dns.c revision 1.18
1/* 2 * services/cache/dns.c - Cache services for DNS using msg and rrset caches. 3 * 4 * Copyright (c) 2007, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36/** 37 * \file 38 * 39 * This file contains the DNS cache. 40 */ 41#include "config.h" 42#include "iterator/iter_delegpt.h" 43#include "iterator/iter_utils.h" 44#include "validator/val_nsec.h" 45#include "validator/val_utils.h" 46#include "services/cache/dns.h" 47#include "services/cache/rrset.h" 48#include "util/data/msgparse.h" 49#include "util/data/msgreply.h" 50#include "util/data/packed_rrset.h" 51#include "util/data/dname.h" 52#include "util/module.h" 53#include "util/net_help.h" 54#include "util/regional.h" 55#include "util/config_file.h" 56#include "sldns/sbuffer.h" 57 58/** store rrsets in the rrset cache. 59 * @param env: module environment with caches. 60 * @param rep: contains list of rrsets to store. 61 * @param now: current time. 62 * @param leeway: during prefetch how much leeway to update TTLs. 63 * This makes rrsets (other than type NS) timeout sooner so they get 64 * updated with a new full TTL. 65 * Type NS does not get this, because it must not be refreshed from the 66 * child domain, but keep counting down properly. 67 * @param pside: if from parentside discovered NS, so that its NS is okay 68 * in a prefetch situation to be updated (without becoming sticky). 69 * @param qrep: update rrsets here if cache is better 70 * @param region: for qrep allocs. 71 */ 72static void 73store_rrsets(struct module_env* env, struct reply_info* rep, time_t now, 74 time_t leeway, int pside, struct reply_info* qrep, 75 struct regional* region) 76{ 77 size_t i; 78 /* see if rrset already exists in cache, if not insert it. */ 79 for(i=0; i<rep->rrset_count; i++) { 80 rep->ref[i].key = rep->rrsets[i]; 81 rep->ref[i].id = rep->rrsets[i]->id; 82 /* update ref if it was in the cache */ 83 switch(rrset_cache_update(env->rrset_cache, &rep->ref[i], 84 env->alloc, now + ((ntohs(rep->ref[i].key->rk.type)== 85 LDNS_RR_TYPE_NS && !pside)?0:leeway))) { 86 case 0: /* ref unchanged, item inserted */ 87 break; 88 case 2: /* ref updated, cache is superior */ 89 if(region) { 90 struct ub_packed_rrset_key* ck; 91 lock_rw_rdlock(&rep->ref[i].key->entry.lock); 92 /* if deleted rrset, do not copy it */ 93 if(rep->ref[i].key->id == 0) 94 ck = NULL; 95 else ck = packed_rrset_copy_region( 96 rep->ref[i].key, region, now); 97 lock_rw_unlock(&rep->ref[i].key->entry.lock); 98 if(ck) { 99 /* use cached copy if memory allows */ 100 qrep->rrsets[i] = ck; 101 } 102 } 103 /* no break: also copy key item */ 104 /* the line below is matched by gcc regex and silences 105 * the fallthrough warning */ 106 /* fallthrough */ 107 case 1: /* ref updated, item inserted */ 108 rep->rrsets[i] = rep->ref[i].key; 109 } 110 } 111} 112 113/** delete message from message cache */ 114void 115msg_cache_remove(struct module_env* env, uint8_t* qname, size_t qnamelen, 116 uint16_t qtype, uint16_t qclass, uint16_t flags) 117{ 118 struct query_info k; 119 hashvalue_type h; 120 121 k.qname = qname; 122 k.qname_len = qnamelen; 123 k.qtype = qtype; 124 k.qclass = qclass; 125 k.local_alias = NULL; 126 h = query_info_hash(&k, flags); 127 slabhash_remove(env->msg_cache, h, &k); 128} 129 130/** remove servfail msg cache entry */ 131static void 132msg_del_servfail(struct module_env* env, struct query_info* qinfo, 133 uint32_t flags) 134{ 135 struct msgreply_entry* e; 136 /* see if the entry is servfail, and then remove it, so that 137 * lookups move from the cacheresponse stage to the recursionresponse 138 * stage */ 139 e = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len, 140 qinfo->qtype, qinfo->qclass, flags, 0, 0); 141 if(!e) return; 142 /* we don't check for the ttl here, also expired servfail entries 143 * are removed. If the user uses serve-expired, they would still be 144 * used to answer from cache */ 145 if(FLAGS_GET_RCODE(((struct reply_info*)e->entry.data)->flags) 146 != LDNS_RCODE_SERVFAIL) { 147 lock_rw_unlock(&e->entry.lock); 148 return; 149 } 150 lock_rw_unlock(&e->entry.lock); 151 msg_cache_remove(env, qinfo->qname, qinfo->qname_len, qinfo->qtype, 152 qinfo->qclass, flags); 153} 154 155void 156dns_cache_store_msg(struct module_env* env, struct query_info* qinfo, 157 hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside, 158 struct reply_info* qrep, uint32_t flags, struct regional* region) 159{ 160 struct msgreply_entry* e; 161 time_t ttl = rep->ttl; 162 size_t i; 163 164 /* store RRsets */ 165 for(i=0; i<rep->rrset_count; i++) { 166 rep->ref[i].key = rep->rrsets[i]; 167 rep->ref[i].id = rep->rrsets[i]->id; 168 } 169 170 /* there was a reply_info_sortref(rep) here but it seems to be 171 * unnecessary, because the cache gets locked per rrset. */ 172 reply_info_set_ttls(rep, *env->now); 173 store_rrsets(env, rep, *env->now, leeway, pside, qrep, region); 174 if(ttl == 0 && !(flags & DNSCACHE_STORE_ZEROTTL)) { 175 /* we do not store the message, but we did store the RRs, 176 * which could be useful for delegation information */ 177 verbose(VERB_ALGO, "TTL 0: dropped msg from cache"); 178 free(rep); 179 /* if the message is SERVFAIL in cache, remove that SERVFAIL, 180 * so that the TTL 0 response can be returned for future 181 * responses (i.e. don't get answered by the servfail from 182 * cache, but instead go to recursion to get this TTL0 183 * response). */ 184 msg_del_servfail(env, qinfo, flags); 185 return; 186 } 187 188 /* store msg in the cache */ 189 reply_info_sortref(rep); 190 if(!(e = query_info_entrysetup(qinfo, rep, hash))) { 191 log_err("store_msg: malloc failed"); 192 return; 193 } 194 slabhash_insert(env->msg_cache, hash, &e->entry, rep, env->alloc); 195} 196 197/** find closest NS or DNAME and returns the rrset (locked) */ 198static struct ub_packed_rrset_key* 199find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen, 200 uint16_t qclass, time_t now, uint16_t searchtype, int stripfront) 201{ 202 struct ub_packed_rrset_key *rrset; 203 uint8_t lablen; 204 205 if(stripfront) { 206 /* strip off so that DNAMEs have strict subdomain match */ 207 lablen = *qname; 208 qname += lablen + 1; 209 qnamelen -= lablen + 1; 210 } 211 212 /* snip off front part of qname until the type is found */ 213 while(qnamelen > 0) { 214 if((rrset = rrset_cache_lookup(env->rrset_cache, qname, 215 qnamelen, searchtype, qclass, 0, now, 0))) 216 return rrset; 217 218 /* snip off front label */ 219 lablen = *qname; 220 qname += lablen + 1; 221 qnamelen -= lablen + 1; 222 } 223 return NULL; 224} 225 226/** add addr to additional section */ 227static void 228addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region, 229 struct dns_msg* msg, time_t now) 230{ 231 if((msg->rep->rrsets[msg->rep->rrset_count] = 232 packed_rrset_copy_region(rrset, region, now))) { 233 msg->rep->ar_numrrsets++; 234 msg->rep->rrset_count++; 235 } 236} 237 238/** lookup message in message cache */ 239struct msgreply_entry* 240msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen, 241 uint16_t qtype, uint16_t qclass, uint16_t flags, time_t now, int wr) 242{ 243 struct lruhash_entry* e; 244 struct query_info k; 245 hashvalue_type h; 246 247 k.qname = qname; 248 k.qname_len = qnamelen; 249 k.qtype = qtype; 250 k.qclass = qclass; 251 k.local_alias = NULL; 252 h = query_info_hash(&k, flags); 253 e = slabhash_lookup(env->msg_cache, h, &k, wr); 254 255 if(!e) return NULL; 256 if( now > ((struct reply_info*)e->data)->ttl ) { 257 lock_rw_unlock(&e->lock); 258 return NULL; 259 } 260 return (struct msgreply_entry*)e->key; 261} 262 263/** find and add A and AAAA records for nameservers in delegpt */ 264static int 265find_add_addrs(struct module_env* env, uint16_t qclass, 266 struct regional* region, struct delegpt* dp, time_t now, 267 struct dns_msg** msg) 268{ 269 struct delegpt_ns* ns; 270 struct msgreply_entry* neg; 271 struct ub_packed_rrset_key* akey; 272 for(ns = dp->nslist; ns; ns = ns->next) { 273 akey = rrset_cache_lookup(env->rrset_cache, ns->name, 274 ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0); 275 if(akey) { 276 if(!delegpt_add_rrset_A(dp, region, akey, 0, NULL)) { 277 lock_rw_unlock(&akey->entry.lock); 278 return 0; 279 } 280 if(msg) 281 addr_to_additional(akey, region, *msg, now); 282 lock_rw_unlock(&akey->entry.lock); 283 } else { 284 /* BIT_CD on false because delegpt lookup does 285 * not use dns64 translation */ 286 neg = msg_cache_lookup(env, ns->name, ns->namelen, 287 LDNS_RR_TYPE_A, qclass, 0, now, 0); 288 if(neg) { 289 delegpt_add_neg_msg(dp, neg); 290 lock_rw_unlock(&neg->entry.lock); 291 } 292 } 293 akey = rrset_cache_lookup(env->rrset_cache, ns->name, 294 ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 295 if(akey) { 296 if(!delegpt_add_rrset_AAAA(dp, region, akey, 0, NULL)) { 297 lock_rw_unlock(&akey->entry.lock); 298 return 0; 299 } 300 if(msg) 301 addr_to_additional(akey, region, *msg, now); 302 lock_rw_unlock(&akey->entry.lock); 303 } else { 304 /* BIT_CD on false because delegpt lookup does 305 * not use dns64 translation */ 306 neg = msg_cache_lookup(env, ns->name, ns->namelen, 307 LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 308 if(neg) { 309 delegpt_add_neg_msg(dp, neg); 310 lock_rw_unlock(&neg->entry.lock); 311 } 312 } 313 } 314 return 1; 315} 316 317/** find and add A and AAAA records for missing nameservers in delegpt */ 318int 319cache_fill_missing(struct module_env* env, uint16_t qclass, 320 struct regional* region, struct delegpt* dp) 321{ 322 struct delegpt_ns* ns; 323 struct msgreply_entry* neg; 324 struct ub_packed_rrset_key* akey; 325 time_t now = *env->now; 326 for(ns = dp->nslist; ns; ns = ns->next) { 327 akey = rrset_cache_lookup(env->rrset_cache, ns->name, 328 ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0); 329 if(akey) { 330 if(!delegpt_add_rrset_A(dp, region, akey, ns->lame, 331 NULL)) { 332 lock_rw_unlock(&akey->entry.lock); 333 return 0; 334 } 335 log_nametypeclass(VERB_ALGO, "found in cache", 336 ns->name, LDNS_RR_TYPE_A, qclass); 337 lock_rw_unlock(&akey->entry.lock); 338 } else { 339 /* BIT_CD on false because delegpt lookup does 340 * not use dns64 translation */ 341 neg = msg_cache_lookup(env, ns->name, ns->namelen, 342 LDNS_RR_TYPE_A, qclass, 0, now, 0); 343 if(neg) { 344 delegpt_add_neg_msg(dp, neg); 345 lock_rw_unlock(&neg->entry.lock); 346 } 347 } 348 akey = rrset_cache_lookup(env->rrset_cache, ns->name, 349 ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 350 if(akey) { 351 if(!delegpt_add_rrset_AAAA(dp, region, akey, ns->lame, 352 NULL)) { 353 lock_rw_unlock(&akey->entry.lock); 354 return 0; 355 } 356 log_nametypeclass(VERB_ALGO, "found in cache", 357 ns->name, LDNS_RR_TYPE_AAAA, qclass); 358 lock_rw_unlock(&akey->entry.lock); 359 } else { 360 /* BIT_CD on false because delegpt lookup does 361 * not use dns64 translation */ 362 neg = msg_cache_lookup(env, ns->name, ns->namelen, 363 LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 364 if(neg) { 365 delegpt_add_neg_msg(dp, neg); 366 lock_rw_unlock(&neg->entry.lock); 367 } 368 } 369 } 370 return 1; 371} 372 373/** find and add DS or NSEC to delegation msg */ 374static void 375find_add_ds(struct module_env* env, struct regional* region, 376 struct dns_msg* msg, struct delegpt* dp, time_t now) 377{ 378 /* Lookup the DS or NSEC at the delegation point. */ 379 struct ub_packed_rrset_key* rrset = rrset_cache_lookup( 380 env->rrset_cache, dp->name, dp->namelen, LDNS_RR_TYPE_DS, 381 msg->qinfo.qclass, 0, now, 0); 382 if(!rrset) { 383 /* NOTE: this won't work for alternate NSEC schemes 384 * (opt-in, NSEC3) */ 385 rrset = rrset_cache_lookup(env->rrset_cache, dp->name, 386 dp->namelen, LDNS_RR_TYPE_NSEC, msg->qinfo.qclass, 387 0, now, 0); 388 /* Note: the PACKED_RRSET_NSEC_AT_APEX flag is not used. 389 * since this is a referral, we need the NSEC at the parent 390 * side of the zone cut, not the NSEC at apex side. */ 391 if(rrset && nsec_has_type(rrset, LDNS_RR_TYPE_DS)) { 392 lock_rw_unlock(&rrset->entry.lock); 393 rrset = NULL; /* discard wrong NSEC */ 394 } 395 } 396 if(rrset) { 397 /* add it to auth section. This is the second rrset. */ 398 if((msg->rep->rrsets[msg->rep->rrset_count] = 399 packed_rrset_copy_region(rrset, region, now))) { 400 msg->rep->ns_numrrsets++; 401 msg->rep->rrset_count++; 402 } 403 lock_rw_unlock(&rrset->entry.lock); 404 } 405} 406 407struct dns_msg* 408dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype, 409 uint16_t qclass, struct regional* region, size_t capacity) 410{ 411 struct dns_msg* msg = (struct dns_msg*)regional_alloc(region, 412 sizeof(struct dns_msg)); 413 if(!msg) 414 return NULL; 415 msg->qinfo.qname = regional_alloc_init(region, qname, qnamelen); 416 if(!msg->qinfo.qname) 417 return NULL; 418 msg->qinfo.qname_len = qnamelen; 419 msg->qinfo.qtype = qtype; 420 msg->qinfo.qclass = qclass; 421 msg->qinfo.local_alias = NULL; 422 /* non-packed reply_info, because it needs to grow the array */ 423 msg->rep = (struct reply_info*)regional_alloc_zero(region, 424 sizeof(struct reply_info)-sizeof(struct rrset_ref)); 425 if(!msg->rep) 426 return NULL; 427 if(capacity > RR_COUNT_MAX) 428 return NULL; /* integer overflow protection */ 429 msg->rep->flags = BIT_QR; /* with QR, no AA */ 430 msg->rep->qdcount = 1; 431 msg->rep->reason_bogus = LDNS_EDE_NONE; 432 msg->rep->rrsets = (struct ub_packed_rrset_key**) 433 regional_alloc(region, 434 capacity*sizeof(struct ub_packed_rrset_key*)); 435 if(!msg->rep->rrsets) 436 return NULL; 437 return msg; 438} 439 440int 441dns_msg_authadd(struct dns_msg* msg, struct regional* region, 442 struct ub_packed_rrset_key* rrset, time_t now) 443{ 444 if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 445 packed_rrset_copy_region(rrset, region, now))) 446 return 0; 447 msg->rep->ns_numrrsets++; 448 return 1; 449} 450 451int 452dns_msg_ansadd(struct dns_msg* msg, struct regional* region, 453 struct ub_packed_rrset_key* rrset, time_t now) 454{ 455 if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 456 packed_rrset_copy_region(rrset, region, now))) 457 return 0; 458 msg->rep->an_numrrsets++; 459 return 1; 460} 461 462struct delegpt* 463dns_cache_find_delegation(struct module_env* env, uint8_t* qname, 464 size_t qnamelen, uint16_t qtype, uint16_t qclass, 465 struct regional* region, struct dns_msg** msg, time_t now) 466{ 467 /* try to find closest NS rrset */ 468 struct ub_packed_rrset_key* nskey; 469 struct packed_rrset_data* nsdata; 470 struct delegpt* dp; 471 472 nskey = find_closest_of_type(env, qname, qnamelen, qclass, now, 473 LDNS_RR_TYPE_NS, 0); 474 if(!nskey) /* hope the caller has hints to prime or something */ 475 return NULL; 476 nsdata = (struct packed_rrset_data*)nskey->entry.data; 477 /* got the NS key, create delegation point */ 478 dp = delegpt_create(region); 479 if(!dp || !delegpt_set_name(dp, region, nskey->rk.dname)) { 480 lock_rw_unlock(&nskey->entry.lock); 481 log_err("find_delegation: out of memory"); 482 return NULL; 483 } 484 /* create referral message */ 485 if(msg) { 486 /* allocate the array to as much as we could need: 487 * NS rrset + DS/NSEC rrset + 488 * A rrset for every NS RR 489 * AAAA rrset for every NS RR 490 */ 491 *msg = dns_msg_create(qname, qnamelen, qtype, qclass, region, 492 2 + nsdata->count*2); 493 if(!*msg || !dns_msg_authadd(*msg, region, nskey, now)) { 494 lock_rw_unlock(&nskey->entry.lock); 495 log_err("find_delegation: out of memory"); 496 return NULL; 497 } 498 } 499 if(!delegpt_rrset_add_ns(dp, region, nskey, 0)) 500 log_err("find_delegation: addns out of memory"); 501 lock_rw_unlock(&nskey->entry.lock); /* first unlock before next lookup*/ 502 /* find and add DS/NSEC (if any) */ 503 if(msg) 504 find_add_ds(env, region, *msg, dp, now); 505 /* find and add A entries */ 506 if(!find_add_addrs(env, qclass, region, dp, now, msg)) 507 log_err("find_delegation: addrs out of memory"); 508 return dp; 509} 510 511/** allocate dns_msg from query_info and reply_info */ 512static struct dns_msg* 513gen_dns_msg(struct regional* region, struct query_info* q, size_t num) 514{ 515 struct dns_msg* msg = (struct dns_msg*)regional_alloc(region, 516 sizeof(struct dns_msg)); 517 if(!msg) 518 return NULL; 519 memcpy(&msg->qinfo, q, sizeof(struct query_info)); 520 msg->qinfo.qname = regional_alloc_init(region, q->qname, q->qname_len); 521 if(!msg->qinfo.qname) 522 return NULL; 523 /* allocate replyinfo struct and rrset key array separately */ 524 msg->rep = (struct reply_info*)regional_alloc(region, 525 sizeof(struct reply_info) - sizeof(struct rrset_ref)); 526 if(!msg->rep) 527 return NULL; 528 msg->rep->reason_bogus = LDNS_EDE_NONE; 529 if(num > RR_COUNT_MAX) 530 return NULL; /* integer overflow protection */ 531 msg->rep->rrsets = (struct ub_packed_rrset_key**) 532 regional_alloc(region, 533 num * sizeof(struct ub_packed_rrset_key*)); 534 if(!msg->rep->rrsets) 535 return NULL; 536 return msg; 537} 538 539struct dns_msg* 540tomsg(struct module_env* env, struct query_info* q, struct reply_info* r, 541 struct regional* region, time_t now, int allow_expired, 542 struct regional* scratch) 543{ 544 struct dns_msg* msg; 545 size_t i; 546 int is_expired = 0; 547 time_t now_control = now; 548 if(now > r->ttl) { 549 /* Check if we are allowed to serve expired */ 550 if(allow_expired) { 551 if(env->cfg->serve_expired_ttl && 552 r->serve_expired_ttl < now) { 553 return NULL; 554 } 555 } else { 556 return NULL; 557 } 558 /* Change the current time so we can pass the below TTL checks when 559 * serving expired data. */ 560 now_control = r->ttl - env->cfg->serve_expired_reply_ttl; 561 is_expired = 1; 562 } 563 564 msg = gen_dns_msg(region, q, r->rrset_count); 565 if(!msg) return NULL; 566 msg->rep->flags = r->flags; 567 msg->rep->qdcount = r->qdcount; 568 msg->rep->ttl = is_expired 569 ?SERVE_EXPIRED_REPLY_TTL 570 :r->ttl - now; 571 if(r->prefetch_ttl > now) 572 msg->rep->prefetch_ttl = r->prefetch_ttl - now; 573 else 574 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 575 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 576 msg->rep->security = r->security; 577 msg->rep->an_numrrsets = r->an_numrrsets; 578 msg->rep->ns_numrrsets = r->ns_numrrsets; 579 msg->rep->ar_numrrsets = r->ar_numrrsets; 580 msg->rep->rrset_count = r->rrset_count; 581 msg->rep->authoritative = r->authoritative; 582 msg->rep->reason_bogus = r->reason_bogus; 583 if(!rrset_array_lock(r->ref, r->rrset_count, now_control)) { 584 return NULL; 585 } 586 if(r->an_numrrsets > 0 && (r->rrsets[0]->rk.type == htons( 587 LDNS_RR_TYPE_CNAME) || r->rrsets[0]->rk.type == htons( 588 LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(q, r)) { 589 /* cname chain is now invalid, reconstruct msg */ 590 rrset_array_unlock(r->ref, r->rrset_count); 591 return NULL; 592 } 593 if(r->security == sec_status_secure && !reply_all_rrsets_secure(r)) { 594 /* message rrsets have changed status, revalidate */ 595 rrset_array_unlock(r->ref, r->rrset_count); 596 return NULL; 597 } 598 for(i=0; i<msg->rep->rrset_count; i++) { 599 msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i], 600 region, now); 601 if(!msg->rep->rrsets[i]) { 602 rrset_array_unlock(r->ref, r->rrset_count); 603 return NULL; 604 } 605 } 606 if(env) 607 rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref, 608 r->rrset_count); 609 else 610 rrset_array_unlock(r->ref, r->rrset_count); 611 return msg; 612} 613 614/** synthesize RRset-only response from cached RRset item */ 615static struct dns_msg* 616rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region, 617 time_t now, struct query_info* q) 618{ 619 struct dns_msg* msg; 620 struct packed_rrset_data* d = (struct packed_rrset_data*) 621 rrset->entry.data; 622 if(now > d->ttl) 623 return NULL; 624 msg = gen_dns_msg(region, q, 1); /* only the CNAME (or other) RRset */ 625 if(!msg) 626 return NULL; 627 msg->rep->flags = BIT_QR; /* reply, no AA, no error */ 628 msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */ 629 msg->rep->qdcount = 1; 630 msg->rep->ttl = d->ttl - now; 631 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 632 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 633 msg->rep->security = sec_status_unchecked; 634 msg->rep->an_numrrsets = 1; 635 msg->rep->ns_numrrsets = 0; 636 msg->rep->ar_numrrsets = 0; 637 msg->rep->rrset_count = 1; 638 msg->rep->reason_bogus = LDNS_EDE_NONE; 639 msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now); 640 if(!msg->rep->rrsets[0]) /* copy CNAME */ 641 return NULL; 642 return msg; 643} 644 645/** synthesize DNAME+CNAME response from cached DNAME item */ 646static struct dns_msg* 647synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region, 648 time_t now, struct query_info* q, enum sec_status* sec_status) 649{ 650 struct dns_msg* msg; 651 struct ub_packed_rrset_key* ck; 652 struct packed_rrset_data* newd, *d = (struct packed_rrset_data*) 653 rrset->entry.data; 654 uint8_t* newname, *dtarg = NULL; 655 size_t newlen, dtarglen; 656 if(now > d->ttl) 657 return NULL; 658 /* only allow validated (with DNSSEC) DNAMEs used from cache 659 * for insecure DNAMEs, query again. */ 660 *sec_status = d->security; 661 /* return sec status, so the status of the CNAME can be checked 662 * by the calling routine. */ 663 msg = gen_dns_msg(region, q, 2); /* DNAME + CNAME RRset */ 664 if(!msg) 665 return NULL; 666 msg->rep->flags = BIT_QR; /* reply, no AA, no error */ 667 msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */ 668 msg->rep->qdcount = 1; 669 msg->rep->ttl = d->ttl - now; 670 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 671 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 672 msg->rep->security = sec_status_unchecked; 673 msg->rep->an_numrrsets = 1; 674 msg->rep->ns_numrrsets = 0; 675 msg->rep->ar_numrrsets = 0; 676 msg->rep->rrset_count = 1; 677 msg->rep->reason_bogus = LDNS_EDE_NONE; 678 msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now); 679 if(!msg->rep->rrsets[0]) /* copy DNAME */ 680 return NULL; 681 /* synth CNAME rrset */ 682 get_cname_target(rrset, &dtarg, &dtarglen); 683 if(!dtarg) 684 return NULL; 685 newlen = q->qname_len + dtarglen - rrset->rk.dname_len; 686 if(newlen > LDNS_MAX_DOMAINLEN) { 687 msg->rep->flags |= LDNS_RCODE_YXDOMAIN; 688 return msg; 689 } 690 newname = (uint8_t*)regional_alloc(region, newlen); 691 if(!newname) 692 return NULL; 693 /* new name is concatenation of qname front (without DNAME owner) 694 * and DNAME target name */ 695 memcpy(newname, q->qname, q->qname_len-rrset->rk.dname_len); 696 memmove(newname+(q->qname_len-rrset->rk.dname_len), dtarg, dtarglen); 697 /* create rest of CNAME rrset */ 698 ck = (struct ub_packed_rrset_key*)regional_alloc(region, 699 sizeof(struct ub_packed_rrset_key)); 700 if(!ck) 701 return NULL; 702 memset(&ck->entry, 0, sizeof(ck->entry)); 703 msg->rep->rrsets[1] = ck; 704 ck->entry.key = ck; 705 ck->rk.type = htons(LDNS_RR_TYPE_CNAME); 706 ck->rk.rrset_class = rrset->rk.rrset_class; 707 ck->rk.flags = 0; 708 ck->rk.dname = regional_alloc_init(region, q->qname, q->qname_len); 709 if(!ck->rk.dname) 710 return NULL; 711 ck->rk.dname_len = q->qname_len; 712 ck->entry.hash = rrset_key_hash(&ck->rk); 713 newd = (struct packed_rrset_data*)regional_alloc_zero(region, 714 sizeof(struct packed_rrset_data) + sizeof(size_t) + 715 sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t) 716 + newlen); 717 if(!newd) 718 return NULL; 719 ck->entry.data = newd; 720 newd->ttl = 0; /* 0 for synthesized CNAME TTL */ 721 newd->count = 1; 722 newd->rrsig_count = 0; 723 newd->trust = rrset_trust_ans_noAA; 724 newd->rr_len = (size_t*)((uint8_t*)newd + 725 sizeof(struct packed_rrset_data)); 726 newd->rr_len[0] = newlen + sizeof(uint16_t); 727 packed_rrset_ptr_fixup(newd); 728 newd->rr_ttl[0] = newd->ttl; 729 msg->rep->ttl = newd->ttl; 730 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(newd->ttl); 731 msg->rep->serve_expired_ttl = newd->ttl + SERVE_EXPIRED_TTL; 732 sldns_write_uint16(newd->rr_data[0], newlen); 733 memmove(newd->rr_data[0] + sizeof(uint16_t), newname, newlen); 734 msg->rep->an_numrrsets ++; 735 msg->rep->rrset_count ++; 736 return msg; 737} 738 739/** Fill TYPE_ANY response with some data from cache */ 740static struct dns_msg* 741fill_any(struct module_env* env, 742 uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass, 743 struct regional* region) 744{ 745 time_t now = *env->now; 746 struct dns_msg* msg = NULL; 747 uint16_t lookup[] = {LDNS_RR_TYPE_A, LDNS_RR_TYPE_AAAA, 748 LDNS_RR_TYPE_MX, LDNS_RR_TYPE_SOA, LDNS_RR_TYPE_NS, 749 LDNS_RR_TYPE_DNAME, 0}; 750 int i, num=6; /* number of RR types to look up */ 751 log_assert(lookup[num] == 0); 752 753 if(env->cfg->deny_any) { 754 /* return empty message */ 755 msg = dns_msg_create(qname, qnamelen, qtype, qclass, 756 region, 0); 757 if(!msg) { 758 return NULL; 759 } 760 /* set NOTIMPL for RFC 8482 */ 761 msg->rep->flags |= LDNS_RCODE_NOTIMPL; 762 msg->rep->security = sec_status_indeterminate; 763 return msg; 764 } 765 766 for(i=0; i<num; i++) { 767 /* look up this RR for inclusion in type ANY response */ 768 struct ub_packed_rrset_key* rrset = rrset_cache_lookup( 769 env->rrset_cache, qname, qnamelen, lookup[i], 770 qclass, 0, now, 0); 771 struct packed_rrset_data *d; 772 if(!rrset) 773 continue; 774 775 /* only if rrset from answer section */ 776 d = (struct packed_rrset_data*)rrset->entry.data; 777 if(d->trust == rrset_trust_add_noAA || 778 d->trust == rrset_trust_auth_noAA || 779 d->trust == rrset_trust_add_AA || 780 d->trust == rrset_trust_auth_AA) { 781 lock_rw_unlock(&rrset->entry.lock); 782 continue; 783 } 784 785 /* create msg if none */ 786 if(!msg) { 787 msg = dns_msg_create(qname, qnamelen, qtype, qclass, 788 region, (size_t)(num-i)); 789 if(!msg) { 790 lock_rw_unlock(&rrset->entry.lock); 791 return NULL; 792 } 793 } 794 795 /* add RRset to response */ 796 if(!dns_msg_ansadd(msg, region, rrset, now)) { 797 lock_rw_unlock(&rrset->entry.lock); 798 return NULL; 799 } 800 lock_rw_unlock(&rrset->entry.lock); 801 } 802 return msg; 803} 804 805struct dns_msg* 806dns_cache_lookup(struct module_env* env, 807 uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass, 808 uint16_t flags, struct regional* region, struct regional* scratch, 809 int no_partial, uint8_t* dpname, size_t dpnamelen) 810{ 811 struct lruhash_entry* e; 812 struct query_info k; 813 hashvalue_type h; 814 time_t now = *env->now; 815 struct ub_packed_rrset_key* rrset; 816 817 /* lookup first, this has both NXdomains and ANSWER responses */ 818 k.qname = qname; 819 k.qname_len = qnamelen; 820 k.qtype = qtype; 821 k.qclass = qclass; 822 k.local_alias = NULL; 823 h = query_info_hash(&k, flags); 824 e = slabhash_lookup(env->msg_cache, h, &k, 0); 825 if(e) { 826 struct msgreply_entry* key = (struct msgreply_entry*)e->key; 827 struct reply_info* data = (struct reply_info*)e->data; 828 struct dns_msg* msg = tomsg(env, &key->key, data, region, now, 0, 829 scratch); 830 if(msg) { 831 lock_rw_unlock(&e->lock); 832 return msg; 833 } 834 /* could be msg==NULL; due to TTL or not all rrsets available */ 835 lock_rw_unlock(&e->lock); 836 } 837 838 /* see if a DNAME exists. Checked for first, to enforce that DNAMEs 839 * are more important, the CNAME is resynthesized and thus 840 * consistent with the DNAME */ 841 if(!no_partial && 842 (rrset=find_closest_of_type(env, qname, qnamelen, qclass, now, 843 LDNS_RR_TYPE_DNAME, 1))) { 844 /* synthesize a DNAME+CNAME message based on this */ 845 enum sec_status sec_status = sec_status_unchecked; 846 struct dns_msg* msg = synth_dname_msg(rrset, region, now, &k, 847 &sec_status); 848 if(msg) { 849 struct ub_packed_rrset_key* cname_rrset; 850 lock_rw_unlock(&rrset->entry.lock); 851 /* now, after unlocking the DNAME rrset lock, 852 * check the sec_status, and see if we need to look 853 * up the CNAME record associated before it can 854 * be used */ 855 /* normally, only secure DNAMEs allowed from cache*/ 856 if(sec_status == sec_status_secure) 857 return msg; 858 /* but if we have a CNAME cached with this name, then we 859 * have previously already allowed this name to pass. 860 * the next cache lookup is going to fetch that CNAME itself, 861 * but it is better to have the (unsigned)DNAME + CNAME in 862 * that case */ 863 cname_rrset = rrset_cache_lookup( 864 env->rrset_cache, qname, qnamelen, 865 LDNS_RR_TYPE_CNAME, qclass, 0, now, 0); 866 if(cname_rrset) { 867 /* CNAME already synthesized by 868 * synth_dname_msg routine, so we can 869 * straight up return the msg */ 870 lock_rw_unlock(&cname_rrset->entry.lock); 871 return msg; 872 } 873 } else { 874 lock_rw_unlock(&rrset->entry.lock); 875 } 876 } 877 878 /* see if we have CNAME for this domain, 879 * but not for DS records (which are part of the parent) */ 880 if(!no_partial && qtype != LDNS_RR_TYPE_DS && 881 (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen, 882 LDNS_RR_TYPE_CNAME, qclass, 0, now, 0))) { 883 uint8_t* wc = NULL; 884 size_t wl; 885 /* if the rrset is not a wildcard expansion, with wcname */ 886 /* because, if we return that CNAME rrset on its own, it is 887 * missing the NSEC or NSEC3 proof */ 888 if(!(val_rrset_wildcard(rrset, &wc, &wl) && wc != NULL)) { 889 struct dns_msg* msg = rrset_msg(rrset, region, now, &k); 890 if(msg) { 891 lock_rw_unlock(&rrset->entry.lock); 892 return msg; 893 } 894 } 895 lock_rw_unlock(&rrset->entry.lock); 896 } 897 898 /* construct DS, DNSKEY messages from rrset cache. */ 899 if((qtype == LDNS_RR_TYPE_DS || qtype == LDNS_RR_TYPE_DNSKEY) && 900 (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen, 901 qtype, qclass, 0, now, 0))) { 902 /* if the rrset is from the additional section, and the 903 * signatures have fallen off, then do not synthesize a msg 904 * instead, allow a full query for signed results to happen. 905 * Forego all rrset data from additional section, because 906 * some signatures may not be present and cause validation 907 * failure. 908 */ 909 struct packed_rrset_data *d = (struct packed_rrset_data*) 910 rrset->entry.data; 911 if(d->trust != rrset_trust_add_noAA && 912 d->trust != rrset_trust_add_AA && 913 (qtype == LDNS_RR_TYPE_DS || 914 (d->trust != rrset_trust_auth_noAA 915 && d->trust != rrset_trust_auth_AA) )) { 916 struct dns_msg* msg = rrset_msg(rrset, region, now, &k); 917 if(msg) { 918 lock_rw_unlock(&rrset->entry.lock); 919 return msg; 920 } 921 } 922 lock_rw_unlock(&rrset->entry.lock); 923 } 924 925 /* stop downwards cache search on NXDOMAIN. 926 * Empty nonterminals are NOERROR, so an NXDOMAIN for foo 927 * means bla.foo also does not exist. The DNSSEC proofs are 928 * the same. We search upwards for NXDOMAINs. */ 929 if(env->cfg->harden_below_nxdomain) { 930 while(!dname_is_root(k.qname)) { 931 if(dpname && dpnamelen 932 && !dname_subdomain_c(k.qname, dpname)) 933 break; /* no synth nxdomain above the stub */ 934 dname_remove_label(&k.qname, &k.qname_len); 935 h = query_info_hash(&k, flags); 936 e = slabhash_lookup(env->msg_cache, h, &k, 0); 937 if(!e && k.qtype != LDNS_RR_TYPE_A && 938 env->cfg->qname_minimisation) { 939 k.qtype = LDNS_RR_TYPE_A; 940 h = query_info_hash(&k, flags); 941 e = slabhash_lookup(env->msg_cache, h, &k, 0); 942 } 943 if(e) { 944 struct reply_info* data = (struct reply_info*)e->data; 945 struct dns_msg* msg; 946 if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN 947 && data->security == sec_status_secure 948 && (data->an_numrrsets == 0 || 949 ntohs(data->rrsets[0]->rk.type) != LDNS_RR_TYPE_CNAME) 950 && (msg=tomsg(env, &k, data, region, now, 0, scratch))) { 951 lock_rw_unlock(&e->lock); 952 msg->qinfo.qname=qname; 953 msg->qinfo.qname_len=qnamelen; 954 /* check that DNSSEC really works out */ 955 msg->rep->security = sec_status_unchecked; 956 iter_scrub_nxdomain(msg); 957 return msg; 958 } 959 lock_rw_unlock(&e->lock); 960 } 961 k.qtype = qtype; 962 } 963 } 964 965 /* fill common RR types for ANY response to avoid requery */ 966 if(qtype == LDNS_RR_TYPE_ANY) { 967 return fill_any(env, qname, qnamelen, qtype, qclass, region); 968 } 969 970 return NULL; 971} 972 973int 974dns_cache_store(struct module_env* env, struct query_info* msgqinf, 975 struct reply_info* msgrep, int is_referral, time_t leeway, int pside, 976 struct regional* region, uint32_t flags) 977{ 978 struct reply_info* rep = NULL; 979 /* alloc, malloc properly (not in region, like msg is) */ 980 rep = reply_info_copy(msgrep, env->alloc, NULL); 981 if(!rep) 982 return 0; 983 /* ttl must be relative ;i.e. 0..86400 not time(0)+86400. 984 * the env->now is added to message and RRsets in this routine. */ 985 /* the leeway is used to invalidate other rrsets earlier */ 986 987 if(is_referral) { 988 /* store rrsets */ 989 struct rrset_ref ref; 990 size_t i; 991 for(i=0; i<rep->rrset_count; i++) { 992 packed_rrset_ttl_add((struct packed_rrset_data*) 993 rep->rrsets[i]->entry.data, *env->now); 994 ref.key = rep->rrsets[i]; 995 ref.id = rep->rrsets[i]->id; 996 /*ignore ret: it was in the cache, ref updated */ 997 /* no leeway for typeNS */ 998 (void)rrset_cache_update(env->rrset_cache, &ref, 999 env->alloc, *env->now + 1000 ((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS 1001 && !pside) ? 0:leeway)); 1002 } 1003 free(rep); 1004 return 1; 1005 } else { 1006 /* store msg, and rrsets */ 1007 struct query_info qinf; 1008 hashvalue_type h; 1009 1010 qinf = *msgqinf; 1011 qinf.qname = memdup(msgqinf->qname, msgqinf->qname_len); 1012 if(!qinf.qname) { 1013 reply_info_parsedelete(rep, env->alloc); 1014 return 0; 1015 } 1016 /* fixup flags to be sensible for a reply based on the cache */ 1017 /* this module means that RA is available. It is an answer QR. 1018 * Not AA from cache. Not CD in cache (depends on client bit). */ 1019 rep->flags |= (BIT_RA | BIT_QR); 1020 rep->flags &= ~(BIT_AA | BIT_CD); 1021 h = query_info_hash(&qinf, (uint16_t)flags); 1022 dns_cache_store_msg(env, &qinf, h, rep, leeway, pside, msgrep, 1023 flags, region); 1024 /* qname is used inside query_info_entrysetup, and set to 1025 * NULL. If it has not been used, free it. free(0) is safe. */ 1026 free(qinf.qname); 1027 } 1028 return 1; 1029} 1030 1031int 1032dns_cache_prefetch_adjust(struct module_env* env, struct query_info* qinfo, 1033 time_t adjust, uint16_t flags) 1034{ 1035 struct msgreply_entry* msg; 1036 msg = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len, 1037 qinfo->qtype, qinfo->qclass, flags, *env->now, 1); 1038 if(msg) { 1039 struct reply_info* rep = (struct reply_info*)msg->entry.data; 1040 if(rep) { 1041 rep->prefetch_ttl += adjust; 1042 lock_rw_unlock(&msg->entry.lock); 1043 return 1; 1044 } 1045 lock_rw_unlock(&msg->entry.lock); 1046 } 1047 return 0; 1048} 1049