MEDIUM: resolvers/dns: split dns.c into dns.c and resolvers.c
This patch splits current dns.c into two files:
The first dns.c contains code related to DNS message exchange over UDP
and in future other TCP. We try to remove depencies to resolving
to make it usable by other stuff as DNS load balancing.
The new resolvers.c inherit of the code specific to the actual
resolvers.
Note:
It was really difficult to obtain a clean diff dur to the amount
of moved code.
Note2:
Counters and stuff related to stats is not cleany separated because
currently counters for both layers are merged and hard to separate
for now.
diff --git a/Makefile b/Makefile
index 81d9b3b..613067f 100644
--- a/Makefile
+++ b/Makefile
@@ -845,7 +845,7 @@
src/mux_h1.o src/stats.o src/flt_spoe.o src/backend.o \
src/tcpcheck.o src/server.o src/tools.o src/cli.o \
src/cfgparse.o src/log.o src/cfgparse-listen.o src/check.o \
- src/stick_table.o src/peers.o src/dns.o src/stream_interface.o \
+ src/stick_table.o src/peers.o src/resolvers.o src/stream_interface.o \
src/sample.o src/http_htx.o src/haproxy.o src/http_act.o \
src/proxy.o src/pattern.o src/listener.o src/cache.o \
src/http_fetch.o src/session.o src/connection.o src/sink.o \
@@ -871,7 +871,7 @@
src/ebimtree.o src/uri_auth.o src/freq_ctr.o src/ebsttree.o \
src/ebistree.o src/auth.o src/wdt.o src/http_acl.o \
src/hpack-enc.o src/hpack-huff.o src/ebtree.o src/base64.o \
- src/hash.o src/dgram.o src/version.o src/fix.o src/mqtt.o
+ src/hash.o src/dgram.o src/version.o src/fix.o src/mqtt.o src/dns.o
ifneq ($(TRACE),)
OBJS += src/calltrace.o
diff --git a/include/haproxy/dns-t.h b/include/haproxy/dns-t.h
index f6e2889..2261570 100644
--- a/include/haproxy/dns-t.h
+++ b/include/haproxy/dns-t.h
@@ -25,73 +25,14 @@
#include <import/eb32tree.h>
#include <haproxy/connection-t.h>
+#include <haproxy/buf-t.h>
#include <haproxy/dgram-t.h>
#include <haproxy/obj_type-t.h>
+#include <haproxy/ring-t.h>
#include <haproxy/stats-t.h>
#include <haproxy/task-t.h>
#include <haproxy/thread.h>
-extern struct pool_head *resolv_requester_pool;
-
-/*DNS maximum values */
-/*
- * Maximum issued from RFC:
- * RFC 1035: https://www.ietf.org/rfc/rfc1035.txt chapter 2.3.4
- * RFC 2671: http://tools.ietf.org/html/rfc2671
- */
-#define DNS_MAX_LABEL_SIZE 63
-#define DNS_MAX_NAME_SIZE 255
-#define DNS_MAX_UDP_MESSAGE 8192
-
-/* DNS minimum record size: 1 char + 1 NULL + type + class */
-#define DNS_MIN_RECORD_SIZE (1 + 1 + 2 + 2)
-
-/* DNS smallest fqdn 'a.gl' size */
-# define DNS_SMALLEST_FQDN_SIZE 4
-
-/* maximum number of query records in a DNS response
- * For now, we allow only one */
-#define DNS_MAX_QUERY_RECORDS 1
-
-/* maximum number of answer record in a DNS response */
-#define DNS_MAX_ANSWER_RECORDS ((DNS_MAX_UDP_MESSAGE - DNS_HEADER_SIZE) / DNS_MIN_RECORD_SIZE)
-
-/* size of dns_buffer used to store responses from the buffer
- * dns_buffer is used to store data collected from records found in a response.
- * Before using it, caller will always check that there is at least DNS_MAX_NAME_SIZE bytes
- * available */
-#define DNS_ANALYZE_BUFFER_SIZE DNS_MAX_UDP_MESSAGE + DNS_MAX_NAME_SIZE
-
-/* DNS error messages */
-#define DNS_TOO_LONG_FQDN "hostname too long"
-#define DNS_LABEL_TOO_LONG "one label too long"
-#define DNS_INVALID_CHARACTER "found an invalid character"
-
-/* dns query class */
-#define DNS_RCLASS_IN 1 /* internet class */
-
-/* dns record types (non exhaustive list) */
-#define DNS_RTYPE_A 1 /* IPv4 address */
-#define DNS_RTYPE_CNAME 5 /* canonical name */
-#define DNS_RTYPE_AAAA 28 /* IPv6 address */
-#define DNS_RTYPE_SRV 33 /* SRV record */
-#define DNS_RTYPE_OPT 41 /* OPT */
-#define DNS_RTYPE_ANY 255 /* all records */
-
-/* dns rcode values */
-#define DNS_RCODE_NO_ERROR 0 /* no error */
-#define DNS_RCODE_NX_DOMAIN 3 /* non existent domain */
-#define DNS_RCODE_REFUSED 5 /* query refused */
-
-/* dns flags masks */
-#define DNS_FLAG_TRUNCATED 0x0200 /* mask for truncated flag */
-#define DNS_FLAG_REPLYCODE 0x000F /* mask for reply code */
-
-/* max number of network preference entries are available from the
- * configuration file.
- */
-#define SRV_MAX_PREF_NET 5
-
/* DNS header size */
#define DNS_HEADER_SIZE ((int)sizeof(struct dns_header))
@@ -115,13 +56,6 @@
unsigned short qclass; /* query class */
} __attribute__ ((packed));
-/* NOTE: big endian structure */
-struct resolv_query_item {
- char name[DNS_MAX_NAME_SIZE+1]; /* query name */
- unsigned short type; /* question type */
- unsigned short class; /* query class */
- struct list list;
-};
/* NOTE: big endian structure */
struct dns_additional_record {
@@ -136,77 +70,13 @@
* extension set (client subnet, tcp keepalive, etc...)*/
} __attribute__ ((packed));
-/* NOTE: big endian structure */
-struct resolv_answer_item {
- /*For SRV type, name also includes service and protocol value */
- char name[DNS_MAX_NAME_SIZE+1]; /* answer name */
- int16_t type; /* question type */
- int16_t class; /* query class */
- int32_t ttl; /* response TTL */
- int16_t priority; /* SRV type priority */
- uint16_t weight; /* SRV type weight */
- uint16_t port; /* SRV type port */
- uint16_t data_len; /* number of bytes in target below */
- struct sockaddr address; /* IPv4 or IPv6, network format */
- char target[DNS_MAX_NAME_SIZE+1]; /* Response data: SRV or CNAME type target */
- time_t last_seen; /* When was the answer was last seen */
- struct resolv_answer_item *ar_item; /* pointer to a RRset from the additional section, if exists */
- struct list list;
-};
-
-struct resolv_response {
- struct dns_header header;
- struct list query_list;
- struct list answer_list;
- /* authority ignored for now */
-};
-
-/* Resolvers section and parameters. It is linked to the name servers
- * servers points to it.
- * current resolution are stored in a FIFO list.
- */
-struct resolvers {
- __decl_thread(HA_SPINLOCK_T lock);
- unsigned int accepted_payload_size; /* maximum payload size we accept for responses */
- int nb_nameservers; /* total number of active nameservers in a resolvers section */
- int resolve_retries; /* number of retries before giving up */
- struct { /* time to: */
- int resolve; /* wait between 2 queries for the same resolution */
- int retry; /* wait for a response before retrying */
- } timeout;
- struct { /* time to hold current data when */
- int valid; /* a response is valid */
- int nx; /* a response doesn't exist */
- int timeout; /* no answer was delivered */
- int refused; /* dns server refused to answer */
- int other; /* other dns response errors */
- int obsolete; /* an answer hasn't been seen */
- } hold;
- struct task *t; /* timeout management */
- struct {
- struct list wait; /* resolutions managed to this resolvers section */
- struct list curr; /* current running resolutions */
- } resolutions;
- struct eb_root query_ids; /* tree to quickly lookup/retrieve query ids currently in use
- * used by each nameserver, but stored in resolvers since there must
- * be a unique relation between an eb_root and an eb_node (resolution) */
- struct list list; /* resolvers list */
- struct list nameservers; /* dns server list */
- char *id; /* resolvers unique identifier */
- struct {
- const char *file; /* file where the section appears */
- int line; /* line where the section appears */
- } conf; /* config information */
-};
-
struct dns_dgram_server {
struct dgram_conn conn; /* transport layer */
struct ring *ring_req;
size_t ofs_req; // ring buffer reader offset
};
-/* Structure describing a name server used during name resolution.
- * A name server belongs to a resolvers section.
+/* Structure describing a name server
*/
struct dns_nameserver {
char *id; /* nameserver unique identifier */
@@ -225,6 +95,7 @@
struct list list; /* nameserver chained list */
};
+/* mixed dns and resolver counters, we will have to split them */
struct dns_counters {
char *id;
char *pid;
@@ -245,127 +116,4 @@
long long truncated; /* - truncated response */;
};
-struct resolv_options {
- int family_prio; /* which IP family should the resolver use when both are returned */
- struct {
- int family;
- union {
- struct in_addr in4;
- struct in6_addr in6;
- } addr;
- union {
- struct in_addr in4;
- struct in6_addr in6;
- } mask;
- } pref_net[SRV_MAX_PREF_NET];
- int pref_net_nb; /* The number of registered preferred networks. */
- int accept_duplicate_ip; /* flag to indicate whether the associated object can use an IP address
- already set to an other object of the same group */
- int ignore_weight; /* flag to indicate whether to ignore the weight within the record */
-};
-
-/* Resolution structure associated to single server and used to manage name
- * resolution for this server.
- * The only link between the resolution and a nameserver is through the
- * query_id.
- */
-struct resolv_resolution {
- struct resolvers *resolvers; /* pointer to the resolvers structure owning the resolution */
- struct list requesters; /* list of requesters using this resolution */
- int uuid; /* unique id (used for debugging purpose) */
- char *hostname_dn; /* server hostname in domain name label format */
- int hostname_dn_len; /* server domain name label len */
- unsigned int last_resolution; /* time of the last resolution */
- unsigned int last_query; /* time of the last query sent */
- unsigned int last_valid; /* time of the last valid response */
- int query_id; /* DNS query ID dedicated for this resolution */
- struct eb32_node qid; /* ebtree query id */
- int prefered_query_type; /* preferred query type */
- int query_type; /* current query type */
- int status; /* status of the resolution being processed RSLV_STATUS_* */
- int step; /* RSLV_STEP_* */
- int try; /* current resolution try */
- int nb_queries; /* count number of queries sent */
- int nb_responses; /* count number of responses received */
-
- struct resolv_response response; /* structure hosting the DNS response */
- struct resolv_query_item response_query_records[DNS_MAX_QUERY_RECORDS]; /* <response> query records */
-
- struct list list; /* resolution list */
-};
-
-/* Structure used to describe the owner of a DNS resolution. */
-struct resolv_requester {
- enum obj_type *owner; /* pointer to the owner (server or dns_srvrq) */
- struct resolv_resolution *resolution; /* pointer to the owned DNS resolution */
-
- int (*requester_cb)(struct resolv_requester *, struct dns_counters *); /* requester callback for valid response */
- int (*requester_error_cb)(struct resolv_requester *, int); /* requester callback, for error management */
-
- struct list list; /* requester list */
-};
-
-/* Last resolution status code */
-enum {
- RSLV_STATUS_NONE = 0, /* no resolution occurred yet */
- RSLV_STATUS_VALID, /* no error */
- RSLV_STATUS_INVALID, /* invalid responses */
- RSLV_STATUS_ERROR, /* error */
- RSLV_STATUS_NX, /* NXDOMAIN */
- RSLV_STATUS_REFUSED, /* server refused our query */
- RSLV_STATUS_TIMEOUT, /* no response from DNS servers */
- RSLV_STATUS_OTHER, /* other errors */
-};
-
-/* Current resolution step */
-enum {
- RSLV_STEP_NONE = 0, /* nothing happening currently */
- RSLV_STEP_RUNNING, /* resolution is running */
-};
-
-/* Return codes after analyzing a DNS response */
-enum {
- RSLV_RESP_VALID = 0, /* valid response */
- RSLV_RESP_INVALID, /* invalid response (various type of errors can trigger it) */
- RSLV_RESP_ERROR, /* DNS error code */
- RSLV_RESP_NX_DOMAIN, /* resolution unsuccessful */
- RSLV_RESP_REFUSED, /* DNS server refused to answer */
- RSLV_RESP_ANCOUNT_ZERO, /* no answers in the response */
- RSLV_RESP_WRONG_NAME, /* response does not match query name */
- RSLV_RESP_CNAME_ERROR, /* error when resolving a CNAME in an atomic response */
- RSLV_RESP_TIMEOUT, /* DNS server has not answered in time */
- RSLV_RESP_TRUNCATED, /* DNS response is truncated */
- RSLV_RESP_NO_EXPECTED_RECORD, /* No expected records were found in the response */
- RSLV_RESP_QUERY_COUNT_ERROR, /* we did not get the expected number of queries in the response */
- RSLV_RESP_INTERNAL, /* internal resolver error */
-};
-
-/* Return codes after searching an IP in a DNS response buffer, using a family
- * preference
- */
-enum {
- RSLV_UPD_NO = 1, /* provided IP was found and preference is matched
- * OR provided IP found and preference is not matched, but no IP
- * matching preference was found */
- RSLV_UPD_SRVIP_NOT_FOUND, /* provided IP not found
- * OR provided IP found and preference is not match and an IP
- * matching preference was found */
- RSLV_UPD_CNAME, /* CNAME without any IP provided in the response */
- RSLV_UPD_NAME_ERROR, /* name in the response did not match the query */
- RSLV_UPD_NO_IP_FOUND, /* no IP could be found in the response */
- RSLV_UPD_OBSOLETE_IP, /* The server IP was obsolete, and no other IP was found */
-};
-
-struct proxy;
-struct resolv_srvrq {
- enum obj_type obj_type; /* object type == OBJ_TYPE_SRVRQ */
- struct resolvers *resolvers; /* pointer to the resolvers structure used for this server template */
- struct proxy *proxy; /* associated proxy */
- char *name;
- char *hostname_dn; /* server hostname in Domain Name format */
- int hostname_dn_len; /* string length of the server hostname in Domain Name format */
- struct resolv_requester *requester; /* used to link to its DNS resolution */
- struct list list; /* Next SRV RQ for the same proxy */
-};
-
#endif /* _HAPROXY_DNS_T_H */
diff --git a/include/haproxy/dns.h b/include/haproxy/dns.h
index 5b6f0b2..dd3477d 100644
--- a/include/haproxy/dns.h
+++ b/include/haproxy/dns.h
@@ -2,7 +2,7 @@
* include/haproxy/dns.h
* This file provides functions related to DNS protocol
*
- * Copyright (C) 2014 Baptiste Assmann <bedis9@gmail.com>
+ * Copyright (C) 2020 Haproxy Technologies
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
@@ -22,37 +22,10 @@
#ifndef _HAPROXY_DNS_H
#define _HAPROXY_DNS_H
-#include <haproxy/action-t.h>
#include <haproxy/dns-t.h>
-extern struct list sec_resolvers;
-extern unsigned int resolv_failed_resolutions;
-
-struct resolvers *find_resolvers_by_id(const char *id);
-struct resolv_srvrq *find_srvrq_by_name(const char *name, struct proxy *px);
-struct resolv_srvrq *new_resolv_srvrq(struct server *srv, char *fqdn);
-
-int resolv_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len);
-int resolv_dn_label_to_str(const char *dn, int dn_len, char *str, int str_len);
-
-int resolv_hostname_validation(const char *string, char **err);
-int resolv_get_ip_from_response(struct resolv_response *r_res,
- struct resolv_options *resolv_opts, void *currentip,
- short currentip_sin_family,
- void **newip, short *newip_sin_family,
- void *owner);
-
-int resolv_link_resolution(void *requester, int requester_type, int requester_locked);
-void resolv_unlink_resolution(struct resolv_requester *requester);
-void resolv_trigger_resolution(struct resolv_requester *requester);
-enum act_parse_ret resolv_parse_do_resolve(const char **args, int *orig_arg, struct proxy *px, struct act_rule *rule, char **err);
-int check_action_do_resolve(struct act_rule *rule, struct proxy *px, char **err);
-
-int stats_dump_resolvers(struct stream_interface *si,
- struct field *stats, size_t stats_count,
- struct list *stat_modules);
-void resolv_stats_clear_counters(int clrall, struct list *stat_modules);
-int resolv_allocate_counters(struct list *stat_modules);
+int dns_send_nameserver(struct dns_nameserver *ns, void *buf, size_t len);
+ssize_t dns_recv_nameserver(struct dns_nameserver *ns, void *data, size_t size);
int dns_dgram_init(struct dns_nameserver *ns, struct sockaddr_storage *sk);
#endif // _HAPROXY_DNS_H
diff --git a/include/haproxy/resolvers-t.h b/include/haproxy/resolvers-t.h
new file mode 100644
index 0000000..4e16545
--- /dev/null
+++ b/include/haproxy/resolvers-t.h
@@ -0,0 +1,292 @@
+/*
+ * include/haproxy/dns-t.h
+ * This file provides structures and types for DNS.
+ *
+ * Copyright (C) 2014 Baptiste Assmann <bedis9@gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation, version 2.1
+ * exclusively.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef _HAPROXY_RESOLVERS_T_H
+#define _HAPROXY_RESOLVERS_T_H
+
+#include <import/eb32tree.h>
+
+#include <haproxy/connection-t.h>
+#include <haproxy/dns-t.h>
+#include <haproxy/obj_type-t.h>
+#include <haproxy/stats-t.h>
+#include <haproxy/task-t.h>
+#include <haproxy/thread.h>
+
+extern struct pool_head *resolv_requester_pool;
+
+/*DNS maximum values */
+/*
+ * Maximum issued from RFC:
+ * RFC 1035: https://www.ietf.org/rfc/rfc1035.txt chapter 2.3.4
+ * RFC 2671: http://tools.ietf.org/html/rfc2671
+ */
+#define DNS_MAX_LABEL_SIZE 63
+#define DNS_MAX_NAME_SIZE 255
+#define DNS_MAX_UDP_MESSAGE 8192
+
+/* DNS minimum record size: 1 char + 1 NULL + type + class */
+#define DNS_MIN_RECORD_SIZE (1 + 1 + 2 + 2)
+
+/* DNS smallest fqdn 'a.gl' size */
+# define DNS_SMALLEST_FQDN_SIZE 4
+
+/* maximum number of query records in a DNS response
+ * For now, we allow only one */
+#define DNS_MAX_QUERY_RECORDS 1
+
+/* maximum number of answer record in a DNS response */
+#define DNS_MAX_ANSWER_RECORDS ((DNS_MAX_UDP_MESSAGE - DNS_HEADER_SIZE) / DNS_MIN_RECORD_SIZE)
+
+/* size of dns_buffer used to store responses from the buffer
+ * dns_buffer is used to store data collected from records found in a response.
+ * Before using it, caller will always check that there is at least DNS_MAX_NAME_SIZE bytes
+ * available */
+#define DNS_ANALYZE_BUFFER_SIZE DNS_MAX_UDP_MESSAGE + DNS_MAX_NAME_SIZE
+
+/* DNS error messages */
+#define DNS_TOO_LONG_FQDN "hostname too long"
+#define DNS_LABEL_TOO_LONG "one label too long"
+#define DNS_INVALID_CHARACTER "found an invalid character"
+
+/* dns query class */
+#define DNS_RCLASS_IN 1 /* internet class */
+
+/* dns record types (non exhaustive list) */
+#define DNS_RTYPE_A 1 /* IPv4 address */
+#define DNS_RTYPE_CNAME 5 /* canonical name */
+#define DNS_RTYPE_AAAA 28 /* IPv6 address */
+#define DNS_RTYPE_SRV 33 /* SRV record */
+#define DNS_RTYPE_OPT 41 /* OPT */
+#define DNS_RTYPE_ANY 255 /* all records */
+
+/* dns rcode values */
+#define DNS_RCODE_NO_ERROR 0 /* no error */
+#define DNS_RCODE_NX_DOMAIN 3 /* non existent domain */
+#define DNS_RCODE_REFUSED 5 /* query refused */
+
+/* dns flags masks */
+#define DNS_FLAG_TRUNCATED 0x0200 /* mask for truncated flag */
+#define DNS_FLAG_REPLYCODE 0x000F /* mask for reply code */
+
+/* max number of network preference entries are available from the
+ * configuration file.
+ */
+#define SRV_MAX_PREF_NET 5
+
+/* NOTE: big endian structure */
+struct resolv_query_item {
+ char name[DNS_MAX_NAME_SIZE+1]; /* query name */
+ unsigned short type; /* question type */
+ unsigned short class; /* query class */
+ struct list list;
+};
+
+/* NOTE: big endian structure */
+struct resolv_answer_item {
+ /*For SRV type, name also includes service and protocol value */
+ char name[DNS_MAX_NAME_SIZE+1]; /* answer name */
+ int16_t type; /* question type */
+ int16_t class; /* query class */
+ int32_t ttl; /* response TTL */
+ int16_t priority; /* SRV type priority */
+ uint16_t weight; /* SRV type weight */
+ uint16_t port; /* SRV type port */
+ uint16_t data_len; /* number of bytes in target below */
+ struct sockaddr address; /* IPv4 or IPv6, network format */
+ char target[DNS_MAX_NAME_SIZE+1]; /* Response data: SRV or CNAME type target */
+ time_t last_seen; /* When was the answer was last seen */
+ struct resolv_answer_item *ar_item; /* pointer to a RRset from the additional section, if exists */
+ struct list list;
+};
+
+struct resolv_response {
+ struct dns_header header;
+ struct list query_list;
+ struct list answer_list;
+ /* authority ignored for now */
+};
+
+/* Resolvers section and parameters. It is linked to the name servers
+ * servers points to it.
+ * current resolution are stored in a FIFO list.
+ */
+struct resolvers {
+ __decl_thread(HA_SPINLOCK_T lock);
+ unsigned int accepted_payload_size; /* maximum payload size we accept for responses */
+ int nb_nameservers; /* total number of active nameservers in a resolvers section */
+ int resolve_retries; /* number of retries before giving up */
+ struct { /* time to: */
+ int resolve; /* wait between 2 queries for the same resolution */
+ int retry; /* wait for a response before retrying */
+ } timeout;
+ struct { /* time to hold current data when */
+ int valid; /* a response is valid */
+ int nx; /* a response doesn't exist */
+ int timeout; /* no answer was delivered */
+ int refused; /* dns server refused to answer */
+ int other; /* other dns response errors */
+ int obsolete; /* an answer hasn't been seen */
+ } hold;
+ struct task *t; /* timeout management */
+ struct {
+ struct list wait; /* resolutions managed to this resolvers section */
+ struct list curr; /* current running resolutions */
+ } resolutions;
+ struct eb_root query_ids; /* tree to quickly lookup/retrieve query ids currently in use
+ * used by each nameserver, but stored in resolvers since there must
+ * be a unique relation between an eb_root and an eb_node (resolution) */
+ struct list list; /* resolvers list */
+ struct list nameservers; /* dns server list */
+ struct proxy *px; /* px to handle connections to DNS servers */
+ char *id; /* resolvers unique identifier */
+ struct {
+ const char *file; /* file where the section appears */
+ int line; /* line where the section appears */
+ } conf; /* config information */
+};
+
+struct resolv_options {
+ int family_prio; /* which IP family should the resolver use when both are returned */
+ struct {
+ int family;
+ union {
+ struct in_addr in4;
+ struct in6_addr in6;
+ } addr;
+ union {
+ struct in_addr in4;
+ struct in6_addr in6;
+ } mask;
+ } pref_net[SRV_MAX_PREF_NET];
+ int pref_net_nb; /* The number of registered preferred networks. */
+ int accept_duplicate_ip; /* flag to indicate whether the associated object can use an IP address
+ already set to an other object of the same group */
+ int ignore_weight; /* flag to indicate whether to ignore the weight within the record */
+};
+
+/* Resolution structure associated to single server and used to manage name
+ * resolution for this server.
+ * The only link between the resolution and a nameserver is through the
+ * query_id.
+ */
+struct resolv_resolution {
+ struct resolvers *resolvers; /* pointer to the resolvers structure owning the resolution */
+ struct list requesters; /* list of requesters using this resolution */
+ int uuid; /* unique id (used for debugging purpose) */
+ char *hostname_dn; /* server hostname in domain name label format */
+ int hostname_dn_len; /* server domain name label len */
+ unsigned int last_resolution; /* time of the last resolution */
+ unsigned int last_query; /* time of the last query sent */
+ unsigned int last_valid; /* time of the last valid response */
+ int query_id; /* DNS query ID dedicated for this resolution */
+ struct eb32_node qid; /* ebtree query id */
+ int prefered_query_type; /* preferred query type */
+ int query_type; /* current query type */
+ int status; /* status of the resolution being processed RSLV_STATUS_* */
+ int step; /* RSLV_STEP_* */
+ int try; /* current resolution try */
+ int nb_queries; /* count number of queries sent */
+ int nb_responses; /* count number of responses received */
+
+ struct resolv_response response; /* structure hosting the DNS response */
+ struct resolv_query_item response_query_records[DNS_MAX_QUERY_RECORDS]; /* <response> query records */
+
+ struct list list; /* resolution list */
+};
+
+/* Structure used to describe the owner of a DNS resolution. */
+struct resolv_requester {
+ enum obj_type *owner; /* pointer to the owner (server or dns_srvrq) */
+ struct resolv_resolution *resolution; /* pointer to the owned DNS resolution */
+
+ int (*requester_cb)(struct resolv_requester *, struct dns_counters *); /* requester callback for valid response */
+ int (*requester_error_cb)(struct resolv_requester *, int); /* requester callback, for error management */
+
+ struct list list; /* requester list */
+};
+
+/* Last resolution status code */
+enum {
+ RSLV_STATUS_NONE = 0, /* no resolution occurred yet */
+ RSLV_STATUS_VALID, /* no error */
+ RSLV_STATUS_INVALID, /* invalid responses */
+ RSLV_STATUS_ERROR, /* error */
+ RSLV_STATUS_NX, /* NXDOMAIN */
+ RSLV_STATUS_REFUSED, /* server refused our query */
+ RSLV_STATUS_TIMEOUT, /* no response from DNS servers */
+ RSLV_STATUS_OTHER, /* other errors */
+};
+
+/* Current resolution step */
+enum {
+ RSLV_STEP_NONE = 0, /* nothing happening currently */
+ RSLV_STEP_RUNNING, /* resolution is running */
+};
+
+/* Return codes after analyzing a DNS response */
+enum {
+ RSLV_RESP_VALID = 0, /* valid response */
+ RSLV_RESP_INVALID, /* invalid response (various type of errors can trigger it) */
+ RSLV_RESP_ERROR, /* DNS error code */
+ RSLV_RESP_NX_DOMAIN, /* resolution unsuccessful */
+ RSLV_RESP_REFUSED, /* DNS server refused to answer */
+ RSLV_RESP_ANCOUNT_ZERO, /* no answers in the response */
+ RSLV_RESP_WRONG_NAME, /* response does not match query name */
+ RSLV_RESP_CNAME_ERROR, /* error when resolving a CNAME in an atomic response */
+ RSLV_RESP_TIMEOUT, /* DNS server has not answered in time */
+ RSLV_RESP_TRUNCATED, /* DNS response is truncated */
+ RSLV_RESP_NO_EXPECTED_RECORD, /* No expected records were found in the response */
+ RSLV_RESP_QUERY_COUNT_ERROR, /* we did not get the expected number of queries in the response */
+ RSLV_RESP_INTERNAL, /* internal resolver error */
+};
+
+/* Return codes after searching an IP in a DNS response buffer, using a family
+ * preference
+ */
+enum {
+ RSLV_UPD_NO = 1, /* provided IP was found and preference is matched
+ * OR provided IP found and preference is not matched, but no IP
+ * matching preference was found.
+ */
+ RSLV_UPD_SRVIP_NOT_FOUND, /* provided IP not found
+ * OR provided IP found and preference is not match and an IP
+ * matching preference was found.
+ */
+ RSLV_UPD_CNAME, /* CNAME without any IP provided in the response */
+ RSLV_UPD_NAME_ERROR, /* name in the response did not match the query */
+ RSLV_UPD_NO_IP_FOUND, /* no IP could be found in the response */
+ RSLV_UPD_OBSOLETE_IP, /* The server IP was obsolete, and no other IP was found */
+};
+
+struct proxy;
+struct resolv_srvrq {
+ enum obj_type obj_type; /* object type == OBJ_TYPE_SRVRQ */
+ struct resolvers *resolvers; /* pointer to the resolvers structure used for this server template */
+ struct proxy *proxy; /* associated proxy */
+ char *name;
+ char *hostname_dn; /* server hostname in Domain Name format */
+ int hostname_dn_len; /* string length of the server hostname in Domain Name format */
+ struct resolv_requester *requester; /* used to link to its DNS resolution */
+ struct list list; /* Next SRV RQ for the same proxy */
+};
+
+#endif /* _HAPROXY_RESOLVERS_T_H */
diff --git a/include/haproxy/resolvers.h b/include/haproxy/resolvers.h
new file mode 100644
index 0000000..342c1f1
--- /dev/null
+++ b/include/haproxy/resolvers.h
@@ -0,0 +1,58 @@
+/*
+ * include/haproxy/dns.h
+ * This file provides functions related to DNS protocol
+ *
+ * Copyright (C) 2014 Baptiste Assmann <bedis9@gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation, version 2.1
+ * exclusively.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef _HAPROXY_RESOLVERS_H
+#define _HAPROXY_RESOLVERS_H
+
+#include <haproxy/action-t.h>
+#include <haproxy/resolvers-t.h>
+
+extern struct list sec_resolvers;
+extern unsigned int resolv_failed_resolutions;
+
+struct resolvers *find_resolvers_by_id(const char *id);
+struct resolv_srvrq *find_srvrq_by_name(const char *name, struct proxy *px);
+struct resolv_srvrq *new_resolv_srvrq(struct server *srv, char *fqdn);
+
+int resolv_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len);
+int resolv_dn_label_to_str(const char *dn, int dn_len, char *str, int str_len);
+
+int resolv_hostname_validation(const char *string, char **err);
+int resolv_get_ip_from_response(struct resolv_response *r_res,
+ struct resolv_options *resolv_opts, void *currentip,
+ short currentip_sin_family,
+ void **newip, short *newip_sin_family,
+ void *owner);
+
+int resolv_link_resolution(void *requester, int requester_type, int requester_locked);
+void resolv_unlink_resolution(struct resolv_requester *requester);
+void resolv_trigger_resolution(struct resolv_requester *requester);
+enum act_parse_ret resolv_parse_do_resolve(const char **args, int *orig_arg, struct proxy *px, struct act_rule *rule, char **err);
+int check_action_do_resolve(struct act_rule *rule, struct proxy *px, char **err);
+
+int stats_dump_resolvers(struct stream_interface *si,
+ struct field *stats, size_t stats_count,
+ struct list *stat_modules);
+void resolv_stats_clear_counters(int clrall, struct list *stat_modules);
+int resolv_allocate_counters(struct list *stat_modules);
+int dns_dgram_init(struct dns_nameserver *ns, struct sockaddr_storage *sk);
+
+#endif // _HAPROXY_RESOLVER_H
diff --git a/include/haproxy/server-t.h b/include/haproxy/server-t.h
index b1840fd..7f58edd 100644
--- a/include/haproxy/server-t.h
+++ b/include/haproxy/server-t.h
@@ -32,11 +32,11 @@
#include <haproxy/check-t.h>
#include <haproxy/connection-t.h>
#include <haproxy/counters-t.h>
-#include <haproxy/dns-t.h>
#include <haproxy/freq_ctr-t.h>
#include <haproxy/listener-t.h>
#include <haproxy/obj_type-t.h>
#include <haproxy/openssl-compat.h>
+#include <haproxy/resolvers-t.h>
#include <haproxy/ssl_sock-t.h>
#include <haproxy/stats-t.h>
#include <haproxy/task-t.h>
diff --git a/include/haproxy/server.h b/include/haproxy/server.h
index 987a385..bbf2174 100644
--- a/include/haproxy/server.h
+++ b/include/haproxy/server.h
@@ -26,9 +26,9 @@
#include <haproxy/api.h>
#include <haproxy/applet-t.h>
-#include <haproxy/dns-t.h>
#include <haproxy/freq_ctr.h>
#include <haproxy/proxy-t.h>
+#include <haproxy/resolvers-t.h>
#include <haproxy/server-t.h>
#include <haproxy/task.h>
#include <haproxy/thread-t.h>
diff --git a/src/cfgparse.c b/src/cfgparse.c
index 0c0638e..8ceecf2 100644
--- a/src/cfgparse.c
+++ b/src/cfgparse.c
@@ -44,7 +44,6 @@
#include <haproxy/check.h>
#include <haproxy/chunk.h>
#include <haproxy/connection.h>
-#include <haproxy/dns.h>
#include <haproxy/errors.h>
#include <haproxy/filters.h>
#include <haproxy/frontend.h>
@@ -66,6 +65,7 @@
#include <haproxy/pool.h>
#include <haproxy/protocol.h>
#include <haproxy/proxy.h>
+#include <haproxy/resolvers.h>
#include <haproxy/sample.h>
#include <haproxy/server.h>
#include <haproxy/session.h>
diff --git a/src/check.c b/src/check.c
index 4f45c23..d37a552 100644
--- a/src/check.c
+++ b/src/check.c
@@ -36,7 +36,6 @@
#include <haproxy/check.h>
#include <haproxy/chunk.h>
#include <haproxy/dgram.h>
-#include <haproxy/dns.h>
#include <haproxy/dynbuf-t.h>
#include <haproxy/extcheck.h>
#include <haproxy/fd.h>
@@ -55,6 +54,7 @@
#include <haproxy/proxy.h>
#include <haproxy/queue.h>
#include <haproxy/regex.h>
+#include <haproxy/resolvers.h>
#include <haproxy/sample.h>
#include <haproxy/server.h>
#include <haproxy/ssl_sock.h>
diff --git a/src/dns.c b/src/dns.c
index ceca0a3..5fc656f 100644
--- a/src/dns.c
+++ b/src/dns.c
@@ -1,7 +1,7 @@
/*
* Name server resolution
*
- * Copyright 2014 Baptiste Assmann <bedis9@gmail.com>
+ * Copyright 2020 Haproxy Technologies
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
@@ -29,238 +29,11 @@
#include <haproxy/dns.h>
#include <haproxy/errors.h>
#include <haproxy/fd.h>
-#include <haproxy/global.h>
-#include <haproxy/http_rules.h>
#include <haproxy/log.h>
-#include <haproxy/net_helper.h>
-#include <haproxy/protocol.h>
-#include <haproxy/proxy.h>
#include <haproxy/ring.h>
-#include <haproxy/sample.h>
-#include <haproxy/server.h>
-#include <haproxy/stats.h>
-#include <haproxy/stream_interface.h>
-#include <haproxy/task.h>
-#include <haproxy/tcp_rules.h>
-#include <haproxy/ticks.h>
-#include <haproxy/time.h>
-#include <haproxy/vars.h>
static THREAD_LOCAL char *dns_msg_trash;
-struct list sec_resolvers = LIST_HEAD_INIT(sec_resolvers);
-struct list resolv_srvrq_list = LIST_HEAD_INIT(resolv_srvrq_list);
-
-static THREAD_LOCAL uint64_t resolv_query_id_seed = 0; /* random seed */
-struct resolvers *curr_resolvers = NULL;
-
-DECLARE_STATIC_POOL(resolv_answer_item_pool, "resolv_answer_item", sizeof(struct resolv_answer_item));
-DECLARE_STATIC_POOL(resolv_resolution_pool, "resolv_resolution", sizeof(struct resolv_resolution));
-DECLARE_POOL(resolv_requester_pool, "resolv_requester", sizeof(struct resolv_requester));
-
-static unsigned int resolution_uuid = 1;
-unsigned int resolv_failed_resolutions = 0;
-
-enum {
- DNS_STAT_ID,
- DNS_STAT_PID,
- DNS_STAT_SENT,
- DNS_STAT_SND_ERROR,
- DNS_STAT_VALID,
- DNS_STAT_UPDATE,
- DNS_STAT_CNAME,
- DNS_STAT_CNAME_ERROR,
- DNS_STAT_ANY_ERR,
- DNS_STAT_NX,
- DNS_STAT_TIMEOUT,
- DNS_STAT_REFUSED,
- DNS_STAT_OTHER,
- DNS_STAT_INVALID,
- DNS_STAT_TOO_BIG,
- DNS_STAT_TRUNCATED,
- DNS_STAT_OUTDATED,
- DNS_STAT_END,
-};
-
-static struct name_desc dns_stats[] = {
- [DNS_STAT_ID] = { .name = "id", .desc = "ID" },
- [DNS_STAT_PID] = { .name = "pid", .desc = "Parent ID" },
- [DNS_STAT_SENT] = { .name = "sent", .desc = "Sent" },
- [DNS_STAT_SND_ERROR] = { .name = "send_error", .desc = "Send error" },
- [DNS_STAT_VALID] = { .name = "valid", .desc = "Valid" },
- [DNS_STAT_UPDATE] = { .name = "update", .desc = "Update" },
- [DNS_STAT_CNAME] = { .name = "cname", .desc = "CNAME" },
- [DNS_STAT_CNAME_ERROR] = { .name = "cname_error", .desc = "CNAME error" },
- [DNS_STAT_ANY_ERR] = { .name = "any_err", .desc = "Any errors" },
- [DNS_STAT_NX] = { .name = "nx", .desc = "NX" },
- [DNS_STAT_TIMEOUT] = { .name = "timeout", .desc = "Timeout" },
- [DNS_STAT_REFUSED] = { .name = "refused", .desc = "Refused" },
- [DNS_STAT_OTHER] = { .name = "other", .desc = "Other" },
- [DNS_STAT_INVALID] = { .name = "invalid", .desc = "Invalid" },
- [DNS_STAT_TOO_BIG] = { .name = "too_big", .desc = "Too big" },
- [DNS_STAT_TRUNCATED] = { .name = "truncated", .desc = "Truncated" },
- [DNS_STAT_OUTDATED] = { .name = "outdated", .desc = "Outdated" },
-};
-
-static struct dns_counters dns_counters;
-
-static void dns_fill_stats(void *d, struct field *stats)
-{
- struct dns_counters *counters = d;
- stats[DNS_STAT_ID] = mkf_str(FO_CONFIG, counters->id);
- stats[DNS_STAT_PID] = mkf_str(FO_CONFIG, counters->pid);
- stats[DNS_STAT_SENT] = mkf_u64(FN_GAUGE, counters->sent);
- stats[DNS_STAT_SND_ERROR] = mkf_u64(FN_GAUGE, counters->snd_error);
- stats[DNS_STAT_VALID] = mkf_u64(FN_GAUGE, counters->valid);
- stats[DNS_STAT_UPDATE] = mkf_u64(FN_GAUGE, counters->update);
- stats[DNS_STAT_CNAME] = mkf_u64(FN_GAUGE, counters->cname);
- stats[DNS_STAT_CNAME_ERROR] = mkf_u64(FN_GAUGE, counters->cname_error);
- stats[DNS_STAT_ANY_ERR] = mkf_u64(FN_GAUGE, counters->any_err);
- stats[DNS_STAT_NX] = mkf_u64(FN_GAUGE, counters->nx);
- stats[DNS_STAT_TIMEOUT] = mkf_u64(FN_GAUGE, counters->timeout);
- stats[DNS_STAT_REFUSED] = mkf_u64(FN_GAUGE, counters->refused);
- stats[DNS_STAT_OTHER] = mkf_u64(FN_GAUGE, counters->other);
- stats[DNS_STAT_INVALID] = mkf_u64(FN_GAUGE, counters->invalid);
- stats[DNS_STAT_TOO_BIG] = mkf_u64(FN_GAUGE, counters->too_big);
- stats[DNS_STAT_TRUNCATED] = mkf_u64(FN_GAUGE, counters->truncated);
- stats[DNS_STAT_OUTDATED] = mkf_u64(FN_GAUGE, counters->outdated);
-}
-
-static struct stats_module dns_stats_module = {
- .name = "dns",
- .domain_flags = STATS_DOMAIN_DNS << STATS_DOMAIN,
- .fill_stats = dns_fill_stats,
- .stats = dns_stats,
- .stats_count = DNS_STAT_END,
- .counters = &dns_counters,
- .counters_size = sizeof(dns_counters),
- .clearable = 0,
-};
-
-INITCALL1(STG_REGISTER, stats_register_module, &dns_stats_module);
-
-/* Returns a pointer to the resolvers matching the id <id>. NULL is returned if
- * no match is found.
- */
-struct resolvers *find_resolvers_by_id(const char *id)
-{
- struct resolvers *res;
-
- list_for_each_entry(res, &sec_resolvers, list) {
- if (strcmp(res->id, id) == 0)
- return res;
- }
- return NULL;
-}
-
-/* Compare hostnames in a case-insensitive way .
- * Returns 0 if they are the same, non-zero otherwise
- */
-static __inline int resolv_hostname_cmp(const char *name1, const char *name2, int len)
-{
- int i;
-
- for (i = 0; i < len; i++)
- if (tolower((unsigned char)name1[i]) != tolower((unsigned char)name2[i]))
- return -1;
- return 0;
-}
-
-/* Returns a pointer on the SRV request matching the name <name> for the proxy
- * <px>. NULL is returned if no match is found.
- */
-struct resolv_srvrq *find_srvrq_by_name(const char *name, struct proxy *px)
-{
- struct resolv_srvrq *srvrq;
-
- list_for_each_entry(srvrq, &resolv_srvrq_list, list) {
- if (srvrq->proxy == px && strcmp(srvrq->name, name) == 0)
- return srvrq;
- }
- return NULL;
-}
-
-/* Allocates a new SRVRQ for the given server with the name <fqdn>. It returns
- * NULL if an error occurred. */
-struct resolv_srvrq *new_resolv_srvrq(struct server *srv, char *fqdn)
-{
- struct proxy *px = srv->proxy;
- struct resolv_srvrq *srvrq = NULL;
- int fqdn_len, hostname_dn_len;
-
- fqdn_len = strlen(fqdn);
- hostname_dn_len = resolv_str_to_dn_label(fqdn, fqdn_len + 1, trash.area,
- trash.size);
- if (hostname_dn_len == -1) {
- ha_alert("config : %s '%s', server '%s': failed to parse FQDN '%s'\n",
- proxy_type_str(px), px->id, srv->id, fqdn);
- goto err;
- }
-
- if ((srvrq = calloc(1, sizeof(*srvrq))) == NULL) {
- ha_alert("config : %s '%s', server '%s': out of memory\n",
- proxy_type_str(px), px->id, srv->id);
- goto err;
- }
- srvrq->obj_type = OBJ_TYPE_SRVRQ;
- srvrq->proxy = px;
- srvrq->name = strdup(fqdn);
- srvrq->hostname_dn = strdup(trash.area);
- srvrq->hostname_dn_len = hostname_dn_len;
- if (!srvrq->name || !srvrq->hostname_dn) {
- ha_alert("config : %s '%s', server '%s': out of memory\n",
- proxy_type_str(px), px->id, srv->id);
- goto err;
- }
- LIST_ADDQ(&resolv_srvrq_list, &srvrq->list);
- return srvrq;
-
- err:
- if (srvrq) {
- free(srvrq->name);
- free(srvrq->hostname_dn);
- free(srvrq);
- }
- return NULL;
-}
-
-
-/* 2 bytes random generator to generate DNS query ID */
-static inline uint16_t resolv_rnd16(void)
-{
- if (!resolv_query_id_seed)
- resolv_query_id_seed = now_ms;
- resolv_query_id_seed ^= resolv_query_id_seed << 13;
- resolv_query_id_seed ^= resolv_query_id_seed >> 7;
- resolv_query_id_seed ^= resolv_query_id_seed << 17;
- return resolv_query_id_seed;
-}
-
-
-static inline int resolv_resolution_timeout(struct resolv_resolution *res)
-{
- return res->resolvers->timeout.resolve;
-}
-
-/* Updates a resolvers' task timeout for next wake up and queue it */
-static void resolv_update_resolvers_timeout(struct resolvers *resolvers)
-{
- struct resolv_resolution *res;
- int next;
-
- next = tick_add(now_ms, resolvers->timeout.resolve);
- if (!LIST_ISEMPTY(&resolvers->resolutions.curr)) {
- res = LIST_NEXT(&resolvers->resolutions.curr, struct resolv_resolution *, list);
- next = MIN(next, tick_add(res->last_query, resolvers->timeout.retry));
- }
-
- list_for_each_entry(res, &resolvers->resolutions.wait, list)
- next = MIN(next, tick_add(res->last_resolution, resolv_resolution_timeout(res)));
-
- resolvers->t->expire = next;
- task_queue(resolvers->t);
-}
-
/* Opens an UDP socket on the namesaver's IP/Port, if required. Returns 0 on
* success, -1 otherwise.
*/
@@ -277,15 +50,15 @@
/* Create an UDP socket and connect it on the nameserver's IP/Port */
if ((fd = socket(dgram->addr.to.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
send_log(NULL, LOG_WARNING,
- "DNS : resolvers '%s': can't create socket for nameserver '%s'.\n",
+ "DNS : section '%s': can't create socket for nameserver '%s'.\n",
ns->counters->pid, ns->id);
return -1;
}
if (connect(fd, (struct sockaddr*)&dgram->addr.to, get_addr_len(&dgram->addr.to)) == -1) {
send_log(NULL, LOG_WARNING,
- "DNS : resolvers '%s': can't connect socket for nameserver '%s'.\n",
+ "DNS : section '%s': can't connect socket for nameserver '%s'.\n",
ns->counters->id, ns->id);
- close(fd);
+ close(fd);
return -1;
}
@@ -296,64 +69,8 @@
dgram->t.sock.fd = fd;
fd_insert(fd, dgram, dgram_fd_handler, MAX_THREADS_MASK);
fd_want_recv(fd);
- }
- return 0;
-}
-
-/* Forges a DNS query. It needs the following information from the caller:
- * - <query_id> : the DNS query id corresponding to this query
- * - <query_type> : DNS_RTYPE_* request DNS record type (A, AAAA, ANY...)
- * - <hostname_dn> : hostname in domain name format
- * - <hostname_dn_len> : length of <hostname_dn>
- *
- * To store the query, the caller must pass a buffer <buf> and its size
- * <bufsize>. It returns the number of written bytes in success, -1 if <buf> is
- * too short.
- */
-static int resolv_build_query(int query_id, int query_type, unsigned int accepted_payload_size,
- char *hostname_dn, int hostname_dn_len, char *buf, int bufsize)
-{
- struct dns_header dns_hdr;
- struct dns_question qinfo;
- struct dns_additional_record edns;
- char *p = buf;
-
- if (sizeof(dns_hdr) + sizeof(qinfo) + sizeof(edns) + hostname_dn_len >= bufsize)
- return -1;
-
- memset(buf, 0, bufsize);
-
- /* Set dns query headers */
- dns_hdr.id = (unsigned short) htons(query_id);
- dns_hdr.flags = htons(0x0100); /* qr=0, opcode=0, aa=0, tc=0, rd=1, ra=0, z=0, rcode=0 */
- dns_hdr.qdcount = htons(1); /* 1 question */
- dns_hdr.ancount = 0;
- dns_hdr.nscount = 0;
- dns_hdr.arcount = htons(1);
- memcpy(p, &dns_hdr, sizeof(dns_hdr));
- p += sizeof(dns_hdr);
-
- /* Set up query hostname */
- memcpy(p, hostname_dn, hostname_dn_len);
- p += hostname_dn_len;
- *p++ = 0;
-
- /* Set up query info (type and class) */
- qinfo.qtype = htons(query_type);
- qinfo.qclass = htons(DNS_RCLASS_IN);
- memcpy(p, &qinfo, sizeof(qinfo));
- p += sizeof(qinfo);
-
- /* Set the DNS extension */
- edns.name = 0;
- edns.type = htons(DNS_RTYPE_OPT);
- edns.udp_payload_size = htons(accepted_payload_size);
- edns.extension = 0;
- edns.data_length = 0;
- memcpy(p, &edns, sizeof(edns));
- p += sizeof(edns);
-
- return (p - buf);
+ }
+ return 0;
}
/* Sends a message to a name server
@@ -551,2936 +268,64 @@
}
-/* Sends a DNS query to resolvers associated to a resolution. It returns 0 on
- * success, -1 otherwise.
- */
-static int resolv_send_query(struct resolv_resolution *resolution)
-{
- struct resolvers *resolvers = resolution->resolvers;
- struct dns_nameserver *ns;
- int len;
-
- /* Update resolution */
- resolution->nb_queries = 0;
- resolution->nb_responses = 0;
- resolution->last_query = now_ms;
-
- len = resolv_build_query(resolution->query_id, resolution->query_type,
- resolvers->accepted_payload_size,
- resolution->hostname_dn, resolution->hostname_dn_len,
- trash.area, trash.size);
-
- list_for_each_entry(ns, &resolvers->nameservers, list) {
- if (len < 0) {
- ns->counters->snd_error++;
- continue;
- }
-
- if (dns_send_nameserver(ns, trash.area, len) < 0)
- ns->counters->snd_error++;
- else
- resolution->nb_queries++;
- }
-
- /* Push the resolution at the end of the active list */
- LIST_DEL(&resolution->list);
- LIST_ADDQ(&resolvers->resolutions.curr, &resolution->list);
- return 0;
-}
+/* proto_udp callback functions for a DNS resolution */
+struct dgram_data_cb dns_dgram_cb = {
+ .recv = dns_resolve_recv,
+ .send = dns_resolve_send,
+};
-/* Prepares and sends a DNS resolution. It returns 1 if the query was sent, 0 if
- * skipped and -1 if an error occurred.
- */
-static int
-resolv_run_resolution(struct resolv_resolution *resolution)
+int dns_dgram_init(struct dns_nameserver *ns, struct sockaddr_storage *sk)
{
- struct resolvers *resolvers = resolution->resolvers;
- int query_id, i;
-
- /* Avoid sending requests for resolutions that don't yet have an
- * hostname, ie resolutions linked to servers that do not yet have an
- * fqdn */
- if (!resolution->hostname_dn)
- return 0;
-
- /* Check if a resolution has already been started for this server return
- * directly to avoid resolution pill up. */
- if (resolution->step != RSLV_STEP_NONE)
- return 0;
+ struct dns_dgram_server *dgram;
- /* Generates a new query id. We try at most 100 times to find a free
- * query id */
- for (i = 0; i < 100; ++i) {
- query_id = resolv_rnd16();
- if (!eb32_lookup(&resolvers->query_ids, query_id))
- break;
- query_id = -1;
- }
- if (query_id == -1) {
- send_log(NULL, LOG_NOTICE,
- "could not generate a query id for %s, in resolvers %s.\n",
- resolution->hostname_dn, resolvers->id);
+ if ((dgram = calloc(1, sizeof(*dgram))) == NULL)
return -1;
- }
-
- /* Update resolution parameters */
- resolution->query_id = query_id;
- resolution->qid.key = query_id;
- resolution->step = RSLV_STEP_RUNNING;
- resolution->query_type = resolution->prefered_query_type;
- resolution->try = resolvers->resolve_retries;
- eb32_insert(&resolvers->query_ids, &resolution->qid);
-
- /* Send the DNS query */
- resolution->try -= 1;
- resolv_send_query(resolution);
- return 1;
-}
-
-/* Performs a name resolution for the requester <req> */
-void resolv_trigger_resolution(struct resolv_requester *req)
-{
- struct resolvers *resolvers;
- struct resolv_resolution *res;
- int exp;
-
- if (!req || !req->resolution)
- return;
- res = req->resolution;
- resolvers = res->resolvers;
-
- /* The resolution must not be triggered yet. Use the cached response, if
- * valid */
- exp = tick_add(res->last_resolution, resolvers->hold.valid);
- if (resolvers->t && (res->status != RSLV_STATUS_VALID ||
- !tick_isset(res->last_resolution) || tick_is_expired(exp, now_ms)))
- task_wakeup(resolvers->t, TASK_WOKEN_OTHER);
-}
-
-
-/* Resets some resolution parameters to initial values and also delete the query
- * ID from the resolver's tree.
- */
-static void resolv_reset_resolution(struct resolv_resolution *resolution)
-{
- /* update resolution status */
- resolution->step = RSLV_STEP_NONE;
- resolution->try = 0;
- resolution->last_resolution = now_ms;
- resolution->nb_queries = 0;
- resolution->nb_responses = 0;
- resolution->query_type = resolution->prefered_query_type;
-
- /* clean up query id */
- eb32_delete(&resolution->qid);
- resolution->query_id = 0;
- resolution->qid.key = 0;
-}
-
-/* Returns the query id contained in a DNS response */
-static inline unsigned short resolv_response_get_query_id(unsigned char *resp)
-{
- return resp[0] * 256 + resp[1];
-}
-
-
-/* Analyses, re-builds and copies the name <name> from the DNS response packet
- * <buffer>. <name> must point to the 'data_len' information or pointer 'c0'
- * for compressed data. The result is copied into <dest>, ensuring we don't
- * overflow using <dest_len> Returns the number of bytes the caller can move
- * forward. If 0 it means an error occurred while parsing the name. <offset> is
- * the number of bytes the caller could move forward.
- */
-int resolv_read_name(unsigned char *buffer, unsigned char *bufend,
- unsigned char *name, char *destination, int dest_len,
- int *offset, unsigned int depth)
-{
- int nb_bytes = 0, n = 0;
- int label_len;
- unsigned char *reader = name;
- char *dest = destination;
- while (1) {
- if (reader >= bufend)
- goto err;
-
- /* Name compression is in use */
- if ((*reader & 0xc0) == 0xc0) {
- if (reader + 1 >= bufend)
- goto err;
-
- /* Must point BEFORE current position */
- if ((buffer + reader[1]) > reader)
- goto err;
-
- if (depth++ > 100)
- goto err;
-
- n = resolv_read_name(buffer, bufend, buffer + (*reader & 0x3f)*256 + reader[1],
- dest, dest_len - nb_bytes, offset, depth);
- if (n == 0)
- goto err;
-
- dest += n;
- nb_bytes += n;
- goto out;
- }
-
- label_len = *reader;
- if (label_len == 0)
- goto out;
-
- /* Check if:
- * - we won't read outside the buffer
- * - there is enough place in the destination
- */
- if ((reader + label_len >= bufend) || (nb_bytes + label_len >= dest_len))
- goto err;
-
- /* +1 to take label len + label string */
- label_len++;
-
- memcpy(dest, reader, label_len);
+ /* Leave dgram partially initialized, no FD attached for
+ * now. */
+ dgram->conn.owner = ns;
+ dgram->conn.data = &dns_dgram_cb;
+ dgram->conn.t.sock.fd = -1;
+ dgram->conn.addr.to = *sk;
+ ns->dgram = dgram;
- dest += label_len;
- nb_bytes += label_len;
- reader += label_len;
+ dgram->ofs_req = ~0; /* init ring offset */
+ dgram->ring_req = ring_new(2*DNS_TCP_MSG_RING_MAX_SIZE);
+ if (!dgram->ring_req) {
+ ha_alert("memory allocation error initializing the ring for nameserver.\n");
+ goto out;
}
- out:
- /* offset computation:
- * parse from <name> until finding either NULL or a pointer "c0xx"
- */
- reader = name;
- *offset = 0;
- while (reader < bufend) {
- if ((reader[0] & 0xc0) == 0xc0) {
- *offset += 2;
- break;
- }
- else if (*reader == 0) {
- *offset += 1;
- break;
- }
- *offset += 1;
- ++reader;
+ /* attach the task as reader */
+ if (!ring_attach(dgram->ring_req)) {
+ /* mark server attached to the ring */
+ ha_alert("nameserver sets too many watchers > 255 on ring. This is a bug and should not happen.\n");
+ goto out;
}
- return nb_bytes;
-
- err:
return 0;
-}
-
-/* Checks for any obsolete record, also identify any SRV request, and try to
- * find a corresponding server.
-*/
-static void resolv_check_response(struct resolv_resolution *res)
-{
- struct resolvers *resolvers = res->resolvers;
- struct resolv_requester *req, *reqback;
- struct resolv_answer_item *item, *itemback;
- struct server *srv;
- struct resolv_srvrq *srvrq;
-
- list_for_each_entry_safe(item, itemback, &res->response.answer_list, list) {
- struct resolv_answer_item *ar_item = item->ar_item;
-
- /* clean up obsolete Additional record */
- if (ar_item && (ar_item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
- pool_free(resolv_answer_item_pool, ar_item);
- item->ar_item = NULL;
- }
-
- /* Remove obsolete items */
- if ((item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
- if (item->type != DNS_RTYPE_SRV)
- goto rm_obselete_item;
-
- list_for_each_entry_safe(req, reqback, &res->requesters, list) {
- if ((srvrq = objt_resolv_srvrq(req->owner)) == NULL)
- continue;
-
- /* Remove any associated server */
- for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
- HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
- if (srv->srvrq == srvrq && srv->svc_port == item->port &&
- item->data_len == srv->hostname_dn_len &&
- !resolv_hostname_cmp(srv->hostname_dn, item->target, item->data_len)) {
- snr_update_srv_status(srv, 1);
- free(srv->hostname);
- free(srv->hostname_dn);
- srv->hostname = NULL;
- srv->hostname_dn = NULL;
- srv->hostname_dn_len = 0;
- resolv_unlink_resolution(srv->resolv_requester);
- }
- HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
- }
- }
-
- rm_obselete_item:
- LIST_DEL(&item->list);
- if (item->ar_item) {
- pool_free(resolv_answer_item_pool, item->ar_item);
- item->ar_item = NULL;
- }
- pool_free(resolv_answer_item_pool, item);
- continue;
- }
-
- if (item->type != DNS_RTYPE_SRV)
- continue;
-
- /* Now process SRV records */
- list_for_each_entry_safe(req, reqback, &res->requesters, list) {
- if ((srvrq = objt_resolv_srvrq(req->owner)) == NULL)
- continue;
-
- /* Check if a server already uses that hostname */
- for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
- HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
- if (srv->srvrq == srvrq && srv->svc_port == item->port &&
- item->data_len == srv->hostname_dn_len &&
- !resolv_hostname_cmp(srv->hostname_dn, item->target, item->data_len)) {
- break;
- }
- HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
- }
-
- /* If not, try to find a server with undefined hostname */
- if (!srv) {
- for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
- HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
- if (srv->srvrq == srvrq && !srv->hostname_dn)
- break;
- HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
- }
- }
-
- /* And update this server, if found (srv is locked here) */
- if (srv) {
- /* Check if an Additional Record is associated to this SRV record.
- * Perform some sanity checks too to ensure the record can be used.
- * If all fine, we simply pick up the IP address found and associate
- * it to the server.
- */
- if ((item->ar_item != NULL) &&
- (item->ar_item->type == DNS_RTYPE_A || item->ar_item->type == DNS_RTYPE_AAAA))
- {
-
- switch (item->ar_item->type) {
- case DNS_RTYPE_A:
- update_server_addr(srv, &(((struct sockaddr_in*)&item->ar_item->address)->sin_addr), AF_INET, "DNS additional record");
- break;
- case DNS_RTYPE_AAAA:
- update_server_addr(srv, &(((struct sockaddr_in6*)&item->ar_item->address)->sin6_addr), AF_INET6, "DNS additional record");
- break;
- }
-
- srv->flags |= SRV_F_NO_RESOLUTION;
- }
-
- if (!srv->hostname_dn) {
- const char *msg = NULL;
- char hostname[DNS_MAX_NAME_SIZE];
-
- if (resolv_dn_label_to_str(item->target, item->data_len+1,
- hostname, DNS_MAX_NAME_SIZE) == -1) {
- HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
- continue;
- }
- msg = update_server_fqdn(srv, hostname, "SRV record", 1);
- if (msg)
- send_log(srv->proxy, LOG_NOTICE, "%s", msg);
- }
-
- /* now we have an IP address associated to this server, we can update its status */
- snr_update_srv_status(srv, 0);
-
- srv->svc_port = item->port;
- srv->flags &= ~SRV_F_MAPPORTS;
-
- if (!srv->resolv_opts.ignore_weight) {
- char weight[9];
- int ha_weight;
+out:
+ if (dgram->ring_req)
+ ring_free(dgram->ring_req);
- /* DNS weight range if from 0 to 65535
- * HAProxy weight is from 0 to 256
- * The rule below ensures that weight 0 is well respected
- * while allowing a "mapping" from DNS weight into HAProxy's one.
- */
- ha_weight = (item->weight + 255) / 256;
+ free(dgram);
- snprintf(weight, sizeof(weight), "%d", ha_weight);
- server_parse_weight_change_request(srv, weight);
- }
- HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
- }
- }
- }
+ return -1;
}
-/* Validates that the buffer DNS response provided in <resp> and finishing
- * before <bufend> is valid from a DNS protocol point of view.
- *
- * The result is stored in <resolution>' response, buf_response,
- * response_query_records and response_answer_records members.
- *
- * This function returns one of the RSLV_RESP_* code to indicate the type of
- * error found.
- */
-static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufend,
- struct resolv_resolution *resolution, int max_answer_records)
+int init_dns_buffers()
{
- unsigned char *reader;
- char *previous_dname, tmpname[DNS_MAX_NAME_SIZE];
- int len, flags, offset;
- int query_record_id;
- int nb_saved_records;
- struct resolv_query_item *query;
- struct resolv_answer_item *answer_record, *tmp_record;
- struct resolv_response *r_res;
- int i, found = 0;
- int cause = RSLV_RESP_ERROR;
-
- reader = resp;
- len = 0;
- previous_dname = NULL;
- query = NULL;
- answer_record = NULL;
-
- /* Initialization of response buffer and structure */
- r_res = &resolution->response;
-
- /* query id */
- if (reader + 2 >= bufend)
- goto invalid_resp;
-
- r_res->header.id = reader[0] * 256 + reader[1];
- reader += 2;
-
- /* Flags and rcode are stored over 2 bytes
- * First byte contains:
- * - response flag (1 bit)
- * - opcode (4 bits)
- * - authoritative (1 bit)
- * - truncated (1 bit)
- * - recursion desired (1 bit)
- */
- if (reader + 2 >= bufend)
- goto invalid_resp;
-
- flags = reader[0] * 256 + reader[1];
-
- if ((flags & DNS_FLAG_REPLYCODE) != DNS_RCODE_NO_ERROR) {
- if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_NX_DOMAIN) {
- cause = RSLV_RESP_NX_DOMAIN;
- goto return_error;
- }
- else if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_REFUSED) {
- cause = RSLV_RESP_REFUSED;
- goto return_error;
- }
- else {
- cause = RSLV_RESP_ERROR;
- goto return_error;
- }
- }
-
- /* Move forward 2 bytes for flags */
- reader += 2;
-
- /* 2 bytes for question count */
- if (reader + 2 >= bufend)
- goto invalid_resp;
- r_res->header.qdcount = reader[0] * 256 + reader[1];
- /* (for now) we send one query only, so we expect only one in the
- * response too */
- if (r_res->header.qdcount != 1) {
- cause = RSLV_RESP_QUERY_COUNT_ERROR;
- goto return_error;
- }
-
- if (r_res->header.qdcount > DNS_MAX_QUERY_RECORDS)
- goto invalid_resp;
- reader += 2;
-
- /* 2 bytes for answer count */
- if (reader + 2 >= bufend)
- goto invalid_resp;
- r_res->header.ancount = reader[0] * 256 + reader[1];
- if (r_res->header.ancount == 0) {
- cause = RSLV_RESP_ANCOUNT_ZERO;
- goto return_error;
- }
-
- /* Check if too many records are announced */
- if (r_res->header.ancount > max_answer_records)
- goto invalid_resp;
- reader += 2;
-
- /* 2 bytes authority count */
- if (reader + 2 >= bufend)
- goto invalid_resp;
- r_res->header.nscount = reader[0] * 256 + reader[1];
- reader += 2;
-
- /* 2 bytes additional count */
- if (reader + 2 >= bufend)
- goto invalid_resp;
- r_res->header.arcount = reader[0] * 256 + reader[1];
- reader += 2;
-
- /* Parsing dns queries */
- LIST_INIT(&r_res->query_list);
- for (query_record_id = 0; query_record_id < r_res->header.qdcount; query_record_id++) {
- /* Use next pre-allocated resolv_query_item after ensuring there is
- * still one available.
- * It's then added to our packet query list. */
- if (query_record_id > DNS_MAX_QUERY_RECORDS)
- goto invalid_resp;
- query = &resolution->response_query_records[query_record_id];
- LIST_ADDQ(&r_res->query_list, &query->list);
-
- /* Name is a NULL terminated string in our case, since we have
- * one query per response and the first one can't be compressed
- * (using the 0x0c format) */
- offset = 0;
- len = resolv_read_name(resp, bufend, reader, query->name, DNS_MAX_NAME_SIZE, &offset, 0);
-
- if (len == 0)
- goto invalid_resp;
-
- reader += offset;
- previous_dname = query->name;
-
- /* move forward 2 bytes for question type */
- if (reader + 2 >= bufend)
- goto invalid_resp;
- query->type = reader[0] * 256 + reader[1];
- reader += 2;
-
- /* move forward 2 bytes for question class */
- if (reader + 2 >= bufend)
- goto invalid_resp;
- query->class = reader[0] * 256 + reader[1];
- reader += 2;
- }
-
- /* TRUNCATED flag must be checked after we could read the query type
- * because a TRUNCATED SRV query type response can still be exploited */
- if (query->type != DNS_RTYPE_SRV && flags & DNS_FLAG_TRUNCATED) {
- cause = RSLV_RESP_TRUNCATED;
- goto return_error;
- }
-
- /* now parsing response records */
- nb_saved_records = 0;
- for (i = 0; i < r_res->header.ancount; i++) {
- if (reader >= bufend)
- goto invalid_resp;
-
- answer_record = pool_alloc(resolv_answer_item_pool);
- if (answer_record == NULL)
- goto invalid_resp;
-
- /* initialization */
- answer_record->ar_item = NULL;
-
- offset = 0;
- len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
+ dns_msg_trash = malloc(DNS_TCP_MSG_MAX_SIZE);
+ if (!dns_msg_trash)
+ return 0;
- if (len == 0)
- goto invalid_resp;
+ return 1;
+}
- /* Check if the current record dname is valid. previous_dname
- * points either to queried dname or last CNAME target */
- if (query->type != DNS_RTYPE_SRV && resolv_hostname_cmp(previous_dname, tmpname, len) != 0) {
- if (i == 0) {
- /* First record, means a mismatch issue between
- * queried dname and dname found in the first
- * record */
- goto invalid_resp;
- }
- else {
- /* If not the first record, this means we have a
- * CNAME resolution error.
- */
- cause = RSLV_RESP_CNAME_ERROR;
- goto return_error;
- }
-
- }
-
- memcpy(answer_record->name, tmpname, len);
- answer_record->name[len] = 0;
-
- reader += offset;
- if (reader >= bufend)
- goto invalid_resp;
-
- /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
- if (reader + 2 > bufend)
- goto invalid_resp;
-
- answer_record->type = reader[0] * 256 + reader[1];
- reader += 2;
-
- /* 2 bytes for class (2) */
- if (reader + 2 > bufend)
- goto invalid_resp;
-
- answer_record->class = reader[0] * 256 + reader[1];
- reader += 2;
-
- /* 4 bytes for ttl (4) */
- if (reader + 4 > bufend)
- goto invalid_resp;
-
- answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
- + reader[2] * 256 + reader[3];
- reader += 4;
-
- /* Now reading data len */
- if (reader + 2 > bufend)
- goto invalid_resp;
-
- answer_record->data_len = reader[0] * 256 + reader[1];
-
- /* Move forward 2 bytes for data len */
- reader += 2;
-
- if (reader + answer_record->data_len > bufend)
- goto invalid_resp;
-
- /* Analyzing record content */
- switch (answer_record->type) {
- case DNS_RTYPE_A:
- /* ipv4 is stored on 4 bytes */
- if (answer_record->data_len != 4)
- goto invalid_resp;
-
- answer_record->address.sa_family = AF_INET;
- memcpy(&(((struct sockaddr_in *)&answer_record->address)->sin_addr),
- reader, answer_record->data_len);
- break;
-
- case DNS_RTYPE_CNAME:
- /* Check if this is the last record and update the caller about the status:
- * no IP could be found and last record was a CNAME. Could be triggered
- * by a wrong query type
- *
- * + 1 because answer_record_id starts at 0
- * while number of answers is an integer and
- * starts at 1.
- */
- if (i + 1 == r_res->header.ancount) {
- cause = RSLV_RESP_CNAME_ERROR;
- goto return_error;
- }
-
- offset = 0;
- len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
- if (len == 0)
- goto invalid_resp;
-
- memcpy(answer_record->target, tmpname, len);
- answer_record->target[len] = 0;
- previous_dname = answer_record->target;
- break;
-
-
- case DNS_RTYPE_SRV:
- /* Answer must contain :
- * - 2 bytes for the priority
- * - 2 bytes for the weight
- * - 2 bytes for the port
- * - the target hostname
- */
- if (answer_record->data_len <= 6)
- goto invalid_resp;
-
- answer_record->priority = read_n16(reader);
- reader += sizeof(uint16_t);
- answer_record->weight = read_n16(reader);
- reader += sizeof(uint16_t);
- answer_record->port = read_n16(reader);
- reader += sizeof(uint16_t);
- offset = 0;
- len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
- if (len == 0)
- goto invalid_resp;
-
- answer_record->data_len = len;
- memcpy(answer_record->target, tmpname, len);
- answer_record->target[len] = 0;
- if (answer_record->ar_item != NULL) {
- pool_free(resolv_answer_item_pool, answer_record->ar_item);
- answer_record->ar_item = NULL;
- }
- break;
-
- case DNS_RTYPE_AAAA:
- /* ipv6 is stored on 16 bytes */
- if (answer_record->data_len != 16)
- goto invalid_resp;
-
- answer_record->address.sa_family = AF_INET6;
- memcpy(&(((struct sockaddr_in6 *)&answer_record->address)->sin6_addr),
- reader, answer_record->data_len);
- break;
-
- } /* switch (record type) */
-
- /* Increment the counter for number of records saved into our
- * local response */
- nb_saved_records++;
-
- /* Move forward answer_record->data_len for analyzing next
- * record in the response */
- reader += ((answer_record->type == DNS_RTYPE_SRV)
- ? offset
- : answer_record->data_len);
-
- /* Lookup to see if we already had this entry */
- found = 0;
- list_for_each_entry(tmp_record, &r_res->answer_list, list) {
- if (tmp_record->type != answer_record->type)
- continue;
-
- switch(tmp_record->type) {
- case DNS_RTYPE_A:
- if (!memcmp(&((struct sockaddr_in *)&answer_record->address)->sin_addr,
- &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
- sizeof(in_addr_t)))
- found = 1;
- break;
-
- case DNS_RTYPE_AAAA:
- if (!memcmp(&((struct sockaddr_in6 *)&answer_record->address)->sin6_addr,
- &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
- sizeof(struct in6_addr)))
- found = 1;
- break;
-
- case DNS_RTYPE_SRV:
- if (answer_record->data_len == tmp_record->data_len &&
- !resolv_hostname_cmp(answer_record->target, tmp_record->target, answer_record->data_len) &&
- answer_record->port == tmp_record->port) {
- tmp_record->weight = answer_record->weight;
- found = 1;
- }
- break;
-
- default:
- break;
- }
-
- if (found == 1)
- break;
- }
-
- if (found == 1) {
- tmp_record->last_seen = now.tv_sec;
- pool_free(resolv_answer_item_pool, answer_record);
- answer_record = NULL;
- }
- else {
- answer_record->last_seen = now.tv_sec;
- answer_record->ar_item = NULL;
- LIST_ADDQ(&r_res->answer_list, &answer_record->list);
- answer_record = NULL;
- }
- } /* for i 0 to ancount */
-
- /* Save the number of records we really own */
- r_res->header.ancount = nb_saved_records;
-
- /* now parsing additional records for SRV queries only */
- if (query->type != DNS_RTYPE_SRV)
- goto skip_parsing_additional_records;
-
- /* if we find Authority records, just skip them */
- for (i = 0; i < r_res->header.nscount; i++) {
- offset = 0;
- len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE,
- &offset, 0);
- if (len == 0)
- continue;
-
- if (reader + offset + 10 >= bufend)
- goto invalid_resp;
-
- reader += offset;
- /* skip 2 bytes for class */
- reader += 2;
- /* skip 2 bytes for type */
- reader += 2;
- /* skip 4 bytes for ttl */
- reader += 4;
- /* read data len */
- len = reader[0] * 256 + reader[1];
- reader += 2;
-
- if (reader + len >= bufend)
- goto invalid_resp;
-
- reader += len;
- }
-
- nb_saved_records = 0;
- for (i = 0; i < r_res->header.arcount; i++) {
- if (reader >= bufend)
- goto invalid_resp;
-
- answer_record = pool_alloc(resolv_answer_item_pool);
- if (answer_record == NULL)
- goto invalid_resp;
-
- offset = 0;
- len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
-
- if (len == 0) {
- pool_free(resolv_answer_item_pool, answer_record);
- answer_record = NULL;
- continue;
- }
-
- memcpy(answer_record->name, tmpname, len);
- answer_record->name[len] = 0;
-
- reader += offset;
- if (reader >= bufend)
- goto invalid_resp;
-
- /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
- if (reader + 2 > bufend)
- goto invalid_resp;
-
- answer_record->type = reader[0] * 256 + reader[1];
- reader += 2;
-
- /* 2 bytes for class (2) */
- if (reader + 2 > bufend)
- goto invalid_resp;
-
- answer_record->class = reader[0] * 256 + reader[1];
- reader += 2;
-
- /* 4 bytes for ttl (4) */
- if (reader + 4 > bufend)
- goto invalid_resp;
-
- answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
- + reader[2] * 256 + reader[3];
- reader += 4;
-
- /* Now reading data len */
- if (reader + 2 > bufend)
- goto invalid_resp;
-
- answer_record->data_len = reader[0] * 256 + reader[1];
-
- /* Move forward 2 bytes for data len */
- reader += 2;
-
- if (reader + answer_record->data_len > bufend)
- goto invalid_resp;
-
- /* Analyzing record content */
- switch (answer_record->type) {
- case DNS_RTYPE_A:
- /* ipv4 is stored on 4 bytes */
- if (answer_record->data_len != 4)
- goto invalid_resp;
-
- answer_record->address.sa_family = AF_INET;
- memcpy(&(((struct sockaddr_in *)&answer_record->address)->sin_addr),
- reader, answer_record->data_len);
- break;
-
- case DNS_RTYPE_AAAA:
- /* ipv6 is stored on 16 bytes */
- if (answer_record->data_len != 16)
- goto invalid_resp;
-
- answer_record->address.sa_family = AF_INET6;
- memcpy(&(((struct sockaddr_in6 *)&answer_record->address)->sin6_addr),
- reader, answer_record->data_len);
- break;
-
- default:
- pool_free(resolv_answer_item_pool, answer_record);
- answer_record = NULL;
- continue;
-
- } /* switch (record type) */
-
- /* Increment the counter for number of records saved into our
- * local response */
- nb_saved_records++;
-
- /* Move forward answer_record->data_len for analyzing next
- * record in the response */
- reader += ((answer_record->type == DNS_RTYPE_SRV)
- ? offset
- : answer_record->data_len);
-
- /* Lookup to see if we already had this entry */
- found = 0;
- list_for_each_entry(tmp_record, &r_res->answer_list, list) {
- if (tmp_record->type != answer_record->type)
- continue;
-
- switch(tmp_record->type) {
- case DNS_RTYPE_A:
- if (!memcmp(&((struct sockaddr_in *)&answer_record->address)->sin_addr,
- &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
- sizeof(in_addr_t)))
- found = 1;
- break;
-
- case DNS_RTYPE_AAAA:
- if (!memcmp(&((struct sockaddr_in6 *)&answer_record->address)->sin6_addr,
- &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
- sizeof(struct in6_addr)))
- found = 1;
- break;
-
- default:
- break;
- }
-
- if (found == 1)
- break;
- }
-
- if (found == 1) {
- tmp_record->last_seen = now.tv_sec;
- pool_free(resolv_answer_item_pool, answer_record);
- answer_record = NULL;
- }
- else {
- answer_record->last_seen = now.tv_sec;
- answer_record->ar_item = NULL;
-
- // looking for the SRV record in the response list linked to this additional record
- list_for_each_entry(tmp_record, &r_res->answer_list, list) {
- if (tmp_record->type == DNS_RTYPE_SRV &&
- tmp_record->ar_item == NULL &&
- !resolv_hostname_cmp(tmp_record->target, answer_record->name, tmp_record->data_len)) {
- /* Always use the received additional record to refresh info */
- if (tmp_record->ar_item)
- pool_free(resolv_answer_item_pool, tmp_record->ar_item);
- tmp_record->ar_item = answer_record;
- break;
- }
- }
- if (tmp_record->ar_item != answer_record)
- pool_free(resolv_answer_item_pool, answer_record);
- answer_record = NULL;
- }
- } /* for i 0 to arcount */
-
- skip_parsing_additional_records:
-
- /* Save the number of records we really own */
- r_res->header.arcount = nb_saved_records;
-
- resolv_check_response(resolution);
- return RSLV_RESP_VALID;
-
- invalid_resp:
- cause = RSLV_RESP_INVALID;
-
- return_error:
- pool_free(resolv_answer_item_pool, answer_record);
- return cause;
-}
-
-/* Searches dn_name resolution in resp.
- * If existing IP not found, return the first IP matching family_priority,
- * otherwise, first ip found
- * The following tasks are the responsibility of the caller:
- * - <r_res> contains an error free DNS response
- * For both cases above, resolv_validate_dns_response is required
- * returns one of the RSLV_UPD_* code
- */
-int resolv_get_ip_from_response(struct resolv_response *r_res,
- struct resolv_options *resolv_opts, void *currentip,
- short currentip_sin_family,
- void **newip, short *newip_sin_family,
- void *owner)
-{
- struct resolv_answer_item *record;
- int family_priority;
- int currentip_found;
- unsigned char *newip4, *newip6;
- int currentip_sel;
- int j;
- int score, max_score;
- int allowed_duplicated_ip;
-
- family_priority = resolv_opts->family_prio;
- allowed_duplicated_ip = resolv_opts->accept_duplicate_ip;
- *newip = newip4 = newip6 = NULL;
- currentip_found = 0;
- *newip_sin_family = AF_UNSPEC;
- max_score = -1;
-
- /* Select an IP regarding configuration preference.
- * Top priority is the preferred network ip version,
- * second priority is the preferred network.
- * the last priority is the currently used IP,
- *
- * For these three priorities, a score is calculated. The
- * weight are:
- * 8 - preferred ip version.
- * 4 - preferred network.
- * 2 - if the ip in the record is not affected to any other server in the same backend (duplication)
- * 1 - current ip.
- * The result with the biggest score is returned.
- */
-
- list_for_each_entry(record, &r_res->answer_list, list) {
- void *ip;
- unsigned char ip_type;
-
- if (record->type == DNS_RTYPE_A) {
- ip = &(((struct sockaddr_in *)&record->address)->sin_addr);
- ip_type = AF_INET;
- }
- else if (record->type == DNS_RTYPE_AAAA) {
- ip_type = AF_INET6;
- ip = &(((struct sockaddr_in6 *)&record->address)->sin6_addr);
- }
- else
- continue;
- score = 0;
-
- /* Check for preferred ip protocol. */
- if (ip_type == family_priority)
- score += 8;
-
- /* Check for preferred network. */
- for (j = 0; j < resolv_opts->pref_net_nb; j++) {
-
- /* Compare only the same addresses class. */
- if (resolv_opts->pref_net[j].family != ip_type)
- continue;
-
- if ((ip_type == AF_INET &&
- in_net_ipv4(ip,
- &resolv_opts->pref_net[j].mask.in4,
- &resolv_opts->pref_net[j].addr.in4)) ||
- (ip_type == AF_INET6 &&
- in_net_ipv6(ip,
- &resolv_opts->pref_net[j].mask.in6,
- &resolv_opts->pref_net[j].addr.in6))) {
- score += 4;
- break;
- }
- }
-
- /* Check if the IP found in the record is already affected to a
- * member of a group. If not, the score should be incremented
- * by 2. */
- if (owner && snr_check_ip_callback(owner, ip, &ip_type)) {
- if (!allowed_duplicated_ip) {
- continue;
- }
- } else {
- score += 2;
- }
-
- /* Check for current ip matching. */
- if (ip_type == currentip_sin_family &&
- ((currentip_sin_family == AF_INET &&
- !memcmp(ip, currentip, 4)) ||
- (currentip_sin_family == AF_INET6 &&
- !memcmp(ip, currentip, 16)))) {
- score++;
- currentip_sel = 1;
- }
- else
- currentip_sel = 0;
-
- /* Keep the address if the score is better than the previous
- * score. The maximum score is 15, if this value is reached, we
- * break the parsing. Implicitly, this score is reached the ip
- * selected is the current ip. */
- if (score > max_score) {
- if (ip_type == AF_INET)
- newip4 = ip;
- else
- newip6 = ip;
- currentip_found = currentip_sel;
- if (score == 15)
- return RSLV_UPD_NO;
- max_score = score;
- }
- } /* list for each record entries */
-
- /* No IP found in the response */
- if (!newip4 && !newip6)
- return RSLV_UPD_NO_IP_FOUND;
-
- /* Case when the caller looks first for an IPv4 address */
- if (family_priority == AF_INET) {
- if (newip4) {
- *newip = newip4;
- *newip_sin_family = AF_INET;
- }
- else if (newip6) {
- *newip = newip6;
- *newip_sin_family = AF_INET6;
- }
- if (!currentip_found)
- goto not_found;
- }
- /* Case when the caller looks first for an IPv6 address */
- else if (family_priority == AF_INET6) {
- if (newip6) {
- *newip = newip6;
- *newip_sin_family = AF_INET6;
- }
- else if (newip4) {
- *newip = newip4;
- *newip_sin_family = AF_INET;
- }
- if (!currentip_found)
- goto not_found;
- }
- /* Case when the caller have no preference (we prefer IPv6) */
- else if (family_priority == AF_UNSPEC) {
- if (newip6) {
- *newip = newip6;
- *newip_sin_family = AF_INET6;
- }
- else if (newip4) {
- *newip = newip4;
- *newip_sin_family = AF_INET;
- }
- if (!currentip_found)
- goto not_found;
- }
-
- /* No reason why we should change the server's IP address */
- return RSLV_UPD_NO;
-
- not_found:
- list_for_each_entry(record, &r_res->answer_list, list) {
- /* Move the first record to the end of the list, for internal
- * round robin */
- LIST_DEL(&record->list);
- LIST_ADDQ(&r_res->answer_list, &record->list);
- break;
- }
- return RSLV_UPD_SRVIP_NOT_FOUND;
-}
-
-/* Turns a domain name label into a string.
- *
- * <dn> must be a null-terminated string. <dn_len> must include the terminating
- * null byte. <str> must be allocated and its size must be passed in <str_len>.
- *
- * In case of error, -1 is returned, otherwise, the number of bytes copied in
- * <str> (including the terminating null byte).
- */
-int resolv_dn_label_to_str(const char *dn, int dn_len, char *str, int str_len)
-{
- char *ptr;
- int i, sz;
-
- if (str_len < dn_len - 1)
- return -1;
-
- ptr = str;
- for (i = 0; i < dn_len-1; ++i) {
- sz = dn[i];
- if (i)
- *ptr++ = '.';
- memcpy(ptr, dn+i+1, sz);
- ptr += sz;
- i += sz;
- }
- *ptr++ = '\0';
- return (ptr - str);
-}
-
-/* Turns a string into domain name label: www.haproxy.org into 3www7haproxy3org
- *
- * <str> must be a null-terminated string. <str_len> must include the
- * terminating null byte. <dn> buffer must be allocated and its size must be
- * passed in <dn_len>.
- *
- * In case of error, -1 is returned, otherwise, the number of bytes copied in
- * <dn> (excluding the terminating null byte).
- */
-int resolv_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len)
-{
- int i, offset;
-
- if (dn_len < str_len + 1)
- return -1;
-
- /* First byte of dn will be used to store the length of the first
- * label */
- offset = 0;
- for (i = 0; i < str_len; ++i) {
- if (str[i] == '.') {
- /* 2 or more consecutive dots is invalid */
- if (i == offset)
- return -1;
-
- /* ignore trailing dot */
- if (i + 2 == str_len) {
- i++;
- break;
- }
-
- dn[offset] = (i - offset);
- offset = i+1;
- continue;
- }
- dn[i+1] = str[i];
- }
- dn[offset] = (i - offset - 1);
- dn[i] = '\0';
- return i;
-}
-
-/* Validates host name:
- * - total size
- * - each label size individually
- * returns:
- * 0 in case of error. If <err> is not NULL, an error message is stored there.
- * 1 when no error. <err> is left unaffected.
- */
-int resolv_hostname_validation(const char *string, char **err)
-{
- int i;
-
- if (strlen(string) > DNS_MAX_NAME_SIZE) {
- if (err)
- *err = DNS_TOO_LONG_FQDN;
- return 0;
- }
-
- while (*string) {
- i = 0;
- while (*string && *string != '.' && i < DNS_MAX_LABEL_SIZE) {
- if (!(*string == '-' || *string == '_' ||
- (*string >= 'a' && *string <= 'z') ||
- (*string >= 'A' && *string <= 'Z') ||
- (*string >= '0' && *string <= '9'))) {
- if (err)
- *err = DNS_INVALID_CHARACTER;
- return 0;
- }
- i++;
- string++;
- }
-
- if (!(*string))
- break;
-
- if (*string != '.' && i >= DNS_MAX_LABEL_SIZE) {
- if (err)
- *err = DNS_LABEL_TOO_LONG;
- return 0;
- }
-
- string++;
- }
- return 1;
-}
-
-/* Picks up an available resolution from the different resolution list
- * associated to a resolvers section, in this order:
- * 1. check in resolutions.curr for the same hostname and query_type
- * 2. check in resolutions.wait for the same hostname and query_type
- * 3. Get a new resolution from resolution pool
- *
- * Returns an available resolution, NULL if none found.
- */
-static struct resolv_resolution *resolv_pick_resolution(struct resolvers *resolvers,
- char **hostname_dn, int hostname_dn_len,
- int query_type)
-{
- struct resolv_resolution *res;
-
- if (!*hostname_dn)
- goto from_pool;
-
- /* Search for same hostname and query type in resolutions.curr */
- list_for_each_entry(res, &resolvers->resolutions.curr, list) {
- if (!res->hostname_dn)
- continue;
- if ((query_type == res->prefered_query_type) &&
- hostname_dn_len == res->hostname_dn_len &&
- !resolv_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
- return res;
- }
-
- /* Search for same hostname and query type in resolutions.wait */
- list_for_each_entry(res, &resolvers->resolutions.wait, list) {
- if (!res->hostname_dn)
- continue;
- if ((query_type == res->prefered_query_type) &&
- hostname_dn_len == res->hostname_dn_len &&
- !resolv_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
- return res;
- }
-
- from_pool:
- /* No resolution could be found, so let's allocate a new one */
- res = pool_alloc(resolv_resolution_pool);
- if (res) {
- memset(res, 0, sizeof(*res));
- res->resolvers = resolvers;
- res->uuid = resolution_uuid;
- res->status = RSLV_STATUS_NONE;
- res->step = RSLV_STEP_NONE;
- res->last_valid = now_ms;
-
- LIST_INIT(&res->requesters);
- LIST_INIT(&res->response.answer_list);
-
- res->prefered_query_type = query_type;
- res->query_type = query_type;
- res->hostname_dn = *hostname_dn;
- res->hostname_dn_len = hostname_dn_len;
-
- ++resolution_uuid;
-
- /* Move the resolution to the resolvers wait queue */
- LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
- }
- return res;
-}
-
-/* Releases a resolution from its requester(s) and move it back to the pool */
-static void resolv_free_resolution(struct resolv_resolution *resolution)
-{
- struct resolv_requester *req, *reqback;
- struct resolv_answer_item *item, *itemback;
-
- /* clean up configuration */
- resolv_reset_resolution(resolution);
- resolution->hostname_dn = NULL;
- resolution->hostname_dn_len = 0;
-
- list_for_each_entry_safe(req, reqback, &resolution->requesters, list) {
- LIST_DEL(&req->list);
- req->resolution = NULL;
- }
-
- list_for_each_entry_safe(item, itemback, &resolution->response.answer_list, list) {
- LIST_DEL(&item->list);
- if (item->ar_item) {
- pool_free(resolv_answer_item_pool, item->ar_item);
- item->ar_item = NULL;
- }
- pool_free(resolv_answer_item_pool, item);
- }
-
- LIST_DEL(&resolution->list);
- pool_free(resolv_resolution_pool, resolution);
-}
-
-/* Links a requester (a server or a resolv_srvrq) with a resolution. It returns 0
- * on success, -1 otherwise.
- */
-int resolv_link_resolution(void *requester, int requester_type, int requester_locked)
-{
- struct resolv_resolution *res = NULL;
- struct resolv_requester *req;
- struct resolvers *resolvers;
- struct server *srv = NULL;
- struct resolv_srvrq *srvrq = NULL;
- struct stream *stream = NULL;
- char **hostname_dn;
- int hostname_dn_len, query_type;
-
- switch (requester_type) {
- case OBJ_TYPE_SERVER:
- srv = (struct server *)requester;
- hostname_dn = &srv->hostname_dn;
- hostname_dn_len = srv->hostname_dn_len;
- resolvers = srv->resolvers;
- query_type = ((srv->resolv_opts.family_prio == AF_INET)
- ? DNS_RTYPE_A
- : DNS_RTYPE_AAAA);
- break;
-
- case OBJ_TYPE_SRVRQ:
- srvrq = (struct resolv_srvrq *)requester;
- hostname_dn = &srvrq->hostname_dn;
- hostname_dn_len = srvrq->hostname_dn_len;
- resolvers = srvrq->resolvers;
- query_type = DNS_RTYPE_SRV;
- break;
-
- case OBJ_TYPE_STREAM:
- stream = (struct stream *)requester;
- hostname_dn = &stream->resolv_ctx.hostname_dn;
- hostname_dn_len = stream->resolv_ctx.hostname_dn_len;
- resolvers = stream->resolv_ctx.parent->arg.resolv.resolvers;
- query_type = ((stream->resolv_ctx.parent->arg.resolv.opts->family_prio == AF_INET)
- ? DNS_RTYPE_A
- : DNS_RTYPE_AAAA);
- break;
- default:
- goto err;
- }
-
- /* Get a resolution from the resolvers' wait queue or pool */
- if ((res = resolv_pick_resolution(resolvers, hostname_dn, hostname_dn_len, query_type)) == NULL)
- goto err;
-
- if (srv) {
- if (!requester_locked)
- HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
- if (srv->resolv_requester == NULL) {
- if ((req = pool_alloc(resolv_requester_pool)) == NULL) {
- if (!requester_locked)
- HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
- goto err;
- }
- req->owner = &srv->obj_type;
- srv->resolv_requester = req;
- }
- else
- req = srv->resolv_requester;
- if (!requester_locked)
- HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
-
- req->requester_cb = snr_resolution_cb;
- req->requester_error_cb = snr_resolution_error_cb;
- }
- else if (srvrq) {
- if (srvrq->requester == NULL) {
- if ((req = pool_alloc(resolv_requester_pool)) == NULL)
- goto err;
- req->owner = &srvrq->obj_type;
- srvrq->requester = req;
- }
- else
- req = srvrq->requester;
-
- req->requester_cb = snr_resolution_cb;
- req->requester_error_cb = snr_resolution_error_cb;
- }
- else if (stream) {
- if (stream->resolv_ctx.requester == NULL) {
- if ((req = pool_alloc(resolv_requester_pool)) == NULL)
- goto err;
- req->owner = &stream->obj_type;
- stream->resolv_ctx.requester = req;
- }
- else
- req = stream->resolv_ctx.requester;
-
- req->requester_cb = act_resolution_cb;
- req->requester_error_cb = act_resolution_error_cb;
- }
- else
- goto err;
-
- req->resolution = res;
-
- LIST_ADDQ(&res->requesters, &req->list);
- return 0;
-
- err:
- if (res && LIST_ISEMPTY(&res->requesters))
- resolv_free_resolution(res);
- return -1;
-}
-
-/* Removes a requester from a DNS resolution. It takes takes care of all the
- * consequences. It also cleans up some parameters from the requester.
- */
-void resolv_unlink_resolution(struct resolv_requester *requester)
-{
- struct resolv_resolution *res;
- struct resolv_requester *req;
-
- /* Nothing to do */
- if (!requester || !requester->resolution)
- return;
- res = requester->resolution;
-
- /* Clean up the requester */
- LIST_DEL(&requester->list);
- requester->resolution = NULL;
-
- /* We need to find another requester linked on this resolution */
- if (!LIST_ISEMPTY(&res->requesters))
- req = LIST_NEXT(&res->requesters, struct resolv_requester *, list);
- else {
- resolv_free_resolution(res);
- return;
- }
-
- /* Move hostname_dn related pointers to the next requester */
- switch (obj_type(req->owner)) {
- case OBJ_TYPE_SERVER:
- res->hostname_dn = __objt_server(req->owner)->hostname_dn;
- res->hostname_dn_len = __objt_server(req->owner)->hostname_dn_len;
- break;
- case OBJ_TYPE_SRVRQ:
- res->hostname_dn = __objt_resolv_srvrq(req->owner)->hostname_dn;
- res->hostname_dn_len = __objt_resolv_srvrq(req->owner)->hostname_dn_len;
- break;
- case OBJ_TYPE_STREAM:
- res->hostname_dn = __objt_stream(req->owner)->resolv_ctx.hostname_dn;
- res->hostname_dn_len = __objt_stream(req->owner)->resolv_ctx.hostname_dn_len;
- break;
- default:
- res->hostname_dn = NULL;
- res->hostname_dn_len = 0;
- break;
- }
-}
-
-/* Called when a network IO is generated on a name server socket for an incoming
- * packet. It performs the following actions:
- * - check if the packet requires processing (not outdated resolution)
- * - ensure the DNS packet received is valid and call requester's callback
- * - call requester's error callback if invalid response
- * - check the dn_name in the packet against the one sent
- */
-static int resolv_process_responses(struct dns_nameserver *ns)
-{
- struct dns_counters *tmpcounters;
- struct resolvers *resolvers;
- struct resolv_resolution *res;
- struct resolv_query_item *query;
- unsigned char buf[DNS_MAX_UDP_MESSAGE + 1];
- unsigned char *bufend;
- int buflen, dns_resp;
- int max_answer_records;
- unsigned short query_id;
- struct eb32_node *eb;
- struct resolv_requester *req;
-
- resolvers = ns->parent;
- HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
-
- /* process all pending input messages */
- while (1) {
- /* read message received */
- memset(buf, '\0', resolvers->accepted_payload_size + 1);
- if ((buflen = dns_recv_nameserver(ns, (void *)buf, sizeof(buf))) <= 0) {
- /* TO DO: handle error case */
- break;
- }
-
- /* message too big */
- if (buflen > resolvers->accepted_payload_size) {
- ns->counters->too_big++;
- continue;
- }
-
- /* initializing variables */
- bufend = buf + buflen; /* pointer to mark the end of the buffer */
-
- /* read the query id from the packet (16 bits) */
- if (buf + 2 > bufend) {
- ns->counters->invalid++;
- continue;
- }
- query_id = resolv_response_get_query_id(buf);
-
- /* search the query_id in the pending resolution tree */
- eb = eb32_lookup(&resolvers->query_ids, query_id);
- if (eb == NULL) {
- /* unknown query id means an outdated response and can be safely ignored */
- ns->counters->outdated++;
- continue;
- }
-
- /* known query id means a resolution in progress */
- res = eb32_entry(eb, struct resolv_resolution, qid);
- /* number of responses received */
- res->nb_responses++;
-
- max_answer_records = (resolvers->accepted_payload_size - DNS_HEADER_SIZE) / DNS_MIN_RECORD_SIZE;
- dns_resp = resolv_validate_dns_response(buf, bufend, res, max_answer_records);
-
- switch (dns_resp) {
- case RSLV_RESP_VALID:
- break;
-
- case RSLV_RESP_INVALID:
- case RSLV_RESP_QUERY_COUNT_ERROR:
- case RSLV_RESP_WRONG_NAME:
- res->status = RSLV_STATUS_INVALID;
- ns->counters->invalid++;
- break;
-
- case RSLV_RESP_NX_DOMAIN:
- res->status = RSLV_STATUS_NX;
- ns->counters->nx++;
- break;
-
- case RSLV_RESP_REFUSED:
- res->status = RSLV_STATUS_REFUSED;
- ns->counters->refused++;
- break;
-
- case RSLV_RESP_ANCOUNT_ZERO:
- res->status = RSLV_STATUS_OTHER;
- ns->counters->any_err++;
- break;
-
- case RSLV_RESP_CNAME_ERROR:
- res->status = RSLV_STATUS_OTHER;
- ns->counters->cname_error++;
- break;
-
- case RSLV_RESP_TRUNCATED:
- res->status = RSLV_STATUS_OTHER;
- ns->counters->truncated++;
- break;
-
- case RSLV_RESP_NO_EXPECTED_RECORD:
- case RSLV_RESP_ERROR:
- case RSLV_RESP_INTERNAL:
- res->status = RSLV_STATUS_OTHER;
- ns->counters->other++;
- break;
- }
-
- /* Wait all nameservers response to handle errors */
- if (dns_resp != RSLV_RESP_VALID && res->nb_responses < resolvers->nb_nameservers)
- continue;
-
- /* Process error codes */
- if (dns_resp != RSLV_RESP_VALID) {
- if (res->prefered_query_type != res->query_type) {
- /* The fallback on the query type was already performed,
- * so check the try counter. If it falls to 0, we can
- * report an error. Else, wait the next attempt. */
- if (!res->try)
- goto report_res_error;
- }
- else {
- /* Fallback from A to AAAA or the opposite and re-send
- * the resolution immediately. try counter is not
- * decremented. */
- if (res->prefered_query_type == DNS_RTYPE_A) {
- res->query_type = DNS_RTYPE_AAAA;
- resolv_send_query(res);
- }
- else if (res->prefered_query_type == DNS_RTYPE_AAAA) {
- res->query_type = DNS_RTYPE_A;
- resolv_send_query(res);
- }
- }
- continue;
- }
-
- /* Now let's check the query's dname corresponds to the one we
- * sent. We can check only the first query of the list. We send
- * one query at a time so we get one query in the response */
- query = LIST_NEXT(&res->response.query_list, struct resolv_query_item *, list);
- if (query && resolv_hostname_cmp(query->name, res->hostname_dn, res->hostname_dn_len) != 0) {
- dns_resp = RSLV_RESP_WRONG_NAME;
- ns->counters->other++;
- goto report_res_error;
- }
-
- /* So the resolution succeeded */
- res->status = RSLV_STATUS_VALID;
- res->last_valid = now_ms;
- ns->counters->valid++;
- goto report_res_success;
-
- report_res_error:
- list_for_each_entry(req, &res->requesters, list)
- req->requester_error_cb(req, dns_resp);
- resolv_reset_resolution(res);
- LIST_DEL(&res->list);
- LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
- continue;
-
- report_res_success:
- /* Only the 1rst requester s managed by the server, others are
- * from the cache */
- tmpcounters = ns->counters;
- list_for_each_entry(req, &res->requesters, list) {
- struct server *s = objt_server(req->owner);
-
- if (s)
- HA_SPIN_LOCK(SERVER_LOCK, &s->lock);
- req->requester_cb(req, tmpcounters);
- if (s)
- HA_SPIN_UNLOCK(SERVER_LOCK, &s->lock);
- tmpcounters = NULL;
- }
-
- resolv_reset_resolution(res);
- LIST_DEL(&res->list);
- LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
- continue;
- }
- resolv_update_resolvers_timeout(resolvers);
- HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
-
- return buflen;
-}
-
-/* Processes DNS resolution. First, it checks the active list to detect expired
- * resolutions and retry them if possible. Else a timeout is reported. Then, it
- * checks the wait list to trigger new resolutions.
- */
-static struct task *process_resolvers(struct task *t, void *context, unsigned short state)
-{
- struct resolvers *resolvers = context;
- struct resolv_resolution *res, *resback;
- int exp;
-
- HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
-
- /* Handle all expired resolutions from the active list */
- list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
- /* When we find the first resolution in the future, then we can
- * stop here */
- exp = tick_add(res->last_query, resolvers->timeout.retry);
- if (!tick_is_expired(exp, now_ms))
- break;
-
- /* If current resolution has been tried too many times and
- * finishes in timeout we update its status and remove it from
- * the list */
- if (!res->try) {
- struct resolv_requester *req;
-
- /* Notify the result to the requesters */
- if (!res->nb_responses)
- res->status = RSLV_STATUS_TIMEOUT;
- list_for_each_entry(req, &res->requesters, list)
- req->requester_error_cb(req, res->status);
-
- /* Clean up resolution info and remove it from the
- * current list */
- resolv_reset_resolution(res);
- LIST_DEL(&res->list);
- LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
- }
- else {
- /* Otherwise resend the DNS query and requeue the resolution */
- if (!res->nb_responses || res->prefered_query_type != res->query_type) {
- /* No response received (a real timeout) or fallback already done */
- res->query_type = res->prefered_query_type;
- res->try--;
- }
- else {
- /* Fallback from A to AAAA or the opposite and re-send
- * the resolution immediately. try counter is not
- * decremented. */
- if (res->prefered_query_type == DNS_RTYPE_A)
- res->query_type = DNS_RTYPE_AAAA;
- else if (res->prefered_query_type == DNS_RTYPE_AAAA)
- res->query_type = DNS_RTYPE_A;
- else
- res->try--;
- }
- resolv_send_query(res);
- }
- }
-
- /* Handle all resolutions in the wait list */
- list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
- exp = tick_add(res->last_resolution, resolv_resolution_timeout(res));
- if (tick_isset(res->last_resolution) && !tick_is_expired(exp, now_ms))
- continue;
-
- if (resolv_run_resolution(res) != 1) {
- res->last_resolution = now_ms;
- LIST_DEL(&res->list);
- LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
- }
- }
-
- resolv_update_resolvers_timeout(resolvers);
- HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
- return t;
-}
-
-/* proto_udp callback functions for a DNS resolution */
-struct dgram_data_cb dns_dgram_cb = {
- .recv = dns_resolve_recv,
- .send = dns_resolve_send,
-};
-
-/* Release memory allocated by DNS */
-static void resolvers_deinit(void)
-{
- struct resolvers *resolvers, *resolversback;
- struct dns_nameserver *ns, *nsback;
- struct resolv_resolution *res, *resback;
- struct resolv_requester *req, *reqback;
- struct resolv_srvrq *srvrq, *srvrqback;
-
- list_for_each_entry_safe(resolvers, resolversback, &sec_resolvers, list) {
- list_for_each_entry_safe(ns, nsback, &resolvers->nameservers, list) {
- free(ns->id);
- free((char *)ns->conf.file);
- if (ns->dgram) {
- if (ns->dgram->conn.t.sock.fd != -1) {
- fd_delete(ns->dgram->conn.t.sock.fd);
- close(ns->dgram->conn.t.sock.fd);
- }
- if (ns->dgram->ring_req)
- ring_free(ns->dgram->ring_req);
- free(ns->dgram);
- }
- LIST_DEL(&ns->list);
- EXTRA_COUNTERS_FREE(ns->extra_counters);
- free(ns);
- }
-
- list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
- list_for_each_entry_safe(req, reqback, &res->requesters, list) {
- LIST_DEL(&req->list);
- pool_free(resolv_requester_pool, req);
- }
- resolv_free_resolution(res);
- }
-
- list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
- list_for_each_entry_safe(req, reqback, &res->requesters, list) {
- LIST_DEL(&req->list);
- pool_free(resolv_requester_pool, req);
- }
- resolv_free_resolution(res);
- }
-
- free(resolvers->id);
- free((char *)resolvers->conf.file);
- task_destroy(resolvers->t);
- LIST_DEL(&resolvers->list);
- free(resolvers);
- }
-
- list_for_each_entry_safe(srvrq, srvrqback, &resolv_srvrq_list, list) {
- free(srvrq->name);
- free(srvrq->hostname_dn);
- LIST_DEL(&srvrq->list);
- free(srvrq);
- }
-}
-
-/* Finalizes the DNS configuration by allocating required resources and checking
- * live parameters.
- * Returns 0 on success, ERR_* flags otherwise.
- */
-static int resolvers_finalize_config(void)
-{
- struct resolvers *resolvers;
- struct proxy *px;
- int err_code = 0;
-
- /* allocate pool of resolution per resolvers */
- list_for_each_entry(resolvers, &sec_resolvers, list) {
- struct dns_nameserver *ns;
- struct task *t;
-
- /* Check if we can create the socket with nameservers info */
- list_for_each_entry(ns, &resolvers->nameservers, list) {
- int fd;
-
- if (ns->dgram) {
- /* Check nameserver info */
- if ((fd = socket(ns->dgram->conn.addr.to.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
- ha_alert("config : resolvers '%s': can't create socket for nameserver '%s'.\n",
- resolvers->id, ns->id);
- err_code |= (ERR_ALERT|ERR_ABORT);
- continue;
- }
- if (connect(fd, (struct sockaddr*)&ns->dgram->conn.addr.to, get_addr_len(&ns->dgram->conn.addr.to)) == -1) {
- ha_alert("config : resolvers '%s': can't connect socket for nameserver '%s'.\n",
- resolvers->id, ns->id);
- close(fd);
- err_code |= (ERR_ALERT|ERR_ABORT);
- continue;
- }
- close(fd);
- }
- }
-
- /* Create the task associated to the resolvers section */
- if ((t = task_new(MAX_THREADS_MASK)) == NULL) {
- ha_alert("config : resolvers '%s' : out of memory.\n", resolvers->id);
- err_code |= (ERR_ALERT|ERR_ABORT);
- goto err;
- }
-
- /* Update task's parameters */
- t->process = process_resolvers;
- t->context = resolvers;
- resolvers->t = t;
- task_wakeup(t, TASK_WOKEN_INIT);
- }
-
- for (px = proxies_list; px; px = px->next) {
- struct server *srv;
-
- for (srv = px->srv; srv; srv = srv->next) {
- struct resolvers *resolvers;
-
- if (!srv->resolvers_id)
- continue;
-
- if ((resolvers = find_resolvers_by_id(srv->resolvers_id)) == NULL) {
- ha_alert("config : %s '%s', server '%s': unable to find required resolvers '%s'\n",
- proxy_type_str(px), px->id, srv->id, srv->resolvers_id);
- err_code |= (ERR_ALERT|ERR_ABORT);
- continue;
- }
- srv->resolvers = resolvers;
-
- if (srv->srvrq && !srv->srvrq->resolvers) {
- srv->srvrq->resolvers = srv->resolvers;
- if (resolv_link_resolution(srv->srvrq, OBJ_TYPE_SRVRQ, 0) == -1) {
- ha_alert("config : %s '%s' : unable to set DNS resolution for server '%s'.\n",
- proxy_type_str(px), px->id, srv->id);
- err_code |= (ERR_ALERT|ERR_ABORT);
- continue;
- }
- }
- if (resolv_link_resolution(srv, OBJ_TYPE_SERVER, 0) == -1) {
- ha_alert("config : %s '%s', unable to set DNS resolution for server '%s'.\n",
- proxy_type_str(px), px->id, srv->id);
- err_code |= (ERR_ALERT|ERR_ABORT);
- continue;
- }
- }
- }
-
- if (err_code & (ERR_ALERT|ERR_ABORT))
- goto err;
-
- return err_code;
- err:
- resolvers_deinit();
- return err_code;
-
-}
-
-static int stats_dump_resolv_to_buffer(struct stream_interface *si,
- struct dns_nameserver *ns,
- struct field *stats, size_t stats_count,
- struct list *stat_modules)
-{
- struct appctx *appctx = __objt_appctx(si->end);
- struct channel *rep = si_ic(si);
- struct stats_module *mod;
- size_t idx = 0;
-
- memset(stats, 0, sizeof(struct field) * stats_count);
-
- list_for_each_entry(mod, stat_modules, list) {
- struct counters_node *counters = EXTRA_COUNTERS_GET(ns->extra_counters, mod);
-
- mod->fill_stats(counters, stats + idx);
- idx += mod->stats_count;
- }
-
- if (!stats_dump_one_line(stats, idx, appctx))
- return 0;
-
- if (!stats_putchk(rep, NULL, &trash))
- goto full;
-
- return 1;
-
- full:
- si_rx_room_rdy(si);
- return 0;
-}
-
-/* Uses <appctx.ctx.stats.obj1> as a pointer to the current resolver and <obj2>
- * as a pointer to the current nameserver.
- */
-int stats_dump_resolvers(struct stream_interface *si,
- struct field *stats, size_t stats_count,
- struct list *stat_modules)
-{
- struct appctx *appctx = __objt_appctx(si->end);
- struct channel *rep = si_ic(si);
- struct resolvers *resolver = appctx->ctx.stats.obj1;
- struct dns_nameserver *ns = appctx->ctx.stats.obj2;
-
- if (!resolver)
- resolver = LIST_NEXT(&sec_resolvers, struct resolvers *, list);
-
- /* dump resolvers */
- list_for_each_entry_from(resolver, &sec_resolvers, list) {
- appctx->ctx.stats.obj1 = resolver;
-
- ns = appctx->ctx.stats.obj2 ?
- appctx->ctx.stats.obj2 :
- LIST_NEXT(&resolver->nameservers, struct dns_nameserver *, list);
-
- list_for_each_entry_from(ns, &resolver->nameservers, list) {
- appctx->ctx.stats.obj2 = ns;
-
- if (buffer_almost_full(&rep->buf))
- goto full;
-
- if (!stats_dump_resolv_to_buffer(si, ns,
- stats, stats_count,
- stat_modules)) {
- return 0;
- }
- }
-
- appctx->ctx.stats.obj2 = NULL;
- }
-
- return 1;
-
- full:
- si_rx_room_blk(si);
- return 0;
-}
-
-void resolv_stats_clear_counters(int clrall, struct list *stat_modules)
-{
- struct resolvers *resolvers;
- struct dns_nameserver *ns;
- struct stats_module *mod;
- void *counters;
-
- list_for_each_entry(mod, stat_modules, list) {
- if (!mod->clearable && !clrall)
- continue;
-
- list_for_each_entry(resolvers, &sec_resolvers, list) {
- list_for_each_entry(ns, &resolvers->nameservers, list) {
- counters = EXTRA_COUNTERS_GET(ns->extra_counters, mod);
- memcpy(counters, mod->counters, mod->counters_size);
- }
- }
- }
-
-}
-
-int resolv_allocate_counters(struct list *stat_modules)
-{
- struct stats_module *mod;
- struct resolvers *resolvers;
- struct dns_nameserver *ns;
-
- list_for_each_entry(resolvers, &sec_resolvers, list) {
- list_for_each_entry(ns, &resolvers->nameservers, list) {
- EXTRA_COUNTERS_REGISTER(&ns->extra_counters, COUNTERS_DNS,
- alloc_failed);
-
- list_for_each_entry(mod, stat_modules, list) {
- EXTRA_COUNTERS_ADD(mod,
- ns->extra_counters,
- mod->counters,
- mod->counters_size);
- }
-
- EXTRA_COUNTERS_ALLOC(ns->extra_counters, alloc_failed);
-
- list_for_each_entry(mod, stat_modules, list) {
- memcpy(ns->extra_counters->data + mod->counters_off[ns->extra_counters->type],
- mod->counters, mod->counters_size);
-
- /* Store the ns counters pointer */
- if (strcmp(mod->name, "dns") == 0) {
- ns->counters = (struct dns_counters *)ns->extra_counters->data + mod->counters_off[COUNTERS_DNS];
- ns->counters->id = ns->id;
- ns->counters->pid = resolvers->id;
- }
- }
- }
- }
-
- return 1;
-
-alloc_failed:
- return 0;
-}
-
-/* if an arg is found, it sets the resolvers section pointer into cli.p0 */
-static int cli_parse_stat_resolvers(char **args, char *payload, struct appctx *appctx, void *private)
-{
- struct resolvers *presolvers;
-
- if (*args[2]) {
- list_for_each_entry(presolvers, &sec_resolvers, list) {
- if (strcmp(presolvers->id, args[2]) == 0) {
- appctx->ctx.cli.p0 = presolvers;
- break;
- }
- }
- if (appctx->ctx.cli.p0 == NULL)
- return cli_err(appctx, "Can't find that resolvers section\n");
- }
- return 0;
-}
-
-/* Dumps counters from all resolvers section and associated name servers. It
- * returns 0 if the output buffer is full and it needs to be called again,
- * otherwise non-zero. It may limit itself to the resolver pointed to by
- * <cli.p0> if it's not null.
- */
-static int cli_io_handler_dump_resolvers_to_buffer(struct appctx *appctx)
-{
- struct stream_interface *si = appctx->owner;
- struct resolvers *resolvers;
- struct dns_nameserver *ns;
-
- chunk_reset(&trash);
-
- switch (appctx->st2) {
- case STAT_ST_INIT:
- appctx->st2 = STAT_ST_LIST; /* let's start producing data */
- /* fall through */
-
- case STAT_ST_LIST:
- if (LIST_ISEMPTY(&sec_resolvers)) {
- chunk_appendf(&trash, "No resolvers found\n");
- }
- else {
- list_for_each_entry(resolvers, &sec_resolvers, list) {
- if (appctx->ctx.cli.p0 != NULL && appctx->ctx.cli.p0 != resolvers)
- continue;
-
- chunk_appendf(&trash, "Resolvers section %s\n", resolvers->id);
- list_for_each_entry(ns, &resolvers->nameservers, list) {
- chunk_appendf(&trash, " nameserver %s:\n", ns->id);
- chunk_appendf(&trash, " sent: %lld\n", ns->counters->sent);
- chunk_appendf(&trash, " snd_error: %lld\n", ns->counters->snd_error);
- chunk_appendf(&trash, " valid: %lld\n", ns->counters->valid);
- chunk_appendf(&trash, " update: %lld\n", ns->counters->update);
- chunk_appendf(&trash, " cname: %lld\n", ns->counters->cname);
- chunk_appendf(&trash, " cname_error: %lld\n", ns->counters->cname_error);
- chunk_appendf(&trash, " any_err: %lld\n", ns->counters->any_err);
- chunk_appendf(&trash, " nx: %lld\n", ns->counters->nx);
- chunk_appendf(&trash, " timeout: %lld\n", ns->counters->timeout);
- chunk_appendf(&trash, " refused: %lld\n", ns->counters->refused);
- chunk_appendf(&trash, " other: %lld\n", ns->counters->other);
- chunk_appendf(&trash, " invalid: %lld\n", ns->counters->invalid);
- chunk_appendf(&trash, " too_big: %lld\n", ns->counters->too_big);
- chunk_appendf(&trash, " truncated: %lld\n", ns->counters->truncated);
- chunk_appendf(&trash, " outdated: %lld\n", ns->counters->outdated);
- }
- chunk_appendf(&trash, "\n");
- }
- }
-
- /* display response */
- if (ci_putchk(si_ic(si), &trash) == -1) {
- /* let's try again later from this session. We add ourselves into
- * this session's users so that it can remove us upon termination.
- */
- si_rx_room_blk(si);
- return 0;
- }
- /* fall through */
-
- default:
- appctx->st2 = STAT_ST_FIN;
- return 1;
- }
-}
-
-/* register cli keywords */
-static struct cli_kw_list cli_kws = {{ }, {
- { { "show", "resolvers", NULL }, "show resolvers [id]: dumps counters from all resolvers section and\n"
- " associated name servers",
- cli_parse_stat_resolvers, cli_io_handler_dump_resolvers_to_buffer },
- {{},}
- }
-};
-
-INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
-
-/*
- * Prepare <rule> for hostname resolution.
- * Returns -1 in case of any allocation failure, 0 if not.
- * On error, a global failure counter is also incremented.
- */
-static int action_prepare_for_resolution(struct stream *stream, const char *hostname)
-{
- char *hostname_dn;
- int hostname_len, hostname_dn_len;
- struct buffer *tmp = get_trash_chunk();
-
- if (!hostname)
- return 0;
-
- hostname_len = strlen(hostname);
- hostname_dn = tmp->area;
- hostname_dn_len = resolv_str_to_dn_label(hostname, hostname_len + 1,
- hostname_dn, tmp->size);
- if (hostname_dn_len == -1)
- goto err;
-
-
- stream->resolv_ctx.hostname_dn = strdup(hostname_dn);
- stream->resolv_ctx.hostname_dn_len = hostname_dn_len;
- if (!stream->resolv_ctx.hostname_dn)
- goto err;
-
- return 0;
-
- err:
- free(stream->resolv_ctx.hostname_dn); stream->resolv_ctx.hostname_dn = NULL;
- resolv_failed_resolutions += 1;
- return -1;
-}
-
-
-/*
- * Execute the "do-resolution" action. May be called from {tcp,http}request.
- */
-enum act_return resolv_action_do_resolve(struct act_rule *rule, struct proxy *px,
- struct session *sess, struct stream *s, int flags)
-{
- struct resolv_resolution *resolution;
- struct sample *smp;
- char *fqdn;
- struct resolv_requester *req;
- struct resolvers *resolvers;
- struct resolv_resolution *res;
- int exp, locked = 0;
- enum act_return ret = ACT_RET_CONT;
-
- resolvers = rule->arg.resolv.resolvers;
-
- /* we have a response to our DNS resolution */
- use_cache:
- if (s->resolv_ctx.requester && s->resolv_ctx.requester->resolution != NULL) {
- resolution = s->resolv_ctx.requester->resolution;
- if (!locked) {
- HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
- locked = 1;
- }
-
- if (resolution->step == RSLV_STEP_RUNNING)
- goto yield;
- if (resolution->step == RSLV_STEP_NONE) {
- /* We update the variable only if we have a valid response. */
- if (resolution->status == RSLV_STATUS_VALID) {
- struct sample smp;
- short ip_sin_family = 0;
- void *ip = NULL;
-
- resolv_get_ip_from_response(&resolution->response, rule->arg.resolv.opts, NULL,
- 0, &ip, &ip_sin_family, NULL);
-
- switch (ip_sin_family) {
- case AF_INET:
- smp.data.type = SMP_T_IPV4;
- memcpy(&smp.data.u.ipv4, ip, 4);
- break;
- case AF_INET6:
- smp.data.type = SMP_T_IPV6;
- memcpy(&smp.data.u.ipv6, ip, 16);
- break;
- default:
- ip = NULL;
- }
-
- if (ip) {
- smp.px = px;
- smp.sess = sess;
- smp.strm = s;
-
- vars_set_by_name(rule->arg.resolv.varname, strlen(rule->arg.resolv.varname), &smp);
- }
- }
- }
-
- goto release_requester;
- }
-
- /* need to configure and start a new DNS resolution */
- smp = sample_fetch_as_type(px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.resolv.expr, SMP_T_STR);
- if (smp == NULL)
- goto end;
-
- fqdn = smp->data.u.str.area;
- if (action_prepare_for_resolution(s, fqdn) == -1)
- goto end; /* on error, ignore the action */
-
- s->resolv_ctx.parent = rule;
-
- HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
- locked = 1;
-
- resolv_link_resolution(s, OBJ_TYPE_STREAM, 0);
-
- /* Check if there is a fresh enough response in the cache of our associated resolution */
- req = s->resolv_ctx.requester;
- if (!req || !req->resolution)
- goto release_requester; /* on error, ignore the action */
- res = req->resolution;
-
- exp = tick_add(res->last_resolution, resolvers->hold.valid);
- if (resolvers->t && res->status == RSLV_STATUS_VALID && tick_isset(res->last_resolution)
- && !tick_is_expired(exp, now_ms)) {
- goto use_cache;
- }
-
- resolv_trigger_resolution(s->resolv_ctx.requester);
-
- yield:
- if (flags & ACT_OPT_FINAL)
- goto release_requester;
- ret = ACT_RET_YIELD;
-
- end:
- if (locked)
- HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
- return ret;
-
- release_requester:
- free(s->resolv_ctx.hostname_dn);
- s->resolv_ctx.hostname_dn = NULL;
- s->resolv_ctx.hostname_dn_len = 0;
- if (s->resolv_ctx.requester) {
- resolv_unlink_resolution(s->resolv_ctx.requester);
- pool_free(resolv_requester_pool, s->resolv_ctx.requester);
- s->resolv_ctx.requester = NULL;
- }
- goto end;
-}
-
-static void release_resolv_action(struct act_rule *rule)
-{
- release_sample_expr(rule->arg.resolv.expr);
- free(rule->arg.resolv.varname);
- free(rule->arg.resolv.resolvers_id);
- free(rule->arg.resolv.opts);
-}
-
-
-/* parse "do-resolve" action
- * This action takes the following arguments:
- * do-resolve(<varName>,<resolversSectionName>,<resolvePrefer>) <expr>
- *
- * - <varName> is the variable name where the result of the DNS resolution will be stored
- * (mandatory)
- * - <resolversSectionName> is the name of the resolvers section to use to perform the resolution
- * (mandatory)
- * - <resolvePrefer> can be either 'ipv4' or 'ipv6' and is the IP family we would like to resolve first
- * (optional), defaults to ipv6
- * - <expr> is an HAProxy expression used to fetch the name to be resolved
- */
-enum act_parse_ret resolv_parse_do_resolve(const char **args, int *orig_arg, struct proxy *px, struct act_rule *rule, char **err)
-{
- int cur_arg;
- struct sample_expr *expr;
- unsigned int where;
- const char *beg, *end;
-
- /* orig_arg points to the first argument, but we need to analyse the command itself first */
- cur_arg = *orig_arg - 1;
-
- /* locate varName, which is mandatory */
- beg = strchr(args[cur_arg], '(');
- if (beg == NULL)
- goto do_resolve_parse_error;
- beg = beg + 1; /* beg should points to the first character after opening parenthesis '(' */
- end = strchr(beg, ',');
- if (end == NULL)
- goto do_resolve_parse_error;
- rule->arg.resolv.varname = my_strndup(beg, end - beg);
- if (rule->arg.resolv.varname == NULL)
- goto do_resolve_parse_error;
-
-
- /* locate resolversSectionName, which is mandatory.
- * Since next parameters are optional, the delimiter may be comma ','
- * or closing parenthesis ')'
- */
- beg = end + 1;
- end = strchr(beg, ',');
- if (end == NULL)
- end = strchr(beg, ')');
- if (end == NULL)
- goto do_resolve_parse_error;
- rule->arg.resolv.resolvers_id = my_strndup(beg, end - beg);
- if (rule->arg.resolv.resolvers_id == NULL)
- goto do_resolve_parse_error;
-
-
- rule->arg.resolv.opts = calloc(1, sizeof(*rule->arg.resolv.opts));
- if (rule->arg.resolv.opts == NULL)
- goto do_resolve_parse_error;
-
- /* Default priority is ipv6 */
- rule->arg.resolv.opts->family_prio = AF_INET6;
-
- /* optional arguments accepted for now:
- * ipv4 or ipv6
- */
- while (*end != ')') {
- beg = end + 1;
- end = strchr(beg, ',');
- if (end == NULL)
- end = strchr(beg, ')');
- if (end == NULL)
- goto do_resolve_parse_error;
-
- if (strncmp(beg, "ipv4", end - beg) == 0) {
- rule->arg.resolv.opts->family_prio = AF_INET;
- }
- else if (strncmp(beg, "ipv6", end - beg) == 0) {
- rule->arg.resolv.opts->family_prio = AF_INET6;
- }
- else {
- goto do_resolve_parse_error;
- }
- }
-
- cur_arg = cur_arg + 1;
-
- expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args, NULL);
- if (!expr)
- goto do_resolve_parse_error;
-
-
- where = 0;
- if (px->cap & PR_CAP_FE)
- where |= SMP_VAL_FE_HRQ_HDR;
- if (px->cap & PR_CAP_BE)
- where |= SMP_VAL_BE_HRQ_HDR;
-
- if (!(expr->fetch->val & where)) {
- memprintf(err,
- "fetch method '%s' extracts information from '%s', none of which is available here",
- args[cur_arg-1], sample_src_names(expr->fetch->use));
- free(expr);
- return ACT_RET_PRS_ERR;
- }
- rule->arg.resolv.expr = expr;
- rule->action = ACT_CUSTOM;
- rule->action_ptr = resolv_action_do_resolve;
- *orig_arg = cur_arg;
-
- rule->check_ptr = check_action_do_resolve;
- rule->release_ptr = release_resolv_action;
-
- return ACT_RET_PRS_OK;
-
- do_resolve_parse_error:
- free(rule->arg.resolv.varname); rule->arg.resolv.varname = NULL;
- free(rule->arg.resolv.resolvers_id); rule->arg.resolv.resolvers_id = NULL;
- memprintf(err, "Can't parse '%s'. Expects 'do-resolve(<varname>,<resolvers>[,<options>]) <expr>'. Available options are 'ipv4' and 'ipv6'",
- args[cur_arg]);
- return ACT_RET_PRS_ERR;
-}
-
-static struct action_kw_list http_req_kws = { { }, {
- { "do-resolve", resolv_parse_do_resolve, 1 },
- { /* END */ }
-}};
-
-INITCALL1(STG_REGISTER, http_req_keywords_register, &http_req_kws);
-
-static struct action_kw_list tcp_req_cont_actions = {ILH, {
- { "do-resolve", resolv_parse_do_resolve, 1 },
- { /* END */ }
-}};
-
-INITCALL1(STG_REGISTER, tcp_req_cont_keywords_register, &tcp_req_cont_actions);
-
-/* Check an "http-request do-resolve" action.
- *
- * The function returns 1 in success case, otherwise, it returns 0 and err is
- * filled.
- */
-int check_action_do_resolve(struct act_rule *rule, struct proxy *px, char **err)
-{
- struct resolvers *resolvers = NULL;
-
- if (rule->arg.resolv.resolvers_id == NULL) {
- memprintf(err,"Proxy '%s': %s", px->id, "do-resolve action without resolvers");
- return 0;
- }
-
- resolvers = find_resolvers_by_id(rule->arg.resolv.resolvers_id);
- if (resolvers == NULL) {
- memprintf(err,"Can't find resolvers section '%s' for do-resolve action", rule->arg.resolv.resolvers_id);
- return 0;
- }
- rule->arg.resolv.resolvers = resolvers;
-
- return 1;
-}
-/*
- * Parse a <resolvers> section.
- * Returns the error code, 0 if OK, or any combination of :
- * - ERR_ABORT: must abort ASAP
- * - ERR_FATAL: we can continue parsing but not start the service
- * - ERR_WARN: a warning has been emitted
- * - ERR_ALERT: an alert has been emitted
- * Only the two first ones can stop processing, the two others are just
- * indicators.
- */
-int cfg_parse_resolvers(const char *file, int linenum, char **args, int kwm)
-{
- const char *err;
- int err_code = 0;
- char *errmsg = NULL;
-
- if (strcmp(args[0], "resolvers") == 0) { /* new resolvers section */
- if (!*args[1]) {
- ha_alert("parsing [%s:%d] : missing name for resolvers section.\n", file, linenum);
- err_code |= ERR_ALERT | ERR_ABORT;
- goto out;
- }
-
- err = invalid_char(args[1]);
- if (err) {
- ha_alert("parsing [%s:%d] : character '%c' is not permitted in '%s' name '%s'.\n",
- file, linenum, *err, args[0], args[1]);
- err_code |= ERR_ALERT | ERR_ABORT;
- goto out;
- }
-
- list_for_each_entry(curr_resolvers, &sec_resolvers, list) {
- /* Error if two resolvers owns the same name */
- if (strcmp(curr_resolvers->id, args[1]) == 0) {
- ha_alert("Parsing [%s:%d]: resolvers '%s' has same name as another resolvers (declared at %s:%d).\n",
- file, linenum, args[1], curr_resolvers->conf.file, curr_resolvers->conf.line);
- err_code |= ERR_ALERT | ERR_ABORT;
- }
- }
-
- if ((curr_resolvers = calloc(1, sizeof(*curr_resolvers))) == NULL) {
- ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
- err_code |= ERR_ALERT | ERR_ABORT;
- goto out;
- }
-
- /* default values */
- LIST_ADDQ(&sec_resolvers, &curr_resolvers->list);
- curr_resolvers->conf.file = strdup(file);
- curr_resolvers->conf.line = linenum;
- curr_resolvers->id = strdup(args[1]);
- curr_resolvers->query_ids = EB_ROOT;
- /* default maximum response size */
- curr_resolvers->accepted_payload_size = 512;
- /* default hold period for nx, other, refuse and timeout is 30s */
- curr_resolvers->hold.nx = 30000;
- curr_resolvers->hold.other = 30000;
- curr_resolvers->hold.refused = 30000;
- curr_resolvers->hold.timeout = 30000;
- curr_resolvers->hold.obsolete = 0;
- /* default hold period for valid is 10s */
- curr_resolvers->hold.valid = 10000;
- curr_resolvers->timeout.resolve = 1000;
- curr_resolvers->timeout.retry = 1000;
- curr_resolvers->resolve_retries = 3;
- curr_resolvers->nb_nameservers = 0;
- LIST_INIT(&curr_resolvers->nameservers);
- LIST_INIT(&curr_resolvers->resolutions.curr);
- LIST_INIT(&curr_resolvers->resolutions.wait);
- HA_SPIN_INIT(&curr_resolvers->lock);
- }
- else if (strcmp(args[0], "nameserver") == 0) { /* nameserver definition */
- struct dns_nameserver *newnameserver = NULL;
- struct sockaddr_storage *sk;
- int port1, port2;
-
- if (!*args[2]) {
- ha_alert("parsing [%s:%d] : '%s' expects <name> and <addr>[:<port>] as arguments.\n",
- file, linenum, args[0]);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
-
- err = invalid_char(args[1]);
- if (err) {
- ha_alert("parsing [%s:%d] : character '%c' is not permitted in server name '%s'.\n",
- file, linenum, *err, args[1]);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
-
- list_for_each_entry(newnameserver, &curr_resolvers->nameservers, list) {
- /* Error if two resolvers owns the same name */
- if (strcmp(newnameserver->id, args[1]) == 0) {
- ha_alert("Parsing [%s:%d]: nameserver '%s' has same name as another nameserver (declared at %s:%d).\n",
- file, linenum, args[1], newnameserver->conf.file, newnameserver->conf.line);
- err_code |= ERR_ALERT | ERR_FATAL;
- }
- }
-
- sk = str2sa_range(args[2], NULL, &port1, &port2, NULL, NULL,
- &errmsg, NULL, NULL, PA_O_RESOLVE | PA_O_PORT_OK | PA_O_PORT_MAND | PA_O_DGRAM);
- if (!sk) {
- ha_alert("parsing [%s:%d] : '%s %s' : %s\n", file, linenum, args[0], args[1], errmsg);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
-
- if ((newnameserver = calloc(1, sizeof(*newnameserver))) == NULL) {
- ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
- err_code |= ERR_ALERT | ERR_ABORT;
- goto out;
- }
-
- if (dns_dgram_init(newnameserver, sk) < 0) {
- ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
- err_code |= ERR_ALERT | ERR_ABORT;
- goto out;
- }
-
- if ((newnameserver->conf.file = strdup(file)) == NULL) {
- ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
- err_code |= ERR_ALERT | ERR_ABORT;
- goto out;
- }
-
- if ((newnameserver->id = strdup(args[1])) == NULL) {
- ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
- err_code |= ERR_ALERT | ERR_ABORT;
- goto out;
- }
-
- newnameserver->parent = curr_resolvers;
- newnameserver->process_responses = resolv_process_responses;
- newnameserver->conf.line = linenum;
- /* the nameservers are linked backward first */
- LIST_ADDQ(&curr_resolvers->nameservers, &newnameserver->list);
- }
- else if (strcmp(args[0], "parse-resolv-conf") == 0) {
- struct dns_nameserver *newnameserver = NULL;
- const char *whitespace = "\r\n\t ";
- char *resolv_line = NULL;
- int resolv_linenum = 0;
- FILE *f = NULL;
- char *address = NULL;
- struct sockaddr_storage *sk = NULL;
- struct protocol *proto;
- int duplicate_name = 0;
-
- if ((resolv_line = malloc(sizeof(*resolv_line) * LINESIZE)) == NULL) {
- ha_alert("parsing [%s:%d] : out of memory.\n",
- file, linenum);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto resolv_out;
- }
-
- if ((f = fopen("/etc/resolv.conf", "r")) == NULL) {
- ha_alert("parsing [%s:%d] : failed to open /etc/resolv.conf.\n",
- file, linenum);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto resolv_out;
- }
-
- sk = calloc(1, sizeof(*sk));
- if (sk == NULL) {
- ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n",
- resolv_linenum);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto resolv_out;
- }
-
- while (fgets(resolv_line, LINESIZE, f) != NULL) {
- resolv_linenum++;
- if (strncmp(resolv_line, "nameserver", 10) != 0)
- continue;
-
- address = strtok(resolv_line + 10, whitespace);
- if (address == resolv_line + 10)
- continue;
-
- if (address == NULL) {
- ha_warning("parsing [/etc/resolv.conf:%d] : nameserver line is missing address.\n",
- resolv_linenum);
- err_code |= ERR_WARN;
- continue;
- }
-
- duplicate_name = 0;
- list_for_each_entry(newnameserver, &curr_resolvers->nameservers, list) {
- if (strcmp(newnameserver->id, address) == 0) {
- ha_warning("Parsing [/etc/resolv.conf:%d] : generated name for /etc/resolv.conf nameserver '%s' conflicts with another nameserver (declared at %s:%d), it appears to be a duplicate and will be excluded.\n",
- resolv_linenum, address, newnameserver->conf.file, newnameserver->conf.line);
- err_code |= ERR_WARN;
- duplicate_name = 1;
- }
- }
-
- if (duplicate_name)
- continue;
-
- memset(sk, 0, sizeof(*sk));
- if (!str2ip2(address, sk, 1)) {
- ha_warning("parsing [/etc/resolv.conf:%d] : address '%s' could not be recognized, nameserver will be excluded.\n",
- resolv_linenum, address);
- err_code |= ERR_WARN;
- continue;
- }
-
- set_host_port(sk, 53);
-
- proto = protocol_by_family(sk->ss_family);
- if (!proto || !proto->connect) {
- ha_warning("parsing [/etc/resolv.conf:%d] : '%s' : connect() not supported for this address family.\n",
- resolv_linenum, address);
- err_code |= ERR_WARN;
- continue;
- }
-
- if ((newnameserver = calloc(1, sizeof(*newnameserver))) == NULL) {
- ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n", resolv_linenum);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto resolv_out;
- }
-
- if (dns_dgram_init(newnameserver, sk) < 0) {
- ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n", resolv_linenum);
- err_code |= ERR_ALERT | ERR_FATAL;
- free(newnameserver);
- goto resolv_out;
- }
-
- newnameserver->conf.file = strdup("/etc/resolv.conf");
- if (newnameserver->conf.file == NULL) {
- ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n", resolv_linenum);
- err_code |= ERR_ALERT | ERR_FATAL;
- free(newnameserver);
- goto resolv_out;
- }
-
- newnameserver->id = strdup(address);
- if (newnameserver->id == NULL) {
- ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n", resolv_linenum);
- err_code |= ERR_ALERT | ERR_FATAL;
- free((char *)newnameserver->conf.file);
- free(newnameserver);
- goto resolv_out;
- }
-
- newnameserver->parent = curr_resolvers;
- newnameserver->process_responses = resolv_process_responses;
- newnameserver->conf.line = resolv_linenum;
- LIST_ADDQ(&curr_resolvers->nameservers, &newnameserver->list);
- }
-
-resolv_out:
- free(sk);
- free(resolv_line);
- if (f != NULL)
- fclose(f);
- }
- else if (strcmp(args[0], "hold") == 0) { /* hold periods */
- const char *res;
- unsigned int time;
-
- if (!*args[2]) {
- ha_alert("parsing [%s:%d] : '%s' expects an <event> and a <time> as arguments.\n",
- file, linenum, args[0]);
- ha_alert("<event> can be either 'valid', 'nx', 'refused', 'timeout', or 'other'\n");
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
- res = parse_time_err(args[2], &time, TIME_UNIT_MS);
- if (res == PARSE_TIME_OVER) {
- ha_alert("parsing [%s:%d]: timer overflow in argument <%s> to <%s>, maximum value is 2147483647 ms (~24.8 days).\n",
- file, linenum, args[1], args[0]);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
- else if (res == PARSE_TIME_UNDER) {
- ha_alert("parsing [%s:%d]: timer underflow in argument <%s> to <%s>, minimum non-null value is 1 ms.\n",
- file, linenum, args[1], args[0]);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
- else if (res) {
- ha_alert("parsing [%s:%d]: unexpected character '%c' in argument to <%s>.\n",
- file, linenum, *res, args[0]);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
- if (strcmp(args[1], "nx") == 0)
- curr_resolvers->hold.nx = time;
- else if (strcmp(args[1], "other") == 0)
- curr_resolvers->hold.other = time;
- else if (strcmp(args[1], "refused") == 0)
- curr_resolvers->hold.refused = time;
- else if (strcmp(args[1], "timeout") == 0)
- curr_resolvers->hold.timeout = time;
- else if (strcmp(args[1], "valid") == 0)
- curr_resolvers->hold.valid = time;
- else if (strcmp(args[1], "obsolete") == 0)
- curr_resolvers->hold.obsolete = time;
- else {
- ha_alert("parsing [%s:%d] : '%s' unknown <event>: '%s', expects either 'nx', 'timeout', 'valid', 'obsolete' or 'other'.\n",
- file, linenum, args[0], args[1]);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
-
- }
- else if (strcmp(args[0], "accepted_payload_size") == 0) {
- int i = 0;
-
- if (!*args[1]) {
- ha_alert("parsing [%s:%d] : '%s' expects <nb> as argument.\n",
- file, linenum, args[0]);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
-
- i = atoi(args[1]);
- if (i < DNS_HEADER_SIZE || i > DNS_MAX_UDP_MESSAGE) {
- ha_alert("parsing [%s:%d] : '%s' must be between %d and %d inclusive (was %s).\n",
- file, linenum, args[0], DNS_HEADER_SIZE, DNS_MAX_UDP_MESSAGE, args[1]);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
-
- curr_resolvers->accepted_payload_size = i;
- }
- else if (strcmp(args[0], "resolution_pool_size") == 0) {
- ha_alert("parsing [%s:%d] : '%s' directive is not supported anymore (it never appeared in a stable release).\n",
- file, linenum, args[0]);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
- else if (strcmp(args[0], "resolve_retries") == 0) {
- if (!*args[1]) {
- ha_alert("parsing [%s:%d] : '%s' expects <nb> as argument.\n",
- file, linenum, args[0]);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
- curr_resolvers->resolve_retries = atoi(args[1]);
- }
- else if (strcmp(args[0], "timeout") == 0) {
- if (!*args[1]) {
- ha_alert("parsing [%s:%d] : '%s' expects 'retry' or 'resolve' and <time> as arguments.\n",
- file, linenum, args[0]);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
- else if (strcmp(args[1], "retry") == 0 ||
- strcmp(args[1], "resolve") == 0) {
- const char *res;
- unsigned int tout;
-
- if (!*args[2]) {
- ha_alert("parsing [%s:%d] : '%s %s' expects <time> as argument.\n",
- file, linenum, args[0], args[1]);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
- res = parse_time_err(args[2], &tout, TIME_UNIT_MS);
- if (res == PARSE_TIME_OVER) {
- ha_alert("parsing [%s:%d]: timer overflow in argument <%s> to <%s %s>, maximum value is 2147483647 ms (~24.8 days).\n",
- file, linenum, args[2], args[0], args[1]);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
- else if (res == PARSE_TIME_UNDER) {
- ha_alert("parsing [%s:%d]: timer underflow in argument <%s> to <%s %s>, minimum non-null value is 1 ms.\n",
- file, linenum, args[2], args[0], args[1]);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
- else if (res) {
- ha_alert("parsing [%s:%d]: unexpected character '%c' in argument to <%s %s>.\n",
- file, linenum, *res, args[0], args[1]);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
- if (args[1][2] == 't')
- curr_resolvers->timeout.retry = tout;
- else
- curr_resolvers->timeout.resolve = tout;
- }
- else {
- ha_alert("parsing [%s:%d] : '%s' expects 'retry' or 'resolve' and <time> as arguments got '%s'.\n",
- file, linenum, args[0], args[1]);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
- }
- else if (*args[0] != 0) {
- ha_alert("parsing [%s:%d] : unknown keyword '%s' in '%s' section\n", file, linenum, args[0], cursection);
- err_code |= ERR_ALERT | ERR_FATAL;
- goto out;
- }
-
- out:
- free(errmsg);
- return err_code;
-}
-
-int dns_dgram_init(struct dns_nameserver *ns, struct sockaddr_storage *sk)
-{
- struct dns_dgram_server *dgram;
-
- if ((dgram = calloc(1, sizeof(*dgram))) == NULL)
- return -1;
-
- /* Leave dgram partially initialized, no FD attached for
- * now. */
- dgram->conn.owner = ns;
- dgram->conn.data = &dns_dgram_cb;
- dgram->conn.t.sock.fd = -1;
- dgram->conn.addr.to = *sk;
- ns->dgram = dgram;
-
- dgram->ofs_req = ~0; /* init ring offset */
- dgram->ring_req = ring_new(2*DNS_TCP_MSG_RING_MAX_SIZE);
- if (!dgram->ring_req) {
- ha_alert("memory allocation error initializing the ring for nameserver.\n");
- goto out;
- }
-
- /* attach the task as reader */
- if (!ring_attach(dgram->ring_req)) {
- /* mark server attached to the ring */
- ha_alert("nameserver sets too many watchers > 255 on ring. This is a bug and should not happen.\n");
- goto out;
- }
- return 0;
-out:
- if (dgram->ring_req)
- ring_free(dgram->ring_req);
-
- free(dgram);
- return 0;
-}
-
-int init_dns_buffers()
-{
- dns_msg_trash = malloc(DNS_TCP_MSG_MAX_SIZE);
- if (!dns_msg_trash)
- return 0;
-
- return 1;
-}
-
-void deinit_dns_buffers()
-{
- free(dns_msg_trash);
- dns_msg_trash = NULL;
-}
+void deinit_dns_buffers()
+{
+ free(dns_msg_trash);
+ dns_msg_trash = NULL;
+}
REGISTER_PER_THREAD_ALLOC(init_dns_buffers);
REGISTER_PER_THREAD_FREE(deinit_dns_buffers);
-
-REGISTER_CONFIG_SECTION("resolvers", cfg_parse_resolvers, NULL);
-REGISTER_POST_DEINIT(resolvers_deinit);
-REGISTER_CONFIG_POSTPARSER("dns runtime resolver", resolvers_finalize_config);
diff --git a/src/resolvers.c b/src/resolvers.c
new file mode 100644
index 0000000..ded3004
--- /dev/null
+++ b/src/resolvers.c
@@ -0,0 +1,3220 @@
+/*
+ * Name server resolution
+ *
+ * Copyright 2014 Baptiste Assmann <bedis9@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ *
+ */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <sys/types.h>
+
+#include <haproxy/action.h>
+#include <haproxy/api.h>
+#include <haproxy/cfgparse.h>
+#include <haproxy/channel.h>
+#include <haproxy/check.h>
+#include <haproxy/cli.h>
+#include <haproxy/dns.h>
+#include <haproxy/errors.h>
+#include <haproxy/fd.h>
+#include <haproxy/global.h>
+#include <haproxy/http_rules.h>
+#include <haproxy/log.h>
+#include <haproxy/net_helper.h>
+#include <haproxy/protocol.h>
+#include <haproxy/proxy.h>
+#include <haproxy/resolvers.h>
+#include <haproxy/ring.h>
+#include <haproxy/sample.h>
+#include <haproxy/server.h>
+#include <haproxy/stats.h>
+#include <haproxy/stream_interface.h>
+#include <haproxy/task.h>
+#include <haproxy/tcp_rules.h>
+#include <haproxy/ticks.h>
+#include <haproxy/time.h>
+#include <haproxy/vars.h>
+
+
+struct list sec_resolvers = LIST_HEAD_INIT(sec_resolvers);
+struct list resolv_srvrq_list = LIST_HEAD_INIT(resolv_srvrq_list);
+
+static THREAD_LOCAL uint64_t resolv_query_id_seed = 0; /* random seed */
+struct resolvers *curr_resolvers = NULL;
+
+DECLARE_STATIC_POOL(resolv_answer_item_pool, "resolv_answer_item", sizeof(struct resolv_answer_item));
+DECLARE_STATIC_POOL(resolv_resolution_pool, "resolv_resolution", sizeof(struct resolv_resolution));
+DECLARE_POOL(resolv_requester_pool, "resolv_requester", sizeof(struct resolv_requester));
+
+static unsigned int resolution_uuid = 1;
+unsigned int resolv_failed_resolutions = 0;
+
+enum {
+ DNS_STAT_ID,
+ DNS_STAT_PID,
+ DNS_STAT_SENT,
+ DNS_STAT_SND_ERROR,
+ DNS_STAT_VALID,
+ DNS_STAT_UPDATE,
+ DNS_STAT_CNAME,
+ DNS_STAT_CNAME_ERROR,
+ DNS_STAT_ANY_ERR,
+ DNS_STAT_NX,
+ DNS_STAT_TIMEOUT,
+ DNS_STAT_REFUSED,
+ DNS_STAT_OTHER,
+ DNS_STAT_INVALID,
+ DNS_STAT_TOO_BIG,
+ DNS_STAT_TRUNCATED,
+ DNS_STAT_OUTDATED,
+ DNS_STAT_END,
+};
+
+static struct name_desc dns_stats[] = {
+ [DNS_STAT_ID] = { .name = "id", .desc = "ID" },
+ [DNS_STAT_PID] = { .name = "pid", .desc = "Parent ID" },
+ [DNS_STAT_SENT] = { .name = "sent", .desc = "Sent" },
+ [DNS_STAT_SND_ERROR] = { .name = "send_error", .desc = "Send error" },
+ [DNS_STAT_VALID] = { .name = "valid", .desc = "Valid" },
+ [DNS_STAT_UPDATE] = { .name = "update", .desc = "Update" },
+ [DNS_STAT_CNAME] = { .name = "cname", .desc = "CNAME" },
+ [DNS_STAT_CNAME_ERROR] = { .name = "cname_error", .desc = "CNAME error" },
+ [DNS_STAT_ANY_ERR] = { .name = "any_err", .desc = "Any errors" },
+ [DNS_STAT_NX] = { .name = "nx", .desc = "NX" },
+ [DNS_STAT_TIMEOUT] = { .name = "timeout", .desc = "Timeout" },
+ [DNS_STAT_REFUSED] = { .name = "refused", .desc = "Refused" },
+ [DNS_STAT_OTHER] = { .name = "other", .desc = "Other" },
+ [DNS_STAT_INVALID] = { .name = "invalid", .desc = "Invalid" },
+ [DNS_STAT_TOO_BIG] = { .name = "too_big", .desc = "Too big" },
+ [DNS_STAT_TRUNCATED] = { .name = "truncated", .desc = "Truncated" },
+ [DNS_STAT_OUTDATED] = { .name = "outdated", .desc = "Outdated" },
+};
+
+static struct dns_counters dns_counters;
+
+static void dns_fill_stats(void *d, struct field *stats)
+{
+ struct dns_counters *counters = d;
+ stats[DNS_STAT_ID] = mkf_str(FO_CONFIG, counters->id);
+ stats[DNS_STAT_PID] = mkf_str(FO_CONFIG, counters->pid);
+ stats[DNS_STAT_SENT] = mkf_u64(FN_GAUGE, counters->sent);
+ stats[DNS_STAT_SND_ERROR] = mkf_u64(FN_GAUGE, counters->snd_error);
+ stats[DNS_STAT_VALID] = mkf_u64(FN_GAUGE, counters->valid);
+ stats[DNS_STAT_UPDATE] = mkf_u64(FN_GAUGE, counters->update);
+ stats[DNS_STAT_CNAME] = mkf_u64(FN_GAUGE, counters->cname);
+ stats[DNS_STAT_CNAME_ERROR] = mkf_u64(FN_GAUGE, counters->cname_error);
+ stats[DNS_STAT_ANY_ERR] = mkf_u64(FN_GAUGE, counters->any_err);
+ stats[DNS_STAT_NX] = mkf_u64(FN_GAUGE, counters->nx);
+ stats[DNS_STAT_TIMEOUT] = mkf_u64(FN_GAUGE, counters->timeout);
+ stats[DNS_STAT_REFUSED] = mkf_u64(FN_GAUGE, counters->refused);
+ stats[DNS_STAT_OTHER] = mkf_u64(FN_GAUGE, counters->other);
+ stats[DNS_STAT_INVALID] = mkf_u64(FN_GAUGE, counters->invalid);
+ stats[DNS_STAT_TOO_BIG] = mkf_u64(FN_GAUGE, counters->too_big);
+ stats[DNS_STAT_TRUNCATED] = mkf_u64(FN_GAUGE, counters->truncated);
+ stats[DNS_STAT_OUTDATED] = mkf_u64(FN_GAUGE, counters->outdated);
+}
+
+static struct stats_module dns_stats_module = {
+ .name = "dns",
+ .domain_flags = STATS_DOMAIN_DNS << STATS_DOMAIN,
+ .fill_stats = dns_fill_stats,
+ .stats = dns_stats,
+ .stats_count = DNS_STAT_END,
+ .counters = &dns_counters,
+ .counters_size = sizeof(dns_counters),
+ .clearable = 0,
+};
+
+INITCALL1(STG_REGISTER, stats_register_module, &dns_stats_module);
+
+/* Returns a pointer to the resolvers matching the id <id>. NULL is returned if
+ * no match is found.
+ */
+struct resolvers *find_resolvers_by_id(const char *id)
+{
+ struct resolvers *res;
+
+ list_for_each_entry(res, &sec_resolvers, list) {
+ if (strcmp(res->id, id) == 0)
+ return res;
+ }
+ return NULL;
+}
+
+/* Compare hostnames in a case-insensitive way .
+ * Returns 0 if they are the same, non-zero otherwise
+ */
+static __inline int resolv_hostname_cmp(const char *name1, const char *name2, int len)
+{
+ int i;
+
+ for (i = 0; i < len; i++)
+ if (tolower((unsigned char)name1[i]) != tolower((unsigned char)name2[i]))
+ return -1;
+ return 0;
+}
+
+/* Returns a pointer on the SRV request matching the name <name> for the proxy
+ * <px>. NULL is returned if no match is found.
+ */
+struct resolv_srvrq *find_srvrq_by_name(const char *name, struct proxy *px)
+{
+ struct resolv_srvrq *srvrq;
+
+ list_for_each_entry(srvrq, &resolv_srvrq_list, list) {
+ if (srvrq->proxy == px && strcmp(srvrq->name, name) == 0)
+ return srvrq;
+ }
+ return NULL;
+}
+
+/* Allocates a new SRVRQ for the given server with the name <fqdn>. It returns
+ * NULL if an error occurred. */
+struct resolv_srvrq *new_resolv_srvrq(struct server *srv, char *fqdn)
+{
+ struct proxy *px = srv->proxy;
+ struct resolv_srvrq *srvrq = NULL;
+ int fqdn_len, hostname_dn_len;
+
+ fqdn_len = strlen(fqdn);
+ hostname_dn_len = resolv_str_to_dn_label(fqdn, fqdn_len + 1, trash.area,
+ trash.size);
+ if (hostname_dn_len == -1) {
+ ha_alert("config : %s '%s', server '%s': failed to parse FQDN '%s'\n",
+ proxy_type_str(px), px->id, srv->id, fqdn);
+ goto err;
+ }
+
+ if ((srvrq = calloc(1, sizeof(*srvrq))) == NULL) {
+ ha_alert("config : %s '%s', server '%s': out of memory\n",
+ proxy_type_str(px), px->id, srv->id);
+ goto err;
+ }
+ srvrq->obj_type = OBJ_TYPE_SRVRQ;
+ srvrq->proxy = px;
+ srvrq->name = strdup(fqdn);
+ srvrq->hostname_dn = strdup(trash.area);
+ srvrq->hostname_dn_len = hostname_dn_len;
+ if (!srvrq->name || !srvrq->hostname_dn) {
+ ha_alert("config : %s '%s', server '%s': out of memory\n",
+ proxy_type_str(px), px->id, srv->id);
+ goto err;
+ }
+ LIST_ADDQ(&resolv_srvrq_list, &srvrq->list);
+ return srvrq;
+
+ err:
+ if (srvrq) {
+ free(srvrq->name);
+ free(srvrq->hostname_dn);
+ free(srvrq);
+ }
+ return NULL;
+}
+
+
+/* 2 bytes random generator to generate DNS query ID */
+static inline uint16_t resolv_rnd16(void)
+{
+ if (!resolv_query_id_seed)
+ resolv_query_id_seed = now_ms;
+ resolv_query_id_seed ^= resolv_query_id_seed << 13;
+ resolv_query_id_seed ^= resolv_query_id_seed >> 7;
+ resolv_query_id_seed ^= resolv_query_id_seed << 17;
+ return resolv_query_id_seed;
+}
+
+
+static inline int resolv_resolution_timeout(struct resolv_resolution *res)
+{
+ return res->resolvers->timeout.resolve;
+}
+
+/* Updates a resolvers' task timeout for next wake up and queue it */
+static void resolv_update_resolvers_timeout(struct resolvers *resolvers)
+{
+ struct resolv_resolution *res;
+ int next;
+
+ next = tick_add(now_ms, resolvers->timeout.resolve);
+ if (!LIST_ISEMPTY(&resolvers->resolutions.curr)) {
+ res = LIST_NEXT(&resolvers->resolutions.curr, struct resolv_resolution *, list);
+ next = MIN(next, tick_add(res->last_query, resolvers->timeout.retry));
+ }
+
+ list_for_each_entry(res, &resolvers->resolutions.wait, list)
+ next = MIN(next, tick_add(res->last_resolution, resolv_resolution_timeout(res)));
+
+ resolvers->t->expire = next;
+ task_queue(resolvers->t);
+}
+
+/* Forges a DNS query. It needs the following information from the caller:
+ * - <query_id> : the DNS query id corresponding to this query
+ * - <query_type> : DNS_RTYPE_* request DNS record type (A, AAAA, ANY...)
+ * - <hostname_dn> : hostname in domain name format
+ * - <hostname_dn_len> : length of <hostname_dn>
+ *
+ * To store the query, the caller must pass a buffer <buf> and its size
+ * <bufsize>. It returns the number of written bytes in success, -1 if <buf> is
+ * too short.
+ */
+static int resolv_build_query(int query_id, int query_type, unsigned int accepted_payload_size,
+ char *hostname_dn, int hostname_dn_len, char *buf, int bufsize)
+{
+ struct dns_header dns_hdr;
+ struct dns_question qinfo;
+ struct dns_additional_record edns;
+ char *p = buf;
+
+ if (sizeof(dns_hdr) + sizeof(qinfo) + sizeof(edns) + hostname_dn_len >= bufsize)
+ return -1;
+
+ memset(buf, 0, bufsize);
+
+ /* Set dns query headers */
+ dns_hdr.id = (unsigned short) htons(query_id);
+ dns_hdr.flags = htons(0x0100); /* qr=0, opcode=0, aa=0, tc=0, rd=1, ra=0, z=0, rcode=0 */
+ dns_hdr.qdcount = htons(1); /* 1 question */
+ dns_hdr.ancount = 0;
+ dns_hdr.nscount = 0;
+ dns_hdr.arcount = htons(1);
+ memcpy(p, &dns_hdr, sizeof(dns_hdr));
+ p += sizeof(dns_hdr);
+
+ /* Set up query hostname */
+ memcpy(p, hostname_dn, hostname_dn_len);
+ p += hostname_dn_len;
+ *p++ = 0;
+
+ /* Set up query info (type and class) */
+ qinfo.qtype = htons(query_type);
+ qinfo.qclass = htons(DNS_RCLASS_IN);
+ memcpy(p, &qinfo, sizeof(qinfo));
+ p += sizeof(qinfo);
+
+ /* Set the DNS extension */
+ edns.name = 0;
+ edns.type = htons(DNS_RTYPE_OPT);
+ edns.udp_payload_size = htons(accepted_payload_size);
+ edns.extension = 0;
+ edns.data_length = 0;
+ memcpy(p, &edns, sizeof(edns));
+ p += sizeof(edns);
+
+ return (p - buf);
+}
+
+/* Sends a DNS query to resolvers associated to a resolution. It returns 0 on
+ * success, -1 otherwise.
+ */
+static int resolv_send_query(struct resolv_resolution *resolution)
+{
+ struct resolvers *resolvers = resolution->resolvers;
+ struct dns_nameserver *ns;
+ int len;
+
+ /* Update resolution */
+ resolution->nb_queries = 0;
+ resolution->nb_responses = 0;
+ resolution->last_query = now_ms;
+
+ len = resolv_build_query(resolution->query_id, resolution->query_type,
+ resolvers->accepted_payload_size,
+ resolution->hostname_dn, resolution->hostname_dn_len,
+ trash.area, trash.size);
+
+ list_for_each_entry(ns, &resolvers->nameservers, list) {
+ if (len < 0) {
+ ns->counters->snd_error++;
+ continue;
+ }
+
+ if (dns_send_nameserver(ns, trash.area, len) < 0)
+ ns->counters->snd_error++;
+ else
+ resolution->nb_queries++;
+ }
+
+ /* Push the resolution at the end of the active list */
+ LIST_DEL(&resolution->list);
+ LIST_ADDQ(&resolvers->resolutions.curr, &resolution->list);
+ return 0;
+}
+
+/* Prepares and sends a DNS resolution. It returns 1 if the query was sent, 0 if
+ * skipped and -1 if an error occurred.
+ */
+static int
+resolv_run_resolution(struct resolv_resolution *resolution)
+{
+ struct resolvers *resolvers = resolution->resolvers;
+ int query_id, i;
+
+ /* Avoid sending requests for resolutions that don't yet have an
+ * hostname, ie resolutions linked to servers that do not yet have an
+ * fqdn */
+ if (!resolution->hostname_dn)
+ return 0;
+
+ /* Check if a resolution has already been started for this server return
+ * directly to avoid resolution pill up. */
+ if (resolution->step != RSLV_STEP_NONE)
+ return 0;
+
+ /* Generates a new query id. We try at most 100 times to find a free
+ * query id */
+ for (i = 0; i < 100; ++i) {
+ query_id = resolv_rnd16();
+ if (!eb32_lookup(&resolvers->query_ids, query_id))
+ break;
+ query_id = -1;
+ }
+ if (query_id == -1) {
+ send_log(NULL, LOG_NOTICE,
+ "could not generate a query id for %s, in resolvers %s.\n",
+ resolution->hostname_dn, resolvers->id);
+ return -1;
+ }
+
+ /* Update resolution parameters */
+ resolution->query_id = query_id;
+ resolution->qid.key = query_id;
+ resolution->step = RSLV_STEP_RUNNING;
+ resolution->query_type = resolution->prefered_query_type;
+ resolution->try = resolvers->resolve_retries;
+ eb32_insert(&resolvers->query_ids, &resolution->qid);
+
+ /* Send the DNS query */
+ resolution->try -= 1;
+ resolv_send_query(resolution);
+ return 1;
+}
+
+/* Performs a name resolution for the requester <req> */
+void resolv_trigger_resolution(struct resolv_requester *req)
+{
+ struct resolvers *resolvers;
+ struct resolv_resolution *res;
+ int exp;
+
+ if (!req || !req->resolution)
+ return;
+ res = req->resolution;
+ resolvers = res->resolvers;
+
+ /* The resolution must not be triggered yet. Use the cached response, if
+ * valid */
+ exp = tick_add(res->last_resolution, resolvers->hold.valid);
+ if (resolvers->t && (res->status != RSLV_STATUS_VALID ||
+ !tick_isset(res->last_resolution) || tick_is_expired(exp, now_ms)))
+ task_wakeup(resolvers->t, TASK_WOKEN_OTHER);
+}
+
+
+/* Resets some resolution parameters to initial values and also delete the query
+ * ID from the resolver's tree.
+ */
+static void resolv_reset_resolution(struct resolv_resolution *resolution)
+{
+ /* update resolution status */
+ resolution->step = RSLV_STEP_NONE;
+ resolution->try = 0;
+ resolution->last_resolution = now_ms;
+ resolution->nb_queries = 0;
+ resolution->nb_responses = 0;
+ resolution->query_type = resolution->prefered_query_type;
+
+ /* clean up query id */
+ eb32_delete(&resolution->qid);
+ resolution->query_id = 0;
+ resolution->qid.key = 0;
+}
+
+/* Returns the query id contained in a DNS response */
+static inline unsigned short resolv_response_get_query_id(unsigned char *resp)
+{
+ return resp[0] * 256 + resp[1];
+}
+
+
+/* Analyses, re-builds and copies the name <name> from the DNS response packet
+ * <buffer>. <name> must point to the 'data_len' information or pointer 'c0'
+ * for compressed data. The result is copied into <dest>, ensuring we don't
+ * overflow using <dest_len> Returns the number of bytes the caller can move
+ * forward. If 0 it means an error occurred while parsing the name. <offset> is
+ * the number of bytes the caller could move forward.
+ */
+int resolv_read_name(unsigned char *buffer, unsigned char *bufend,
+ unsigned char *name, char *destination, int dest_len,
+ int *offset, unsigned int depth)
+{
+ int nb_bytes = 0, n = 0;
+ int label_len;
+ unsigned char *reader = name;
+ char *dest = destination;
+
+ while (1) {
+ if (reader >= bufend)
+ goto err;
+
+ /* Name compression is in use */
+ if ((*reader & 0xc0) == 0xc0) {
+ if (reader + 1 >= bufend)
+ goto err;
+
+ /* Must point BEFORE current position */
+ if ((buffer + reader[1]) > reader)
+ goto err;
+
+ if (depth++ > 100)
+ goto err;
+
+ n = resolv_read_name(buffer, bufend, buffer + (*reader & 0x3f)*256 + reader[1],
+ dest, dest_len - nb_bytes, offset, depth);
+ if (n == 0)
+ goto err;
+
+ dest += n;
+ nb_bytes += n;
+ goto out;
+ }
+
+ label_len = *reader;
+ if (label_len == 0)
+ goto out;
+
+ /* Check if:
+ * - we won't read outside the buffer
+ * - there is enough place in the destination
+ */
+ if ((reader + label_len >= bufend) || (nb_bytes + label_len >= dest_len))
+ goto err;
+
+ /* +1 to take label len + label string */
+ label_len++;
+
+ memcpy(dest, reader, label_len);
+
+ dest += label_len;
+ nb_bytes += label_len;
+ reader += label_len;
+ }
+
+ out:
+ /* offset computation:
+ * parse from <name> until finding either NULL or a pointer "c0xx"
+ */
+ reader = name;
+ *offset = 0;
+ while (reader < bufend) {
+ if ((reader[0] & 0xc0) == 0xc0) {
+ *offset += 2;
+ break;
+ }
+ else if (*reader == 0) {
+ *offset += 1;
+ break;
+ }
+ *offset += 1;
+ ++reader;
+ }
+ return nb_bytes;
+
+ err:
+ return 0;
+}
+
+/* Checks for any obsolete record, also identify any SRV request, and try to
+ * find a corresponding server.
+*/
+static void resolv_check_response(struct resolv_resolution *res)
+{
+ struct resolvers *resolvers = res->resolvers;
+ struct resolv_requester *req, *reqback;
+ struct resolv_answer_item *item, *itemback;
+ struct server *srv;
+ struct resolv_srvrq *srvrq;
+
+ list_for_each_entry_safe(item, itemback, &res->response.answer_list, list) {
+ struct resolv_answer_item *ar_item = item->ar_item;
+
+ /* clean up obsolete Additional record */
+ if (ar_item && (ar_item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
+ pool_free(resolv_answer_item_pool, ar_item);
+ item->ar_item = NULL;
+ }
+
+ /* Remove obsolete items */
+ if ((item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
+ if (item->type != DNS_RTYPE_SRV)
+ goto rm_obselete_item;
+
+ list_for_each_entry_safe(req, reqback, &res->requesters, list) {
+ if ((srvrq = objt_resolv_srvrq(req->owner)) == NULL)
+ continue;
+
+ /* Remove any associated server */
+ for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
+ HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
+ if (srv->srvrq == srvrq && srv->svc_port == item->port &&
+ item->data_len == srv->hostname_dn_len &&
+ !resolv_hostname_cmp(srv->hostname_dn, item->target, item->data_len)) {
+ snr_update_srv_status(srv, 1);
+ free(srv->hostname);
+ free(srv->hostname_dn);
+ srv->hostname = NULL;
+ srv->hostname_dn = NULL;
+ srv->hostname_dn_len = 0;
+ resolv_unlink_resolution(srv->resolv_requester);
+ }
+ HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
+ }
+ }
+
+ rm_obselete_item:
+ LIST_DEL(&item->list);
+ if (item->ar_item) {
+ pool_free(resolv_answer_item_pool, item->ar_item);
+ item->ar_item = NULL;
+ }
+ pool_free(resolv_answer_item_pool, item);
+ continue;
+ }
+
+ if (item->type != DNS_RTYPE_SRV)
+ continue;
+
+ /* Now process SRV records */
+ list_for_each_entry_safe(req, reqback, &res->requesters, list) {
+ if ((srvrq = objt_resolv_srvrq(req->owner)) == NULL)
+ continue;
+
+ /* Check if a server already uses that hostname */
+ for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
+ HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
+ if (srv->srvrq == srvrq && srv->svc_port == item->port &&
+ item->data_len == srv->hostname_dn_len &&
+ !resolv_hostname_cmp(srv->hostname_dn, item->target, item->data_len)) {
+ break;
+ }
+ HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
+ }
+
+ /* If not, try to find a server with undefined hostname */
+ if (!srv) {
+ for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
+ HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
+ if (srv->srvrq == srvrq && !srv->hostname_dn)
+ break;
+ HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
+ }
+ }
+
+ /* And update this server, if found (srv is locked here) */
+ if (srv) {
+ /* Check if an Additional Record is associated to this SRV record.
+ * Perform some sanity checks too to ensure the record can be used.
+ * If all fine, we simply pick up the IP address found and associate
+ * it to the server.
+ */
+ if ((item->ar_item != NULL) &&
+ (item->ar_item->type == DNS_RTYPE_A || item->ar_item->type == DNS_RTYPE_AAAA))
+ {
+
+ switch (item->ar_item->type) {
+ case DNS_RTYPE_A:
+ update_server_addr(srv, &(((struct sockaddr_in*)&item->ar_item->address)->sin_addr), AF_INET, "DNS additional record");
+ break;
+ case DNS_RTYPE_AAAA:
+ update_server_addr(srv, &(((struct sockaddr_in6*)&item->ar_item->address)->sin6_addr), AF_INET6, "DNS additional record");
+ break;
+ }
+
+ srv->flags |= SRV_F_NO_RESOLUTION;
+ }
+
+ if (!srv->hostname_dn) {
+ const char *msg = NULL;
+ char hostname[DNS_MAX_NAME_SIZE];
+
+ if (resolv_dn_label_to_str(item->target, item->data_len+1,
+ hostname, DNS_MAX_NAME_SIZE) == -1) {
+ HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
+ continue;
+ }
+ msg = update_server_fqdn(srv, hostname, "SRV record", 1);
+ if (msg)
+ send_log(srv->proxy, LOG_NOTICE, "%s", msg);
+ }
+
+ /* now we have an IP address associated to this server, we can update its status */
+ snr_update_srv_status(srv, 0);
+
+ srv->svc_port = item->port;
+ srv->flags &= ~SRV_F_MAPPORTS;
+
+ if (!srv->resolv_opts.ignore_weight) {
+ char weight[9];
+ int ha_weight;
+
+ /* DNS weight range if from 0 to 65535
+ * HAProxy weight is from 0 to 256
+ * The rule below ensures that weight 0 is well respected
+ * while allowing a "mapping" from DNS weight into HAProxy's one.
+ */
+ ha_weight = (item->weight + 255) / 256;
+
+ snprintf(weight, sizeof(weight), "%d", ha_weight);
+ server_parse_weight_change_request(srv, weight);
+ }
+ HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
+ }
+ }
+ }
+}
+
+/* Validates that the buffer DNS response provided in <resp> and finishing
+ * before <bufend> is valid from a DNS protocol point of view.
+ *
+ * The result is stored in <resolution>' response, buf_response,
+ * response_query_records and response_answer_records members.
+ *
+ * This function returns one of the RSLV_RESP_* code to indicate the type of
+ * error found.
+ */
+static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufend,
+ struct resolv_resolution *resolution, int max_answer_records)
+{
+ unsigned char *reader;
+ char *previous_dname, tmpname[DNS_MAX_NAME_SIZE];
+ int len, flags, offset;
+ int query_record_id;
+ int nb_saved_records;
+ struct resolv_query_item *query;
+ struct resolv_answer_item *answer_record, *tmp_record;
+ struct resolv_response *r_res;
+ int i, found = 0;
+ int cause = RSLV_RESP_ERROR;
+
+ reader = resp;
+ len = 0;
+ previous_dname = NULL;
+ query = NULL;
+ answer_record = NULL;
+
+ /* Initialization of response buffer and structure */
+ r_res = &resolution->response;
+
+ /* query id */
+ if (reader + 2 >= bufend)
+ goto invalid_resp;
+
+ r_res->header.id = reader[0] * 256 + reader[1];
+ reader += 2;
+
+ /* Flags and rcode are stored over 2 bytes
+ * First byte contains:
+ * - response flag (1 bit)
+ * - opcode (4 bits)
+ * - authoritative (1 bit)
+ * - truncated (1 bit)
+ * - recursion desired (1 bit)
+ */
+ if (reader + 2 >= bufend)
+ goto invalid_resp;
+
+ flags = reader[0] * 256 + reader[1];
+
+ if ((flags & DNS_FLAG_REPLYCODE) != DNS_RCODE_NO_ERROR) {
+ if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_NX_DOMAIN) {
+ cause = RSLV_RESP_NX_DOMAIN;
+ goto return_error;
+ }
+ else if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_REFUSED) {
+ cause = RSLV_RESP_REFUSED;
+ goto return_error;
+ }
+ else {
+ cause = RSLV_RESP_ERROR;
+ goto return_error;
+ }
+ }
+
+ /* Move forward 2 bytes for flags */
+ reader += 2;
+
+ /* 2 bytes for question count */
+ if (reader + 2 >= bufend)
+ goto invalid_resp;
+ r_res->header.qdcount = reader[0] * 256 + reader[1];
+ /* (for now) we send one query only, so we expect only one in the
+ * response too */
+ if (r_res->header.qdcount != 1) {
+ cause = RSLV_RESP_QUERY_COUNT_ERROR;
+ goto return_error;
+ }
+
+ if (r_res->header.qdcount > DNS_MAX_QUERY_RECORDS)
+ goto invalid_resp;
+ reader += 2;
+
+ /* 2 bytes for answer count */
+ if (reader + 2 >= bufend)
+ goto invalid_resp;
+ r_res->header.ancount = reader[0] * 256 + reader[1];
+ if (r_res->header.ancount == 0) {
+ cause = RSLV_RESP_ANCOUNT_ZERO;
+ goto return_error;
+ }
+
+ /* Check if too many records are announced */
+ if (r_res->header.ancount > max_answer_records)
+ goto invalid_resp;
+ reader += 2;
+
+ /* 2 bytes authority count */
+ if (reader + 2 >= bufend)
+ goto invalid_resp;
+ r_res->header.nscount = reader[0] * 256 + reader[1];
+ reader += 2;
+
+ /* 2 bytes additional count */
+ if (reader + 2 >= bufend)
+ goto invalid_resp;
+ r_res->header.arcount = reader[0] * 256 + reader[1];
+ reader += 2;
+
+ /* Parsing dns queries */
+ LIST_INIT(&r_res->query_list);
+ for (query_record_id = 0; query_record_id < r_res->header.qdcount; query_record_id++) {
+ /* Use next pre-allocated resolv_query_item after ensuring there is
+ * still one available.
+ * It's then added to our packet query list. */
+ if (query_record_id > DNS_MAX_QUERY_RECORDS)
+ goto invalid_resp;
+ query = &resolution->response_query_records[query_record_id];
+ LIST_ADDQ(&r_res->query_list, &query->list);
+
+ /* Name is a NULL terminated string in our case, since we have
+ * one query per response and the first one can't be compressed
+ * (using the 0x0c format) */
+ offset = 0;
+ len = resolv_read_name(resp, bufend, reader, query->name, DNS_MAX_NAME_SIZE, &offset, 0);
+
+ if (len == 0)
+ goto invalid_resp;
+
+ reader += offset;
+ previous_dname = query->name;
+
+ /* move forward 2 bytes for question type */
+ if (reader + 2 >= bufend)
+ goto invalid_resp;
+ query->type = reader[0] * 256 + reader[1];
+ reader += 2;
+
+ /* move forward 2 bytes for question class */
+ if (reader + 2 >= bufend)
+ goto invalid_resp;
+ query->class = reader[0] * 256 + reader[1];
+ reader += 2;
+ }
+
+ /* TRUNCATED flag must be checked after we could read the query type
+ * because a TRUNCATED SRV query type response can still be exploited */
+ if (query->type != DNS_RTYPE_SRV && flags & DNS_FLAG_TRUNCATED) {
+ cause = RSLV_RESP_TRUNCATED;
+ goto return_error;
+ }
+
+ /* now parsing response records */
+ nb_saved_records = 0;
+ for (i = 0; i < r_res->header.ancount; i++) {
+ if (reader >= bufend)
+ goto invalid_resp;
+
+ answer_record = pool_alloc(resolv_answer_item_pool);
+ if (answer_record == NULL)
+ goto invalid_resp;
+
+ /* initialization */
+ answer_record->ar_item = NULL;
+
+ offset = 0;
+ len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
+
+ if (len == 0)
+ goto invalid_resp;
+
+ /* Check if the current record dname is valid. previous_dname
+ * points either to queried dname or last CNAME target */
+ if (query->type != DNS_RTYPE_SRV && resolv_hostname_cmp(previous_dname, tmpname, len) != 0) {
+ if (i == 0) {
+ /* First record, means a mismatch issue between
+ * queried dname and dname found in the first
+ * record */
+ goto invalid_resp;
+ }
+ else {
+ /* If not the first record, this means we have a
+ * CNAME resolution error.
+ */
+ cause = RSLV_RESP_CNAME_ERROR;
+ goto return_error;
+ }
+
+ }
+
+ memcpy(answer_record->name, tmpname, len);
+ answer_record->name[len] = 0;
+
+ reader += offset;
+ if (reader >= bufend)
+ goto invalid_resp;
+
+ /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
+ if (reader + 2 > bufend)
+ goto invalid_resp;
+
+ answer_record->type = reader[0] * 256 + reader[1];
+ reader += 2;
+
+ /* 2 bytes for class (2) */
+ if (reader + 2 > bufend)
+ goto invalid_resp;
+
+ answer_record->class = reader[0] * 256 + reader[1];
+ reader += 2;
+
+ /* 4 bytes for ttl (4) */
+ if (reader + 4 > bufend)
+ goto invalid_resp;
+
+ answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
+ + reader[2] * 256 + reader[3];
+ reader += 4;
+
+ /* Now reading data len */
+ if (reader + 2 > bufend)
+ goto invalid_resp;
+
+ answer_record->data_len = reader[0] * 256 + reader[1];
+
+ /* Move forward 2 bytes for data len */
+ reader += 2;
+
+ if (reader + answer_record->data_len > bufend)
+ goto invalid_resp;
+
+ /* Analyzing record content */
+ switch (answer_record->type) {
+ case DNS_RTYPE_A:
+ /* ipv4 is stored on 4 bytes */
+ if (answer_record->data_len != 4)
+ goto invalid_resp;
+
+ answer_record->address.sa_family = AF_INET;
+ memcpy(&(((struct sockaddr_in *)&answer_record->address)->sin_addr),
+ reader, answer_record->data_len);
+ break;
+
+ case DNS_RTYPE_CNAME:
+ /* Check if this is the last record and update the caller about the status:
+ * no IP could be found and last record was a CNAME. Could be triggered
+ * by a wrong query type
+ *
+ * + 1 because answer_record_id starts at 0
+ * while number of answers is an integer and
+ * starts at 1.
+ */
+ if (i + 1 == r_res->header.ancount) {
+ cause = RSLV_RESP_CNAME_ERROR;
+ goto return_error;
+ }
+
+ offset = 0;
+ len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
+ if (len == 0)
+ goto invalid_resp;
+
+ memcpy(answer_record->target, tmpname, len);
+ answer_record->target[len] = 0;
+ previous_dname = answer_record->target;
+ break;
+
+
+ case DNS_RTYPE_SRV:
+ /* Answer must contain :
+ * - 2 bytes for the priority
+ * - 2 bytes for the weight
+ * - 2 bytes for the port
+ * - the target hostname
+ */
+ if (answer_record->data_len <= 6)
+ goto invalid_resp;
+
+ answer_record->priority = read_n16(reader);
+ reader += sizeof(uint16_t);
+ answer_record->weight = read_n16(reader);
+ reader += sizeof(uint16_t);
+ answer_record->port = read_n16(reader);
+ reader += sizeof(uint16_t);
+ offset = 0;
+ len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
+ if (len == 0)
+ goto invalid_resp;
+
+ answer_record->data_len = len;
+ memcpy(answer_record->target, tmpname, len);
+ answer_record->target[len] = 0;
+ if (answer_record->ar_item != NULL) {
+ pool_free(resolv_answer_item_pool, answer_record->ar_item);
+ answer_record->ar_item = NULL;
+ }
+ break;
+
+ case DNS_RTYPE_AAAA:
+ /* ipv6 is stored on 16 bytes */
+ if (answer_record->data_len != 16)
+ goto invalid_resp;
+
+ answer_record->address.sa_family = AF_INET6;
+ memcpy(&(((struct sockaddr_in6 *)&answer_record->address)->sin6_addr),
+ reader, answer_record->data_len);
+ break;
+
+ } /* switch (record type) */
+
+ /* Increment the counter for number of records saved into our
+ * local response */
+ nb_saved_records++;
+
+ /* Move forward answer_record->data_len for analyzing next
+ * record in the response */
+ reader += ((answer_record->type == DNS_RTYPE_SRV)
+ ? offset
+ : answer_record->data_len);
+
+ /* Lookup to see if we already had this entry */
+ found = 0;
+ list_for_each_entry(tmp_record, &r_res->answer_list, list) {
+ if (tmp_record->type != answer_record->type)
+ continue;
+
+ switch(tmp_record->type) {
+ case DNS_RTYPE_A:
+ if (!memcmp(&((struct sockaddr_in *)&answer_record->address)->sin_addr,
+ &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
+ sizeof(in_addr_t)))
+ found = 1;
+ break;
+
+ case DNS_RTYPE_AAAA:
+ if (!memcmp(&((struct sockaddr_in6 *)&answer_record->address)->sin6_addr,
+ &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
+ sizeof(struct in6_addr)))
+ found = 1;
+ break;
+
+ case DNS_RTYPE_SRV:
+ if (answer_record->data_len == tmp_record->data_len &&
+ !resolv_hostname_cmp(answer_record->target, tmp_record->target, answer_record->data_len) &&
+ answer_record->port == tmp_record->port) {
+ tmp_record->weight = answer_record->weight;
+ found = 1;
+ }
+ break;
+
+ default:
+ break;
+ }
+
+ if (found == 1)
+ break;
+ }
+
+ if (found == 1) {
+ tmp_record->last_seen = now.tv_sec;
+ pool_free(resolv_answer_item_pool, answer_record);
+ answer_record = NULL;
+ }
+ else {
+ answer_record->last_seen = now.tv_sec;
+ answer_record->ar_item = NULL;
+ LIST_ADDQ(&r_res->answer_list, &answer_record->list);
+ answer_record = NULL;
+ }
+ } /* for i 0 to ancount */
+
+ /* Save the number of records we really own */
+ r_res->header.ancount = nb_saved_records;
+
+ /* now parsing additional records for SRV queries only */
+ if (query->type != DNS_RTYPE_SRV)
+ goto skip_parsing_additional_records;
+
+ /* if we find Authority records, just skip them */
+ for (i = 0; i < r_res->header.nscount; i++) {
+ offset = 0;
+ len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE,
+ &offset, 0);
+ if (len == 0)
+ continue;
+
+ if (reader + offset + 10 >= bufend)
+ goto invalid_resp;
+
+ reader += offset;
+ /* skip 2 bytes for class */
+ reader += 2;
+ /* skip 2 bytes for type */
+ reader += 2;
+ /* skip 4 bytes for ttl */
+ reader += 4;
+ /* read data len */
+ len = reader[0] * 256 + reader[1];
+ reader += 2;
+
+ if (reader + len >= bufend)
+ goto invalid_resp;
+
+ reader += len;
+ }
+
+ nb_saved_records = 0;
+ for (i = 0; i < r_res->header.arcount; i++) {
+ if (reader >= bufend)
+ goto invalid_resp;
+
+ answer_record = pool_alloc(resolv_answer_item_pool);
+ if (answer_record == NULL)
+ goto invalid_resp;
+
+ offset = 0;
+ len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
+
+ if (len == 0) {
+ pool_free(resolv_answer_item_pool, answer_record);
+ answer_record = NULL;
+ continue;
+ }
+
+ memcpy(answer_record->name, tmpname, len);
+ answer_record->name[len] = 0;
+
+ reader += offset;
+ if (reader >= bufend)
+ goto invalid_resp;
+
+ /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
+ if (reader + 2 > bufend)
+ goto invalid_resp;
+
+ answer_record->type = reader[0] * 256 + reader[1];
+ reader += 2;
+
+ /* 2 bytes for class (2) */
+ if (reader + 2 > bufend)
+ goto invalid_resp;
+
+ answer_record->class = reader[0] * 256 + reader[1];
+ reader += 2;
+
+ /* 4 bytes for ttl (4) */
+ if (reader + 4 > bufend)
+ goto invalid_resp;
+
+ answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
+ + reader[2] * 256 + reader[3];
+ reader += 4;
+
+ /* Now reading data len */
+ if (reader + 2 > bufend)
+ goto invalid_resp;
+
+ answer_record->data_len = reader[0] * 256 + reader[1];
+
+ /* Move forward 2 bytes for data len */
+ reader += 2;
+
+ if (reader + answer_record->data_len > bufend)
+ goto invalid_resp;
+
+ /* Analyzing record content */
+ switch (answer_record->type) {
+ case DNS_RTYPE_A:
+ /* ipv4 is stored on 4 bytes */
+ if (answer_record->data_len != 4)
+ goto invalid_resp;
+
+ answer_record->address.sa_family = AF_INET;
+ memcpy(&(((struct sockaddr_in *)&answer_record->address)->sin_addr),
+ reader, answer_record->data_len);
+ break;
+
+ case DNS_RTYPE_AAAA:
+ /* ipv6 is stored on 16 bytes */
+ if (answer_record->data_len != 16)
+ goto invalid_resp;
+
+ answer_record->address.sa_family = AF_INET6;
+ memcpy(&(((struct sockaddr_in6 *)&answer_record->address)->sin6_addr),
+ reader, answer_record->data_len);
+ break;
+
+ default:
+ pool_free(resolv_answer_item_pool, answer_record);
+ answer_record = NULL;
+ continue;
+
+ } /* switch (record type) */
+
+ /* Increment the counter for number of records saved into our
+ * local response */
+ nb_saved_records++;
+
+ /* Move forward answer_record->data_len for analyzing next
+ * record in the response */
+ reader += ((answer_record->type == DNS_RTYPE_SRV)
+ ? offset
+ : answer_record->data_len);
+
+ /* Lookup to see if we already had this entry */
+ found = 0;
+ list_for_each_entry(tmp_record, &r_res->answer_list, list) {
+ if (tmp_record->type != answer_record->type)
+ continue;
+
+ switch(tmp_record->type) {
+ case DNS_RTYPE_A:
+ if (!memcmp(&((struct sockaddr_in *)&answer_record->address)->sin_addr,
+ &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
+ sizeof(in_addr_t)))
+ found = 1;
+ break;
+
+ case DNS_RTYPE_AAAA:
+ if (!memcmp(&((struct sockaddr_in6 *)&answer_record->address)->sin6_addr,
+ &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
+ sizeof(struct in6_addr)))
+ found = 1;
+ break;
+
+ default:
+ break;
+ }
+
+ if (found == 1)
+ break;
+ }
+
+ if (found == 1) {
+ tmp_record->last_seen = now.tv_sec;
+ pool_free(resolv_answer_item_pool, answer_record);
+ answer_record = NULL;
+ }
+ else {
+ answer_record->last_seen = now.tv_sec;
+ answer_record->ar_item = NULL;
+
+ // looking for the SRV record in the response list linked to this additional record
+ list_for_each_entry(tmp_record, &r_res->answer_list, list) {
+ if (tmp_record->type == DNS_RTYPE_SRV &&
+ tmp_record->ar_item == NULL &&
+ !resolv_hostname_cmp(tmp_record->target, answer_record->name, tmp_record->data_len)) {
+ /* Always use the received additional record to refresh info */
+ if (tmp_record->ar_item)
+ pool_free(resolv_answer_item_pool, tmp_record->ar_item);
+ tmp_record->ar_item = answer_record;
+ break;
+ }
+ }
+ if (tmp_record->ar_item != answer_record)
+ pool_free(resolv_answer_item_pool, answer_record);
+ answer_record = NULL;
+ }
+ } /* for i 0 to arcount */
+
+ skip_parsing_additional_records:
+
+ /* Save the number of records we really own */
+ r_res->header.arcount = nb_saved_records;
+
+ resolv_check_response(resolution);
+ return RSLV_RESP_VALID;
+
+ invalid_resp:
+ cause = RSLV_RESP_INVALID;
+
+ return_error:
+ pool_free(resolv_answer_item_pool, answer_record);
+ return cause;
+}
+
+/* Searches dn_name resolution in resp.
+ * If existing IP not found, return the first IP matching family_priority,
+ * otherwise, first ip found
+ * The following tasks are the responsibility of the caller:
+ * - <r_res> contains an error free DNS response
+ * For both cases above, resolv_validate_dns_response is required
+ * returns one of the RSLV_UPD_* code
+ */
+int resolv_get_ip_from_response(struct resolv_response *r_res,
+ struct resolv_options *resolv_opts, void *currentip,
+ short currentip_sin_family,
+ void **newip, short *newip_sin_family,
+ void *owner)
+{
+ struct resolv_answer_item *record;
+ int family_priority;
+ int currentip_found;
+ unsigned char *newip4, *newip6;
+ int currentip_sel;
+ int j;
+ int score, max_score;
+ int allowed_duplicated_ip;
+
+ family_priority = resolv_opts->family_prio;
+ allowed_duplicated_ip = resolv_opts->accept_duplicate_ip;
+ *newip = newip4 = newip6 = NULL;
+ currentip_found = 0;
+ *newip_sin_family = AF_UNSPEC;
+ max_score = -1;
+
+ /* Select an IP regarding configuration preference.
+ * Top priority is the preferred network ip version,
+ * second priority is the preferred network.
+ * the last priority is the currently used IP,
+ *
+ * For these three priorities, a score is calculated. The
+ * weight are:
+ * 8 - preferred ip version.
+ * 4 - preferred network.
+ * 2 - if the ip in the record is not affected to any other server in the same backend (duplication)
+ * 1 - current ip.
+ * The result with the biggest score is returned.
+ */
+
+ list_for_each_entry(record, &r_res->answer_list, list) {
+ void *ip;
+ unsigned char ip_type;
+
+ if (record->type == DNS_RTYPE_A) {
+ ip = &(((struct sockaddr_in *)&record->address)->sin_addr);
+ ip_type = AF_INET;
+ }
+ else if (record->type == DNS_RTYPE_AAAA) {
+ ip_type = AF_INET6;
+ ip = &(((struct sockaddr_in6 *)&record->address)->sin6_addr);
+ }
+ else
+ continue;
+ score = 0;
+
+ /* Check for preferred ip protocol. */
+ if (ip_type == family_priority)
+ score += 8;
+
+ /* Check for preferred network. */
+ for (j = 0; j < resolv_opts->pref_net_nb; j++) {
+
+ /* Compare only the same addresses class. */
+ if (resolv_opts->pref_net[j].family != ip_type)
+ continue;
+
+ if ((ip_type == AF_INET &&
+ in_net_ipv4(ip,
+ &resolv_opts->pref_net[j].mask.in4,
+ &resolv_opts->pref_net[j].addr.in4)) ||
+ (ip_type == AF_INET6 &&
+ in_net_ipv6(ip,
+ &resolv_opts->pref_net[j].mask.in6,
+ &resolv_opts->pref_net[j].addr.in6))) {
+ score += 4;
+ break;
+ }
+ }
+
+ /* Check if the IP found in the record is already affected to a
+ * member of a group. If not, the score should be incremented
+ * by 2. */
+ if (owner && snr_check_ip_callback(owner, ip, &ip_type)) {
+ if (!allowed_duplicated_ip) {
+ continue;
+ }
+ } else {
+ score += 2;
+ }
+
+ /* Check for current ip matching. */
+ if (ip_type == currentip_sin_family &&
+ ((currentip_sin_family == AF_INET &&
+ !memcmp(ip, currentip, 4)) ||
+ (currentip_sin_family == AF_INET6 &&
+ !memcmp(ip, currentip, 16)))) {
+ score++;
+ currentip_sel = 1;
+ }
+ else
+ currentip_sel = 0;
+
+ /* Keep the address if the score is better than the previous
+ * score. The maximum score is 15, if this value is reached, we
+ * break the parsing. Implicitly, this score is reached the ip
+ * selected is the current ip. */
+ if (score > max_score) {
+ if (ip_type == AF_INET)
+ newip4 = ip;
+ else
+ newip6 = ip;
+ currentip_found = currentip_sel;
+ if (score == 15)
+ return RSLV_UPD_NO;
+ max_score = score;
+ }
+ } /* list for each record entries */
+
+ /* No IP found in the response */
+ if (!newip4 && !newip6)
+ return RSLV_UPD_NO_IP_FOUND;
+
+ /* Case when the caller looks first for an IPv4 address */
+ if (family_priority == AF_INET) {
+ if (newip4) {
+ *newip = newip4;
+ *newip_sin_family = AF_INET;
+ }
+ else if (newip6) {
+ *newip = newip6;
+ *newip_sin_family = AF_INET6;
+ }
+ if (!currentip_found)
+ goto not_found;
+ }
+ /* Case when the caller looks first for an IPv6 address */
+ else if (family_priority == AF_INET6) {
+ if (newip6) {
+ *newip = newip6;
+ *newip_sin_family = AF_INET6;
+ }
+ else if (newip4) {
+ *newip = newip4;
+ *newip_sin_family = AF_INET;
+ }
+ if (!currentip_found)
+ goto not_found;
+ }
+ /* Case when the caller have no preference (we prefer IPv6) */
+ else if (family_priority == AF_UNSPEC) {
+ if (newip6) {
+ *newip = newip6;
+ *newip_sin_family = AF_INET6;
+ }
+ else if (newip4) {
+ *newip = newip4;
+ *newip_sin_family = AF_INET;
+ }
+ if (!currentip_found)
+ goto not_found;
+ }
+
+ /* No reason why we should change the server's IP address */
+ return RSLV_UPD_NO;
+
+ not_found:
+ list_for_each_entry(record, &r_res->answer_list, list) {
+ /* Move the first record to the end of the list, for internal
+ * round robin */
+ LIST_DEL(&record->list);
+ LIST_ADDQ(&r_res->answer_list, &record->list);
+ break;
+ }
+ return RSLV_UPD_SRVIP_NOT_FOUND;
+}
+
+/* Turns a domain name label into a string.
+ *
+ * <dn> must be a null-terminated string. <dn_len> must include the terminating
+ * null byte. <str> must be allocated and its size must be passed in <str_len>.
+ *
+ * In case of error, -1 is returned, otherwise, the number of bytes copied in
+ * <str> (including the terminating null byte).
+ */
+int resolv_dn_label_to_str(const char *dn, int dn_len, char *str, int str_len)
+{
+ char *ptr;
+ int i, sz;
+
+ if (str_len < dn_len - 1)
+ return -1;
+
+ ptr = str;
+ for (i = 0; i < dn_len-1; ++i) {
+ sz = dn[i];
+ if (i)
+ *ptr++ = '.';
+ memcpy(ptr, dn+i+1, sz);
+ ptr += sz;
+ i += sz;
+ }
+ *ptr++ = '\0';
+ return (ptr - str);
+}
+
+/* Turns a string into domain name label: www.haproxy.org into 3www7haproxy3org
+ *
+ * <str> must be a null-terminated string. <str_len> must include the
+ * terminating null byte. <dn> buffer must be allocated and its size must be
+ * passed in <dn_len>.
+ *
+ * In case of error, -1 is returned, otherwise, the number of bytes copied in
+ * <dn> (excluding the terminating null byte).
+ */
+int resolv_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len)
+{
+ int i, offset;
+
+ if (dn_len < str_len + 1)
+ return -1;
+
+ /* First byte of dn will be used to store the length of the first
+ * label */
+ offset = 0;
+ for (i = 0; i < str_len; ++i) {
+ if (str[i] == '.') {
+ /* 2 or more consecutive dots is invalid */
+ if (i == offset)
+ return -1;
+
+ /* ignore trailing dot */
+ if (i + 2 == str_len) {
+ i++;
+ break;
+ }
+
+ dn[offset] = (i - offset);
+ offset = i+1;
+ continue;
+ }
+ dn[i+1] = str[i];
+ }
+ dn[offset] = (i - offset - 1);
+ dn[i] = '\0';
+ return i;
+}
+
+/* Validates host name:
+ * - total size
+ * - each label size individually
+ * returns:
+ * 0 in case of error. If <err> is not NULL, an error message is stored there.
+ * 1 when no error. <err> is left unaffected.
+ */
+int resolv_hostname_validation(const char *string, char **err)
+{
+ int i;
+
+ if (strlen(string) > DNS_MAX_NAME_SIZE) {
+ if (err)
+ *err = DNS_TOO_LONG_FQDN;
+ return 0;
+ }
+
+ while (*string) {
+ i = 0;
+ while (*string && *string != '.' && i < DNS_MAX_LABEL_SIZE) {
+ if (!(*string == '-' || *string == '_' ||
+ (*string >= 'a' && *string <= 'z') ||
+ (*string >= 'A' && *string <= 'Z') ||
+ (*string >= '0' && *string <= '9'))) {
+ if (err)
+ *err = DNS_INVALID_CHARACTER;
+ return 0;
+ }
+ i++;
+ string++;
+ }
+
+ if (!(*string))
+ break;
+
+ if (*string != '.' && i >= DNS_MAX_LABEL_SIZE) {
+ if (err)
+ *err = DNS_LABEL_TOO_LONG;
+ return 0;
+ }
+
+ string++;
+ }
+ return 1;
+}
+
+/* Picks up an available resolution from the different resolution list
+ * associated to a resolvers section, in this order:
+ * 1. check in resolutions.curr for the same hostname and query_type
+ * 2. check in resolutions.wait for the same hostname and query_type
+ * 3. Get a new resolution from resolution pool
+ *
+ * Returns an available resolution, NULL if none found.
+ */
+static struct resolv_resolution *resolv_pick_resolution(struct resolvers *resolvers,
+ char **hostname_dn, int hostname_dn_len,
+ int query_type)
+{
+ struct resolv_resolution *res;
+
+ if (!*hostname_dn)
+ goto from_pool;
+
+ /* Search for same hostname and query type in resolutions.curr */
+ list_for_each_entry(res, &resolvers->resolutions.curr, list) {
+ if (!res->hostname_dn)
+ continue;
+ if ((query_type == res->prefered_query_type) &&
+ hostname_dn_len == res->hostname_dn_len &&
+ !resolv_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
+ return res;
+ }
+
+ /* Search for same hostname and query type in resolutions.wait */
+ list_for_each_entry(res, &resolvers->resolutions.wait, list) {
+ if (!res->hostname_dn)
+ continue;
+ if ((query_type == res->prefered_query_type) &&
+ hostname_dn_len == res->hostname_dn_len &&
+ !resolv_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
+ return res;
+ }
+
+ from_pool:
+ /* No resolution could be found, so let's allocate a new one */
+ res = pool_alloc(resolv_resolution_pool);
+ if (res) {
+ memset(res, 0, sizeof(*res));
+ res->resolvers = resolvers;
+ res->uuid = resolution_uuid;
+ res->status = RSLV_STATUS_NONE;
+ res->step = RSLV_STEP_NONE;
+ res->last_valid = now_ms;
+
+ LIST_INIT(&res->requesters);
+ LIST_INIT(&res->response.answer_list);
+
+ res->prefered_query_type = query_type;
+ res->query_type = query_type;
+ res->hostname_dn = *hostname_dn;
+ res->hostname_dn_len = hostname_dn_len;
+
+ ++resolution_uuid;
+
+ /* Move the resolution to the resolvers wait queue */
+ LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
+ }
+ return res;
+}
+
+/* Releases a resolution from its requester(s) and move it back to the pool */
+static void resolv_free_resolution(struct resolv_resolution *resolution)
+{
+ struct resolv_requester *req, *reqback;
+ struct resolv_answer_item *item, *itemback;
+
+ /* clean up configuration */
+ resolv_reset_resolution(resolution);
+ resolution->hostname_dn = NULL;
+ resolution->hostname_dn_len = 0;
+
+ list_for_each_entry_safe(req, reqback, &resolution->requesters, list) {
+ LIST_DEL(&req->list);
+ req->resolution = NULL;
+ }
+
+ list_for_each_entry_safe(item, itemback, &resolution->response.answer_list, list) {
+ LIST_DEL(&item->list);
+ if (item->ar_item) {
+ pool_free(resolv_answer_item_pool, item->ar_item);
+ item->ar_item = NULL;
+ }
+ pool_free(resolv_answer_item_pool, item);
+ }
+
+ LIST_DEL(&resolution->list);
+ pool_free(resolv_resolution_pool, resolution);
+}
+
+/* Links a requester (a server or a resolv_srvrq) with a resolution. It returns 0
+ * on success, -1 otherwise.
+ */
+int resolv_link_resolution(void *requester, int requester_type, int requester_locked)
+{
+ struct resolv_resolution *res = NULL;
+ struct resolv_requester *req;
+ struct resolvers *resolvers;
+ struct server *srv = NULL;
+ struct resolv_srvrq *srvrq = NULL;
+ struct stream *stream = NULL;
+ char **hostname_dn;
+ int hostname_dn_len, query_type;
+
+ switch (requester_type) {
+ case OBJ_TYPE_SERVER:
+ srv = (struct server *)requester;
+ hostname_dn = &srv->hostname_dn;
+ hostname_dn_len = srv->hostname_dn_len;
+ resolvers = srv->resolvers;
+ query_type = ((srv->resolv_opts.family_prio == AF_INET)
+ ? DNS_RTYPE_A
+ : DNS_RTYPE_AAAA);
+ break;
+
+ case OBJ_TYPE_SRVRQ:
+ srvrq = (struct resolv_srvrq *)requester;
+ hostname_dn = &srvrq->hostname_dn;
+ hostname_dn_len = srvrq->hostname_dn_len;
+ resolvers = srvrq->resolvers;
+ query_type = DNS_RTYPE_SRV;
+ break;
+
+ case OBJ_TYPE_STREAM:
+ stream = (struct stream *)requester;
+ hostname_dn = &stream->resolv_ctx.hostname_dn;
+ hostname_dn_len = stream->resolv_ctx.hostname_dn_len;
+ resolvers = stream->resolv_ctx.parent->arg.resolv.resolvers;
+ query_type = ((stream->resolv_ctx.parent->arg.resolv.opts->family_prio == AF_INET)
+ ? DNS_RTYPE_A
+ : DNS_RTYPE_AAAA);
+ break;
+ default:
+ goto err;
+ }
+
+ /* Get a resolution from the resolvers' wait queue or pool */
+ if ((res = resolv_pick_resolution(resolvers, hostname_dn, hostname_dn_len, query_type)) == NULL)
+ goto err;
+
+ if (srv) {
+ if (!requester_locked)
+ HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
+ if (srv->resolv_requester == NULL) {
+ if ((req = pool_alloc(resolv_requester_pool)) == NULL) {
+ if (!requester_locked)
+ HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
+ goto err;
+ }
+ req->owner = &srv->obj_type;
+ srv->resolv_requester = req;
+ }
+ else
+ req = srv->resolv_requester;
+ if (!requester_locked)
+ HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
+
+ req->requester_cb = snr_resolution_cb;
+ req->requester_error_cb = snr_resolution_error_cb;
+ }
+ else if (srvrq) {
+ if (srvrq->requester == NULL) {
+ if ((req = pool_alloc(resolv_requester_pool)) == NULL)
+ goto err;
+ req->owner = &srvrq->obj_type;
+ srvrq->requester = req;
+ }
+ else
+ req = srvrq->requester;
+
+ req->requester_cb = snr_resolution_cb;
+ req->requester_error_cb = snr_resolution_error_cb;
+ }
+ else if (stream) {
+ if (stream->resolv_ctx.requester == NULL) {
+ if ((req = pool_alloc(resolv_requester_pool)) == NULL)
+ goto err;
+ req->owner = &stream->obj_type;
+ stream->resolv_ctx.requester = req;
+ }
+ else
+ req = stream->resolv_ctx.requester;
+
+ req->requester_cb = act_resolution_cb;
+ req->requester_error_cb = act_resolution_error_cb;
+ }
+ else
+ goto err;
+
+ req->resolution = res;
+
+ LIST_ADDQ(&res->requesters, &req->list);
+ return 0;
+
+ err:
+ if (res && LIST_ISEMPTY(&res->requesters))
+ resolv_free_resolution(res);
+ return -1;
+}
+
+/* Removes a requester from a DNS resolution. It takes takes care of all the
+ * consequences. It also cleans up some parameters from the requester.
+ */
+void resolv_unlink_resolution(struct resolv_requester *requester)
+{
+ struct resolv_resolution *res;
+ struct resolv_requester *req;
+
+ /* Nothing to do */
+ if (!requester || !requester->resolution)
+ return;
+ res = requester->resolution;
+
+ /* Clean up the requester */
+ LIST_DEL(&requester->list);
+ requester->resolution = NULL;
+
+ /* We need to find another requester linked on this resolution */
+ if (!LIST_ISEMPTY(&res->requesters))
+ req = LIST_NEXT(&res->requesters, struct resolv_requester *, list);
+ else {
+ resolv_free_resolution(res);
+ return;
+ }
+
+ /* Move hostname_dn related pointers to the next requester */
+ switch (obj_type(req->owner)) {
+ case OBJ_TYPE_SERVER:
+ res->hostname_dn = __objt_server(req->owner)->hostname_dn;
+ res->hostname_dn_len = __objt_server(req->owner)->hostname_dn_len;
+ break;
+ case OBJ_TYPE_SRVRQ:
+ res->hostname_dn = __objt_resolv_srvrq(req->owner)->hostname_dn;
+ res->hostname_dn_len = __objt_resolv_srvrq(req->owner)->hostname_dn_len;
+ break;
+ case OBJ_TYPE_STREAM:
+ res->hostname_dn = __objt_stream(req->owner)->resolv_ctx.hostname_dn;
+ res->hostname_dn_len = __objt_stream(req->owner)->resolv_ctx.hostname_dn_len;
+ break;
+ default:
+ res->hostname_dn = NULL;
+ res->hostname_dn_len = 0;
+ break;
+ }
+}
+
+/* Called when a network IO is generated on a name server socket for an incoming
+ * packet. It performs the following actions:
+ * - check if the packet requires processing (not outdated resolution)
+ * - ensure the DNS packet received is valid and call requester's callback
+ * - call requester's error callback if invalid response
+ * - check the dn_name in the packet against the one sent
+ */
+static int resolv_process_responses(struct dns_nameserver *ns)
+{
+ struct dns_counters *tmpcounters;
+ struct resolvers *resolvers;
+ struct resolv_resolution *res;
+ struct resolv_query_item *query;
+ unsigned char buf[DNS_MAX_UDP_MESSAGE + 1];
+ unsigned char *bufend;
+ int buflen, dns_resp;
+ int max_answer_records;
+ unsigned short query_id;
+ struct eb32_node *eb;
+ struct resolv_requester *req;
+
+ resolvers = ns->parent;
+ HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
+
+ /* process all pending input messages */
+ while (1) {
+ /* read message received */
+ memset(buf, '\0', resolvers->accepted_payload_size + 1);
+ if ((buflen = dns_recv_nameserver(ns, (void *)buf, sizeof(buf))) <= 0) {
+ break;
+ }
+
+ /* message too big */
+ if (buflen > resolvers->accepted_payload_size) {
+ ns->counters->too_big++;
+ continue;
+ }
+
+ /* initializing variables */
+ bufend = buf + buflen; /* pointer to mark the end of the buffer */
+
+ /* read the query id from the packet (16 bits) */
+ if (buf + 2 > bufend) {
+ ns->counters->invalid++;
+ continue;
+ }
+ query_id = resolv_response_get_query_id(buf);
+
+ /* search the query_id in the pending resolution tree */
+ eb = eb32_lookup(&resolvers->query_ids, query_id);
+ if (eb == NULL) {
+ /* unknown query id means an outdated response and can be safely ignored */
+ ns->counters->outdated++;
+ continue;
+ }
+
+ /* known query id means a resolution in progress */
+ res = eb32_entry(eb, struct resolv_resolution, qid);
+ /* number of responses received */
+ res->nb_responses++;
+
+ max_answer_records = (resolvers->accepted_payload_size - DNS_HEADER_SIZE) / DNS_MIN_RECORD_SIZE;
+ dns_resp = resolv_validate_dns_response(buf, bufend, res, max_answer_records);
+
+ switch (dns_resp) {
+ case RSLV_RESP_VALID:
+ break;
+
+ case RSLV_RESP_INVALID:
+ case RSLV_RESP_QUERY_COUNT_ERROR:
+ case RSLV_RESP_WRONG_NAME:
+ res->status = RSLV_STATUS_INVALID;
+ ns->counters->invalid++;
+ break;
+
+ case RSLV_RESP_NX_DOMAIN:
+ res->status = RSLV_STATUS_NX;
+ ns->counters->nx++;
+ break;
+
+ case RSLV_RESP_REFUSED:
+ res->status = RSLV_STATUS_REFUSED;
+ ns->counters->refused++;
+ break;
+
+ case RSLV_RESP_ANCOUNT_ZERO:
+ res->status = RSLV_STATUS_OTHER;
+ ns->counters->any_err++;
+ break;
+
+ case RSLV_RESP_CNAME_ERROR:
+ res->status = RSLV_STATUS_OTHER;
+ ns->counters->cname_error++;
+ break;
+
+ case RSLV_RESP_TRUNCATED:
+ res->status = RSLV_STATUS_OTHER;
+ ns->counters->truncated++;
+ break;
+
+ case RSLV_RESP_NO_EXPECTED_RECORD:
+ case RSLV_RESP_ERROR:
+ case RSLV_RESP_INTERNAL:
+ res->status = RSLV_STATUS_OTHER;
+ ns->counters->other++;
+ break;
+ }
+
+ /* Wait all nameservers response to handle errors */
+ if (dns_resp != RSLV_RESP_VALID && res->nb_responses < res->nb_queries)
+ continue;
+
+ /* Process error codes */
+ if (dns_resp != RSLV_RESP_VALID) {
+ if (res->prefered_query_type != res->query_type) {
+ /* The fallback on the query type was already performed,
+ * so check the try counter. If it falls to 0, we can
+ * report an error. Else, wait the next attempt. */
+ if (!res->try)
+ goto report_res_error;
+ }
+ else {
+ /* Fallback from A to AAAA or the opposite and re-send
+ * the resolution immediately. try counter is not
+ * decremented. */
+ if (res->prefered_query_type == DNS_RTYPE_A) {
+ res->query_type = DNS_RTYPE_AAAA;
+ resolv_send_query(res);
+ }
+ else if (res->prefered_query_type == DNS_RTYPE_AAAA) {
+ res->query_type = DNS_RTYPE_A;
+ resolv_send_query(res);
+ }
+ }
+ continue;
+ }
+
+ /* Now let's check the query's dname corresponds to the one we
+ * sent. We can check only the first query of the list. We send
+ * one query at a time so we get one query in the response */
+ query = LIST_NEXT(&res->response.query_list, struct resolv_query_item *, list);
+ if (query && resolv_hostname_cmp(query->name, res->hostname_dn, res->hostname_dn_len) != 0) {
+ dns_resp = RSLV_RESP_WRONG_NAME;
+ ns->counters->other++;
+ goto report_res_error;
+ }
+
+ /* So the resolution succeeded */
+ res->status = RSLV_STATUS_VALID;
+ res->last_valid = now_ms;
+ ns->counters->valid++;
+ goto report_res_success;
+
+ report_res_error:
+ list_for_each_entry(req, &res->requesters, list)
+ req->requester_error_cb(req, dns_resp);
+ resolv_reset_resolution(res);
+ LIST_DEL(&res->list);
+ LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
+ continue;
+
+ report_res_success:
+ /* Only the 1rst requester s managed by the server, others are
+ * from the cache */
+ tmpcounters = ns->counters;
+ list_for_each_entry(req, &res->requesters, list) {
+ struct server *s = objt_server(req->owner);
+
+ if (s)
+ HA_SPIN_LOCK(SERVER_LOCK, &s->lock);
+ req->requester_cb(req, tmpcounters);
+ if (s)
+ HA_SPIN_UNLOCK(SERVER_LOCK, &s->lock);
+ tmpcounters = NULL;
+ }
+
+ resolv_reset_resolution(res);
+ LIST_DEL(&res->list);
+ LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
+ continue;
+ }
+ resolv_update_resolvers_timeout(resolvers);
+ HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
+
+ return buflen;
+}
+
+/* Processes DNS resolution. First, it checks the active list to detect expired
+ * resolutions and retry them if possible. Else a timeout is reported. Then, it
+ * checks the wait list to trigger new resolutions.
+ */
+static struct task *process_resolvers(struct task *t, void *context, unsigned short state)
+{
+ struct resolvers *resolvers = context;
+ struct resolv_resolution *res, *resback;
+ int exp;
+
+ HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
+
+ /* Handle all expired resolutions from the active list */
+ list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
+ /* When we find the first resolution in the future, then we can
+ * stop here */
+ exp = tick_add(res->last_query, resolvers->timeout.retry);
+ if (!tick_is_expired(exp, now_ms))
+ break;
+
+ /* If current resolution has been tried too many times and
+ * finishes in timeout we update its status and remove it from
+ * the list */
+ if (!res->try) {
+ struct resolv_requester *req;
+
+ /* Notify the result to the requesters */
+ if (!res->nb_responses)
+ res->status = RSLV_STATUS_TIMEOUT;
+ list_for_each_entry(req, &res->requesters, list)
+ req->requester_error_cb(req, res->status);
+
+ /* Clean up resolution info and remove it from the
+ * current list */
+ resolv_reset_resolution(res);
+ LIST_DEL(&res->list);
+ LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
+ }
+ else {
+ /* Otherwise resend the DNS query and requeue the resolution */
+ if (!res->nb_responses || res->prefered_query_type != res->query_type) {
+ /* No response received (a real timeout) or fallback already done */
+ res->query_type = res->prefered_query_type;
+ res->try--;
+ }
+ else {
+ /* Fallback from A to AAAA or the opposite and re-send
+ * the resolution immediately. try counter is not
+ * decremented. */
+ if (res->prefered_query_type == DNS_RTYPE_A)
+ res->query_type = DNS_RTYPE_AAAA;
+ else if (res->prefered_query_type == DNS_RTYPE_AAAA)
+ res->query_type = DNS_RTYPE_A;
+ else
+ res->try--;
+ }
+ resolv_send_query(res);
+ }
+ }
+
+ /* Handle all resolutions in the wait list */
+ list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
+ exp = tick_add(res->last_resolution, resolv_resolution_timeout(res));
+ if (tick_isset(res->last_resolution) && !tick_is_expired(exp, now_ms))
+ continue;
+
+ if (resolv_run_resolution(res) != 1) {
+ res->last_resolution = now_ms;
+ LIST_DEL(&res->list);
+ LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
+ }
+ }
+
+ resolv_update_resolvers_timeout(resolvers);
+ HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
+ return t;
+}
+
+/* Release memory allocated by DNS */
+static void resolvers_deinit(void)
+{
+ struct resolvers *resolvers, *resolversback;
+ struct dns_nameserver *ns, *nsback;
+ struct resolv_resolution *res, *resback;
+ struct resolv_requester *req, *reqback;
+ struct resolv_srvrq *srvrq, *srvrqback;
+
+ list_for_each_entry_safe(resolvers, resolversback, &sec_resolvers, list) {
+ list_for_each_entry_safe(ns, nsback, &resolvers->nameservers, list) {
+ free(ns->id);
+ free((char *)ns->conf.file);
+ if (ns->dgram) {
+ if (ns->dgram->conn.t.sock.fd != -1) {
+ fd_delete(ns->dgram->conn.t.sock.fd);
+ close(ns->dgram->conn.t.sock.fd);
+ }
+ if (ns->dgram->ring_req)
+ ring_free(ns->dgram->ring_req);
+ free(ns->dgram);
+ }
+ LIST_DEL(&ns->list);
+ EXTRA_COUNTERS_FREE(ns->extra_counters);
+ free(ns);
+ }
+
+ list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
+ list_for_each_entry_safe(req, reqback, &res->requesters, list) {
+ LIST_DEL(&req->list);
+ pool_free(resolv_requester_pool, req);
+ }
+ resolv_free_resolution(res);
+ }
+
+ list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
+ list_for_each_entry_safe(req, reqback, &res->requesters, list) {
+ LIST_DEL(&req->list);
+ pool_free(resolv_requester_pool, req);
+ }
+ resolv_free_resolution(res);
+ }
+
+ free(resolvers->id);
+ free((char *)resolvers->conf.file);
+ task_destroy(resolvers->t);
+ LIST_DEL(&resolvers->list);
+ free(resolvers);
+ }
+
+ list_for_each_entry_safe(srvrq, srvrqback, &resolv_srvrq_list, list) {
+ free(srvrq->name);
+ free(srvrq->hostname_dn);
+ LIST_DEL(&srvrq->list);
+ free(srvrq);
+ }
+}
+
+/* Finalizes the DNS configuration by allocating required resources and checking
+ * live parameters.
+ * Returns 0 on success, ERR_* flags otherwise.
+ */
+static int resolvers_finalize_config(void)
+{
+ struct resolvers *resolvers;
+ struct proxy *px;
+ int err_code = 0;
+
+ /* allocate pool of resolution per resolvers */
+ list_for_each_entry(resolvers, &sec_resolvers, list) {
+ struct dns_nameserver *ns;
+ struct task *t;
+
+ /* Check if we can create the socket with nameservers info */
+ list_for_each_entry(ns, &resolvers->nameservers, list) {
+ int fd;
+
+ if (ns->dgram) {
+ /* Check nameserver info */
+ if ((fd = socket(ns->dgram->conn.addr.to.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
+ ha_alert("config : resolvers '%s': can't create socket for nameserver '%s'.\n",
+ resolvers->id, ns->id);
+ err_code |= (ERR_ALERT|ERR_ABORT);
+ continue;
+ }
+ if (connect(fd, (struct sockaddr*)&ns->dgram->conn.addr.to, get_addr_len(&ns->dgram->conn.addr.to)) == -1) {
+ ha_alert("config : resolvers '%s': can't connect socket for nameserver '%s'.\n",
+ resolvers->id, ns->id);
+ close(fd);
+ err_code |= (ERR_ALERT|ERR_ABORT);
+ continue;
+ }
+ close(fd);
+ }
+ }
+
+ /* Create the task associated to the resolvers section */
+ if ((t = task_new(MAX_THREADS_MASK)) == NULL) {
+ ha_alert("config : resolvers '%s' : out of memory.\n", resolvers->id);
+ err_code |= (ERR_ALERT|ERR_ABORT);
+ goto err;
+ }
+
+ /* Update task's parameters */
+ t->process = process_resolvers;
+ t->context = resolvers;
+ resolvers->t = t;
+ task_wakeup(t, TASK_WOKEN_INIT);
+ }
+
+ for (px = proxies_list; px; px = px->next) {
+ struct server *srv;
+
+ for (srv = px->srv; srv; srv = srv->next) {
+ struct resolvers *resolvers;
+
+ if (!srv->resolvers_id)
+ continue;
+
+ if ((resolvers = find_resolvers_by_id(srv->resolvers_id)) == NULL) {
+ ha_alert("config : %s '%s', server '%s': unable to find required resolvers '%s'\n",
+ proxy_type_str(px), px->id, srv->id, srv->resolvers_id);
+ err_code |= (ERR_ALERT|ERR_ABORT);
+ continue;
+ }
+ srv->resolvers = resolvers;
+
+ if (srv->srvrq && !srv->srvrq->resolvers) {
+ srv->srvrq->resolvers = srv->resolvers;
+ if (resolv_link_resolution(srv->srvrq, OBJ_TYPE_SRVRQ, 0) == -1) {
+ ha_alert("config : %s '%s' : unable to set DNS resolution for server '%s'.\n",
+ proxy_type_str(px), px->id, srv->id);
+ err_code |= (ERR_ALERT|ERR_ABORT);
+ continue;
+ }
+ }
+ if (resolv_link_resolution(srv, OBJ_TYPE_SERVER, 0) == -1) {
+ ha_alert("config : %s '%s', unable to set DNS resolution for server '%s'.\n",
+ proxy_type_str(px), px->id, srv->id);
+ err_code |= (ERR_ALERT|ERR_ABORT);
+ continue;
+ }
+ }
+ }
+
+ if (err_code & (ERR_ALERT|ERR_ABORT))
+ goto err;
+
+ return err_code;
+ err:
+ resolvers_deinit();
+ return err_code;
+
+}
+
+static int stats_dump_resolv_to_buffer(struct stream_interface *si,
+ struct dns_nameserver *ns,
+ struct field *stats, size_t stats_count,
+ struct list *stat_modules)
+{
+ struct appctx *appctx = __objt_appctx(si->end);
+ struct channel *rep = si_ic(si);
+ struct stats_module *mod;
+ size_t idx = 0;
+
+ memset(stats, 0, sizeof(struct field) * stats_count);
+
+ list_for_each_entry(mod, stat_modules, list) {
+ struct counters_node *counters = EXTRA_COUNTERS_GET(ns->extra_counters, mod);
+
+ mod->fill_stats(counters, stats + idx);
+ idx += mod->stats_count;
+ }
+
+ if (!stats_dump_one_line(stats, idx, appctx))
+ return 0;
+
+ if (!stats_putchk(rep, NULL, &trash))
+ goto full;
+
+ return 1;
+
+ full:
+ si_rx_room_rdy(si);
+ return 0;
+}
+
+/* Uses <appctx.ctx.stats.obj1> as a pointer to the current resolver and <obj2>
+ * as a pointer to the current nameserver.
+ */
+int stats_dump_resolvers(struct stream_interface *si,
+ struct field *stats, size_t stats_count,
+ struct list *stat_modules)
+{
+ struct appctx *appctx = __objt_appctx(si->end);
+ struct channel *rep = si_ic(si);
+ struct resolvers *resolver = appctx->ctx.stats.obj1;
+ struct dns_nameserver *ns = appctx->ctx.stats.obj2;
+
+ if (!resolver)
+ resolver = LIST_NEXT(&sec_resolvers, struct resolvers *, list);
+
+ /* dump resolvers */
+ list_for_each_entry_from(resolver, &sec_resolvers, list) {
+ appctx->ctx.stats.obj1 = resolver;
+
+ ns = appctx->ctx.stats.obj2 ?
+ appctx->ctx.stats.obj2 :
+ LIST_NEXT(&resolver->nameservers, struct dns_nameserver *, list);
+
+ list_for_each_entry_from(ns, &resolver->nameservers, list) {
+ appctx->ctx.stats.obj2 = ns;
+
+ if (buffer_almost_full(&rep->buf))
+ goto full;
+
+ if (!stats_dump_resolv_to_buffer(si, ns,
+ stats, stats_count,
+ stat_modules)) {
+ return 0;
+ }
+ }
+
+ appctx->ctx.stats.obj2 = NULL;
+ }
+
+ return 1;
+
+ full:
+ si_rx_room_blk(si);
+ return 0;
+}
+
+void resolv_stats_clear_counters(int clrall, struct list *stat_modules)
+{
+ struct resolvers *resolvers;
+ struct dns_nameserver *ns;
+ struct stats_module *mod;
+ void *counters;
+
+ list_for_each_entry(mod, stat_modules, list) {
+ if (!mod->clearable && !clrall)
+ continue;
+
+ list_for_each_entry(resolvers, &sec_resolvers, list) {
+ list_for_each_entry(ns, &resolvers->nameservers, list) {
+ counters = EXTRA_COUNTERS_GET(ns->extra_counters, mod);
+ memcpy(counters, mod->counters, mod->counters_size);
+ }
+ }
+ }
+
+}
+
+int resolv_allocate_counters(struct list *stat_modules)
+{
+ struct stats_module *mod;
+ struct resolvers *resolvers;
+ struct dns_nameserver *ns;
+
+ list_for_each_entry(resolvers, &sec_resolvers, list) {
+ list_for_each_entry(ns, &resolvers->nameservers, list) {
+ EXTRA_COUNTERS_REGISTER(&ns->extra_counters, COUNTERS_DNS,
+ alloc_failed);
+
+ list_for_each_entry(mod, stat_modules, list) {
+ EXTRA_COUNTERS_ADD(mod,
+ ns->extra_counters,
+ mod->counters,
+ mod->counters_size);
+ }
+
+ EXTRA_COUNTERS_ALLOC(ns->extra_counters, alloc_failed);
+
+ list_for_each_entry(mod, stat_modules, list) {
+ memcpy(ns->extra_counters->data + mod->counters_off[ns->extra_counters->type],
+ mod->counters, mod->counters_size);
+
+ /* Store the ns counters pointer */
+ if (strcmp(mod->name, "dns") == 0) {
+ ns->counters = (struct dns_counters *)ns->extra_counters->data + mod->counters_off[COUNTERS_DNS];
+ ns->counters->id = ns->id;
+ ns->counters->pid = resolvers->id;
+ }
+ }
+ }
+ }
+
+ return 1;
+
+alloc_failed:
+ return 0;
+}
+
+/* if an arg is found, it sets the resolvers section pointer into cli.p0 */
+static int cli_parse_stat_resolvers(char **args, char *payload, struct appctx *appctx, void *private)
+{
+ struct resolvers *presolvers;
+
+ if (*args[2]) {
+ list_for_each_entry(presolvers, &sec_resolvers, list) {
+ if (strcmp(presolvers->id, args[2]) == 0) {
+ appctx->ctx.cli.p0 = presolvers;
+ break;
+ }
+ }
+ if (appctx->ctx.cli.p0 == NULL)
+ return cli_err(appctx, "Can't find that resolvers section\n");
+ }
+ return 0;
+}
+
+/* Dumps counters from all resolvers section and associated name servers. It
+ * returns 0 if the output buffer is full and it needs to be called again,
+ * otherwise non-zero. It may limit itself to the resolver pointed to by
+ * <cli.p0> if it's not null.
+ */
+static int cli_io_handler_dump_resolvers_to_buffer(struct appctx *appctx)
+{
+ struct stream_interface *si = appctx->owner;
+ struct resolvers *resolvers;
+ struct dns_nameserver *ns;
+
+ chunk_reset(&trash);
+
+ switch (appctx->st2) {
+ case STAT_ST_INIT:
+ appctx->st2 = STAT_ST_LIST; /* let's start producing data */
+ /* fall through */
+
+ case STAT_ST_LIST:
+ if (LIST_ISEMPTY(&sec_resolvers)) {
+ chunk_appendf(&trash, "No resolvers found\n");
+ }
+ else {
+ list_for_each_entry(resolvers, &sec_resolvers, list) {
+ if (appctx->ctx.cli.p0 != NULL && appctx->ctx.cli.p0 != resolvers)
+ continue;
+
+ chunk_appendf(&trash, "Resolvers section %s\n", resolvers->id);
+ list_for_each_entry(ns, &resolvers->nameservers, list) {
+ chunk_appendf(&trash, " nameserver %s:\n", ns->id);
+ chunk_appendf(&trash, " sent: %lld\n", ns->counters->sent);
+ chunk_appendf(&trash, " snd_error: %lld\n", ns->counters->snd_error);
+ chunk_appendf(&trash, " valid: %lld\n", ns->counters->valid);
+ chunk_appendf(&trash, " update: %lld\n", ns->counters->update);
+ chunk_appendf(&trash, " cname: %lld\n", ns->counters->cname);
+ chunk_appendf(&trash, " cname_error: %lld\n", ns->counters->cname_error);
+ chunk_appendf(&trash, " any_err: %lld\n", ns->counters->any_err);
+ chunk_appendf(&trash, " nx: %lld\n", ns->counters->nx);
+ chunk_appendf(&trash, " timeout: %lld\n", ns->counters->timeout);
+ chunk_appendf(&trash, " refused: %lld\n", ns->counters->refused);
+ chunk_appendf(&trash, " other: %lld\n", ns->counters->other);
+ chunk_appendf(&trash, " invalid: %lld\n", ns->counters->invalid);
+ chunk_appendf(&trash, " too_big: %lld\n", ns->counters->too_big);
+ chunk_appendf(&trash, " truncated: %lld\n", ns->counters->truncated);
+ chunk_appendf(&trash, " outdated: %lld\n", ns->counters->outdated);
+ }
+ chunk_appendf(&trash, "\n");
+ }
+ }
+
+ /* display response */
+ if (ci_putchk(si_ic(si), &trash) == -1) {
+ /* let's try again later from this session. We add ourselves into
+ * this session's users so that it can remove us upon termination.
+ */
+ si_rx_room_blk(si);
+ return 0;
+ }
+ /* fall through */
+
+ default:
+ appctx->st2 = STAT_ST_FIN;
+ return 1;
+ }
+}
+
+/* register cli keywords */
+static struct cli_kw_list cli_kws = {{ }, {
+ { { "show", "resolvers", NULL }, "show resolvers [id]: dumps counters from all resolvers section and\n"
+ " associated name servers",
+ cli_parse_stat_resolvers, cli_io_handler_dump_resolvers_to_buffer },
+ {{},}
+ }
+};
+
+INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
+
+/*
+ * Prepare <rule> for hostname resolution.
+ * Returns -1 in case of any allocation failure, 0 if not.
+ * On error, a global failure counter is also incremented.
+ */
+static int action_prepare_for_resolution(struct stream *stream, const char *hostname)
+{
+ char *hostname_dn;
+ int hostname_len, hostname_dn_len;
+ struct buffer *tmp = get_trash_chunk();
+
+ if (!hostname)
+ return 0;
+
+ hostname_len = strlen(hostname);
+ hostname_dn = tmp->area;
+ hostname_dn_len = resolv_str_to_dn_label(hostname, hostname_len + 1,
+ hostname_dn, tmp->size);
+ if (hostname_dn_len == -1)
+ goto err;
+
+
+ stream->resolv_ctx.hostname_dn = strdup(hostname_dn);
+ stream->resolv_ctx.hostname_dn_len = hostname_dn_len;
+ if (!stream->resolv_ctx.hostname_dn)
+ goto err;
+
+ return 0;
+
+ err:
+ free(stream->resolv_ctx.hostname_dn); stream->resolv_ctx.hostname_dn = NULL;
+ resolv_failed_resolutions += 1;
+ return -1;
+}
+
+
+/*
+ * Execute the "do-resolution" action. May be called from {tcp,http}request.
+ */
+enum act_return resolv_action_do_resolve(struct act_rule *rule, struct proxy *px,
+ struct session *sess, struct stream *s, int flags)
+{
+ struct resolv_resolution *resolution;
+ struct sample *smp;
+ char *fqdn;
+ struct resolv_requester *req;
+ struct resolvers *resolvers;
+ struct resolv_resolution *res;
+ int exp, locked = 0;
+ enum act_return ret = ACT_RET_CONT;
+
+ resolvers = rule->arg.resolv.resolvers;
+
+ /* we have a response to our DNS resolution */
+ use_cache:
+ if (s->resolv_ctx.requester && s->resolv_ctx.requester->resolution != NULL) {
+ resolution = s->resolv_ctx.requester->resolution;
+ if (!locked) {
+ HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
+ locked = 1;
+ }
+
+ if (resolution->step == RSLV_STEP_RUNNING)
+ goto yield;
+ if (resolution->step == RSLV_STEP_NONE) {
+ /* We update the variable only if we have a valid response. */
+ if (resolution->status == RSLV_STATUS_VALID) {
+ struct sample smp;
+ short ip_sin_family = 0;
+ void *ip = NULL;
+
+ resolv_get_ip_from_response(&resolution->response, rule->arg.resolv.opts, NULL,
+ 0, &ip, &ip_sin_family, NULL);
+
+ switch (ip_sin_family) {
+ case AF_INET:
+ smp.data.type = SMP_T_IPV4;
+ memcpy(&smp.data.u.ipv4, ip, 4);
+ break;
+ case AF_INET6:
+ smp.data.type = SMP_T_IPV6;
+ memcpy(&smp.data.u.ipv6, ip, 16);
+ break;
+ default:
+ ip = NULL;
+ }
+
+ if (ip) {
+ smp.px = px;
+ smp.sess = sess;
+ smp.strm = s;
+
+ vars_set_by_name(rule->arg.resolv.varname, strlen(rule->arg.resolv.varname), &smp);
+ }
+ }
+ }
+
+ goto release_requester;
+ }
+
+ /* need to configure and start a new DNS resolution */
+ smp = sample_fetch_as_type(px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.resolv.expr, SMP_T_STR);
+ if (smp == NULL)
+ goto end;
+
+ fqdn = smp->data.u.str.area;
+ if (action_prepare_for_resolution(s, fqdn) == -1)
+ goto end; /* on error, ignore the action */
+
+ s->resolv_ctx.parent = rule;
+
+ HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
+ locked = 1;
+
+ resolv_link_resolution(s, OBJ_TYPE_STREAM, 0);
+
+ /* Check if there is a fresh enough response in the cache of our associated resolution */
+ req = s->resolv_ctx.requester;
+ if (!req || !req->resolution)
+ goto release_requester; /* on error, ignore the action */
+ res = req->resolution;
+
+ exp = tick_add(res->last_resolution, resolvers->hold.valid);
+ if (resolvers->t && res->status == RSLV_STATUS_VALID && tick_isset(res->last_resolution)
+ && !tick_is_expired(exp, now_ms)) {
+ goto use_cache;
+ }
+
+ resolv_trigger_resolution(s->resolv_ctx.requester);
+
+ yield:
+ if (flags & ACT_OPT_FINAL)
+ goto release_requester;
+ ret = ACT_RET_YIELD;
+
+ end:
+ if (locked)
+ HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
+ return ret;
+
+ release_requester:
+ free(s->resolv_ctx.hostname_dn);
+ s->resolv_ctx.hostname_dn = NULL;
+ s->resolv_ctx.hostname_dn_len = 0;
+ if (s->resolv_ctx.requester) {
+ resolv_unlink_resolution(s->resolv_ctx.requester);
+ pool_free(resolv_requester_pool, s->resolv_ctx.requester);
+ s->resolv_ctx.requester = NULL;
+ }
+ goto end;
+}
+
+static void release_resolv_action(struct act_rule *rule)
+{
+ release_sample_expr(rule->arg.resolv.expr);
+ free(rule->arg.resolv.varname);
+ free(rule->arg.resolv.resolvers_id);
+ free(rule->arg.resolv.opts);
+}
+
+
+/* parse "do-resolve" action
+ * This action takes the following arguments:
+ * do-resolve(<varName>,<resolversSectionName>,<resolvePrefer>) <expr>
+ *
+ * - <varName> is the variable name where the result of the DNS resolution will be stored
+ * (mandatory)
+ * - <resolversSectionName> is the name of the resolvers section to use to perform the resolution
+ * (mandatory)
+ * - <resolvePrefer> can be either 'ipv4' or 'ipv6' and is the IP family we would like to resolve first
+ * (optional), defaults to ipv6
+ * - <expr> is an HAProxy expression used to fetch the name to be resolved
+ */
+enum act_parse_ret resolv_parse_do_resolve(const char **args, int *orig_arg, struct proxy *px, struct act_rule *rule, char **err)
+{
+ int cur_arg;
+ struct sample_expr *expr;
+ unsigned int where;
+ const char *beg, *end;
+
+ /* orig_arg points to the first argument, but we need to analyse the command itself first */
+ cur_arg = *orig_arg - 1;
+
+ /* locate varName, which is mandatory */
+ beg = strchr(args[cur_arg], '(');
+ if (beg == NULL)
+ goto do_resolve_parse_error;
+ beg = beg + 1; /* beg should points to the first character after opening parenthesis '(' */
+ end = strchr(beg, ',');
+ if (end == NULL)
+ goto do_resolve_parse_error;
+ rule->arg.resolv.varname = my_strndup(beg, end - beg);
+ if (rule->arg.resolv.varname == NULL)
+ goto do_resolve_parse_error;
+
+
+ /* locate resolversSectionName, which is mandatory.
+ * Since next parameters are optional, the delimiter may be comma ','
+ * or closing parenthesis ')'
+ */
+ beg = end + 1;
+ end = strchr(beg, ',');
+ if (end == NULL)
+ end = strchr(beg, ')');
+ if (end == NULL)
+ goto do_resolve_parse_error;
+ rule->arg.resolv.resolvers_id = my_strndup(beg, end - beg);
+ if (rule->arg.resolv.resolvers_id == NULL)
+ goto do_resolve_parse_error;
+
+
+ rule->arg.resolv.opts = calloc(1, sizeof(*rule->arg.resolv.opts));
+ if (rule->arg.resolv.opts == NULL)
+ goto do_resolve_parse_error;
+
+ /* Default priority is ipv6 */
+ rule->arg.resolv.opts->family_prio = AF_INET6;
+
+ /* optional arguments accepted for now:
+ * ipv4 or ipv6
+ */
+ while (*end != ')') {
+ beg = end + 1;
+ end = strchr(beg, ',');
+ if (end == NULL)
+ end = strchr(beg, ')');
+ if (end == NULL)
+ goto do_resolve_parse_error;
+
+ if (strncmp(beg, "ipv4", end - beg) == 0) {
+ rule->arg.resolv.opts->family_prio = AF_INET;
+ }
+ else if (strncmp(beg, "ipv6", end - beg) == 0) {
+ rule->arg.resolv.opts->family_prio = AF_INET6;
+ }
+ else {
+ goto do_resolve_parse_error;
+ }
+ }
+
+ cur_arg = cur_arg + 1;
+
+ expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args, NULL);
+ if (!expr)
+ goto do_resolve_parse_error;
+
+
+ where = 0;
+ if (px->cap & PR_CAP_FE)
+ where |= SMP_VAL_FE_HRQ_HDR;
+ if (px->cap & PR_CAP_BE)
+ where |= SMP_VAL_BE_HRQ_HDR;
+
+ if (!(expr->fetch->val & where)) {
+ memprintf(err,
+ "fetch method '%s' extracts information from '%s', none of which is available here",
+ args[cur_arg-1], sample_src_names(expr->fetch->use));
+ free(expr);
+ return ACT_RET_PRS_ERR;
+ }
+ rule->arg.resolv.expr = expr;
+ rule->action = ACT_CUSTOM;
+ rule->action_ptr = resolv_action_do_resolve;
+ *orig_arg = cur_arg;
+
+ rule->check_ptr = check_action_do_resolve;
+ rule->release_ptr = release_resolv_action;
+
+ return ACT_RET_PRS_OK;
+
+ do_resolve_parse_error:
+ free(rule->arg.resolv.varname); rule->arg.resolv.varname = NULL;
+ free(rule->arg.resolv.resolvers_id); rule->arg.resolv.resolvers_id = NULL;
+ memprintf(err, "Can't parse '%s'. Expects 'do-resolve(<varname>,<resolvers>[,<options>]) <expr>'. Available options are 'ipv4' and 'ipv6'",
+ args[cur_arg]);
+ return ACT_RET_PRS_ERR;
+}
+
+static struct action_kw_list http_req_kws = { { }, {
+ { "do-resolve", resolv_parse_do_resolve, 1 },
+ { /* END */ }
+}};
+
+INITCALL1(STG_REGISTER, http_req_keywords_register, &http_req_kws);
+
+static struct action_kw_list tcp_req_cont_actions = {ILH, {
+ { "do-resolve", resolv_parse_do_resolve, 1 },
+ { /* END */ }
+}};
+
+INITCALL1(STG_REGISTER, tcp_req_cont_keywords_register, &tcp_req_cont_actions);
+
+/* Check an "http-request do-resolve" action.
+ *
+ * The function returns 1 in success case, otherwise, it returns 0 and err is
+ * filled.
+ */
+int check_action_do_resolve(struct act_rule *rule, struct proxy *px, char **err)
+{
+ struct resolvers *resolvers = NULL;
+
+ if (rule->arg.resolv.resolvers_id == NULL) {
+ memprintf(err,"Proxy '%s': %s", px->id, "do-resolve action without resolvers");
+ return 0;
+ }
+
+ resolvers = find_resolvers_by_id(rule->arg.resolv.resolvers_id);
+ if (resolvers == NULL) {
+ memprintf(err,"Can't find resolvers section '%s' for do-resolve action", rule->arg.resolv.resolvers_id);
+ return 0;
+ }
+ rule->arg.resolv.resolvers = resolvers;
+
+ return 1;
+}
+
+void resolvers_setup_proxy(struct proxy *px)
+{
+ px->last_change = now.tv_sec;
+ px->cap = PR_CAP_FE | PR_CAP_BE;
+ px->maxconn = 0;
+ px->conn_retries = 1;
+ px->timeout.server = TICK_ETERNITY;
+ px->timeout.client = TICK_ETERNITY;
+ px->timeout.connect = TICK_ETERNITY;
+ px->accept = NULL;
+ px->options2 |= PR_O2_INDEPSTR | PR_O2_SMARTCON;
+ px->bind_proc = 0; /* will be filled by users */
+}
+
+/*
+ * Parse a <resolvers> section.
+ * Returns the error code, 0 if OK, or any combination of :
+ * - ERR_ABORT: must abort ASAP
+ * - ERR_FATAL: we can continue parsing but not start the service
+ * - ERR_WARN: a warning has been emitted
+ * - ERR_ALERT: an alert has been emitted
+ * Only the two first ones can stop processing, the two others are just
+ * indicators.
+ */
+int cfg_parse_resolvers(const char *file, int linenum, char **args, int kwm)
+{
+ const char *err;
+ int err_code = 0;
+ char *errmsg = NULL;
+ struct proxy *p;
+
+ if (strcmp(args[0], "resolvers") == 0) { /* new resolvers section */
+ if (!*args[1]) {
+ ha_alert("parsing [%s:%d] : missing name for resolvers section.\n", file, linenum);
+ err_code |= ERR_ALERT | ERR_ABORT;
+ goto out;
+ }
+
+ err = invalid_char(args[1]);
+ if (err) {
+ ha_alert("parsing [%s:%d] : character '%c' is not permitted in '%s' name '%s'.\n",
+ file, linenum, *err, args[0], args[1]);
+ err_code |= ERR_ALERT | ERR_ABORT;
+ goto out;
+ }
+
+ list_for_each_entry(curr_resolvers, &sec_resolvers, list) {
+ /* Error if two resolvers owns the same name */
+ if (strcmp(curr_resolvers->id, args[1]) == 0) {
+ ha_alert("Parsing [%s:%d]: resolvers '%s' has same name as another resolvers (declared at %s:%d).\n",
+ file, linenum, args[1], curr_resolvers->conf.file, curr_resolvers->conf.line);
+ err_code |= ERR_ALERT | ERR_ABORT;
+ }
+ }
+
+ if ((curr_resolvers = calloc(1, sizeof(*curr_resolvers))) == NULL) {
+ ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
+ err_code |= ERR_ALERT | ERR_ABORT;
+ goto out;
+ }
+
+ /* allocate new proxy to tcp servers */
+ p = calloc(1, sizeof *p);
+ if (!p) {
+ ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+
+ init_new_proxy(p);
+ resolvers_setup_proxy(p);
+ p->parent = curr_resolvers;
+ p->id = strdup(args[1]);
+ p->conf.args.file = p->conf.file = strdup(file);
+ p->conf.args.line = p->conf.line = linenum;
+ curr_resolvers->px = p;
+
+ /* default values */
+ LIST_ADDQ(&sec_resolvers, &curr_resolvers->list);
+ curr_resolvers->conf.file = strdup(file);
+ curr_resolvers->conf.line = linenum;
+ curr_resolvers->id = strdup(args[1]);
+ curr_resolvers->query_ids = EB_ROOT;
+ /* default maximum response size */
+ curr_resolvers->accepted_payload_size = 512;
+ /* default hold period for nx, other, refuse and timeout is 30s */
+ curr_resolvers->hold.nx = 30000;
+ curr_resolvers->hold.other = 30000;
+ curr_resolvers->hold.refused = 30000;
+ curr_resolvers->hold.timeout = 30000;
+ curr_resolvers->hold.obsolete = 0;
+ /* default hold period for valid is 10s */
+ curr_resolvers->hold.valid = 10000;
+ curr_resolvers->timeout.resolve = 1000;
+ curr_resolvers->timeout.retry = 1000;
+ curr_resolvers->resolve_retries = 3;
+ LIST_INIT(&curr_resolvers->nameservers);
+ LIST_INIT(&curr_resolvers->resolutions.curr);
+ LIST_INIT(&curr_resolvers->resolutions.wait);
+ HA_SPIN_INIT(&curr_resolvers->lock);
+ }
+ else if (strcmp(args[0], "nameserver") == 0) { /* nameserver definition */
+ struct dns_nameserver *newnameserver = NULL;
+ struct sockaddr_storage *sk;
+ int port1, port2;
+
+ if (!*args[2]) {
+ ha_alert("parsing [%s:%d] : '%s' expects <name> and <addr>[:<port>] as arguments.\n",
+ file, linenum, args[0]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+
+ err = invalid_char(args[1]);
+ if (err) {
+ ha_alert("parsing [%s:%d] : character '%c' is not permitted in server name '%s'.\n",
+ file, linenum, *err, args[1]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+
+ list_for_each_entry(newnameserver, &curr_resolvers->nameservers, list) {
+ /* Error if two resolvers owns the same name */
+ if (strcmp(newnameserver->id, args[1]) == 0) {
+ ha_alert("Parsing [%s:%d]: nameserver '%s' has same name as another nameserver (declared at %s:%d).\n",
+ file, linenum, args[1], newnameserver->conf.file, newnameserver->conf.line);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ }
+ }
+
+ sk = str2sa_range(args[2], NULL, &port1, &port2, NULL, NULL,
+ &errmsg, NULL, NULL, PA_O_RESOLVE | PA_O_PORT_OK | PA_O_PORT_MAND | PA_O_DGRAM);
+ if (!sk) {
+ ha_alert("parsing [%s:%d] : '%s %s' : %s\n", file, linenum, args[0], args[1], errmsg);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+
+ if ((newnameserver = calloc(1, sizeof(*newnameserver))) == NULL) {
+ ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
+ err_code |= ERR_ALERT | ERR_ABORT;
+ goto out;
+ }
+
+ if (dns_dgram_init(newnameserver, sk) < 0) {
+ ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
+ err_code |= ERR_ALERT | ERR_ABORT;
+ goto out;
+ }
+
+ if ((newnameserver->conf.file = strdup(file)) == NULL) {
+ ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
+ err_code |= ERR_ALERT | ERR_ABORT;
+ goto out;
+ }
+
+ if ((newnameserver->id = strdup(args[1])) == NULL) {
+ ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
+ err_code |= ERR_ALERT | ERR_ABORT;
+ goto out;
+ }
+
+ newnameserver->parent = curr_resolvers;
+ newnameserver->process_responses = resolv_process_responses;
+ newnameserver->conf.line = linenum;
+ /* the nameservers are linked backward first */
+ LIST_ADDQ(&curr_resolvers->nameservers, &newnameserver->list);
+ }
+ else if (strcmp(args[0], "parse-resolv-conf") == 0) {
+ struct dns_nameserver *newnameserver = NULL;
+ const char *whitespace = "\r\n\t ";
+ char *resolv_line = NULL;
+ int resolv_linenum = 0;
+ FILE *f = NULL;
+ char *address = NULL;
+ struct sockaddr_storage *sk = NULL;
+ struct protocol *proto;
+ int duplicate_name = 0;
+
+ if ((resolv_line = malloc(sizeof(*resolv_line) * LINESIZE)) == NULL) {
+ ha_alert("parsing [%s:%d] : out of memory.\n",
+ file, linenum);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto resolv_out;
+ }
+
+ if ((f = fopen("/etc/resolv.conf", "r")) == NULL) {
+ ha_alert("parsing [%s:%d] : failed to open /etc/resolv.conf.\n",
+ file, linenum);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto resolv_out;
+ }
+
+ sk = calloc(1, sizeof(*sk));
+ if (sk == NULL) {
+ ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n",
+ resolv_linenum);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto resolv_out;
+ }
+
+ while (fgets(resolv_line, LINESIZE, f) != NULL) {
+ resolv_linenum++;
+ if (strncmp(resolv_line, "nameserver", 10) != 0)
+ continue;
+
+ address = strtok(resolv_line + 10, whitespace);
+ if (address == resolv_line + 10)
+ continue;
+
+ if (address == NULL) {
+ ha_warning("parsing [/etc/resolv.conf:%d] : nameserver line is missing address.\n",
+ resolv_linenum);
+ err_code |= ERR_WARN;
+ continue;
+ }
+
+ duplicate_name = 0;
+ list_for_each_entry(newnameserver, &curr_resolvers->nameservers, list) {
+ if (strcmp(newnameserver->id, address) == 0) {
+ ha_warning("Parsing [/etc/resolv.conf:%d] : generated name for /etc/resolv.conf nameserver '%s' conflicts with another nameserver (declared at %s:%d), it appears to be a duplicate and will be excluded.\n",
+ resolv_linenum, address, newnameserver->conf.file, newnameserver->conf.line);
+ err_code |= ERR_WARN;
+ duplicate_name = 1;
+ }
+ }
+
+ if (duplicate_name)
+ continue;
+
+ memset(sk, 0, sizeof(*sk));
+ if (!str2ip2(address, sk, 1)) {
+ ha_warning("parsing [/etc/resolv.conf:%d] : address '%s' could not be recognized, nameserver will be excluded.\n",
+ resolv_linenum, address);
+ err_code |= ERR_WARN;
+ continue;
+ }
+
+ set_host_port(sk, 53);
+
+ proto = protocol_by_family(sk->ss_family);
+ if (!proto || !proto->connect) {
+ ha_warning("parsing [/etc/resolv.conf:%d] : '%s' : connect() not supported for this address family.\n",
+ resolv_linenum, address);
+ err_code |= ERR_WARN;
+ continue;
+ }
+
+ if ((newnameserver = calloc(1, sizeof(*newnameserver))) == NULL) {
+ ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n", resolv_linenum);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto resolv_out;
+ }
+
+ if (dns_dgram_init(newnameserver, sk) < 0) {
+ ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n", resolv_linenum);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ free(newnameserver);
+ goto resolv_out;
+ }
+
+ newnameserver->conf.file = strdup("/etc/resolv.conf");
+ if (newnameserver->conf.file == NULL) {
+ ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n", resolv_linenum);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ free(newnameserver);
+ goto resolv_out;
+ }
+
+ newnameserver->id = strdup(address);
+ if (newnameserver->id == NULL) {
+ ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n", resolv_linenum);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ free((char *)newnameserver->conf.file);
+ free(newnameserver);
+ goto resolv_out;
+ }
+
+ newnameserver->parent = curr_resolvers;
+ newnameserver->process_responses = resolv_process_responses;
+ newnameserver->conf.line = resolv_linenum;
+ LIST_ADDQ(&curr_resolvers->nameservers, &newnameserver->list);
+ }
+
+resolv_out:
+ free(sk);
+ free(resolv_line);
+ if (f != NULL)
+ fclose(f);
+ }
+ else if (strcmp(args[0], "hold") == 0) { /* hold periods */
+ const char *res;
+ unsigned int time;
+
+ if (!*args[2]) {
+ ha_alert("parsing [%s:%d] : '%s' expects an <event> and a <time> as arguments.\n",
+ file, linenum, args[0]);
+ ha_alert("<event> can be either 'valid', 'nx', 'refused', 'timeout', or 'other'\n");
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+ res = parse_time_err(args[2], &time, TIME_UNIT_MS);
+ if (res == PARSE_TIME_OVER) {
+ ha_alert("parsing [%s:%d]: timer overflow in argument <%s> to <%s>, maximum value is 2147483647 ms (~24.8 days).\n",
+ file, linenum, args[1], args[0]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+ else if (res == PARSE_TIME_UNDER) {
+ ha_alert("parsing [%s:%d]: timer underflow in argument <%s> to <%s>, minimum non-null value is 1 ms.\n",
+ file, linenum, args[1], args[0]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+ else if (res) {
+ ha_alert("parsing [%s:%d]: unexpected character '%c' in argument to <%s>.\n",
+ file, linenum, *res, args[0]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+ if (strcmp(args[1], "nx") == 0)
+ curr_resolvers->hold.nx = time;
+ else if (strcmp(args[1], "other") == 0)
+ curr_resolvers->hold.other = time;
+ else if (strcmp(args[1], "refused") == 0)
+ curr_resolvers->hold.refused = time;
+ else if (strcmp(args[1], "timeout") == 0)
+ curr_resolvers->hold.timeout = time;
+ else if (strcmp(args[1], "valid") == 0)
+ curr_resolvers->hold.valid = time;
+ else if (strcmp(args[1], "obsolete") == 0)
+ curr_resolvers->hold.obsolete = time;
+ else {
+ ha_alert("parsing [%s:%d] : '%s' unknown <event>: '%s', expects either 'nx', 'timeout', 'valid', 'obsolete' or 'other'.\n",
+ file, linenum, args[0], args[1]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+
+ }
+ else if (strcmp(args[0], "accepted_payload_size") == 0) {
+ int i = 0;
+
+ if (!*args[1]) {
+ ha_alert("parsing [%s:%d] : '%s' expects <nb> as argument.\n",
+ file, linenum, args[0]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+
+ i = atoi(args[1]);
+ if (i < DNS_HEADER_SIZE || i > DNS_MAX_UDP_MESSAGE) {
+ ha_alert("parsing [%s:%d] : '%s' must be between %d and %d inclusive (was %s).\n",
+ file, linenum, args[0], DNS_HEADER_SIZE, DNS_MAX_UDP_MESSAGE, args[1]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+
+ curr_resolvers->accepted_payload_size = i;
+ }
+ else if (strcmp(args[0], "resolution_pool_size") == 0) {
+ ha_alert("parsing [%s:%d] : '%s' directive is not supported anymore (it never appeared in a stable release).\n",
+ file, linenum, args[0]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+ else if (strcmp(args[0], "resolve_retries") == 0) {
+ if (!*args[1]) {
+ ha_alert("parsing [%s:%d] : '%s' expects <nb> as argument.\n",
+ file, linenum, args[0]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+ curr_resolvers->resolve_retries = atoi(args[1]);
+ }
+ else if (strcmp(args[0], "timeout") == 0) {
+ if (!*args[1]) {
+ ha_alert("parsing [%s:%d] : '%s' expects 'retry' or 'resolve' and <time> as arguments.\n",
+ file, linenum, args[0]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+ else if (strcmp(args[1], "retry") == 0 ||
+ strcmp(args[1], "resolve") == 0) {
+ const char *res;
+ unsigned int tout;
+
+ if (!*args[2]) {
+ ha_alert("parsing [%s:%d] : '%s %s' expects <time> as argument.\n",
+ file, linenum, args[0], args[1]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+ res = parse_time_err(args[2], &tout, TIME_UNIT_MS);
+ if (res == PARSE_TIME_OVER) {
+ ha_alert("parsing [%s:%d]: timer overflow in argument <%s> to <%s %s>, maximum value is 2147483647 ms (~24.8 days).\n",
+ file, linenum, args[2], args[0], args[1]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+ else if (res == PARSE_TIME_UNDER) {
+ ha_alert("parsing [%s:%d]: timer underflow in argument <%s> to <%s %s>, minimum non-null value is 1 ms.\n",
+ file, linenum, args[2], args[0], args[1]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+ else if (res) {
+ ha_alert("parsing [%s:%d]: unexpected character '%c' in argument to <%s %s>.\n",
+ file, linenum, *res, args[0], args[1]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+ if (args[1][2] == 't')
+ curr_resolvers->timeout.retry = tout;
+ else
+ curr_resolvers->timeout.resolve = tout;
+ }
+ else {
+ ha_alert("parsing [%s:%d] : '%s' expects 'retry' or 'resolve' and <time> as arguments got '%s'.\n",
+ file, linenum, args[0], args[1]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+ }
+ else if (*args[0] != 0) {
+ ha_alert("parsing [%s:%d] : unknown keyword '%s' in '%s' section\n", file, linenum, args[0], cursection);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+
+ out:
+ free(errmsg);
+ return err_code;
+}
+
+REGISTER_CONFIG_SECTION("resolvers", cfg_parse_resolvers, NULL);
+REGISTER_POST_DEINIT(resolvers_deinit);
+REGISTER_CONFIG_POSTPARSER("dns runtime resolver", resolvers_finalize_config);
diff --git a/src/server.c b/src/server.c
index 0d41d48..36eceb5 100644
--- a/src/server.c
+++ b/src/server.c
@@ -27,7 +27,6 @@
#include <haproxy/cli.h>
#include <haproxy/connection.h>
#include <haproxy/dict-t.h>
-#include <haproxy/dns.h>
#include <haproxy/errors.h>
#include <haproxy/global.h>
#include <haproxy/log.h>
@@ -36,6 +35,7 @@
#include <haproxy/port_range.h>
#include <haproxy/protocol.h>
#include <haproxy/queue.h>
+#include <haproxy/resolvers.h>
#include <haproxy/sample.h>
#include <haproxy/server.h>
#include <haproxy/ssl_sock.h>
diff --git a/src/stats.c b/src/stats.c
index a6fe8bf..07155e6 100644
--- a/src/stats.c
+++ b/src/stats.c
@@ -34,7 +34,6 @@
#include <haproxy/cli.h>
#include <haproxy/compression.h>
#include <haproxy/debug.h>
-#include <haproxy/dns.h>
#include <haproxy/errors.h>
#include <haproxy/fd.h>
#include <haproxy/freq_ctr.h>
@@ -51,6 +50,7 @@
#include <haproxy/pipe.h>
#include <haproxy/pool.h>
#include <haproxy/proxy.h>
+#include <haproxy/resolvers.h>
#include <haproxy/server.h>
#include <haproxy/session.h>
#include <haproxy/ssl_sock.h>
diff --git a/src/stream.c b/src/stream.c
index ff838b8..72718f2 100644
--- a/src/stream.c
+++ b/src/stream.c
@@ -30,7 +30,6 @@
#include <haproxy/cli.h>
#include <haproxy/connection.h>
#include <haproxy/dict.h>
-#include <haproxy/dns.h>
#include <haproxy/dynbuf.h>
#include <haproxy/fd.h>
#include <haproxy/filters.h>
@@ -48,6 +47,7 @@
#include <haproxy/proxy.h>
#include <haproxy/queue.h>
#include <haproxy/server.h>
+#include <haproxy/resolvers.h>
#include <haproxy/sample.h>
#include <haproxy/session.h>
#include <haproxy/stats-t.h>
diff --git a/src/tools.c b/src/tools.c
index 2f7b5f1..4db3e18 100644
--- a/src/tools.c
+++ b/src/tools.c
@@ -42,12 +42,12 @@
#include <haproxy/api.h>
#include <haproxy/chunk.h>
#include <haproxy/dgram.h>
-#include <haproxy/dns.h>
#include <haproxy/global.h>
#include <haproxy/hlua.h>
#include <haproxy/listener.h>
#include <haproxy/namespace.h>
#include <haproxy/protocol.h>
+#include <haproxy/resolvers.h>
#include <haproxy/sock.h>
#include <haproxy/ssl_sock.h>
#include <haproxy/stream_interface.h>