xref: /freebsd/contrib/unbound/services/outside_network.c (revision 13ea0450a9c8742119d36f3bf8f47accdce46e54)
1 /*
2  * services/outside_network.c - implement sending of queries and wait answer.
3  *
4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
5  *
6  * This software is open source.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * Redistributions of source code must retain the above copyright notice,
13  * this list of conditions and the following disclaimer.
14  *
15  * Redistributions in binary form must reproduce the above copyright notice,
16  * this list of conditions and the following disclaimer in the documentation
17  * and/or other materials provided with the distribution.
18  *
19  * Neither the name of the NLNET LABS nor the names of its contributors may
20  * be used to endorse or promote products derived from this software without
21  * specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /**
37  * \file
38  *
39  * This file has functions to send queries to authoritative servers and
40  * wait for the pending answer events.
41  */
42 #include "config.h"
43 #include <ctype.h>
44 #ifdef HAVE_SYS_TYPES_H
45 #  include <sys/types.h>
46 #endif
47 #include <sys/time.h>
48 #include "services/outside_network.h"
49 #include "services/listen_dnsport.h"
50 #include "services/cache/infra.h"
51 #include "iterator/iterator.h"
52 #include "util/data/msgparse.h"
53 #include "util/data/msgreply.h"
54 #include "util/data/msgencode.h"
55 #include "util/data/dname.h"
56 #include "util/netevent.h"
57 #include "util/log.h"
58 #include "util/net_help.h"
59 #include "util/random.h"
60 #include "util/fptr_wlist.h"
61 #include "sldns/sbuffer.h"
62 #include "dnstap/dnstap.h"
63 #ifdef HAVE_OPENSSL_SSL_H
64 #include <openssl/ssl.h>
65 #endif
66 
67 #ifdef HAVE_NETDB_H
68 #include <netdb.h>
69 #endif
70 #include <fcntl.h>
71 
72 /** number of times to retry making a random ID that is unique. */
73 #define MAX_ID_RETRY 1000
74 /** number of times to retry finding interface, port that can be opened. */
75 #define MAX_PORT_RETRY 10000
76 /** number of retries on outgoing UDP queries */
77 #define OUTBOUND_UDP_RETRY 1
78 
79 /** initiate TCP transaction for serviced query */
80 static void serviced_tcp_initiate(struct serviced_query* sq, sldns_buffer* buff);
81 /** with a fd available, randomize and send UDP */
82 static int randomize_and_send_udp(struct pending* pend, sldns_buffer* packet,
83 	int timeout);
84 
85 /** remove waiting tcp from the outnet waiting list */
86 static void waiting_list_remove(struct outside_network* outnet,
87 	struct waiting_tcp* w);
88 
89 int
90 pending_cmp(const void* key1, const void* key2)
91 {
92 	struct pending *p1 = (struct pending*)key1;
93 	struct pending *p2 = (struct pending*)key2;
94 	if(p1->id < p2->id)
95 		return -1;
96 	if(p1->id > p2->id)
97 		return 1;
98 	log_assert(p1->id == p2->id);
99 	return sockaddr_cmp(&p1->addr, p1->addrlen, &p2->addr, p2->addrlen);
100 }
101 
102 int
103 serviced_cmp(const void* key1, const void* key2)
104 {
105 	struct serviced_query* q1 = (struct serviced_query*)key1;
106 	struct serviced_query* q2 = (struct serviced_query*)key2;
107 	int r;
108 	if(q1->qbuflen < q2->qbuflen)
109 		return -1;
110 	if(q1->qbuflen > q2->qbuflen)
111 		return 1;
112 	log_assert(q1->qbuflen == q2->qbuflen);
113 	log_assert(q1->qbuflen >= 15 /* 10 header, root, type, class */);
114 	/* alternate casing of qname is still the same query */
115 	if((r = memcmp(q1->qbuf, q2->qbuf, 10)) != 0)
116 		return r;
117 	if((r = memcmp(q1->qbuf+q1->qbuflen-4, q2->qbuf+q2->qbuflen-4, 4)) != 0)
118 		return r;
119 	if(q1->dnssec != q2->dnssec) {
120 		if(q1->dnssec < q2->dnssec)
121 			return -1;
122 		return 1;
123 	}
124 	if((r = query_dname_compare(q1->qbuf+10, q2->qbuf+10)) != 0)
125 		return r;
126 	if((r = edns_opt_list_compare(q1->opt_list, q2->opt_list)) != 0)
127 		return r;
128 	return sockaddr_cmp(&q1->addr, q1->addrlen, &q2->addr, q2->addrlen);
129 }
130 
131 /** delete waiting_tcp entry. Does not unlink from waiting list.
132  * @param w: to delete.
133  */
134 static void
135 waiting_tcp_delete(struct waiting_tcp* w)
136 {
137 	if(!w) return;
138 	if(w->timer)
139 		comm_timer_delete(w->timer);
140 	free(w);
141 }
142 
143 /**
144  * Pick random outgoing-interface of that family, and bind it.
145  * port set to 0 so OS picks a port number for us.
146  * if it is the ANY address, do not bind.
147  * @param w: tcp structure with destination address.
148  * @param s: socket fd.
149  * @return false on error, socket closed.
150  */
151 static int
152 pick_outgoing_tcp(struct waiting_tcp* w, int s)
153 {
154 	struct port_if* pi = NULL;
155 	int num;
156 #ifdef INET6
157 	if(addr_is_ip6(&w->addr, w->addrlen))
158 		num = w->outnet->num_ip6;
159 	else
160 #endif
161 		num = w->outnet->num_ip4;
162 	if(num == 0) {
163 		log_err("no TCP outgoing interfaces of family");
164 		log_addr(VERB_OPS, "for addr", &w->addr, w->addrlen);
165 #ifndef USE_WINSOCK
166 		close(s);
167 #else
168 		closesocket(s);
169 #endif
170 		return 0;
171 	}
172 #ifdef INET6
173 	if(addr_is_ip6(&w->addr, w->addrlen))
174 		pi = &w->outnet->ip6_ifs[ub_random_max(w->outnet->rnd, num)];
175 	else
176 #endif
177 		pi = &w->outnet->ip4_ifs[ub_random_max(w->outnet->rnd, num)];
178 	log_assert(pi);
179 	if(addr_is_any(&pi->addr, pi->addrlen)) {
180 		/* binding to the ANY interface is for listening sockets */
181 		return 1;
182 	}
183 	/* set port to 0 */
184 	if(addr_is_ip6(&pi->addr, pi->addrlen))
185 		((struct sockaddr_in6*)&pi->addr)->sin6_port = 0;
186 	else	((struct sockaddr_in*)&pi->addr)->sin_port = 0;
187 	if(bind(s, (struct sockaddr*)&pi->addr, pi->addrlen) != 0) {
188 #ifndef USE_WINSOCK
189 		log_err("outgoing tcp: bind: %s", strerror(errno));
190 		close(s);
191 #else
192 		log_err("outgoing tcp: bind: %s",
193 			wsa_strerror(WSAGetLastError()));
194 		closesocket(s);
195 #endif
196 		return 0;
197 	}
198 	log_addr(VERB_ALGO, "tcp bound to src", &pi->addr, pi->addrlen);
199 	return 1;
200 }
201 
202 /** get TCP file descriptor for address, returns -1 on failure,
203  * tcp_mss is 0 or maxseg size to set for TCP packets. */
204 int
205 outnet_get_tcp_fd(struct sockaddr_storage* addr, socklen_t addrlen, int tcp_mss)
206 {
207 	int s;
208 #ifdef SO_REUSEADDR
209 	int on = 1;
210 #endif
211 #ifdef INET6
212 	if(addr_is_ip6(addr, addrlen))
213 		s = socket(PF_INET6, SOCK_STREAM, IPPROTO_TCP);
214 	else
215 #endif
216 		s = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
217 	if(s == -1) {
218 #ifndef USE_WINSOCK
219 		log_err_addr("outgoing tcp: socket", strerror(errno),
220 			addr, addrlen);
221 #else
222 		log_err_addr("outgoing tcp: socket",
223 			wsa_strerror(WSAGetLastError()), addr, addrlen);
224 #endif
225 		return -1;
226 	}
227 
228 #ifdef SO_REUSEADDR
229 	if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on,
230 		(socklen_t)sizeof(on)) < 0) {
231 		verbose(VERB_ALGO, "outgoing tcp:"
232 			" setsockopt(.. SO_REUSEADDR ..) failed");
233 	}
234 #endif
235 
236 	if(tcp_mss > 0) {
237 #if defined(IPPROTO_TCP) && defined(TCP_MAXSEG)
238 		if(setsockopt(s, IPPROTO_TCP, TCP_MAXSEG,
239 			(void*)&tcp_mss, (socklen_t)sizeof(tcp_mss)) < 0) {
240 			verbose(VERB_ALGO, "outgoing tcp:"
241 				" setsockopt(.. TCP_MAXSEG ..) failed");
242 		}
243 #else
244 		verbose(VERB_ALGO, "outgoing tcp:"
245 			" setsockopt(TCP_MAXSEG) unsupported");
246 #endif /* defined(IPPROTO_TCP) && defined(TCP_MAXSEG) */
247 	}
248 
249 	return s;
250 }
251 
252 /** connect tcp connection to addr, 0 on failure */
253 int
254 outnet_tcp_connect(int s, struct sockaddr_storage* addr, socklen_t addrlen)
255 {
256 	if(connect(s, (struct sockaddr*)addr, addrlen) == -1) {
257 #ifndef USE_WINSOCK
258 #ifdef EINPROGRESS
259 		if(errno != EINPROGRESS) {
260 #endif
261 			if(tcp_connect_errno_needs_log(
262 				(struct sockaddr*)addr, addrlen))
263 				log_err_addr("outgoing tcp: connect",
264 					strerror(errno), addr, addrlen);
265 			close(s);
266 			return 0;
267 #ifdef EINPROGRESS
268 		}
269 #endif
270 #else /* USE_WINSOCK */
271 		if(WSAGetLastError() != WSAEINPROGRESS &&
272 			WSAGetLastError() != WSAEWOULDBLOCK) {
273 			closesocket(s);
274 			return 0;
275 		}
276 #endif
277 	}
278 	return 1;
279 }
280 
281 /** use next free buffer to service a tcp query */
282 static int
283 outnet_tcp_take_into_use(struct waiting_tcp* w, uint8_t* pkt, size_t pkt_len)
284 {
285 	struct pending_tcp* pend = w->outnet->tcp_free;
286 	int s;
287 	log_assert(pend);
288 	log_assert(pkt);
289 	log_assert(w->addrlen > 0);
290 	/* open socket */
291 	s = outnet_get_tcp_fd(&w->addr, w->addrlen, w->outnet->tcp_mss);
292 
293 	if(!pick_outgoing_tcp(w, s))
294 		return 0;
295 
296 	fd_set_nonblock(s);
297 #ifdef USE_OSX_MSG_FASTOPEN
298 	/* API for fast open is different here. We use a connectx() function and
299 	   then writes can happen as normal even using SSL.*/
300 	/* connectx requires that the len be set in the sockaddr struct*/
301 	struct sockaddr_in *addr_in = (struct sockaddr_in *)&w->addr;
302 	addr_in->sin_len = w->addrlen;
303 	sa_endpoints_t endpoints;
304 	endpoints.sae_srcif = 0;
305 	endpoints.sae_srcaddr = NULL;
306 	endpoints.sae_srcaddrlen = 0;
307 	endpoints.sae_dstaddr = (struct sockaddr *)&w->addr;
308 	endpoints.sae_dstaddrlen = w->addrlen;
309 	if (connectx(s, &endpoints, SAE_ASSOCID_ANY,
310 	             CONNECT_DATA_IDEMPOTENT | CONNECT_RESUME_ON_READ_WRITE,
311 	             NULL, 0, NULL, NULL) == -1) {
312 		/* if fails, failover to connect for OSX 10.10 */
313 #ifdef EINPROGRESS
314 		if(errno != EINPROGRESS) {
315 #else
316 		if(1) {
317 #endif
318 			if(connect(s, (struct sockaddr*)&w->addr, w->addrlen) == -1) {
319 #else /* USE_OSX_MSG_FASTOPEN*/
320 #ifdef USE_MSG_FASTOPEN
321 	pend->c->tcp_do_fastopen = 1;
322 	/* Only do TFO for TCP in which case no connect() is required here.
323 	   Don't combine client TFO with SSL, since OpenSSL can't
324 	   currently support doing a handshake on fd that already isn't connected*/
325 	if (w->outnet->sslctx && w->ssl_upstream) {
326 		if(connect(s, (struct sockaddr*)&w->addr, w->addrlen) == -1) {
327 #else /* USE_MSG_FASTOPEN*/
328 	if(connect(s, (struct sockaddr*)&w->addr, w->addrlen) == -1) {
329 #endif /* USE_MSG_FASTOPEN*/
330 #endif /* USE_OSX_MSG_FASTOPEN*/
331 #ifndef USE_WINSOCK
332 #ifdef EINPROGRESS
333 		if(errno != EINPROGRESS) {
334 #else
335 		if(1) {
336 #endif
337 			if(tcp_connect_errno_needs_log(
338 				(struct sockaddr*)&w->addr, w->addrlen))
339 				log_err_addr("outgoing tcp: connect",
340 					strerror(errno), &w->addr, w->addrlen);
341 			close(s);
342 #else /* USE_WINSOCK */
343 		if(WSAGetLastError() != WSAEINPROGRESS &&
344 			WSAGetLastError() != WSAEWOULDBLOCK) {
345 			closesocket(s);
346 #endif
347 			return 0;
348 		}
349 	}
350 #ifdef USE_MSG_FASTOPEN
351 	}
352 #endif /* USE_MSG_FASTOPEN */
353 #ifdef USE_OSX_MSG_FASTOPEN
354 		}
355 	}
356 #endif /* USE_OSX_MSG_FASTOPEN */
357 	if(w->outnet->sslctx && w->ssl_upstream) {
358 		pend->c->ssl = outgoing_ssl_fd(w->outnet->sslctx, s);
359 		if(!pend->c->ssl) {
360 			pend->c->fd = s;
361 			comm_point_close(pend->c);
362 			return 0;
363 		}
364 #ifdef USE_WINSOCK
365 		comm_point_tcp_win_bio_cb(pend->c, pend->c->ssl);
366 #endif
367 		pend->c->ssl_shake_state = comm_ssl_shake_write;
368 		if(w->tls_auth_name) {
369 #ifdef HAVE_SSL
370 			(void)SSL_set_tlsext_host_name(pend->c->ssl, w->tls_auth_name);
371 #endif
372 		}
373 #ifdef HAVE_SSL_SET1_HOST
374 		if(w->tls_auth_name) {
375 			SSL_set_verify(pend->c->ssl, SSL_VERIFY_PEER, NULL);
376 			/* setting the hostname makes openssl verify the
377                          * host name in the x509 certificate in the
378                          * SSL connection*/
379                         if(!SSL_set1_host(pend->c->ssl, w->tls_auth_name)) {
380                                 log_err("SSL_set1_host failed");
381 				pend->c->fd = s;
382 				SSL_free(pend->c->ssl);
383 				pend->c->ssl = NULL;
384 				comm_point_close(pend->c);
385 				return 0;
386 			}
387 		}
388 #endif /* HAVE_SSL_SET1_HOST */
389 	}
390 	w->pkt = NULL;
391 	w->next_waiting = (void*)pend;
392 	pend->id = LDNS_ID_WIRE(pkt);
393 	w->outnet->num_tcp_outgoing++;
394 	w->outnet->tcp_free = pend->next_free;
395 	pend->next_free = NULL;
396 	pend->query = w;
397 	pend->c->repinfo.addrlen = w->addrlen;
398 	memcpy(&pend->c->repinfo.addr, &w->addr, w->addrlen);
399 	sldns_buffer_clear(pend->c->buffer);
400 	sldns_buffer_write(pend->c->buffer, pkt, pkt_len);
401 	sldns_buffer_flip(pend->c->buffer);
402 	pend->c->tcp_is_reading = 0;
403 	pend->c->tcp_byte_count = 0;
404 	comm_point_start_listening(pend->c, s, -1);
405 	return 1;
406 }
407 
408 /** see if buffers can be used to service TCP queries */
409 static void
410 use_free_buffer(struct outside_network* outnet)
411 {
412 	struct waiting_tcp* w;
413 	while(outnet->tcp_free && outnet->tcp_wait_first
414 		&& !outnet->want_to_quit) {
415 		w = outnet->tcp_wait_first;
416 		outnet->tcp_wait_first = w->next_waiting;
417 		if(outnet->tcp_wait_last == w)
418 			outnet->tcp_wait_last = NULL;
419 		if(!outnet_tcp_take_into_use(w, w->pkt, w->pkt_len)) {
420 			comm_point_callback_type* cb = w->cb;
421 			void* cb_arg = w->cb_arg;
422 			waiting_tcp_delete(w);
423 			fptr_ok(fptr_whitelist_pending_tcp(cb));
424 			(void)(*cb)(NULL, cb_arg, NETEVENT_CLOSED, NULL);
425 		}
426 	}
427 }
428 
429 /** decommission a tcp buffer, closes commpoint and frees waiting_tcp entry */
430 static void
431 decommission_pending_tcp(struct outside_network* outnet,
432 	struct pending_tcp* pend)
433 {
434 	if(pend->c->ssl) {
435 #ifdef HAVE_SSL
436 		SSL_shutdown(pend->c->ssl);
437 		SSL_free(pend->c->ssl);
438 		pend->c->ssl = NULL;
439 #endif
440 	}
441 	comm_point_close(pend->c);
442 	pend->next_free = outnet->tcp_free;
443 	outnet->tcp_free = pend;
444 	waiting_tcp_delete(pend->query);
445 	pend->query = NULL;
446 	use_free_buffer(outnet);
447 }
448 
449 int
450 outnet_tcp_cb(struct comm_point* c, void* arg, int error,
451 	struct comm_reply *reply_info)
452 {
453 	struct pending_tcp* pend = (struct pending_tcp*)arg;
454 	struct outside_network* outnet = pend->query->outnet;
455 	verbose(VERB_ALGO, "outnettcp cb");
456 	if(error != NETEVENT_NOERROR) {
457 		verbose(VERB_QUERY, "outnettcp got tcp error %d", error);
458 		/* pass error below and exit */
459 	} else {
460 		/* check ID */
461 		if(sldns_buffer_limit(c->buffer) < sizeof(uint16_t) ||
462 			LDNS_ID_WIRE(sldns_buffer_begin(c->buffer))!=pend->id) {
463 			log_addr(VERB_QUERY,
464 				"outnettcp: bad ID in reply, from:",
465 				&pend->query->addr, pend->query->addrlen);
466 			error = NETEVENT_CLOSED;
467 		}
468 	}
469 	fptr_ok(fptr_whitelist_pending_tcp(pend->query->cb));
470 	(void)(*pend->query->cb)(c, pend->query->cb_arg, error, reply_info);
471 	decommission_pending_tcp(outnet, pend);
472 	return 0;
473 }
474 
475 /** lower use count on pc, see if it can be closed */
476 static void
477 portcomm_loweruse(struct outside_network* outnet, struct port_comm* pc)
478 {
479 	struct port_if* pif;
480 	pc->num_outstanding--;
481 	if(pc->num_outstanding > 0) {
482 		return;
483 	}
484 	/* close it and replace in unused list */
485 	verbose(VERB_ALGO, "close of port %d", pc->number);
486 	comm_point_close(pc->cp);
487 	pif = pc->pif;
488 	log_assert(pif->inuse > 0);
489 	pif->avail_ports[pif->avail_total - pif->inuse] = pc->number;
490 	pif->inuse--;
491 	pif->out[pc->index] = pif->out[pif->inuse];
492 	pif->out[pc->index]->index = pc->index;
493 	pc->next = outnet->unused_fds;
494 	outnet->unused_fds = pc;
495 }
496 
497 /** try to send waiting UDP queries */
498 static void
499 outnet_send_wait_udp(struct outside_network* outnet)
500 {
501 	struct pending* pend;
502 	/* process waiting queries */
503 	while(outnet->udp_wait_first && outnet->unused_fds
504 		&& !outnet->want_to_quit) {
505 		pend = outnet->udp_wait_first;
506 		outnet->udp_wait_first = pend->next_waiting;
507 		if(!pend->next_waiting) outnet->udp_wait_last = NULL;
508 		sldns_buffer_clear(outnet->udp_buff);
509 		sldns_buffer_write(outnet->udp_buff, pend->pkt, pend->pkt_len);
510 		sldns_buffer_flip(outnet->udp_buff);
511 		free(pend->pkt); /* freeing now makes get_mem correct */
512 		pend->pkt = NULL;
513 		pend->pkt_len = 0;
514 		if(!randomize_and_send_udp(pend, outnet->udp_buff,
515 			pend->timeout)) {
516 			/* callback error on pending */
517 			if(pend->cb) {
518 				fptr_ok(fptr_whitelist_pending_udp(pend->cb));
519 				(void)(*pend->cb)(outnet->unused_fds->cp, pend->cb_arg,
520 					NETEVENT_CLOSED, NULL);
521 			}
522 			pending_delete(outnet, pend);
523 		}
524 	}
525 }
526 
527 int
528 outnet_udp_cb(struct comm_point* c, void* arg, int error,
529 	struct comm_reply *reply_info)
530 {
531 	struct outside_network* outnet = (struct outside_network*)arg;
532 	struct pending key;
533 	struct pending* p;
534 	verbose(VERB_ALGO, "answer cb");
535 
536 	if(error != NETEVENT_NOERROR) {
537 		verbose(VERB_QUERY, "outnetudp got udp error %d", error);
538 		return 0;
539 	}
540 	if(sldns_buffer_limit(c->buffer) < LDNS_HEADER_SIZE) {
541 		verbose(VERB_QUERY, "outnetudp udp too short");
542 		return 0;
543 	}
544 	log_assert(reply_info);
545 
546 	/* setup lookup key */
547 	key.id = (unsigned)LDNS_ID_WIRE(sldns_buffer_begin(c->buffer));
548 	memcpy(&key.addr, &reply_info->addr, reply_info->addrlen);
549 	key.addrlen = reply_info->addrlen;
550 	verbose(VERB_ALGO, "Incoming reply id = %4.4x", key.id);
551 	log_addr(VERB_ALGO, "Incoming reply addr =",
552 		&reply_info->addr, reply_info->addrlen);
553 
554 	/* find it, see if this thing is a valid query response */
555 	verbose(VERB_ALGO, "lookup size is %d entries", (int)outnet->pending->count);
556 	p = (struct pending*)rbtree_search(outnet->pending, &key);
557 	if(!p) {
558 		verbose(VERB_QUERY, "received unwanted or unsolicited udp reply dropped.");
559 		log_buf(VERB_ALGO, "dropped message", c->buffer);
560 		outnet->unwanted_replies++;
561 		if(outnet->unwanted_threshold && ++outnet->unwanted_total
562 			>= outnet->unwanted_threshold) {
563 			log_warn("unwanted reply total reached threshold (%u)"
564 				" you may be under attack."
565 				" defensive action: clearing the cache",
566 				(unsigned)outnet->unwanted_threshold);
567 			fptr_ok(fptr_whitelist_alloc_cleanup(
568 				outnet->unwanted_action));
569 			(*outnet->unwanted_action)(outnet->unwanted_param);
570 			outnet->unwanted_total = 0;
571 		}
572 		return 0;
573 	}
574 
575 	verbose(VERB_ALGO, "received udp reply.");
576 	log_buf(VERB_ALGO, "udp message", c->buffer);
577 	if(p->pc->cp != c) {
578 		verbose(VERB_QUERY, "received reply id,addr on wrong port. "
579 			"dropped.");
580 		outnet->unwanted_replies++;
581 		if(outnet->unwanted_threshold && ++outnet->unwanted_total
582 			>= outnet->unwanted_threshold) {
583 			log_warn("unwanted reply total reached threshold (%u)"
584 				" you may be under attack."
585 				" defensive action: clearing the cache",
586 				(unsigned)outnet->unwanted_threshold);
587 			fptr_ok(fptr_whitelist_alloc_cleanup(
588 				outnet->unwanted_action));
589 			(*outnet->unwanted_action)(outnet->unwanted_param);
590 			outnet->unwanted_total = 0;
591 		}
592 		return 0;
593 	}
594 	comm_timer_disable(p->timer);
595 	verbose(VERB_ALGO, "outnet handle udp reply");
596 	/* delete from tree first in case callback creates a retry */
597 	(void)rbtree_delete(outnet->pending, p->node.key);
598 	if(p->cb) {
599 		fptr_ok(fptr_whitelist_pending_udp(p->cb));
600 		(void)(*p->cb)(p->pc->cp, p->cb_arg, NETEVENT_NOERROR, reply_info);
601 	}
602 	portcomm_loweruse(outnet, p->pc);
603 	pending_delete(NULL, p);
604 	outnet_send_wait_udp(outnet);
605 	return 0;
606 }
607 
608 /** calculate number of ip4 and ip6 interfaces*/
609 static void
610 calc_num46(char** ifs, int num_ifs, int do_ip4, int do_ip6,
611 	int* num_ip4, int* num_ip6)
612 {
613 	int i;
614 	*num_ip4 = 0;
615 	*num_ip6 = 0;
616 	if(num_ifs <= 0) {
617 		if(do_ip4)
618 			*num_ip4 = 1;
619 		if(do_ip6)
620 			*num_ip6 = 1;
621 		return;
622 	}
623 	for(i=0; i<num_ifs; i++)
624 	{
625 		if(str_is_ip6(ifs[i])) {
626 			if(do_ip6)
627 				(*num_ip6)++;
628 		} else {
629 			if(do_ip4)
630 				(*num_ip4)++;
631 		}
632 	}
633 
634 }
635 
636 void
637 pending_udp_timer_delay_cb(void* arg)
638 {
639 	struct pending* p = (struct pending*)arg;
640 	struct outside_network* outnet = p->outnet;
641 	verbose(VERB_ALGO, "timeout udp with delay");
642 	portcomm_loweruse(outnet, p->pc);
643 	pending_delete(outnet, p);
644 	outnet_send_wait_udp(outnet);
645 }
646 
647 void
648 pending_udp_timer_cb(void *arg)
649 {
650 	struct pending* p = (struct pending*)arg;
651 	struct outside_network* outnet = p->outnet;
652 	/* it timed out */
653 	verbose(VERB_ALGO, "timeout udp");
654 	if(p->cb) {
655 		fptr_ok(fptr_whitelist_pending_udp(p->cb));
656 		(void)(*p->cb)(p->pc->cp, p->cb_arg, NETEVENT_TIMEOUT, NULL);
657 	}
658 	/* if delayclose, keep port open for a longer time.
659 	 * But if the udpwaitlist exists, then we are struggling to
660 	 * keep up with demand for sockets, so do not wait, but service
661 	 * the customer (customer service more important than portICMPs) */
662 	if(outnet->delayclose && !outnet->udp_wait_first) {
663 		p->cb = NULL;
664 		p->timer->callback = &pending_udp_timer_delay_cb;
665 		comm_timer_set(p->timer, &outnet->delay_tv);
666 		return;
667 	}
668 	portcomm_loweruse(outnet, p->pc);
669 	pending_delete(outnet, p);
670 	outnet_send_wait_udp(outnet);
671 }
672 
673 /** create pending_tcp buffers */
674 static int
675 create_pending_tcp(struct outside_network* outnet, size_t bufsize)
676 {
677 	size_t i;
678 	if(outnet->num_tcp == 0)
679 		return 1; /* no tcp needed, nothing to do */
680 	if(!(outnet->tcp_conns = (struct pending_tcp **)calloc(
681 			outnet->num_tcp, sizeof(struct pending_tcp*))))
682 		return 0;
683 	for(i=0; i<outnet->num_tcp; i++) {
684 		if(!(outnet->tcp_conns[i] = (struct pending_tcp*)calloc(1,
685 			sizeof(struct pending_tcp))))
686 			return 0;
687 		outnet->tcp_conns[i]->next_free = outnet->tcp_free;
688 		outnet->tcp_free = outnet->tcp_conns[i];
689 		outnet->tcp_conns[i]->c = comm_point_create_tcp_out(
690 			outnet->base, bufsize, outnet_tcp_cb,
691 			outnet->tcp_conns[i]);
692 		if(!outnet->tcp_conns[i]->c)
693 			return 0;
694 	}
695 	return 1;
696 }
697 
698 /** setup an outgoing interface, ready address */
699 static int setup_if(struct port_if* pif, const char* addrstr,
700 	int* avail, int numavail, size_t numfd)
701 {
702 	pif->avail_total = numavail;
703 	pif->avail_ports = (int*)memdup(avail, (size_t)numavail*sizeof(int));
704 	if(!pif->avail_ports)
705 		return 0;
706 	if(!ipstrtoaddr(addrstr, UNBOUND_DNS_PORT, &pif->addr, &pif->addrlen) &&
707 	   !netblockstrtoaddr(addrstr, UNBOUND_DNS_PORT,
708 			      &pif->addr, &pif->addrlen, &pif->pfxlen))
709 		return 0;
710 	pif->maxout = (int)numfd;
711 	pif->inuse = 0;
712 	pif->out = (struct port_comm**)calloc(numfd,
713 		sizeof(struct port_comm*));
714 	if(!pif->out)
715 		return 0;
716 	return 1;
717 }
718 
719 struct outside_network*
720 outside_network_create(struct comm_base *base, size_t bufsize,
721 	size_t num_ports, char** ifs, int num_ifs, int do_ip4,
722 	int do_ip6, size_t num_tcp, struct infra_cache* infra,
723 	struct ub_randstate* rnd, int use_caps_for_id, int* availports,
724 	int numavailports, size_t unwanted_threshold, int tcp_mss,
725 	void (*unwanted_action)(void*), void* unwanted_param, int do_udp,
726 	void* sslctx, int delayclose, struct dt_env* dtenv)
727 {
728 	struct outside_network* outnet = (struct outside_network*)
729 		calloc(1, sizeof(struct outside_network));
730 	size_t k;
731 	if(!outnet) {
732 		log_err("malloc failed");
733 		return NULL;
734 	}
735 	comm_base_timept(base, &outnet->now_secs, &outnet->now_tv);
736 	outnet->base = base;
737 	outnet->num_tcp = num_tcp;
738 	outnet->num_tcp_outgoing = 0;
739 	outnet->infra = infra;
740 	outnet->rnd = rnd;
741 	outnet->sslctx = sslctx;
742 #ifdef USE_DNSTAP
743 	outnet->dtenv = dtenv;
744 #else
745 	(void)dtenv;
746 #endif
747 	outnet->svcd_overhead = 0;
748 	outnet->want_to_quit = 0;
749 	outnet->unwanted_threshold = unwanted_threshold;
750 	outnet->unwanted_action = unwanted_action;
751 	outnet->unwanted_param = unwanted_param;
752 	outnet->use_caps_for_id = use_caps_for_id;
753 	outnet->do_udp = do_udp;
754 	outnet->tcp_mss = tcp_mss;
755 #ifndef S_SPLINT_S
756 	if(delayclose) {
757 		outnet->delayclose = 1;
758 		outnet->delay_tv.tv_sec = delayclose/1000;
759 		outnet->delay_tv.tv_usec = (delayclose%1000)*1000;
760 	}
761 #endif
762 	if(numavailports == 0) {
763 		log_err("no outgoing ports available");
764 		outside_network_delete(outnet);
765 		return NULL;
766 	}
767 #ifndef INET6
768 	do_ip6 = 0;
769 #endif
770 	calc_num46(ifs, num_ifs, do_ip4, do_ip6,
771 		&outnet->num_ip4, &outnet->num_ip6);
772 	if(outnet->num_ip4 != 0) {
773 		if(!(outnet->ip4_ifs = (struct port_if*)calloc(
774 			(size_t)outnet->num_ip4, sizeof(struct port_if)))) {
775 			log_err("malloc failed");
776 			outside_network_delete(outnet);
777 			return NULL;
778 		}
779 	}
780 	if(outnet->num_ip6 != 0) {
781 		if(!(outnet->ip6_ifs = (struct port_if*)calloc(
782 			(size_t)outnet->num_ip6, sizeof(struct port_if)))) {
783 			log_err("malloc failed");
784 			outside_network_delete(outnet);
785 			return NULL;
786 		}
787 	}
788 	if(	!(outnet->udp_buff = sldns_buffer_new(bufsize)) ||
789 		!(outnet->pending = rbtree_create(pending_cmp)) ||
790 		!(outnet->serviced = rbtree_create(serviced_cmp)) ||
791 		!create_pending_tcp(outnet, bufsize)) {
792 		log_err("malloc failed");
793 		outside_network_delete(outnet);
794 		return NULL;
795 	}
796 
797 	/* allocate commpoints */
798 	for(k=0; k<num_ports; k++) {
799 		struct port_comm* pc;
800 		pc = (struct port_comm*)calloc(1, sizeof(*pc));
801 		if(!pc) {
802 			log_err("malloc failed");
803 			outside_network_delete(outnet);
804 			return NULL;
805 		}
806 		pc->cp = comm_point_create_udp(outnet->base, -1,
807 			outnet->udp_buff, outnet_udp_cb, outnet);
808 		if(!pc->cp) {
809 			log_err("malloc failed");
810 			free(pc);
811 			outside_network_delete(outnet);
812 			return NULL;
813 		}
814 		pc->next = outnet->unused_fds;
815 		outnet->unused_fds = pc;
816 	}
817 
818 	/* allocate interfaces */
819 	if(num_ifs == 0) {
820 		if(do_ip4 && !setup_if(&outnet->ip4_ifs[0], "0.0.0.0",
821 			availports, numavailports, num_ports)) {
822 			log_err("malloc failed");
823 			outside_network_delete(outnet);
824 			return NULL;
825 		}
826 		if(do_ip6 && !setup_if(&outnet->ip6_ifs[0], "::",
827 			availports, numavailports, num_ports)) {
828 			log_err("malloc failed");
829 			outside_network_delete(outnet);
830 			return NULL;
831 		}
832 	} else {
833 		size_t done_4 = 0, done_6 = 0;
834 		int i;
835 		for(i=0; i<num_ifs; i++) {
836 			if(str_is_ip6(ifs[i]) && do_ip6) {
837 				if(!setup_if(&outnet->ip6_ifs[done_6], ifs[i],
838 					availports, numavailports, num_ports)){
839 					log_err("malloc failed");
840 					outside_network_delete(outnet);
841 					return NULL;
842 				}
843 				done_6++;
844 			}
845 			if(!str_is_ip6(ifs[i]) && do_ip4) {
846 				if(!setup_if(&outnet->ip4_ifs[done_4], ifs[i],
847 					availports, numavailports, num_ports)){
848 					log_err("malloc failed");
849 					outside_network_delete(outnet);
850 					return NULL;
851 				}
852 				done_4++;
853 			}
854 		}
855 	}
856 	return outnet;
857 }
858 
859 /** helper pending delete */
860 static void
861 pending_node_del(rbnode_type* node, void* arg)
862 {
863 	struct pending* pend = (struct pending*)node;
864 	struct outside_network* outnet = (struct outside_network*)arg;
865 	pending_delete(outnet, pend);
866 }
867 
868 /** helper serviced delete */
869 static void
870 serviced_node_del(rbnode_type* node, void* ATTR_UNUSED(arg))
871 {
872 	struct serviced_query* sq = (struct serviced_query*)node;
873 	struct service_callback* p = sq->cblist, *np;
874 	free(sq->qbuf);
875 	free(sq->zone);
876 	free(sq->tls_auth_name);
877 	edns_opt_list_free(sq->opt_list);
878 	while(p) {
879 		np = p->next;
880 		free(p);
881 		p = np;
882 	}
883 	free(sq);
884 }
885 
886 void
887 outside_network_quit_prepare(struct outside_network* outnet)
888 {
889 	if(!outnet)
890 		return;
891 	/* prevent queued items from being sent */
892 	outnet->want_to_quit = 1;
893 }
894 
895 void
896 outside_network_delete(struct outside_network* outnet)
897 {
898 	if(!outnet)
899 		return;
900 	outnet->want_to_quit = 1;
901 	/* check every element, since we can be called on malloc error */
902 	if(outnet->pending) {
903 		/* free pending elements, but do no unlink from tree. */
904 		traverse_postorder(outnet->pending, pending_node_del, NULL);
905 		free(outnet->pending);
906 	}
907 	if(outnet->serviced) {
908 		traverse_postorder(outnet->serviced, serviced_node_del, NULL);
909 		free(outnet->serviced);
910 	}
911 	if(outnet->udp_buff)
912 		sldns_buffer_free(outnet->udp_buff);
913 	if(outnet->unused_fds) {
914 		struct port_comm* p = outnet->unused_fds, *np;
915 		while(p) {
916 			np = p->next;
917 			comm_point_delete(p->cp);
918 			free(p);
919 			p = np;
920 		}
921 		outnet->unused_fds = NULL;
922 	}
923 	if(outnet->ip4_ifs) {
924 		int i, k;
925 		for(i=0; i<outnet->num_ip4; i++) {
926 			for(k=0; k<outnet->ip4_ifs[i].inuse; k++) {
927 				struct port_comm* pc = outnet->ip4_ifs[i].
928 					out[k];
929 				comm_point_delete(pc->cp);
930 				free(pc);
931 			}
932 			free(outnet->ip4_ifs[i].avail_ports);
933 			free(outnet->ip4_ifs[i].out);
934 		}
935 		free(outnet->ip4_ifs);
936 	}
937 	if(outnet->ip6_ifs) {
938 		int i, k;
939 		for(i=0; i<outnet->num_ip6; i++) {
940 			for(k=0; k<outnet->ip6_ifs[i].inuse; k++) {
941 				struct port_comm* pc = outnet->ip6_ifs[i].
942 					out[k];
943 				comm_point_delete(pc->cp);
944 				free(pc);
945 			}
946 			free(outnet->ip6_ifs[i].avail_ports);
947 			free(outnet->ip6_ifs[i].out);
948 		}
949 		free(outnet->ip6_ifs);
950 	}
951 	if(outnet->tcp_conns) {
952 		size_t i;
953 		for(i=0; i<outnet->num_tcp; i++)
954 			if(outnet->tcp_conns[i]) {
955 				comm_point_delete(outnet->tcp_conns[i]->c);
956 				waiting_tcp_delete(outnet->tcp_conns[i]->query);
957 				free(outnet->tcp_conns[i]);
958 			}
959 		free(outnet->tcp_conns);
960 	}
961 	if(outnet->tcp_wait_first) {
962 		struct waiting_tcp* p = outnet->tcp_wait_first, *np;
963 		while(p) {
964 			np = p->next_waiting;
965 			waiting_tcp_delete(p);
966 			p = np;
967 		}
968 	}
969 	if(outnet->udp_wait_first) {
970 		struct pending* p = outnet->udp_wait_first, *np;
971 		while(p) {
972 			np = p->next_waiting;
973 			pending_delete(NULL, p);
974 			p = np;
975 		}
976 	}
977 	free(outnet);
978 }
979 
980 void
981 pending_delete(struct outside_network* outnet, struct pending* p)
982 {
983 	if(!p)
984 		return;
985 	if(outnet && outnet->udp_wait_first &&
986 		(p->next_waiting || p == outnet->udp_wait_last) ) {
987 		/* delete from waiting list, if it is in the waiting list */
988 		struct pending* prev = NULL, *x = outnet->udp_wait_first;
989 		while(x && x != p) {
990 			prev = x;
991 			x = x->next_waiting;
992 		}
993 		if(x) {
994 			log_assert(x == p);
995 			if(prev)
996 				prev->next_waiting = p->next_waiting;
997 			else	outnet->udp_wait_first = p->next_waiting;
998 			if(outnet->udp_wait_last == p)
999 				outnet->udp_wait_last = prev;
1000 		}
1001 	}
1002 	if(outnet) {
1003 		(void)rbtree_delete(outnet->pending, p->node.key);
1004 	}
1005 	if(p->timer)
1006 		comm_timer_delete(p->timer);
1007 	free(p->pkt);
1008 	free(p);
1009 }
1010 
1011 static void
1012 sai6_putrandom(struct sockaddr_in6 *sa, int pfxlen, struct ub_randstate *rnd)
1013 {
1014 	int i, last;
1015 	if(!(pfxlen > 0 && pfxlen < 128))
1016 		return;
1017 	for(i = 0; i < (128 - pfxlen) / 8; i++) {
1018 		sa->sin6_addr.s6_addr[15-i] = (uint8_t)ub_random_max(rnd, 256);
1019 	}
1020 	last = pfxlen & 7;
1021 	if(last != 0) {
1022 		sa->sin6_addr.s6_addr[15-i] |=
1023 			((0xFF >> last) & ub_random_max(rnd, 256));
1024 	}
1025 }
1026 
1027 /**
1028  * Try to open a UDP socket for outgoing communication.
1029  * Sets sockets options as needed.
1030  * @param addr: socket address.
1031  * @param addrlen: length of address.
1032  * @param pfxlen: length of network prefix (for address randomisation).
1033  * @param port: port override for addr.
1034  * @param inuse: if -1 is returned, this bool means the port was in use.
1035  * @param rnd: random state (for address randomisation).
1036  * @return fd or -1
1037  */
1038 static int
1039 udp_sockport(struct sockaddr_storage* addr, socklen_t addrlen, int pfxlen,
1040 	int port, int* inuse, struct ub_randstate* rnd)
1041 {
1042 	int fd, noproto;
1043 	if(addr_is_ip6(addr, addrlen)) {
1044 		int freebind = 0;
1045 		struct sockaddr_in6 sa = *(struct sockaddr_in6*)addr;
1046 		sa.sin6_port = (in_port_t)htons((uint16_t)port);
1047 		sa.sin6_flowinfo = 0;
1048 		sa.sin6_scope_id = 0;
1049 		if(pfxlen != 0) {
1050 			freebind = 1;
1051 			sai6_putrandom(&sa, pfxlen, rnd);
1052 		}
1053 		fd = create_udp_sock(AF_INET6, SOCK_DGRAM,
1054 			(struct sockaddr*)&sa, addrlen, 1, inuse, &noproto,
1055 			0, 0, 0, NULL, 0, freebind, 0);
1056 	} else {
1057 		struct sockaddr_in* sa = (struct sockaddr_in*)addr;
1058 		sa->sin_port = (in_port_t)htons((uint16_t)port);
1059 		fd = create_udp_sock(AF_INET, SOCK_DGRAM,
1060 			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto,
1061 			0, 0, 0, NULL, 0, 0, 0);
1062 	}
1063 	return fd;
1064 }
1065 
1066 /** Select random ID */
1067 static int
1068 select_id(struct outside_network* outnet, struct pending* pend,
1069 	sldns_buffer* packet)
1070 {
1071 	int id_tries = 0;
1072 	pend->id = ((unsigned)ub_random(outnet->rnd)>>8) & 0xffff;
1073 	LDNS_ID_SET(sldns_buffer_begin(packet), pend->id);
1074 
1075 	/* insert in tree */
1076 	pend->node.key = pend;
1077 	while(!rbtree_insert(outnet->pending, &pend->node)) {
1078 		/* change ID to avoid collision */
1079 		pend->id = ((unsigned)ub_random(outnet->rnd)>>8) & 0xffff;
1080 		LDNS_ID_SET(sldns_buffer_begin(packet), pend->id);
1081 		id_tries++;
1082 		if(id_tries == MAX_ID_RETRY) {
1083 			pend->id=99999; /* non existant ID */
1084 			log_err("failed to generate unique ID, drop msg");
1085 			return 0;
1086 		}
1087 	}
1088 	verbose(VERB_ALGO, "inserted new pending reply id=%4.4x", pend->id);
1089 	return 1;
1090 }
1091 
1092 /** Select random interface and port */
1093 static int
1094 select_ifport(struct outside_network* outnet, struct pending* pend,
1095 	int num_if, struct port_if* ifs)
1096 {
1097 	int my_if, my_port, fd, portno, inuse, tries=0;
1098 	struct port_if* pif;
1099 	/* randomly select interface and port */
1100 	if(num_if == 0) {
1101 		verbose(VERB_QUERY, "Need to send query but have no "
1102 			"outgoing interfaces of that family");
1103 		return 0;
1104 	}
1105 	log_assert(outnet->unused_fds);
1106 	tries = 0;
1107 	while(1) {
1108 		my_if = ub_random_max(outnet->rnd, num_if);
1109 		pif = &ifs[my_if];
1110 		my_port = ub_random_max(outnet->rnd, pif->avail_total);
1111 		if(my_port < pif->inuse) {
1112 			/* port already open */
1113 			pend->pc = pif->out[my_port];
1114 			verbose(VERB_ALGO, "using UDP if=%d port=%d",
1115 				my_if, pend->pc->number);
1116 			break;
1117 		}
1118 		/* try to open new port, if fails, loop to try again */
1119 		log_assert(pif->inuse < pif->maxout);
1120 		portno = pif->avail_ports[my_port - pif->inuse];
1121 		fd = udp_sockport(&pif->addr, pif->addrlen, pif->pfxlen,
1122 			portno, &inuse, outnet->rnd);
1123 		if(fd == -1 && !inuse) {
1124 			/* nonrecoverable error making socket */
1125 			return 0;
1126 		}
1127 		if(fd != -1) {
1128 			verbose(VERB_ALGO, "opened UDP if=%d port=%d",
1129 				my_if, portno);
1130 			/* grab fd */
1131 			pend->pc = outnet->unused_fds;
1132 			outnet->unused_fds = pend->pc->next;
1133 
1134 			/* setup portcomm */
1135 			pend->pc->next = NULL;
1136 			pend->pc->number = portno;
1137 			pend->pc->pif = pif;
1138 			pend->pc->index = pif->inuse;
1139 			pend->pc->num_outstanding = 0;
1140 			comm_point_start_listening(pend->pc->cp, fd, -1);
1141 
1142 			/* grab port in interface */
1143 			pif->out[pif->inuse] = pend->pc;
1144 			pif->avail_ports[my_port - pif->inuse] =
1145 				pif->avail_ports[pif->avail_total-pif->inuse-1];
1146 			pif->inuse++;
1147 			break;
1148 		}
1149 		/* failed, already in use */
1150 		verbose(VERB_QUERY, "port %d in use, trying another", portno);
1151 		tries++;
1152 		if(tries == MAX_PORT_RETRY) {
1153 			log_err("failed to find an open port, drop msg");
1154 			return 0;
1155 		}
1156 	}
1157 	log_assert(pend->pc);
1158 	pend->pc->num_outstanding++;
1159 
1160 	return 1;
1161 }
1162 
1163 static int
1164 randomize_and_send_udp(struct pending* pend, sldns_buffer* packet, int timeout)
1165 {
1166 	struct timeval tv;
1167 	struct outside_network* outnet = pend->sq->outnet;
1168 
1169 	/* select id */
1170 	if(!select_id(outnet, pend, packet)) {
1171 		return 0;
1172 	}
1173 
1174 	/* select src_if, port */
1175 	if(addr_is_ip6(&pend->addr, pend->addrlen)) {
1176 		if(!select_ifport(outnet, pend,
1177 			outnet->num_ip6, outnet->ip6_ifs))
1178 			return 0;
1179 	} else {
1180 		if(!select_ifport(outnet, pend,
1181 			outnet->num_ip4, outnet->ip4_ifs))
1182 			return 0;
1183 	}
1184 	log_assert(pend->pc && pend->pc->cp);
1185 
1186 	/* send it over the commlink */
1187 	if(!comm_point_send_udp_msg(pend->pc->cp, packet,
1188 		(struct sockaddr*)&pend->addr, pend->addrlen)) {
1189 		portcomm_loweruse(outnet, pend->pc);
1190 		return 0;
1191 	}
1192 
1193 	/* system calls to set timeout after sending UDP to make roundtrip
1194 	   smaller. */
1195 #ifndef S_SPLINT_S
1196 	tv.tv_sec = timeout/1000;
1197 	tv.tv_usec = (timeout%1000)*1000;
1198 #endif
1199 	comm_timer_set(pend->timer, &tv);
1200 
1201 #ifdef USE_DNSTAP
1202 	if(outnet->dtenv &&
1203 	   (outnet->dtenv->log_resolver_query_messages ||
1204 	    outnet->dtenv->log_forwarder_query_messages))
1205 		dt_msg_send_outside_query(outnet->dtenv, &pend->addr, comm_udp,
1206 		pend->sq->zone, pend->sq->zonelen, packet);
1207 #endif
1208 	return 1;
1209 }
1210 
1211 struct pending*
1212 pending_udp_query(struct serviced_query* sq, struct sldns_buffer* packet,
1213 	int timeout, comm_point_callback_type* cb, void* cb_arg)
1214 {
1215 	struct pending* pend = (struct pending*)calloc(1, sizeof(*pend));
1216 	if(!pend) return NULL;
1217 	pend->outnet = sq->outnet;
1218 	pend->sq = sq;
1219 	pend->addrlen = sq->addrlen;
1220 	memmove(&pend->addr, &sq->addr, sq->addrlen);
1221 	pend->cb = cb;
1222 	pend->cb_arg = cb_arg;
1223 	pend->node.key = pend;
1224 	pend->timer = comm_timer_create(sq->outnet->base, pending_udp_timer_cb,
1225 		pend);
1226 	if(!pend->timer) {
1227 		free(pend);
1228 		return NULL;
1229 	}
1230 
1231 	if(sq->outnet->unused_fds == NULL) {
1232 		/* no unused fd, cannot create a new port (randomly) */
1233 		verbose(VERB_ALGO, "no fds available, udp query waiting");
1234 		pend->timeout = timeout;
1235 		pend->pkt_len = sldns_buffer_limit(packet);
1236 		pend->pkt = (uint8_t*)memdup(sldns_buffer_begin(packet),
1237 			pend->pkt_len);
1238 		if(!pend->pkt) {
1239 			comm_timer_delete(pend->timer);
1240 			free(pend);
1241 			return NULL;
1242 		}
1243 		/* put at end of waiting list */
1244 		if(sq->outnet->udp_wait_last)
1245 			sq->outnet->udp_wait_last->next_waiting = pend;
1246 		else
1247 			sq->outnet->udp_wait_first = pend;
1248 		sq->outnet->udp_wait_last = pend;
1249 		return pend;
1250 	}
1251 	if(!randomize_and_send_udp(pend, packet, timeout)) {
1252 		pending_delete(sq->outnet, pend);
1253 		return NULL;
1254 	}
1255 	return pend;
1256 }
1257 
1258 void
1259 outnet_tcptimer(void* arg)
1260 {
1261 	struct waiting_tcp* w = (struct waiting_tcp*)arg;
1262 	struct outside_network* outnet = w->outnet;
1263 	comm_point_callback_type* cb;
1264 	void* cb_arg;
1265 	if(w->pkt) {
1266 		/* it is on the waiting list */
1267 		waiting_list_remove(outnet, w);
1268 	} else {
1269 		/* it was in use */
1270 		struct pending_tcp* pend=(struct pending_tcp*)w->next_waiting;
1271 		if(pend->c->ssl) {
1272 #ifdef HAVE_SSL
1273 			SSL_shutdown(pend->c->ssl);
1274 			SSL_free(pend->c->ssl);
1275 			pend->c->ssl = NULL;
1276 #endif
1277 		}
1278 		comm_point_close(pend->c);
1279 		pend->query = NULL;
1280 		pend->next_free = outnet->tcp_free;
1281 		outnet->tcp_free = pend;
1282 	}
1283 	cb = w->cb;
1284 	cb_arg = w->cb_arg;
1285 	waiting_tcp_delete(w);
1286 	fptr_ok(fptr_whitelist_pending_tcp(cb));
1287 	(void)(*cb)(NULL, cb_arg, NETEVENT_TIMEOUT, NULL);
1288 	use_free_buffer(outnet);
1289 }
1290 
1291 struct waiting_tcp*
1292 pending_tcp_query(struct serviced_query* sq, sldns_buffer* packet,
1293 	int timeout, comm_point_callback_type* callback, void* callback_arg)
1294 {
1295 	struct pending_tcp* pend = sq->outnet->tcp_free;
1296 	struct waiting_tcp* w;
1297 	struct timeval tv;
1298 	uint16_t id;
1299 	/* if no buffer is free allocate space to store query */
1300 	w = (struct waiting_tcp*)malloc(sizeof(struct waiting_tcp)
1301 		+ (pend?0:sldns_buffer_limit(packet)));
1302 	if(!w) {
1303 		return NULL;
1304 	}
1305 	if(!(w->timer = comm_timer_create(sq->outnet->base, outnet_tcptimer, w))) {
1306 		free(w);
1307 		return NULL;
1308 	}
1309 	w->pkt = NULL;
1310 	w->pkt_len = 0;
1311 	id = ((unsigned)ub_random(sq->outnet->rnd)>>8) & 0xffff;
1312 	LDNS_ID_SET(sldns_buffer_begin(packet), id);
1313 	memcpy(&w->addr, &sq->addr, sq->addrlen);
1314 	w->addrlen = sq->addrlen;
1315 	w->outnet = sq->outnet;
1316 	w->cb = callback;
1317 	w->cb_arg = callback_arg;
1318 	w->ssl_upstream = sq->ssl_upstream;
1319 	w->tls_auth_name = sq->tls_auth_name;
1320 #ifndef S_SPLINT_S
1321 	tv.tv_sec = timeout/1000;
1322 	tv.tv_usec = (timeout%1000)*1000;
1323 #endif
1324 	comm_timer_set(w->timer, &tv);
1325 	if(pend) {
1326 		/* we have a buffer available right now */
1327 		if(!outnet_tcp_take_into_use(w, sldns_buffer_begin(packet),
1328 			sldns_buffer_limit(packet))) {
1329 			waiting_tcp_delete(w);
1330 			return NULL;
1331 		}
1332 #ifdef USE_DNSTAP
1333 		if(sq->outnet->dtenv &&
1334 		   (sq->outnet->dtenv->log_resolver_query_messages ||
1335 		    sq->outnet->dtenv->log_forwarder_query_messages))
1336 		dt_msg_send_outside_query(sq->outnet->dtenv, &sq->addr,
1337 		comm_tcp, sq->zone, sq->zonelen, packet);
1338 #endif
1339 	} else {
1340 		/* queue up */
1341 		w->pkt = (uint8_t*)w + sizeof(struct waiting_tcp);
1342 		w->pkt_len = sldns_buffer_limit(packet);
1343 		memmove(w->pkt, sldns_buffer_begin(packet), w->pkt_len);
1344 		w->next_waiting = NULL;
1345 		if(sq->outnet->tcp_wait_last)
1346 			sq->outnet->tcp_wait_last->next_waiting = w;
1347 		else	sq->outnet->tcp_wait_first = w;
1348 		sq->outnet->tcp_wait_last = w;
1349 	}
1350 	return w;
1351 }
1352 
1353 /** create query for serviced queries */
1354 static void
1355 serviced_gen_query(sldns_buffer* buff, uint8_t* qname, size_t qnamelen,
1356 	uint16_t qtype, uint16_t qclass, uint16_t flags)
1357 {
1358 	sldns_buffer_clear(buff);
1359 	/* skip id */
1360 	sldns_buffer_write_u16(buff, flags);
1361 	sldns_buffer_write_u16(buff, 1); /* qdcount */
1362 	sldns_buffer_write_u16(buff, 0); /* ancount */
1363 	sldns_buffer_write_u16(buff, 0); /* nscount */
1364 	sldns_buffer_write_u16(buff, 0); /* arcount */
1365 	sldns_buffer_write(buff, qname, qnamelen);
1366 	sldns_buffer_write_u16(buff, qtype);
1367 	sldns_buffer_write_u16(buff, qclass);
1368 	sldns_buffer_flip(buff);
1369 }
1370 
1371 /** lookup serviced query in serviced query rbtree */
1372 static struct serviced_query*
1373 lookup_serviced(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
1374 	struct sockaddr_storage* addr, socklen_t addrlen,
1375 	struct edns_option* opt_list)
1376 {
1377 	struct serviced_query key;
1378 	key.node.key = &key;
1379 	key.qbuf = sldns_buffer_begin(buff);
1380 	key.qbuflen = sldns_buffer_limit(buff);
1381 	key.dnssec = dnssec;
1382 	memcpy(&key.addr, addr, addrlen);
1383 	key.addrlen = addrlen;
1384 	key.outnet = outnet;
1385 	key.opt_list = opt_list;
1386 	return (struct serviced_query*)rbtree_search(outnet->serviced, &key);
1387 }
1388 
1389 /** Create new serviced entry */
1390 static struct serviced_query*
1391 serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
1392 	int want_dnssec, int nocaps, int tcp_upstream, int ssl_upstream,
1393 	char* tls_auth_name, struct sockaddr_storage* addr, socklen_t addrlen,
1394 	uint8_t* zone, size_t zonelen, int qtype, struct edns_option* opt_list)
1395 {
1396 	struct serviced_query* sq = (struct serviced_query*)malloc(sizeof(*sq));
1397 #ifdef UNBOUND_DEBUG
1398 	rbnode_type* ins;
1399 #endif
1400 	if(!sq)
1401 		return NULL;
1402 	sq->node.key = sq;
1403 	sq->qbuf = memdup(sldns_buffer_begin(buff), sldns_buffer_limit(buff));
1404 	if(!sq->qbuf) {
1405 		free(sq);
1406 		return NULL;
1407 	}
1408 	sq->qbuflen = sldns_buffer_limit(buff);
1409 	sq->zone = memdup(zone, zonelen);
1410 	if(!sq->zone) {
1411 		free(sq->qbuf);
1412 		free(sq);
1413 		return NULL;
1414 	}
1415 	sq->zonelen = zonelen;
1416 	sq->qtype = qtype;
1417 	sq->dnssec = dnssec;
1418 	sq->want_dnssec = want_dnssec;
1419 	sq->nocaps = nocaps;
1420 	sq->tcp_upstream = tcp_upstream;
1421 	sq->ssl_upstream = ssl_upstream;
1422 	if(tls_auth_name) {
1423 		sq->tls_auth_name = strdup(tls_auth_name);
1424 		if(!sq->tls_auth_name) {
1425 			free(sq->zone);
1426 			free(sq->qbuf);
1427 			free(sq);
1428 			return NULL;
1429 		}
1430 	} else {
1431 		sq->tls_auth_name = NULL;
1432 	}
1433 	memcpy(&sq->addr, addr, addrlen);
1434 	sq->addrlen = addrlen;
1435 	sq->opt_list = NULL;
1436 	if(opt_list) {
1437 		sq->opt_list = edns_opt_copy_alloc(opt_list);
1438 		if(!sq->opt_list) {
1439 			free(sq->tls_auth_name);
1440 			free(sq->zone);
1441 			free(sq->qbuf);
1442 			free(sq);
1443 			return NULL;
1444 		}
1445 	}
1446 	sq->outnet = outnet;
1447 	sq->cblist = NULL;
1448 	sq->pending = NULL;
1449 	sq->status = serviced_initial;
1450 	sq->retry = 0;
1451 	sq->to_be_deleted = 0;
1452 #ifdef UNBOUND_DEBUG
1453 	ins =
1454 #else
1455 	(void)
1456 #endif
1457 	rbtree_insert(outnet->serviced, &sq->node);
1458 	log_assert(ins != NULL); /* must not be already present */
1459 	return sq;
1460 }
1461 
1462 /** remove waiting tcp from the outnet waiting list */
1463 static void
1464 waiting_list_remove(struct outside_network* outnet, struct waiting_tcp* w)
1465 {
1466 	struct waiting_tcp* p = outnet->tcp_wait_first, *prev = NULL;
1467 	while(p) {
1468 		if(p == w) {
1469 			/* remove w */
1470 			if(prev)
1471 				prev->next_waiting = w->next_waiting;
1472 			else	outnet->tcp_wait_first = w->next_waiting;
1473 			if(outnet->tcp_wait_last == w)
1474 				outnet->tcp_wait_last = prev;
1475 			return;
1476 		}
1477 		prev = p;
1478 		p = p->next_waiting;
1479 	}
1480 }
1481 
1482 /** cleanup serviced query entry */
1483 static void
1484 serviced_delete(struct serviced_query* sq)
1485 {
1486 	if(sq->pending) {
1487 		/* clear up the pending query */
1488 		if(sq->status == serviced_query_UDP_EDNS ||
1489 			sq->status == serviced_query_UDP ||
1490 			sq->status == serviced_query_PROBE_EDNS ||
1491 			sq->status == serviced_query_UDP_EDNS_FRAG ||
1492 			sq->status == serviced_query_UDP_EDNS_fallback) {
1493 			struct pending* p = (struct pending*)sq->pending;
1494 			if(p->pc)
1495 				portcomm_loweruse(sq->outnet, p->pc);
1496 			pending_delete(sq->outnet, p);
1497 			/* this call can cause reentrant calls back into the
1498 			 * mesh */
1499 			outnet_send_wait_udp(sq->outnet);
1500 		} else {
1501 			struct waiting_tcp* p = (struct waiting_tcp*)
1502 				sq->pending;
1503 			if(p->pkt == NULL) {
1504 				decommission_pending_tcp(sq->outnet,
1505 					(struct pending_tcp*)p->next_waiting);
1506 			} else {
1507 				waiting_list_remove(sq->outnet, p);
1508 				waiting_tcp_delete(p);
1509 			}
1510 		}
1511 	}
1512 	/* does not delete from tree, caller has to do that */
1513 	serviced_node_del(&sq->node, NULL);
1514 }
1515 
1516 /** perturb a dname capitalization randomly */
1517 static void
1518 serviced_perturb_qname(struct ub_randstate* rnd, uint8_t* qbuf, size_t len)
1519 {
1520 	uint8_t lablen;
1521 	uint8_t* d = qbuf + 10;
1522 	long int random = 0;
1523 	int bits = 0;
1524 	log_assert(len >= 10 + 5 /* offset qname, root, qtype, qclass */);
1525 	(void)len;
1526 	lablen = *d++;
1527 	while(lablen) {
1528 		while(lablen--) {
1529 			/* only perturb A-Z, a-z */
1530 			if(isalpha((unsigned char)*d)) {
1531 				/* get a random bit */
1532 				if(bits == 0) {
1533 					random = ub_random(rnd);
1534 					bits = 30;
1535 				}
1536 				if(random & 0x1) {
1537 					*d = (uint8_t)toupper((unsigned char)*d);
1538 				} else {
1539 					*d = (uint8_t)tolower((unsigned char)*d);
1540 				}
1541 				random >>= 1;
1542 				bits--;
1543 			}
1544 			d++;
1545 		}
1546 		lablen = *d++;
1547 	}
1548 	if(verbosity >= VERB_ALGO) {
1549 		char buf[LDNS_MAX_DOMAINLEN+1];
1550 		dname_str(qbuf+10, buf);
1551 		verbose(VERB_ALGO, "qname perturbed to %s", buf);
1552 	}
1553 }
1554 
1555 /** put serviced query into a buffer */
1556 static void
1557 serviced_encode(struct serviced_query* sq, sldns_buffer* buff, int with_edns)
1558 {
1559 	/* if we are using 0x20 bits for ID randomness, perturb them */
1560 	if(sq->outnet->use_caps_for_id && !sq->nocaps) {
1561 		serviced_perturb_qname(sq->outnet->rnd, sq->qbuf, sq->qbuflen);
1562 	}
1563 	/* generate query */
1564 	sldns_buffer_clear(buff);
1565 	sldns_buffer_write_u16(buff, 0); /* id placeholder */
1566 	sldns_buffer_write(buff, sq->qbuf, sq->qbuflen);
1567 	sldns_buffer_flip(buff);
1568 	if(with_edns) {
1569 		/* add edns section */
1570 		struct edns_data edns;
1571 		edns.edns_present = 1;
1572 		edns.ext_rcode = 0;
1573 		edns.edns_version = EDNS_ADVERTISED_VERSION;
1574 		edns.opt_list = sq->opt_list;
1575 		if(sq->status == serviced_query_UDP_EDNS_FRAG) {
1576 			if(addr_is_ip6(&sq->addr, sq->addrlen)) {
1577 				if(EDNS_FRAG_SIZE_IP6 < EDNS_ADVERTISED_SIZE)
1578 					edns.udp_size = EDNS_FRAG_SIZE_IP6;
1579 				else	edns.udp_size = EDNS_ADVERTISED_SIZE;
1580 			} else {
1581 				if(EDNS_FRAG_SIZE_IP4 < EDNS_ADVERTISED_SIZE)
1582 					edns.udp_size = EDNS_FRAG_SIZE_IP4;
1583 				else	edns.udp_size = EDNS_ADVERTISED_SIZE;
1584 			}
1585 		} else {
1586 			edns.udp_size = EDNS_ADVERTISED_SIZE;
1587 		}
1588 		edns.bits = 0;
1589 		if(sq->dnssec & EDNS_DO)
1590 			edns.bits = EDNS_DO;
1591 		if(sq->dnssec & BIT_CD)
1592 			LDNS_CD_SET(sldns_buffer_begin(buff));
1593 		attach_edns_record(buff, &edns);
1594 	}
1595 }
1596 
1597 /**
1598  * Perform serviced query UDP sending operation.
1599  * Sends UDP with EDNS, unless infra host marked non EDNS.
1600  * @param sq: query to send.
1601  * @param buff: buffer scratch space.
1602  * @return 0 on error.
1603  */
1604 static int
1605 serviced_udp_send(struct serviced_query* sq, sldns_buffer* buff)
1606 {
1607 	int rtt, vs;
1608 	uint8_t edns_lame_known;
1609 	time_t now = *sq->outnet->now_secs;
1610 
1611 	if(!infra_host(sq->outnet->infra, &sq->addr, sq->addrlen, sq->zone,
1612 		sq->zonelen, now, &vs, &edns_lame_known, &rtt))
1613 		return 0;
1614 	sq->last_rtt = rtt;
1615 	verbose(VERB_ALGO, "EDNS lookup known=%d vs=%d", edns_lame_known, vs);
1616 	if(sq->status == serviced_initial) {
1617 		if(edns_lame_known == 0 && rtt > 5000 && rtt < 10001) {
1618 			/* perform EDNS lame probe - check if server is
1619 			 * EDNS lame (EDNS queries to it are dropped) */
1620 			verbose(VERB_ALGO, "serviced query: send probe to see "
1621 				" if use of EDNS causes timeouts");
1622 			/* even 700 msec may be too small */
1623 			rtt = 1000;
1624 			sq->status = serviced_query_PROBE_EDNS;
1625 		} else if(vs != -1) {
1626 			sq->status = serviced_query_UDP_EDNS;
1627 		} else {
1628 			sq->status = serviced_query_UDP;
1629 		}
1630 	}
1631 	serviced_encode(sq, buff, (sq->status == serviced_query_UDP_EDNS) ||
1632 		(sq->status == serviced_query_UDP_EDNS_FRAG));
1633 	sq->last_sent_time = *sq->outnet->now_tv;
1634 	sq->edns_lame_known = (int)edns_lame_known;
1635 	verbose(VERB_ALGO, "serviced query UDP timeout=%d msec", rtt);
1636 	sq->pending = pending_udp_query(sq, buff, rtt,
1637 		serviced_udp_callback, sq);
1638 	if(!sq->pending)
1639 		return 0;
1640 	return 1;
1641 }
1642 
1643 /** check that perturbed qname is identical */
1644 static int
1645 serviced_check_qname(sldns_buffer* pkt, uint8_t* qbuf, size_t qbuflen)
1646 {
1647 	uint8_t* d1 = sldns_buffer_begin(pkt)+12;
1648 	uint8_t* d2 = qbuf+10;
1649 	uint8_t len1, len2;
1650 	int count = 0;
1651 	if(sldns_buffer_limit(pkt) < 12+1+4) /* packet too small for qname */
1652 		return 0;
1653 	log_assert(qbuflen >= 15 /* 10 header, root, type, class */);
1654 	len1 = *d1++;
1655 	len2 = *d2++;
1656 	while(len1 != 0 || len2 != 0) {
1657 		if(LABEL_IS_PTR(len1)) {
1658 			/* check if we can read *d1 with compression ptr rest */
1659 			if(d1 >= sldns_buffer_at(pkt, sldns_buffer_limit(pkt)))
1660 				return 0;
1661 			d1 = sldns_buffer_begin(pkt)+PTR_OFFSET(len1, *d1);
1662 			/* check if we can read the destination *d1 */
1663 			if(d1 >= sldns_buffer_at(pkt, sldns_buffer_limit(pkt)))
1664 				return 0;
1665 			len1 = *d1++;
1666 			if(count++ > MAX_COMPRESS_PTRS)
1667 				return 0;
1668 			continue;
1669 		}
1670 		if(d2 > qbuf+qbuflen)
1671 			return 0;
1672 		if(len1 != len2)
1673 			return 0;
1674 		if(len1 > LDNS_MAX_LABELLEN)
1675 			return 0;
1676 		/* check len1 + 1(next length) are okay to read */
1677 		if(d1+len1 >= sldns_buffer_at(pkt, sldns_buffer_limit(pkt)))
1678 			return 0;
1679 		log_assert(len1 <= LDNS_MAX_LABELLEN);
1680 		log_assert(len2 <= LDNS_MAX_LABELLEN);
1681 		log_assert(len1 == len2 && len1 != 0);
1682 		/* compare the labels - bitwise identical */
1683 		if(memcmp(d1, d2, len1) != 0)
1684 			return 0;
1685 		d1 += len1;
1686 		d2 += len2;
1687 		len1 = *d1++;
1688 		len2 = *d2++;
1689 	}
1690 	return 1;
1691 }
1692 
1693 /** call the callbacks for a serviced query */
1694 static void
1695 serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c,
1696 	struct comm_reply* rep)
1697 {
1698 	struct service_callback* p;
1699 	int dobackup = (sq->cblist && sq->cblist->next); /* >1 cb*/
1700 	uint8_t *backup_p = NULL;
1701 	size_t backlen = 0;
1702 #ifdef UNBOUND_DEBUG
1703 	rbnode_type* rem =
1704 #else
1705 	(void)
1706 #endif
1707 	/* remove from tree, and schedule for deletion, so that callbacks
1708 	 * can safely deregister themselves and even create new serviced
1709 	 * queries that are identical to this one. */
1710 	rbtree_delete(sq->outnet->serviced, sq);
1711 	log_assert(rem); /* should have been present */
1712 	sq->to_be_deleted = 1;
1713 	verbose(VERB_ALGO, "svcd callbacks start");
1714 	if(sq->outnet->use_caps_for_id && error == NETEVENT_NOERROR && c &&
1715 		!sq->nocaps && sq->qtype != LDNS_RR_TYPE_PTR) {
1716 		/* for type PTR do not check perturbed name in answer,
1717 		 * compatibility with cisco dns guard boxes that mess up
1718 		 * reverse queries 0x20 contents */
1719 		/* noerror and nxdomain must have a qname in reply */
1720 		if(sldns_buffer_read_u16_at(c->buffer, 4) == 0 &&
1721 			(LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer))
1722 				== LDNS_RCODE_NOERROR ||
1723 			 LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer))
1724 				== LDNS_RCODE_NXDOMAIN)) {
1725 			verbose(VERB_DETAIL, "no qname in reply to check 0x20ID");
1726 			log_addr(VERB_DETAIL, "from server",
1727 				&sq->addr, sq->addrlen);
1728 			log_buf(VERB_DETAIL, "for packet", c->buffer);
1729 			error = NETEVENT_CLOSED;
1730 			c = NULL;
1731 		} else if(sldns_buffer_read_u16_at(c->buffer, 4) > 0 &&
1732 			!serviced_check_qname(c->buffer, sq->qbuf,
1733 			sq->qbuflen)) {
1734 			verbose(VERB_DETAIL, "wrong 0x20-ID in reply qname");
1735 			log_addr(VERB_DETAIL, "from server",
1736 				&sq->addr, sq->addrlen);
1737 			log_buf(VERB_DETAIL, "for packet", c->buffer);
1738 			error = NETEVENT_CAPSFAIL;
1739 			/* and cleanup too */
1740 			pkt_dname_tolower(c->buffer,
1741 				sldns_buffer_at(c->buffer, 12));
1742 		} else {
1743 			verbose(VERB_ALGO, "good 0x20-ID in reply qname");
1744 			/* cleanup caps, prettier cache contents. */
1745 			pkt_dname_tolower(c->buffer,
1746 				sldns_buffer_at(c->buffer, 12));
1747 		}
1748 	}
1749 	if(dobackup && c) {
1750 		/* make a backup of the query, since the querystate processing
1751 		 * may send outgoing queries that overwrite the buffer.
1752 		 * use secondary buffer to store the query.
1753 		 * This is a data copy, but faster than packet to server */
1754 		backlen = sldns_buffer_limit(c->buffer);
1755 		backup_p = memdup(sldns_buffer_begin(c->buffer), backlen);
1756 		if(!backup_p) {
1757 			log_err("malloc failure in serviced query callbacks");
1758 			error = NETEVENT_CLOSED;
1759 			c = NULL;
1760 		}
1761 		sq->outnet->svcd_overhead = backlen;
1762 	}
1763 	/* test the actual sq->cblist, because the next elem could be deleted*/
1764 	while((p=sq->cblist) != NULL) {
1765 		sq->cblist = p->next; /* remove this element */
1766 		if(dobackup && c) {
1767 			sldns_buffer_clear(c->buffer);
1768 			sldns_buffer_write(c->buffer, backup_p, backlen);
1769 			sldns_buffer_flip(c->buffer);
1770 		}
1771 		fptr_ok(fptr_whitelist_serviced_query(p->cb));
1772 		(void)(*p->cb)(c, p->cb_arg, error, rep);
1773 		free(p);
1774 	}
1775 	if(backup_p) {
1776 		free(backup_p);
1777 		sq->outnet->svcd_overhead = 0;
1778 	}
1779 	verbose(VERB_ALGO, "svcd callbacks end");
1780 	log_assert(sq->cblist == NULL);
1781 	serviced_delete(sq);
1782 }
1783 
1784 int
1785 serviced_tcp_callback(struct comm_point* c, void* arg, int error,
1786         struct comm_reply* rep)
1787 {
1788 	struct serviced_query* sq = (struct serviced_query*)arg;
1789 	struct comm_reply r2;
1790 	sq->pending = NULL; /* removed after this callback */
1791 	if(error != NETEVENT_NOERROR)
1792 		log_addr(VERB_QUERY, "tcp error for address",
1793 			&sq->addr, sq->addrlen);
1794 	if(error==NETEVENT_NOERROR)
1795 		infra_update_tcp_works(sq->outnet->infra, &sq->addr,
1796 			sq->addrlen, sq->zone, sq->zonelen);
1797 #ifdef USE_DNSTAP
1798 	if(error==NETEVENT_NOERROR && sq->outnet->dtenv &&
1799 	   (sq->outnet->dtenv->log_resolver_response_messages ||
1800 	    sq->outnet->dtenv->log_forwarder_response_messages))
1801 		dt_msg_send_outside_response(sq->outnet->dtenv, &sq->addr,
1802 		c->type, sq->zone, sq->zonelen, sq->qbuf, sq->qbuflen,
1803 		&sq->last_sent_time, sq->outnet->now_tv, c->buffer);
1804 #endif
1805 	if(error==NETEVENT_NOERROR && sq->status == serviced_query_TCP_EDNS &&
1806 		(LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer)) ==
1807 		LDNS_RCODE_FORMERR || LDNS_RCODE_WIRE(sldns_buffer_begin(
1808 		c->buffer)) == LDNS_RCODE_NOTIMPL) ) {
1809 		/* attempt to fallback to nonEDNS */
1810 		sq->status = serviced_query_TCP_EDNS_fallback;
1811 		serviced_tcp_initiate(sq, c->buffer);
1812 		return 0;
1813 	} else if(error==NETEVENT_NOERROR &&
1814 		sq->status == serviced_query_TCP_EDNS_fallback &&
1815 			(LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer)) ==
1816 			LDNS_RCODE_NOERROR || LDNS_RCODE_WIRE(
1817 			sldns_buffer_begin(c->buffer)) == LDNS_RCODE_NXDOMAIN
1818 			|| LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer))
1819 			== LDNS_RCODE_YXDOMAIN)) {
1820 		/* the fallback produced a result that looks promising, note
1821 		 * that this server should be approached without EDNS */
1822 		/* only store noEDNS in cache if domain is noDNSSEC */
1823 		if(!sq->want_dnssec)
1824 		  if(!infra_edns_update(sq->outnet->infra, &sq->addr,
1825 			sq->addrlen, sq->zone, sq->zonelen, -1,
1826 			*sq->outnet->now_secs))
1827 			log_err("Out of memory caching no edns for host");
1828 		sq->status = serviced_query_TCP;
1829 	}
1830 	if(sq->tcp_upstream || sq->ssl_upstream) {
1831 	    struct timeval now = *sq->outnet->now_tv;
1832 	    if(error!=NETEVENT_NOERROR) {
1833 	        if(!infra_rtt_update(sq->outnet->infra, &sq->addr,
1834 		    sq->addrlen, sq->zone, sq->zonelen, sq->qtype,
1835 		    -1, sq->last_rtt, (time_t)now.tv_sec))
1836 		    log_err("out of memory in TCP exponential backoff.");
1837 	    } else if(now.tv_sec > sq->last_sent_time.tv_sec ||
1838 		(now.tv_sec == sq->last_sent_time.tv_sec &&
1839 		now.tv_usec > sq->last_sent_time.tv_usec)) {
1840 		/* convert from microseconds to milliseconds */
1841 		int roundtime = ((int)(now.tv_sec - sq->last_sent_time.tv_sec))*1000
1842 		  + ((int)now.tv_usec - (int)sq->last_sent_time.tv_usec)/1000;
1843 		verbose(VERB_ALGO, "measured TCP-time at %d msec", roundtime);
1844 		log_assert(roundtime >= 0);
1845 		/* only store if less then AUTH_TIMEOUT seconds, it could be
1846 		 * huge due to system-hibernated and we woke up */
1847 		if(roundtime < 60000) {
1848 		    if(!infra_rtt_update(sq->outnet->infra, &sq->addr,
1849 			sq->addrlen, sq->zone, sq->zonelen, sq->qtype,
1850 			roundtime, sq->last_rtt, (time_t)now.tv_sec))
1851 			log_err("out of memory noting rtt.");
1852 		}
1853 	    }
1854 	}
1855 	/* insert address into reply info */
1856 	if(!rep) {
1857 		/* create one if there isn't (on errors) */
1858 		rep = &r2;
1859 		r2.c = c;
1860 	}
1861 	memcpy(&rep->addr, &sq->addr, sq->addrlen);
1862 	rep->addrlen = sq->addrlen;
1863 	serviced_callbacks(sq, error, c, rep);
1864 	return 0;
1865 }
1866 
1867 static void
1868 serviced_tcp_initiate(struct serviced_query* sq, sldns_buffer* buff)
1869 {
1870 	verbose(VERB_ALGO, "initiate TCP query %s",
1871 		sq->status==serviced_query_TCP_EDNS?"EDNS":"");
1872 	serviced_encode(sq, buff, sq->status == serviced_query_TCP_EDNS);
1873 	sq->last_sent_time = *sq->outnet->now_tv;
1874 	sq->pending = pending_tcp_query(sq, buff, TCP_AUTH_QUERY_TIMEOUT,
1875 		serviced_tcp_callback, sq);
1876 	if(!sq->pending) {
1877 		/* delete from tree so that a retry by above layer does not
1878 		 * clash with this entry */
1879 		log_err("serviced_tcp_initiate: failed to send tcp query");
1880 		serviced_callbacks(sq, NETEVENT_CLOSED, NULL, NULL);
1881 	}
1882 }
1883 
1884 /** Send serviced query over TCP return false on initial failure */
1885 static int
1886 serviced_tcp_send(struct serviced_query* sq, sldns_buffer* buff)
1887 {
1888 	int vs, rtt, timeout;
1889 	uint8_t edns_lame_known;
1890 	if(!infra_host(sq->outnet->infra, &sq->addr, sq->addrlen, sq->zone,
1891 		sq->zonelen, *sq->outnet->now_secs, &vs, &edns_lame_known,
1892 		&rtt))
1893 		return 0;
1894 	sq->last_rtt = rtt;
1895 	if(vs != -1)
1896 		sq->status = serviced_query_TCP_EDNS;
1897 	else 	sq->status = serviced_query_TCP;
1898 	serviced_encode(sq, buff, sq->status == serviced_query_TCP_EDNS);
1899 	sq->last_sent_time = *sq->outnet->now_tv;
1900 	if(sq->tcp_upstream || sq->ssl_upstream) {
1901 		timeout = rtt;
1902 		if(rtt >= UNKNOWN_SERVER_NICENESS && rtt < TCP_AUTH_QUERY_TIMEOUT)
1903 			timeout = TCP_AUTH_QUERY_TIMEOUT;
1904 	} else {
1905 		timeout = TCP_AUTH_QUERY_TIMEOUT;
1906 	}
1907 	sq->pending = pending_tcp_query(sq, buff, timeout,
1908 		serviced_tcp_callback, sq);
1909 	return sq->pending != NULL;
1910 }
1911 
1912 /* see if packet is edns malformed; got zeroes at start.
1913  * This is from servers that return malformed packets to EDNS0 queries,
1914  * but they return good packets for nonEDNS0 queries.
1915  * We try to detect their output; without resorting to a full parse or
1916  * check for too many bytes after the end of the packet. */
1917 static int
1918 packet_edns_malformed(struct sldns_buffer* buf, int qtype)
1919 {
1920 	size_t len;
1921 	if(sldns_buffer_limit(buf) < LDNS_HEADER_SIZE)
1922 		return 1; /* malformed */
1923 	/* they have NOERROR rcode, 1 answer. */
1924 	if(LDNS_RCODE_WIRE(sldns_buffer_begin(buf)) != LDNS_RCODE_NOERROR)
1925 		return 0;
1926 	/* one query (to skip) and answer records */
1927 	if(LDNS_QDCOUNT(sldns_buffer_begin(buf)) != 1 ||
1928 		LDNS_ANCOUNT(sldns_buffer_begin(buf)) == 0)
1929 		return 0;
1930 	/* skip qname */
1931 	len = dname_valid(sldns_buffer_at(buf, LDNS_HEADER_SIZE),
1932 		sldns_buffer_limit(buf)-LDNS_HEADER_SIZE);
1933 	if(len == 0)
1934 		return 0;
1935 	if(len == 1 && qtype == 0)
1936 		return 0; /* we asked for '.' and type 0 */
1937 	/* and then 4 bytes (type and class of query) */
1938 	if(sldns_buffer_limit(buf) < LDNS_HEADER_SIZE + len + 4 + 3)
1939 		return 0;
1940 
1941 	/* and start with 11 zeroes as the answer RR */
1942 	/* so check the qtype of the answer record, qname=0, type=0 */
1943 	if(sldns_buffer_at(buf, LDNS_HEADER_SIZE+len+4)[0] == 0 &&
1944 	   sldns_buffer_at(buf, LDNS_HEADER_SIZE+len+4)[1] == 0 &&
1945 	   sldns_buffer_at(buf, LDNS_HEADER_SIZE+len+4)[2] == 0)
1946 		return 1;
1947 	return 0;
1948 }
1949 
1950 int
1951 serviced_udp_callback(struct comm_point* c, void* arg, int error,
1952         struct comm_reply* rep)
1953 {
1954 	struct serviced_query* sq = (struct serviced_query*)arg;
1955 	struct outside_network* outnet = sq->outnet;
1956 	struct timeval now = *sq->outnet->now_tv;
1957 	int fallback_tcp = 0;
1958 
1959 	sq->pending = NULL; /* removed after callback */
1960 	if(error == NETEVENT_TIMEOUT) {
1961 		int rto = 0;
1962 		if(sq->status == serviced_query_PROBE_EDNS) {
1963 			/* non-EDNS probe failed; we do not know its status,
1964 			 * keep trying with EDNS, timeout may not be caused
1965 			 * by EDNS. */
1966 			sq->status = serviced_query_UDP_EDNS;
1967 		}
1968 		if(sq->status == serviced_query_UDP_EDNS && sq->last_rtt < 5000) {
1969 			/* fallback to 1480/1280 */
1970 			sq->status = serviced_query_UDP_EDNS_FRAG;
1971 			log_name_addr(VERB_ALGO, "try edns1xx0", sq->qbuf+10,
1972 				&sq->addr, sq->addrlen);
1973 			if(!serviced_udp_send(sq, c->buffer)) {
1974 				serviced_callbacks(sq, NETEVENT_CLOSED, c, rep);
1975 			}
1976 			return 0;
1977 		}
1978 		if(sq->status == serviced_query_UDP_EDNS_FRAG) {
1979 			/* fragmentation size did not fix it */
1980 			sq->status = serviced_query_UDP_EDNS;
1981 		}
1982 		sq->retry++;
1983 		if(!(rto=infra_rtt_update(outnet->infra, &sq->addr, sq->addrlen,
1984 			sq->zone, sq->zonelen, sq->qtype, -1, sq->last_rtt,
1985 			(time_t)now.tv_sec)))
1986 			log_err("out of memory in UDP exponential backoff");
1987 		if(sq->retry < OUTBOUND_UDP_RETRY) {
1988 			log_name_addr(VERB_ALGO, "retry query", sq->qbuf+10,
1989 				&sq->addr, sq->addrlen);
1990 			if(!serviced_udp_send(sq, c->buffer)) {
1991 				serviced_callbacks(sq, NETEVENT_CLOSED, c, rep);
1992 			}
1993 			return 0;
1994 		}
1995 		if(rto >= RTT_MAX_TIMEOUT) {
1996 			/* fallback_tcp = 1; */
1997 			/* UDP does not work, fallback to TCP below */
1998 		} else {
1999 			serviced_callbacks(sq, NETEVENT_TIMEOUT, c, rep);
2000 			return 0;
2001 		}
2002 	} else if(error != NETEVENT_NOERROR) {
2003 		/* udp returns error (due to no ID or interface available) */
2004 		serviced_callbacks(sq, error, c, rep);
2005 		return 0;
2006 	}
2007 #ifdef USE_DNSTAP
2008 	if(error == NETEVENT_NOERROR && outnet->dtenv &&
2009 	   (outnet->dtenv->log_resolver_response_messages ||
2010 	    outnet->dtenv->log_forwarder_response_messages))
2011 		dt_msg_send_outside_response(outnet->dtenv, &sq->addr, c->type,
2012 		sq->zone, sq->zonelen, sq->qbuf, sq->qbuflen,
2013 		&sq->last_sent_time, sq->outnet->now_tv, c->buffer);
2014 #endif
2015 	if(!fallback_tcp) {
2016 	    if( (sq->status == serviced_query_UDP_EDNS
2017 	        ||sq->status == serviced_query_UDP_EDNS_FRAG)
2018 		&& (LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer))
2019 			== LDNS_RCODE_FORMERR || LDNS_RCODE_WIRE(
2020 			sldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOTIMPL
2021 		    || packet_edns_malformed(c->buffer, sq->qtype)
2022 			)) {
2023 		/* try to get an answer by falling back without EDNS */
2024 		verbose(VERB_ALGO, "serviced query: attempt without EDNS");
2025 		sq->status = serviced_query_UDP_EDNS_fallback;
2026 		sq->retry = 0;
2027 		if(!serviced_udp_send(sq, c->buffer)) {
2028 			serviced_callbacks(sq, NETEVENT_CLOSED, c, rep);
2029 		}
2030 		return 0;
2031 	    } else if(sq->status == serviced_query_PROBE_EDNS) {
2032 		/* probe without EDNS succeeds, so we conclude that this
2033 		 * host likely has EDNS packets dropped */
2034 		log_addr(VERB_DETAIL, "timeouts, concluded that connection to "
2035 			"host drops EDNS packets", &sq->addr, sq->addrlen);
2036 		/* only store noEDNS in cache if domain is noDNSSEC */
2037 		if(!sq->want_dnssec)
2038 		  if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
2039 			sq->zone, sq->zonelen, -1, (time_t)now.tv_sec)) {
2040 			log_err("Out of memory caching no edns for host");
2041 		  }
2042 		sq->status = serviced_query_UDP;
2043 	    } else if(sq->status == serviced_query_UDP_EDNS &&
2044 		!sq->edns_lame_known) {
2045 		/* now we know that edns queries received answers store that */
2046 		log_addr(VERB_ALGO, "serviced query: EDNS works for",
2047 			&sq->addr, sq->addrlen);
2048 		if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
2049 			sq->zone, sq->zonelen, 0, (time_t)now.tv_sec)) {
2050 			log_err("Out of memory caching edns works");
2051 		}
2052 		sq->edns_lame_known = 1;
2053 	    } else if(sq->status == serviced_query_UDP_EDNS_fallback &&
2054 		!sq->edns_lame_known && (LDNS_RCODE_WIRE(
2055 		sldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOERROR ||
2056 		LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer)) ==
2057 		LDNS_RCODE_NXDOMAIN || LDNS_RCODE_WIRE(sldns_buffer_begin(
2058 		c->buffer)) == LDNS_RCODE_YXDOMAIN)) {
2059 		/* the fallback produced a result that looks promising, note
2060 		 * that this server should be approached without EDNS */
2061 		/* only store noEDNS in cache if domain is noDNSSEC */
2062 		if(!sq->want_dnssec) {
2063 		  log_addr(VERB_ALGO, "serviced query: EDNS fails for",
2064 			&sq->addr, sq->addrlen);
2065 		  if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
2066 			sq->zone, sq->zonelen, -1, (time_t)now.tv_sec)) {
2067 			log_err("Out of memory caching no edns for host");
2068 		  }
2069 		} else {
2070 		  log_addr(VERB_ALGO, "serviced query: EDNS fails, but "
2071 		  	"not stored because need DNSSEC for", &sq->addr,
2072 			sq->addrlen);
2073 		}
2074 		sq->status = serviced_query_UDP;
2075 	    }
2076 	    if(now.tv_sec > sq->last_sent_time.tv_sec ||
2077 		(now.tv_sec == sq->last_sent_time.tv_sec &&
2078 		now.tv_usec > sq->last_sent_time.tv_usec)) {
2079 		/* convert from microseconds to milliseconds */
2080 		int roundtime = ((int)(now.tv_sec - sq->last_sent_time.tv_sec))*1000
2081 		  + ((int)now.tv_usec - (int)sq->last_sent_time.tv_usec)/1000;
2082 		verbose(VERB_ALGO, "measured roundtrip at %d msec", roundtime);
2083 		log_assert(roundtime >= 0);
2084 		/* in case the system hibernated, do not enter a huge value,
2085 		 * above this value gives trouble with server selection */
2086 		if(roundtime < 60000) {
2087 		    if(!infra_rtt_update(outnet->infra, &sq->addr, sq->addrlen,
2088 			sq->zone, sq->zonelen, sq->qtype, roundtime,
2089 			sq->last_rtt, (time_t)now.tv_sec))
2090 			log_err("out of memory noting rtt.");
2091 		}
2092 	    }
2093 	} /* end of if_!fallback_tcp */
2094 	/* perform TC flag check and TCP fallback after updating our
2095 	 * cache entries for EDNS status and RTT times */
2096 	if(LDNS_TC_WIRE(sldns_buffer_begin(c->buffer)) || fallback_tcp) {
2097 		/* fallback to TCP */
2098 		/* this discards partial UDP contents */
2099 		if(sq->status == serviced_query_UDP_EDNS ||
2100 			sq->status == serviced_query_UDP_EDNS_FRAG ||
2101 			sq->status == serviced_query_UDP_EDNS_fallback)
2102 			/* if we have unfinished EDNS_fallback, start again */
2103 			sq->status = serviced_query_TCP_EDNS;
2104 		else	sq->status = serviced_query_TCP;
2105 		serviced_tcp_initiate(sq, c->buffer);
2106 		return 0;
2107 	}
2108 	/* yay! an answer */
2109 	serviced_callbacks(sq, error, c, rep);
2110 	return 0;
2111 }
2112 
2113 struct serviced_query*
2114 outnet_serviced_query(struct outside_network* outnet,
2115 	struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec,
2116 	int nocaps, int tcp_upstream, int ssl_upstream, char* tls_auth_name,
2117 	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
2118 	size_t zonelen, struct module_qstate* qstate,
2119 	comm_point_callback_type* callback, void* callback_arg, sldns_buffer* buff,
2120 	struct module_env* env)
2121 {
2122 	struct serviced_query* sq;
2123 	struct service_callback* cb;
2124 	if(!inplace_cb_query_call(env, qinfo, flags, addr, addrlen, zone, zonelen,
2125 		qstate, qstate->region))
2126 			return NULL;
2127 	serviced_gen_query(buff, qinfo->qname, qinfo->qname_len, qinfo->qtype,
2128 		qinfo->qclass, flags);
2129 	sq = lookup_serviced(outnet, buff, dnssec, addr, addrlen,
2130 		qstate->edns_opts_back_out);
2131 	/* duplicate entries are included in the callback list, because
2132 	 * there is a counterpart registration by our caller that needs to
2133 	 * be doubly-removed (with callbacks perhaps). */
2134 	if(!(cb = (struct service_callback*)malloc(sizeof(*cb))))
2135 		return NULL;
2136 	if(!sq) {
2137 		/* make new serviced query entry */
2138 		sq = serviced_create(outnet, buff, dnssec, want_dnssec, nocaps,
2139 			tcp_upstream, ssl_upstream, tls_auth_name, addr,
2140 			addrlen, zone, zonelen, (int)qinfo->qtype,
2141 			qstate->edns_opts_back_out);
2142 		if(!sq) {
2143 			free(cb);
2144 			return NULL;
2145 		}
2146 		/* perform first network action */
2147 		if(outnet->do_udp && !(tcp_upstream || ssl_upstream)) {
2148 			if(!serviced_udp_send(sq, buff)) {
2149 				(void)rbtree_delete(outnet->serviced, sq);
2150 				free(sq->qbuf);
2151 				free(sq->zone);
2152 				free(sq);
2153 				free(cb);
2154 				return NULL;
2155 			}
2156 		} else {
2157 			if(!serviced_tcp_send(sq, buff)) {
2158 				(void)rbtree_delete(outnet->serviced, sq);
2159 				free(sq->qbuf);
2160 				free(sq->zone);
2161 				free(sq);
2162 				free(cb);
2163 				return NULL;
2164 			}
2165 		}
2166 	}
2167 	/* add callback to list of callbacks */
2168 	cb->cb = callback;
2169 	cb->cb_arg = callback_arg;
2170 	cb->next = sq->cblist;
2171 	sq->cblist = cb;
2172 	return sq;
2173 }
2174 
2175 /** remove callback from list */
2176 static void
2177 callback_list_remove(struct serviced_query* sq, void* cb_arg)
2178 {
2179 	struct service_callback** pp = &sq->cblist;
2180 	while(*pp) {
2181 		if((*pp)->cb_arg == cb_arg) {
2182 			struct service_callback* del = *pp;
2183 			*pp = del->next;
2184 			free(del);
2185 			return;
2186 		}
2187 		pp = &(*pp)->next;
2188 	}
2189 }
2190 
2191 void outnet_serviced_query_stop(struct serviced_query* sq, void* cb_arg)
2192 {
2193 	if(!sq)
2194 		return;
2195 	callback_list_remove(sq, cb_arg);
2196 	/* if callbacks() routine scheduled deletion, let it do that */
2197 	if(!sq->cblist && !sq->to_be_deleted) {
2198 		(void)rbtree_delete(sq->outnet->serviced, sq);
2199 		serviced_delete(sq);
2200 	}
2201 }
2202 
2203 /** create fd to send to this destination */
2204 static int
2205 fd_for_dest(struct outside_network* outnet, struct sockaddr_storage* to_addr,
2206 	socklen_t to_addrlen)
2207 {
2208 	struct sockaddr_storage* addr;
2209 	socklen_t addrlen;
2210 	int i, try, pnum;
2211 	struct port_if* pif;
2212 
2213 	/* create fd */
2214 	for(try = 0; try<1000; try++) {
2215 		int port = 0;
2216 		int freebind = 0;
2217 		int noproto = 0;
2218 		int inuse = 0;
2219 		int fd = -1;
2220 
2221 		/* select interface */
2222 		if(addr_is_ip6(to_addr, to_addrlen)) {
2223 			if(outnet->num_ip6 == 0) {
2224 				char to[64];
2225 				addr_to_str(to_addr, to_addrlen, to, sizeof(to));
2226 				verbose(VERB_QUERY, "need ipv6 to send, but no ipv6 outgoing interfaces, for %s", to);
2227 				return -1;
2228 			}
2229 			i = ub_random_max(outnet->rnd, outnet->num_ip6);
2230 			pif = &outnet->ip6_ifs[i];
2231 		} else {
2232 			if(outnet->num_ip4 == 0) {
2233 				char to[64];
2234 				addr_to_str(to_addr, to_addrlen, to, sizeof(to));
2235 				verbose(VERB_QUERY, "need ipv4 to send, but no ipv4 outgoing interfaces, for %s", to);
2236 				return -1;
2237 			}
2238 			i = ub_random_max(outnet->rnd, outnet->num_ip4);
2239 			pif = &outnet->ip4_ifs[i];
2240 		}
2241 		addr = &pif->addr;
2242 		addrlen = pif->addrlen;
2243 		pnum = ub_random_max(outnet->rnd, pif->avail_total);
2244 		if(pnum < pif->inuse) {
2245 			/* port already open */
2246 			port = pif->out[pnum]->number;
2247 		} else {
2248 			/* unused ports in start part of array */
2249 			port = pif->avail_ports[pnum - pif->inuse];
2250 		}
2251 
2252 		if(addr_is_ip6(to_addr, to_addrlen)) {
2253 			struct sockaddr_in6 sa = *(struct sockaddr_in6*)addr;
2254 			sa.sin6_port = (in_port_t)htons((uint16_t)port);
2255 			fd = create_udp_sock(AF_INET6, SOCK_DGRAM,
2256 				(struct sockaddr*)&sa, addrlen, 1, &inuse, &noproto,
2257 				0, 0, 0, NULL, 0, freebind, 0);
2258 		} else {
2259 			struct sockaddr_in* sa = (struct sockaddr_in*)addr;
2260 			sa->sin_port = (in_port_t)htons((uint16_t)port);
2261 			fd = create_udp_sock(AF_INET, SOCK_DGRAM,
2262 				(struct sockaddr*)addr, addrlen, 1, &inuse, &noproto,
2263 				0, 0, 0, NULL, 0, freebind, 0);
2264 		}
2265 		if(fd != -1) {
2266 			return fd;
2267 		}
2268 		if(!inuse) {
2269 			return -1;
2270 		}
2271 	}
2272 	/* too many tries */
2273 	log_err("cannot send probe, ports are in use");
2274 	return -1;
2275 }
2276 
2277 struct comm_point*
2278 outnet_comm_point_for_udp(struct outside_network* outnet,
2279 	comm_point_callback_type* cb, void* cb_arg,
2280 	struct sockaddr_storage* to_addr, socklen_t to_addrlen)
2281 {
2282 	struct comm_point* cp;
2283 	int fd = fd_for_dest(outnet, to_addr, to_addrlen);
2284 	if(fd == -1) {
2285 		return NULL;
2286 	}
2287 	cp = comm_point_create_udp(outnet->base, fd, outnet->udp_buff,
2288 		cb, cb_arg);
2289 	if(!cp) {
2290 		log_err("malloc failure");
2291 		close(fd);
2292 		return NULL;
2293 	}
2294 	return cp;
2295 }
2296 
2297 struct comm_point*
2298 outnet_comm_point_for_tcp(struct outside_network* outnet,
2299 	comm_point_callback_type* cb, void* cb_arg,
2300 	struct sockaddr_storage* to_addr, socklen_t to_addrlen,
2301 	sldns_buffer* query, int timeout)
2302 {
2303 	struct comm_point* cp;
2304 	int fd = outnet_get_tcp_fd(to_addr, to_addrlen, outnet->tcp_mss);
2305 	if(fd == -1) {
2306 		return 0;
2307 	}
2308 	fd_set_nonblock(fd);
2309 	if(!outnet_tcp_connect(fd, to_addr, to_addrlen)) {
2310 		/* outnet_tcp_connect has closed fd on error for us */
2311 		return 0;
2312 	}
2313 	cp = comm_point_create_tcp_out(outnet->base, 65552, cb, cb_arg);
2314 	if(!cp) {
2315 		log_err("malloc failure");
2316 		close(fd);
2317 		return 0;
2318 	}
2319 	cp->repinfo.addrlen = to_addrlen;
2320 	memcpy(&cp->repinfo.addr, to_addr, to_addrlen);
2321 	/* set timeout on TCP connection */
2322 	comm_point_start_listening(cp, fd, timeout);
2323 	/* copy scratch buffer to cp->buffer */
2324 	sldns_buffer_copy(cp->buffer, query);
2325 	return cp;
2326 }
2327 
2328 /** setup http request headers in buffer for sending query to destination */
2329 static int
2330 setup_http_request(sldns_buffer* buf, char* host, char* path)
2331 {
2332 	sldns_buffer_clear(buf);
2333 	sldns_buffer_printf(buf, "GET /%s HTTP/1.1\r\n", path);
2334 	sldns_buffer_printf(buf, "Host: %s\r\n", host);
2335 	sldns_buffer_printf(buf, "User-Agent: unbound/%s\r\n",
2336 		PACKAGE_VERSION);
2337 	/* We do not really do multiple queries per connection,
2338 	 * but this header setting is also not needed.
2339 	 * sldns_buffer_printf(buf, "Connection: close\r\n") */
2340 	sldns_buffer_printf(buf, "\r\n");
2341 	if(sldns_buffer_position(buf)+10 > sldns_buffer_capacity(buf))
2342 		return 0; /* somehow buffer too short, but it is about 60K
2343 		and the request is only a couple bytes long. */
2344 	sldns_buffer_flip(buf);
2345 	return 1;
2346 }
2347 
2348 struct comm_point*
2349 outnet_comm_point_for_http(struct outside_network* outnet,
2350 	comm_point_callback_type* cb, void* cb_arg,
2351 	struct sockaddr_storage* to_addr, socklen_t to_addrlen, int timeout,
2352 	int ssl, char* host, char* path)
2353 {
2354 	/* cp calls cb with err=NETEVENT_DONE when transfer is done */
2355 	struct comm_point* cp;
2356 	int fd = outnet_get_tcp_fd(to_addr, to_addrlen, outnet->tcp_mss);
2357 	if(fd == -1) {
2358 		return 0;
2359 	}
2360 	fd_set_nonblock(fd);
2361 	if(!outnet_tcp_connect(fd, to_addr, to_addrlen)) {
2362 		/* outnet_tcp_connect has closed fd on error for us */
2363 		return 0;
2364 	}
2365 	cp = comm_point_create_http_out(outnet->base, 65552, cb, cb_arg,
2366 		outnet->udp_buff);
2367 	if(!cp) {
2368 		log_err("malloc failure");
2369 		close(fd);
2370 		return 0;
2371 	}
2372 	cp->repinfo.addrlen = to_addrlen;
2373 	memcpy(&cp->repinfo.addr, to_addr, to_addrlen);
2374 
2375 	/* setup for SSL (if needed) */
2376 	if(ssl) {
2377 		cp->ssl = outgoing_ssl_fd(outnet->sslctx, fd);
2378 		if(!cp->ssl) {
2379 			log_err("cannot setup https");
2380 			comm_point_delete(cp);
2381 			return NULL;
2382 		}
2383 #ifdef USE_WINSOCK
2384 		comm_point_tcp_win_bio_cb(cp, cp->ssl);
2385 #endif
2386 		cp->ssl_shake_state = comm_ssl_shake_write;
2387 		/* https verification */
2388 #ifdef HAVE_SSL_SET1_HOST
2389 		if((SSL_CTX_get_verify_mode(outnet->sslctx)&SSL_VERIFY_PEER)) {
2390 			/* because we set SSL_VERIFY_PEER, in netevent in
2391 			 * ssl_handshake, it'll check if the certificate
2392 			 * verification has succeeded */
2393 			/* SSL_VERIFY_PEER is set on the sslctx */
2394 			/* and the certificates to verify with are loaded into
2395 			 * it with SSL_load_verify_locations or
2396 			 * SSL_CTX_set_default_verify_paths */
2397 			/* setting the hostname makes openssl verify the
2398 			 * host name in the x509 certificate in the
2399 			 * SSL connection*/
2400 		 	if(!SSL_set1_host(cp->ssl, host)) {
2401 				log_err("SSL_set1_host failed");
2402 				comm_point_delete(cp);
2403 				return NULL;
2404 			}
2405 		}
2406 #endif /* HAVE_SSL_SET1_HOST */
2407 	}
2408 
2409 	/* set timeout on TCP connection */
2410 	comm_point_start_listening(cp, fd, timeout);
2411 
2412 	/* setup http request in cp->buffer */
2413 	if(!setup_http_request(cp->buffer, host, path)) {
2414 		log_err("error setting up http request");
2415 		comm_point_delete(cp);
2416 		return NULL;
2417 	}
2418 	return cp;
2419 }
2420 
2421 /** get memory used by waiting tcp entry (in use or not) */
2422 static size_t
2423 waiting_tcp_get_mem(struct waiting_tcp* w)
2424 {
2425 	size_t s;
2426 	if(!w) return 0;
2427 	s = sizeof(*w) + w->pkt_len;
2428 	if(w->timer)
2429 		s += comm_timer_get_mem(w->timer);
2430 	return s;
2431 }
2432 
2433 /** get memory used by port if */
2434 static size_t
2435 if_get_mem(struct port_if* pif)
2436 {
2437 	size_t s;
2438 	int i;
2439 	s = sizeof(*pif) + sizeof(int)*pif->avail_total +
2440 		sizeof(struct port_comm*)*pif->maxout;
2441 	for(i=0; i<pif->inuse; i++)
2442 		s += sizeof(*pif->out[i]) +
2443 			comm_point_get_mem(pif->out[i]->cp);
2444 	return s;
2445 }
2446 
2447 /** get memory used by waiting udp */
2448 static size_t
2449 waiting_udp_get_mem(struct pending* w)
2450 {
2451 	size_t s;
2452 	s = sizeof(*w) + comm_timer_get_mem(w->timer) + w->pkt_len;
2453 	return s;
2454 }
2455 
2456 size_t outnet_get_mem(struct outside_network* outnet)
2457 {
2458 	size_t i;
2459 	int k;
2460 	struct waiting_tcp* w;
2461 	struct pending* u;
2462 	struct serviced_query* sq;
2463 	struct service_callback* sb;
2464 	struct port_comm* pc;
2465 	size_t s = sizeof(*outnet) + sizeof(*outnet->base) +
2466 		sizeof(*outnet->udp_buff) +
2467 		sldns_buffer_capacity(outnet->udp_buff);
2468 	/* second buffer is not ours */
2469 	for(pc = outnet->unused_fds; pc; pc = pc->next) {
2470 		s += sizeof(*pc) + comm_point_get_mem(pc->cp);
2471 	}
2472 	for(k=0; k<outnet->num_ip4; k++)
2473 		s += if_get_mem(&outnet->ip4_ifs[k]);
2474 	for(k=0; k<outnet->num_ip6; k++)
2475 		s += if_get_mem(&outnet->ip6_ifs[k]);
2476 	for(u=outnet->udp_wait_first; u; u=u->next_waiting)
2477 		s += waiting_udp_get_mem(u);
2478 
2479 	s += sizeof(struct pending_tcp*)*outnet->num_tcp;
2480 	for(i=0; i<outnet->num_tcp; i++) {
2481 		s += sizeof(struct pending_tcp);
2482 		s += comm_point_get_mem(outnet->tcp_conns[i]->c);
2483 		if(outnet->tcp_conns[i]->query)
2484 			s += waiting_tcp_get_mem(outnet->tcp_conns[i]->query);
2485 	}
2486 	for(w=outnet->tcp_wait_first; w; w = w->next_waiting)
2487 		s += waiting_tcp_get_mem(w);
2488 	s += sizeof(*outnet->pending);
2489 	s += (sizeof(struct pending) + comm_timer_get_mem(NULL)) *
2490 		outnet->pending->count;
2491 	s += sizeof(*outnet->serviced);
2492 	s += outnet->svcd_overhead;
2493 	RBTREE_FOR(sq, struct serviced_query*, outnet->serviced) {
2494 		s += sizeof(*sq) + sq->qbuflen;
2495 		for(sb = sq->cblist; sb; sb = sb->next)
2496 			s += sizeof(*sb);
2497 	}
2498 	return s;
2499 }
2500 
2501 size_t
2502 serviced_get_mem(struct serviced_query* sq)
2503 {
2504 	struct service_callback* sb;
2505 	size_t s;
2506 	s = sizeof(*sq) + sq->qbuflen;
2507 	for(sb = sq->cblist; sb; sb = sb->next)
2508 		s += sizeof(*sb);
2509 	if(sq->status == serviced_query_UDP_EDNS ||
2510 		sq->status == serviced_query_UDP ||
2511 		sq->status == serviced_query_PROBE_EDNS ||
2512 		sq->status == serviced_query_UDP_EDNS_FRAG ||
2513 		sq->status == serviced_query_UDP_EDNS_fallback) {
2514 		s += sizeof(struct pending);
2515 		s += comm_timer_get_mem(NULL);
2516 	} else {
2517 		/* does not have size of the pkt pointer */
2518 		/* always has a timer except on malloc failures */
2519 
2520 		/* these sizes are part of the main outside network mem */
2521 		/*
2522 		s += sizeof(struct waiting_tcp);
2523 		s += comm_timer_get_mem(NULL);
2524 		*/
2525 	}
2526 	return s;
2527 }
2528 
2529