1 /* 2 * util/data/msgparse.c - parse wireformat DNS messages. 3 * 4 * Copyright (c) 2007, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 /** 36 * \file 37 * Routines for message parsing a packet buffer to a descriptive structure. 38 */ 39 #include "config.h" 40 #include "util/data/msgparse.h" 41 #include "util/data/msgreply.h" 42 #include "util/data/dname.h" 43 #include "util/data/packed_rrset.h" 44 #include "util/storage/lookup3.h" 45 #include "util/regional.h" 46 #include "sldns/rrdef.h" 47 #include "sldns/sbuffer.h" 48 #include "sldns/parseutil.h" 49 #include "sldns/wire2str.h" 50 51 /** smart comparison of (compressed, valid) dnames from packet */ 52 static int 53 smart_compare(sldns_buffer* pkt, uint8_t* dnow, 54 uint8_t* dprfirst, uint8_t* dprlast) 55 { 56 if(LABEL_IS_PTR(*dnow)) { 57 /* ptr points to a previous dname */ 58 uint8_t* p = sldns_buffer_at(pkt, PTR_OFFSET(dnow[0], dnow[1])); 59 if( p == dprfirst || p == dprlast ) 60 return 0; 61 /* prev dname is also a ptr, both ptrs are the same. */ 62 if(LABEL_IS_PTR(*dprlast) && 63 dprlast[0] == dnow[0] && dprlast[1] == dnow[1]) 64 return 0; 65 } 66 return dname_pkt_compare(pkt, dnow, dprlast); 67 } 68 69 /** 70 * Allocate new rrset in region, fill with data. 71 */ 72 static struct rrset_parse* 73 new_rrset(struct msg_parse* msg, uint8_t* dname, size_t dnamelen, 74 uint16_t type, uint16_t dclass, hashvalue_t hash, 75 uint32_t rrset_flags, sldns_pkt_section section, 76 struct regional* region) 77 { 78 struct rrset_parse* p = regional_alloc(region, sizeof(*p)); 79 if(!p) return NULL; 80 p->rrset_bucket_next = msg->hashtable[hash & (PARSE_TABLE_SIZE-1)]; 81 msg->hashtable[hash & (PARSE_TABLE_SIZE-1)] = p; 82 p->rrset_all_next = 0; 83 if(msg->rrset_last) 84 msg->rrset_last->rrset_all_next = p; 85 else msg->rrset_first = p; 86 msg->rrset_last = p; 87 p->hash = hash; 88 p->section = section; 89 p->dname = dname; 90 p->dname_len = dnamelen; 91 p->type = type; 92 p->rrset_class = dclass; 93 p->flags = rrset_flags; 94 p->rr_count = 0; 95 p->size = 0; 96 p->rr_first = 0; 97 p->rr_last = 0; 98 p->rrsig_count = 0; 99 p->rrsig_first = 0; 100 p->rrsig_last = 0; 101 return p; 102 } 103 104 /** See if next rrset is nsec at zone apex */ 105 static int 106 nsec_at_apex(sldns_buffer* pkt) 107 { 108 /* we are at ttl position in packet. */ 109 size_t pos = sldns_buffer_position(pkt); 110 uint16_t rdatalen; 111 if(sldns_buffer_remaining(pkt) < 7) /* ttl+len+root */ 112 return 0; /* eek! */ 113 sldns_buffer_skip(pkt, 4); /* ttl */; 114 rdatalen = sldns_buffer_read_u16(pkt); 115 if(sldns_buffer_remaining(pkt) < rdatalen) { 116 sldns_buffer_set_position(pkt, pos); 117 return 0; /* parse error happens later */ 118 } 119 /* must validate the nsec next domain name format */ 120 if(pkt_dname_len(pkt) == 0) { 121 sldns_buffer_set_position(pkt, pos); 122 return 0; /* parse error */ 123 } 124 125 /* see if SOA bit is set. */ 126 if(sldns_buffer_position(pkt) < pos+4+rdatalen) { 127 /* nsec type bitmap contains items */ 128 uint8_t win, blen, bits; 129 /* need: windownum, bitmap len, firstbyte */ 130 if(sldns_buffer_position(pkt)+3 > pos+4+rdatalen) { 131 sldns_buffer_set_position(pkt, pos); 132 return 0; /* malformed nsec */ 133 } 134 win = sldns_buffer_read_u8(pkt); 135 blen = sldns_buffer_read_u8(pkt); 136 bits = sldns_buffer_read_u8(pkt); 137 /* 0window always first window. bitlen >=1 or parse 138 error really. bit 0x2 is SOA. */ 139 if(win == 0 && blen >= 1 && (bits & 0x02)) { 140 sldns_buffer_set_position(pkt, pos); 141 return 1; 142 } 143 } 144 145 sldns_buffer_set_position(pkt, pos); 146 return 0; 147 } 148 149 /** Calculate rrset flags */ 150 static uint32_t 151 pkt_rrset_flags(sldns_buffer* pkt, uint16_t type, sldns_pkt_section sec) 152 { 153 uint32_t f = 0; 154 if(type == LDNS_RR_TYPE_NSEC && nsec_at_apex(pkt)) { 155 f |= PACKED_RRSET_NSEC_AT_APEX; 156 } else if(type == LDNS_RR_TYPE_SOA && sec == LDNS_SECTION_AUTHORITY) { 157 f |= PACKED_RRSET_SOA_NEG; 158 } 159 return f; 160 } 161 162 hashvalue_t 163 pkt_hash_rrset(sldns_buffer* pkt, uint8_t* dname, uint16_t type, 164 uint16_t dclass, uint32_t rrset_flags) 165 { 166 /* note this MUST be identical to rrset_key_hash in packed_rrset.c */ 167 /* this routine handles compressed names */ 168 hashvalue_t h = 0xab; 169 h = dname_pkt_hash(pkt, dname, h); 170 h = hashlittle(&type, sizeof(type), h); /* host order */ 171 h = hashlittle(&dclass, sizeof(dclass), h); /* netw order */ 172 h = hashlittle(&rrset_flags, sizeof(uint32_t), h); 173 return h; 174 } 175 176 /** create partial dname hash for rrset hash */ 177 static hashvalue_t 178 pkt_hash_rrset_first(sldns_buffer* pkt, uint8_t* dname) 179 { 180 /* works together with pkt_hash_rrset_rest */ 181 /* note this MUST be identical to rrset_key_hash in packed_rrset.c */ 182 /* this routine handles compressed names */ 183 hashvalue_t h = 0xab; 184 h = dname_pkt_hash(pkt, dname, h); 185 return h; 186 } 187 188 /** create a rrset hash from a partial dname hash */ 189 static hashvalue_t 190 pkt_hash_rrset_rest(hashvalue_t dname_h, uint16_t type, uint16_t dclass, 191 uint32_t rrset_flags) 192 { 193 /* works together with pkt_hash_rrset_first */ 194 /* note this MUST be identical to rrset_key_hash in packed_rrset.c */ 195 hashvalue_t h; 196 h = hashlittle(&type, sizeof(type), dname_h); /* host order */ 197 h = hashlittle(&dclass, sizeof(dclass), h); /* netw order */ 198 h = hashlittle(&rrset_flags, sizeof(uint32_t), h); 199 return h; 200 } 201 202 /** compare rrset_parse with data */ 203 static int 204 rrset_parse_equals(struct rrset_parse* p, sldns_buffer* pkt, hashvalue_t h, 205 uint32_t rrset_flags, uint8_t* dname, size_t dnamelen, 206 uint16_t type, uint16_t dclass) 207 { 208 if(p->hash == h && p->dname_len == dnamelen && p->type == type && 209 p->rrset_class == dclass && p->flags == rrset_flags && 210 dname_pkt_compare(pkt, dname, p->dname) == 0) 211 return 1; 212 return 0; 213 } 214 215 216 struct rrset_parse* 217 msgparse_hashtable_lookup(struct msg_parse* msg, sldns_buffer* pkt, 218 hashvalue_t h, uint32_t rrset_flags, uint8_t* dname, size_t dnamelen, 219 uint16_t type, uint16_t dclass) 220 { 221 struct rrset_parse* p = msg->hashtable[h & (PARSE_TABLE_SIZE-1)]; 222 while(p) { 223 if(rrset_parse_equals(p, pkt, h, rrset_flags, dname, dnamelen, 224 type, dclass)) 225 return p; 226 p = p->rrset_bucket_next; 227 } 228 return NULL; 229 } 230 231 /** return type networkformat that rrsig in packet covers */ 232 static int 233 pkt_rrsig_covered(sldns_buffer* pkt, uint8_t* here, uint16_t* type) 234 { 235 size_t pos = sldns_buffer_position(pkt); 236 sldns_buffer_set_position(pkt, (size_t)(here-sldns_buffer_begin(pkt))); 237 /* ttl + len + size of small rrsig(rootlabel, no signature) */ 238 if(sldns_buffer_remaining(pkt) < 4+2+19) 239 return 0; 240 sldns_buffer_skip(pkt, 4); /* ttl */ 241 if(sldns_buffer_read_u16(pkt) < 19) /* too short */ { 242 sldns_buffer_set_position(pkt, pos); 243 return 0; 244 } 245 *type = sldns_buffer_read_u16(pkt); 246 sldns_buffer_set_position(pkt, pos); 247 return 1; 248 } 249 250 /** true if covered type equals prevtype */ 251 static int 252 pkt_rrsig_covered_equals(sldns_buffer* pkt, uint8_t* here, uint16_t type) 253 { 254 uint16_t t; 255 if(pkt_rrsig_covered(pkt, here, &t) && t == type) 256 return 1; 257 return 0; 258 } 259 260 void 261 msgparse_bucket_remove(struct msg_parse* msg, struct rrset_parse* rrset) 262 { 263 struct rrset_parse** p; 264 p = &msg->hashtable[ rrset->hash & (PARSE_TABLE_SIZE-1) ]; 265 while(*p) { 266 if(*p == rrset) { 267 *p = rrset->rrset_bucket_next; 268 return; 269 } 270 p = &( (*p)->rrset_bucket_next ); 271 } 272 } 273 274 /** change section of rrset from previous to current section */ 275 static void 276 change_section(struct msg_parse* msg, struct rrset_parse* rrset, 277 sldns_pkt_section section) 278 { 279 struct rrset_parse *p, *prev; 280 /* remove from list */ 281 if(section == rrset->section) 282 return; 283 p = msg->rrset_first; 284 prev = 0; 285 while(p) { 286 if(p == rrset) { 287 if(prev) prev->rrset_all_next = p->rrset_all_next; 288 else msg->rrset_first = p->rrset_all_next; 289 if(msg->rrset_last == rrset) 290 msg->rrset_last = prev; 291 break; 292 } 293 prev = p; 294 p = p->rrset_all_next; 295 } 296 /* remove from count */ 297 switch(rrset->section) { 298 case LDNS_SECTION_ANSWER: msg->an_rrsets--; break; 299 case LDNS_SECTION_AUTHORITY: msg->ns_rrsets--; break; 300 case LDNS_SECTION_ADDITIONAL: msg->ar_rrsets--; break; 301 default: log_assert(0); 302 } 303 /* insert at end of list */ 304 rrset->rrset_all_next = 0; 305 if(msg->rrset_last) 306 msg->rrset_last->rrset_all_next = rrset; 307 else msg->rrset_first = rrset; 308 msg->rrset_last = rrset; 309 /* up count of new section */ 310 switch(section) { 311 case LDNS_SECTION_AUTHORITY: msg->ns_rrsets++; break; 312 case LDNS_SECTION_ADDITIONAL: msg->ar_rrsets++; break; 313 default: log_assert(0); 314 } 315 rrset->section = section; 316 } 317 318 /** see if rrset of type RRSIG contains sig over given type */ 319 static int 320 rrset_has_sigover(sldns_buffer* pkt, struct rrset_parse* rrset, uint16_t type, 321 int* hasother) 322 { 323 int res = 0; 324 struct rr_parse* rr = rrset->rr_first; 325 log_assert( rrset->type == LDNS_RR_TYPE_RRSIG ); 326 while(rr) { 327 if(pkt_rrsig_covered_equals(pkt, rr->ttl_data, type)) 328 res = 1; 329 else *hasother = 1; 330 rr = rr->next; 331 } 332 return res; 333 } 334 335 /** move rrsigs from sigset to dataset */ 336 static int 337 moveover_rrsigs(sldns_buffer* pkt, struct regional* region, 338 struct rrset_parse* sigset, struct rrset_parse* dataset, int duplicate) 339 { 340 struct rr_parse* sig = sigset->rr_first; 341 struct rr_parse* prev = NULL; 342 struct rr_parse* insert; 343 struct rr_parse* nextsig; 344 while(sig) { 345 nextsig = sig->next; 346 if(pkt_rrsig_covered_equals(pkt, sig->ttl_data, 347 dataset->type)) { 348 if(duplicate) { 349 /* new */ 350 insert = (struct rr_parse*)regional_alloc( 351 region, sizeof(struct rr_parse)); 352 if(!insert) return 0; 353 insert->outside_packet = 0; 354 insert->ttl_data = sig->ttl_data; 355 insert->size = sig->size; 356 /* prev not used */ 357 } else { 358 /* remove from sigset */ 359 if(prev) prev->next = sig->next; 360 else sigset->rr_first = sig->next; 361 if(sigset->rr_last == sig) 362 sigset->rr_last = prev; 363 sigset->rr_count--; 364 sigset->size -= sig->size; 365 insert = sig; 366 /* prev not changed */ 367 } 368 /* add to dataset */ 369 dataset->rrsig_count++; 370 insert->next = 0; 371 if(dataset->rrsig_last) 372 dataset->rrsig_last->next = insert; 373 else dataset->rrsig_first = insert; 374 dataset->rrsig_last = insert; 375 dataset->size += insert->size; 376 } else { 377 prev = sig; 378 } 379 sig = nextsig; 380 } 381 return 1; 382 } 383 384 /** change an rrsig rrset for use as data rrset */ 385 static struct rrset_parse* 386 change_rrsig_rrset(struct rrset_parse* sigset, struct msg_parse* msg, 387 sldns_buffer* pkt, uint16_t datatype, uint32_t rrset_flags, 388 int hasother, sldns_pkt_section section, struct regional* region) 389 { 390 struct rrset_parse* dataset = sigset; 391 hashvalue_t hash = pkt_hash_rrset(pkt, sigset->dname, datatype, 392 sigset->rrset_class, rrset_flags); 393 log_assert( sigset->type == LDNS_RR_TYPE_RRSIG ); 394 log_assert( datatype != LDNS_RR_TYPE_RRSIG ); 395 if(hasother) { 396 /* need to make new rrset to hold data type */ 397 dataset = new_rrset(msg, sigset->dname, sigset->dname_len, 398 datatype, sigset->rrset_class, hash, rrset_flags, 399 section, region); 400 if(!dataset) 401 return NULL; 402 switch(section) { 403 case LDNS_SECTION_ANSWER: msg->an_rrsets++; break; 404 case LDNS_SECTION_AUTHORITY: msg->ns_rrsets++; break; 405 case LDNS_SECTION_ADDITIONAL: msg->ar_rrsets++; break; 406 default: log_assert(0); 407 } 408 if(!moveover_rrsigs(pkt, region, sigset, dataset, 409 msg->qtype == LDNS_RR_TYPE_RRSIG || 410 (msg->qtype == LDNS_RR_TYPE_ANY && 411 section != LDNS_SECTION_ANSWER) )) 412 return NULL; 413 return dataset; 414 } 415 /* changeover the type of the rrset to data set */ 416 msgparse_bucket_remove(msg, dataset); 417 /* insert into new hash bucket */ 418 dataset->rrset_bucket_next = msg->hashtable[hash&(PARSE_TABLE_SIZE-1)]; 419 msg->hashtable[hash&(PARSE_TABLE_SIZE-1)] = dataset; 420 dataset->hash = hash; 421 /* use section of data item for result */ 422 change_section(msg, dataset, section); 423 dataset->type = datatype; 424 dataset->flags = rrset_flags; 425 dataset->rrsig_count += dataset->rr_count; 426 dataset->rr_count = 0; 427 /* move sigs to end of siglist */ 428 if(dataset->rrsig_last) 429 dataset->rrsig_last->next = dataset->rr_first; 430 else dataset->rrsig_first = dataset->rr_first; 431 dataset->rrsig_last = dataset->rr_last; 432 dataset->rr_first = 0; 433 dataset->rr_last = 0; 434 return dataset; 435 } 436 437 /** Find rrset. If equal to previous it is fast. hash if not so. 438 * @param msg: the message with hash table. 439 * @param pkt: the packet in wireformat (needed for compression ptrs). 440 * @param dname: pointer to start of dname (compressed) in packet. 441 * @param dnamelen: uncompressed wirefmt length of dname. 442 * @param type: type of current rr. 443 * @param dclass: class of current rr. 444 * @param hash: hash value is returned if the rrset could not be found. 445 * @param rrset_flags: is returned if the rrset could not be found. 446 * @param prev_dname_first: dname of last seen RR. First seen dname. 447 * @param prev_dname_last: dname of last seen RR. Last seen dname. 448 * @param prev_dnamelen: dname len of last seen RR. 449 * @param prev_type: type of last seen RR. 450 * @param prev_dclass: class of last seen RR. 451 * @param rrset_prev: last seen RRset. 452 * @param section: the current section in the packet. 453 * @param region: used to allocate temporary parsing data. 454 * @return 0 on out of memory. 455 */ 456 static int 457 find_rrset(struct msg_parse* msg, sldns_buffer* pkt, uint8_t* dname, 458 size_t dnamelen, uint16_t type, uint16_t dclass, hashvalue_t* hash, 459 uint32_t* rrset_flags, 460 uint8_t** prev_dname_first, uint8_t** prev_dname_last, 461 size_t* prev_dnamelen, uint16_t* prev_type, 462 uint16_t* prev_dclass, struct rrset_parse** rrset_prev, 463 sldns_pkt_section section, struct regional* region) 464 { 465 hashvalue_t dname_h = pkt_hash_rrset_first(pkt, dname); 466 uint16_t covtype; 467 if(*rrset_prev) { 468 /* check if equal to previous item */ 469 if(type == *prev_type && dclass == *prev_dclass && 470 dnamelen == *prev_dnamelen && 471 smart_compare(pkt, dname, *prev_dname_first, 472 *prev_dname_last) == 0 && 473 type != LDNS_RR_TYPE_RRSIG) { 474 /* same as previous */ 475 *prev_dname_last = dname; 476 return 1; 477 } 478 /* check if rrsig over previous item */ 479 if(type == LDNS_RR_TYPE_RRSIG && dclass == *prev_dclass && 480 pkt_rrsig_covered_equals(pkt, sldns_buffer_current(pkt), 481 *prev_type) && 482 smart_compare(pkt, dname, *prev_dname_first, 483 *prev_dname_last) == 0) { 484 /* covers previous */ 485 *prev_dname_last = dname; 486 return 1; 487 } 488 } 489 /* find by hashing and lookup in hashtable */ 490 *rrset_flags = pkt_rrset_flags(pkt, type, section); 491 492 /* if rrsig - try to lookup matching data set first */ 493 if(type == LDNS_RR_TYPE_RRSIG && pkt_rrsig_covered(pkt, 494 sldns_buffer_current(pkt), &covtype)) { 495 *hash = pkt_hash_rrset_rest(dname_h, covtype, dclass, 496 *rrset_flags); 497 *rrset_prev = msgparse_hashtable_lookup(msg, pkt, *hash, 498 *rrset_flags, dname, dnamelen, covtype, dclass); 499 if(!*rrset_prev && covtype == LDNS_RR_TYPE_NSEC) { 500 /* if NSEC try with NSEC apex bit twiddled */ 501 *rrset_flags ^= PACKED_RRSET_NSEC_AT_APEX; 502 *hash = pkt_hash_rrset_rest(dname_h, covtype, dclass, 503 *rrset_flags); 504 *rrset_prev = msgparse_hashtable_lookup(msg, pkt, 505 *hash, *rrset_flags, dname, dnamelen, covtype, 506 dclass); 507 if(!*rrset_prev) /* untwiddle if not found */ 508 *rrset_flags ^= PACKED_RRSET_NSEC_AT_APEX; 509 } 510 if(!*rrset_prev && covtype == LDNS_RR_TYPE_SOA) { 511 /* if SOA try with SOA neg flag twiddled */ 512 *rrset_flags ^= PACKED_RRSET_SOA_NEG; 513 *hash = pkt_hash_rrset_rest(dname_h, covtype, dclass, 514 *rrset_flags); 515 *rrset_prev = msgparse_hashtable_lookup(msg, pkt, 516 *hash, *rrset_flags, dname, dnamelen, covtype, 517 dclass); 518 if(!*rrset_prev) /* untwiddle if not found */ 519 *rrset_flags ^= PACKED_RRSET_SOA_NEG; 520 } 521 if(*rrset_prev) { 522 *prev_dname_first = (*rrset_prev)->dname; 523 *prev_dname_last = dname; 524 *prev_dnamelen = dnamelen; 525 *prev_type = covtype; 526 *prev_dclass = dclass; 527 return 1; 528 } 529 } 530 if(type != LDNS_RR_TYPE_RRSIG) { 531 int hasother = 0; 532 /* find matching rrsig */ 533 *hash = pkt_hash_rrset_rest(dname_h, LDNS_RR_TYPE_RRSIG, 534 dclass, 0); 535 *rrset_prev = msgparse_hashtable_lookup(msg, pkt, *hash, 536 0, dname, dnamelen, LDNS_RR_TYPE_RRSIG, 537 dclass); 538 if(*rrset_prev && rrset_has_sigover(pkt, *rrset_prev, type, 539 &hasother)) { 540 /* yes! */ 541 *prev_dname_first = (*rrset_prev)->dname; 542 *prev_dname_last = dname; 543 *prev_dnamelen = dnamelen; 544 *prev_type = type; 545 *prev_dclass = dclass; 546 *rrset_prev = change_rrsig_rrset(*rrset_prev, msg, 547 pkt, type, *rrset_flags, hasother, section, 548 region); 549 if(!*rrset_prev) return 0; 550 return 1; 551 } 552 } 553 554 *hash = pkt_hash_rrset_rest(dname_h, type, dclass, *rrset_flags); 555 *rrset_prev = msgparse_hashtable_lookup(msg, pkt, *hash, *rrset_flags, 556 dname, dnamelen, type, dclass); 557 if(*rrset_prev) 558 *prev_dname_first = (*rrset_prev)->dname; 559 else *prev_dname_first = dname; 560 *prev_dname_last = dname; 561 *prev_dnamelen = dnamelen; 562 *prev_type = type; 563 *prev_dclass = dclass; 564 return 1; 565 } 566 567 /** 568 * Parse query section. 569 * @param pkt: packet, position at call must be at start of query section. 570 * at end position is after query section. 571 * @param msg: store results here. 572 * @return: 0 if OK, or rcode on error. 573 */ 574 static int 575 parse_query_section(sldns_buffer* pkt, struct msg_parse* msg) 576 { 577 if(msg->qdcount == 0) 578 return 0; 579 if(msg->qdcount > 1) 580 return LDNS_RCODE_FORMERR; 581 log_assert(msg->qdcount == 1); 582 if(sldns_buffer_remaining(pkt) <= 0) 583 return LDNS_RCODE_FORMERR; 584 msg->qname = sldns_buffer_current(pkt); 585 if((msg->qname_len = pkt_dname_len(pkt)) == 0) 586 return LDNS_RCODE_FORMERR; 587 if(sldns_buffer_remaining(pkt) < sizeof(uint16_t)*2) 588 return LDNS_RCODE_FORMERR; 589 msg->qtype = sldns_buffer_read_u16(pkt); 590 msg->qclass = sldns_buffer_read_u16(pkt); 591 return 0; 592 } 593 594 size_t 595 get_rdf_size(sldns_rdf_type rdf) 596 { 597 switch(rdf) { 598 case LDNS_RDF_TYPE_CLASS: 599 case LDNS_RDF_TYPE_ALG: 600 case LDNS_RDF_TYPE_INT8: 601 return 1; 602 break; 603 case LDNS_RDF_TYPE_INT16: 604 case LDNS_RDF_TYPE_TYPE: 605 case LDNS_RDF_TYPE_CERT_ALG: 606 return 2; 607 break; 608 case LDNS_RDF_TYPE_INT32: 609 case LDNS_RDF_TYPE_TIME: 610 case LDNS_RDF_TYPE_A: 611 case LDNS_RDF_TYPE_PERIOD: 612 return 4; 613 break; 614 case LDNS_RDF_TYPE_TSIGTIME: 615 return 6; 616 break; 617 case LDNS_RDF_TYPE_AAAA: 618 return 16; 619 break; 620 default: 621 log_assert(0); /* add type above */ 622 /* only types that appear before a domain * 623 * name are needed. rest is simply copied. */ 624 } 625 return 0; 626 } 627 628 /** calculate the size of one rr */ 629 static int 630 calc_size(sldns_buffer* pkt, uint16_t type, struct rr_parse* rr) 631 { 632 const sldns_rr_descriptor* desc; 633 uint16_t pkt_len; /* length of rr inside the packet */ 634 rr->size = sizeof(uint16_t); /* the rdatalen */ 635 sldns_buffer_skip(pkt, 4); /* skip ttl */ 636 pkt_len = sldns_buffer_read_u16(pkt); 637 if(sldns_buffer_remaining(pkt) < pkt_len) 638 return 0; 639 desc = sldns_rr_descript(type); 640 if(pkt_len > 0 && desc && desc->_dname_count > 0) { 641 int count = (int)desc->_dname_count; 642 int rdf = 0; 643 size_t len; 644 size_t oldpos; 645 /* skip first part. */ 646 while(pkt_len > 0 && count) { 647 switch(desc->_wireformat[rdf]) { 648 case LDNS_RDF_TYPE_DNAME: 649 /* decompress every domain name */ 650 oldpos = sldns_buffer_position(pkt); 651 if((len = pkt_dname_len(pkt)) == 0) 652 return 0; /* malformed dname */ 653 if(sldns_buffer_position(pkt)-oldpos > pkt_len) 654 return 0; /* dname exceeds rdata */ 655 pkt_len -= sldns_buffer_position(pkt)-oldpos; 656 rr->size += len; 657 count--; 658 len = 0; 659 break; 660 case LDNS_RDF_TYPE_STR: 661 if(pkt_len < 1) { 662 /* NOTREACHED, due to 'while(>0)' */ 663 return 0; /* len byte exceeds rdata */ 664 } 665 len = sldns_buffer_current(pkt)[0] + 1; 666 break; 667 default: 668 len = get_rdf_size(desc->_wireformat[rdf]); 669 } 670 if(len) { 671 if(pkt_len < len) 672 return 0; /* exceeds rdata */ 673 pkt_len -= len; 674 sldns_buffer_skip(pkt, (ssize_t)len); 675 rr->size += len; 676 } 677 rdf++; 678 } 679 } 680 /* remaining rdata */ 681 rr->size += pkt_len; 682 sldns_buffer_skip(pkt, (ssize_t)pkt_len); 683 return 1; 684 } 685 686 /** skip rr ttl and rdata */ 687 static int 688 skip_ttl_rdata(sldns_buffer* pkt) 689 { 690 uint16_t rdatalen; 691 if(sldns_buffer_remaining(pkt) < 6) /* ttl + rdatalen */ 692 return 0; 693 sldns_buffer_skip(pkt, 4); /* ttl */ 694 rdatalen = sldns_buffer_read_u16(pkt); 695 if(sldns_buffer_remaining(pkt) < rdatalen) 696 return 0; 697 sldns_buffer_skip(pkt, (ssize_t)rdatalen); 698 return 1; 699 } 700 701 /** see if RRSIG is a duplicate of another */ 702 static int 703 sig_is_double(sldns_buffer* pkt, struct rrset_parse* rrset, uint8_t* ttldata) 704 { 705 uint16_t rlen, siglen; 706 size_t pos = sldns_buffer_position(pkt); 707 struct rr_parse* sig; 708 if(sldns_buffer_remaining(pkt) < 6) 709 return 0; 710 sldns_buffer_skip(pkt, 4); /* ttl */ 711 rlen = sldns_buffer_read_u16(pkt); 712 if(sldns_buffer_remaining(pkt) < rlen) { 713 sldns_buffer_set_position(pkt, pos); 714 return 0; 715 } 716 sldns_buffer_set_position(pkt, pos); 717 718 sig = rrset->rrsig_first; 719 while(sig) { 720 /* check if rdatalen is same */ 721 memmove(&siglen, sig->ttl_data+4, sizeof(siglen)); 722 siglen = ntohs(siglen); 723 /* checks if data in packet is exactly the same, this means 724 * also dname in rdata is the same, but rrsig is not allowed 725 * to have compressed dnames anyway. If it is compressed anyway 726 * it will lead to duplicate rrs for qtype=RRSIG. (or ANY). 727 * 728 * Cannot use sig->size because size of the other one is not 729 * calculated yet. 730 */ 731 if(siglen == rlen) { 732 if(siglen>0 && memcmp(sig->ttl_data+6, ttldata+6, 733 siglen) == 0) { 734 /* same! */ 735 return 1; 736 } 737 } 738 sig = sig->next; 739 } 740 return 0; 741 } 742 743 /** Add rr (from packet here) to rrset, skips rr */ 744 static int 745 add_rr_to_rrset(struct rrset_parse* rrset, sldns_buffer* pkt, 746 struct msg_parse* msg, struct regional* region, 747 sldns_pkt_section section, uint16_t type) 748 { 749 struct rr_parse* rr; 750 /* check section of rrset. */ 751 if(rrset->section != section && type != LDNS_RR_TYPE_RRSIG && 752 rrset->type != LDNS_RR_TYPE_RRSIG) { 753 /* silently drop it - we drop the last part, since 754 * trust in rr data depends on the section it is in. 755 * the less trustworthy part is discarded. 756 * also the last part is more likely to be incomplete. 757 * RFC 2181: must put RRset only once in response. */ 758 /* 759 verbose(VERB_QUERY, "Packet contains rrset data in " 760 "multiple sections, dropped last part."); 761 log_buf(VERB_QUERY, "packet was", pkt); 762 */ 763 /* forwards */ 764 if(!skip_ttl_rdata(pkt)) 765 return LDNS_RCODE_FORMERR; 766 return 0; 767 } 768 769 if( (msg->qtype == LDNS_RR_TYPE_RRSIG || 770 msg->qtype == LDNS_RR_TYPE_ANY) 771 && sig_is_double(pkt, rrset, sldns_buffer_current(pkt))) { 772 if(!skip_ttl_rdata(pkt)) 773 return LDNS_RCODE_FORMERR; 774 return 0; 775 } 776 777 /* create rr */ 778 if(!(rr = (struct rr_parse*)regional_alloc(region, sizeof(*rr)))) 779 return LDNS_RCODE_SERVFAIL; 780 rr->outside_packet = 0; 781 rr->ttl_data = sldns_buffer_current(pkt); 782 rr->next = 0; 783 if(type == LDNS_RR_TYPE_RRSIG && rrset->type != LDNS_RR_TYPE_RRSIG) { 784 if(rrset->rrsig_last) 785 rrset->rrsig_last->next = rr; 786 else rrset->rrsig_first = rr; 787 rrset->rrsig_last = rr; 788 rrset->rrsig_count++; 789 } else { 790 if(rrset->rr_last) 791 rrset->rr_last->next = rr; 792 else rrset->rr_first = rr; 793 rrset->rr_last = rr; 794 rrset->rr_count++; 795 } 796 797 /* calc decompressed size */ 798 if(!calc_size(pkt, type, rr)) 799 return LDNS_RCODE_FORMERR; 800 rrset->size += rr->size; 801 802 return 0; 803 } 804 805 /** 806 * Parse packet RR section, for answer, authority and additional sections. 807 * @param pkt: packet, position at call must be at start of section. 808 * at end position is after section. 809 * @param msg: store results here. 810 * @param region: how to alloc results. 811 * @param section: section enum. 812 * @param num_rrs: how many rrs are in the section. 813 * @param num_rrsets: returns number of rrsets in the section. 814 * @return: 0 if OK, or rcode on error. 815 */ 816 static int 817 parse_section(sldns_buffer* pkt, struct msg_parse* msg, 818 struct regional* region, sldns_pkt_section section, 819 uint16_t num_rrs, size_t* num_rrsets) 820 { 821 uint16_t i; 822 uint8_t* dname, *prev_dname_f = NULL, *prev_dname_l = NULL; 823 size_t dnamelen, prev_dnamelen = 0; 824 uint16_t type, prev_type = 0; 825 uint16_t dclass, prev_dclass = 0; 826 uint32_t rrset_flags = 0; 827 hashvalue_t hash = 0; 828 struct rrset_parse* rrset = NULL; 829 int r; 830 831 if(num_rrs == 0) 832 return 0; 833 if(sldns_buffer_remaining(pkt) <= 0) 834 return LDNS_RCODE_FORMERR; 835 for(i=0; i<num_rrs; i++) { 836 /* parse this RR. */ 837 dname = sldns_buffer_current(pkt); 838 if((dnamelen = pkt_dname_len(pkt)) == 0) 839 return LDNS_RCODE_FORMERR; 840 if(sldns_buffer_remaining(pkt) < 10) /* type, class, ttl, len */ 841 return LDNS_RCODE_FORMERR; 842 type = sldns_buffer_read_u16(pkt); 843 sldns_buffer_read(pkt, &dclass, sizeof(dclass)); 844 845 if(0) { /* debug show what is being parsed. */ 846 if(type == LDNS_RR_TYPE_RRSIG) { 847 uint16_t t; 848 if(pkt_rrsig_covered(pkt, 849 sldns_buffer_current(pkt), &t)) 850 fprintf(stderr, "parse of %s(%d) [%s(%d)]", 851 sldns_rr_descript(type)? 852 sldns_rr_descript(type)->_name: "??", 853 (int)type, 854 sldns_rr_descript(t)? 855 sldns_rr_descript(t)->_name: "??", 856 (int)t); 857 } else 858 fprintf(stderr, "parse of %s(%d)", 859 sldns_rr_descript(type)? 860 sldns_rr_descript(type)->_name: "??", 861 (int)type); 862 fprintf(stderr, " %s(%d) ", 863 sldns_lookup_by_id(sldns_rr_classes, 864 (int)ntohs(dclass))?sldns_lookup_by_id( 865 sldns_rr_classes, (int)ntohs(dclass))->name: 866 "??", (int)ntohs(dclass)); 867 dname_print(stderr, pkt, dname); 868 fprintf(stderr, "\n"); 869 } 870 871 /* see if it is part of an existing RR set */ 872 if(!find_rrset(msg, pkt, dname, dnamelen, type, dclass, &hash, 873 &rrset_flags, &prev_dname_f, &prev_dname_l, 874 &prev_dnamelen, &prev_type, &prev_dclass, &rrset, 875 section, region)) 876 return LDNS_RCODE_SERVFAIL; 877 if(!rrset) { 878 /* it is a new RR set. hash&flags already calculated.*/ 879 (*num_rrsets)++; 880 rrset = new_rrset(msg, dname, dnamelen, type, dclass, 881 hash, rrset_flags, section, region); 882 if(!rrset) 883 return LDNS_RCODE_SERVFAIL; 884 } 885 else if(0) { 886 fprintf(stderr, "is part of existing: "); 887 dname_print(stderr, pkt, rrset->dname); 888 fprintf(stderr, " type %s(%d)\n", 889 sldns_rr_descript(rrset->type)? 890 sldns_rr_descript(rrset->type)->_name: "??", 891 (int)rrset->type); 892 } 893 /* add to rrset. */ 894 if((r=add_rr_to_rrset(rrset, pkt, msg, region, section, 895 type)) != 0) 896 return r; 897 } 898 return 0; 899 } 900 901 int 902 parse_packet(sldns_buffer* pkt, struct msg_parse* msg, struct regional* region) 903 { 904 int ret; 905 if(sldns_buffer_remaining(pkt) < LDNS_HEADER_SIZE) 906 return LDNS_RCODE_FORMERR; 907 /* read the header */ 908 sldns_buffer_read(pkt, &msg->id, sizeof(uint16_t)); 909 msg->flags = sldns_buffer_read_u16(pkt); 910 msg->qdcount = sldns_buffer_read_u16(pkt); 911 msg->ancount = sldns_buffer_read_u16(pkt); 912 msg->nscount = sldns_buffer_read_u16(pkt); 913 msg->arcount = sldns_buffer_read_u16(pkt); 914 if(msg->qdcount > 1) 915 return LDNS_RCODE_FORMERR; 916 if((ret = parse_query_section(pkt, msg)) != 0) 917 return ret; 918 if((ret = parse_section(pkt, msg, region, LDNS_SECTION_ANSWER, 919 msg->ancount, &msg->an_rrsets)) != 0) 920 return ret; 921 if((ret = parse_section(pkt, msg, region, LDNS_SECTION_AUTHORITY, 922 msg->nscount, &msg->ns_rrsets)) != 0) 923 return ret; 924 if(sldns_buffer_remaining(pkt) == 0 && msg->arcount == 1) { 925 /* BIND accepts leniently that an EDNS record is missing. 926 * so, we do too. */ 927 } else if((ret = parse_section(pkt, msg, region, 928 LDNS_SECTION_ADDITIONAL, msg->arcount, &msg->ar_rrsets)) != 0) 929 return ret; 930 /* if(sldns_buffer_remaining(pkt) > 0) { */ 931 /* there is spurious data at end of packet. ignore */ 932 /* } */ 933 msg->rrset_count = msg->an_rrsets + msg->ns_rrsets + msg->ar_rrsets; 934 return 0; 935 } 936 937 /** parse EDNS options from EDNS wireformat rdata */ 938 static int 939 parse_edns_options(uint8_t* rdata_ptr, size_t rdata_len, 940 struct edns_data* edns, struct regional* region) 941 { 942 /* while still more options, and have code+len to read */ 943 /* ignores partial content (i.e. rdata len 3) */ 944 while(rdata_len >= 4) { 945 uint16_t opt_code = sldns_read_uint16(rdata_ptr); 946 uint16_t opt_len = sldns_read_uint16(rdata_ptr+2); 947 rdata_ptr += 4; 948 rdata_len -= 4; 949 if(opt_len > rdata_len) 950 break; /* option code partial */ 951 if(!edns_opt_append(edns, region, opt_code, opt_len, 952 rdata_ptr)) { 953 log_err("out of memory"); 954 return 0; 955 } 956 rdata_ptr += opt_len; 957 rdata_len -= opt_len; 958 } 959 return 1; 960 } 961 962 int 963 parse_extract_edns(struct msg_parse* msg, struct edns_data* edns, 964 struct regional* region) 965 { 966 struct rrset_parse* rrset = msg->rrset_first; 967 struct rrset_parse* prev = 0; 968 struct rrset_parse* found = 0; 969 struct rrset_parse* found_prev = 0; 970 size_t rdata_len; 971 uint8_t* rdata_ptr; 972 /* since the class encodes the UDP size, we cannot use hash table to 973 * find the EDNS OPT record. Scan the packet. */ 974 while(rrset) { 975 if(rrset->type == LDNS_RR_TYPE_OPT) { 976 /* only one OPT RR allowed. */ 977 if(found) return LDNS_RCODE_FORMERR; 978 /* found it! */ 979 found_prev = prev; 980 found = rrset; 981 } 982 prev = rrset; 983 rrset = rrset->rrset_all_next; 984 } 985 if(!found) { 986 memset(edns, 0, sizeof(*edns)); 987 edns->udp_size = 512; 988 return 0; 989 } 990 /* check the found RRset */ 991 /* most lenient check possible. ignore dname, use last opt */ 992 if(found->section != LDNS_SECTION_ADDITIONAL) 993 return LDNS_RCODE_FORMERR; 994 if(found->rr_count == 0) 995 return LDNS_RCODE_FORMERR; 996 if(0) { /* strict checking of dname and RRcount */ 997 if(found->dname_len != 1 || !found->dname 998 || found->dname[0] != 0) return LDNS_RCODE_FORMERR; 999 if(found->rr_count != 1) return LDNS_RCODE_FORMERR; 1000 } 1001 log_assert(found->rr_first && found->rr_last); 1002 1003 /* remove from packet */ 1004 if(found_prev) found_prev->rrset_all_next = found->rrset_all_next; 1005 else msg->rrset_first = found->rrset_all_next; 1006 if(found == msg->rrset_last) 1007 msg->rrset_last = found_prev; 1008 msg->arcount --; 1009 msg->ar_rrsets --; 1010 msg->rrset_count --; 1011 1012 /* take the data ! */ 1013 edns->edns_present = 1; 1014 edns->ext_rcode = found->rr_last->ttl_data[0]; 1015 edns->edns_version = found->rr_last->ttl_data[1]; 1016 edns->bits = sldns_read_uint16(&found->rr_last->ttl_data[2]); 1017 edns->udp_size = ntohs(found->rrset_class); 1018 edns->opt_list = NULL; 1019 1020 /* take the options */ 1021 rdata_len = found->rr_first->size; 1022 rdata_ptr = found->rr_first->ttl_data+6; 1023 if(!parse_edns_options(rdata_ptr, rdata_len, edns, region)) 1024 return 0; 1025 1026 /* ignore rrsigs */ 1027 1028 return 0; 1029 } 1030 1031 int 1032 parse_edns_from_pkt(sldns_buffer* pkt, struct edns_data* edns, 1033 struct regional* region) 1034 { 1035 size_t rdata_len; 1036 uint8_t* rdata_ptr; 1037 log_assert(LDNS_QDCOUNT(sldns_buffer_begin(pkt)) == 1); 1038 log_assert(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) == 0); 1039 log_assert(LDNS_NSCOUNT(sldns_buffer_begin(pkt)) == 0); 1040 /* check edns section is present */ 1041 if(LDNS_ARCOUNT(sldns_buffer_begin(pkt)) > 1) { 1042 return LDNS_RCODE_FORMERR; 1043 } 1044 if(LDNS_ARCOUNT(sldns_buffer_begin(pkt)) == 0) { 1045 memset(edns, 0, sizeof(*edns)); 1046 edns->udp_size = 512; 1047 return 0; 1048 } 1049 /* domain name must be the root of length 1. */ 1050 if(pkt_dname_len(pkt) != 1) 1051 return LDNS_RCODE_FORMERR; 1052 if(sldns_buffer_remaining(pkt) < 10) /* type, class, ttl, rdatalen */ 1053 return LDNS_RCODE_FORMERR; 1054 if(sldns_buffer_read_u16(pkt) != LDNS_RR_TYPE_OPT) 1055 return LDNS_RCODE_FORMERR; 1056 edns->edns_present = 1; 1057 edns->udp_size = sldns_buffer_read_u16(pkt); /* class is udp size */ 1058 edns->ext_rcode = sldns_buffer_read_u8(pkt); /* ttl used for bits */ 1059 edns->edns_version = sldns_buffer_read_u8(pkt); 1060 edns->bits = sldns_buffer_read_u16(pkt); 1061 edns->opt_list = NULL; 1062 1063 /* take the options */ 1064 rdata_len = sldns_buffer_read_u16(pkt); 1065 if(sldns_buffer_remaining(pkt) < rdata_len) 1066 return LDNS_RCODE_FORMERR; 1067 rdata_ptr = sldns_buffer_current(pkt); 1068 if(!parse_edns_options(rdata_ptr, rdata_len, edns, region)) 1069 return LDNS_RCODE_SERVFAIL; 1070 1071 /* ignore rrsigs */ 1072 1073 return 0; 1074 } 1075