1238106Sdes/* 2238106Sdes * iterator/iter_utils.h - iterative resolver module utility functions. 3238106Sdes * 4238106Sdes * Copyright (c) 2007, NLnet Labs. All rights reserved. 5238106Sdes * 6238106Sdes * This software is open source. 7238106Sdes * 8238106Sdes * Redistribution and use in source and binary forms, with or without 9238106Sdes * modification, are permitted provided that the following conditions 10238106Sdes * are met: 11238106Sdes * 12238106Sdes * Redistributions of source code must retain the above copyright notice, 13238106Sdes * this list of conditions and the following disclaimer. 14238106Sdes * 15238106Sdes * Redistributions in binary form must reproduce the above copyright notice, 16238106Sdes * this list of conditions and the following disclaimer in the documentation 17238106Sdes * and/or other materials provided with the distribution. 18238106Sdes * 19238106Sdes * Neither the name of the NLNET LABS nor the names of its contributors may 20238106Sdes * be used to endorse or promote products derived from this software without 21238106Sdes * specific prior written permission. 22238106Sdes * 23238106Sdes * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24269257Sdes * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25269257Sdes * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26269257Sdes * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27269257Sdes * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28269257Sdes * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29269257Sdes * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30269257Sdes * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31269257Sdes * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32269257Sdes * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33269257Sdes * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34238106Sdes */ 35238106Sdes 36238106Sdes/** 37238106Sdes * \file 38238106Sdes * 39238106Sdes * This file contains functions to assist the iterator module. 40238106Sdes * Configuration options. Forward zones. 41238106Sdes */ 42238106Sdes 43238106Sdes#ifndef ITERATOR_ITER_UTILS_H 44238106Sdes#define ITERATOR_ITER_UTILS_H 45238106Sdes#include "iterator/iter_resptype.h" 46269257Sdesstruct sldns_buffer; 47238106Sdesstruct iter_env; 48238106Sdesstruct iter_hints; 49238106Sdesstruct iter_forwards; 50238106Sdesstruct config_file; 51238106Sdesstruct module_env; 52238106Sdesstruct delegpt_addr; 53238106Sdesstruct delegpt; 54238106Sdesstruct regional; 55238106Sdesstruct msg_parse; 56238106Sdesstruct ub_randstate; 57238106Sdesstruct query_info; 58238106Sdesstruct reply_info; 59238106Sdesstruct module_qstate; 60238106Sdesstruct sock_list; 61238106Sdesstruct ub_packed_rrset_key; 62238106Sdes 63238106Sdes/** 64238106Sdes * Process config options and set iterator module state. 65238106Sdes * Sets default values if no config is found. 66238106Sdes * @param iter_env: iterator module state. 67238106Sdes * @param cfg: config options. 68238106Sdes * @return 0 on error. 69238106Sdes */ 70238106Sdesint iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg); 71238106Sdes 72238106Sdes/** 73238106Sdes * Select a valid, nice target to send query to. 74238106Sdes * Sorting and removing unsuitable targets is combined. 75238106Sdes * 76238106Sdes * @param iter_env: iterator module global state, with ip6 enabled and 77238106Sdes * do-not-query-addresses. 78238106Sdes * @param env: environment with infra cache (lameness, rtt info). 79238106Sdes * @param dp: delegation point with result list. 80238106Sdes * @param name: zone name (for lameness check). 81238106Sdes * @param namelen: length of name. 82238106Sdes * @param qtype: query type that we want to send. 83238106Sdes * @param dnssec_lame: set to 1, if a known dnssec-lame server is selected 84238106Sdes * these are not preferred, but are used as a last resort. 85238106Sdes * @param chase_to_rd: set to 1 if a known recursion lame server is selected 86238106Sdes * these are not preferred, but are used as a last resort. 87238106Sdes * @param open_target: number of currently outstanding target queries. 88238106Sdes * If we wait for these, perhaps more server addresses become available. 89238106Sdes * @param blacklist: the IP blacklist to use. 90238106Sdes * @return best target or NULL if no target. 91238106Sdes * if not null, that target is removed from the result list in the dp. 92238106Sdes */ 93238106Sdesstruct delegpt_addr* iter_server_selection(struct iter_env* iter_env, 94238106Sdes struct module_env* env, struct delegpt* dp, uint8_t* name, 95238106Sdes size_t namelen, uint16_t qtype, int* dnssec_lame, 96238106Sdes int* chase_to_rd, int open_target, struct sock_list* blacklist); 97238106Sdes 98238106Sdes/** 99238106Sdes * Allocate dns_msg from parsed msg, in regional. 100238106Sdes * @param pkt: packet. 101238106Sdes * @param msg: parsed message (cleaned and ready for regional allocation). 102238106Sdes * @param regional: regional to use for allocation. 103238106Sdes * @return newly allocated dns_msg, or NULL on memory error. 104238106Sdes */ 105269257Sdesstruct dns_msg* dns_alloc_msg(struct sldns_buffer* pkt, struct msg_parse* msg, 106238106Sdes struct regional* regional); 107238106Sdes 108238106Sdes/** 109238106Sdes * Copy a dns_msg to this regional. 110238106Sdes * @param from: dns message, also in regional. 111238106Sdes * @param regional: regional to use for allocation. 112238106Sdes * @return newly allocated dns_msg, or NULL on memory error. 113238106Sdes */ 114238106Sdesstruct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional); 115238106Sdes 116238106Sdes/** 117238106Sdes * Allocate a dns_msg with malloc/alloc structure and store in dns cache. 118238106Sdes * @param env: environment, with alloc structure and dns cache. 119238106Sdes * @param qinf: query info, the query for which answer is stored. 120238106Sdes * @param rep: reply in dns_msg from dns_alloc_msg for example. 121238106Sdes * @param is_referral: If true, then the given message to be stored is a 122238106Sdes * referral. The cache implementation may use this as a hint. 123238106Sdes * @param leeway: prefetch TTL leeway to expire old rrsets quicker. 124238106Sdes * @param pside: true if dp is parentside, thus message is 'fresh' and NS 125238106Sdes * can be prefetch-updates. 126238106Sdes * @param region: to copy modified (cache is better) rrs back to. 127285206Sdes * @param flags: with BIT_CD for dns64 AAAA translated queries. 128249141Sdes * @return void, because we are not interested in alloc errors, 129249141Sdes * the iterator and validator can operate on the results in their 130249141Sdes * scratch space (the qstate.region) and are not dependent on the cache. 131249141Sdes * It is useful to log the alloc failure (for the server operator), 132249141Sdes * but the query resolution can continue without cache storage. 133238106Sdes */ 134249141Sdesvoid iter_dns_store(struct module_env* env, struct query_info* qinf, 135269257Sdes struct reply_info* rep, int is_referral, time_t leeway, int pside, 136285206Sdes struct regional* region, uint16_t flags); 137238106Sdes 138238106Sdes/** 139238106Sdes * Select randomly with n/m probability. 140238106Sdes * For shuffle NS records for address fetching. 141238106Sdes * @param rnd: random table 142238106Sdes * @param n: probability. 143238106Sdes * @param m: divisor for probability. 144238106Sdes * @return true with n/m probability. 145238106Sdes */ 146238106Sdesint iter_ns_probability(struct ub_randstate* rnd, int n, int m); 147238106Sdes 148238106Sdes/** 149238106Sdes * Mark targets that result in a dependency cycle as done, so they 150238106Sdes * will not get selected as targets. 151238106Sdes * @param qstate: query state. 152238106Sdes * @param dp: delegpt to mark ns in. 153238106Sdes */ 154238106Sdesvoid iter_mark_cycle_targets(struct module_qstate* qstate, struct delegpt* dp); 155238106Sdes 156238106Sdes/** 157238106Sdes * Mark targets that result in a dependency cycle as done, so they 158238106Sdes * will not get selected as targets. For the parent-side lookups. 159238106Sdes * @param qstate: query state. 160238106Sdes * @param dp: delegpt to mark ns in. 161238106Sdes */ 162238106Sdesvoid iter_mark_pside_cycle_targets(struct module_qstate* qstate, 163238106Sdes struct delegpt* dp); 164238106Sdes 165238106Sdes/** 166238106Sdes * See if delegation is useful or offers immediately no targets for 167238106Sdes * further recursion. 168238106Sdes * @param qinfo: query name and type 169238106Sdes * @param qflags: query flags with RD flag 170238106Sdes * @param dp: delegpt to check. 171238106Sdes * @return true if dp is useless. 172238106Sdes */ 173238106Sdesint iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, 174238106Sdes struct delegpt* dp); 175238106Sdes 176238106Sdes/** 177238106Sdes * See if delegation is expected to have DNSSEC information (RRSIGs) in 178238106Sdes * its answers, or not. Inspects delegation point (name), trust anchors, 179238106Sdes * and delegation message (DS RRset) to determine this. 180238106Sdes * @param env: module env with trust anchors. 181238106Sdes * @param dp: delegation point. 182238106Sdes * @param msg: delegation message, with DS if a secure referral. 183238106Sdes * @param dclass: class of query. 184238106Sdes * @return 1 if dnssec is expected, 0 if not. 185238106Sdes */ 186238106Sdesint iter_indicates_dnssec(struct module_env* env, struct delegpt* dp, 187238106Sdes struct dns_msg* msg, uint16_t dclass); 188238106Sdes 189238106Sdes/** 190238106Sdes * See if a message contains DNSSEC. 191238106Sdes * This is examined by looking for RRSIGs. With DNSSEC a valid answer, 192238106Sdes * nxdomain, nodata, referral or cname reply has RRSIGs in answer or auth 193238106Sdes * sections, sigs on answer data, SOA, DS, or NSEC/NSEC3 records. 194238106Sdes * @param msg: message to examine. 195238106Sdes * @return true if DNSSEC information was found. 196238106Sdes */ 197238106Sdesint iter_msg_has_dnssec(struct dns_msg* msg); 198238106Sdes 199238106Sdes/** 200238106Sdes * See if a message is known to be from a certain zone. 201238106Sdes * This looks for SOA or NS rrsets, for answers. 202238106Sdes * For referrals, when one label is delegated, the zone is detected. 203238106Sdes * Does not look at signatures. 204238106Sdes * @param msg: the message to inspect. 205238106Sdes * @param dp: delegation point with zone name to look for. 206238106Sdes * @param type: type of message. 207238106Sdes * @param dclass: class of query. 208238106Sdes * @return true if message is certain to be from zone in dp->name. 209238106Sdes * false if not sure (empty msg), or not from the zone. 210238106Sdes */ 211238106Sdesint iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp, 212238106Sdes enum response_type type, uint16_t dclass); 213238106Sdes 214238106Sdes/** 215238106Sdes * Check if two replies are equal 216238106Sdes * For fallback procedures 217238106Sdes * @param p: reply one. The reply has rrset data pointers in region. 218238106Sdes * Does not check rrset-IDs 219238106Sdes * @param q: reply two 220269257Sdes * @param region: scratch buffer. 221238106Sdes * @return if one and two are equal. 222238106Sdes */ 223269257Sdesint reply_equal(struct reply_info* p, struct reply_info* q, struct regional* region); 224238106Sdes 225238106Sdes/** 226285206Sdes * Remove unused bits from the reply if possible. 227285206Sdes * So that caps-for-id (0x20) fallback is more likely to be successful. 228285206Sdes * This removes like, the additional section, and NS record in the authority 229285206Sdes * section if those records are gratuitous (not for a referral). 230285206Sdes * @param rep: the reply to strip stuff out of. 231285206Sdes */ 232285206Sdesvoid caps_strip_reply(struct reply_info* rep); 233285206Sdes 234285206Sdes/** 235238106Sdes * Store parent-side rrset in seperate rrset cache entries for later 236238106Sdes * last-resort * lookups in case the child-side versions of this information 237238106Sdes * fails. 238238106Sdes * @param env: environment with cache, time, ... 239238106Sdes * @param rrset: the rrset to store (copied). 240238106Sdes * Failure to store is logged, but otherwise ignored. 241238106Sdes */ 242238106Sdesvoid iter_store_parentside_rrset(struct module_env* env, 243238106Sdes struct ub_packed_rrset_key* rrset); 244238106Sdes 245238106Sdes/** 246238106Sdes * Store parent-side NS records from a referral message 247238106Sdes * @param env: environment with cache, time, ... 248238106Sdes * @param rep: response with NS rrset. 249238106Sdes * Failure to store is logged, but otherwise ignored. 250238106Sdes */ 251238106Sdesvoid iter_store_parentside_NS(struct module_env* env, struct reply_info* rep); 252238106Sdes 253238106Sdes/** 254238106Sdes * Store parent-side negative element, the parentside rrset does not exist, 255238106Sdes * creates an rrset with empty rdata in the rrset cache with PARENTSIDE flag. 256238106Sdes * @param env: environment with cache, time, ... 257238106Sdes * @param qinfo: the identity of the rrset that is missing. 258238106Sdes * @param rep: delegation response or answer response, to glean TTL from. 259238106Sdes * (malloc) failure is logged but otherwise ignored. 260238106Sdes */ 261238106Sdesvoid iter_store_parentside_neg(struct module_env* env, 262238106Sdes struct query_info* qinfo, struct reply_info* rep); 263238106Sdes 264238106Sdes/** 265238106Sdes * Add parent NS record if that exists in the cache. This is both new 266238106Sdes * information and acts like a timeout throttle on retries. 267238106Sdes * @param env: query env with rrset cache and time. 268238106Sdes * @param dp: delegation point to store result in. Also this dp is used to 269238106Sdes * see which NS name is needed. 270238106Sdes * @param region: region to alloc result in. 271238106Sdes * @param qinfo: pertinent information, the qclass. 272238106Sdes * @return false on malloc failure. 273238106Sdes * if true, the routine worked and if such cached information 274238106Sdes * existed dp->has_parent_side_NS is set true. 275238106Sdes */ 276238106Sdesint iter_lookup_parent_NS_from_cache(struct module_env* env, 277238106Sdes struct delegpt* dp, struct regional* region, struct query_info* qinfo); 278238106Sdes 279238106Sdes/** 280238106Sdes * Add parent-side glue if that exists in the cache. This is both new 281238106Sdes * information and acts like a timeout throttle on retries to fetch them. 282238106Sdes * @param env: query env with rrset cache and time. 283238106Sdes * @param dp: delegation point to store result in. Also this dp is used to 284238106Sdes * see which NS name is needed. 285238106Sdes * @param region: region to alloc result in. 286238106Sdes * @param qinfo: pertinent information, the qclass. 287238106Sdes * @return: true, it worked, no malloc failures, and new addresses (lame) 288238106Sdes * have been added, giving extra options as query targets. 289238106Sdes */ 290238106Sdesint iter_lookup_parent_glue_from_cache(struct module_env* env, 291238106Sdes struct delegpt* dp, struct regional* region, struct query_info* qinfo); 292238106Sdes 293238106Sdes/** 294238106Sdes * Lookup next root-hint or root-forward entry. 295238106Sdes * @param hints: the hints. 296238106Sdes * @param fwd: the forwards. 297238106Sdes * @param c: the class to start searching at. 0 means find first one. 298238106Sdes * @return false if no classes found, true if found and returned in c. 299238106Sdes */ 300238106Sdesint iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd, 301238106Sdes uint16_t* c); 302238106Sdes 303238106Sdes/** 304238106Sdes * Remove DS records that are inappropriate before they are cached. 305238106Sdes * @param msg: the response to scrub. 306238106Sdes * @param ns: RRSET that is the NS record for the referral. 307238106Sdes * if NULL, then all DS records are removed from the authority section. 308238106Sdes * @param z: zone name that the response is from. 309238106Sdes */ 310238106Sdesvoid iter_scrub_ds(struct dns_msg* msg, struct ub_packed_rrset_key* ns, 311238106Sdes uint8_t* z); 312238106Sdes 313238106Sdes/** 314238106Sdes * Remove query attempts from all available ips. For 0x20. 315238106Sdes * @param dp: delegpt. 316238106Sdes * @param d: decrease. 317238106Sdes */ 318238106Sdesvoid iter_dec_attempts(struct delegpt* dp, int d); 319238106Sdes 320238106Sdes/** 321238106Sdes * Add retry counts from older delegpt to newer delegpt. 322238106Sdes * Does not waste time on timeout'd (or other failing) addresses. 323238106Sdes * @param dp: new delegationpoint. 324238106Sdes * @param old: old delegationpoint. 325238106Sdes */ 326238106Sdesvoid iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old); 327238106Sdes 328238106Sdes/** 329238106Sdes * See if a DS response (type ANSWER) is too low: a nodata answer with 330238106Sdes * a SOA record in the authority section at-or-below the qchase.qname. 331238106Sdes * Also returns true if we are not sure (i.e. empty message, CNAME nosig). 332238106Sdes * @param msg: the response. 333238106Sdes * @param dp: the dp name is used to check if the RRSIG gives a clue that 334238106Sdes * it was originated from the correct nameserver. 335238106Sdes * @return true if too low. 336238106Sdes */ 337238106Sdesint iter_ds_toolow(struct dns_msg* msg, struct delegpt* dp); 338238106Sdes 339238106Sdes/** 340238106Sdes * See if delegpt can go down a step to the qname or not 341238106Sdes * @param qinfo: the query name looked up. 342238106Sdes * @param dp: checked if the name can go lower to the qname 343238106Sdes * @return true if can go down, false if that would not be possible. 344238106Sdes * the current response seems to be the one and only, best possible, response. 345238106Sdes */ 346238106Sdesint iter_dp_cangodown(struct query_info* qinfo, struct delegpt* dp); 347238106Sdes 348238106Sdes#endif /* ITERATOR_ITER_UTILS_H */ 349