1 /* 2 * util/data/msgencode.c - Encode DNS messages, queries and replies. 3 * 4 * Copyright (c) 2007, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains a routines to encode DNS messages. 40 */ 41 42 #include "config.h" 43 #include "util/data/msgencode.h" 44 #include "util/data/msgreply.h" 45 #include "util/data/msgparse.h" 46 #include "util/data/dname.h" 47 #include "util/log.h" 48 #include "util/regional.h" 49 #include "util/net_help.h" 50 #include "sldns/sbuffer.h" 51 #include "services/localzone.h" 52 53 #ifdef HAVE_TIME_H 54 #include <time.h> 55 #endif 56 #include <sys/time.h> 57 58 /** return code that means the function ran out of memory. negative so it does 59 * not conflict with DNS rcodes. */ 60 #define RETVAL_OUTMEM -2 61 /** return code that means the data did not fit (completely) in the packet */ 62 #define RETVAL_TRUNC -4 63 /** return code that means all is peachy keen. Equal to DNS rcode NOERROR */ 64 #define RETVAL_OK 0 65 66 /** 67 * Data structure to help domain name compression in outgoing messages. 68 * A tree of dnames and their offsets in the packet is kept. 69 * It is kept sorted, not canonical, but by label at least, so that after 70 * a lookup of a name you know its closest match, and the parent from that 71 * closest match. These are possible compression targets. 72 * 73 * It is a binary tree, not a rbtree or balanced tree, as the effort 74 * of keeping it balanced probably outweighs usefulness (given typical 75 * DNS packet size). 76 */ 77 struct compress_tree_node { 78 /** left node in tree, all smaller to this */ 79 struct compress_tree_node* left; 80 /** right node in tree, all larger than this */ 81 struct compress_tree_node* right; 82 83 /** the parent node - not for tree, but zone parent. One less label */ 84 struct compress_tree_node* parent; 85 /** the domain name for this node. Pointer to uncompressed memory. */ 86 uint8_t* dname; 87 /** number of labels in domain name, kept to help compare func. */ 88 int labs; 89 /** offset in packet that points to this dname */ 90 size_t offset; 91 }; 92 93 /** 94 * Find domain name in tree, returns exact and closest match. 95 * @param tree: root of tree. 96 * @param dname: pointer to uncompressed dname. 97 * @param labs: number of labels in domain name. 98 * @param match: closest or exact match. 99 * guaranteed to be smaller or equal to the sought dname. 100 * can be null if the tree is empty. 101 * @param matchlabels: number of labels that match with closest match. 102 * can be zero is there is no match. 103 * @param insertpt: insert location for dname, if not found. 104 * @return: 0 if no exact match. 105 */ 106 static int 107 compress_tree_search(struct compress_tree_node** tree, uint8_t* dname, 108 int labs, struct compress_tree_node** match, int* matchlabels, 109 struct compress_tree_node*** insertpt) 110 { 111 int c, n, closen=0; 112 struct compress_tree_node* p = *tree; 113 struct compress_tree_node* close = 0; 114 struct compress_tree_node** prev = tree; 115 while(p) { 116 if((c = dname_lab_cmp(dname, labs, p->dname, p->labs, &n)) 117 == 0) { 118 *matchlabels = n; 119 *match = p; 120 return 1; 121 } 122 if(c<0) { 123 prev = &p->left; 124 p = p->left; 125 } else { 126 closen = n; 127 close = p; /* p->dname is smaller than dname */ 128 prev = &p->right; 129 p = p->right; 130 } 131 } 132 *insertpt = prev; 133 *matchlabels = closen; 134 *match = close; 135 return 0; 136 } 137 138 /** 139 * Lookup a domain name in compression tree. 140 * @param tree: root of tree (not the node with '.'). 141 * @param dname: pointer to uncompressed dname. 142 * @param labs: number of labels in domain name. 143 * @param insertpt: insert location for dname, if not found. 144 * @return: 0 if not found or compress treenode with best compression. 145 */ 146 static struct compress_tree_node* 147 compress_tree_lookup(struct compress_tree_node** tree, uint8_t* dname, 148 int labs, struct compress_tree_node*** insertpt) 149 { 150 struct compress_tree_node* p; 151 int m; 152 if(labs <= 1) 153 return 0; /* do not compress root node */ 154 if(compress_tree_search(tree, dname, labs, &p, &m, insertpt)) { 155 /* exact match */ 156 return p; 157 } 158 /* return some ancestor of p that compresses well. */ 159 if(m>1) { 160 /* www.example.com. (labs=4) matched foo.example.com.(labs=4) 161 * then matchcount = 3. need to go up. */ 162 while(p && p->labs > m) 163 p = p->parent; 164 return p; 165 } 166 return 0; 167 } 168 169 /** 170 * Create node for domain name compression tree. 171 * @param dname: pointer to uncompressed dname (stored in tree). 172 * @param labs: number of labels in dname. 173 * @param offset: offset into packet for dname. 174 * @param region: how to allocate memory for new node. 175 * @return new node or 0 on malloc failure. 176 */ 177 static struct compress_tree_node* 178 compress_tree_newnode(uint8_t* dname, int labs, size_t offset, 179 struct regional* region) 180 { 181 struct compress_tree_node* n = (struct compress_tree_node*) 182 regional_alloc(region, sizeof(struct compress_tree_node)); 183 if(!n) return 0; 184 n->left = 0; 185 n->right = 0; 186 n->parent = 0; 187 n->dname = dname; 188 n->labs = labs; 189 n->offset = offset; 190 return n; 191 } 192 193 /** 194 * Store domain name and ancestors into compression tree. 195 * @param dname: pointer to uncompressed dname (stored in tree). 196 * @param labs: number of labels in dname. 197 * @param offset: offset into packet for dname. 198 * @param region: how to allocate memory for new node. 199 * @param closest: match from previous lookup, used to compress dname. 200 * may be NULL if no previous match. 201 * if the tree has an ancestor of dname already, this must be it. 202 * @param insertpt: where to insert the dname in tree. 203 * @return: 0 on memory error. 204 */ 205 static int 206 compress_tree_store(uint8_t* dname, int labs, size_t offset, 207 struct regional* region, struct compress_tree_node* closest, 208 struct compress_tree_node** insertpt) 209 { 210 uint8_t lablen; 211 struct compress_tree_node* newnode; 212 struct compress_tree_node* prevnode = NULL; 213 int uplabs = labs-1; /* does not store root in tree */ 214 if(closest) uplabs = labs - closest->labs; 215 log_assert(uplabs >= 0); 216 /* algorithms builds up a vine of dname-labels to hang into tree */ 217 while(uplabs--) { 218 if(offset > PTR_MAX_OFFSET) { 219 /* insertion failed, drop vine */ 220 return 1; /* compression pointer no longer useful */ 221 } 222 if(!(newnode = compress_tree_newnode(dname, labs, offset, 223 region))) { 224 /* insertion failed, drop vine */ 225 return 0; 226 } 227 228 if(prevnode) { 229 /* chain nodes together, last one has one label more, 230 * so is larger than newnode, thus goes right. */ 231 newnode->right = prevnode; 232 prevnode->parent = newnode; 233 } 234 235 /* next label */ 236 lablen = *dname++; 237 dname += lablen; 238 offset += lablen+1; 239 prevnode = newnode; 240 labs--; 241 } 242 /* if we have a vine, hang the vine into the tree */ 243 if(prevnode) { 244 *insertpt = prevnode; 245 prevnode->parent = closest; 246 } 247 return 1; 248 } 249 250 /** compress a domain name */ 251 static int 252 write_compressed_dname(sldns_buffer* pkt, uint8_t* dname, int labs, 253 struct compress_tree_node* p) 254 { 255 /* compress it */ 256 int labcopy = labs - p->labs; 257 uint8_t lablen; 258 uint16_t ptr; 259 260 if(labs == 1) { 261 /* write root label */ 262 if(sldns_buffer_remaining(pkt) < 1) 263 return 0; 264 sldns_buffer_write_u8(pkt, 0); 265 return 1; 266 } 267 268 /* copy the first couple of labels */ 269 while(labcopy--) { 270 lablen = *dname++; 271 if(sldns_buffer_remaining(pkt) < (size_t)lablen+1) 272 return 0; 273 sldns_buffer_write_u8(pkt, lablen); 274 sldns_buffer_write(pkt, dname, lablen); 275 dname += lablen; 276 } 277 /* insert compression ptr */ 278 if(sldns_buffer_remaining(pkt) < 2) 279 return 0; 280 ptr = PTR_CREATE(p->offset); 281 sldns_buffer_write_u16(pkt, ptr); 282 return 1; 283 } 284 285 /** compress owner name of RR, return RETVAL_OUTMEM RETVAL_TRUNC */ 286 static int 287 compress_owner(struct ub_packed_rrset_key* key, sldns_buffer* pkt, 288 struct regional* region, struct compress_tree_node** tree, 289 size_t owner_pos, uint16_t* owner_ptr, int owner_labs) 290 { 291 struct compress_tree_node* p; 292 struct compress_tree_node** insertpt = NULL; 293 if(!*owner_ptr) { 294 /* compress first time dname */ 295 if((p = compress_tree_lookup(tree, key->rk.dname, 296 owner_labs, &insertpt))) { 297 if(p->labs == owner_labs) 298 /* avoid ptr chains, since some software is 299 * not capable of decoding ptr after a ptr. */ 300 *owner_ptr = htons(PTR_CREATE(p->offset)); 301 if(!write_compressed_dname(pkt, key->rk.dname, 302 owner_labs, p)) 303 return RETVAL_TRUNC; 304 /* check if typeclass+4 ttl + rdatalen is available */ 305 if(sldns_buffer_remaining(pkt) < 4+4+2) 306 return RETVAL_TRUNC; 307 } else { 308 /* no compress */ 309 if(sldns_buffer_remaining(pkt) < key->rk.dname_len+4+4+2) 310 return RETVAL_TRUNC; 311 sldns_buffer_write(pkt, key->rk.dname, 312 key->rk.dname_len); 313 if(owner_pos <= PTR_MAX_OFFSET) 314 *owner_ptr = htons(PTR_CREATE(owner_pos)); 315 } 316 if(!compress_tree_store(key->rk.dname, owner_labs, 317 owner_pos, region, p, insertpt)) 318 return RETVAL_OUTMEM; 319 } else { 320 /* always compress 2nd-further RRs in RRset */ 321 if(owner_labs == 1) { 322 if(sldns_buffer_remaining(pkt) < 1+4+4+2) 323 return RETVAL_TRUNC; 324 sldns_buffer_write_u8(pkt, 0); 325 } else { 326 if(sldns_buffer_remaining(pkt) < 2+4+4+2) 327 return RETVAL_TRUNC; 328 sldns_buffer_write(pkt, owner_ptr, 2); 329 } 330 } 331 return RETVAL_OK; 332 } 333 334 /** compress any domain name to the packet, return RETVAL_* */ 335 static int 336 compress_any_dname(uint8_t* dname, sldns_buffer* pkt, int labs, 337 struct regional* region, struct compress_tree_node** tree) 338 { 339 struct compress_tree_node* p; 340 struct compress_tree_node** insertpt = NULL; 341 size_t pos = sldns_buffer_position(pkt); 342 if((p = compress_tree_lookup(tree, dname, labs, &insertpt))) { 343 if(!write_compressed_dname(pkt, dname, labs, p)) 344 return RETVAL_TRUNC; 345 } else { 346 if(!dname_buffer_write(pkt, dname)) 347 return RETVAL_TRUNC; 348 } 349 if(!compress_tree_store(dname, labs, pos, region, p, insertpt)) 350 return RETVAL_OUTMEM; 351 return RETVAL_OK; 352 } 353 354 /** return true if type needs domain name compression in rdata */ 355 static const sldns_rr_descriptor* 356 type_rdata_compressable(struct ub_packed_rrset_key* key) 357 { 358 uint16_t t = ntohs(key->rk.type); 359 if(sldns_rr_descript(t) && 360 sldns_rr_descript(t)->_compress == LDNS_RR_COMPRESS) 361 return sldns_rr_descript(t); 362 return 0; 363 } 364 365 /** compress domain names in rdata, return RETVAL_* */ 366 static int 367 compress_rdata(sldns_buffer* pkt, uint8_t* rdata, size_t todolen, 368 struct regional* region, struct compress_tree_node** tree, 369 const sldns_rr_descriptor* desc) 370 { 371 int labs, r, rdf = 0; 372 size_t dname_len, len, pos = sldns_buffer_position(pkt); 373 uint8_t count = desc->_dname_count; 374 375 sldns_buffer_skip(pkt, 2); /* rdata len fill in later */ 376 /* space for rdatalen checked for already */ 377 rdata += 2; 378 todolen -= 2; 379 while(todolen > 0 && count) { 380 switch(desc->_wireformat[rdf]) { 381 case LDNS_RDF_TYPE_DNAME: 382 labs = dname_count_size_labels(rdata, &dname_len); 383 if((r=compress_any_dname(rdata, pkt, labs, region, 384 tree)) != RETVAL_OK) 385 return r; 386 rdata += dname_len; 387 todolen -= dname_len; 388 count--; 389 len = 0; 390 break; 391 case LDNS_RDF_TYPE_STR: 392 len = *rdata + 1; 393 break; 394 default: 395 len = get_rdf_size(desc->_wireformat[rdf]); 396 } 397 if(len) { 398 /* copy over */ 399 if(sldns_buffer_remaining(pkt) < len) 400 return RETVAL_TRUNC; 401 sldns_buffer_write(pkt, rdata, len); 402 todolen -= len; 403 rdata += len; 404 } 405 rdf++; 406 } 407 /* copy remainder */ 408 if(todolen > 0) { 409 if(sldns_buffer_remaining(pkt) < todolen) 410 return RETVAL_TRUNC; 411 sldns_buffer_write(pkt, rdata, todolen); 412 } 413 414 /* set rdata len */ 415 sldns_buffer_write_u16_at(pkt, pos, sldns_buffer_position(pkt)-pos-2); 416 return RETVAL_OK; 417 } 418 419 /** Returns true if RR type should be included */ 420 static int 421 rrset_belongs_in_reply(sldns_pkt_section s, uint16_t rrtype, uint16_t qtype, 422 int dnssec) 423 { 424 if(dnssec) 425 return 1; 426 /* skip non DNSSEC types, except if directly queried for */ 427 if(s == LDNS_SECTION_ANSWER) { 428 if(qtype == LDNS_RR_TYPE_ANY || qtype == rrtype) 429 return 1; 430 } 431 /* check DNSSEC-ness */ 432 switch(rrtype) { 433 case LDNS_RR_TYPE_SIG: 434 case LDNS_RR_TYPE_KEY: 435 case LDNS_RR_TYPE_NXT: 436 case LDNS_RR_TYPE_DS: 437 case LDNS_RR_TYPE_RRSIG: 438 case LDNS_RR_TYPE_NSEC: 439 case LDNS_RR_TYPE_DNSKEY: 440 case LDNS_RR_TYPE_NSEC3: 441 case LDNS_RR_TYPE_NSEC3PARAMS: 442 return 0; 443 } 444 return 1; 445 } 446 447 /** store rrset in buffer in wireformat, return RETVAL_* */ 448 static int 449 packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt, 450 uint16_t* num_rrs, time_t timenow, struct regional* region, 451 int do_data, int do_sig, struct compress_tree_node** tree, 452 sldns_pkt_section s, uint16_t qtype, int dnssec, size_t rr_offset) 453 { 454 size_t i, j, owner_pos; 455 int r, owner_labs; 456 uint16_t owner_ptr = 0; 457 time_t adjust = 0; 458 struct packed_rrset_data* data = (struct packed_rrset_data*) 459 key->entry.data; 460 461 /* does this RR type belong in the answer? */ 462 if(!rrset_belongs_in_reply(s, ntohs(key->rk.type), qtype, dnssec)) 463 return RETVAL_OK; 464 465 owner_labs = dname_count_labels(key->rk.dname); 466 owner_pos = sldns_buffer_position(pkt); 467 468 /** Determine relative time adjustment for TTL values. 469 * For an rrset with a fixed TTL, use the rrset's TTL as given. */ 470 if((key->rk.flags & PACKED_RRSET_FIXEDTTL) != 0) 471 adjust = 0; 472 else 473 adjust = SERVE_ORIGINAL_TTL ? data->ttl_add : timenow; 474 475 if(do_data) { 476 const sldns_rr_descriptor* c = type_rdata_compressable(key); 477 for(i=0; i<data->count; i++) { 478 /* rrset roundrobin */ 479 j = (i + rr_offset) % data->count; 480 if((r=compress_owner(key, pkt, region, tree, 481 owner_pos, &owner_ptr, owner_labs)) 482 != RETVAL_OK) 483 return r; 484 sldns_buffer_write(pkt, &key->rk.type, 2); 485 sldns_buffer_write(pkt, &key->rk.rrset_class, 2); 486 if(data->rr_ttl[j] < adjust) 487 sldns_buffer_write_u32(pkt, 488 SERVE_EXPIRED?SERVE_EXPIRED_REPLY_TTL:0); 489 else sldns_buffer_write_u32(pkt, data->rr_ttl[j]-adjust); 490 if(c) { 491 if((r=compress_rdata(pkt, data->rr_data[j], 492 data->rr_len[j], region, tree, c)) 493 != RETVAL_OK) 494 return r; 495 } else { 496 if(sldns_buffer_remaining(pkt) < data->rr_len[j]) 497 return RETVAL_TRUNC; 498 sldns_buffer_write(pkt, data->rr_data[j], 499 data->rr_len[j]); 500 } 501 } 502 } 503 /* insert rrsigs */ 504 if(do_sig && dnssec) { 505 size_t total = data->count+data->rrsig_count; 506 for(i=data->count; i<total; i++) { 507 if(owner_ptr && owner_labs != 1) { 508 if(sldns_buffer_remaining(pkt) < 509 2+4+4+data->rr_len[i]) 510 return RETVAL_TRUNC; 511 sldns_buffer_write(pkt, &owner_ptr, 2); 512 } else { 513 if((r=compress_any_dname(key->rk.dname, 514 pkt, owner_labs, region, tree)) 515 != RETVAL_OK) 516 return r; 517 if(sldns_buffer_remaining(pkt) < 518 4+4+data->rr_len[i]) 519 return RETVAL_TRUNC; 520 } 521 sldns_buffer_write_u16(pkt, LDNS_RR_TYPE_RRSIG); 522 sldns_buffer_write(pkt, &key->rk.rrset_class, 2); 523 if(data->rr_ttl[i] < adjust) 524 sldns_buffer_write_u32(pkt, 525 SERVE_EXPIRED?SERVE_EXPIRED_REPLY_TTL:0); 526 else sldns_buffer_write_u32(pkt, data->rr_ttl[i]-adjust); 527 /* rrsig rdata cannot be compressed, perform 100+ byte 528 * memcopy. */ 529 sldns_buffer_write(pkt, data->rr_data[i], 530 data->rr_len[i]); 531 } 532 } 533 /* change rrnum only after we are sure it fits */ 534 if(do_data) 535 *num_rrs += data->count; 536 if(do_sig && dnssec) 537 *num_rrs += data->rrsig_count; 538 539 return RETVAL_OK; 540 } 541 542 /** store msg section in wireformat buffer, return RETVAL_* */ 543 static int 544 insert_section(struct reply_info* rep, size_t num_rrsets, uint16_t* num_rrs, 545 sldns_buffer* pkt, size_t rrsets_before, time_t timenow, 546 struct regional* region, struct compress_tree_node** tree, 547 sldns_pkt_section s, uint16_t qtype, int dnssec, size_t rr_offset) 548 { 549 int r; 550 size_t i, setstart; 551 /* we now allow this function to be called multiple times for the 552 * same section, incrementally updating num_rrs. The caller is 553 * responsible for initializing it (which is the case in the current 554 * implementation). */ 555 556 if(s != LDNS_SECTION_ADDITIONAL) { 557 if(s == LDNS_SECTION_ANSWER && qtype == LDNS_RR_TYPE_ANY) 558 dnssec = 1; /* include all types in ANY answer */ 559 for(i=0; i<num_rrsets; i++) { 560 setstart = sldns_buffer_position(pkt); 561 if((r=packed_rrset_encode(rep->rrsets[rrsets_before+i], 562 pkt, num_rrs, timenow, region, 1, 1, tree, 563 s, qtype, dnssec, rr_offset)) 564 != RETVAL_OK) { 565 /* Bad, but if due to size must set TC bit */ 566 /* trim off the rrset neatly. */ 567 sldns_buffer_set_position(pkt, setstart); 568 return r; 569 } 570 } 571 } else { 572 for(i=0; i<num_rrsets; i++) { 573 setstart = sldns_buffer_position(pkt); 574 if((r=packed_rrset_encode(rep->rrsets[rrsets_before+i], 575 pkt, num_rrs, timenow, region, 1, 0, tree, 576 s, qtype, dnssec, rr_offset)) 577 != RETVAL_OK) { 578 sldns_buffer_set_position(pkt, setstart); 579 return r; 580 } 581 } 582 if(dnssec) 583 for(i=0; i<num_rrsets; i++) { 584 setstart = sldns_buffer_position(pkt); 585 if((r=packed_rrset_encode(rep->rrsets[rrsets_before+i], 586 pkt, num_rrs, timenow, region, 0, 1, tree, 587 s, qtype, dnssec, rr_offset)) 588 != RETVAL_OK) { 589 sldns_buffer_set_position(pkt, setstart); 590 return r; 591 } 592 } 593 } 594 return RETVAL_OK; 595 } 596 597 /** store query section in wireformat buffer, return RETVAL */ 598 static int 599 insert_query(struct query_info* qinfo, struct compress_tree_node** tree, 600 sldns_buffer* buffer, struct regional* region) 601 { 602 uint8_t* qname = qinfo->local_alias ? 603 qinfo->local_alias->rrset->rk.dname : qinfo->qname; 604 size_t qname_len = qinfo->local_alias ? 605 qinfo->local_alias->rrset->rk.dname_len : qinfo->qname_len; 606 if(sldns_buffer_remaining(buffer) < 607 qinfo->qname_len+sizeof(uint16_t)*2) 608 return RETVAL_TRUNC; /* buffer too small */ 609 /* the query is the first name inserted into the tree */ 610 if(!compress_tree_store(qname, dname_count_labels(qname), 611 sldns_buffer_position(buffer), region, NULL, tree)) 612 return RETVAL_OUTMEM; 613 if(sldns_buffer_current(buffer) == qname) 614 sldns_buffer_skip(buffer, (ssize_t)qname_len); 615 else sldns_buffer_write(buffer, qname, qname_len); 616 sldns_buffer_write_u16(buffer, qinfo->qtype); 617 sldns_buffer_write_u16(buffer, qinfo->qclass); 618 return RETVAL_OK; 619 } 620 621 static int 622 positive_answer(struct reply_info* rep, uint16_t qtype) { 623 size_t i; 624 if (FLAGS_GET_RCODE(rep->flags) != LDNS_RCODE_NOERROR) 625 return 0; 626 627 for(i=0;i<rep->an_numrrsets; i++) { 628 if(ntohs(rep->rrsets[i]->rk.type) == qtype) { 629 /* for priming queries, type NS, include addresses */ 630 if(qtype == LDNS_RR_TYPE_NS) 631 return 0; 632 /* in case it is a wildcard with DNSSEC, there will 633 * be NSEC/NSEC3 records in the authority section 634 * that we cannot remove */ 635 for(i=rep->an_numrrsets; i<rep->an_numrrsets+ 636 rep->ns_numrrsets; i++) { 637 if(ntohs(rep->rrsets[i]->rk.type) == 638 LDNS_RR_TYPE_NSEC || 639 ntohs(rep->rrsets[i]->rk.type) == 640 LDNS_RR_TYPE_NSEC3) 641 return 0; 642 } 643 return 1; 644 } 645 } 646 return 0; 647 } 648 649 static int 650 negative_answer(struct reply_info* rep) { 651 size_t i; 652 int ns_seen = 0; 653 if(FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NXDOMAIN) 654 return 1; 655 if(FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR && 656 rep->an_numrrsets != 0) 657 return 0; /* positive */ 658 if(FLAGS_GET_RCODE(rep->flags) != LDNS_RCODE_NOERROR && 659 FLAGS_GET_RCODE(rep->flags) != LDNS_RCODE_NXDOMAIN) 660 return 0; 661 for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++){ 662 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_SOA) 663 return 1; 664 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS) 665 ns_seen = 1; 666 } 667 if(ns_seen) return 0; /* could be referral, NS, but no SOA */ 668 return 1; 669 } 670 671 int 672 reply_info_encode(struct query_info* qinfo, struct reply_info* rep, 673 uint16_t id, uint16_t flags, sldns_buffer* buffer, time_t timenow, 674 struct regional* region, uint16_t udpsize, int dnssec, int minimise) 675 { 676 uint16_t ancount=0, nscount=0, arcount=0; 677 struct compress_tree_node* tree = 0; 678 int r; 679 size_t rr_offset; 680 681 sldns_buffer_clear(buffer); 682 if(udpsize < sldns_buffer_limit(buffer)) 683 sldns_buffer_set_limit(buffer, udpsize); 684 if(sldns_buffer_remaining(buffer) < LDNS_HEADER_SIZE) 685 return 0; 686 687 sldns_buffer_write(buffer, &id, sizeof(uint16_t)); 688 sldns_buffer_write_u16(buffer, flags); 689 sldns_buffer_write_u16(buffer, rep->qdcount); 690 /* set an, ns, ar counts to zero in case of small packets */ 691 sldns_buffer_write(buffer, "\000\000\000\000\000\000", 6); 692 693 /* insert query section */ 694 if(rep->qdcount) { 695 if((r=insert_query(qinfo, &tree, buffer, region)) != 696 RETVAL_OK) { 697 if(r == RETVAL_TRUNC) { 698 /* create truncated message */ 699 sldns_buffer_write_u16_at(buffer, 4, 0); 700 LDNS_TC_SET(sldns_buffer_begin(buffer)); 701 sldns_buffer_flip(buffer); 702 return 1; 703 } 704 return 0; 705 } 706 } 707 /* roundrobin offset. using query id for random number. With ntohs 708 * for different roundrobins for sequential id client senders. */ 709 rr_offset = RRSET_ROUNDROBIN?ntohs(id)+(timenow?timenow:time(NULL)):0; 710 711 /* "prepend" any local alias records in the answer section if this 712 * response is supposed to be authoritative. Currently it should 713 * be a single CNAME record (sanity-checked in worker_handle_request()) 714 * but it can be extended if and when we support more variations of 715 * aliases. */ 716 if(qinfo->local_alias && (flags & BIT_AA)) { 717 struct reply_info arep; 718 time_t timezero = 0; /* to use the 'authoritative' TTL */ 719 memset(&arep, 0, sizeof(arep)); 720 arep.flags = rep->flags; 721 arep.an_numrrsets = 1; 722 arep.rrset_count = 1; 723 arep.rrsets = &qinfo->local_alias->rrset; 724 if((r=insert_section(&arep, 1, &ancount, buffer, 0, 725 timezero, region, &tree, LDNS_SECTION_ANSWER, 726 qinfo->qtype, dnssec, rr_offset)) != RETVAL_OK) { 727 if(r == RETVAL_TRUNC) { 728 /* create truncated message */ 729 sldns_buffer_write_u16_at(buffer, 6, ancount); 730 LDNS_TC_SET(sldns_buffer_begin(buffer)); 731 sldns_buffer_flip(buffer); 732 return 1; 733 } 734 return 0; 735 } 736 } 737 738 /* insert answer section */ 739 if((r=insert_section(rep, rep->an_numrrsets, &ancount, buffer, 740 0, timenow, region, &tree, LDNS_SECTION_ANSWER, qinfo->qtype, 741 dnssec, rr_offset)) != RETVAL_OK) { 742 if(r == RETVAL_TRUNC) { 743 /* create truncated message */ 744 sldns_buffer_write_u16_at(buffer, 6, ancount); 745 LDNS_TC_SET(sldns_buffer_begin(buffer)); 746 sldns_buffer_flip(buffer); 747 return 1; 748 } 749 return 0; 750 } 751 sldns_buffer_write_u16_at(buffer, 6, ancount); 752 753 /* if response is positive answer, auth/add sections are not required */ 754 if( ! (minimise && positive_answer(rep, qinfo->qtype)) ) { 755 /* insert auth section */ 756 if((r=insert_section(rep, rep->ns_numrrsets, &nscount, buffer, 757 rep->an_numrrsets, timenow, region, &tree, 758 LDNS_SECTION_AUTHORITY, qinfo->qtype, 759 dnssec, rr_offset)) != RETVAL_OK) { 760 if(r == RETVAL_TRUNC) { 761 /* create truncated message */ 762 sldns_buffer_write_u16_at(buffer, 8, nscount); 763 LDNS_TC_SET(sldns_buffer_begin(buffer)); 764 sldns_buffer_flip(buffer); 765 return 1; 766 } 767 return 0; 768 } 769 sldns_buffer_write_u16_at(buffer, 8, nscount); 770 771 if(! (minimise && negative_answer(rep))) { 772 /* insert add section */ 773 if((r=insert_section(rep, rep->ar_numrrsets, &arcount, buffer, 774 rep->an_numrrsets + rep->ns_numrrsets, timenow, region, 775 &tree, LDNS_SECTION_ADDITIONAL, qinfo->qtype, 776 dnssec, rr_offset)) != RETVAL_OK) { 777 if(r == RETVAL_TRUNC) { 778 /* no need to set TC bit, this is the additional */ 779 sldns_buffer_write_u16_at(buffer, 10, arcount); 780 sldns_buffer_flip(buffer); 781 return 1; 782 } 783 return 0; 784 } 785 sldns_buffer_write_u16_at(buffer, 10, arcount); 786 } 787 } 788 sldns_buffer_flip(buffer); 789 return 1; 790 } 791 792 uint16_t 793 calc_edns_field_size(struct edns_data* edns) 794 { 795 size_t rdatalen = 0; 796 struct edns_option* opt; 797 if(!edns || !edns->edns_present) 798 return 0; 799 for(opt = edns->opt_list_inplace_cb_out; opt; opt = opt->next) { 800 rdatalen += 4 + opt->opt_len; 801 } 802 for(opt = edns->opt_list_out; opt; opt = opt->next) { 803 rdatalen += 4 + opt->opt_len; 804 } 805 /* domain root '.' + type + class + ttl + rdatalen */ 806 return 1 + 2 + 2 + 4 + 2 + rdatalen; 807 } 808 809 static void 810 attach_edns_record_max_msg_sz(sldns_buffer* pkt, struct edns_data* edns, 811 uint16_t max_msg_sz) 812 { 813 size_t len; 814 size_t rdatapos; 815 struct edns_option* opt; 816 struct edns_option* padding_option = NULL; 817 /* inc additional count */ 818 sldns_buffer_write_u16_at(pkt, 10, 819 sldns_buffer_read_u16_at(pkt, 10) + 1); 820 len = sldns_buffer_limit(pkt); 821 sldns_buffer_clear(pkt); 822 sldns_buffer_set_position(pkt, len); 823 /* write EDNS record */ 824 sldns_buffer_write_u8(pkt, 0); /* '.' label */ 825 sldns_buffer_write_u16(pkt, LDNS_RR_TYPE_OPT); /* type */ 826 sldns_buffer_write_u16(pkt, edns->udp_size); /* class */ 827 sldns_buffer_write_u8(pkt, edns->ext_rcode); /* ttl */ 828 sldns_buffer_write_u8(pkt, edns->edns_version); 829 sldns_buffer_write_u16(pkt, edns->bits); 830 rdatapos = sldns_buffer_position(pkt); 831 sldns_buffer_write_u16(pkt, 0); /* rdatalen */ 832 /* write rdata */ 833 for(opt=edns->opt_list_inplace_cb_out; opt; opt=opt->next) { 834 if (opt->opt_code == LDNS_EDNS_PADDING) { 835 padding_option = opt; 836 continue; 837 } 838 sldns_buffer_write_u16(pkt, opt->opt_code); 839 sldns_buffer_write_u16(pkt, opt->opt_len); 840 if(opt->opt_len != 0) 841 sldns_buffer_write(pkt, opt->opt_data, opt->opt_len); 842 } 843 for(opt=edns->opt_list_out; opt; opt=opt->next) { 844 if (opt->opt_code == LDNS_EDNS_PADDING) { 845 padding_option = opt; 846 continue; 847 } 848 sldns_buffer_write_u16(pkt, opt->opt_code); 849 sldns_buffer_write_u16(pkt, opt->opt_len); 850 if(opt->opt_len != 0) 851 sldns_buffer_write(pkt, opt->opt_data, opt->opt_len); 852 } 853 if (padding_option && edns->padding_block_size ) { 854 size_t pad_pos = sldns_buffer_position(pkt); 855 size_t msg_sz = ((pad_pos + 3) / edns->padding_block_size + 1) 856 * edns->padding_block_size; 857 size_t pad_sz; 858 859 if (msg_sz > max_msg_sz) 860 msg_sz = max_msg_sz; 861 862 /* By use of calc_edns_field_size, calling functions should 863 * have made sure that there is enough space for at least a 864 * zero sized padding option. 865 */ 866 log_assert(pad_pos + 4 <= msg_sz); 867 868 pad_sz = msg_sz - pad_pos - 4; 869 sldns_buffer_write_u16(pkt, LDNS_EDNS_PADDING); 870 sldns_buffer_write_u16(pkt, pad_sz); 871 if (pad_sz) { 872 memset(sldns_buffer_current(pkt), 0, pad_sz); 873 sldns_buffer_skip(pkt, pad_sz); 874 } 875 } 876 sldns_buffer_write_u16_at(pkt, rdatapos, 877 sldns_buffer_position(pkt)-rdatapos-2); 878 sldns_buffer_flip(pkt); 879 } 880 881 void 882 attach_edns_record(sldns_buffer* pkt, struct edns_data* edns) 883 { 884 if(!edns || !edns->edns_present) 885 return; 886 attach_edns_record_max_msg_sz(pkt, edns, edns->udp_size); 887 } 888 889 int 890 reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep, 891 uint16_t id, uint16_t qflags, sldns_buffer* pkt, time_t timenow, 892 int cached, struct regional* region, uint16_t udpsize, 893 struct edns_data* edns, int dnssec, int secure) 894 { 895 uint16_t flags; 896 unsigned int attach_edns = 0; 897 898 if(!cached || rep->authoritative) { 899 /* original flags, copy RD and CD bits from query. */ 900 flags = rep->flags | (qflags & (BIT_RD|BIT_CD)); 901 } else { 902 /* remove AA bit, copy RD and CD bits from query. */ 903 flags = (rep->flags & ~BIT_AA) | (qflags & (BIT_RD|BIT_CD)); 904 } 905 if(secure && (dnssec || (qflags&BIT_AD))) 906 flags |= BIT_AD; 907 /* restore AA bit if we have a local alias and the response can be 908 * authoritative. Also clear AD bit if set as the local data is the 909 * primary answer. */ 910 if(qinf->local_alias && 911 (FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR || 912 FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NXDOMAIN)) { 913 flags |= BIT_AA; 914 flags &= ~BIT_AD; 915 } 916 log_assert(flags & BIT_QR); /* QR bit must be on in our replies */ 917 if(udpsize < LDNS_HEADER_SIZE) 918 return 0; 919 if(sldns_buffer_capacity(pkt) < udpsize) 920 udpsize = sldns_buffer_capacity(pkt); 921 if(udpsize < LDNS_HEADER_SIZE + calc_edns_field_size(edns)) { 922 /* packet too small to contain edns, omit it. */ 923 attach_edns = 0; 924 } else { 925 /* reserve space for edns record */ 926 attach_edns = (unsigned int)calc_edns_field_size(edns); 927 udpsize -= attach_edns; 928 } 929 930 if(!reply_info_encode(qinf, rep, id, flags, pkt, timenow, region, 931 udpsize, dnssec, MINIMAL_RESPONSES)) { 932 log_err("reply encode: out of memory"); 933 return 0; 934 } 935 if(attach_edns && sldns_buffer_capacity(pkt) >= 936 sldns_buffer_limit(pkt)+attach_edns) 937 attach_edns_record_max_msg_sz(pkt, edns, udpsize+attach_edns); 938 return 1; 939 } 940 941 void 942 qinfo_query_encode(sldns_buffer* pkt, struct query_info* qinfo) 943 { 944 uint16_t flags = 0; /* QUERY, NOERROR */ 945 const uint8_t* qname = qinfo->local_alias ? 946 qinfo->local_alias->rrset->rk.dname : qinfo->qname; 947 size_t qname_len = qinfo->local_alias ? 948 qinfo->local_alias->rrset->rk.dname_len : qinfo->qname_len; 949 sldns_buffer_clear(pkt); 950 log_assert(sldns_buffer_remaining(pkt) >= 12+255+4/*max query*/); 951 sldns_buffer_skip(pkt, 2); /* id done later */ 952 sldns_buffer_write_u16(pkt, flags); 953 sldns_buffer_write_u16(pkt, 1); /* query count */ 954 sldns_buffer_write(pkt, "\000\000\000\000\000\000", 6); /* counts */ 955 sldns_buffer_write(pkt, qname, qname_len); 956 sldns_buffer_write_u16(pkt, qinfo->qtype); 957 sldns_buffer_write_u16(pkt, qinfo->qclass); 958 sldns_buffer_flip(pkt); 959 } 960 961 void 962 error_encode(sldns_buffer* buf, int r, struct query_info* qinfo, 963 uint16_t qid, uint16_t qflags, struct edns_data* edns) 964 { 965 uint16_t flags; 966 967 sldns_buffer_clear(buf); 968 sldns_buffer_write(buf, &qid, sizeof(uint16_t)); 969 flags = (uint16_t)(BIT_QR | BIT_RA | r); /* QR and retcode*/ 970 flags |= (qflags & (BIT_RD|BIT_CD)); /* copy RD and CD bit */ 971 sldns_buffer_write_u16(buf, flags); 972 if(qinfo) flags = 1; 973 else flags = 0; 974 sldns_buffer_write_u16(buf, flags); 975 flags = 0; 976 sldns_buffer_write(buf, &flags, sizeof(uint16_t)); 977 sldns_buffer_write(buf, &flags, sizeof(uint16_t)); 978 sldns_buffer_write(buf, &flags, sizeof(uint16_t)); 979 if(qinfo) { 980 const uint8_t* qname = qinfo->local_alias ? 981 qinfo->local_alias->rrset->rk.dname : qinfo->qname; 982 size_t qname_len = qinfo->local_alias ? 983 qinfo->local_alias->rrset->rk.dname_len : 984 qinfo->qname_len; 985 if(sldns_buffer_current(buf) == qname) 986 sldns_buffer_skip(buf, (ssize_t)qname_len); 987 else sldns_buffer_write(buf, qname, qname_len); 988 sldns_buffer_write_u16(buf, qinfo->qtype); 989 sldns_buffer_write_u16(buf, qinfo->qclass); 990 } 991 sldns_buffer_flip(buf); 992 if(edns) { 993 struct edns_data es = *edns; 994 es.edns_version = EDNS_ADVERTISED_VERSION; 995 es.udp_size = EDNS_ADVERTISED_SIZE; 996 es.ext_rcode = 0; 997 es.bits &= EDNS_DO; 998 if(sldns_buffer_limit(buf) + calc_edns_field_size(&es) > 999 edns->udp_size) 1000 return; 1001 attach_edns_record(buf, &es); 1002 } 1003 } 1004