xref: /freebsd/contrib/unbound/services/cache/dns.c (revision cfd6422a5217410fbd66f7a7a8a64d9d85e61229)
1 /*
2  * services/cache/dns.c - Cache services for DNS using msg and rrset caches.
3  *
4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
5  *
6  * This software is open source.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * Redistributions of source code must retain the above copyright notice,
13  * this list of conditions and the following disclaimer.
14  *
15  * Redistributions in binary form must reproduce the above copyright notice,
16  * this list of conditions and the following disclaimer in the documentation
17  * and/or other materials provided with the distribution.
18  *
19  * Neither the name of the NLNET LABS nor the names of its contributors may
20  * be used to endorse or promote products derived from this software without
21  * specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /**
37  * \file
38  *
39  * This file contains the DNS cache.
40  */
41 #include "config.h"
42 #include "iterator/iter_delegpt.h"
43 #include "iterator/iter_utils.h"
44 #include "validator/val_nsec.h"
45 #include "validator/val_utils.h"
46 #include "services/cache/dns.h"
47 #include "services/cache/rrset.h"
48 #include "util/data/msgparse.h"
49 #include "util/data/msgreply.h"
50 #include "util/data/packed_rrset.h"
51 #include "util/data/dname.h"
52 #include "util/module.h"
53 #include "util/net_help.h"
54 #include "util/regional.h"
55 #include "util/config_file.h"
56 #include "sldns/sbuffer.h"
57 
58 /** store rrsets in the rrset cache.
59  * @param env: module environment with caches.
60  * @param rep: contains list of rrsets to store.
61  * @param now: current time.
62  * @param leeway: during prefetch how much leeway to update TTLs.
63  * 	This makes rrsets (other than type NS) timeout sooner so they get
64  * 	updated with a new full TTL.
65  * 	Type NS does not get this, because it must not be refreshed from the
66  * 	child domain, but keep counting down properly.
67  * @param pside: if from parentside discovered NS, so that its NS is okay
68  * 	in a prefetch situation to be updated (without becoming sticky).
69  * @param qrep: update rrsets here if cache is better
70  * @param region: for qrep allocs.
71  */
72 static void
73 store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
74 	time_t leeway, int pside, struct reply_info* qrep,
75 	struct regional* region)
76 {
77 	size_t i;
78 	/* see if rrset already exists in cache, if not insert it. */
79 	for(i=0; i<rep->rrset_count; i++) {
80 		rep->ref[i].key = rep->rrsets[i];
81 		rep->ref[i].id = rep->rrsets[i]->id;
82 		/* update ref if it was in the cache */
83 		switch(rrset_cache_update(env->rrset_cache, &rep->ref[i],
84 				env->alloc, now + ((ntohs(rep->ref[i].key->rk.type)==
85 				LDNS_RR_TYPE_NS && !pside)?0:leeway))) {
86 		case 0: /* ref unchanged, item inserted */
87 			break;
88 		case 2: /* ref updated, cache is superior */
89 			if(region) {
90 				struct ub_packed_rrset_key* ck;
91 				lock_rw_rdlock(&rep->ref[i].key->entry.lock);
92 				/* if deleted rrset, do not copy it */
93 				if(rep->ref[i].key->id == 0)
94 					ck = NULL;
95 				else 	ck = packed_rrset_copy_region(
96 					rep->ref[i].key, region, now);
97 				lock_rw_unlock(&rep->ref[i].key->entry.lock);
98 				if(ck) {
99 					/* use cached copy if memory allows */
100 					qrep->rrsets[i] = ck;
101 				}
102 			}
103 			/* no break: also copy key item */
104 			/* the line below is matched by gcc regex and silences
105 			 * the fallthrough warning */
106 			/* fallthrough */
107 		case 1: /* ref updated, item inserted */
108 			rep->rrsets[i] = rep->ref[i].key;
109 		}
110 	}
111 }
112 
113 /** delete message from message cache */
114 void
115 msg_cache_remove(struct module_env* env, uint8_t* qname, size_t qnamelen,
116 	uint16_t qtype, uint16_t qclass, uint16_t flags)
117 {
118 	struct query_info k;
119 	hashvalue_type h;
120 
121 	k.qname = qname;
122 	k.qname_len = qnamelen;
123 	k.qtype = qtype;
124 	k.qclass = qclass;
125 	k.local_alias = NULL;
126 	h = query_info_hash(&k, flags);
127 	slabhash_remove(env->msg_cache, h, &k);
128 }
129 
130 /** remove servfail msg cache entry */
131 static void
132 msg_del_servfail(struct module_env* env, struct query_info* qinfo,
133 	uint32_t flags)
134 {
135 	struct msgreply_entry* e;
136 	/* see if the entry is servfail, and then remove it, so that
137 	 * lookups move from the cacheresponse stage to the recursionresponse
138 	 * stage */
139 	e = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len,
140 		qinfo->qtype, qinfo->qclass, flags, 0, 0);
141 	if(!e) return;
142 	/* we don't check for the ttl here, also expired servfail entries
143 	 * are removed.  If the user uses serve-expired, they would still be
144 	 * used to answer from cache */
145 	if(FLAGS_GET_RCODE(((struct reply_info*)e->entry.data)->flags)
146 		!= LDNS_RCODE_SERVFAIL) {
147 		lock_rw_unlock(&e->entry.lock);
148 		return;
149 	}
150 	lock_rw_unlock(&e->entry.lock);
151 	msg_cache_remove(env, qinfo->qname, qinfo->qname_len, qinfo->qtype,
152 		qinfo->qclass, flags);
153 }
154 
155 void
156 dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
157 	hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside,
158 	struct reply_info* qrep, uint32_t flags, struct regional* region)
159 {
160 	struct msgreply_entry* e;
161 	time_t ttl = rep->ttl;
162 	size_t i;
163 
164 	/* store RRsets */
165         for(i=0; i<rep->rrset_count; i++) {
166 		rep->ref[i].key = rep->rrsets[i];
167 		rep->ref[i].id = rep->rrsets[i]->id;
168 	}
169 
170 	/* there was a reply_info_sortref(rep) here but it seems to be
171 	 * unnecessary, because the cache gets locked per rrset. */
172 	reply_info_set_ttls(rep, *env->now);
173 	store_rrsets(env, rep, *env->now, leeway, pside, qrep, region);
174 	if(ttl == 0 && !(flags & DNSCACHE_STORE_ZEROTTL)) {
175 		/* we do not store the message, but we did store the RRs,
176 		 * which could be useful for delegation information */
177 		verbose(VERB_ALGO, "TTL 0: dropped msg from cache");
178 		free(rep);
179 		/* if the message is SERVFAIL in cache, remove that SERVFAIL,
180 		 * so that the TTL 0 response can be returned for future
181 		 * responses (i.e. don't get answered by the servfail from
182 		 * cache, but instead go to recursion to get this TTL0
183 		 * response). */
184 		msg_del_servfail(env, qinfo, flags);
185 		return;
186 	}
187 
188 	/* store msg in the cache */
189 	reply_info_sortref(rep);
190 	if(!(e = query_info_entrysetup(qinfo, rep, hash))) {
191 		log_err("store_msg: malloc failed");
192 		return;
193 	}
194 	slabhash_insert(env->msg_cache, hash, &e->entry, rep, env->alloc);
195 }
196 
197 /** find closest NS or DNAME and returns the rrset (locked) */
198 static struct ub_packed_rrset_key*
199 find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen,
200 	uint16_t qclass, time_t now, uint16_t searchtype, int stripfront)
201 {
202 	struct ub_packed_rrset_key *rrset;
203 	uint8_t lablen;
204 
205 	if(stripfront) {
206 		/* strip off so that DNAMEs have strict subdomain match */
207 		lablen = *qname;
208 		qname += lablen + 1;
209 		qnamelen -= lablen + 1;
210 	}
211 
212 	/* snip off front part of qname until the type is found */
213 	while(qnamelen > 0) {
214 		if((rrset = rrset_cache_lookup(env->rrset_cache, qname,
215 			qnamelen, searchtype, qclass, 0, now, 0)))
216 			return rrset;
217 
218 		/* snip off front label */
219 		lablen = *qname;
220 		qname += lablen + 1;
221 		qnamelen -= lablen + 1;
222 	}
223 	return NULL;
224 }
225 
226 /** add addr to additional section */
227 static void
228 addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region,
229 	struct dns_msg* msg, time_t now)
230 {
231 	if((msg->rep->rrsets[msg->rep->rrset_count] =
232 		packed_rrset_copy_region(rrset, region, now))) {
233 		msg->rep->ar_numrrsets++;
234 		msg->rep->rrset_count++;
235 	}
236 }
237 
238 /** lookup message in message cache */
239 struct msgreply_entry*
240 msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen,
241 	uint16_t qtype, uint16_t qclass, uint16_t flags, time_t now, int wr)
242 {
243 	struct lruhash_entry* e;
244 	struct query_info k;
245 	hashvalue_type h;
246 
247 	k.qname = qname;
248 	k.qname_len = qnamelen;
249 	k.qtype = qtype;
250 	k.qclass = qclass;
251 	k.local_alias = NULL;
252 	h = query_info_hash(&k, flags);
253 	e = slabhash_lookup(env->msg_cache, h, &k, wr);
254 
255 	if(!e) return NULL;
256 	if( now > ((struct reply_info*)e->data)->ttl ) {
257 		lock_rw_unlock(&e->lock);
258 		return NULL;
259 	}
260 	return (struct msgreply_entry*)e->key;
261 }
262 
263 /** find and add A and AAAA records for nameservers in delegpt */
264 static int
265 find_add_addrs(struct module_env* env, uint16_t qclass,
266 	struct regional* region, struct delegpt* dp, time_t now,
267 	struct dns_msg** msg)
268 {
269 	struct delegpt_ns* ns;
270 	struct msgreply_entry* neg;
271 	struct ub_packed_rrset_key* akey;
272 	for(ns = dp->nslist; ns; ns = ns->next) {
273 		akey = rrset_cache_lookup(env->rrset_cache, ns->name,
274 			ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
275 		if(akey) {
276 			if(!delegpt_add_rrset_A(dp, region, akey, 0, NULL)) {
277 				lock_rw_unlock(&akey->entry.lock);
278 				return 0;
279 			}
280 			if(msg)
281 				addr_to_additional(akey, region, *msg, now);
282 			lock_rw_unlock(&akey->entry.lock);
283 		} else {
284 			/* BIT_CD on false because delegpt lookup does
285 			 * not use dns64 translation */
286 			neg = msg_cache_lookup(env, ns->name, ns->namelen,
287 				LDNS_RR_TYPE_A, qclass, 0, now, 0);
288 			if(neg) {
289 				delegpt_add_neg_msg(dp, neg);
290 				lock_rw_unlock(&neg->entry.lock);
291 			}
292 		}
293 		akey = rrset_cache_lookup(env->rrset_cache, ns->name,
294 			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
295 		if(akey) {
296 			if(!delegpt_add_rrset_AAAA(dp, region, akey, 0, NULL)) {
297 				lock_rw_unlock(&akey->entry.lock);
298 				return 0;
299 			}
300 			if(msg)
301 				addr_to_additional(akey, region, *msg, now);
302 			lock_rw_unlock(&akey->entry.lock);
303 		} else {
304 			/* BIT_CD on false because delegpt lookup does
305 			 * not use dns64 translation */
306 			neg = msg_cache_lookup(env, ns->name, ns->namelen,
307 				LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
308 			if(neg) {
309 				delegpt_add_neg_msg(dp, neg);
310 				lock_rw_unlock(&neg->entry.lock);
311 			}
312 		}
313 	}
314 	return 1;
315 }
316 
317 /** find and add A and AAAA records for missing nameservers in delegpt */
318 int
319 cache_fill_missing(struct module_env* env, uint16_t qclass,
320 	struct regional* region, struct delegpt* dp)
321 {
322 	struct delegpt_ns* ns;
323 	struct msgreply_entry* neg;
324 	struct ub_packed_rrset_key* akey;
325 	time_t now = *env->now;
326 	for(ns = dp->nslist; ns; ns = ns->next) {
327 		akey = rrset_cache_lookup(env->rrset_cache, ns->name,
328 			ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
329 		if(akey) {
330 			if(!delegpt_add_rrset_A(dp, region, akey, ns->lame,
331 				NULL)) {
332 				lock_rw_unlock(&akey->entry.lock);
333 				return 0;
334 			}
335 			log_nametypeclass(VERB_ALGO, "found in cache",
336 				ns->name, LDNS_RR_TYPE_A, qclass);
337 			lock_rw_unlock(&akey->entry.lock);
338 		} else {
339 			/* BIT_CD on false because delegpt lookup does
340 			 * not use dns64 translation */
341 			neg = msg_cache_lookup(env, ns->name, ns->namelen,
342 				LDNS_RR_TYPE_A, qclass, 0, now, 0);
343 			if(neg) {
344 				delegpt_add_neg_msg(dp, neg);
345 				lock_rw_unlock(&neg->entry.lock);
346 			}
347 		}
348 		akey = rrset_cache_lookup(env->rrset_cache, ns->name,
349 			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
350 		if(akey) {
351 			if(!delegpt_add_rrset_AAAA(dp, region, akey, ns->lame,
352 				NULL)) {
353 				lock_rw_unlock(&akey->entry.lock);
354 				return 0;
355 			}
356 			log_nametypeclass(VERB_ALGO, "found in cache",
357 				ns->name, LDNS_RR_TYPE_AAAA, qclass);
358 			lock_rw_unlock(&akey->entry.lock);
359 		} else {
360 			/* BIT_CD on false because delegpt lookup does
361 			 * not use dns64 translation */
362 			neg = msg_cache_lookup(env, ns->name, ns->namelen,
363 				LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
364 			if(neg) {
365 				delegpt_add_neg_msg(dp, neg);
366 				lock_rw_unlock(&neg->entry.lock);
367 			}
368 		}
369 	}
370 	return 1;
371 }
372 
373 /** find and add DS or NSEC to delegation msg */
374 static void
375 find_add_ds(struct module_env* env, struct regional* region,
376 	struct dns_msg* msg, struct delegpt* dp, time_t now)
377 {
378 	/* Lookup the DS or NSEC at the delegation point. */
379 	struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
380 		env->rrset_cache, dp->name, dp->namelen, LDNS_RR_TYPE_DS,
381 		msg->qinfo.qclass, 0, now, 0);
382 	if(!rrset) {
383 		/* NOTE: this won't work for alternate NSEC schemes
384 		 *	(opt-in, NSEC3) */
385 		rrset = rrset_cache_lookup(env->rrset_cache, dp->name,
386 			dp->namelen, LDNS_RR_TYPE_NSEC, msg->qinfo.qclass,
387 			0, now, 0);
388 		/* Note: the PACKED_RRSET_NSEC_AT_APEX flag is not used.
389 		 * since this is a referral, we need the NSEC at the parent
390 		 * side of the zone cut, not the NSEC at apex side. */
391 		if(rrset && nsec_has_type(rrset, LDNS_RR_TYPE_DS)) {
392 			lock_rw_unlock(&rrset->entry.lock);
393 			rrset = NULL; /* discard wrong NSEC */
394 		}
395 	}
396 	if(rrset) {
397 		/* add it to auth section. This is the second rrset. */
398 		if((msg->rep->rrsets[msg->rep->rrset_count] =
399 			packed_rrset_copy_region(rrset, region, now))) {
400 			msg->rep->ns_numrrsets++;
401 			msg->rep->rrset_count++;
402 		}
403 		lock_rw_unlock(&rrset->entry.lock);
404 	}
405 }
406 
407 struct dns_msg*
408 dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
409 	uint16_t qclass, struct regional* region, size_t capacity)
410 {
411 	struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
412 		sizeof(struct dns_msg));
413 	if(!msg)
414 		return NULL;
415 	msg->qinfo.qname = regional_alloc_init(region, qname, qnamelen);
416 	if(!msg->qinfo.qname)
417 		return NULL;
418 	msg->qinfo.qname_len = qnamelen;
419 	msg->qinfo.qtype = qtype;
420 	msg->qinfo.qclass = qclass;
421 	msg->qinfo.local_alias = NULL;
422 	/* non-packed reply_info, because it needs to grow the array */
423 	msg->rep = (struct reply_info*)regional_alloc_zero(region,
424 		sizeof(struct reply_info)-sizeof(struct rrset_ref));
425 	if(!msg->rep)
426 		return NULL;
427 	if(capacity > RR_COUNT_MAX)
428 		return NULL; /* integer overflow protection */
429 	msg->rep->flags = BIT_QR; /* with QR, no AA */
430 	msg->rep->qdcount = 1;
431 	msg->rep->rrsets = (struct ub_packed_rrset_key**)
432 		regional_alloc(region,
433 		capacity*sizeof(struct ub_packed_rrset_key*));
434 	if(!msg->rep->rrsets)
435 		return NULL;
436 	return msg;
437 }
438 
439 int
440 dns_msg_authadd(struct dns_msg* msg, struct regional* region,
441 	struct ub_packed_rrset_key* rrset, time_t now)
442 {
443 	if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
444 		packed_rrset_copy_region(rrset, region, now)))
445 		return 0;
446 	msg->rep->ns_numrrsets++;
447 	return 1;
448 }
449 
450 int
451 dns_msg_ansadd(struct dns_msg* msg, struct regional* region,
452 	struct ub_packed_rrset_key* rrset, time_t now)
453 {
454 	if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
455 		packed_rrset_copy_region(rrset, region, now)))
456 		return 0;
457 	msg->rep->an_numrrsets++;
458 	return 1;
459 }
460 
461 struct delegpt*
462 dns_cache_find_delegation(struct module_env* env, uint8_t* qname,
463 	size_t qnamelen, uint16_t qtype, uint16_t qclass,
464 	struct regional* region, struct dns_msg** msg, time_t now)
465 {
466 	/* try to find closest NS rrset */
467 	struct ub_packed_rrset_key* nskey;
468 	struct packed_rrset_data* nsdata;
469 	struct delegpt* dp;
470 
471 	nskey = find_closest_of_type(env, qname, qnamelen, qclass, now,
472 		LDNS_RR_TYPE_NS, 0);
473 	if(!nskey) /* hope the caller has hints to prime or something */
474 		return NULL;
475 	nsdata = (struct packed_rrset_data*)nskey->entry.data;
476 	/* got the NS key, create delegation point */
477 	dp = delegpt_create(region);
478 	if(!dp || !delegpt_set_name(dp, region, nskey->rk.dname)) {
479 		lock_rw_unlock(&nskey->entry.lock);
480 		log_err("find_delegation: out of memory");
481 		return NULL;
482 	}
483 	/* create referral message */
484 	if(msg) {
485 		/* allocate the array to as much as we could need:
486 		 *	NS rrset + DS/NSEC rrset +
487 		 *	A rrset for every NS RR
488 		 *	AAAA rrset for every NS RR
489 		 */
490 		*msg = dns_msg_create(qname, qnamelen, qtype, qclass, region,
491 			2 + nsdata->count*2);
492 		if(!*msg || !dns_msg_authadd(*msg, region, nskey, now)) {
493 			lock_rw_unlock(&nskey->entry.lock);
494 			log_err("find_delegation: out of memory");
495 			return NULL;
496 		}
497 	}
498 	if(!delegpt_rrset_add_ns(dp, region, nskey, 0))
499 		log_err("find_delegation: addns out of memory");
500 	lock_rw_unlock(&nskey->entry.lock); /* first unlock before next lookup*/
501 	/* find and add DS/NSEC (if any) */
502 	if(msg)
503 		find_add_ds(env, region, *msg, dp, now);
504 	/* find and add A entries */
505 	if(!find_add_addrs(env, qclass, region, dp, now, msg))
506 		log_err("find_delegation: addrs out of memory");
507 	return dp;
508 }
509 
510 /** allocate dns_msg from query_info and reply_info */
511 static struct dns_msg*
512 gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
513 {
514 	struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
515 		sizeof(struct dns_msg));
516 	if(!msg)
517 		return NULL;
518 	memcpy(&msg->qinfo, q, sizeof(struct query_info));
519 	msg->qinfo.qname = regional_alloc_init(region, q->qname, q->qname_len);
520 	if(!msg->qinfo.qname)
521 		return NULL;
522 	/* allocate replyinfo struct and rrset key array separately */
523 	msg->rep = (struct reply_info*)regional_alloc(region,
524 		sizeof(struct reply_info) - sizeof(struct rrset_ref));
525 	if(!msg->rep)
526 		return NULL;
527 	if(num > RR_COUNT_MAX)
528 		return NULL; /* integer overflow protection */
529 	msg->rep->rrsets = (struct ub_packed_rrset_key**)
530 		regional_alloc(region,
531 		num * sizeof(struct ub_packed_rrset_key*));
532 	if(!msg->rep->rrsets)
533 		return NULL;
534 	return msg;
535 }
536 
537 struct dns_msg*
538 tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
539 	struct regional* region, time_t now, int allow_expired,
540 	struct regional* scratch)
541 {
542 	struct dns_msg* msg;
543 	size_t i;
544 	int is_expired = 0;
545 	time_t now_control = now;
546 	if(now > r->ttl) {
547 		/* Check if we are allowed to serve expired */
548 		if(allow_expired) {
549 			if(env->cfg->serve_expired_ttl &&
550 				r->serve_expired_ttl < now) {
551 				return NULL;
552 			}
553 		} else {
554 			return NULL;
555 		}
556 		/* Change the current time so we can pass the below TTL checks when
557 		 * serving expired data. */
558 		now_control = r->ttl - env->cfg->serve_expired_reply_ttl;
559 		is_expired = 1;
560 	}
561 
562 	msg = gen_dns_msg(region, q, r->rrset_count);
563 	if(!msg) return NULL;
564 	msg->rep->flags = r->flags;
565 	msg->rep->qdcount = r->qdcount;
566 	msg->rep->ttl = is_expired
567 		?SERVE_EXPIRED_REPLY_TTL
568 		:r->ttl - now;
569 	if(r->prefetch_ttl > now)
570 		msg->rep->prefetch_ttl = r->prefetch_ttl - now;
571 	else
572 		msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
573 	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
574 	msg->rep->security = r->security;
575 	msg->rep->an_numrrsets = r->an_numrrsets;
576 	msg->rep->ns_numrrsets = r->ns_numrrsets;
577 	msg->rep->ar_numrrsets = r->ar_numrrsets;
578 	msg->rep->rrset_count = r->rrset_count;
579 	msg->rep->authoritative = r->authoritative;
580 	if(!rrset_array_lock(r->ref, r->rrset_count, now_control)) {
581 		return NULL;
582 	}
583 	if(r->an_numrrsets > 0 && (r->rrsets[0]->rk.type == htons(
584 		LDNS_RR_TYPE_CNAME) || r->rrsets[0]->rk.type == htons(
585 		LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(q, r)) {
586 		/* cname chain is now invalid, reconstruct msg */
587 		rrset_array_unlock(r->ref, r->rrset_count);
588 		return NULL;
589 	}
590 	if(r->security == sec_status_secure && !reply_all_rrsets_secure(r)) {
591 		/* message rrsets have changed status, revalidate */
592 		rrset_array_unlock(r->ref, r->rrset_count);
593 		return NULL;
594 	}
595 	for(i=0; i<msg->rep->rrset_count; i++) {
596 		msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i],
597 			region, now);
598 		if(!msg->rep->rrsets[i]) {
599 			rrset_array_unlock(r->ref, r->rrset_count);
600 			return NULL;
601 		}
602 	}
603 	if(env)
604 		rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref,
605 		r->rrset_count);
606 	else
607 		rrset_array_unlock(r->ref, r->rrset_count);
608 	return msg;
609 }
610 
611 /** synthesize RRset-only response from cached RRset item */
612 static struct dns_msg*
613 rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
614 	time_t now, struct query_info* q)
615 {
616 	struct dns_msg* msg;
617 	struct packed_rrset_data* d = (struct packed_rrset_data*)
618 		rrset->entry.data;
619 	if(now > d->ttl)
620 		return NULL;
621 	msg = gen_dns_msg(region, q, 1); /* only the CNAME (or other) RRset */
622 	if(!msg)
623 		return NULL;
624 	msg->rep->flags = BIT_QR; /* reply, no AA, no error */
625         msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
626 	msg->rep->qdcount = 1;
627 	msg->rep->ttl = d->ttl - now;
628 	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
629 	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
630 	msg->rep->security = sec_status_unchecked;
631 	msg->rep->an_numrrsets = 1;
632 	msg->rep->ns_numrrsets = 0;
633 	msg->rep->ar_numrrsets = 0;
634 	msg->rep->rrset_count = 1;
635 	msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
636 	if(!msg->rep->rrsets[0]) /* copy CNAME */
637 		return NULL;
638 	return msg;
639 }
640 
641 /** synthesize DNAME+CNAME response from cached DNAME item */
642 static struct dns_msg*
643 synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
644 	time_t now, struct query_info* q, enum sec_status* sec_status)
645 {
646 	struct dns_msg* msg;
647 	struct ub_packed_rrset_key* ck;
648 	struct packed_rrset_data* newd, *d = (struct packed_rrset_data*)
649 		rrset->entry.data;
650 	uint8_t* newname, *dtarg = NULL;
651 	size_t newlen, dtarglen;
652 	if(now > d->ttl)
653 		return NULL;
654 	/* only allow validated (with DNSSEC) DNAMEs used from cache
655 	 * for insecure DNAMEs, query again. */
656 	*sec_status = d->security;
657 	/* return sec status, so the status of the CNAME can be checked
658 	 * by the calling routine. */
659 	msg = gen_dns_msg(region, q, 2); /* DNAME + CNAME RRset */
660 	if(!msg)
661 		return NULL;
662 	msg->rep->flags = BIT_QR; /* reply, no AA, no error */
663         msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
664 	msg->rep->qdcount = 1;
665 	msg->rep->ttl = d->ttl - now;
666 	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
667 	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
668 	msg->rep->security = sec_status_unchecked;
669 	msg->rep->an_numrrsets = 1;
670 	msg->rep->ns_numrrsets = 0;
671 	msg->rep->ar_numrrsets = 0;
672 	msg->rep->rrset_count = 1;
673 	msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
674 	if(!msg->rep->rrsets[0]) /* copy DNAME */
675 		return NULL;
676 	/* synth CNAME rrset */
677 	get_cname_target(rrset, &dtarg, &dtarglen);
678 	if(!dtarg)
679 		return NULL;
680 	newlen = q->qname_len + dtarglen - rrset->rk.dname_len;
681 	if(newlen > LDNS_MAX_DOMAINLEN) {
682 		msg->rep->flags |= LDNS_RCODE_YXDOMAIN;
683 		return msg;
684 	}
685 	newname = (uint8_t*)regional_alloc(region, newlen);
686 	if(!newname)
687 		return NULL;
688 	/* new name is concatenation of qname front (without DNAME owner)
689 	 * and DNAME target name */
690 	memcpy(newname, q->qname, q->qname_len-rrset->rk.dname_len);
691 	memmove(newname+(q->qname_len-rrset->rk.dname_len), dtarg, dtarglen);
692 	/* create rest of CNAME rrset */
693 	ck = (struct ub_packed_rrset_key*)regional_alloc(region,
694 		sizeof(struct ub_packed_rrset_key));
695 	if(!ck)
696 		return NULL;
697 	memset(&ck->entry, 0, sizeof(ck->entry));
698 	msg->rep->rrsets[1] = ck;
699 	ck->entry.key = ck;
700 	ck->rk.type = htons(LDNS_RR_TYPE_CNAME);
701 	ck->rk.rrset_class = rrset->rk.rrset_class;
702 	ck->rk.flags = 0;
703 	ck->rk.dname = regional_alloc_init(region, q->qname, q->qname_len);
704 	if(!ck->rk.dname)
705 		return NULL;
706 	ck->rk.dname_len = q->qname_len;
707 	ck->entry.hash = rrset_key_hash(&ck->rk);
708 	newd = (struct packed_rrset_data*)regional_alloc_zero(region,
709 		sizeof(struct packed_rrset_data) + sizeof(size_t) +
710 		sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t)
711 		+ newlen);
712 	if(!newd)
713 		return NULL;
714 	ck->entry.data = newd;
715 	newd->ttl = 0; /* 0 for synthesized CNAME TTL */
716 	newd->count = 1;
717 	newd->rrsig_count = 0;
718 	newd->trust = rrset_trust_ans_noAA;
719 	newd->rr_len = (size_t*)((uint8_t*)newd +
720 		sizeof(struct packed_rrset_data));
721 	newd->rr_len[0] = newlen + sizeof(uint16_t);
722 	packed_rrset_ptr_fixup(newd);
723 	newd->rr_ttl[0] = newd->ttl;
724 	msg->rep->ttl = newd->ttl;
725 	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(newd->ttl);
726 	msg->rep->serve_expired_ttl = newd->ttl + SERVE_EXPIRED_TTL;
727 	sldns_write_uint16(newd->rr_data[0], newlen);
728 	memmove(newd->rr_data[0] + sizeof(uint16_t), newname, newlen);
729 	msg->rep->an_numrrsets ++;
730 	msg->rep->rrset_count ++;
731 	return msg;
732 }
733 
734 /** Fill TYPE_ANY response with some data from cache */
735 static struct dns_msg*
736 fill_any(struct module_env* env,
737 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
738 	struct regional* region)
739 {
740 	time_t now = *env->now;
741 	struct dns_msg* msg = NULL;
742 	uint16_t lookup[] = {LDNS_RR_TYPE_A, LDNS_RR_TYPE_AAAA,
743 		LDNS_RR_TYPE_MX, LDNS_RR_TYPE_SOA, LDNS_RR_TYPE_NS,
744 		LDNS_RR_TYPE_DNAME, 0};
745 	int i, num=6; /* number of RR types to look up */
746 	log_assert(lookup[num] == 0);
747 
748 	if(env->cfg->deny_any) {
749 		/* return empty message */
750 		msg = dns_msg_create(qname, qnamelen, qtype, qclass,
751 			region, 0);
752 		if(!msg) {
753 			return NULL;
754 		}
755 		/* set NOTIMPL for RFC 8482 */
756 		msg->rep->flags |= LDNS_RCODE_NOTIMPL;
757 		msg->rep->security = sec_status_indeterminate;
758 		return msg;
759 	}
760 
761 	for(i=0; i<num; i++) {
762 		/* look up this RR for inclusion in type ANY response */
763 		struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
764 			env->rrset_cache, qname, qnamelen, lookup[i],
765 			qclass, 0, now, 0);
766 		struct packed_rrset_data *d;
767 		if(!rrset)
768 			continue;
769 
770 		/* only if rrset from answer section */
771 		d = (struct packed_rrset_data*)rrset->entry.data;
772 		if(d->trust == rrset_trust_add_noAA ||
773 			d->trust == rrset_trust_auth_noAA ||
774 			d->trust == rrset_trust_add_AA ||
775 			d->trust == rrset_trust_auth_AA) {
776 			lock_rw_unlock(&rrset->entry.lock);
777 			continue;
778 		}
779 
780 		/* create msg if none */
781 		if(!msg) {
782 			msg = dns_msg_create(qname, qnamelen, qtype, qclass,
783 				region, (size_t)(num-i));
784 			if(!msg) {
785 				lock_rw_unlock(&rrset->entry.lock);
786 				return NULL;
787 			}
788 		}
789 
790 		/* add RRset to response */
791 		if(!dns_msg_ansadd(msg, region, rrset, now)) {
792 			lock_rw_unlock(&rrset->entry.lock);
793 			return NULL;
794 		}
795 		lock_rw_unlock(&rrset->entry.lock);
796 	}
797 	return msg;
798 }
799 
800 struct dns_msg*
801 dns_cache_lookup(struct module_env* env,
802 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
803 	uint16_t flags, struct regional* region, struct regional* scratch,
804 	int no_partial)
805 {
806 	struct lruhash_entry* e;
807 	struct query_info k;
808 	hashvalue_type h;
809 	time_t now = *env->now;
810 	struct ub_packed_rrset_key* rrset;
811 
812 	/* lookup first, this has both NXdomains and ANSWER responses */
813 	k.qname = qname;
814 	k.qname_len = qnamelen;
815 	k.qtype = qtype;
816 	k.qclass = qclass;
817 	k.local_alias = NULL;
818 	h = query_info_hash(&k, flags);
819 	e = slabhash_lookup(env->msg_cache, h, &k, 0);
820 	if(e) {
821 		struct msgreply_entry* key = (struct msgreply_entry*)e->key;
822 		struct reply_info* data = (struct reply_info*)e->data;
823 		struct dns_msg* msg = tomsg(env, &key->key, data, region, now, 0,
824 			scratch);
825 		if(msg) {
826 			lock_rw_unlock(&e->lock);
827 			return msg;
828 		}
829 		/* could be msg==NULL; due to TTL or not all rrsets available */
830 		lock_rw_unlock(&e->lock);
831 	}
832 
833 	/* see if a DNAME exists. Checked for first, to enforce that DNAMEs
834 	 * are more important, the CNAME is resynthesized and thus
835 	 * consistent with the DNAME */
836 	if(!no_partial &&
837 		(rrset=find_closest_of_type(env, qname, qnamelen, qclass, now,
838 		LDNS_RR_TYPE_DNAME, 1))) {
839 		/* synthesize a DNAME+CNAME message based on this */
840 		enum sec_status sec_status = sec_status_unchecked;
841 		struct dns_msg* msg = synth_dname_msg(rrset, region, now, &k,
842 			&sec_status);
843 		if(msg) {
844 			struct ub_packed_rrset_key* cname_rrset;
845 			lock_rw_unlock(&rrset->entry.lock);
846 			/* now, after unlocking the DNAME rrset lock,
847 			 * check the sec_status, and see if we need to look
848 			 * up the CNAME record associated before it can
849 			 * be used */
850 			/* normally, only secure DNAMEs allowed from cache*/
851 			if(sec_status == sec_status_secure)
852 				return msg;
853 			/* but if we have a CNAME cached with this name, then we
854 			 * have previously already allowed this name to pass.
855 			 * the next cache lookup is going to fetch that CNAME itself,
856 			 * but it is better to have the (unsigned)DNAME + CNAME in
857 			 * that case */
858 			cname_rrset = rrset_cache_lookup(
859 				env->rrset_cache, qname, qnamelen,
860 				LDNS_RR_TYPE_CNAME, qclass, 0, now, 0);
861 			if(cname_rrset) {
862 				/* CNAME already synthesized by
863 				 * synth_dname_msg routine, so we can
864 				 * straight up return the msg */
865 				lock_rw_unlock(&cname_rrset->entry.lock);
866 				return msg;
867 			}
868 		} else {
869 			lock_rw_unlock(&rrset->entry.lock);
870 		}
871 	}
872 
873 	/* see if we have CNAME for this domain,
874 	 * but not for DS records (which are part of the parent) */
875 	if(!no_partial && qtype != LDNS_RR_TYPE_DS &&
876 	   (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
877 		LDNS_RR_TYPE_CNAME, qclass, 0, now, 0))) {
878 		uint8_t* wc = NULL;
879 		size_t wl;
880 		/* if the rrset is not a wildcard expansion, with wcname */
881 		/* because, if we return that CNAME rrset on its own, it is
882 		 * missing the NSEC or NSEC3 proof */
883 		if(!(val_rrset_wildcard(rrset, &wc, &wl) && wc != NULL)) {
884 			struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
885 			if(msg) {
886 				lock_rw_unlock(&rrset->entry.lock);
887 				return msg;
888 			}
889 		}
890 		lock_rw_unlock(&rrset->entry.lock);
891 	}
892 
893 	/* construct DS, DNSKEY messages from rrset cache. */
894 	if((qtype == LDNS_RR_TYPE_DS || qtype == LDNS_RR_TYPE_DNSKEY) &&
895 		(rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
896 		qtype, qclass, 0, now, 0))) {
897 		/* if the rrset is from the additional section, and the
898 		 * signatures have fallen off, then do not synthesize a msg
899 		 * instead, allow a full query for signed results to happen.
900 		 * Forego all rrset data from additional section, because
901 		 * some signatures may not be present and cause validation
902 		 * failure.
903 		 */
904 		struct packed_rrset_data *d = (struct packed_rrset_data*)
905 			rrset->entry.data;
906 		if(d->trust != rrset_trust_add_noAA &&
907 			d->trust != rrset_trust_add_AA &&
908 			(qtype == LDNS_RR_TYPE_DS ||
909 				(d->trust != rrset_trust_auth_noAA
910 				&& d->trust != rrset_trust_auth_AA) )) {
911 			struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
912 			if(msg) {
913 				lock_rw_unlock(&rrset->entry.lock);
914 				return msg;
915 			}
916 		}
917 		lock_rw_unlock(&rrset->entry.lock);
918 	}
919 
920 	/* stop downwards cache search on NXDOMAIN.
921 	 * Empty nonterminals are NOERROR, so an NXDOMAIN for foo
922 	 * means bla.foo also does not exist.  The DNSSEC proofs are
923 	 * the same.  We search upwards for NXDOMAINs. */
924 	if(env->cfg->harden_below_nxdomain) {
925 		while(!dname_is_root(k.qname)) {
926 			dname_remove_label(&k.qname, &k.qname_len);
927 			h = query_info_hash(&k, flags);
928 			e = slabhash_lookup(env->msg_cache, h, &k, 0);
929 			if(!e && k.qtype != LDNS_RR_TYPE_A &&
930 				env->cfg->qname_minimisation) {
931 				k.qtype = LDNS_RR_TYPE_A;
932 				h = query_info_hash(&k, flags);
933 				e = slabhash_lookup(env->msg_cache, h, &k, 0);
934 			}
935 			if(e) {
936 				struct reply_info* data = (struct reply_info*)e->data;
937 				struct dns_msg* msg;
938 				if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN
939 					&& data->security == sec_status_secure
940 					&& (data->an_numrrsets == 0 ||
941 						ntohs(data->rrsets[0]->rk.type) != LDNS_RR_TYPE_CNAME)
942 					&& (msg=tomsg(env, &k, data, region, now, 0, scratch))) {
943 					lock_rw_unlock(&e->lock);
944 					msg->qinfo.qname=qname;
945 					msg->qinfo.qname_len=qnamelen;
946 					/* check that DNSSEC really works out */
947 					msg->rep->security = sec_status_unchecked;
948 					iter_scrub_nxdomain(msg);
949 					return msg;
950 				}
951 				lock_rw_unlock(&e->lock);
952 			}
953 			k.qtype = qtype;
954 		}
955 	}
956 
957 	/* fill common RR types for ANY response to avoid requery */
958 	if(qtype == LDNS_RR_TYPE_ANY) {
959 		return fill_any(env, qname, qnamelen, qtype, qclass, region);
960 	}
961 
962 	return NULL;
963 }
964 
965 int
966 dns_cache_store(struct module_env* env, struct query_info* msgqinf,
967         struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
968 	struct regional* region, uint32_t flags)
969 {
970 	struct reply_info* rep = NULL;
971 	/* alloc, malloc properly (not in region, like msg is) */
972 	rep = reply_info_copy(msgrep, env->alloc, NULL);
973 	if(!rep)
974 		return 0;
975 	/* ttl must be relative ;i.e. 0..86400 not  time(0)+86400.
976 	 * the env->now is added to message and RRsets in this routine. */
977 	/* the leeway is used to invalidate other rrsets earlier */
978 
979 	if(is_referral) {
980 		/* store rrsets */
981 		struct rrset_ref ref;
982 		size_t i;
983 		for(i=0; i<rep->rrset_count; i++) {
984 			packed_rrset_ttl_add((struct packed_rrset_data*)
985 				rep->rrsets[i]->entry.data, *env->now);
986 			ref.key = rep->rrsets[i];
987 			ref.id = rep->rrsets[i]->id;
988 			/*ignore ret: it was in the cache, ref updated */
989 			/* no leeway for typeNS */
990 			(void)rrset_cache_update(env->rrset_cache, &ref,
991 				env->alloc, *env->now +
992 				((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS
993 				 && !pside) ? 0:leeway));
994 		}
995 		free(rep);
996 		return 1;
997 	} else {
998 		/* store msg, and rrsets */
999 		struct query_info qinf;
1000 		hashvalue_type h;
1001 
1002 		qinf = *msgqinf;
1003 		qinf.qname = memdup(msgqinf->qname, msgqinf->qname_len);
1004 		if(!qinf.qname) {
1005 			reply_info_parsedelete(rep, env->alloc);
1006 			return 0;
1007 		}
1008 		/* fixup flags to be sensible for a reply based on the cache */
1009 		/* this module means that RA is available. It is an answer QR.
1010 		 * Not AA from cache. Not CD in cache (depends on client bit). */
1011 		rep->flags |= (BIT_RA | BIT_QR);
1012 		rep->flags &= ~(BIT_AA | BIT_CD);
1013 		h = query_info_hash(&qinf, (uint16_t)flags);
1014 		dns_cache_store_msg(env, &qinf, h, rep, leeway, pside, msgrep,
1015 			flags, region);
1016 		/* qname is used inside query_info_entrysetup, and set to
1017 		 * NULL. If it has not been used, free it. free(0) is safe. */
1018 		free(qinf.qname);
1019 	}
1020 	return 1;
1021 }
1022 
1023 int
1024 dns_cache_prefetch_adjust(struct module_env* env, struct query_info* qinfo,
1025         time_t adjust, uint16_t flags)
1026 {
1027 	struct msgreply_entry* msg;
1028 	msg = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len,
1029 		qinfo->qtype, qinfo->qclass, flags, *env->now, 1);
1030 	if(msg) {
1031 		struct reply_info* rep = (struct reply_info*)msg->entry.data;
1032 		if(rep) {
1033 			rep->prefetch_ttl += adjust;
1034 			lock_rw_unlock(&msg->entry.lock);
1035 			return 1;
1036 		}
1037 		lock_rw_unlock(&msg->entry.lock);
1038 	}
1039 	return 0;
1040 }
1041