets[i]->rk.dname = newname; 2473 msg->rep->rrsets[i]->rk.dname_len = newlen; 2474 } 2475 } 2476 } 2477 2478 /** find NSEC record covering the query */ 2479 static struct auth_rrset* 2480 az_find_nsec_cover(struct auth_zone* z, struct auth_data** node) 2481 { 2482 uint8_t* nm = (*node)->name; 2483 size_t nmlen = (*node)->namelen; 2484 struct auth_rrset* rrset; 2485 /* find the NSEC for the smallest-or-equal node */ 2486 /* if node == NULL, we did not find a smaller name. But the zone 2487 * name is the smallest name and should have an NSEC. So there is 2488 * no NSEC to return (for a properly signed zone) */ 2489 /* for empty nonterminals, the auth-data node should not exist, 2490 * and thus we don't need to go rbtree_previous here to find 2491 * a domain with an NSEC record */ 2492 /* but there could be glue, and if this is node, then it has no NSEC. 2493 * Go up to find nonglue (previous) NSEC-holding nodes */ 2494 while((rrset=az_domain_rrset(*node, LDNS_RR_TYPE_NSEC)) == NULL) { 2495 if(dname_is_root(nm)) return NULL; 2496 if(nmlen == z->namelen) return NULL; 2497 dname_remove_label(&nm, &nmlen); 2498 /* adjust *node for the nsec rrset to find in */ 2499 *node = az_find_name(z, nm, nmlen); 2500 } 2501 return rrset; 2502 } 2503 2504 /** Find NSEC and add for wildcard denial */ 2505 static int 2506 az_nsec_wildcard_denial(struct auth_zone* z, struct regional* region, 2507 struct dns_msg* msg, uint8_t* cenm, size_t cenmlen) 2508 { 2509 struct query_info qinfo; 2510 int node_exact; 2511 struct auth_data* node; 2512 struct auth_rrset* nsec; 2513 uint8_t wc[LDNS_MAX_DOMAINLEN]; 2514 if(cenmlen+2 > sizeof(wc)) 2515 return 0; /* result would be too long */ 2516 wc[0] = 1; /* length of wildcard label */ 2517 wc[1] = (uint8_t)'*'; /* wildcard label */ 2518 memmove(wc+2, cenm, cenmlen); 2519 2520 /* we have '*.ce' in wc wildcard name buffer */ 2521 /* get nsec cover for that */ 2522 qinfo.qname = wc; 2523 qinfo.qname_len = cenmlen+2; 2524 qinfo.qtype = 0; 2525 qinfo.qclass = 0; 2526 az_find_domain(z, &qinfo, &node_exact, &node); 2527 if((nsec=az_find_nsec_cover(z, &node)) != NULL) { 2528 if(!msg_add_rrset_ns(z, region, msg, node, nsec)) return 0; 2529 } 2530 return 1; 2531 } 2532 2533 /** Find the NSEC3PARAM rrset (if any) and if true you have the parameters */ 2534 static int 2535 az_nsec3_param(struct auth_zone* z, int* algo, size_t* iter, uint8_t** salt, 2536 size_t* saltlen) 2537 { 2538 struct auth_data* apex; 2539 struct auth_rrset* param; 2540 size_t i; 2541 apex = az_find_name(z, z->name, z->namelen); 2542 if(!apex) return 0; 2543 param = az_domain_rrset(apex, LDNS_RR_TYPE_NSEC3PARAM); 2544 if(!param || param->data->count==0) 2545 return 0; /* no RRset or no RRs in rrset */ 2546 /* find out which NSEC3PARAM RR has supported parameters */ 2547 /* skip unknown flags (dynamic signer is recalculating nsec3 chain) */ 2548 for(i=0; i<param->data->count; i++) { 2549 uint8_t* rdata = param->data->rr_data[i]+2; 2550 size_t rdatalen = param->data->rr_len[i]; 2551 if(rdatalen < 2+5) 2552 continue; /* too short */ 2553 if(!nsec3_hash_algo_size_supported((int)(rdata[0]))) 2554 continue; /* unsupported algo */ 2555 if(rdatalen < (size_t)(2+5+(size_t)rdata[4])) 2556 continue; /* salt missing */ 2557 if((rdata[1]&NSEC3_UNKNOWN_FLAGS)!=0) 2558 continue; /* unknown flags */ 2559 *algo = (int)(rdata[0]); 2560 *iter = sldns_read_uint16(rdata+2); 2561 *saltlen = rdata[4]; 2562 if(*saltlen == 0) 2563 *salt = NULL; 2564 else *salt = rdata+5; 2565 return 1; 2566 } 2567 /* no supported params */ 2568 return 0; 2569 } 2570 2571 /** Hash a name with nsec3param into buffer, it has zone name appended. 2572 * return length of hash */ 2573 static size_t 2574 az_nsec3_hash(uint8_t* buf, size_t buflen, uint8_t* nm, size_t nmlen, 2575 int algo, size_t iter, uint8_t* salt, size_t saltlen) 2576 { 2577 size_t hlen = nsec3_hash_algo_size_supported(algo); 2578 /* buffer has domain name, nsec3hash, and 256 is for max saltlen 2579 * (salt has 0-255 length) */ 2580 unsigned char p[LDNS_MAX_DOMAINLEN+1+N3HASHBUFLEN+256]; 2581 size_t i; 2582 if(nmlen+saltlen > sizeof(p) || hlen+saltlen > sizeof(p)) 2583 return 0; 2584 if(hlen > buflen) 2585 return 0; /* somehow too large for destination buffer */ 2586 /* hashfunc(name, salt) */ 2587 memmove(p, nm, nmlen); 2588 query_dname_tolower(p); 2589 memmove(p+nmlen, salt, saltlen); 2590 (void)secalgo_nsec3_hash(algo, p, nmlen+saltlen, (unsigned char*)buf); 2591 for(i=0; i<iter; i++) { 2592 /* hashfunc(hash, salt) */ 2593 memmove(p, buf, hlen); 2594 memmove(p+hlen, salt, saltlen); 2595 (void)secalgo_nsec3_hash(algo, p, hlen+saltlen, 2596 (unsigned char*)buf); 2597 } 2598 return hlen; 2599 } 2600 2601 /** Hash name and return b32encoded hashname for lookup, zone name appended */ 2602 static int 2603 az_nsec3_hashname(struct auth_zone* z, uint8_t* hashname, size_t* hashnmlen, 2604 uint8_t* nm, size_t nmlen, int algo, size_t iter, uint8_t* salt, 2605 size_t saltlen) 2606 { 2607 uint8_t hash[N3HASHBUFLEN]; 2608 size_t hlen; 2609 int ret; 2610 hlen = az_nsec3_hash(hash, sizeof(hash), nm, nmlen, algo, iter, 2611 salt, saltlen); 2612 if(!hlen) return 0; 2613 /* b32 encode */ 2614 if(*hashnmlen < hlen*2+1+z->namelen) /* approx b32 as hexb16 */ 2615 return 0; 2616 ret = sldns_b32_ntop_extended_hex(hash, hlen, (char*)(hashname+1), 2617 (*hashnmlen)-1); 2618 if(ret<1) 2619 return 0; 2620 hashname[0] = (uint8_t)ret; 2621 ret++; 2622 if((*hashnmlen) - ret < z->namelen) 2623 return 0; 2624 memmove(hashname+ret, z->name, z->namelen); 2625 *hashnmlen = z->namelen+(size_t)ret; 2626 return 1; 2627 } 2628 2629 /** Find the datanode that covers the nsec3hash-name */ 2630 static struct auth_data* 2631 az_nsec3_findnode(struct auth_zone* z, uint8_t* hashnm, size_t hashnmlen) 2632 { 2633 struct query_info qinfo; 2634 struct auth_data* node; 2635 int node_exact; 2636 qinfo.qclass = 0; 2637 qinfo.qtype = 0; 2638 qinfo.qname = hashnm; 2639 qinfo.qname_len = hashnmlen; 2640 /* because canonical ordering and b32 nsec3 ordering are the same. 2641 * this is a good lookup to find the nsec3 name. */ 2642 az_find_domain(z, &qinfo, &node_exact, &node); 2643 /* but we may have to skip non-nsec3 nodes */ 2644 /* this may be a lot, the way to speed that up is to have a 2645 * separate nsec3 tree with nsec3 nodes */ 2646 while(node && (rbnode_type*)node != RBTREE_NULL && 2647 !az_domain_rrset(node, LDNS_RR_TYPE_NSEC3)) { 2648 node = (struct auth_data*)rbtree_previous(&node->node); 2649 } 2650 if((rbnode_type*)node == RBTREE_NULL) 2651 node = NULL; 2652 return node; 2653 } 2654 2655 /** Find cover for hashed(nm, nmlen) (or NULL) */ 2656 static struct auth_data* 2657 az_nsec3_find_cover(struct auth_zone* z, uint8_t* nm, size_t nmlen, 2658 int algo, size_t iter, uint8_t* salt, size_t saltlen) 2659 { 2660 struct auth_data* node; 2661 uint8_t hname[LDNS_MAX_DOMAINLEN]; 2662 size_t hlen = sizeof(hname); 2663 if(!az_nsec3_hashname(z, hname, &hlen, nm, nmlen, algo, iter, 2664 salt, saltlen)) 2665 return NULL; 2666 node = az_nsec3_findnode(z, hname, hlen); 2667 if(node) 2668 return node; 2669 /* we did not find any, perhaps because the NSEC3 hash is before 2670 * the first hash, we have to find the 'last hash' in the zone */ 2671 node = (struct auth_data*)rbtree_last(&z->data); 2672 while(node && (rbnode_type*)node != RBTREE_NULL && 2673 !az_domain_rrset(node, LDNS_RR_TYPE_NSEC3)) { 2674 node = (struct auth_data*)rbtree_previous(&node->node); 2675 } 2676 if((rbnode_type*)node == RBTREE_NULL) 2677 node = NULL; 2678 return node; 2679 } 2680 2681 /** Find exact match for hashed(nm, nmlen) NSEC3 record or NULL */ 2682 static struct auth_data* 2683 az_nsec3_find_exact(struct auth_zone* z, uint8_t* nm, size_t nmlen, 2684 int algo, size_t iter, uint8_t* salt, size_t saltlen) 2685 { 2686 struct auth_data* node; 2687 uint8_t hname[LDNS_MAX_DOMAINLEN]; 2688 size_t hlen = sizeof(hname); 2689 if(!az_nsec3_hashname(z, hname, &hlen, nm, nmlen, algo, iter, 2690 salt, saltlen)) 2691 return NULL; 2692 node = az_find_name(z, hname, hlen); 2693 if(az_domain_rrset(node, LDNS_RR_TYPE_NSEC3)) 2694 return node; 2695 return NULL; 2696 } 2697 2698 /** Return nextcloser name (as a ref into the qname). This is one label 2699 * more than the cenm (cename must be a suffix of qname) */ 2700 static void 2701 az_nsec3_get_nextcloser(uint8_t* cenm, uint8_t* qname, size_t qname_len, 2702 uint8_t** nx, size_t* nxlen) 2703 { 2704 int celabs = dname_count_labels(cenm); 2705 int qlabs = dname_count_labels(qname); 2706 int strip = qlabs - celabs -1; 2707 log_assert(dname_strict_subdomain(qname, qlabs, cenm, celabs)); 2708 *nx = qname; 2709 *nxlen = qname_len; 2710 if(strip>0) 2711 dname_remove_labels(nx, nxlen, strip); 2712 } 2713 2714 /** Find the closest encloser that has exact NSEC3. 2715 * updated cenm to the new name. If it went up no-exact-ce is true. */ 2716 static struct auth_data* 2717 az_nsec3_find_ce(struct auth_zone* z, uint8_t** cenm, size_t* cenmlen, 2718 int* no_exact_ce, int algo, size_t iter, uint8_t* salt, size_t saltlen) 2719 { 2720 struct auth_data* node; 2721 while((node = az_nsec3_find_exact(z, *cenm, *cenmlen, 2722 algo, iter, salt, saltlen)) == NULL) { 2723 if(*cenmlen == z->namelen) { 2724 /* next step up would take us out of the zone. fail */ 2725 return NULL; 2726 } 2727 *no_exact_ce = 1; 2728 dname_remove_label(cenm, cenmlen); 2729 } 2730 return node; 2731 } 2732 2733 /* Insert NSEC3 record in authority section, if NULL does nothing */ 2734 static int 2735 az_nsec3_insert(struct auth_zone* z, struct regional* region, 2736 struct dns_msg* msg, struct auth_data* node) 2737 { 2738 struct auth_rrset* nsec3; 2739 if(!node) return 1; /* no node, skip this */ 2740 nsec3 = az_domain_rrset(node, LDNS_RR_TYPE_NSEC3); 2741 if(!nsec3) return 1; /* if no nsec3 RR, skip it */ 2742 if(!msg_add_rrset_ns(z, region, msg, node, nsec3)) return 0; 2743 return 1; 2744 } 2745 2746 /** add NSEC3 records to the zone for the nsec3 proof. 2747 * Specify with the flags with parts of the proof are required. 2748 * the ce is the exact matching name (for notype) but also delegation points. 2749 * qname is the one where the nextcloser name can be derived from. 2750 * If NSEC3 is not properly there (in the zone) nothing is added. 2751 * always enabled: include nsec3 proving about the Closest Encloser. 2752 * that is an exact match that should exist for it. 2753 * If that does not exist, a higher exact match + nxproof is enabled 2754 * (for some sort of opt-out empty nonterminal cases). 2755 * nodataproof: search for exact match and include that instead. 2756 * ceproof: include ce proof NSEC3 (omitted for wildcard replies). 2757 * nxproof: include denial of the qname. 2758 * wcproof: include denial of wildcard (wildcard.ce). 2759 */ 2760 static int 2761 az_add_nsec3_proof(struct auth_zone* z, struct regional* region, 2762 struct dns_msg* msg, uint8_t* cenm, size_t cenmlen, uint8_t* qname, 2763 size_t qname_len, int nodataproof, int ceproof, int nxproof, 2764 int wcproof) 2765 { 2766 int algo; 2767 size_t iter, saltlen; 2768 uint8_t* salt; 2769 int no_exact_ce = 0; 2770 struct auth_data* node; 2771 2772 /* find parameters of nsec3 proof */ 2773 if(!az_nsec3_param(z, &algo, &iter, &salt, &saltlen)) 2774 return 1; /* no nsec3 */ 2775 if(nodataproof) { 2776 /* see if the node has a hash of itself for the nodata 2777 * proof nsec3, this has to be an exact match nsec3. */ 2778 struct auth_data* match; 2779 match = az_nsec3_find_exact(z, qname, qname_len, algo, 2780 iter, salt, saltlen); 2781 if(match) { 2782 if(!az_nsec3_insert(z, region, msg, match)) 2783 return 0; 2784 /* only nodata NSEC3 needed, no CE or others. */ 2785 return 1; 2786 } 2787 } 2788 /* find ce that has an NSEC3 */ 2789 if(ceproof) { 2790 node = az_nsec3_find_ce(z, &cenm, &cenmlen, &no_exact_ce, 2791 algo, iter, salt, saltlen); 2792 if(no_exact_ce) nxproof = 1; 2793 if(!az_nsec3_insert(z, region, msg, node)) 2794 return 0; 2795 } 2796 2797 if(nxproof) { 2798 uint8_t* nx; 2799 size_t nxlen; 2800 /* create nextcloser domain name */ 2801 az_nsec3_get_nextcloser(cenm, qname, qname_len, &nx, &nxlen); 2802 /* find nsec3 that matches or covers it */ 2803 node = az_nsec3_find_cover(z, nx, nxlen, algo, iter, salt, 2804 saltlen); 2805 if(!az_nsec3_insert(z, region, msg, node)) 2806 return 0; 2807 } 2808 if(wcproof) { 2809 /* create wildcard name *.ce */ 2810 uint8_t wc[LDNS_MAX_DOMAINLEN]; 2811 size_t wclen; 2812 if(cenmlen+2 > sizeof(wc)) 2813 return 0; /* result would be too long */ 2814 wc[0] = 1; /* length of wildcard label */ 2815 wc[1] = (uint8_t)'*'; /* wildcard label */ 2816 memmove(wc+2, cenm, cenmlen); 2817 wclen = cenmlen+2; 2818 /* find nsec3 that matches or covers it */ 2819 node = az_nsec3_find_cover(z, wc, wclen, algo, iter, salt, 2820 saltlen); 2821 if(!az_nsec3_insert(z, region, msg, node)) 2822 return 0; 2823 } 2824 return 1; 2825 } 2826 2827 /** generate answer for positive answer */ 2828 static int 2829 az_generate_positive_answer(struct auth_zone* z, struct regional* region, 2830 struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset) 2831 { 2832 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 2833 /* see if we want additional rrs */ 2834 if(rrset->type == LDNS_RR_TYPE_MX) { 2835 if(!az_add_additionals_from(z, region, msg, rrset, 2)) 2836 return 0; 2837 } else if(rrset->type == LDNS_RR_TYPE_SRV) { 2838 if(!az_add_additionals_from(z, region, msg, rrset, 6)) 2839 return 0; 2840 } else if(rrset->type == LDNS_RR_TYPE_NS) { 2841 if(!az_add_additionals_from(z, region, msg, rrset, 0)) 2842 return 0; 2843 } 2844 return 1; 2845 } 2846 2847 /** generate answer for type ANY answer */ 2848 static int 2849 az_generate_any_answer(struct auth_zone* z, struct regional* region, 2850 struct dns_msg* msg, struct auth_data* node) 2851 { 2852 struct auth_rrset* rrset; 2853 int added = 0; 2854 /* add a couple (at least one) RRs */ 2855 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_SOA)) != NULL) { 2856 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 2857 added++; 2858 } 2859 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_MX)) != NULL) { 2860 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 2861 added++; 2862 } 2863 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_A)) != NULL) { 2864 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 2865 added++; 2866 } 2867 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_AAAA)) != NULL) { 2868 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 2869 added++; 2870 } 2871 if(added == 0 && node && node->rrsets) { 2872 if(!msg_add_rrset_an(z, region, msg, node, 2873 node->rrsets)) return 0; 2874 } 2875 return 1; 2876 } 2877 2878 /** follow cname chain and add more data to the answer section */ 2879 static int 2880 follow_cname_chain(struct auth_zone* z, uint16_t qtype, 2881 struct regional* region, struct dns_msg* msg, 2882 struct packed_rrset_data* d) 2883 { 2884 int maxchain = 0; 2885 /* see if we can add the target of the CNAME into the answer */ 2886 while(maxchain++ < MAX_CNAME_CHAIN) { 2887 struct auth_data* node; 2888 struct auth_rrset* rrset; 2889 size_t clen; 2890 /* d has cname rdata */ 2891 if(d->count == 0) break; /* no CNAME */ 2892 if(d->rr_len[0] < 2+1) break; /* too small */ 2893 if((clen=dname_valid(d->rr_data[0]+2, d->rr_len[0]-2))==0) 2894 break; /* malformed */ 2895 if(!dname_subdomain_c(d->rr_data[0]+2, z->name)) 2896 break; /* target out of zone */ 2897 if((node = az_find_name(z, d->rr_data[0]+2, clen))==NULL) 2898 break; /* no such target name */ 2899 if((rrset=az_domain_rrset(node, qtype))!=NULL) { 2900 /* done we found the target */ 2901 if(!msg_add_rrset_an(z, region, msg, node, rrset)) 2902 return 0; 2903 break; 2904 } 2905 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_CNAME))==NULL) 2906 break; /* no further CNAME chain, notype */ 2907 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 2908 d = rrset->data; 2909 } 2910 return 1; 2911 } 2912 2913 /** generate answer for cname answer */ 2914 static int 2915 az_generate_cname_answer(struct auth_zone* z, struct query_info* qinfo, 2916 struct regional* region, struct dns_msg* msg, 2917 struct auth_data* node, struct auth_rrset* rrset) 2918 { 2919 if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0; 2920 if(!rrset) return 1; 2921 if(!follow_cname_chain(z, qinfo->qtype, region, msg, rrset->data)) 2922 return 0; 2923 return 1; 2924 } 2925 2926 /** generate answer for notype answer */ 2927 static int 2928 az_generate_notype_answer(struct auth_zone* z, struct regional* region, 2929 struct dns_msg* msg, struct auth_data* node) 2930 { 2931 struct auth_rrset* rrset; 2932 if(!az_add_negative_soa(z, region, msg)) return 0; 2933 /* DNSSEC denial NSEC */ 2934 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_NSEC))!=NULL) { 2935 if(!msg_add_rrset_ns(z, region, msg, node, rrset)) return 0; 2936 } else if(node) { 2937 /* DNSSEC denial NSEC3 */ 2938 if(!az_add_nsec3_proof(z, region, msg, node->name, 2939 node->namelen, msg->qinfo.qname, 2940 msg->qinfo.qname_len, 1, 1, 0, 0)) 2941 return 0; 2942 } 2943 return 1; 2944 } 2945 2946 /** generate answer for referral answer */ 2947 static int 2948 az_generate_referral_answer(struct auth_zone* z, struct regional* region, 2949 struct dns_msg* msg, struct auth_data* ce, struct auth_rrset* rrset) 2950 { 2951 struct auth_rrset* ds, *nsec; 2952 /* turn off AA flag, referral is nonAA because it leaves the zone */ 2953 log_assert(ce); 2954 msg->rep->flags &= ~BIT_AA; 2955 if(!msg_add_rrset_ns(z, region, msg, ce, rrset)) return 0; 2956 /* add DS or deny it */ 2957 if((ds=az_domain_rrset(ce, LDNS_RR_TYPE_DS))!=NULL) { 2958 if(!msg_add_rrset_ns(z, region, msg, ce, ds)) return 0; 2959 } else { 2960 /* deny the DS */ 2961 if((nsec=az_domain_rrset(ce, LDNS_RR_TYPE_NSEC))!=NULL) { 2962 if(!msg_add_rrset_ns(z, region, msg, ce, nsec)) 2963 return 0; 2964 } else { 2965 if(!az_add_nsec3_proof(z, region, msg, ce->name, 2966 ce->namelen, msg->qinfo.qname, 2967 msg->qinfo.qname_len, 1, 1, 0, 0)) 2968 return 0; 2969 } 2970 } 2971 /* add additional rrs for type NS */ 2972 if(!az_add_additionals_from(z, region, msg, rrset, 0)) return 0; 2973 return 1; 2974 } 2975 2976 /** generate answer for DNAME answer */ 2977 static int 2978 az_generate_dname_answer(struct auth_zone* z, struct query_info* qinfo, 2979 struct regional* region, struct dns_msg* msg, struct auth_data* ce, 2980 struct auth_rrset* rrset) 2981 { 2982 log_assert(ce); 2983 /* add the DNAME and then a CNAME */ 2984 if(!msg_add_rrset_an(z, region, msg, ce, rrset)) return 0; 2985 if(!add_synth_cname(z, qinfo->qname, qinfo->qname_len, region, 2986 msg, ce, rrset)) return 0; 2987 if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_YXDOMAIN) 2988 return 1; 2989 if(msg->rep->rrset_count == 0 || 2990 !msg->rep->rrsets[msg->rep->rrset_count-1]) 2991 return 0; 2992 if(!follow_cname_chain(z, qinfo->qtype, region, msg, 2993 (struct packed_rrset_data*)msg->rep->rrsets[ 2994 msg->rep->rrset_count-1]->entry.data)) 2995 return 0; 2996 return 1; 2997 } 2998 2999 /** generate answer for wildcard answer */ 3000 static int 3001 az_generate_wildcard_answer(struct auth_zone* z, struct query_info* qinfo, 3002 struct regional* region, struct dns_msg* msg, struct auth_data* ce, 3003 struct auth_data* wildcard, struct auth_data* node) 3004 { 3005 struct auth_rrset* rrset, *nsec; 3006 int insert_ce = 0; 3007 if((rrset=az_domain_rrset(wildcard, qinfo->qtype)) != NULL) { 3008 /* wildcard has type, add it */ 3009 if(!msg_add_rrset_an(z, region, msg, wildcard, rrset)) 3010 return 0; 3011 az_change_dnames(msg, wildcard->name, msg->qinfo.qname, 3012 msg->qinfo.qname_len, 1); 3013 } else if((rrset=az_domain_rrset(wildcard, LDNS_RR_TYPE_CNAME))!=NULL) { 3014 /* wildcard has cname instead, do that */ 3015 if(!msg_add_rrset_an(z, region, msg, wildcard, rrset)) 3016 return 0; 3017 az_change_dnames(msg, wildcard->name, msg->qinfo.qname, 3018 msg->qinfo.qname_len, 1); 3019 if(!follow_cname_chain(z, qinfo->qtype, region, msg, 3020 rrset->data)) 3021 return 0; 3022 } else if(qinfo->qtype == LDNS_RR_TYPE_ANY && wildcard->rrsets) { 3023 /* add ANY rrsets from wildcard node */ 3024 if(!az_generate_any_answer(z, region, msg, wildcard)) 3025 return 0; 3026 az_change_dnames(msg, wildcard->name, msg->qinfo.qname, 3027 msg->qinfo.qname_len, 1); 3028 } else { 3029 /* wildcard has nodata, notype answer */ 3030 /* call other notype routine for dnssec notype denials */ 3031 if(!az_generate_notype_answer(z, region, msg, wildcard)) 3032 return 0; 3033 /* because the notype, there is no positive data with an 3034 * RRSIG that indicates the wildcard position. Thus the 3035 * wildcard qname denial needs to have a CE nsec3. */ 3036 insert_ce = 1; 3037 } 3038 3039 /* ce and node for dnssec denial of wildcard original name */ 3040 if((nsec=az_find_nsec_cover(z, &node)) != NULL) { 3041 if(!msg_add_rrset_ns(z, region, msg, node, nsec)) return 0; 3042 } else if(ce) { 3043 uint8_t* wildup = wildcard->name; 3044 size_t wilduplen= wildcard->namelen; 3045 dname_remove_label(&wildup, &wilduplen); 3046 if(!az_add_nsec3_proof(z, region, msg, wildup, 3047 wilduplen, msg->qinfo.qname, 3048 msg->qinfo.qname_len, 0, insert_ce, 1, 0)) 3049 return 0; 3050 } 3051 3052 /* fixup name of wildcard from *.zone to qname, use already allocated 3053 * pointer to msg qname */ 3054 az_change_dnames(msg, wildcard->name, msg->qinfo.qname, 3055 msg->qinfo.qname_len, 0); 3056 return 1; 3057 } 3058 3059 /** generate answer for nxdomain answer */ 3060 static int 3061 az_generate_nxdomain_answer(struct auth_zone* z, struct regional* region, 3062 struct dns_msg* msg, struct auth_data* ce, struct auth_data* node) 3063 { 3064 struct auth_rrset* nsec; 3065 msg->rep->flags |= LDNS_RCODE_NXDOMAIN; 3066 if(!az_add_negative_soa(z, region, msg)) return 0; 3067 if((nsec=az_find_nsec_cover(z, &node)) != NULL) { 3068 if(!msg_add_rrset_ns(z, region, msg, node, nsec)) return 0; 3069 if(ce && !az_nsec_wildcard_denial(z, region, msg, ce->name, 3070 ce->namelen)) return 0; 3071 } else if(ce) { 3072 if(!az_add_nsec3_proof(z, region, msg, ce->name, 3073 ce->namelen, msg->qinfo.qname, 3074 msg->qinfo.qname_len, 0, 1, 1, 1)) 3075 return 0; 3076 } 3077 return 1; 3078 } 3079 3080 /** Create answers when an exact match exists for the domain name */ 3081 static int 3082 az_generate_answer_with_node(struct auth_zone* z, struct query_info* qinfo, 3083 struct regional* region, struct dns_msg* msg, struct auth_data* node) 3084 { 3085 struct auth_rrset* rrset; 3086 /* positive answer, rrset we are looking for exists */ 3087 if((rrset=az_domain_rrset(node, qinfo->qtype)) != NULL) { 3088 return az_generate_positive_answer(z, region, msg, node, rrset); 3089 } 3090 /* CNAME? */ 3091 if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_CNAME)) != NULL) { 3092 return az_generate_cname_answer(z, qinfo, region, msg, 3093 node, rrset); 3094 } 3095 /* type ANY ? */ 3096 if(qinfo->qtype == LDNS_RR_TYPE_ANY) { 3097 return az_generate_any_answer(z, region, msg, node); 3098 } 3099 /* NOERROR/NODATA (no such type at domain name) */ 3100 return az_generate_notype_answer(z, region, msg, node); 3101 } 3102 3103 /** Generate answer without an existing-node that we can use. 3104 * So it'll be a referral, DNAME or nxdomain */ 3105 static int 3106 az_generate_answer_nonexistnode(struct auth_zone* z, struct query_info* qinfo, 3107 struct regional* region, struct dns_msg* msg, struct auth_data* ce, 3108 struct auth_rrset* rrset, struct auth_data* node) 3109 { 3110 struct auth_data* wildcard; 3111 3112 /* we do not have an exact matching name (that exists) */ 3113 /* see if we have a NS or DNAME in the ce */ 3114 if(ce && rrset && rrset->type == LDNS_RR_TYPE_NS) { 3115 return az_generate_referral_answer(z, region, msg, ce, rrset); 3116 } 3117 if(ce && rrset && rrset->type == LDNS_RR_TYPE_DNAME) { 3118 return az_generate_dname_answer(z, qinfo, region, msg, ce, 3119 rrset); 3120 } 3121 /* if there is an empty nonterminal, wildcard and nxdomain don't 3122 * happen, it is a notype answer */ 3123 if(az_empty_nonterminal(z, qinfo, node)) { 3124 return az_generate_notype_answer(z, region, msg, node); 3125 } 3126 /* see if we have a wildcard under the ce */ 3127 if((wildcard=az_find_wildcard(z, qinfo, ce)) != NULL) { 3128 return az_generate_wildcard_answer(z, qinfo, region, msg, 3129 ce, wildcard, node); 3130 } 3131 /* generate nxdomain answer */ 3132 return az_generate_nxdomain_answer(z, region, msg, ce, node); 3133 } 3134 3135 /** Lookup answer in a zone. */ 3136 static int 3137 auth_zone_generate_answer(struct auth_zone* z, struct query_info* qinfo, 3138 struct regional* region, struct dns_msg** msg, int* fallback) 3139 { 3140 struct auth_data* node, *ce; 3141 struct auth_rrset* rrset; 3142 int node_exact, node_exists; 3143 /* does the zone want fallback in case of failure? */ 3144 *fallback = z->fallback_enabled; 3145 if(!(*msg=msg_create(region, qinfo))) return 0; 3146 3147 /* lookup if there is a matching domain name for the query */ 3148 az_find_domain(z, qinfo, &node_exact, &node); 3149 3150 /* see if node exists for generating answers from (i.e. not glue and 3151 * obscured by NS or DNAME or NSEC3-only), and also return the 3152 * closest-encloser from that, closest node that should be used 3153 * to generate answers from that is above the query */ 3154 node_exists = az_find_ce(z, qinfo, node, node_exact, &ce, &rrset); 3155 3156 if(verbosity >= VERB_ALGO) { 3157 char zname[256], qname[256], nname[256], cename[256], 3158 tpstr[32], rrstr[32]; 3159 sldns_wire2str_dname_buf(qinfo->qname, qinfo->qname_len, qname, 3160 sizeof(qname)); 3161 sldns_wire2str_type_buf(qinfo->qtype, tpstr, sizeof(tpstr)); 3162 sldns_wire2str_dname_buf(z->name, z->namelen, zname, 3163 sizeof(zname)); 3164 if(node) 3165 sldns_wire2str_dname_buf(node->name, node->namelen, 3166 nname, sizeof(nname)); 3167 else snprintf(nname, sizeof(nname), "NULL"); 3168 if(ce) 3169 sldns_wire2str_dname_buf(ce->name, ce->namelen, 3170 cename, sizeof(cename)); 3171 else snprintf(cename, sizeof(cename), "NULL"); 3172 if(rrset) sldns_wire2str_type_buf(rrset->type, rrstr, 3173 sizeof(rrstr)); 3174 else snprintf(rrstr, sizeof(rrstr), "NULL"); 3175 log_info("auth_zone %s query %s %s, domain %s %s %s, " 3176 "ce %s, rrset %s", zname, qname, tpstr, nname, 3177 (node_exact?"exact":"notexact"), 3178 (node_exists?"exist":"notexist"), cename, rrstr); 3179 } 3180 3181 if(node_exists) { 3182 /* the node is fine, generate answer from node */ 3183 return az_generate_answer_with_node(z, qinfo, region, *msg, 3184 node); 3185 } 3186 return az_generate_answer_nonexistnode(z, qinfo, region, *msg, 3187 ce, rrset, node); 3188 } 3189 3190 int auth_zones_lookup(struct auth_zones* az, struct query_info* qinfo, 3191 struct regional* region, struct dns_msg** msg, int* fallback, 3192 uint8_t* dp_nm, size_t dp_nmlen) 3193 { 3194 int r; 3195 struct auth_zone* z; 3196 /* find the zone that should contain the answer. */ 3197 lock_rw_rdlock(&az->lock); 3198 z = auth_zone_find(az, dp_nm, dp_nmlen, qinfo->qclass); 3199 if(!z) { 3200 lock_rw_unlock(&az->lock); 3201 /* no auth zone, fallback to internet */ 3202 *fallback = 1; 3203 return 0; 3204 } 3205 lock_rw_rdlock(&z->lock); 3206 lock_rw_unlock(&az->lock); 3207 3208 /* if not for upstream queries, fallback */ 3209 if(!z->for_upstream) { 3210 lock_rw_unlock(&z->lock); 3211 *fallback = 1; 3212 return 0; 3213 } 3214 if(z->zone_expired) { 3215 *fallback = z->fallback_enabled; 3216 lock_rw_unlock(&z->lock); 3217 return 0; 3218 } 3219 /* see what answer that zone would generate */ 3220 r = auth_zone_generate_answer(z, qinfo, region, msg, fallback); 3221 lock_rw_unlock(&z->lock); 3222 return r; 3223 } 3224 3225 /** encode auth answer */ 3226 static void 3227 auth_answer_encode(struct query_info* qinfo, struct module_env* env, 3228 struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf, 3229 struct regional* temp, struct dns_msg* msg) 3230 { 3231 uint16_t udpsize; 3232 udpsize = edns->udp_size; 3233 edns->edns_version = EDNS_ADVERTISED_VERSION; 3234 edns->udp_size = EDNS_ADVERTISED_SIZE; 3235 edns->ext_rcode = 0; 3236 edns->bits &= EDNS_DO; 3237 3238 if(!inplace_cb_reply_local_call(env, qinfo, NULL, msg->rep, 3239 (int)FLAGS_GET_RCODE(msg->rep->flags), edns, repinfo, temp) 3240 || !reply_info_answer_encode(qinfo, msg->rep, 3241 *(uint16_t*)sldns_buffer_begin(buf), 3242 sldns_buffer_read_u16_at(buf, 2), 3243 buf, 0, 0, temp, udpsize, edns, 3244 (int)(edns->bits&EDNS_DO), 0)) { 3245 error_encode(buf, (LDNS_RCODE_SERVFAIL|BIT_AA), qinfo, 3246 *(uint16_t*)sldns_buffer_begin(buf), 3247 sldns_buffer_read_u16_at(buf, 2), edns); 3248 } 3249 } 3250 3251 /** encode auth error answer */ 3252 static void 3253 auth_error_encode(struct query_info* qinfo, struct module_env* env, 3254 struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf, 3255 struct regional* temp, int rcode) 3256 { 3257 edns->edns_version = EDNS_ADVERTISED_VERSION; 3258 edns->udp_size = EDNS_ADVERTISED_SIZE; 3259 edns->ext_rcode = 0; 3260 edns->bits &= EDNS_DO; 3261 3262 if(!inplace_cb_reply_local_call(env, qinfo, NULL, NULL, 3263 rcode, edns, repinfo, temp)) 3264 edns->opt_list = NULL; 3265 error_encode(buf, rcode|BIT_AA, qinfo, 3266 *(uint16_t*)sldns_buffer_begin(buf), 3267 sldns_buffer_read_u16_at(buf, 2), edns); 3268 } 3269 3270 int auth_zones_answer(struct auth_zones* az, struct module_env* env, 3271 struct query_info* qinfo, struct edns_data* edns, 3272 struct comm_reply* repinfo, struct sldns_buffer* buf, struct regional* temp) 3273 { 3274 struct dns_msg* msg = NULL; 3275 struct auth_zone* z; 3276 int r; 3277 int fallback = 0; 3278 3279 lock_rw_rdlock(&az->lock); 3280 if(!az->have_downstream) { 3281 /* no downstream auth zones */ 3282 lock_rw_unlock(&az->lock); 3283 return 0; 3284 } 3285 if(qinfo->qtype == LDNS_RR_TYPE_DS) { 3286 uint8_t* delname = qinfo->qname; 3287 size_t delnamelen = qinfo->qname_len; 3288 dname_remove_label(&delname, &delnamelen); 3289 z = auth_zones_find_zone(az, delname, delnamelen, 3290 qinfo->qclass); 3291 } else { 3292 z = auth_zones_find_zone(az, qinfo->qname, qinfo->qname_len, 3293 qinfo->qclass); 3294 } 3295 if(!z) { 3296 /* no zone above it */ 3297 lock_rw_unlock(&az->lock); 3298 return 0; 3299 } 3300 lock_rw_rdlock(&z->lock); 3301 lock_rw_unlock(&az->lock); 3302 if(!z->for_downstream) { 3303 lock_rw_unlock(&z->lock); 3304 return 0; 3305 } 3306 if(z->zone_expired) { 3307 if(z->fallback_enabled) { 3308 lock_rw_unlock(&z->lock); 3309 return 0; 3310 } 3311 lock_rw_unlock(&z->lock); 3312 lock_rw_wrlock(&az->lock); 3313 az->num_query_down++; 3314 lock_rw_unlock(&az->lock); 3315 auth_error_encode(qinfo, env, edns, repinfo, buf, temp, 3316 LDNS_RCODE_SERVFAIL); 3317 return 1; 3318 } 3319 3320 /* answer it from zone z */ 3321 r = auth_zone_generate_answer(z, qinfo, temp, &msg, &fallback); 3322 lock_rw_unlock(&z->lock); 3323 if(!r && fallback) { 3324 /* fallback to regular answering (recursive) */ 3325 return 0; 3326 } 3327 lock_rw_wrlock(&az->lock); 3328 az->num_query_down++; 3329 lock_rw_unlock(&az->lock); 3330 3331 /* encode answer */ 3332 if(!r) 3333 auth_error_encode(qinfo, env, edns, repinfo, buf, temp, 3334 LDNS_RCODE_SERVFAIL); 3335 else auth_answer_encode(qinfo, env, edns, repinfo, buf, temp, msg); 3336 3337 return 1; 3338 } 3339 3340 int auth_zones_can_fallback(struct auth_zones* az, uint8_t* nm, size_t nmlen, 3341 uint16_t dclass) 3342 { 3343 int r; 3344 struct auth_zone* z; 3345 lock_rw_rdlock(&az->lock); 3346 z = auth_zone_find(az, nm, nmlen, dclass); 3347 if(!z) { 3348 lock_rw_unlock(&az->lock); 3349 /* no such auth zone, fallback */ 3350 return 1; 3351 } 3352 lock_rw_rdlock(&z->lock); 3353 lock_rw_unlock(&az->lock); 3354 r = z->fallback_enabled || (!z->for_upstream); 3355 lock_rw_unlock(&z->lock); 3356 return r; 3357 } 3358 3359 int 3360 auth_zone_parse_notify_serial(sldns_buffer* pkt, uint32_t *serial) 3361 { 3362 struct query_info q; 3363 uint16_t rdlen; 3364 memset(&q, 0, sizeof(q)); 3365 sldns_buffer_set_position(pkt, 0); 3366 if(!query_info_parse(&q, pkt)) return 0; 3367 if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) == 0) return 0; 3368 /* skip name of RR in answer section */ 3369 if(sldns_buffer_remaining(pkt) < 1) return 0; 3370 if(pkt_dname_len(pkt) == 0) return 0; 3371 /* check type */ 3372 if(sldns_buffer_remaining(pkt) < 10 /* type,class,ttl,rdatalen*/) 3373 return 0; 3374 if(sldns_buffer_read_u16(pkt) != LDNS_RR_TYPE_SOA) return 0; 3375 sldns_buffer_skip(pkt, 2); /* class */ 3376 sldns_buffer_skip(pkt, 4); /* ttl */ 3377 rdlen = sldns_buffer_read_u16(pkt); /* rdatalen */ 3378 if(sldns_buffer_remaining(pkt) < rdlen) return 0; 3379 if(rdlen < 22) return 0; /* bad soa length */ 3380 sldns_buffer_skip(pkt, (ssize_t)(rdlen-20)); 3381 *serial = sldns_buffer_read_u32(pkt); 3382 /* return true when has serial in answer section */ 3383 return 1; 3384 } 3385 3386 /** see if addr appears in the list */ 3387 static int 3388 addr_in_list(struct auth_addr* list, struct sockaddr_storage* addr, 3389 socklen_t addrlen) 3390 { 3391 struct auth_addr* p; 3392 for(p=list; p; p=p->next) { 3393 if(sockaddr_cmp_addr(addr, addrlen, &p->addr, p->addrlen)==0) 3394 return 1; 3395 } 3396 return 0; 3397 } 3398 3399 /** check if an address matches a master specification (or one of its 3400 * addresses in the addr list) */ 3401 static int 3402 addr_matches_master(struct auth_master* master, struct sockaddr_storage* addr, 3403 socklen_t addrlen, struct auth_master** fromhost) 3404 { 3405 struct sockaddr_storage a; 3406 socklen_t alen = 0; 3407 int net = 0; 3408 if(addr_in_list(master->list, addr, addrlen)) { 3409 *fromhost = master; 3410 return 1; 3411 } 3412 /* compare address (but not port number, that is the destination 3413 * port of the master, the port number of the received notify is 3414 * allowed to by any port on that master) */ 3415 if(extstrtoaddr(master->host, &a, &alen) && 3416 sockaddr_cmp_addr(addr, addrlen, &a, alen)==0) { 3417 *fromhost = master; 3418 return 1; 3419 } 3420 /* prefixes, addr/len, like 10.0.0.0/8 */ 3421 /* not http and has a / and there is one / */ 3422 if(master->allow_notify && !master->http && 3423 strchr(master->host, '/') != NULL && 3424 strchr(master->host, '/') == strrchr(master->host, '/') && 3425 netblockstrtoaddr(master->host, UNBOUND_DNS_PORT, &a, &alen, 3426 &net) && alen == addrlen) { 3427 if(addr_in_common(addr, (addr_is_ip6(addr, addrlen)?128:32), 3428 &a, net, alen) >= net) { 3429 *fromhost = NULL; /* prefix does not have destination 3430 to send the probe or transfer with */ 3431 return 1; /* matches the netblock */ 3432 } 3433 } 3434 return 0; 3435 } 3436 3437 /** check access list for notifies */ 3438 static int 3439 az_xfr_allowed_notify(struct auth_xfer* xfr, struct sockaddr_storage* addr, 3440 socklen_t addrlen, struct auth_master** fromhost) 3441 { 3442 struct auth_master* p; 3443 for(p=xfr->allow_notify_list; p; p=p->next) { 3444 if(addr_matches_master(p, addr, addrlen, fromhost)) { 3445 return 1; 3446 } 3447 } 3448 return 0; 3449 } 3450 3451 /** see if the serial means the zone has to be updated, i.e. the serial 3452 * is newer than the zone serial, or we have no zone */ 3453 static int 3454 xfr_serial_means_update(struct auth_xfer* xfr, uint32_t serial) 3455 { 3456 if(!xfr->have_zone) 3457 return 1; /* no zone, anything is better */ 3458 if(xfr->zone_expired) 3459 return 1; /* expired, the sent serial is better than expired 3460 data */ 3461 if(compare_serial(xfr->serial, serial) < 0) 3462 return 1; /* our serial is smaller than the sent serial, 3463 the data is newer, fetch it */ 3464 return 0; 3465 } 3466 3467 /** note notify serial, updates the notify information in the xfr struct */ 3468 static void 3469 xfr_note_notify_serial(struct auth_xfer* xfr, int has_serial, uint32_t serial) 3470 { 3471 if(xfr->notify_received && xfr->notify_has_serial && has_serial) { 3472 /* see if this serial is newer */ 3473 if(compare_serial(xfr->notify_serial, serial) < 0) 3474 xfr->notify_serial = serial; 3475 } else if(xfr->notify_received && xfr->notify_has_serial && 3476 !has_serial) { 3477 /* remove serial, we have notify without serial */ 3478 xfr->notify_has_serial = 0; 3479 xfr->notify_serial = 0; 3480 } else if(xfr->notify_received && !xfr->notify_has_serial) { 3481 /* we already have notify without serial, keep it 3482 * that way; no serial check when current operation 3483 * is done */ 3484 } else { 3485 xfr->notify_received = 1; 3486 xfr->notify_has_serial = has_serial; 3487 xfr->notify_serial = serial; 3488 } 3489 } 3490 3491 /** process a notify serial, start new probe or note serial. xfr is locked */ 3492 static void 3493 xfr_process_notify(struct auth_xfer* xfr, struct module_env* env, 3494 int has_serial, uint32_t serial, struct auth_master* fromhost) 3495 { 3496 /* if the serial of notify is older than we have, don't fetch 3497 * a zone, we already have it */ 3498 if(has_serial && !xfr_serial_means_update(xfr, serial)) { 3499 lock_basic_unlock(&xfr->lock); 3500 return; 3501 } 3502 /* start new probe with this addr src, or note serial */ 3503 if(!xfr_start_probe(xfr, env, fromhost)) { 3504 /* not started because already in progress, note the serial */ 3505 xfr_note_notify_serial(xfr, has_serial, serial); 3506 lock_basic_unlock(&xfr->lock); 3507 } 3508 /* successful end of start_probe unlocked xfr->lock */ 3509 } 3510 3511 int auth_zones_notify(struct auth_zones* az, struct module_env* env, 3512 uint8_t* nm, size_t nmlen, uint16_t dclass, 3513 struct sockaddr_storage* addr, socklen_t addrlen, int has_serial, 3514 uint32_t serial, int* refused) 3515 { 3516 struct auth_xfer* xfr; 3517 struct auth_master* fromhost = NULL; 3518 /* see which zone this is */ 3519 lock_rw_rdlock(&az->lock); 3520 xfr = auth_xfer_find(az, nm, nmlen, dclass); 3521 if(!xfr) { 3522 lock_rw_unlock(&az->lock); 3523 /* no such zone, refuse the notify */ 3524 *refused = 1; 3525 return 0; 3526 } 3527 lock_basic_lock(&xfr->lock); 3528 lock_rw_unlock(&az->lock); 3529 3530 /* check access list for notifies */ 3531 if(!az_xfr_allowed_notify(xfr, addr, addrlen, &fromhost)) { 3532 lock_basic_unlock(&xfr->lock); 3533 /* notify not allowed, refuse the notify */ 3534 *refused = 1; 3535 return 0; 3536 } 3537 3538 /* process the notify */ 3539 xfr_process_notify(xfr, env, has_serial, serial, fromhost); 3540 return 1; 3541 } 3542 3543 int auth_zones_startprobesequence(struct auth_zones* az, 3544 struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t dclass) 3545 { 3546 struct auth_xfer* xfr; 3547 lock_rw_rdlock(&az->lock); 3548 xfr = auth_xfer_find(az, nm, nmlen, dclass); 3549 if(!xfr) { 3550 lock_rw_unlock(&az->lock); 3551 return 0; 3552 } 3553 lock_basic_lock(&xfr->lock); 3554 lock_rw_unlock(&az->lock); 3555 3556 xfr_process_notify(xfr, env, 0, 0, NULL); 3557 return 1; 3558 } 3559 3560 /** set a zone expired */ 3561 static void 3562 auth_xfer_set_expired(struct auth_xfer* xfr, struct module_env* env, 3563 int expired) 3564 { 3565 struct auth_zone* z; 3566 3567 /* expire xfr */ 3568 lock_basic_lock(&xfr->lock); 3569 xfr->zone_expired = expired; 3570 lock_basic_unlock(&xfr->lock); 3571 3572 /* find auth_zone */ 3573 lock_rw_rdlock(&env->auth_zones->lock); 3574 z = auth_zone_find(env->auth_zones, xfr->name, xfr->namelen, 3575 xfr->dclass); 3576 if(!z) { 3577 lock_rw_unlock(&env->auth_zones->lock); 3578 return; 3579 } 3580 lock_rw_wrlock(&z->lock); 3581 lock_rw_unlock(&env->auth_zones->lock); 3582 3583 /* expire auth_zone */ 3584 z->zone_expired = expired; 3585 lock_rw_unlock(&z->lock); 3586 } 3587 3588 /** find master (from notify or probe) in list of masters */ 3589 static struct auth_master* 3590 find_master_by_host(struct auth_master* list, char* host) 3591 { 3592 struct auth_master* p; 3593 for(p=list; p; p=p->next) { 3594 if(strcmp(p->host, host) == 0) 3595 return p; 3596 } 3597 return NULL; 3598 } 3599 3600 /** delete the looked up auth_addrs for all the masters in the list */ 3601 static void 3602 xfr_masterlist_free_addrs(struct auth_master* list) 3603 { 3604 struct auth_master* m; 3605 for(m=list; m; m=m->next) { 3606 if(m->list) { 3607 auth_free_master_addrs(m->list); 3608 m->list = NULL; 3609 } 3610 } 3611 } 3612 3613 /** copy a list of auth_addrs */ 3614 static struct auth_addr* 3615 auth_addr_list_copy(struct auth_addr* source) 3616 { 3617 struct auth_addr* list = NULL, *last = NULL; 3618 struct auth_addr* p; 3619 for(p=source; p; p=p->next) { 3620 struct auth_addr* a = (struct auth_addr*)memdup(p, sizeof(*p)); 3621 if(!a) { 3622 log_err("malloc failure"); 3623 auth_free_master_addrs(list); 3624 return NULL; 3625 } 3626 a->next = NULL; 3627 if(last) last->next = a; 3628 if(!list) list = a; 3629 last = a; 3630 } 3631 return list; 3632 } 3633 3634 /** copy a master to a new structure, NULL on alloc failure */ 3635 static struct auth_master* 3636 auth_master_copy(struct auth_master* o) 3637 { 3638 struct auth_master* m; 3639 if(!o) return NULL; 3640 m = (struct auth_master*)memdup(o, sizeof(*o)); 3641 if(!m) { 3642 log_err("malloc failure"); 3643 return NULL; 3644 } 3645 m->next = NULL; 3646 if(m->host) { 3647 m->host = strdup(m->host); 3648 if(!m->host) { 3649 free(m); 3650 log_err("malloc failure"); 3651 return NULL; 3652 } 3653 } 3654 if(m->file) { 3655 m->file = strdup(m->file); 3656 if(!m->file) { 3657 free(m->host); 3658 free(m); 3659 log_err("malloc failure"); 3660 return NULL; 3661 } 3662 } 3663 if(m->list) { 3664 m->list = auth_addr_list_copy(m->list); 3665 if(!m->list) { 3666 free(m->file); 3667 free(m->host); 3668 free(m); 3669 return NULL; 3670 } 3671 } 3672 return m; 3673 } 3674 3675 /** copy the master addresses from the task_probe lookups to the allow_notify 3676 * list of masters */ 3677 static void 3678 probe_copy_masters_for_allow_notify(struct auth_xfer* xfr) 3679 { 3680 struct auth_master* list = NULL, *last = NULL; 3681 struct auth_master* p; 3682 /* build up new list with copies */ 3683 for(p = xfr->task_probe->masters; p; p=p->next) { 3684 struct auth_master* m = auth_master_copy(p); 3685 if(!m) { 3686 auth_free_masters(list); 3687 /* failed because of malloc failure, use old list */ 3688 return; 3689 } 3690 m->next = NULL; 3691 if(last) last->next = m; 3692 if(!list) list = m; 3693 last = m; 3694 } 3695 /* success, replace list */ 3696 auth_free_masters(xfr->allow_notify_list); 3697 xfr->allow_notify_list = list; 3698 } 3699 3700 /** start the lookups for task_transfer */ 3701 static void 3702 xfr_transfer_start_lookups(struct auth_xfer* xfr) 3703 { 3704 /* delete all the looked up addresses in the list */ 3705 xfr->task_transfer->scan_addr = NULL; 3706 xfr_masterlist_free_addrs(xfr->task_transfer->masters); 3707 3708 /* start lookup at the first master */ 3709 xfr->task_transfer->lookup_target = xfr->task_transfer->masters; 3710 xfr->task_transfer->lookup_aaaa = 0; 3711 } 3712 3713 /** move to the next lookup of hostname for task_transfer */ 3714 static void 3715 xfr_transfer_move_to_next_lookup(struct auth_xfer* xfr, struct module_env* env) 3716 { 3717 if(!xfr->task_transfer->lookup_target) 3718 return; /* already at end of list */ 3719 if(!xfr->task_transfer->lookup_aaaa && env->cfg->do_ip6) { 3720 /* move to lookup AAAA */ 3721 xfr->task_transfer->lookup_aaaa = 1; 3722 return; 3723 } 3724 xfr->task_transfer->lookup_target = 3725 xfr->task_transfer->lookup_target->next; 3726 xfr->task_transfer->lookup_aaaa = 0; 3727 if(!env->cfg->do_ip4 && xfr->task_transfer->lookup_target!=NULL) 3728 xfr->task_transfer->lookup_aaaa = 1; 3729 } 3730 3731 /** start the lookups for task_probe */ 3732 static void 3733 xfr_probe_start_lookups(struct auth_xfer* xfr) 3734 { 3735 /* delete all the looked up addresses in the list */ 3736 xfr->task_probe->scan_addr = NULL; 3737 xfr_masterlist_free_addrs(xfr->task_probe->masters); 3738 3739 /* start lookup at the first master */ 3740 xfr->task_probe->lookup_target = xfr->task_probe->masters; 3741 xfr->task_probe->lookup_aaaa = 0; 3742 } 3743 3744 /** move to the next lookup of hostname for task_probe */ 3745 static void 3746 xfr_probe_move_to_next_lookup(struct auth_xfer* xfr, struct module_env* env) 3747 { 3748 if(!xfr->task_probe->lookup_target) 3749 return; /* already at end of list */ 3750 if(!xfr->task_probe->lookup_aaaa && env->cfg->do_ip6) { 3751 /* move to lookup AAAA */ 3752 xfr->task_probe->lookup_aaaa = 1; 3753 return; 3754 } 3755 xfr->task_probe->lookup_target = xfr->task_probe->lookup_target->next; 3756 xfr->task_probe->lookup_aaaa = 0; 3757 if(!env->cfg->do_ip4 && xfr->task_probe->lookup_target!=NULL) 3758 xfr->task_probe->lookup_aaaa = 1; 3759 } 3760 3761 /** start the iteration of the task_transfer list of masters */ 3762 static void 3763 xfr_transfer_start_list(struct auth_xfer* xfr, struct auth_master* spec) 3764 { 3765 if(spec) { 3766 xfr->task_transfer->scan_specific = find_master_by_host( 3767 xfr->task_transfer->masters, spec->host); 3768 if(xfr->task_transfer->scan_specific) { 3769 xfr->task_transfer->scan_target = NULL; 3770 xfr->task_transfer->scan_addr = NULL; 3771 if(xfr->task_transfer->scan_specific->list) 3772 xfr->task_transfer->scan_addr = 3773 xfr->task_transfer->scan_specific->list; 3774 return; 3775 } 3776 } 3777 /* no specific (notified) host to scan */ 3778 xfr->task_transfer->scan_specific = NULL; 3779 xfr->task_transfer->scan_addr = NULL; 3780 /* pick up first scan target */ 3781 xfr->task_transfer->scan_target = xfr->task_transfer->masters; 3782 if(xfr->task_transfer->scan_target && xfr->task_transfer-> 3783 scan_target->list) 3784 xfr->task_transfer->scan_addr = 3785 xfr->task_transfer->scan_target->list; 3786 } 3787 3788 /** start the iteration of the task_probe list of masters */ 3789 static void 3790 xfr_probe_start_list(struct auth_xfer* xfr, struct auth_master* spec) 3791 { 3792 if(spec) { 3793 xfr->task_probe->scan_specific = find_master_by_host( 3794 xfr->task_probe->masters, spec->host); 3795 if(xfr->task_probe->scan_specific) { 3796 xfr->task_probe->scan_target = NULL; 3797 xfr->task_probe->scan_addr = NULL; 3798 if(xfr->task_probe->scan_specific->list) 3799 xfr->task_probe->scan_addr = 3800 xfr->task_probe->scan_specific->list; 3801 return; 3802 } 3803 } 3804 /* no specific (notified) host to scan */ 3805 xfr->task_probe->scan_specific = NULL; 3806 xfr->task_probe->scan_addr = NULL; 3807 /* pick up first scan target */ 3808 xfr->task_probe->scan_target = xfr->task_probe->masters; 3809 if(xfr->task_probe->scan_target && xfr->task_probe->scan_target->list) 3810 xfr->task_probe->scan_addr = 3811 xfr->task_probe->scan_target->list; 3812 } 3813 3814 /** pick up the master that is being scanned right now, task_transfer */ 3815 static struct auth_master* 3816 xfr_transfer_current_master(struct auth_xfer* xfr) 3817 { 3818 if(xfr->task_transfer->scan_specific) 3819 return xfr->task_transfer->scan_specific; 3820 return xfr->task_transfer->scan_target; 3821 } 3822 3823 /** pick up the master that is being scanned right now, task_probe */ 3824 static struct auth_master* 3825 xfr_probe_current_master(struct auth_xfer* xfr) 3826 { 3827 if(xfr->task_probe->scan_specific) 3828 return xfr->task_probe->scan_specific; 3829 return xfr->task_probe->scan_target; 3830 } 3831 3832 /** true if at end of list, task_transfer */ 3833 static int 3834 xfr_transfer_end_of_list(struct auth_xfer* xfr) 3835 { 3836 return !xfr->task_transfer->scan_specific && 3837 !xfr->task_transfer->scan_target; 3838 } 3839 3840 /** true if at end of list, task_probe */ 3841 static int 3842 xfr_probe_end_of_list(struct auth_xfer* xfr) 3843 { 3844 return !xfr->task_probe->scan_specific && !xfr->task_probe->scan_target; 3845 } 3846 3847 /** move to next master in list, task_transfer */ 3848 static void 3849 xfr_transfer_nextmaster(struct auth_xfer* xfr) 3850 { 3851 if(!xfr->task_transfer->scan_specific && 3852 !xfr->task_transfer->scan_target) 3853 return; 3854 if(xfr->task_transfer->scan_addr) { 3855 xfr->task_transfer->scan_addr = 3856 xfr->task_transfer->scan_addr->next; 3857 if(xfr->task_transfer->scan_addr) 3858 return; 3859 } 3860 if(xfr->task_transfer->scan_specific) { 3861 xfr->task_transfer->scan_specific = NULL; 3862 xfr->task_transfer->scan_target = xfr->task_transfer->masters; 3863 if(xfr->task_transfer->scan_target && xfr->task_transfer-> 3864 scan_target->list) 3865 xfr->task_transfer->scan_addr = 3866 xfr->task_transfer->scan_target->list; 3867 return; 3868 } 3869 if(!xfr->task_transfer->scan_target) 3870 return; 3871 xfr->task_transfer->scan_target = xfr->task_transfer->scan_target->next; 3872 if(xfr->task_transfer->scan_target && xfr->task_transfer-> 3873 scan_target->list) 3874 xfr->task_transfer->scan_addr = 3875 xfr->task_transfer->scan_target->list; 3876 return; 3877 } 3878 3879 /** move to next master in list, task_probe */ 3880 static void 3881 xfr_probe_nextmaster(struct auth_xfer* xfr) 3882 { 3883 if(!xfr->task_probe->scan_specific && !xfr->task_probe->scan_target) 3884 return; 3885 if(xfr->task_probe->scan_addr) { 3886 xfr->task_probe->scan_addr = xfr->task_probe->scan_addr->next; 3887 if(xfr->task_probe->scan_addr) 3888 return; 3889 } 3890 if(xfr->task_probe->scan_specific) { 3891 xfr->task_probe->scan_specific = NULL; 3892 xfr->task_probe->scan_target = xfr->task_probe->masters; 3893 if(xfr->task_probe->scan_target && xfr->task_probe-> 3894 scan_target->list) 3895 xfr->task_probe->scan_addr = 3896 xfr->task_probe->scan_target->list; 3897 return; 3898 } 3899 if(!xfr->task_probe->scan_target) 3900 return; 3901 xfr->task_probe->scan_target = xfr->task_probe->scan_target->next; 3902 if(xfr->task_probe->scan_target && xfr->task_probe-> 3903 scan_target->list) 3904 xfr->task_probe->scan_addr = 3905 xfr->task_probe->scan_target->list; 3906 return; 3907 } 3908 3909 /** create SOA probe packet for xfr */ 3910 static void 3911 xfr_create_soa_probe_packet(struct auth_xfer* xfr, sldns_buffer* buf, 3912 uint16_t id) 3913 { 3914 struct query_info qinfo; 3915 3916 memset(&qinfo, 0, sizeof(qinfo)); 3917 qinfo.qname = xfr->name; 3918 qinfo.qname_len = xfr->namelen; 3919 qinfo.qtype = LDNS_RR_TYPE_SOA; 3920 qinfo.qclass = xfr->dclass; 3921 qinfo_query_encode(buf, &qinfo); 3922 sldns_buffer_write_u16_at(buf, 0, id); 3923 } 3924 3925 /** create IXFR/AXFR packet for xfr */ 3926 static void 3927 xfr_create_ixfr_packet(struct auth_xfer* xfr, sldns_buffer* buf, uint16_t id, 3928 struct auth_master* master) 3929 { 3930 struct query_info qinfo; 3931 uint32_t serial; 3932 int have_zone; 3933 have_zone = xfr->have_zone; 3934 serial = xfr->serial; 3935 3936 memset(&qinfo, 0, sizeof(qinfo)); 3937 qinfo.qname = xfr->name; 3938 qinfo.qname_len = xfr->namelen; 3939 xfr->task_transfer->got_xfr_serial = 0; 3940 xfr->task_transfer->rr_scan_num = 0; 3941 xfr->task_transfer->incoming_xfr_serial = 0; 3942 xfr->task_transfer->on_ixfr_is_axfr = 0; 3943 xfr->task_transfer->on_ixfr = 1; 3944 qinfo.qtype = LDNS_RR_TYPE_IXFR; 3945 if(!have_zone || xfr->task_transfer->ixfr_fail || !master->ixfr) { 3946 qinfo.qtype = LDNS_RR_TYPE_AXFR; 3947 xfr->task_transfer->ixfr_fail = 0; 3948 xfr->task_transfer->on_ixfr = 0; 3949 } 3950 3951 qinfo.qclass = xfr->dclass; 3952 qinfo_query_encode(buf, &qinfo); 3953 sldns_buffer_write_u16_at(buf, 0, id); 3954 3955 /* append serial for IXFR */ 3956 if(qinfo.qtype == LDNS_RR_TYPE_IXFR) { 3957 size_t end = sldns_buffer_limit(buf); 3958 sldns_buffer_clear(buf); 3959 sldns_buffer_set_position(buf, end); 3960 /* auth section count 1 */ 3961 sldns_buffer_write_u16_at(buf, LDNS_NSCOUNT_OFF, 1); 3962 /* write SOA */ 3963 sldns_buffer_write_u8(buf, 0xC0); /* compressed ptr to qname */ 3964 sldns_buffer_write_u8(buf, 0x0C); 3965 sldns_buffer_write_u16(buf, LDNS_RR_TYPE_SOA); 3966 sldns_buffer_write_u16(buf, qinfo.qclass); 3967 sldns_buffer_write_u32(buf, 0); /* ttl */ 3968 sldns_buffer_write_u16(buf, 22); /* rdata length */ 3969 sldns_buffer_write_u8(buf, 0); /* . */ 3970 sldns_buffer_write_u8(buf, 0); /* . */ 3971 sldns_buffer_write_u32(buf, serial); /* serial */ 3972 sldns_buffer_write_u32(buf, 0); /* refresh */ 3973 sldns_buffer_write_u32(buf, 0); /* retry */ 3974 sldns_buffer_write_u32(buf, 0); /* expire */ 3975 sldns_buffer_write_u32(buf, 0); /* minimum */ 3976 sldns_buffer_flip(buf); 3977 } 3978 } 3979 3980 /** check if returned packet is OK */ 3981 static int 3982 check_packet_ok(sldns_buffer* pkt, uint16_t qtype, struct auth_xfer* xfr, 3983 uint32_t* serial) 3984 { 3985 /* parse to see if packet worked, valid reply */ 3986 3987 /* check serial number of SOA */ 3988 if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) 3989 return 0; 3990 3991 /* check ID */ 3992 if(LDNS_ID_WIRE(sldns_buffer_begin(pkt)) != xfr->task_probe->id) 3993 return 0; 3994 3995 /* check flag bits and rcode */ 3996 if(!LDNS_QR_WIRE(sldns_buffer_begin(pkt))) 3997 return 0; 3998 if(LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_QUERY) 3999 return 0; 4000 if(LDNS_RCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_RCODE_NOERROR) 4001 return 0; 4002 4003 /* check qname */ 4004 if(LDNS_QDCOUNT(sldns_buffer_begin(pkt)) != 1) 4005 return 0; 4006 sldns_buffer_skip(pkt, LDNS_HEADER_SIZE); 4007 if(sldns_buffer_remaining(pkt) < xfr->namelen) 4008 return 0; 4009 if(query_dname_compare(sldns_buffer_current(pkt), xfr->name) != 0) 4010 return 0; 4011 sldns_buffer_skip(pkt, (ssize_t)xfr->namelen); 4012 4013 /* check qtype, qclass */ 4014 if(sldns_buffer_remaining(pkt) < 4) 4015 return 0; 4016 if(sldns_buffer_read_u16(pkt) != qtype) 4017 return 0; 4018 if(sldns_buffer_read_u16(pkt) != xfr->dclass) 4019 return 0; 4020 4021 if(serial) { 4022 uint16_t rdlen; 4023 /* read serial number, from answer section SOA */ 4024 if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) == 0) 4025 return 0; 4026 /* read from first record SOA record */ 4027 if(sldns_buffer_remaining(pkt) < 1) 4028 return 0; 4029 if(dname_pkt_compare(pkt, sldns_buffer_current(pkt), 4030 xfr->name) != 0) 4031 return 0; 4032 if(!pkt_dname_len(pkt)) 4033 return 0; 4034 /* type, class, ttl, rdatalen */ 4035 if(sldns_buffer_remaining(pkt) < 4+4+2) 4036 return 0; 4037 if(sldns_buffer_read_u16(pkt) != qtype) 4038 return 0; 4039 if(sldns_buffer_read_u16(pkt) != xfr->dclass) 4040 return 0; 4041 sldns_buffer_skip(pkt, 4); /* ttl */ 4042 rdlen = sldns_buffer_read_u16(pkt); 4043 if(sldns_buffer_remaining(pkt) < rdlen) 4044 return 0; 4045 if(sldns_buffer_remaining(pkt) < 1) 4046 return 0; 4047 if(!pkt_dname_len(pkt)) /* soa name */ 4048 return 0; 4049 if(sldns_buffer_remaining(pkt) < 1) 4050 return 0; 4051 if(!pkt_dname_len(pkt)) /* soa name */ 4052 return 0; 4053 if(sldns_buffer_remaining(pkt) < 20) 4054 return 0; 4055 *serial = sldns_buffer_read_u32(pkt); 4056 } 4057 return 1; 4058 } 4059 4060 /** read one line from chunks into buffer at current position */ 4061 static int 4062 chunkline_get_line(struct auth_chunk** chunk, size_t* chunk_pos, 4063 sldns_buffer* buf) 4064 { 4065 int readsome = 0; 4066 while(*chunk) { 4067 /* more text in this chunk? */ 4068 if(*chunk_pos < (*chunk)->len) { 4069 readsome = 1; 4070 while(*chunk_pos < (*chunk)->len) { 4071 char c = (char)((*chunk)->data[*chunk_pos]); 4072 (*chunk_pos)++; 4073 if(sldns_buffer_remaining(buf) < 2) { 4074 /* buffer too short */ 4075 verbose(VERB_ALGO, "http chunkline, " 4076 "line too long"); 4077 return 0; 4078 } 4079 sldns_buffer_write_u8(buf, (uint8_t)c); 4080 if(c == '\n') { 4081 /* we are done */ 4082 return 1; 4083 } 4084 } 4085 } 4086 /* move to next chunk */ 4087 *chunk = (*chunk)->next; 4088 *chunk_pos = 0; 4089 } 4090 /* no more text */ 4091 if(readsome) return 1; 4092 return 0; 4093 } 4094 4095 /** count number of open and closed parenthesis in a chunkline */ 4096 static int 4097 chunkline_count_parens(sldns_buffer* buf, size_t start) 4098 { 4099 size_t end = sldns_buffer_position(buf); 4100 size_t i; 4101 int count = 0; 4102 int squote = 0, dquote = 0; 4103 for(i=start; i<end; i++) { 4104 char c = (char)sldns_buffer_read_u8_at(buf, i); 4105 if(squote && c != '\'') continue; 4106 if(dquote && c != '"') continue; 4107 if(c == '"') 4108 dquote = !dquote; /* skip quoted part */ 4109 else if(c == '\'') 4110 squote = !squote; /* skip quoted part */ 4111 else if(c == '(') 4112 count ++; 4113 else if(c == ')') 4114 count --; 4115 else if(c == ';') { 4116 /* rest is a comment */ 4117 return count; 4118 } 4119 } 4120 return count; 4121 } 4122 4123 /** remove trailing ;... comment from a line in the chunkline buffer */ 4124 static void 4125 chunkline_remove_trailcomment(sldns_buffer* buf, size_t start) 4126 { 4127 size_t end = sldns_buffer_position(buf); 4128 size_t i; 4129 int squote = 0, dquote = 0; 4130 for(i=start; i<end; i++) { 4131 char c = (char)sldns_buffer_read_u8_at(buf, i); 4132 if(squote && c != '\'') continue; 4133 if(dquote && c != '"') continue; 4134 if(c == '"') 4135 dquote = !dquote; /* skip quoted part */ 4136 else if(c == '\'') 4137 squote = !squote; /* skip quoted part */ 4138 else if(c == ';') { 4139 /* rest is a comment */ 4140 sldns_buffer_set_position(buf, i); 4141 return; 4142 } 4143 } 4144 /* nothing to remove */ 4145 } 4146 4147 /** see if a chunkline is a comment line (or empty line) */ 4148 static int 4149 chunkline_is_comment_line_or_empty(sldns_buffer* buf) 4150 { 4151 size_t i, end = sldns_buffer_limit(buf); 4152 for(i=0; i<end; i++) { 4153 char c = (char)sldns_buffer_read_u8_at(buf, i); 4154 if(c == ';') 4155 return 1; /* comment */ 4156 else if(c != ' ' && c != '\t' && c != '\r' && c != '\n') 4157 return 0; /* not a comment */ 4158 } 4159 return 1; /* empty */ 4160 } 4161 4162 /** find a line with ( ) collated */ 4163 static int 4164 chunkline_get_line_collated(struct auth_chunk** chunk, size_t* chunk_pos, 4165 sldns_buffer* buf) 4166 { 4167 size_t pos; 4168 int parens = 0; 4169 sldns_buffer_clear(buf); 4170 pos = sldns_buffer_position(buf); 4171 if(!chunkline_get_line(chunk, chunk_pos, buf)) { 4172 if(sldns_buffer_position(buf) < sldns_buffer_limit(buf)) 4173 sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0); 4174 else sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf)-1, 0); 4175 sldns_buffer_flip(buf); 4176 return 0; 4177 } 4178 parens += chunkline_count_parens(buf, pos); 4179 while(parens > 0) { 4180 chunkline_remove_trailcomment(buf, pos); 4181 pos = sldns_buffer_position(buf); 4182 if(!chunkline_get_line(chunk, chunk_pos, buf)) { 4183 if(sldns_buffer_position(buf) < sldns_buffer_limit(buf)) 4184 sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0); 4185 else sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf)-1, 0); 4186 sldns_buffer_flip(buf); 4187 return 0; 4188 } 4189 parens += chunkline_count_parens(buf, pos); 4190 } 4191 4192 if(sldns_buffer_remaining(buf) < 1) { 4193 verbose(VERB_ALGO, "http chunkline: " 4194 "line too long"); 4195 return 0; 4196 } 4197 sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0); 4198 sldns_buffer_flip(buf); 4199 return 1; 4200 } 4201 4202 /** process $ORIGIN for http */ 4203 static int 4204 http_parse_origin(sldns_buffer* buf, struct sldns_file_parse_state* pstate) 4205 { 4206 char* line = (char*)sldns_buffer_begin(buf); 4207 if(strncmp(line, "$ORIGIN", 7) == 0 && 4208 isspace((unsigned char)line[7])) { 4209 int s; 4210 pstate->origin_len = sizeof(pstate->origin); 4211 s = sldns_str2wire_dname_buf(sldns_strip_ws(line+8), 4212 pstate->origin, &pstate->origin_len); 4213 if(s) pstate->origin_len = 0; 4214 return 1; 4215 } 4216 return 0; 4217 } 4218 4219 /** process $TTL for http */ 4220 static int 4221 http_parse_ttl(sldns_buffer* buf, struct sldns_file_parse_state* pstate) 4222 { 4223 char* line = (char*)sldns_buffer_begin(buf); 4224 if(strncmp(line, "$TTL", 4) == 0 && 4225 isspace((unsigned char)line[4])) { 4226 const char* end = NULL; 4227 pstate->default_ttl = sldns_str2period( 4228 sldns_strip_ws(line+5), &end); 4229 return 1; 4230 } 4231 return 0; 4232 } 4233 4234 /** find noncomment RR line in chunks, collates lines if ( ) format */ 4235 static int 4236 chunkline_non_comment_RR(struct auth_chunk** chunk, size_t* chunk_pos, 4237 sldns_buffer* buf, struct sldns_file_parse_state* pstate) 4238 { 4239 while(chunkline_get_line_collated(chunk, chunk_pos, buf)) { 4240 if(chunkline_is_comment_line_or_empty(buf)) { 4241 /* a comment, go to next line */ 4242 continue; 4243 } 4244 if(http_parse_origin(buf, pstate)) { 4245 continue; /* $ORIGIN has been handled */ 4246 } 4247 if(http_parse_ttl(buf, pstate)) { 4248 continue; /* $TTL has been handled */ 4249 } 4250 return 1; 4251 } 4252 /* no noncomments, fail */ 4253 return 0; 4254 } 4255 4256 /** check syntax of chunklist zonefile, parse first RR, return false on 4257 * failure and return a string in the scratch buffer (first RR string) 4258 * on failure. */ 4259 static int 4260 http_zonefile_syntax_check(struct auth_xfer* xfr, sldns_buffer* buf) 4261 { 4262 uint8_t rr[LDNS_RR_BUF_SIZE]; 4263 size_t rr_len, dname_len = 0; 4264 struct sldns_file_parse_state pstate; 4265 struct auth_chunk* chunk; 4266 size_t chunk_pos; 4267 int e; 4268 memset(&pstate, 0, sizeof(pstate)); 4269 pstate.default_ttl = 3600; 4270 if(xfr->namelen < sizeof(pstate.origin)) { 4271 pstate.origin_len = xfr->namelen; 4272 memmove(pstate.origin, xfr->name, xfr->namelen); 4273 } 4274 chunk = xfr->task_transfer->chunks_first; 4275 chunk_pos = 0; 4276 if(!chunkline_non_comment_RR(&chunk, &chunk_pos, buf, &pstate)) { 4277 return 0; 4278 } 4279 rr_len = sizeof(rr); 4280 e=sldns_str2wire_rr_buf((char*)sldns_buffer_begin(buf), rr, &rr_len, 4281 &dname_len, pstate.default_ttl, 4282 pstate.origin_len?pstate.origin:NULL, pstate.origin_len, 4283 pstate.prev_rr_len?pstate.prev_rr:NULL, pstate.prev_rr_len); 4284 if(e != 0) { 4285 log_err("parse failure on first RR[%d]: %s", 4286 LDNS_WIREPARSE_OFFSET(e), 4287 sldns_get_errorstr_parse(LDNS_WIREPARSE_ERROR(e))); 4288 return 0; 4289 } 4290 /* check that class is correct */ 4291 if(sldns_wirerr_get_class(rr, rr_len, dname_len) != xfr->dclass) { 4292 log_err("parse failure: first record in downloaded zonefile " 4293 "from wrong RR class"); 4294 return 0; 4295 } 4296 return 1; 4297 } 4298 4299 /** sum sizes of chunklist */ 4300 static size_t 4301 chunklist_sum(struct auth_chunk* list) 4302 { 4303 struct auth_chunk* p; 4304 size_t s = 0; 4305 for(p=list; p; p=p->next) { 4306 s += p->len; 4307 } 4308 return s; 4309 } 4310 4311 /** remove newlines from collated line */ 4312 static void 4313 chunkline_newline_removal(sldns_buffer* buf) 4314 { 4315 size_t i, end=sldns_buffer_limit(buf); 4316 for(i=0; i<end; i++) { 4317 char c = (char)sldns_buffer_read_u8_at(buf, i); 4318 if(c == '\n' && i==end-1) { 4319 sldns_buffer_write_u8_at(buf, i, 0); 4320 sldns_buffer_set_limit(buf, end-1); 4321 return; 4322 } 4323 if(c == '\n') 4324 sldns_buffer_write_u8_at(buf, i, (uint8_t)' '); 4325 } 4326 } 4327 4328 /** for http download, parse and add RR to zone */ 4329 static int 4330 http_parse_add_rr(struct auth_xfer* xfr, struct auth_zone* z, 4331 sldns_buffer* buf, struct sldns_file_parse_state* pstate) 4332 { 4333 uint8_t rr[LDNS_RR_BUF_SIZE]; 4334 size_t rr_len, dname_len = 0; 4335 int e; 4336 char* line = (char*)sldns_buffer_begin(buf); 4337 rr_len = sizeof(rr); 4338 e = sldns_str2wire_rr_buf(line, rr, &rr_len, &dname_len, 4339 pstate->default_ttl, 4340 pstate->origin_len?pstate->origin:NULL, pstate->origin_len, 4341 pstate->prev_rr_len?pstate->prev_rr:NULL, pstate->prev_rr_len); 4342 if(e != 0) { 4343 log_err("%s/%s parse failure RR[%d]: %s in '%s'", 4344 xfr->task_transfer->master->host, 4345 xfr->task_transfer->master->file, 4346 LDNS_WIREPARSE_OFFSET(e), 4347 sldns_get_errorstr_parse(LDNS_WIREPARSE_ERROR(e)), 4348 line); 4349 return 0; 4350 } 4351 if(rr_len == 0) 4352 return 1; /* empty line or so */ 4353 4354 /* set prev */ 4355 if(dname_len < sizeof(pstate->prev_rr)) { 4356 memmove(pstate->prev_rr, rr, dname_len); 4357 pstate->prev_rr_len = dname_len; 4358 } 4359 4360 return az_insert_rr(z, rr, rr_len, dname_len, NULL); 4361 } 4362 4363 /** RR list iterator, returns RRs from answer section one by one from the 4364 * dns packets in the chunklist */ 4365 static void 4366 chunk_rrlist_start(struct auth_xfer* xfr, struct auth_chunk** rr_chunk, 4367 int* rr_num, size_t* rr_pos) 4368 { 4369 *rr_chunk = xfr->task_transfer->chunks_first; 4370 *rr_num = 0; 4371 *rr_pos = 0; 4372 } 4373 4374 /** RR list iterator, see if we are at the end of the list */ 4375 static int 4376 chunk_rrlist_end(struct auth_chunk* rr_chunk, int rr_num) 4377 { 4378 while(rr_chunk) { 4379 if(rr_chunk->len < LDNS_HEADER_SIZE) 4380 return 1; 4381 if(rr_num < (int)LDNS_ANCOUNT(rr_chunk->data)) 4382 return 0; 4383 /* no more RRs in this chunk */ 4384 /* continue with next chunk, see if it has RRs */ 4385 rr_chunk = rr_chunk->next; 4386 rr_num = 0; 4387 } 4388 return 1; 4389 } 4390 4391 /** RR list iterator, move to next RR */ 4392 static void 4393 chunk_rrlist_gonext(struct auth_chunk** rr_chunk, int* rr_num, 4394 size_t* rr_pos, size_t rr_nextpos) 4395 { 4396 /* already at end of chunks? */ 4397 if(!*rr_chunk) 4398 return; 4399 /* move within this chunk */ 4400 if((*rr_chunk)->len >= LDNS_HEADER_SIZE && 4401 (*rr_num)+1 < (int)LDNS_ANCOUNT((*rr_chunk)->data)) { 4402 (*rr_num) += 1; 4403 *rr_pos = rr_nextpos; 4404 return; 4405 } 4406 /* no more RRs in this chunk */ 4407 /* continue with next chunk, see if it has RRs */ 4408 if(*rr_chunk) 4409 *rr_chunk = (*rr_chunk)->next; 4410 while(*rr_chunk) { 4411 *rr_num = 0; 4412 *rr_pos = 0; 4413 if((*rr_chunk)->len >= LDNS_HEADER_SIZE && 4414 LDNS_ANCOUNT((*rr_chunk)->data) > 0) { 4415 return; 4416 } 4417 *rr_chunk = (*rr_chunk)->next; 4418 } 4419 } 4420 4421 /** RR iterator, get current RR information, false on parse error */ 4422 static int 4423 chunk_rrlist_get_current(struct auth_chunk* rr_chunk, int rr_num, 4424 size_t rr_pos, uint8_t** rr_dname, uint16_t* rr_type, 4425 uint16_t* rr_class, uint32_t* rr_ttl, uint16_t* rr_rdlen, 4426 uint8_t** rr_rdata, size_t* rr_nextpos) 4427 { 4428 sldns_buffer pkt; 4429 /* integrity checks on position */ 4430 if(!rr_chunk) return 0; 4431 if(rr_chunk->len < LDNS_HEADER_SIZE) return 0; 4432 if(rr_num >= (int)LDNS_ANCOUNT(rr_chunk->data)) return 0; 4433 if(rr_pos >= rr_chunk->len) return 0; 4434 4435 /* fetch rr information */ 4436 sldns_buffer_init_frm_data(&pkt, rr_chunk->data, rr_chunk->len); 4437 if(rr_pos == 0) { 4438 size_t i; 4439 /* skip question section */ 4440 sldns_buffer_set_position(&pkt, LDNS_HEADER_SIZE); 4441 for(i=0; i<LDNS_QDCOUNT(rr_chunk->data); i++) { 4442 if(pkt_dname_len(&pkt) == 0) return 0; 4443 if(sldns_buffer_remaining(&pkt) < 4) return 0; 4444 sldns_buffer_skip(&pkt, 4); /* type and class */ 4445 } 4446 } else { 4447 sldns_buffer_set_position(&pkt, rr_pos); 4448 } 4449 *rr_dname = sldns_buffer_current(&pkt); 4450 if(pkt_dname_len(&pkt) == 0) return 0; 4451 if(sldns_buffer_remaining(&pkt) < 10) return 0; 4452 *rr_type = sldns_buffer_read_u16(&pkt); 4453 *rr_class = sldns_buffer_read_u16(&pkt); 4454 *rr_ttl = sldns_buffer_read_u32(&pkt); 4455 *rr_rdlen = sldns_buffer_read_u16(&pkt); 4456 if(sldns_buffer_remaining(&pkt) < (*rr_rdlen)) return 0; 4457 *rr_rdata = sldns_buffer_current(&pkt); 4458 sldns_buffer_skip(&pkt, (ssize_t)(*rr_rdlen)); 4459 *rr_nextpos = sldns_buffer_position(&pkt); 4460 return 1; 4461 } 4462 4463 /** print log message where we are in parsing the zone transfer */ 4464 static void 4465 log_rrlist_position(const char* label, struct auth_chunk* rr_chunk, 4466 uint8_t* rr_dname, uint16_t rr_type, size_t rr_counter) 4467 { 4468 sldns_buffer pkt; 4469 size_t dlen; 4470 uint8_t buf[256]; 4471 char str[256]; 4472 char typestr[32]; 4473 sldns_buffer_init_frm_data(&pkt, rr_chunk->data, rr_chunk->len); 4474 sldns_buffer_set_position(&pkt, (size_t)(rr_dname - 4475 sldns_buffer_begin(&pkt))); 4476 if((dlen=pkt_dname_len(&pkt)) == 0) return; 4477 if(dlen >= sizeof(buf)) return; 4478 dname_pkt_copy(&pkt, buf, rr_dname); 4479 dname_str(buf, str); 4480 (void)sldns_wire2str_type_buf(rr_type, typestr, sizeof(typestr)); 4481 verbose(VERB_ALGO, "%s at[%d] %s %s", label, (int)rr_counter, 4482 str, typestr); 4483 } 4484 4485 /** check that start serial is OK for ixfr. we are at rr_counter == 0, 4486 * and we are going to check rr_counter == 1 (has to be type SOA) serial */ 4487 static int 4488 ixfr_start_serial(struct auth_chunk* rr_chunk, int rr_num, size_t rr_pos, 4489 uint8_t* rr_dname, uint16_t rr_type, uint16_t rr_class, 4490 uint32_t rr_ttl, uint16_t rr_rdlen, uint8_t* rr_rdata, 4491 size_t rr_nextpos, uint32_t transfer_serial, uint32_t xfr_serial) 4492 { 4493 uint32_t startserial; 4494 /* move forward on RR */ 4495 chunk_rrlist_gonext(&rr_chunk, &rr_num, &rr_pos, rr_nextpos); 4496 if(chunk_rrlist_end(rr_chunk, rr_num)) { 4497 /* no second SOA */ 4498 verbose(VERB_OPS, "IXFR has no second SOA record"); 4499 return 0; 4500 } 4501 if(!chunk_rrlist_get_current(rr_chunk, rr_num, rr_pos, 4502 &rr_dname, &rr_type, &rr_class, &rr_ttl, &rr_rdlen, 4503 &rr_rdata, &rr_nextpos)) { 4504 verbose(VERB_OPS, "IXFR cannot parse second SOA record"); 4505 /* failed to parse RR */ 4506 return 0; 4507 } 4508 if(rr_type != LDNS_RR_TYPE_SOA) { 4509 verbose(VERB_OPS, "IXFR second record is not type SOA"); 4510 return 0; 4511 } 4512 if(rr_rdlen < 22) { 4513 verbose(VERB_OPS, "IXFR, second SOA has short rdlength"); 4514 return 0; /* bad SOA rdlen */ 4515 } 4516 startserial = sldns_read_uint32(rr_rdata+rr_rdlen-20); 4517 if(startserial == transfer_serial) { 4518 /* empty AXFR, not an IXFR */ 4519 verbose(VERB_OPS, "IXFR second serial same as first"); 4520 return 0; 4521 } 4522 if(startserial != xfr_serial) { 4523 /* wrong start serial, it does not match the serial in 4524 * memory */ 4525 verbose(VERB_OPS, "IXFR is from serial %u to %u but %u " 4526 "in memory, rejecting the zone transfer", 4527 (unsigned)startserial, (unsigned)transfer_serial, 4528 (unsigned)xfr_serial); 4529 return 0; 4530 } 4531 /* everything OK in second SOA serial */ 4532 return 1; 4533 } 4534 4535 /** apply IXFR to zone in memory. z is locked. false on failure(mallocfail) */ 4536 static int 4537 apply_ixfr(struct auth_xfer* xfr, struct auth_zone* z, 4538 struct sldns_buffer* scratch_buffer) 4539 { 4540 struct auth_chunk* rr_chunk; 4541 int rr_num; 4542 size_t rr_pos; 4543 uint8_t* rr_dname, *rr_rdata; 4544 uint16_t rr_type, rr_class, rr_rdlen; 4545 uint32_t rr_ttl; 4546 size_t rr_nextpos; 4547 int have_transfer_serial = 0; 4548 uint32_t transfer_serial = 0; 4549 size_t rr_counter = 0; 4550 int delmode = 0; 4551 int softfail = 0; 4552 4553 /* start RR iterator over chunklist of packets */ 4554 chunk_rrlist_start(xfr, &rr_chunk, &rr_num, &rr_pos); 4555 while(!chunk_rrlist_end(rr_chunk, rr_num)) { 4556 if(!chunk_rrlist_get_current(rr_chunk, rr_num, rr_pos, 4557 &rr_dname, &rr_type, &rr_class, &rr_ttl, &rr_rdlen, 4558 &rr_rdata, &rr_nextpos)) { 4559 /* failed to parse RR */ 4560 return 0; 4561 } 4562 if(verbosity>=7) log_rrlist_position("apply ixfr", 4563 rr_chunk, rr_dname, rr_type, rr_counter); 4564 /* twiddle add/del mode and check for start and end */ 4565 if(rr_counter == 0 && rr_type != LDNS_RR_TYPE_SOA) 4566 return 0; 4567 if(rr_counter == 1 && rr_type != LDNS_RR_TYPE_SOA) { 4568 /* this is an AXFR returned from the IXFR master */ 4569 /* but that should already have been detected, by 4570 * on_ixfr_is_axfr */ 4571 return 0; 4572 } 4573 if(rr_type == LDNS_RR_TYPE_SOA) { 4574 uint32_t serial; 4575 if(rr_rdlen < 22) return 0; /* bad SOA rdlen */ 4576 serial = sldns_read_uint32(rr_rdata+rr_rdlen-20); 4577 if(have_transfer_serial == 0) { 4578 have_transfer_serial = 1; 4579 transfer_serial = serial; 4580 delmode = 1; /* gets negated below */ 4581 /* check second RR before going any further */ 4582 if(!ixfr_start_serial(rr_chunk, rr_num, rr_pos, 4583 rr_dname, rr_type, rr_class, rr_ttl, 4584 rr_rdlen, rr_rdata, rr_nextpos, 4585 transfer_serial, xfr->serial)) { 4586 return 0; 4587 } 4588 } else if(transfer_serial == serial) { 4589 have_transfer_serial++; 4590 if(rr_counter == 1) { 4591 /* empty AXFR, with SOA; SOA; */ 4592 /* should have been detected by 4593 * on_ixfr_is_axfr */ 4594 return 0; 4595 } 4596 if(have_transfer_serial == 3) { 4597 /* see serial three times for end */ 4598 /* eg. IXFR: 4599 * SOA 3 start 4600 * SOA 1 second RR, followed by del 4601 * SOA 2 followed by add 4602 * SOA 2 followed by del 4603 * SOA 3 followed by add 4604 * SOA 3 end */ 4605 /* ended by SOA record */ 4606 xfr->serial = transfer_serial; 4607 break; 4608 } 4609 } 4610 /* twiddle add/del mode */ 4611 /* switch from delete part to add part and back again 4612 * just before the soa, it gets deleted and added too 4613 * this means we switch to delete mode for the final 4614 * SOA(so skip that one) */ 4615 delmode = !delmode; 4616 } 4617 /* process this RR */ 4618 /* if the RR is deleted twice or added twice, then we 4619 * softfail, and continue with the rest of the IXFR, so 4620 * that we serve something fairly nice during the refetch */ 4621 if(verbosity>=7) log_rrlist_position((delmode?"del":"add"), 4622 rr_chunk, rr_dname, rr_type, rr_counter); 4623 if(delmode) { 4624 /* delete this RR */ 4625 int nonexist = 0; 4626 if(!az_remove_rr_decompress(z, rr_chunk->data, 4627 rr_chunk->len, scratch_buffer, rr_dname, 4628 rr_type, rr_class, rr_ttl, rr_rdata, rr_rdlen, 4629 &nonexist)) { 4630 /* failed, malloc error or so */ 4631 return 0; 4632 } 4633 if(nonexist) { 4634 /* it was removal of a nonexisting RR */ 4635 if(verbosity>=4) log_rrlist_position( 4636 "IXFR error nonexistent RR", 4637 rr_chunk, rr_dname, rr_type, rr_counter); 4638 softfail = 1; 4639 } 4640 } else if(rr_counter != 0) { 4641 /* skip first SOA RR for addition, it is added in 4642 * the addition part near the end of the ixfr, when 4643 * that serial is seen the second time. */ 4644 int duplicate = 0; 4645 /* add this RR */ 4646 if(!az_insert_rr_decompress(z, rr_chunk->data, 4647 rr_chunk->len, scratch_buffer, rr_dname, 4648 rr_type, rr_class, rr_ttl, rr_rdata, rr_rdlen, 4649 &duplicate)) { 4650 /* failed, malloc error or so */ 4651 return 0; 4652 } 4653 if(duplicate) { 4654 /* it was a duplicate */ 4655 if(verbosity>=4) log_rrlist_position( 4656 "IXFR error duplicate RR", 4657 rr_chunk, rr_dname, rr_type, rr_counter); 4658 softfail = 1; 4659 } 4660 } 4661 4662 rr_counter++; 4663 chunk_rrlist_gonext(&rr_chunk, &rr_num, &rr_pos, rr_nextpos); 4664 } 4665 if(softfail) { 4666 verbose(VERB_ALGO, "IXFR did not apply cleanly, fetching full zone"); 4667 return 0; 4668 } 4669 return 1; 4670 } 4671 4672 /** apply AXFR to zone in memory. z is locked. false on failure(mallocfail) */ 4673 static int 4674 apply_axfr(struct auth_xfer* xfr, struct auth_zone* z, 4675 struct sldns_buffer* scratch_buffer) 4676 { 4677 struct auth_chunk* rr_chunk; 4678 int rr_num; 4679 size_t rr_pos; 4680 uint8_t* rr_dname, *rr_rdata; 4681 uint16_t rr_type, rr_class, rr_rdlen; 4682 uint32_t rr_ttl; 4683 uint32_t serial = 0; 4684 size_t rr_nextpos; 4685 size_t rr_counter = 0; 4686 int have_end_soa = 0; 4687 4688 /* clear the data tree */ 4689 traverse_postorder(&z->data, auth_data_del, NULL); 4690 rbtree_init(&z->data, &auth_data_cmp); 4691 xfr->have_zone = 0; 4692 xfr->serial = 0; 4693 4694 /* insert all RRs in to the zone */ 4695 /* insert the SOA only once, skip the last one */ 4696 /* start RR iterator over chunklist of packets */ 4697 chunk_rrlist_start(xfr, &rr_chunk, &rr_num, &rr_pos); 4698 while(!chunk_rrlist_end(rr_chunk, rr_num)) { 4699 if(!chunk_rrlist_get_current(rr_chunk, rr_num, rr_pos, 4700 &rr_dname, &rr_type, &rr_class, &rr_ttl, &rr_rdlen, 4701 &rr_rdata, &rr_nextpos)) { 4702 /* failed to parse RR */ 4703 return 0; 4704 } 4705 if(verbosity>=7) log_rrlist_position("apply_axfr", 4706 rr_chunk, rr_dname, rr_type, rr_counter); 4707 if(rr_type == LDNS_RR_TYPE_SOA) { 4708 if(rr_counter != 0) { 4709 /* end of the axfr */ 4710 have_end_soa = 1; 4711 break; 4712 } 4713 if(rr_rdlen < 22) return 0; /* bad SOA rdlen */ 4714 serial = sldns_read_uint32(rr_rdata+rr_rdlen-20); 4715 } 4716 4717 /* add this RR */ 4718 if(!az_insert_rr_decompress(z, rr_chunk->data, rr_chunk->len, 4719 scratch_buffer, rr_dname, rr_type, rr_class, rr_ttl, 4720 rr_rdata, rr_rdlen, NULL)) { 4721 /* failed, malloc error or so */ 4722 return 0; 4723 } 4724 4725 rr_counter++; 4726 chunk_rrlist_gonext(&rr_chunk, &rr_num, &rr_pos, rr_nextpos); 4727 } 4728 if(!have_end_soa) { 4729 log_err("no end SOA record for AXFR"); 4730 return 0; 4731 } 4732 4733 xfr->serial = serial; 4734 xfr->have_zone = 1; 4735 return 1; 4736 } 4737 4738 /** apply HTTP to zone in memory. z is locked. false on failure(mallocfail) */ 4739 static int 4740 apply_http(struct auth_xfer* xfr, struct auth_zone* z, 4741 struct sldns_buffer* scratch_buffer) 4742 { 4743 /* parse data in chunks */ 4744 /* parse RR's and read into memory. ignore $INCLUDE from the 4745 * downloaded file*/ 4746 struct sldns_file_parse_state pstate; 4747 struct auth_chunk* chunk; 4748 size_t chunk_pos; 4749 memset(&pstate, 0, sizeof(pstate)); 4750 pstate.default_ttl = 3600; 4751 if(xfr->namelen < sizeof(pstate.origin)) { 4752 pstate.origin_len = xfr->namelen; 4753 memmove(pstate.origin, xfr->name, xfr->namelen); 4754 } 4755 4756 if(verbosity >= VERB_ALGO) 4757 verbose(VERB_ALGO, "http download %s of size %d", 4758 xfr->task_transfer->master->file, 4759 (int)chunklist_sum(xfr->task_transfer->chunks_first)); 4760 if(xfr->task_transfer->chunks_first && verbosity >= VERB_ALGO) { 4761 char preview[1024]; 4762 if(xfr->task_transfer->chunks_first->len+1 > sizeof(preview)) { 4763 memmove(preview, xfr->task_transfer->chunks_first->data, 4764 sizeof(preview)-1); 4765 preview[sizeof(preview)-1]=0; 4766 } else { 4767 memmove(preview, xfr->task_transfer->chunks_first->data, 4768 xfr->task_transfer->chunks_first->len); 4769 preview[xfr->task_transfer->chunks_first->len]=0; 4770 } 4771 log_info("auth zone http downloaded content preview: %s", 4772 preview); 4773 } 4774 4775 /* perhaps a little syntax check before we try to apply the data? */ 4776 if(!http_zonefile_syntax_check(xfr, scratch_buffer)) { 4777 log_err("http download %s/%s does not contain a zonefile, " 4778 "but got '%s'", xfr->task_transfer->master->host, 4779 xfr->task_transfer->master->file, 4780 sldns_buffer_begin(scratch_buffer)); 4781 return 0; 4782 } 4783 4784 /* clear the data tree */ 4785 traverse_postorder(&z->data, auth_data_del, NULL); 4786 rbtree_init(&z->data, &auth_data_cmp); 4787 xfr->have_zone = 0; 4788 xfr->serial = 0; 4789 4790 chunk = xfr->task_transfer->chunks_first; 4791 chunk_pos = 0; 4792 pstate.lineno = 0; 4793 while(chunkline_get_line_collated(&chunk, &chunk_pos, scratch_buffer)) { 4794 /* process this line */ 4795 pstate.lineno++; 4796 chunkline_newline_removal(scratch_buffer); 4797 if(chunkline_is_comment_line_or_empty(scratch_buffer)) { 4798 continue; 4799 } 4800 /* parse line and add RR */ 4801 if(http_parse_origin(scratch_buffer, &pstate)) { 4802 continue; /* $ORIGIN has been handled */ 4803 } 4804 if(http_parse_ttl(scratch_buffer, &pstate)) { 4805 continue; /* $TTL has been handled */ 4806 } 4807 if(!http_parse_add_rr(xfr, z, scratch_buffer, &pstate)) { 4808 verbose(VERB_ALGO, "error parsing line [%s:%d] %s", 4809 xfr->task_transfer->master->file, 4810 pstate.lineno, 4811 sldns_buffer_begin(scratch_buffer)); 4812 return 0; 4813 } 4814 } 4815 return 1; 4816 } 4817 4818 /** write http chunks to zonefile to create downloaded file */ 4819 static int 4820 auth_zone_write_chunks(struct auth_xfer* xfr, const char* fname) 4821 { 4822 FILE* out; 4823 struct auth_chunk* p; 4824 out = fopen(fname, "w"); 4825 if(!out) { 4826 log_err("could not open %s: %s", fname, strerror(errno)); 4827 return 0; 4828 } 4829 for(p = xfr->task_transfer->chunks_first; p ; p = p->next) { 4830 if(!write_out(out, (char*)p->data, p->len)) { 4831 log_err("could not write http download to %s", fname); 4832 fclose(out); 4833 return 0; 4834 } 4835 } 4836 fclose(out); 4837 return 1; 4838 } 4839 4840 /** write to zonefile after zone has been updated */ 4841 static void 4842 xfr_write_after_update(struct auth_xfer* xfr, struct module_env* env) 4843 { 4844 struct config_file* cfg = env->cfg; 4845 struct auth_zone* z; 4846 char tmpfile[1024]; 4847 char* zfilename; 4848 lock_basic_unlock(&xfr->lock); 4849 4850 /* get lock again, so it is a readlock and concurrently queries 4851 * can be answered */ 4852 lock_rw_rdlock(&env->auth_zones->lock); 4853 z = auth_zone_find(env->auth_zones, xfr->name, xfr->namelen, 4854 xfr->dclass); 4855 if(!z) { 4856 lock_rw_unlock(&env->auth_zones->lock); 4857 /* the zone is gone, ignore xfr results */ 4858 lock_basic_lock(&xfr->lock); 4859 return; 4860 } 4861 lock_rw_rdlock(&z->lock); 4862 lock_basic_lock(&xfr->lock); 4863 lock_rw_unlock(&env->auth_zones->lock); 4864 4865 if(z->zonefile == NULL || z->zonefile[0] == 0) { 4866 lock_rw_unlock(&z->lock); 4867 /* no write needed, no zonefile set */ 4868 return; 4869 } 4870 zfilename = z->zonefile; 4871 if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(zfilename, 4872 cfg->chrootdir, strlen(cfg->chrootdir)) == 0) 4873 zfilename += strlen(cfg->chrootdir); 4874 if(verbosity >= VERB_ALGO) { 4875 char nm[255+1]; 4876 dname_str(z->name, nm); 4877 verbose(VERB_ALGO, "write zonefile %s for %s", zfilename, nm); 4878 } 4879 4880 /* write to tempfile first */ 4881 if((size_t)strlen(zfilename) + 16 > sizeof(tmpfile)) { 4882 verbose(VERB_ALGO, "tmpfilename too long, cannot update " 4883 " zonefile %s", zfilename); 4884 lock_rw_unlock(&z->lock); 4885 return; 4886 } 4887 snprintf(tmpfile, sizeof(tmpfile), "%s.tmp%u", zfilename, 4888 (unsigned)getpid()); 4889 if(xfr->task_transfer->master->http) { 4890 /* use the stored chunk list to write them */ 4891 if(!auth_zone_write_chunks(xfr, tmpfile)) { 4892 unlink(tmpfile); 4893 lock_rw_unlock(&z->lock); 4894 return; 4895 } 4896 } else if(!auth_zone_write_file(z, tmpfile)) { 4897 unlink(tmpfile); 4898 lock_rw_unlock(&z->lock); 4899 return; 4900 } 4901 if(rename(tmpfile, zfilename) < 0) { 4902 log_err("could not rename(%s, %s): %s", tmpfile, zfilename, 4903 strerror(errno)); 4904 unlink(tmpfile); 4905 lock_rw_unlock(&z->lock); 4906 return; 4907 } 4908 lock_rw_unlock(&z->lock); 4909 } 4910 4911 /** process chunk list and update zone in memory, 4912 * return false if it did not work */ 4913 static int 4914 xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env, 4915 int* ixfr_fail) 4916 { 4917 struct auth_zone* z; 4918 4919 /* obtain locks and structures */ 4920 /* release xfr lock, then, while holding az->lock grab both 4921 * z->lock and xfr->lock */ 4922 lock_basic_unlock(&xfr->lock); 4923 lock_rw_rdlock(&env->auth_zones->lock); 4924 z = auth_zone_find(env->auth_zones, xfr->name, xfr->namelen, 4925 xfr->dclass); 4926 if(!z) { 4927 lock_rw_unlock(&env->auth_zones->lock); 4928 /* the zone is gone, ignore xfr results */ 4929 lock_basic_lock(&xfr->lock); 4930 return 0; 4931 } 4932 lock_rw_wrlock(&z->lock); 4933 lock_basic_lock(&xfr->lock); 4934 lock_rw_unlock(&env->auth_zones->lock); 4935 4936 /* apply data */ 4937 if(xfr->task_transfer->master->http) { 4938 if(!apply_http(xfr, z, env->scratch_buffer)) { 4939 lock_rw_unlock(&z->lock); 4940 verbose(VERB_ALGO, "http from %s: could not store data", 4941 xfr->task_transfer->master->host); 4942 return 0; 4943 } 4944 } else if(xfr->task_transfer->on_ixfr && 4945 !xfr->task_transfer->on_ixfr_is_axfr) { 4946 if(!apply_ixfr(xfr, z, env->scratch_buffer)) { 4947 lock_rw_unlock(&z->lock); 4948 verbose(VERB_ALGO, "xfr from %s: could not store IXFR" 4949 " data", xfr->task_transfer->master->host); 4950 *ixfr_fail = 1; 4951 return 0; 4952 } 4953 } else { 4954 if(!apply_axfr(xfr, z, env->scratch_buffer)) { 4955 lock_rw_unlock(&z->lock); 4956 verbose(VERB_ALGO, "xfr from %s: could not store AXFR" 4957 " data", xfr->task_transfer->master->host); 4958 return 0; 4959 } 4960 } 4961 xfr->zone_expired = 0; 4962 z->zone_expired = 0; 4963 if(!xfr_find_soa(z, xfr)) { 4964 lock_rw_unlock(&z->lock); 4965 verbose(VERB_ALGO, "xfr from %s: no SOA in zone after update" 4966 " (or malformed RR)", xfr->task_transfer->master->host); 4967 return 0; 4968 } 4969 if(xfr->have_zone) 4970 xfr->lease_time = *env->now; 4971 4972 /* unlock */ 4973 lock_rw_unlock(&z->lock); 4974 4975 if(verbosity >= VERB_QUERY && xfr->have_zone) { 4976 char zname[256]; 4977 dname_str(xfr->name, zname); 4978 verbose(VERB_QUERY, "auth zone %s updated to serial %u", zname, 4979 (unsigned)xfr->serial); 4980 } 4981 /* see if we need to write to a zonefile */ 4982 xfr_write_after_update(xfr, env); 4983 return 1; 4984 } 4985 4986 /** disown task_transfer. caller must hold xfr.lock */ 4987 static void 4988 xfr_transfer_disown(struct auth_xfer* xfr) 4989 { 4990 /* remove timer (from this worker's event base) */ 4991 comm_timer_delete(xfr->task_transfer->timer); 4992 xfr->task_transfer->timer = NULL; 4993 /* remove the commpoint */ 4994 comm_point_delete(xfr->task_transfer->cp); 4995 xfr->task_transfer->cp = NULL; 4996 /* we don't own this item anymore */ 4997 xfr->task_transfer->worker = NULL; 4998 xfr->task_transfer->env = NULL; 4999 } 5000 5001 /** lookup a host name for its addresses, if needed */ 5002 static int 5003 xfr_transfer_lookup_host(struct auth_xfer* xfr, struct module_env* env) 5004 { 5005 struct sockaddr_storage addr; 5006 socklen_t addrlen = 0; 5007 struct auth_master* master = xfr->task_transfer->lookup_target; 5008 struct query_info qinfo; 5009 uint16_t qflags = BIT_RD; 5010 uint8_t dname[LDNS_MAX_DOMAINLEN+1]; 5011 struct edns_data edns; 5012 sldns_buffer* buf = env->scratch_buffer; 5013 if(!master) return 0; 5014 if(extstrtoaddr(master->host, &addr, &addrlen)) { 5015 /* not needed, host is in IP addr format */ 5016 return 0; 5017 } 5018 if(master->allow_notify) 5019 return 0; /* allow-notifies are not transferred from, no 5020 lookup is needed */ 5021 5022 /* use mesh_new_callback to probe for non-addr hosts, 5023 * and then wait for them to be looked up (in cache, or query) */ 5024 qinfo.qname_len = sizeof(dname); 5025 if(sldns_str2wire_dname_buf(master->host, dname, &qinfo.qname_len) 5026 != 0) { 5027 log_err("cannot parse host name of master %s", master->host); 5028 return 0; 5029 } 5030 qinfo.qname = dname; 5031 qinfo.qclass = xfr->dclass; 5032 qinfo.qtype = LDNS_RR_TYPE_A; 5033 if(xfr->task_transfer->lookup_aaaa) 5034 qinfo.qtype = LDNS_RR_TYPE_AAAA; 5035 qinfo.local_alias = NULL; 5036 if(verbosity >= VERB_ALGO) { 5037 char buf1[512]; 5038 char buf2[LDNS_MAX_DOMAINLEN+1]; 5039 dname_str(xfr->name, buf2); 5040 snprintf(buf1, sizeof(buf1), "auth zone %s: master lookup" 5041 " for task_transfer", buf2); 5042 log_query_info(VERB_ALGO, buf1, &qinfo); 5043 } 5044 edns.edns_present = 1; 5045 edns.ext_rcode = 0; 5046 edns.edns_version = 0; 5047 edns.bits = EDNS_DO; 5048 edns.opt_list = NULL; 5049 if(sldns_buffer_capacity(buf) < 65535) 5050 edns.udp_size = (uint16_t)sldns_buffer_capacity(buf); 5051 else edns.udp_size = 65535; 5052 5053 /* unlock xfr during mesh_new_callback() because the callback can be 5054 * called straight away */ 5055 lock_basic_unlock(&xfr->lock); 5056 if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0, 5057 &auth_xfer_transfer_lookup_callback, xfr)) { 5058 lock_basic_lock(&xfr->lock); 5059 log_err("out of memory lookup up master %s", master->host); 5060 return 0; 5061 } 5062 lock_basic_lock(&xfr->lock); 5063 return 1; 5064 } 5065 5066 /** initiate TCP to the target and fetch zone. 5067 * returns true if that was successfully started, and timeout setup. */ 5068 static int 5069 xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env) 5070 { 5071 struct sockaddr_storage addr; 5072 socklen_t addrlen = 0; 5073 struct auth_master* master = xfr->task_transfer->master; 5074 char *auth_name = NULL; 5075 struct timeval t; 5076 int timeout; 5077 if(!master) return 0; 5078 if(master->allow_notify) return 0; /* only for notify */ 5079 5080 /* get master addr */ 5081 if(xfr->task_transfer->scan_addr) { 5082 addrlen = xfr->task_transfer->scan_addr->addrlen; 5083 memmove(&addr, &xfr->task_transfer->scan_addr->addr, addrlen); 5084 } else { 5085 if(!authextstrtoaddr(master->host, &addr, &addrlen, &auth_name)) { 5086 /* the ones that are not in addr format are supposed 5087 * to be looked up. The lookup has failed however, 5088 * so skip them */ 5089 char zname[255+1]; 5090 dname_str(xfr->name, zname); 5091 log_err("%s: failed lookup, cannot transfer from master %s", 5092 zname, master->host); 5093 return 0; 5094 } 5095 } 5096 5097 /* remove previous TCP connection (if any) */ 5098 if(xfr->task_transfer->cp) { 5099 comm_point_delete(xfr->task_transfer->cp); 5100 xfr->task_transfer->cp = NULL; 5101 } 5102 if(!xfr->task_transfer->timer) { 5103 xfr->task_transfer->timer = comm_timer_create(env->worker_base, 5104 auth_xfer_transfer_timer_callback, xfr); 5105 if(!xfr->task_transfer->timer) { 5106 log_err("malloc failure"); 5107 return 0; 5108 } 5109 } 5110 timeout = AUTH_TRANSFER_TIMEOUT; 5111 #ifndef S_SPLINT_S 5112 t.tv_sec = timeout/1000; 5113 t.tv_usec = (timeout%1000)*1000; 5114 #endif 5115 5116 if(master->http) { 5117 /* perform http fetch */ 5118 /* store http port number into sockaddr, 5119 * unless someone used unbound's host@port notation */ 5120 xfr->task_transfer->on_ixfr = 0; 5121 if(strchr(master->host, '@') == NULL) 5122 sockaddr_store_port(&addr, addrlen, master->port); 5123 xfr->task_transfer->cp = outnet_comm_point_for_http( 5124 env->outnet, auth_xfer_transfer_http_callback, xfr, 5125 &addr, addrlen, -1, master->ssl, master->host, 5126 master->file); 5127 if(!xfr->task_transfer->cp) { 5128 char zname[255+1], as[256]; 5129 dname_str(xfr->name, zname); 5130 addr_to_str(&addr, addrlen, as, sizeof(as)); 5131 verbose(VERB_ALGO, "cannot create http cp " 5132 "connection for %s to %s", zname, as); 5133 return 0; 5134 } 5135 comm_timer_set(xfr->task_transfer->timer, &t); 5136 if(verbosity >= VERB_ALGO) { 5137 char zname[255+1], as[256]; 5138 dname_str(xfr->name, zname); 5139 addr_to_str(&addr, addrlen, as, sizeof(as)); 5140 verbose(VERB_ALGO, "auth zone %s transfer next HTTP fetch from %s started", zname, as); 5141 } 5142 return 1; 5143 } 5144 5145 /* perform AXFR/IXFR */ 5146 /* set the packet to be written */ 5147 /* create new ID */ 5148 xfr->task_transfer->id = (uint16_t)(ub_random(env->rnd)&0xffff); 5149 xfr_create_ixfr_packet(xfr, env->scratch_buffer, 5150 xfr->task_transfer->id, master); 5151 5152 /* connect on fd */ 5153 xfr->task_transfer->cp = outnet_comm_point_for_tcp(env->outnet, 5154 auth_xfer_transfer_tcp_callback, xfr, &addr, addrlen, 5155 env->scratch_buffer, -1, 5156 auth_name != NULL, auth_name); 5157 if(!xfr->task_transfer->cp) { 5158 char zname[255+1], as[256]; 5159 dname_str(xfr->name, zname); 5160 addr_to_str(&addr, addrlen, as, sizeof(as)); 5161 verbose(VERB_ALGO, "cannot create tcp cp connection for " 5162 "xfr %s to %s", zname, as); 5163 return 0; 5164 } 5165 comm_timer_set(xfr->task_transfer->timer, &t); 5166 if(verbosity >= VERB_ALGO) { 5167 char zname[255+1], as[256]; 5168 dname_str(xfr->name, zname); 5169 addr_to_str(&addr, addrlen, as, sizeof(as)); 5170 verbose(VERB_ALGO, "auth zone %s transfer next %s fetch from %s started", zname, 5171 (xfr->task_transfer->on_ixfr?"IXFR":"AXFR"), as); 5172 } 5173 return 1; 5174 } 5175 5176 /** perform next lookup, next transfer TCP, or end and resume wait time task */ 5177 static void 5178 xfr_transfer_nexttarget_or_end(struct auth_xfer* xfr, struct module_env* env) 5179 { 5180 log_assert(xfr->task_transfer->worker == env->worker); 5181 5182 /* are we performing lookups? */ 5183 while(xfr->task_transfer->lookup_target) { 5184 if(xfr_transfer_lookup_host(xfr, env)) { 5185 /* wait for lookup to finish, 5186 * note that the hostname may be in unbound's cache 5187 * and we may then get an instant cache response, 5188 * and that calls the callback just like a full 5189 * lookup and lookup failures also call callback */ 5190 if(verbosity >= VERB_ALGO) { 5191 char zname[255+1]; 5192 dname_str(xfr->name, zname); 5193 verbose(VERB_ALGO, "auth zone %s transfer next target lookup", zname); 5194 } 5195 lock_basic_unlock(&xfr->lock); 5196 return; 5197 } 5198 xfr_transfer_move_to_next_lookup(xfr, env); 5199 } 5200 5201 /* initiate TCP and fetch the zone from the master */ 5202 /* and set timeout on it */ 5203 while(!xfr_transfer_end_of_list(xfr)) { 5204 xfr->task_transfer->master = xfr_transfer_current_master(xfr); 5205 if(xfr_transfer_init_fetch(xfr, env)) { 5206 /* successfully started, wait for callback */ 5207 lock_basic_unlock(&xfr->lock); 5208 return; 5209 } 5210 /* failed to fetch, next master */ 5211 xfr_transfer_nextmaster(xfr); 5212 } 5213 if(verbosity >= VERB_ALGO) { 5214 char zname[255+1]; 5215 dname_str(xfr->name, zname); 5216 verbose(VERB_ALGO, "auth zone %s transfer failed, wait", zname); 5217 } 5218 5219 /* we failed to fetch the zone, move to wait task 5220 * use the shorter retry timeout */ 5221 xfr_transfer_disown(xfr); 5222 5223 /* pick up the nextprobe task and wait */ 5224 if(xfr->task_nextprobe->worker == NULL) 5225 xfr_set_timeout(xfr, env, 1, 0); 5226 lock_basic_unlock(&xfr->lock); 5227 } 5228 5229 /** add addrs from A or AAAA rrset to the master */ 5230 static void 5231 xfr_master_add_addrs(struct auth_master* m, struct ub_packed_rrset_key* rrset, 5232 uint16_t rrtype) 5233 { 5234 size_t i; 5235 struct packed_rrset_data* data; 5236 if(!m || !rrset) return; 5237 if(rrtype != LDNS_RR_TYPE_A && rrtype != LDNS_RR_TYPE_AAAA) 5238 return; 5239 data = (struct packed_rrset_data*)rrset->entry.data; 5240 for(i=0; i<data->count; i++) { 5241 struct auth_addr* a; 5242 size_t len = data->rr_len[i] - 2; 5243 uint8_t* rdata = data->rr_data[i]+2; 5244 if(rrtype == LDNS_RR_TYPE_A && len != INET_SIZE) 5245 continue; /* wrong length for A */ 5246 if(rrtype == LDNS_RR_TYPE_AAAA && len != INET6_SIZE) 5247 continue; /* wrong length for AAAA */ 5248 5249 /* add and alloc it */ 5250 a = (struct auth_addr*)calloc(1, sizeof(*a)); 5251 if(!a) { 5252 log_err("out of memory"); 5253 return; 5254 } 5255 if(rrtype == LDNS_RR_TYPE_A) { 5256 struct sockaddr_in* sa; 5257 a->addrlen = (socklen_t)sizeof(*sa); 5258 sa = (struct sockaddr_in*)&a->addr; 5259 sa->sin_family = AF_INET; 5260 sa->sin_port = (in_port_t)htons(UNBOUND_DNS_PORT); 5261 memmove(&sa->sin_addr, rdata, INET_SIZE); 5262 } else { 5263 struct sockaddr_in6* sa; 5264 a->addrlen = (socklen_t)sizeof(*sa); 5265 sa = (struct sockaddr_in6*)&a->addr; 5266 sa->sin6_family = AF_INET6; 5267 sa->sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT); 5268 memmove(&sa->sin6_addr, rdata, INET6_SIZE); 5269 } 5270 if(verbosity >= VERB_ALGO) { 5271 char s[64]; 5272 addr_to_str(&a->addr, a->addrlen, s, sizeof(s)); 5273 verbose(VERB_ALGO, "auth host %s lookup %s", 5274 m->host, s); 5275 } 5276 /* append to list */ 5277 a->next = m->list; 5278 m->list = a; 5279 } 5280 } 5281 5282 /** callback for task_transfer lookup of host name, of A or AAAA */ 5283 void auth_xfer_transfer_lookup_callback(void* arg, int rcode, sldns_buffer* buf, 5284 enum sec_status ATTR_UNUSED(sec), char* ATTR_UNUSED(why_bogus), 5285 int ATTR_UNUSED(was_ratelimited)) 5286 { 5287 struct auth_xfer* xfr = (struct auth_xfer*)arg; 5288 struct module_env* env; 5289 log_assert(xfr->task_transfer); 5290 lock_basic_lock(&xfr->lock); 5291 env = xfr->task_transfer->env; 5292 if(env->outnet->want_to_quit) { 5293 lock_basic_unlock(&xfr->lock); 5294 return; /* stop on quit */ 5295 } 5296 5297 /* process result */ 5298 if(rcode == LDNS_RCODE_NOERROR) { 5299 uint16_t wanted_qtype = LDNS_RR_TYPE_A; 5300 struct regional* temp = env->scratch; 5301 struct query_info rq; 5302 struct reply_info* rep; 5303 if(xfr->task_transfer->lookup_aaaa) 5304 wanted_qtype = LDNS_RR_TYPE_AAAA; 5305 memset(&rq, 0, sizeof(rq)); 5306 rep = parse_reply_in_temp_region(buf, temp, &rq); 5307 if(rep && rq.qtype == wanted_qtype && 5308 FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR) { 5309 /* parsed successfully */ 5310 struct ub_packed_rrset_key* answer = 5311 reply_find_answer_rrset(&rq, rep); 5312 if(answer) { 5313 xfr_master_add_addrs(xfr->task_transfer-> 5314 lookup_target, answer, wanted_qtype); 5315 } else { 5316 if(verbosity >= VERB_ALGO) { 5317 char zname[255+1]; 5318 dname_str(xfr->name, zname); 5319 verbose(VERB_ALGO, "auth zone %s host %s type %s transfer lookup has nodata", zname, xfr->task_transfer->lookup_target->host, (xfr->task_transfer->lookup_aaaa?"AAAA":"A")); 5320 } 5321 } 5322 } else { 5323 if(verbosity >= VERB_ALGO) { 5324 char zname[255+1]; 5325 dname_str(xfr->name, zname); 5326 verbose(VERB_ALGO, "auth zone %s host %s type %s transfer lookup has no answer", zname, xfr->task_transfer->lookup_target->host, (xfr->task_transfer->lookup_aaaa?"AAAA":"A")); 5327 } 5328 } 5329 } else { 5330 if(verbosity >= VERB_ALGO) { 5331 char zname[255+1]; 5332 dname_str(xfr->name, zname); 5333 verbose(VERB_ALGO, "auth zone %s host %s type %s transfer lookup failed", zname, xfr->task_transfer->lookup_target->host, (xfr->task_transfer->lookup_aaaa?"AAAA":"A")); 5334 } 5335 } 5336 if(xfr->task_transfer->lookup_target->list && 5337 xfr->task_transfer->lookup_target == xfr_transfer_current_master(xfr)) 5338 xfr->task_transfer->scan_addr = xfr->task_transfer->lookup_target->list; 5339 5340 /* move to lookup AAAA after A lookup, move to next hostname lookup, 5341 * or move to fetch the zone, or, if nothing to do, end task_transfer */ 5342 xfr_transfer_move_to_next_lookup(xfr, env); 5343 xfr_transfer_nexttarget_or_end(xfr, env); 5344 } 5345 5346 /** check if xfer (AXFR or IXFR) packet is OK. 5347 * return false if we lost connection (SERVFAIL, or unreadable). 5348 * return false if we need to move from IXFR to AXFR, with gonextonfail 5349 * set to false, so the same master is tried again, but with AXFR. 5350 * return true if fine to link into data. 5351 * return true with transferdone=true when the transfer has ended. 5352 */ 5353 static int 5354 check_xfer_packet(sldns_buffer* pkt, struct auth_xfer* xfr, 5355 int* gonextonfail, int* transferdone) 5356 { 5357 uint8_t* wire = sldns_buffer_begin(pkt); 5358 int i; 5359 if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) { 5360 verbose(VERB_ALGO, "xfr to %s failed, packet too small", 5361 xfr->task_transfer->master->host); 5362 return 0; 5363 } 5364 if(!LDNS_QR_WIRE(wire)) { 5365 verbose(VERB_ALGO, "xfr to %s failed, packet has no QR flag", 5366 xfr->task_transfer->master->host); 5367 return 0; 5368 } 5369 if(LDNS_TC_WIRE(wire)) { 5370 verbose(VERB_ALGO, "xfr to %s failed, packet has TC flag", 5371 xfr->task_transfer->master->host); 5372 return 0; 5373 } 5374 /* check ID */ 5375 if(LDNS_ID_WIRE(wire) != xfr->task_transfer->id) { 5376 verbose(VERB_ALGO, "xfr to %s failed, packet wrong ID", 5377 xfr->task_transfer->master->host); 5378 return 0; 5379 } 5380 if(LDNS_RCODE_WIRE(wire) != LDNS_RCODE_NOERROR) { 5381 char rcode[32]; 5382 sldns_wire2str_rcode_buf((int)LDNS_RCODE_WIRE(wire), rcode, 5383 sizeof(rcode)); 5384 /* if we are doing IXFR, check for fallback */ 5385 if(xfr->task_transfer->on_ixfr) { 5386 if(LDNS_RCODE_WIRE(wire) == LDNS_RCODE_NOTIMPL || 5387 LDNS_RCODE_WIRE(wire) == LDNS_RCODE_SERVFAIL || 5388 LDNS_RCODE_WIRE(wire) == LDNS_RCODE_REFUSED || 5389 LDNS_RCODE_WIRE(wire) == LDNS_RCODE_FORMERR) { 5390 verbose(VERB_ALGO, "xfr to %s, fallback " 5391 "from IXFR to AXFR (with rcode %s)", 5392 xfr->task_transfer->master->host, 5393 rcode); 5394 xfr->task_transfer->ixfr_fail = 1; 5395 *gonextonfail = 0; 5396 return 0; 5397 } 5398 } 5399 verbose(VERB_ALGO, "xfr to %s failed, packet with rcode %s", 5400 xfr->task_transfer->master->host, rcode); 5401 return 0; 5402 } 5403 if(LDNS_OPCODE_WIRE(wire) != LDNS_PACKET_QUERY) { 5404 verbose(VERB_ALGO, "xfr to %s failed, packet with bad opcode", 5405 xfr->task_transfer->master->host); 5406 return 0; 5407 } 5408 if(LDNS_QDCOUNT(wire) > 1) { 5409 verbose(VERB_ALGO, "xfr to %s failed, packet has qdcount %d", 5410 xfr->task_transfer->master->host, 5411 (int)LDNS_QDCOUNT(wire)); 5412 return 0; 5413 } 5414 5415 /* check qname */ 5416 sldns_buffer_set_position(pkt, LDNS_HEADER_SIZE); 5417 for(i=0; i<(int)LDNS_QDCOUNT(wire); i++) { 5418 size_t pos = sldns_buffer_position(pkt); 5419 uint16_t qtype, qclass; 5420 if(pkt_dname_len(pkt) == 0) { 5421 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5422 "malformed dname", 5423 xfr->task_transfer->master->host); 5424 return 0; 5425 } 5426 if(dname_pkt_compare(pkt, sldns_buffer_at(pkt, pos), 5427 xfr->name) != 0) { 5428 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5429 "wrong qname", 5430 xfr->task_transfer->master->host); 5431 return 0; 5432 } 5433 if(sldns_buffer_remaining(pkt) < 4) { 5434 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5435 "truncated query RR", 5436 xfr->task_transfer->master->host); 5437 return 0; 5438 } 5439 qtype = sldns_buffer_read_u16(pkt); 5440 qclass = sldns_buffer_read_u16(pkt); 5441 if(qclass != xfr->dclass) { 5442 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5443 "wrong qclass", 5444 xfr->task_transfer->master->host); 5445 return 0; 5446 } 5447 if(xfr->task_transfer->on_ixfr) { 5448 if(qtype != LDNS_RR_TYPE_IXFR) { 5449 verbose(VERB_ALGO, "xfr to %s failed, packet " 5450 "with wrong qtype, expected IXFR", 5451 xfr->task_transfer->master->host); 5452 return 0; 5453 } 5454 } else { 5455 if(qtype != LDNS_RR_TYPE_AXFR) { 5456 verbose(VERB_ALGO, "xfr to %s failed, packet " 5457 "with wrong qtype, expected AXFR", 5458 xfr->task_transfer->master->host); 5459 return 0; 5460 } 5461 } 5462 } 5463 5464 /* check parse of RRs in packet, store first SOA serial 5465 * to be able to detect last SOA (with that serial) to see if done */ 5466 /* also check for IXFR 'zone up to date' reply */ 5467 for(i=0; i<(int)LDNS_ANCOUNT(wire); i++) { 5468 size_t pos = sldns_buffer_position(pkt); 5469 uint16_t tp, rdlen; 5470 if(pkt_dname_len(pkt) == 0) { 5471 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5472 "malformed dname in answer section", 5473 xfr->task_transfer->master->host); 5474 return 0; 5475 } 5476 if(sldns_buffer_remaining(pkt) < 10) { 5477 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5478 "truncated RR", 5479 xfr->task_transfer->master->host); 5480 return 0; 5481 } 5482 tp = sldns_buffer_read_u16(pkt); 5483 (void)sldns_buffer_read_u16(pkt); /* class */ 5484 (void)sldns_buffer_read_u32(pkt); /* ttl */ 5485 rdlen = sldns_buffer_read_u16(pkt); 5486 if(sldns_buffer_remaining(pkt) < rdlen) { 5487 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5488 "truncated RR rdata", 5489 xfr->task_transfer->master->host); 5490 return 0; 5491 } 5492 5493 /* RR parses (haven't checked rdata itself), now look at 5494 * SOA records to see serial number */ 5495 if(xfr->task_transfer->rr_scan_num == 0 && 5496 tp != LDNS_RR_TYPE_SOA) { 5497 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5498 "malformed zone transfer, no start SOA", 5499 xfr->task_transfer->master->host); 5500 return 0; 5501 } 5502 if(xfr->task_transfer->rr_scan_num == 1 && 5503 tp != LDNS_RR_TYPE_SOA) { 5504 /* second RR is not a SOA record, this is not an IXFR 5505 * the master is replying with an AXFR */ 5506 xfr->task_transfer->on_ixfr_is_axfr = 1; 5507 } 5508 if(tp == LDNS_RR_TYPE_SOA) { 5509 uint32_t serial; 5510 if(rdlen < 22) { 5511 verbose(VERB_ALGO, "xfr to %s failed, packet " 5512 "with SOA with malformed rdata", 5513 xfr->task_transfer->master->host); 5514 return 0; 5515 } 5516 if(dname_pkt_compare(pkt, sldns_buffer_at(pkt, pos), 5517 xfr->name) != 0) { 5518 verbose(VERB_ALGO, "xfr to %s failed, packet " 5519 "with SOA with wrong dname", 5520 xfr->task_transfer->master->host); 5521 return 0; 5522 } 5523 5524 /* read serial number of SOA */ 5525 serial = sldns_buffer_read_u32_at(pkt, 5526 sldns_buffer_position(pkt)+rdlen-20); 5527 5528 /* check for IXFR 'zone has SOA x' reply */ 5529 if(xfr->task_transfer->on_ixfr && 5530 xfr->task_transfer->rr_scan_num == 0 && 5531 LDNS_ANCOUNT(wire)==1) { 5532 verbose(VERB_ALGO, "xfr to %s ended, " 5533 "IXFR reply that zone has serial %u", 5534 xfr->task_transfer->master->host, 5535 (unsigned)serial); 5536 return 0; 5537 } 5538 5539 /* if first SOA, store serial number */ 5540 if(xfr->task_transfer->got_xfr_serial == 0) { 5541 xfr->task_transfer->got_xfr_serial = 1; 5542 xfr->task_transfer->incoming_xfr_serial = 5543 serial; 5544 verbose(VERB_ALGO, "xfr %s: contains " 5545 "SOA serial %u", 5546 xfr->task_transfer->master->host, 5547 (unsigned)serial); 5548 /* see if end of AXFR */ 5549 } else if(!xfr->task_transfer->on_ixfr || 5550 xfr->task_transfer->on_ixfr_is_axfr) { 5551 /* second SOA with serial is the end 5552 * for AXFR */ 5553 *transferdone = 1; 5554 verbose(VERB_ALGO, "xfr %s: last AXFR packet", 5555 xfr->task_transfer->master->host); 5556 /* for IXFR, count SOA records with that serial */ 5557 } else if(xfr->task_transfer->incoming_xfr_serial == 5558 serial && xfr->task_transfer->got_xfr_serial 5559 == 1) { 5560 xfr->task_transfer->got_xfr_serial++; 5561 /* if not first soa, if serial==firstserial, the 5562 * third time we are at the end, for IXFR */ 5563 } else if(xfr->task_transfer->incoming_xfr_serial == 5564 serial && xfr->task_transfer->got_xfr_serial 5565 == 2) { 5566 verbose(VERB_ALGO, "xfr %s: last IXFR packet", 5567 xfr->task_transfer->master->host); 5568 *transferdone = 1; 5569 /* continue parse check, if that succeeds, 5570 * transfer is done */ 5571 } 5572 } 5573 xfr->task_transfer->rr_scan_num++; 5574 5575 /* skip over RR rdata to go to the next RR */ 5576 sldns_buffer_skip(pkt, (ssize_t)rdlen); 5577 } 5578 5579 /* check authority section */ 5580 /* we skip over the RRs checking packet format */ 5581 for(i=0; i<(int)LDNS_NSCOUNT(wire); i++) { 5582 uint16_t rdlen; 5583 if(pkt_dname_len(pkt) == 0) { 5584 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5585 "malformed dname in authority section", 5586 xfr->task_transfer->master->host); 5587 return 0; 5588 } 5589 if(sldns_buffer_remaining(pkt) < 10) { 5590 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5591 "truncated RR", 5592 xfr->task_transfer->master->host); 5593 return 0; 5594 } 5595 (void)sldns_buffer_read_u16(pkt); /* type */ 5596 (void)sldns_buffer_read_u16(pkt); /* class */ 5597 (void)sldns_buffer_read_u32(pkt); /* ttl */ 5598 rdlen = sldns_buffer_read_u16(pkt); 5599 if(sldns_buffer_remaining(pkt) < rdlen) { 5600 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5601 "truncated RR rdata", 5602 xfr->task_transfer->master->host); 5603 return 0; 5604 } 5605 /* skip over RR rdata to go to the next RR */ 5606 sldns_buffer_skip(pkt, (ssize_t)rdlen); 5607 } 5608 5609 /* check additional section */ 5610 for(i=0; i<(int)LDNS_ARCOUNT(wire); i++) { 5611 uint16_t rdlen; 5612 if(pkt_dname_len(pkt) == 0) { 5613 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5614 "malformed dname in additional section", 5615 xfr->task_transfer->master->host); 5616 return 0; 5617 } 5618 if(sldns_buffer_remaining(pkt) < 10) { 5619 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5620 "truncated RR", 5621 xfr->task_transfer->master->host); 5622 return 0; 5623 } 5624 (void)sldns_buffer_read_u16(pkt); /* type */ 5625 (void)sldns_buffer_read_u16(pkt); /* class */ 5626 (void)sldns_buffer_read_u32(pkt); /* ttl */ 5627 rdlen = sldns_buffer_read_u16(pkt); 5628 if(sldns_buffer_remaining(pkt) < rdlen) { 5629 verbose(VERB_ALGO, "xfr to %s failed, packet with " 5630 "truncated RR rdata", 5631 xfr->task_transfer->master->host); 5632 return 0; 5633 } 5634 /* skip over RR rdata to go to the next RR */ 5635 sldns_buffer_skip(pkt, (ssize_t)rdlen); 5636 } 5637 5638 return 1; 5639 } 5640 5641 /** Link the data from this packet into the worklist of transferred data */ 5642 static int 5643 xfer_link_data(sldns_buffer* pkt, struct auth_xfer* xfr) 5644 { 5645 /* alloc it */ 5646 struct auth_chunk* e; 5647 e = (struct auth_chunk*)calloc(1, sizeof(*e)); 5648 if(!e) return 0; 5649 e->next = NULL; 5650 e->len = sldns_buffer_limit(pkt); 5651 e->data = memdup(sldns_buffer_begin(pkt), e->len); 5652 if(!e->data) { 5653 free(e); 5654 return 0; 5655 } 5656 5657 /* alloc succeeded, link into list */ 5658 if(!xfr->task_transfer->chunks_first) 5659 xfr->task_transfer->chunks_first = e; 5660 if(xfr->task_transfer->chunks_last) 5661 xfr->task_transfer->chunks_last->next = e; 5662 xfr->task_transfer->chunks_last = e; 5663 return 1; 5664 } 5665 5666 /** task transfer. the list of data is complete. process it and if failed 5667 * move to next master, if succeeded, end the task transfer */ 5668 static void 5669 process_list_end_transfer(struct auth_xfer* xfr, struct module_env* env) 5670 { 5671 int ixfr_fail = 0; 5672 if(xfr_process_chunk_list(xfr, env, &ixfr_fail)) { 5673 /* it worked! */ 5674 auth_chunks_delete(xfr->task_transfer); 5675 5676 /* we fetched the zone, move to wait task */ 5677 xfr_transfer_disown(xfr); 5678 5679 if(xfr->notify_received && (!xfr->notify_has_serial || 5680 (xfr->notify_has_serial && 5681 xfr_serial_means_update(xfr, xfr->notify_serial)))) { 5682 uint32_t sr = xfr->notify_serial; 5683 int has_sr = xfr->notify_has_serial; 5684 /* we received a notify while probe/transfer was 5685 * in progress. start a new probe and transfer */ 5686 xfr->notify_received = 0; 5687 xfr->notify_has_serial = 0; 5688 xfr->notify_serial = 0; 5689 if(!xfr_start_probe(xfr, env, NULL)) { 5690 /* if we couldn't start it, already in 5691 * progress; restore notify serial, 5692 * while xfr still locked */ 5693 xfr->notify_received = 1; 5694 xfr->notify_has_serial = has_sr; 5695 xfr->notify_serial = sr; 5696 lock_basic_unlock(&xfr->lock); 5697 } 5698 return; 5699 } else { 5700 /* pick up the nextprobe task and wait (normail wait time) */ 5701 if(xfr->task_nextprobe->worker == NULL) 5702 xfr_set_timeout(xfr, env, 0, 0); 5703 } 5704 lock_basic_unlock(&xfr->lock); 5705 return; 5706 } 5707 /* processing failed */ 5708 /* when done, delete data from list */ 5709 auth_chunks_delete(xfr->task_transfer); 5710 if(ixfr_fail) { 5711 xfr->task_transfer->ixfr_fail = 1; 5712 } else { 5713 xfr_transfer_nextmaster(xfr); 5714 } 5715 xfr_transfer_nexttarget_or_end(xfr, env); 5716 } 5717 5718 /** callback for the task_transfer timer */ 5719 void 5720 auth_xfer_transfer_timer_callback(void* arg) 5721 { 5722 struct auth_xfer* xfr = (struct auth_xfer*)arg; 5723 struct module_env* env; 5724 int gonextonfail = 1; 5725 log_assert(xfr->task_transfer); 5726 lock_basic_lock(&xfr->lock); 5727 env = xfr->task_transfer->env; 5728 if(env->outnet->want_to_quit) { 5729 lock_basic_unlock(&xfr->lock); 5730 return; /* stop on quit */ 5731 } 5732 5733 verbose(VERB_ALGO, "xfr stopped, connection timeout to %s", 5734 xfr->task_transfer->master->host); 5735 5736 /* see if IXFR caused the failure, if so, try AXFR */ 5737 if(xfr->task_transfer->on_ixfr) { 5738 xfr->task_transfer->ixfr_possible_timeout_count++; 5739 if(xfr->task_transfer->ixfr_possible_timeout_count >= 5740 NUM_TIMEOUTS_FALLBACK_IXFR) { 5741 verbose(VERB_ALGO, "xfr to %s, fallback " 5742 "from IXFR to AXFR (because of timeouts)", 5743 xfr->task_transfer->master->host); 5744 xfr->task_transfer->ixfr_fail = 1; 5745 gonextonfail = 0; 5746 } 5747 } 5748 5749 /* delete transferred data from list */ 5750 auth_chunks_delete(xfr->task_transfer); 5751 comm_point_delete(xfr->task_transfer->cp); 5752 xfr->task_transfer->cp = NULL; 5753 if(gonextonfail) 5754 xfr_transfer_nextmaster(xfr); 5755 xfr_transfer_nexttarget_or_end(xfr, env); 5756 } 5757 5758 /** callback for task_transfer tcp connections */ 5759 int 5760 auth_xfer_transfer_tcp_callback(struct comm_point* c, void* arg, int err, 5761 struct comm_reply* ATTR_UNUSED(repinfo)) 5762 { 5763 struct auth_xfer* xfr = (struct auth_xfer*)arg; 5764 struct module_env* env; 5765 int gonextonfail = 1; 5766 int transferdone = 0; 5767 log_assert(xfr->task_transfer); 5768 lock_basic_lock(&xfr->lock); 5769 env = xfr->task_transfer->env; 5770 if(env->outnet->want_to_quit) { 5771 lock_basic_unlock(&xfr->lock); 5772 return 0; /* stop on quit */ 5773 } 5774 /* stop the timer */ 5775 comm_timer_disable(xfr->task_transfer->timer); 5776 5777 if(err != NETEVENT_NOERROR) { 5778 /* connection failed, closed, or timeout */ 5779 /* stop this transfer, cleanup 5780 * and continue task_transfer*/ 5781 verbose(VERB_ALGO, "xfr stopped, connection lost to %s", 5782 xfr->task_transfer->master->host); 5783 5784 /* see if IXFR caused the failure, if so, try AXFR */ 5785 if(xfr->task_transfer->on_ixfr) { 5786 xfr->task_transfer->ixfr_possible_timeout_count++; 5787 if(xfr->task_transfer->ixfr_possible_timeout_count >= 5788 NUM_TIMEOUTS_FALLBACK_IXFR) { 5789 verbose(VERB_ALGO, "xfr to %s, fallback " 5790 "from IXFR to AXFR (because of timeouts)", 5791 xfr->task_transfer->master->host); 5792 xfr->task_transfer->ixfr_fail = 1; 5793 gonextonfail = 0; 5794 } 5795 } 5796 5797 failed: 5798 /* delete transferred data from list */ 5799 auth_chunks_delete(xfr->task_transfer); 5800 comm_point_delete(xfr->task_transfer->cp); 5801 xfr->task_transfer->cp = NULL; 5802 if(gonextonfail) 5803 xfr_transfer_nextmaster(xfr); 5804 xfr_transfer_nexttarget_or_end(xfr, env); 5805 return 0; 5806 } 5807 /* note that IXFR worked without timeout */ 5808 if(xfr->task_transfer->on_ixfr) 5809 xfr->task_transfer->ixfr_possible_timeout_count = 0; 5810 5811 /* handle returned packet */ 5812 /* if it fails, cleanup and end this transfer */ 5813 /* if it needs to fallback from IXFR to AXFR, do that */ 5814 if(!check_xfer_packet(c->buffer, xfr, &gonextonfail, &transferdone)) { 5815 goto failed; 5816 } 5817 /* if it is good, link it into the list of data */ 5818 /* if the link into list of data fails (malloc fail) cleanup and end */ 5819 if(!xfer_link_data(c->buffer, xfr)) { 5820 verbose(VERB_ALGO, "xfr stopped to %s, malloc failed", 5821 xfr->task_transfer->master->host); 5822 goto failed; 5823 } 5824 /* if the transfer is done now, disconnect and process the list */ 5825 if(transferdone) { 5826 comm_point_delete(xfr->task_transfer->cp); 5827 xfr->task_transfer->cp = NULL; 5828 process_list_end_transfer(xfr, env); 5829 return 0; 5830 } 5831 5832 /* if we want to read more messages, setup the commpoint to read 5833 * a DNS packet, and the timeout */ 5834 lock_basic_unlock(&xfr->lock); 5835 c->tcp_is_reading = 1; 5836 sldns_buffer_clear(c->buffer); 5837 comm_point_start_listening(c, -1, AUTH_TRANSFER_TIMEOUT); 5838 return 0; 5839 } 5840 5841 /** callback for task_transfer http connections */ 5842 int 5843 auth_xfer_transfer_http_callback(struct comm_point* c, void* arg, int err, 5844 struct comm_reply* repinfo) 5845 { 5846 struct auth_xfer* xfr = (struct auth_xfer*)arg; 5847 struct module_env* env; 5848 log_assert(xfr->task_transfer); 5849 lock_basic_lock(&xfr->lock); 5850 env = xfr->task_transfer->env; 5851 if(env->outnet->want_to_quit) { 5852 lock_basic_unlock(&xfr->lock); 5853 return 0; /* stop on quit */ 5854 } 5855 verbose(VERB_ALGO, "auth zone transfer http callback"); 5856 /* stop the timer */ 5857 comm_timer_disable(xfr->task_transfer->timer); 5858 5859 if(err != NETEVENT_NOERROR && err != NETEVENT_DONE) { 5860 /* connection failed, closed, or timeout */ 5861 /* stop this transfer, cleanup 5862 * and continue task_transfer*/ 5863 verbose(VERB_ALGO, "http stopped, connection lost to %s", 5864 xfr->task_transfer->master->host); 5865 failed: 5866 /* delete transferred data from list */ 5867 auth_chunks_delete(xfr->task_transfer); 5868 if(repinfo) repinfo->c = NULL; /* signal cp deleted to 5869 the routine calling this callback */ 5870 comm_point_delete(xfr->task_transfer->cp); 5871 xfr->task_transfer->cp = NULL; 5872 xfr_transfer_nextmaster(xfr); 5873 xfr_transfer_nexttarget_or_end(xfr, env); 5874 return 0; 5875 } 5876 5877 /* if it is good, link it into the list of data */ 5878 /* if the link into list of data fails (malloc fail) cleanup and end */ 5879 if(sldns_buffer_limit(c->buffer) > 0) { 5880 verbose(VERB_ALGO, "auth zone http queued up %d bytes", 5881 (int)sldns_buffer_limit(c->buffer)); 5882 if(!xfer_link_data(c->buffer, xfr)) { 5883 verbose(VERB_ALGO, "http stopped to %s, malloc failed", 5884 xfr->task_transfer->master->host); 5885 goto failed; 5886 } 5887 } 5888 /* if the transfer is done now, disconnect and process the list */ 5889 if(err == NETEVENT_DONE) { 5890 if(repinfo) repinfo->c = NULL; /* signal cp deleted to 5891 the routine calling this callback */ 5892 comm_point_delete(xfr->task_transfer->cp); 5893 xfr->task_transfer->cp = NULL; 5894 process_list_end_transfer(xfr, env); 5895 return 0; 5896 } 5897 5898 /* if we want to read more messages, setup the commpoint to read 5899 * a DNS packet, and the timeout */ 5900 lock_basic_unlock(&xfr->lock); 5901 c->tcp_is_reading = 1; 5902 sldns_buffer_clear(c->buffer); 5903 comm_point_start_listening(c, -1, AUTH_TRANSFER_TIMEOUT); 5904 return 0; 5905 } 5906 5907 5908 /** start transfer task by this worker , xfr is locked. */ 5909 static void 5910 xfr_start_transfer(struct auth_xfer* xfr, struct module_env* env, 5911 struct auth_master* master) 5912 { 5913 log_assert(xfr->task_transfer != NULL); 5914 log_assert(xfr->task_transfer->worker == NULL); 5915 log_assert(xfr->task_transfer->chunks_first == NULL); 5916 log_assert(xfr->task_transfer->chunks_last == NULL); 5917 xfr->task_transfer->worker = env->worker; 5918 xfr->task_transfer->env = env; 5919 5920 /* init transfer process */ 5921 /* find that master in the transfer's list of masters? */ 5922 xfr_transfer_start_list(xfr, master); 5923 /* start lookup for hostnames in transfer master list */ 5924 xfr_transfer_start_lookups(xfr); 5925 5926 /* initiate TCP, and set timeout on it */ 5927 xfr_transfer_nexttarget_or_end(xfr, env); 5928 } 5929 5930 /** disown task_probe. caller must hold xfr.lock */ 5931 static void 5932 xfr_probe_disown(struct auth_xfer* xfr) 5933 { 5934 /* remove timer (from this worker's event base) */ 5935 comm_timer_delete(xfr->task_probe->timer); 5936 xfr->task_probe->timer = NULL; 5937 /* remove the commpoint */ 5938 comm_point_delete(xfr->task_probe->cp); 5939 xfr->task_probe->cp = NULL; 5940 /* we don't own this item anymore */ 5941 xfr->task_probe->worker = NULL; 5942 xfr->task_probe->env = NULL; 5943 } 5944 5945 /** send the UDP probe to the master, this is part of task_probe */ 5946 static int 5947 xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env, 5948 int timeout) 5949 { 5950 struct sockaddr_storage addr; 5951 socklen_t addrlen = 0; 5952 struct timeval t; 5953 /* pick master */ 5954 struct auth_master* master = xfr_probe_current_master(xfr); 5955 char *auth_name = NULL; 5956 if(!master) return 0; 5957 if(master->allow_notify) return 0; /* only for notify */ 5958 if(master->http) return 0; /* only masters get SOA UDP probe, 5959 not urls, if those are in this list */ 5960 5961 /* get master addr */ 5962 if(xfr->task_probe->scan_addr) { 5963 addrlen = xfr->task_probe->scan_addr->addrlen; 5964 memmove(&addr, &xfr->task_probe->scan_addr->addr, addrlen); 5965 } else { 5966 if(!authextstrtoaddr(master->host, &addr, &addrlen, &auth_name)) { 5967 /* the ones that are not in addr format are supposed 5968 * to be looked up. The lookup has failed however, 5969 * so skip them */ 5970 char zname[255+1]; 5971 dname_str(xfr->name, zname); 5972 log_err("%s: failed lookup, cannot probe to master %s", 5973 zname, master->host); 5974 return 0; 5975 } 5976 if (auth_name != NULL) { 5977 if (addr.ss_family == AF_INET 5978 && (int)ntohs(((struct sockaddr_in *)&addr)->sin_port) 5979 == env->cfg->ssl_port) 5980 ((struct sockaddr_in *)&addr)->sin_port 5981 = htons((uint16_t)env->cfg->port); 5982 else if (addr.ss_family == AF_INET6 5983 && (int)ntohs(((struct sockaddr_in6 *)&addr)->sin6_port) 5984 == env->cfg->ssl_port) 5985 ((struct sockaddr_in6 *)&addr)->sin6_port 5986 = htons((uint16_t)env->cfg->port); 5987 } 5988 } 5989 5990 /* create packet */ 5991 /* create new ID for new probes, but not on timeout retries, 5992 * this means we'll accept replies to previous retries to same ip */ 5993 if(timeout == AUTH_PROBE_TIMEOUT) 5994 xfr->task_probe->id = (uint16_t)(ub_random(env->rnd)&0xffff); 5995 xfr_create_soa_probe_packet(xfr, env->scratch_buffer, 5996 xfr->task_probe->id); 5997 /* we need to remove the cp if we have a different ip4/ip6 type now */ 5998 if(xfr->task_probe->cp && 5999 ((xfr->task_probe->cp_is_ip6 && !addr_is_ip6(&addr, addrlen)) || 6000 (!xfr->task_probe->cp_is_ip6 && addr_is_ip6(&addr, addrlen))) 6001 ) { 6002 comm_point_delete(xfr->task_probe->cp); 6003 xfr->task_probe->cp = NULL; 6004 } 6005 if(!xfr->task_probe->cp) { 6006 if(addr_is_ip6(&addr, addrlen)) 6007 xfr->task_probe->cp_is_ip6 = 1; 6008 else xfr->task_probe->cp_is_ip6 = 0; 6009 xfr->task_probe->cp = outnet_comm_point_for_udp(env->outnet, 6010 auth_xfer_probe_udp_callback, xfr, &addr, addrlen); 6011 if(!xfr->task_probe->cp) { 6012 char zname[255+1], as[256]; 6013 dname_str(xfr->name, zname); 6014 addr_to_str(&addr, addrlen, as, sizeof(as)); 6015 verbose(VERB_ALGO, "cannot create udp cp for " 6016 "probe %s to %s", zname, as); 6017 return 0; 6018 } 6019 } 6020 if(!xfr->task_probe->timer) { 6021 xfr->task_probe->timer = comm_timer_create(env->worker_base, 6022 auth_xfer_probe_timer_callback, xfr); 6023 if(!xfr->task_probe->timer) { 6024 log_err("malloc failure"); 6025 return 0; 6026 } 6027 } 6028 6029 /* send udp packet */ 6030 if(!comm_point_send_udp_msg(xfr->task_probe->cp, env->scratch_buffer, 6031 (struct sockaddr*)&addr, addrlen)) { 6032 char zname[255+1], as[256]; 6033 dname_str(xfr->name, zname); 6034 addr_to_str(&addr, addrlen, as, sizeof(as)); 6035 verbose(VERB_ALGO, "failed to send soa probe for %s to %s", 6036 zname, as); 6037 return 0; 6038 } 6039 if(verbosity >= VERB_ALGO) { 6040 char zname[255+1], as[256]; 6041 dname_str(xfr->name, zname); 6042 addr_to_str(&addr, addrlen, as, sizeof(as)); 6043 verbose(VERB_ALGO, "auth zone %s soa probe sent to %s", zname, 6044 as); 6045 } 6046 xfr->task_probe->timeout = timeout; 6047 #ifndef S_SPLINT_S 6048 t.tv_sec = timeout/1000; 6049 t.tv_usec = (timeout%1000)*1000; 6050 #endif 6051 comm_timer_set(xfr->task_probe->timer, &t); 6052 6053 return 1; 6054 } 6055 6056 /** callback for task_probe timer */ 6057 void 6058 auth_xfer_probe_timer_callback(void* arg) 6059 { 6060 struct auth_xfer* xfr = (struct auth_xfer*)arg; 6061 struct module_env* env; 6062 log_assert(xfr->task_probe); 6063 lock_basic_lock(&xfr->lock); 6064 env = xfr->task_probe->env; 6065 if(env->outnet->want_to_quit) { 6066 lock_basic_unlock(&xfr->lock); 6067 return; /* stop on quit */ 6068 } 6069 6070 if(verbosity >= VERB_ALGO) { 6071 char zname[255+1]; 6072 dname_str(xfr->name, zname); 6073 verbose(VERB_ALGO, "auth zone %s soa probe timeout", zname); 6074 } 6075 if(xfr->task_probe->timeout <= AUTH_PROBE_TIMEOUT_STOP) { 6076 /* try again with bigger timeout */ 6077 if(xfr_probe_send_probe(xfr, env, xfr->task_probe->timeout*2)) { 6078 lock_basic_unlock(&xfr->lock); 6079 return; 6080 } 6081 } 6082 /* delete commpoint so a new one is created, with a fresh port nr */ 6083 comm_point_delete(xfr->task_probe->cp); 6084 xfr->task_probe->cp = NULL; 6085 6086 /* too many timeouts (or fail to send), move to next or end */ 6087 xfr_probe_nextmaster(xfr); 6088 xfr_probe_send_or_end(xfr, env); 6089 } 6090 6091 /** callback for task_probe udp packets */ 6092 int 6093 auth_xfer_probe_udp_callback(struct comm_point* c, void* arg, int err, 6094 struct comm_reply* repinfo) 6095 { 6096 struct auth_xfer* xfr = (struct auth_xfer*)arg; 6097 struct module_env* env; 6098 log_assert(xfr->task_probe); 6099 lock_basic_lock(&xfr->lock); 6100 env = xfr->task_probe->env; 6101 if(env->outnet->want_to_quit) { 6102 lock_basic_unlock(&xfr->lock); 6103 return 0; /* stop on quit */ 6104 } 6105 6106 /* the comm_point_udp_callback is in a for loop for NUM_UDP_PER_SELECT 6107 * and we set rep.c=NULL to stop if from looking inside the commpoint*/ 6108 repinfo->c = NULL; 6109 /* stop the timer */ 6110 comm_timer_disable(xfr->task_probe->timer); 6111 6112 /* see if we got a packet and what that means */ 6113 if(err == NETEVENT_NOERROR) { 6114 uint32_t serial = 0; 6115 if(check_packet_ok(c->buffer, LDNS_RR_TYPE_SOA, xfr, 6116 &serial)) { 6117 /* successful lookup */ 6118 if(verbosity >= VERB_ALGO) { 6119 char buf[256]; 6120 dname_str(xfr->name, buf); 6121 verbose(VERB_ALGO, "auth zone %s: soa probe " 6122 "serial is %u", buf, (unsigned)serial); 6123 } 6124 /* see if this serial indicates that the zone has 6125 * to be updated */ 6126 if(xfr_serial_means_update(xfr, serial)) { 6127 /* if updated, start the transfer task, if needed */ 6128 verbose(VERB_ALGO, "auth_zone updated, start transfer"); 6129 if(xfr->task_transfer->worker == NULL) { 6130 struct auth_master* master = 6131 xfr_probe_current_master(xfr); 6132 /* if we have download URLs use them 6133 * in preference to this master we 6134 * just probed the SOA from */ 6135 if(xfr->task_transfer->masters && 6136 xfr->task_transfer->masters->http) 6137 master = NULL; 6138 xfr_probe_disown(xfr); 6139 xfr_start_transfer(xfr, env, master); 6140 return 0; 6141 6142 } 6143 /* other tasks are running, we don't do this anymore */ 6144 xfr_probe_disown(xfr); 6145 lock_basic_unlock(&xfr->lock); 6146 /* return, we don't sent a reply to this udp packet, 6147 * and we setup the tasks to do next */ 6148 return 0; 6149 } else { 6150 verbose(VERB_ALGO, "auth_zone master reports unchanged soa serial"); 6151 /* we if cannot find updates amongst the 6152 * masters, this means we then have a new lease 6153 * on the zone */ 6154 xfr->task_probe->have_new_lease = 1; 6155 } 6156 } else { 6157 if(verbosity >= VERB_ALGO) { 6158 char buf[256]; 6159 dname_str(xfr->name, buf); 6160 verbose(VERB_ALGO, "auth zone %s: bad reply to soa probe", buf); 6161 } 6162 } 6163 } else { 6164 if(verbosity >= VERB_ALGO) { 6165 char buf[256]; 6166 dname_str(xfr->name, buf); 6167 verbose(VERB_ALGO, "auth zone %s: soa probe failed", buf); 6168 } 6169 } 6170 6171 /* failed lookup or not an update */ 6172 /* delete commpoint so a new one is created, with a fresh port nr */ 6173 comm_point_delete(xfr->task_probe->cp); 6174 xfr->task_probe->cp = NULL; 6175 6176 /* if the result was not a successfull probe, we need 6177 * to send the next one */ 6178 xfr_probe_nextmaster(xfr); 6179 xfr_probe_send_or_end(xfr, env); 6180 return 0; 6181 } 6182 6183 /** lookup a host name for its addresses, if needed */ 6184 static int 6185 xfr_probe_lookup_host(struct auth_xfer* xfr, struct module_env* env) 6186 { 6187 struct sockaddr_storage addr; 6188 socklen_t addrlen = 0; 6189 struct auth_master* master = xfr->task_probe->lookup_target; 6190 struct query_info qinfo; 6191 uint16_t qflags = BIT_RD; 6192 uint8_t dname[LDNS_MAX_DOMAINLEN+1]; 6193 struct edns_data edns; 6194 sldns_buffer* buf = env->scratch_buffer; 6195 if(!master) return 0; 6196 if(extstrtoaddr(master->host, &addr, &addrlen)) { 6197 /* not needed, host is in IP addr format */ 6198 return 0; 6199 } 6200 if(master->allow_notify && !master->http && 6201 strchr(master->host, '/') != NULL && 6202 strchr(master->host, '/') == strrchr(master->host, '/')) { 6203 return 0; /* is IP/prefix format, not something to look up */ 6204 } 6205 6206 /* use mesh_new_callback to probe for non-addr hosts, 6207 * and then wait for them to be looked up (in cache, or query) */ 6208 qinfo.qname_len = sizeof(dname); 6209 if(sldns_str2wire_dname_buf(master->host, dname, &qinfo.qname_len) 6210 != 0) { 6211 log_err("cannot parse host name of master %s", master->host); 6212 return 0; 6213 } 6214 qinfo.qname = dname; 6215 qinfo.qclass = xfr->dclass; 6216 qinfo.qtype = LDNS_RR_TYPE_A; 6217 if(xfr->task_probe->lookup_aaaa) 6218 qinfo.qtype = LDNS_RR_TYPE_AAAA; 6219 qinfo.local_alias = NULL; 6220 if(verbosity >= VERB_ALGO) { 6221 char buf1[512]; 6222 char buf2[LDNS_MAX_DOMAINLEN+1]; 6223 dname_str(xfr->name, buf2); 6224 snprintf(buf1, sizeof(buf1), "auth zone %s: master lookup" 6225 " for task_probe", buf2); 6226 log_query_info(VERB_ALGO, buf1, &qinfo); 6227 } 6228 edns.edns_present = 1; 6229 edns.ext_rcode = 0; 6230 edns.edns_version = 0; 6231 edns.bits = EDNS_DO; 6232 edns.opt_list = NULL; 6233 if(sldns_buffer_capacity(buf) < 65535) 6234 edns.udp_size = (uint16_t)sldns_buffer_capacity(buf); 6235 else edns.udp_size = 65535; 6236 6237 /* unlock xfr during mesh_new_callback() because the callback can be 6238 * called straight away */ 6239 lock_basic_unlock(&xfr->lock); 6240 if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0, 6241 &auth_xfer_probe_lookup_callback, xfr)) { 6242 lock_basic_lock(&xfr->lock); 6243 log_err("out of memory lookup up master %s", master->host); 6244 return 0; 6245 } 6246 lock_basic_lock(&xfr->lock); 6247 return 1; 6248 } 6249 6250 /** move to sending the probe packets, next if fails. task_probe */ 6251 static void 6252 xfr_probe_send_or_end(struct auth_xfer* xfr, struct module_env* env) 6253 { 6254 /* are we doing hostname lookups? */ 6255 while(xfr->task_probe->lookup_target) { 6256 if(xfr_probe_lookup_host(xfr, env)) { 6257 /* wait for lookup to finish, 6258 * note that the hostname may be in unbound's cache 6259 * and we may then get an instant cache response, 6260 * and that calls the callback just like a full 6261 * lookup and lookup failures also call callback */ 6262 if(verbosity >= VERB_ALGO) { 6263 char zname[255+1]; 6264 dname_str(xfr->name, zname); 6265 verbose(VERB_ALGO, "auth zone %s probe next target lookup", zname); 6266 } 6267 lock_basic_unlock(&xfr->lock); 6268 return; 6269 } 6270 xfr_probe_move_to_next_lookup(xfr, env); 6271 } 6272 /* probe of list has ended. Create or refresh the list of of 6273 * allow_notify addrs */ 6274 probe_copy_masters_for_allow_notify(xfr); 6275 if(verbosity >= VERB_ALGO) { 6276 char zname[255+1]; 6277 dname_str(xfr->name, zname); 6278 verbose(VERB_ALGO, "auth zone %s probe: notify addrs updated", zname); 6279 } 6280 if(xfr->task_probe->only_lookup) { 6281 /* only wanted lookups for copy, stop probe and start wait */ 6282 xfr->task_probe->only_lookup = 0; 6283 if(verbosity >= VERB_ALGO) { 6284 char zname[255+1]; 6285 dname_str(xfr->name, zname); 6286 verbose(VERB_ALGO, "auth zone %s probe: finished only_lookup", zname); 6287 } 6288 xfr_probe_disown(xfr); 6289 if(xfr->task_nextprobe->worker == NULL) 6290 xfr_set_timeout(xfr, env, 0, 0); 6291 lock_basic_unlock(&xfr->lock); 6292 return; 6293 } 6294 6295 /* send probe packets */ 6296 while(!xfr_probe_end_of_list(xfr)) { 6297 if(xfr_probe_send_probe(xfr, env, AUTH_PROBE_TIMEOUT)) { 6298 /* successfully sent probe, wait for callback */ 6299 lock_basic_unlock(&xfr->lock); 6300 return; 6301 } 6302 /* failed to send probe, next master */ 6303 xfr_probe_nextmaster(xfr); 6304 } 6305 6306 /* done with probe sequence, wait */ 6307 if(xfr->task_probe->have_new_lease) { 6308 /* if zone not updated, start the wait timer again */ 6309 if(verbosity >= VERB_ALGO) { 6310 char zname[255+1]; 6311 dname_str(xfr->name, zname); 6312 verbose(VERB_ALGO, "auth_zone %s unchanged, new lease, wait", zname); 6313 } 6314 xfr_probe_disown(xfr); 6315 if(xfr->have_zone) 6316 xfr->lease_time = *env->now; 6317 if(xfr->task_nextprobe->worker == NULL) 6318 xfr_set_timeout(xfr, env, 0, 0); 6319 } else { 6320 if(verbosity >= VERB_ALGO) { 6321 char zname[255+1]; 6322 dname_str(xfr->name, zname); 6323 verbose(VERB_ALGO, "auth zone %s soa probe failed, wait to retry", zname); 6324 } 6325 /* we failed to send this as well, move to the wait task, 6326 * use the shorter retry timeout */ 6327 xfr_probe_disown(xfr); 6328 /* pick up the nextprobe task and wait */ 6329 if(xfr->task_nextprobe->worker == NULL) 6330 xfr_set_timeout(xfr, env, 1, 0); 6331 } 6332 6333 lock_basic_unlock(&xfr->lock); 6334 } 6335 6336 /** callback for task_probe lookup of host name, of A or AAAA */ 6337 void auth_xfer_probe_lookup_callback(void* arg, int rcode, sldns_buffer* buf, 6338 enum sec_status ATTR_UNUSED(sec), char* ATTR_UNUSED(why_bogus), 6339 int ATTR_UNUSED(was_ratelimited)) 6340 { 6341 struct auth_xfer* xfr = (struct auth_xfer*)arg; 6342 struct module_env* env; 6343 log_assert(xfr->task_probe); 6344 lock_basic_lock(&xfr->lock); 6345 env = xfr->task_probe->env; 6346 if(env->outnet->want_to_quit) { 6347 lock_basic_unlock(&xfr->lock); 6348 return; /* stop on quit */ 6349 } 6350 6351 /* process result */ 6352 if(rcode == LDNS_RCODE_NOERROR) { 6353 uint16_t wanted_qtype = LDNS_RR_TYPE_A; 6354 struct regional* temp = env->scratch; 6355 struct query_info rq; 6356 struct reply_info* rep; 6357 if(xfr->task_probe->lookup_aaaa) 6358 wanted_qtype = LDNS_RR_TYPE_AAAA; 6359 memset(&rq, 0, sizeof(rq)); 6360 rep = parse_reply_in_temp_region(buf, temp, &rq); 6361 if(rep && rq.qtype == wanted_qtype && 6362 FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR) { 6363 /* parsed successfully */ 6364 struct ub_packed_rrset_key* answer = 6365 reply_find_answer_rrset(&rq, rep); 6366 if(answer) { 6367 xfr_master_add_addrs(xfr->task_probe-> 6368 lookup_target, answer, wanted_qtype); 6369 } else { 6370 if(verbosity >= VERB_ALGO) { 6371 char zname[255+1]; 6372 dname_str(xfr->name, zname); 6373 verbose(VERB_ALGO, "auth zone %s host %s type %s probe lookup has nodata", zname, xfr->task_probe->lookup_target->host, (xfr->task_probe->lookup_aaaa?"AAAA":"A")); 6374 } 6375 } 6376 } else { 6377 if(verbosity >= VERB_ALGO) { 6378 char zname[255+1]; 6379 dname_str(xfr->name, zname); 6380 verbose(VERB_ALGO, "auth zone %s host %s type %s probe lookup has no address", zname, xfr->task_probe->lookup_target->host, (xfr->task_probe->lookup_aaaa?"AAAA":"A")); 6381 } 6382 } 6383 } else { 6384 if(verbosity >= VERB_ALGO) { 6385 char zname[255+1]; 6386 dname_str(xfr->name, zname); 6387 verbose(VERB_ALGO, "auth zone %s host %s type %s probe lookup failed", zname, xfr->task_probe->lookup_target->host, (xfr->task_probe->lookup_aaaa?"AAAA":"A")); 6388 } 6389 } 6390 if(xfr->task_probe->lookup_target->list && 6391 xfr->task_probe->lookup_target == xfr_probe_current_master(xfr)) 6392 xfr->task_probe->scan_addr = xfr->task_probe->lookup_target->list; 6393 6394 /* move to lookup AAAA after A lookup, move to next hostname lookup, 6395 * or move to send the probes, or, if nothing to do, end task_probe */ 6396 xfr_probe_move_to_next_lookup(xfr, env); 6397 xfr_probe_send_or_end(xfr, env); 6398 } 6399 6400 /** disown task_nextprobe. caller must hold xfr.lock */ 6401 static void 6402 xfr_nextprobe_disown(struct auth_xfer* xfr) 6403 { 6404 /* delete the timer, because the next worker to pick this up may 6405 * not have the same event base */ 6406 comm_timer_delete(xfr->task_nextprobe->timer); 6407 xfr->task_nextprobe->timer = NULL; 6408 xfr->task_nextprobe->next_probe = 0; 6409 /* we don't own this item anymore */ 6410 xfr->task_nextprobe->worker = NULL; 6411 xfr->task_nextprobe->env = NULL; 6412 } 6413 6414 /** xfer nextprobe timeout callback, this is part of task_nextprobe */ 6415 void 6416 auth_xfer_timer(void* arg) 6417 { 6418 struct auth_xfer* xfr = (struct auth_xfer*)arg; 6419 struct module_env* env; 6420 log_assert(xfr->task_nextprobe); 6421 lock_basic_lock(&xfr->lock); 6422 env = xfr->task_nextprobe->env; 6423 if(env->outnet->want_to_quit) { 6424 lock_basic_unlock(&xfr->lock); 6425 return; /* stop on quit */ 6426 } 6427 6428 /* see if zone has expired, and if so, also set auth_zone expired */ 6429 if(xfr->have_zone && !xfr->zone_expired && 6430 *env->now >= xfr->lease_time + xfr->expiry) { 6431 lock_basic_unlock(&xfr->lock); 6432 auth_xfer_set_expired(xfr, env, 1); 6433 lock_basic_lock(&xfr->lock); 6434 } 6435 6436 xfr_nextprobe_disown(xfr); 6437 6438 if(!xfr_start_probe(xfr, env, NULL)) { 6439 /* not started because already in progress */ 6440 lock_basic_unlock(&xfr->lock); 6441 } 6442 } 6443 6444 /** return true if there are probe (SOA UDP query) targets in the master list*/ 6445 static int 6446 have_probe_targets(struct auth_master* list) 6447 { 6448 struct auth_master* p; 6449 for(p=list; p; p = p->next) { 6450 if(!p->allow_notify && p->host) 6451 return 1; 6452 } 6453 return 0; 6454 } 6455 6456 /** start task_probe if possible, if no masters for probe start task_transfer 6457 * returns true if task has been started, and false if the task is already 6458 * in progress. */ 6459 static int 6460 xfr_start_probe(struct auth_xfer* xfr, struct module_env* env, 6461 struct auth_master* spec) 6462 { 6463 /* see if we need to start a probe (or maybe it is already in 6464 * progress (due to notify)) */ 6465 if(xfr->task_probe->worker == NULL) { 6466 if(!have_probe_targets(xfr->task_probe->masters) && 6467 !(xfr->task_probe->only_lookup && 6468 xfr->task_probe->masters != NULL)) { 6469 /* useless to pick up task_probe, no masters to 6470 * probe. Instead attempt to pick up task transfer */ 6471 if(xfr->task_transfer->worker == NULL) { 6472 xfr_start_transfer(xfr, env, spec); 6473 return 1; 6474 } 6475 /* task transfer already in progress */ 6476 return 0; 6477 } 6478 6479 /* pick up the probe task ourselves */ 6480 xfr->task_probe->worker = env->worker; 6481 xfr->task_probe->env = env; 6482 xfr->task_probe->cp = NULL; 6483 6484 /* start the task */ 6485 /* have not seen a new lease yet, this scan */ 6486 xfr->task_probe->have_new_lease = 0; 6487 /* if this was a timeout, no specific first master to scan */ 6488 /* otherwise, spec is nonNULL the notified master, scan 6489 * first and also transfer first from it */ 6490 xfr_probe_start_list(xfr, spec); 6491 /* setup to start the lookup of hostnames of masters afresh */ 6492 xfr_probe_start_lookups(xfr); 6493 /* send the probe packet or next send, or end task */ 6494 xfr_probe_send_or_end(xfr, env); 6495 return 1; 6496 } 6497 return 0; 6498 } 6499 6500 /** for task_nextprobe. 6501 * determine next timeout for auth_xfer. Also (re)sets timer. 6502 * @param xfr: task structure 6503 * @param env: module environment, with worker and time. 6504 * @param failure: set true if timer should be set for failure retry. 6505 * @param lookup_only: only perform lookups when timer done, 0 sec timeout 6506 */ 6507 static void 6508 xfr_set_timeout(struct auth_xfer* xfr, struct module_env* env, 6509 int failure, int lookup_only) 6510 { 6511 struct timeval tv; 6512 log_assert(xfr->task_nextprobe != NULL); 6513 log_assert(xfr->task_nextprobe->worker == NULL || 6514 xfr->task_nextprobe->worker == env->worker); 6515 /* normally, nextprobe = startoflease + refresh, 6516 * but if expiry is sooner, use that one. 6517 * after a failure, use the retry timer instead. */ 6518 xfr->task_nextprobe->next_probe = *env->now; 6519 if(xfr->lease_time && !failure) 6520 xfr->task_nextprobe->next_probe = xfr->lease_time; 6521 6522 if(!failure) { 6523 xfr->task_nextprobe->backoff = 0; 6524 } else { 6525 if(xfr->task_nextprobe->backoff == 0) 6526 xfr->task_nextprobe->backoff = 3; 6527 else xfr->task_nextprobe->backoff *= 2; 6528 if(xfr->task_nextprobe->backoff > AUTH_TRANSFER_MAX_BACKOFF) 6529 xfr->task_nextprobe->backoff = 6530 AUTH_TRANSFER_MAX_BACKOFF; 6531 } 6532 6533 if(xfr->have_zone) { 6534 time_t wait = xfr->refresh; 6535 if(failure) wait = xfr->retry; 6536 if(xfr->expiry < wait) 6537 xfr->task_nextprobe->next_probe += xfr->expiry; 6538 else xfr->task_nextprobe->next_probe += wait; 6539 if(failure) 6540 xfr->task_nextprobe->next_probe += 6541 xfr->task_nextprobe->backoff; 6542 /* put the timer exactly on expiry, if possible */ 6543 if(xfr->lease_time && xfr->lease_time+xfr->expiry < 6544 xfr->task_nextprobe->next_probe && 6545 xfr->lease_time+xfr->expiry > *env->now) 6546 xfr->task_nextprobe->next_probe = 6547 xfr->lease_time+xfr->expiry; 6548 } else { 6549 xfr->task_nextprobe->next_probe += 6550 xfr->task_nextprobe->backoff; 6551 } 6552 6553 if(!xfr->task_nextprobe->timer) { 6554 xfr->task_nextprobe->timer = comm_timer_create( 6555 env->worker_base, auth_xfer_timer, xfr); 6556 if(!xfr->task_nextprobe->timer) { 6557 /* failed to malloc memory. likely zone transfer 6558 * also fails for that. skip the timeout */ 6559 char zname[255+1]; 6560 dname_str(xfr->name, zname); 6561 log_err("cannot allocate timer, no refresh for %s", 6562 zname); 6563 return; 6564 } 6565 } 6566 xfr->task_nextprobe->worker = env->worker; 6567 xfr->task_nextprobe->env = env; 6568 if(*(xfr->task_nextprobe->env->now) <= xfr->task_nextprobe->next_probe) 6569 tv.tv_sec = xfr->task_nextprobe->next_probe - 6570 *(xfr->task_nextprobe->env->now); 6571 else tv.tv_sec = 0; 6572 if(tv.tv_sec != 0 && lookup_only && xfr->task_probe->masters) { 6573 /* don't lookup_only, if lookup timeout is 0 anyway, 6574 * or if we don't have masters to lookup */ 6575 tv.tv_sec = 0; 6576 if(xfr->task_probe->worker == NULL) 6577 xfr->task_probe->only_lookup = 1; 6578 } 6579 if(verbosity >= VERB_ALGO) { 6580 char zname[255+1]; 6581 dname_str(xfr->name, zname); 6582 verbose(VERB_ALGO, "auth zone %s timeout in %d seconds", 6583 zname, (int)tv.tv_sec); 6584 } 6585 tv.tv_usec = 0; 6586 comm_timer_set(xfr->task_nextprobe->timer, &tv); 6587 } 6588 6589 /** initial pick up of worker timeouts, ties events to worker event loop */ 6590 void 6591 auth_xfer_pickup_initial(struct auth_zones* az, struct module_env* env) 6592 { 6593 struct auth_xfer* x; 6594 lock_rw_wrlock(&az->lock); 6595 RBTREE_FOR(x, struct auth_xfer*, &az->xtree) { 6596 lock_basic_lock(&x->lock); 6597 /* set lease_time, because we now have timestamp in env, 6598 * (not earlier during startup and apply_cfg), and this 6599 * notes the start time when the data was acquired */ 6600 if(x->have_zone) 6601 x->lease_time = *env->now; 6602 if(x->task_nextprobe && x->task_nextprobe->worker == NULL) { 6603 xfr_set_timeout(x, env, 0, 1); 6604 } 6605 lock_basic_unlock(&x->lock); 6606 } 6607 lock_rw_unlock(&az->lock); 6608 } 6609 6610 void auth_zones_cleanup(struct auth_zones* az) 6611 { 6612 struct auth_xfer* x; 6613 lock_rw_wrlock(&az->lock); 6614 RBTREE_FOR(x, struct auth_xfer*, &az->xtree) { 6615 lock_basic_lock(&x->lock); 6616 if(x->task_nextprobe && x->task_nextprobe->worker != NULL) { 6617 xfr_nextprobe_disown(x); 6618 } 6619 if(x->task_probe && x->task_probe->worker != NULL) { 6620 xfr_probe_disown(x); 6621 } 6622 if(x->task_transfer && x->task_transfer->worker != NULL) { 6623 auth_chunks_delete(x->task_transfer); 6624 xfr_transfer_disown(x); 6625 } 6626 lock_basic_unlock(&x->lock); 6627 } 6628 lock_rw_unlock(&az->lock); 6629 } 6630 6631 /** 6632 * malloc the xfer and tasks 6633 * @param z: auth_zone with name of zone. 6634 */ 6635 static struct auth_xfer* 6636 auth_xfer_new(struct auth_zone* z) 6637 { 6638 struct auth_xfer* xfr; 6639 xfr = (struct auth_xfer*)calloc(1, sizeof(*xfr)); 6640 if(!xfr) return NULL; 6641 xfr->name = memdup(z->name, z->namelen); 6642 if(!xfr->name) { 6643 free(xfr); 6644 return NULL; 6645 } 6646 xfr->node.key = xfr; 6647 xfr->namelen = z->namelen; 6648 xfr->namelabs = z->namelabs; 6649 xfr->dclass = z->dclass; 6650 6651 xfr->task_nextprobe = (struct auth_nextprobe*)calloc(1, 6652 sizeof(struct auth_nextprobe)); 6653 if(!xfr->task_nextprobe) { 6654 free(xfr->name); 6655 free(xfr); 6656 return NULL; 6657 } 6658 xfr->task_probe = (struct auth_probe*)calloc(1, 6659 sizeof(struct auth_probe)); 6660 if(!xfr->task_probe) { 6661 free(xfr->task_nextprobe); 6662 free(xfr->name); 6663 free(xfr); 6664 return NULL; 6665 } 6666 xfr->task_transfer = (struct auth_transfer*)calloc(1, 6667 sizeof(struct auth_transfer)); 6668 if(!xfr->task_transfer) { 6669 free(xfr->task_probe); 6670 free(xfr->task_nextprobe); 6671 free(xfr->name); 6672 free(xfr); 6673 return NULL; 6674 } 6675 6676 lock_basic_init(&xfr->lock); 6677 lock_protect(&xfr->lock, &xfr->name, sizeof(xfr->name)); 6678 lock_protect(&xfr->lock, &xfr->namelen, sizeof(xfr->namelen)); 6679 lock_protect(&xfr->lock, xfr->name, xfr->namelen); 6680 lock_protect(&xfr->lock, &xfr->namelabs, sizeof(xfr->namelabs)); 6681 lock_protect(&xfr->lock, &xfr->dclass, sizeof(xfr->dclass)); 6682 lock_protect(&xfr->lock, &xfr->notify_received, sizeof(xfr->notify_received)); 6683 lock_protect(&xfr->lock, &xfr->notify_serial, sizeof(xfr->notify_serial)); 6684 lock_protect(&xfr->lock, &xfr->zone_expired, sizeof(xfr->zone_expired)); 6685 lock_protect(&xfr->lock, &xfr->have_zone, sizeof(xfr->have_zone)); 6686 lock_protect(&xfr->lock, &xfr->serial, sizeof(xfr->serial)); 6687 lock_protect(&xfr->lock, &xfr->retry, sizeof(xfr->retry)); 6688 lock_protect(&xfr->lock, &xfr->refresh, sizeof(xfr->refresh)); 6689 lock_protect(&xfr->lock, &xfr->expiry, sizeof(xfr->expiry)); 6690 lock_protect(&xfr->lock, &xfr->lease_time, sizeof(xfr->lease_time)); 6691 lock_protect(&xfr->lock, &xfr->task_nextprobe->worker, 6692 sizeof(xfr->task_nextprobe->worker)); 6693 lock_protect(&xfr->lock, &xfr->task_probe->worker, 6694 sizeof(xfr->task_probe->worker)); 6695 lock_protect(&xfr->lock, &xfr->task_transfer->worker, 6696 sizeof(xfr->task_transfer->worker)); 6697 lock_basic_lock(&xfr->lock); 6698 return xfr; 6699 } 6700 6701 /** Create auth_xfer structure. 6702 * This populates the have_zone, soa values, and so on times. 6703 * and sets the timeout, if a zone transfer is needed a short timeout is set. 6704 * For that the auth_zone itself must exist (and read in zonefile) 6705 * returns false on alloc failure. */ 6706 struct auth_xfer* 6707 auth_xfer_create(struct auth_zones* az, struct auth_zone* z) 6708 { 6709 struct auth_xfer* xfr; 6710 6711 /* malloc it */ 6712 xfr = auth_xfer_new(z); 6713 if(!xfr) { 6714 log_err("malloc failure"); 6715 return NULL; 6716 } 6717 /* insert in tree */ 6718 (void)rbtree_insert(&az->xtree, &xfr->node); 6719 return xfr; 6720 } 6721 6722 /** create new auth_master structure */ 6723 static struct auth_master* 6724 auth_master_new(struct auth_master*** list) 6725 { 6726 struct auth_master *m; 6727 m = (struct auth_master*)calloc(1, sizeof(*m)); 6728 if(!m) { 6729 log_err("malloc failure"); 6730 return NULL; 6731 } 6732 /* set first pointer to m, or next pointer of previous element to m */ 6733 (**list) = m; 6734 /* store m's next pointer as future point to store at */ 6735 (*list) = &(m->next); 6736 return m; 6737 } 6738 6739 /** dup_prefix : create string from initial part of other string, malloced */ 6740 static char* 6741 dup_prefix(char* str, size_t num) 6742 { 6743 char* result; 6744 size_t len = strlen(str); 6745 if(len < num) num = len; /* not more than strlen */ 6746 result = (char*)malloc(num+1); 6747 if(!result) { 6748 log_err("malloc failure"); 6749 return result; 6750 } 6751 memmove(result, str, num); 6752 result[num] = 0; 6753 return result; 6754 } 6755 6756 /** dup string and print error on error */ 6757 static char* 6758 dup_all(char* str) 6759 { 6760 char* result = strdup(str); 6761 if(!result) { 6762 log_err("malloc failure"); 6763 return NULL; 6764 } 6765 return result; 6766 } 6767 6768 /** find first of two characters */ 6769 static char* 6770 str_find_first_of_chars(char* s, char a, char b) 6771 { 6772 char* ra = strchr(s, a); 6773 char* rb = strchr(s, b); 6774 if(!ra) return rb; 6775 if(!rb) return ra; 6776 if(ra < rb) return ra; 6777 return rb; 6778 } 6779 6780 /** parse URL into host and file parts, false on malloc or parse error */ 6781 static int 6782 parse_url(char* url, char** host, char** file, int* port, int* ssl) 6783 { 6784 char* p = url; 6785 /* parse http://www.example.com/file.htm 6786 * or http://127.0.0.1 (index.html) 6787 * or https://[::1@1234]/a/b/c/d */ 6788 *ssl = 1; 6789 *port = AUTH_HTTPS_PORT; 6790 6791 /* parse http:// or https:// */ 6792 if(strncmp(p, "http://", 7) == 0) { 6793 p += 7; 6794 *ssl = 0; 6795 *port = AUTH_HTTP_PORT; 6796 } else if(strncmp(p, "https://", 8) == 0) { 6797 p += 8; 6798 } else if(strstr(p, "://") && strchr(p, '/') > strstr(p, "://") && 6799 strchr(p, ':') >= strstr(p, "://")) { 6800 char* uri = dup_prefix(p, (size_t)(strstr(p, "://")-p)); 6801 log_err("protocol %s:// not supported (for url %s)", 6802 uri?uri:"", p); 6803 free(uri); 6804 return 0; 6805 } 6806 6807 /* parse hostname part */ 6808 if(p[0] == '[') { 6809 char* end = strchr(p, ']'); 6810 p++; /* skip over [ */ 6811 if(end) { 6812 *host = dup_prefix(p, (size_t)(end-p)); 6813 if(!*host) return 0; 6814 p = end+1; /* skip over ] */ 6815 } else { 6816 *host = dup_all(p); 6817 if(!*host) return 0; 6818 p = end; 6819 } 6820 } else { 6821 char* end = str_find_first_of_chars(p, ':', '/'); 6822 if(end) { 6823 *host = dup_prefix(p, (size_t)(end-p)); 6824 if(!*host) return 0; 6825 } else { 6826 *host = dup_all(p); 6827 if(!*host) return 0; 6828 } 6829 p = end; /* at next : or / or NULL */ 6830 } 6831 6832 /* parse port number */ 6833 if(p && p[0] == ':') { 6834 char* end = NULL; 6835 *port = strtol(p+1, &end, 10); 6836 p = end; 6837 } 6838 6839 /* parse filename part */ 6840 while(p && *p == '/') 6841 p++; 6842 if(!p || p[0] == 0) 6843 *file = strdup("index.html"); 6844 else *file = strdup(p); 6845 if(!*file) { 6846 log_err("malloc failure"); 6847 return 0; 6848 } 6849 return 1; 6850 } 6851 6852 int 6853 xfer_set_masters(struct auth_master** list, struct config_auth* c, 6854 int with_http) 6855 { 6856 struct auth_master* m; 6857 struct config_strlist* p; 6858 /* list points to the first, or next pointer for the new element */ 6859 while(*list) { 6860 list = &( (*list)->next ); 6861 } 6862 if(with_http) 6863 for(p = c->urls; p; p = p->next) { 6864 m = auth_master_new(&list); 6865 m->http = 1; 6866 if(!parse_url(p->str, &m->host, &m->file, &m->port, &m->ssl)) 6867 return 0; 6868 } 6869 for(p = c->masters; p; p = p->next) { 6870 m = auth_master_new(&list); 6871 m->ixfr = 1; /* this flag is not configurable */ 6872 m->host = strdup(p->str); 6873 if(!m->host) { 6874 log_err("malloc failure"); 6875 return 0; 6876 } 6877 } 6878 for(p = c->allow_notify; p; p = p->next) { 6879 m = auth_master_new(&list); 6880 m->allow_notify = 1; 6881 m->host = strdup(p->str); 6882 if(!m->host) { 6883 log_err("malloc failure"); 6884 return 0; 6885 } 6886 } 6887 return 1; 6888 } 6889 6890 #define SERIAL_BITS 32 6891 int 6892 compare_serial(uint32_t a, uint32_t b) 6893 { 6894 const uint32_t cutoff = ((uint32_t) 1 << (SERIAL_BITS - 1)); 6895 6896 if (a == b) { 6897 return 0; 6898 } else if ((a < b && b - a < cutoff) || (a > b && a - b > cutoff)) { 6899 return -1; 6900 } else { 6901 return 1; 6902 } 6903 } 6904