blob: 85fa6aa9a4a54a119f371e2c21d4d36d86dff988 [file] [log] [blame]
Emeric Brunc9437992021-02-12 19:42:55 +01001/*
2 * Name server resolution
3 *
4 * Copyright 2014 Baptiste Assmann <bedis9@gmail.com>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <errno.h>
14#include <fcntl.h>
15#include <stdio.h>
16#include <stdlib.h>
17#include <string.h>
18#include <unistd.h>
19
20#include <sys/types.h>
21
Emeric Brun0c4a8a32021-06-11 10:48:45 +020022#include <import/ebistree.h>
23
Emeric Brunc9437992021-02-12 19:42:55 +010024#include <haproxy/action.h>
25#include <haproxy/api.h>
26#include <haproxy/cfgparse.h>
27#include <haproxy/channel.h>
28#include <haproxy/check.h>
29#include <haproxy/cli.h>
30#include <haproxy/dns.h>
31#include <haproxy/errors.h>
32#include <haproxy/fd.h>
Emeric Brunc9437992021-02-12 19:42:55 +010033#include <haproxy/http_rules.h>
34#include <haproxy/log.h>
35#include <haproxy/net_helper.h>
36#include <haproxy/protocol.h>
37#include <haproxy/proxy.h>
38#include <haproxy/resolvers.h>
39#include <haproxy/ring.h>
40#include <haproxy/sample.h>
41#include <haproxy/server.h>
42#include <haproxy/stats.h>
43#include <haproxy/stream_interface.h>
44#include <haproxy/task.h>
45#include <haproxy/tcp_rules.h>
46#include <haproxy/ticks.h>
47#include <haproxy/time.h>
Willy Tarreauca14dd52021-05-08 12:59:47 +020048#include <haproxy/tools.h>
Emeric Brunc9437992021-02-12 19:42:55 +010049#include <haproxy/vars.h>
50
51
52struct list sec_resolvers = LIST_HEAD_INIT(sec_resolvers);
53struct list resolv_srvrq_list = LIST_HEAD_INIT(resolv_srvrq_list);
54
Willy Tarreau20751652021-10-18 16:46:38 +020055static THREAD_LOCAL struct list death_row; /* list of deferred resolutions to kill, local validity only */
Christopher Faulet7a3a5362021-11-02 16:25:05 +010056static THREAD_LOCAL unsigned int recurse = 0; /* counter to track calls to public functions */
Emeric Brunc9437992021-02-12 19:42:55 +010057static THREAD_LOCAL uint64_t resolv_query_id_seed = 0; /* random seed */
58struct resolvers *curr_resolvers = NULL;
59
60DECLARE_STATIC_POOL(resolv_answer_item_pool, "resolv_answer_item", sizeof(struct resolv_answer_item));
61DECLARE_STATIC_POOL(resolv_resolution_pool, "resolv_resolution", sizeof(struct resolv_resolution));
62DECLARE_POOL(resolv_requester_pool, "resolv_requester", sizeof(struct resolv_requester));
63
64static unsigned int resolution_uuid = 1;
65unsigned int resolv_failed_resolutions = 0;
Willy Tarreau20751652021-10-18 16:46:38 +020066static struct task *process_resolvers(struct task *t, void *context, unsigned int state);
67static void resolv_free_resolution(struct resolv_resolution *resolution);
Willy Tarreau33360872021-10-20 14:07:31 +020068static void _resolv_unlink_resolution(struct resolv_requester *requester);
Christopher Faulet7a3a5362021-11-02 16:25:05 +010069static void enter_resolver_code();
70static void leave_resolver_code();
Emeric Brunc9437992021-02-12 19:42:55 +010071
72enum {
73 DNS_STAT_ID,
74 DNS_STAT_PID,
75 DNS_STAT_SENT,
76 DNS_STAT_SND_ERROR,
77 DNS_STAT_VALID,
78 DNS_STAT_UPDATE,
79 DNS_STAT_CNAME,
80 DNS_STAT_CNAME_ERROR,
81 DNS_STAT_ANY_ERR,
82 DNS_STAT_NX,
83 DNS_STAT_TIMEOUT,
84 DNS_STAT_REFUSED,
85 DNS_STAT_OTHER,
86 DNS_STAT_INVALID,
87 DNS_STAT_TOO_BIG,
88 DNS_STAT_TRUNCATED,
89 DNS_STAT_OUTDATED,
90 DNS_STAT_END,
91};
92
93static struct name_desc dns_stats[] = {
94 [DNS_STAT_ID] = { .name = "id", .desc = "ID" },
95 [DNS_STAT_PID] = { .name = "pid", .desc = "Parent ID" },
96 [DNS_STAT_SENT] = { .name = "sent", .desc = "Sent" },
97 [DNS_STAT_SND_ERROR] = { .name = "send_error", .desc = "Send error" },
98 [DNS_STAT_VALID] = { .name = "valid", .desc = "Valid" },
99 [DNS_STAT_UPDATE] = { .name = "update", .desc = "Update" },
100 [DNS_STAT_CNAME] = { .name = "cname", .desc = "CNAME" },
101 [DNS_STAT_CNAME_ERROR] = { .name = "cname_error", .desc = "CNAME error" },
102 [DNS_STAT_ANY_ERR] = { .name = "any_err", .desc = "Any errors" },
103 [DNS_STAT_NX] = { .name = "nx", .desc = "NX" },
104 [DNS_STAT_TIMEOUT] = { .name = "timeout", .desc = "Timeout" },
105 [DNS_STAT_REFUSED] = { .name = "refused", .desc = "Refused" },
106 [DNS_STAT_OTHER] = { .name = "other", .desc = "Other" },
107 [DNS_STAT_INVALID] = { .name = "invalid", .desc = "Invalid" },
108 [DNS_STAT_TOO_BIG] = { .name = "too_big", .desc = "Too big" },
109 [DNS_STAT_TRUNCATED] = { .name = "truncated", .desc = "Truncated" },
110 [DNS_STAT_OUTDATED] = { .name = "outdated", .desc = "Outdated" },
111};
112
113static struct dns_counters dns_counters;
114
115static void dns_fill_stats(void *d, struct field *stats)
116{
117 struct dns_counters *counters = d;
118 stats[DNS_STAT_ID] = mkf_str(FO_CONFIG, counters->id);
119 stats[DNS_STAT_PID] = mkf_str(FO_CONFIG, counters->pid);
120 stats[DNS_STAT_SENT] = mkf_u64(FN_GAUGE, counters->sent);
121 stats[DNS_STAT_SND_ERROR] = mkf_u64(FN_GAUGE, counters->snd_error);
122 stats[DNS_STAT_VALID] = mkf_u64(FN_GAUGE, counters->valid);
123 stats[DNS_STAT_UPDATE] = mkf_u64(FN_GAUGE, counters->update);
124 stats[DNS_STAT_CNAME] = mkf_u64(FN_GAUGE, counters->cname);
125 stats[DNS_STAT_CNAME_ERROR] = mkf_u64(FN_GAUGE, counters->cname_error);
126 stats[DNS_STAT_ANY_ERR] = mkf_u64(FN_GAUGE, counters->any_err);
127 stats[DNS_STAT_NX] = mkf_u64(FN_GAUGE, counters->nx);
128 stats[DNS_STAT_TIMEOUT] = mkf_u64(FN_GAUGE, counters->timeout);
129 stats[DNS_STAT_REFUSED] = mkf_u64(FN_GAUGE, counters->refused);
130 stats[DNS_STAT_OTHER] = mkf_u64(FN_GAUGE, counters->other);
131 stats[DNS_STAT_INVALID] = mkf_u64(FN_GAUGE, counters->invalid);
132 stats[DNS_STAT_TOO_BIG] = mkf_u64(FN_GAUGE, counters->too_big);
133 stats[DNS_STAT_TRUNCATED] = mkf_u64(FN_GAUGE, counters->truncated);
134 stats[DNS_STAT_OUTDATED] = mkf_u64(FN_GAUGE, counters->outdated);
135}
136
137static struct stats_module dns_stats_module = {
138 .name = "dns",
139 .domain_flags = STATS_DOMAIN_DNS << STATS_DOMAIN,
140 .fill_stats = dns_fill_stats,
141 .stats = dns_stats,
142 .stats_count = DNS_STAT_END,
143 .counters = &dns_counters,
144 .counters_size = sizeof(dns_counters),
145 .clearable = 0,
146};
147
148INITCALL1(STG_REGISTER, stats_register_module, &dns_stats_module);
149
150/* Returns a pointer to the resolvers matching the id <id>. NULL is returned if
151 * no match is found.
152 */
153struct resolvers *find_resolvers_by_id(const char *id)
154{
155 struct resolvers *res;
156
157 list_for_each_entry(res, &sec_resolvers, list) {
158 if (strcmp(res->id, id) == 0)
159 return res;
160 }
161 return NULL;
162}
163
164/* Compare hostnames in a case-insensitive way .
165 * Returns 0 if they are the same, non-zero otherwise
166 */
167static __inline int resolv_hostname_cmp(const char *name1, const char *name2, int len)
168{
169 int i;
170
171 for (i = 0; i < len; i++)
172 if (tolower((unsigned char)name1[i]) != tolower((unsigned char)name2[i]))
173 return -1;
174 return 0;
175}
176
177/* Returns a pointer on the SRV request matching the name <name> for the proxy
178 * <px>. NULL is returned if no match is found.
179 */
180struct resolv_srvrq *find_srvrq_by_name(const char *name, struct proxy *px)
181{
182 struct resolv_srvrq *srvrq;
183
184 list_for_each_entry(srvrq, &resolv_srvrq_list, list) {
185 if (srvrq->proxy == px && strcmp(srvrq->name, name) == 0)
186 return srvrq;
187 }
188 return NULL;
189}
190
191/* Allocates a new SRVRQ for the given server with the name <fqdn>. It returns
192 * NULL if an error occurred. */
193struct resolv_srvrq *new_resolv_srvrq(struct server *srv, char *fqdn)
194{
195 struct proxy *px = srv->proxy;
196 struct resolv_srvrq *srvrq = NULL;
197 int fqdn_len, hostname_dn_len;
198
199 fqdn_len = strlen(fqdn);
Willy Tarreauc1c765f2021-10-14 07:49:49 +0200200 hostname_dn_len = resolv_str_to_dn_label(fqdn, fqdn_len, trash.area,
Emeric Brunc9437992021-02-12 19:42:55 +0100201 trash.size);
202 if (hostname_dn_len == -1) {
203 ha_alert("config : %s '%s', server '%s': failed to parse FQDN '%s'\n",
204 proxy_type_str(px), px->id, srv->id, fqdn);
205 goto err;
206 }
207
208 if ((srvrq = calloc(1, sizeof(*srvrq))) == NULL) {
209 ha_alert("config : %s '%s', server '%s': out of memory\n",
210 proxy_type_str(px), px->id, srv->id);
211 goto err;
212 }
213 srvrq->obj_type = OBJ_TYPE_SRVRQ;
214 srvrq->proxy = px;
215 srvrq->name = strdup(fqdn);
216 srvrq->hostname_dn = strdup(trash.area);
217 srvrq->hostname_dn_len = hostname_dn_len;
218 if (!srvrq->name || !srvrq->hostname_dn) {
219 ha_alert("config : %s '%s', server '%s': out of memory\n",
220 proxy_type_str(px), px->id, srv->id);
221 goto err;
222 }
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200223 LIST_INIT(&srvrq->attached_servers);
224 srvrq->named_servers = EB_ROOT;
Willy Tarreau2b718102021-04-21 07:32:39 +0200225 LIST_APPEND(&resolv_srvrq_list, &srvrq->list);
Emeric Brunc9437992021-02-12 19:42:55 +0100226 return srvrq;
227
228 err:
229 if (srvrq) {
230 free(srvrq->name);
231 free(srvrq->hostname_dn);
232 free(srvrq);
233 }
234 return NULL;
235}
236
237
Baptiste Assmann6a8d11d2021-03-10 12:22:18 +0100238/* finds and return the SRV answer item associated to a requester (whose type is 'server').
239 *
240 * returns NULL in case of error or not found.
241 */
242struct resolv_answer_item *find_srvrq_answer_record(const struct resolv_requester *requester)
243{
244 struct resolv_resolution *res;
245 struct resolv_answer_item *item;
246 struct server *srv;
247
248 if (!requester)
249 return NULL;
250
251 if ((srv = objt_server(requester->owner)) == NULL)
252 return NULL;
253 /* check if the server is managed by a SRV record */
254 if (srv->srvrq == NULL)
255 return NULL;
256
257 res = srv->srvrq->requester->resolution;
258 /* search an ANSWER record whose target points to the server's hostname and whose port is
259 * the same as server's svc_port */
260 list_for_each_entry(item, &res->response.answer_list, list) {
Willy Tarreau20a02372021-10-14 22:52:04 +0200261 if (resolv_hostname_cmp(srv->hostname_dn, item->data.target, srv->hostname_dn_len) == 0 &&
Baptiste Assmann6a8d11d2021-03-10 12:22:18 +0100262 (srv->svc_port == item->port))
263 return item;
264 }
265
266 return NULL;
267}
268
Emeric Brunc9437992021-02-12 19:42:55 +0100269/* 2 bytes random generator to generate DNS query ID */
270static inline uint16_t resolv_rnd16(void)
271{
272 if (!resolv_query_id_seed)
273 resolv_query_id_seed = now_ms;
274 resolv_query_id_seed ^= resolv_query_id_seed << 13;
275 resolv_query_id_seed ^= resolv_query_id_seed >> 7;
276 resolv_query_id_seed ^= resolv_query_id_seed << 17;
277 return resolv_query_id_seed;
278}
279
280
281static inline int resolv_resolution_timeout(struct resolv_resolution *res)
282{
283 return res->resolvers->timeout.resolve;
284}
285
286/* Updates a resolvers' task timeout for next wake up and queue it */
287static void resolv_update_resolvers_timeout(struct resolvers *resolvers)
288{
289 struct resolv_resolution *res;
290 int next;
291
292 next = tick_add(now_ms, resolvers->timeout.resolve);
293 if (!LIST_ISEMPTY(&resolvers->resolutions.curr)) {
294 res = LIST_NEXT(&resolvers->resolutions.curr, struct resolv_resolution *, list);
Christopher Faulet1039c332022-12-14 10:26:25 +0100295 next = tick_first(next, tick_add(res->last_query, resolvers->timeout.retry));
Emeric Brunc9437992021-02-12 19:42:55 +0100296 }
297
298 list_for_each_entry(res, &resolvers->resolutions.wait, list)
Christopher Faulet1039c332022-12-14 10:26:25 +0100299 next = tick_first(next, tick_add(res->last_resolution, resolv_resolution_timeout(res)));
Emeric Brunc9437992021-02-12 19:42:55 +0100300
301 resolvers->t->expire = next;
302 task_queue(resolvers->t);
303}
304
305/* Forges a DNS query. It needs the following information from the caller:
306 * - <query_id> : the DNS query id corresponding to this query
307 * - <query_type> : DNS_RTYPE_* request DNS record type (A, AAAA, ANY...)
308 * - <hostname_dn> : hostname in domain name format
309 * - <hostname_dn_len> : length of <hostname_dn>
310 *
311 * To store the query, the caller must pass a buffer <buf> and its size
312 * <bufsize>. It returns the number of written bytes in success, -1 if <buf> is
313 * too short.
314 */
315static int resolv_build_query(int query_id, int query_type, unsigned int accepted_payload_size,
316 char *hostname_dn, int hostname_dn_len, char *buf, int bufsize)
317{
318 struct dns_header dns_hdr;
319 struct dns_question qinfo;
320 struct dns_additional_record edns;
321 char *p = buf;
322
323 if (sizeof(dns_hdr) + sizeof(qinfo) + sizeof(edns) + hostname_dn_len >= bufsize)
324 return -1;
325
326 memset(buf, 0, bufsize);
327
328 /* Set dns query headers */
329 dns_hdr.id = (unsigned short) htons(query_id);
330 dns_hdr.flags = htons(0x0100); /* qr=0, opcode=0, aa=0, tc=0, rd=1, ra=0, z=0, rcode=0 */
331 dns_hdr.qdcount = htons(1); /* 1 question */
332 dns_hdr.ancount = 0;
333 dns_hdr.nscount = 0;
334 dns_hdr.arcount = htons(1);
335 memcpy(p, &dns_hdr, sizeof(dns_hdr));
336 p += sizeof(dns_hdr);
337
338 /* Set up query hostname */
339 memcpy(p, hostname_dn, hostname_dn_len);
340 p += hostname_dn_len;
341 *p++ = 0;
342
343 /* Set up query info (type and class) */
344 qinfo.qtype = htons(query_type);
345 qinfo.qclass = htons(DNS_RCLASS_IN);
346 memcpy(p, &qinfo, sizeof(qinfo));
347 p += sizeof(qinfo);
348
349 /* Set the DNS extension */
350 edns.name = 0;
351 edns.type = htons(DNS_RTYPE_OPT);
352 edns.udp_payload_size = htons(accepted_payload_size);
353 edns.extension = 0;
354 edns.data_length = 0;
355 memcpy(p, &edns, sizeof(edns));
356 p += sizeof(edns);
357
358 return (p - buf);
359}
360
361/* Sends a DNS query to resolvers associated to a resolution. It returns 0 on
Emeric Brun9267ed82021-10-29 16:44:49 +0200362 * success or -1 if trash buffer is not large enough to build a valid query.
Emeric Brunc9437992021-02-12 19:42:55 +0100363 */
364static int resolv_send_query(struct resolv_resolution *resolution)
365{
366 struct resolvers *resolvers = resolution->resolvers;
367 struct dns_nameserver *ns;
368 int len;
369
370 /* Update resolution */
371 resolution->nb_queries = 0;
372 resolution->nb_responses = 0;
373 resolution->last_query = now_ms;
374
375 len = resolv_build_query(resolution->query_id, resolution->query_type,
376 resolvers->accepted_payload_size,
377 resolution->hostname_dn, resolution->hostname_dn_len,
378 trash.area, trash.size);
Emeric Brun9267ed82021-10-29 16:44:49 +0200379 if (len < 0) {
380 send_log(NULL, LOG_NOTICE,
381 "can not build the query message for %s, in resolvers %s.\n",
382 resolution->hostname_dn, resolvers->id);
383 return -1;
384 }
Emeric Brunc9437992021-02-12 19:42:55 +0100385
386 list_for_each_entry(ns, &resolvers->nameservers, list) {
Emeric Brun2fa8f072021-10-29 16:28:33 +0200387 if (dns_send_nameserver(ns, trash.area, len) >= 0)
Emeric Brunc9437992021-02-12 19:42:55 +0100388 resolution->nb_queries++;
389 }
390
391 /* Push the resolution at the end of the active list */
Willy Tarreau8c3c5232021-10-19 22:01:36 +0200392 LIST_DEL_INIT(&resolution->list);
Willy Tarreau2b718102021-04-21 07:32:39 +0200393 LIST_APPEND(&resolvers->resolutions.curr, &resolution->list);
Emeric Brunc9437992021-02-12 19:42:55 +0100394 return 0;
395}
396
397/* Prepares and sends a DNS resolution. It returns 1 if the query was sent, 0 if
398 * skipped and -1 if an error occurred.
399 */
400static int
401resolv_run_resolution(struct resolv_resolution *resolution)
402{
403 struct resolvers *resolvers = resolution->resolvers;
404 int query_id, i;
405
406 /* Avoid sending requests for resolutions that don't yet have an
407 * hostname, ie resolutions linked to servers that do not yet have an
408 * fqdn */
409 if (!resolution->hostname_dn)
410 return 0;
411
412 /* Check if a resolution has already been started for this server return
413 * directly to avoid resolution pill up. */
414 if (resolution->step != RSLV_STEP_NONE)
415 return 0;
416
417 /* Generates a new query id. We try at most 100 times to find a free
418 * query id */
419 for (i = 0; i < 100; ++i) {
420 query_id = resolv_rnd16();
421 if (!eb32_lookup(&resolvers->query_ids, query_id))
422 break;
423 query_id = -1;
424 }
425 if (query_id == -1) {
426 send_log(NULL, LOG_NOTICE,
427 "could not generate a query id for %s, in resolvers %s.\n",
428 resolution->hostname_dn, resolvers->id);
429 return -1;
430 }
431
432 /* Update resolution parameters */
433 resolution->query_id = query_id;
434 resolution->qid.key = query_id;
435 resolution->step = RSLV_STEP_RUNNING;
436 resolution->query_type = resolution->prefered_query_type;
437 resolution->try = resolvers->resolve_retries;
438 eb32_insert(&resolvers->query_ids, &resolution->qid);
439
440 /* Send the DNS query */
441 resolution->try -= 1;
442 resolv_send_query(resolution);
443 return 1;
444}
445
446/* Performs a name resolution for the requester <req> */
447void resolv_trigger_resolution(struct resolv_requester *req)
448{
449 struct resolvers *resolvers;
450 struct resolv_resolution *res;
451 int exp;
452
453 if (!req || !req->resolution)
454 return;
455 res = req->resolution;
456 resolvers = res->resolvers;
457
Christopher Faulet7a3a5362021-11-02 16:25:05 +0100458 enter_resolver_code();
459
Emeric Brunc9437992021-02-12 19:42:55 +0100460 /* The resolution must not be triggered yet. Use the cached response, if
461 * valid */
462 exp = tick_add(res->last_resolution, resolvers->hold.valid);
463 if (resolvers->t && (res->status != RSLV_STATUS_VALID ||
Christopher Fauletc386b8c2022-10-24 08:59:59 +0200464 !tick_isset(res->last_resolution) || tick_is_expired(exp, now_ms))) {
465 /* If the resolution is not running and the requester is a
466 * server, reset the resoltion timer to force a quick
467 * resolution.
468 */
469 if (res->step == RSLV_STEP_NONE &&
470 (obj_type(req->owner) == OBJ_TYPE_SERVER ||
471 obj_type(req->owner) == OBJ_TYPE_SRVRQ))
472 res->last_resolution = TICK_ETERNITY;
Emeric Brunc9437992021-02-12 19:42:55 +0100473 task_wakeup(resolvers->t, TASK_WOKEN_OTHER);
Christopher Fauletc386b8c2022-10-24 08:59:59 +0200474 }
Christopher Faulet7a3a5362021-11-02 16:25:05 +0100475
476 leave_resolver_code();
Emeric Brunc9437992021-02-12 19:42:55 +0100477}
478
479
480/* Resets some resolution parameters to initial values and also delete the query
481 * ID from the resolver's tree.
482 */
483static void resolv_reset_resolution(struct resolv_resolution *resolution)
484{
485 /* update resolution status */
486 resolution->step = RSLV_STEP_NONE;
487 resolution->try = 0;
488 resolution->last_resolution = now_ms;
489 resolution->nb_queries = 0;
490 resolution->nb_responses = 0;
491 resolution->query_type = resolution->prefered_query_type;
492
493 /* clean up query id */
494 eb32_delete(&resolution->qid);
495 resolution->query_id = 0;
496 resolution->qid.key = 0;
497}
498
499/* Returns the query id contained in a DNS response */
500static inline unsigned short resolv_response_get_query_id(unsigned char *resp)
501{
502 return resp[0] * 256 + resp[1];
503}
504
505
506/* Analyses, re-builds and copies the name <name> from the DNS response packet
507 * <buffer>. <name> must point to the 'data_len' information or pointer 'c0'
508 * for compressed data. The result is copied into <dest>, ensuring we don't
509 * overflow using <dest_len> Returns the number of bytes the caller can move
510 * forward. If 0 it means an error occurred while parsing the name. <offset> is
511 * the number of bytes the caller could move forward.
512 */
513int resolv_read_name(unsigned char *buffer, unsigned char *bufend,
514 unsigned char *name, char *destination, int dest_len,
515 int *offset, unsigned int depth)
516{
517 int nb_bytes = 0, n = 0;
518 int label_len;
519 unsigned char *reader = name;
520 char *dest = destination;
521
522 while (1) {
523 if (reader >= bufend)
524 goto err;
525
526 /* Name compression is in use */
527 if ((*reader & 0xc0) == 0xc0) {
528 if (reader + 1 >= bufend)
529 goto err;
530
531 /* Must point BEFORE current position */
532 if ((buffer + reader[1]) > reader)
533 goto err;
534
535 if (depth++ > 100)
536 goto err;
537
538 n = resolv_read_name(buffer, bufend, buffer + (*reader & 0x3f)*256 + reader[1],
539 dest, dest_len - nb_bytes, offset, depth);
540 if (n == 0)
541 goto err;
542
543 dest += n;
544 nb_bytes += n;
545 goto out;
546 }
547
548 label_len = *reader;
549 if (label_len == 0)
550 goto out;
551
552 /* Check if:
553 * - we won't read outside the buffer
554 * - there is enough place in the destination
555 */
556 if ((reader + label_len >= bufend) || (nb_bytes + label_len >= dest_len))
557 goto err;
558
559 /* +1 to take label len + label string */
560 label_len++;
561
562 memcpy(dest, reader, label_len);
563
564 dest += label_len;
565 nb_bytes += label_len;
566 reader += label_len;
567 }
568
569 out:
570 /* offset computation:
571 * parse from <name> until finding either NULL or a pointer "c0xx"
572 */
573 reader = name;
574 *offset = 0;
575 while (reader < bufend) {
576 if ((reader[0] & 0xc0) == 0xc0) {
577 *offset += 2;
578 break;
579 }
580 else if (*reader == 0) {
581 *offset += 1;
582 break;
583 }
584 *offset += 1;
585 ++reader;
586 }
587 return nb_bytes;
588
589 err:
590 return 0;
591}
592
Willy Tarreau20751652021-10-18 16:46:38 +0200593/* Reinitialize the list of aborted resolutions before calling certain
594 * functions relying on it. The list must be processed by calling
Christopher Faulet7a3a5362021-11-02 16:25:05 +0100595 * leave_resolver_code() after operations.
Willy Tarreau20751652021-10-18 16:46:38 +0200596 */
Christopher Faulet7a3a5362021-11-02 16:25:05 +0100597static void enter_resolver_code()
Willy Tarreau20751652021-10-18 16:46:38 +0200598{
Christopher Faulet7a3a5362021-11-02 16:25:05 +0100599 if (!recurse)
600 LIST_INIT(&death_row);
601 recurse++;
Willy Tarreau20751652021-10-18 16:46:38 +0200602}
603
Christopher Faulet7a3a5362021-11-02 16:25:05 +0100604/* Add a resolution to the death_row. */
Willy Tarreau20751652021-10-18 16:46:38 +0200605static void abort_resolution(struct resolv_resolution *res)
606{
Christopher Faulet6256aaa2022-09-27 10:43:24 +0200607 /* Remove the resolution from query_ids tree and from any resolvers list */
608 eb32_delete(&res->qid);
609 res->query_id = 0;
610 res->qid.key = 0;
611
Willy Tarreau20751652021-10-18 16:46:38 +0200612 LIST_DEL_INIT(&res->list);
613 LIST_APPEND(&death_row, &res->list);
614}
615
616/* This releases any aborted resolution found in the death row. It is mandatory
Christopher Faulet7a3a5362021-11-02 16:25:05 +0100617 * to call enter_resolver_code() first before the function (or loop) that
Willy Tarreau20751652021-10-18 16:46:38 +0200618 * needs to defer deletions. Note that some of them are in relation via internal
619 * objects and might cause the deletion of other ones from the same list, so we
620 * must absolutely not use a list_for_each_entry_safe() nor any such thing here,
621 * and solely rely on each call to remove the first remaining list element.
622 */
Christopher Faulet7a3a5362021-11-02 16:25:05 +0100623static void leave_resolver_code()
Willy Tarreau20751652021-10-18 16:46:38 +0200624{
625 struct resolv_resolution *res;
626
Christopher Faulet7a3a5362021-11-02 16:25:05 +0100627 recurse--;
628 if (recurse)
629 return;
630
Willy Tarreau20751652021-10-18 16:46:38 +0200631 while (!LIST_ISEMPTY(&death_row)) {
632 res = LIST_NEXT(&death_row, struct resolv_resolution *, list);
633 resolv_free_resolution(res);
634 }
635
636 /* make sure nobody tries to add anything without having initialized it */
637 death_row = (struct list){ };
638}
639
Christopher Faulet5f8ccff2021-06-15 16:08:48 +0200640/* Cleanup fqdn/port and address of a server attached to a SRV resolution. This
641 * happens when an SRV item is purged or when the server status is considered as
642 * obsolete.
643 *
Willy Tarreau20751652021-10-18 16:46:38 +0200644 * Must be called with the DNS lock held, and with the death_row already
Christopher Faulet7a3a5362021-11-02 16:25:05 +0100645 * initialized via enter_resolver_code().
Christopher Faulet5f8ccff2021-06-15 16:08:48 +0200646 */
Willy Tarreau20751652021-10-18 16:46:38 +0200647static void resolv_srvrq_cleanup_srv(struct server *srv)
Christopher Faulet5f8ccff2021-06-15 16:08:48 +0200648{
Willy Tarreau33360872021-10-20 14:07:31 +0200649 _resolv_unlink_resolution(srv->resolv_requester);
Christopher Faulet5f8ccff2021-06-15 16:08:48 +0200650 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
651 srvrq_update_srv_status(srv, 1);
652 ha_free(&srv->hostname);
653 ha_free(&srv->hostname_dn);
654 srv->hostname_dn_len = 0;
655 memset(&srv->addr, 0, sizeof(srv->addr));
656 srv->svc_port = 0;
657 srv->flags |= SRV_F_NO_RESOLUTION;
Christopher Fauleta62d9742021-06-15 16:14:37 +0200658
659 ebpt_delete(&srv->host_dn);
660 ha_free(&srv->host_dn.key);
661
Christopher Faulet5f8ccff2021-06-15 16:08:48 +0200662 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Willy Tarreau8c3c5232021-10-19 22:01:36 +0200663 LIST_DEL_INIT(&srv->srv_rec_item);
Christopher Faulet5f8ccff2021-06-15 16:08:48 +0200664 LIST_APPEND(&srv->srvrq->attached_servers, &srv->srv_rec_item);
Christopher Faulet2c0f5272021-06-15 16:17:17 +0200665
666 srv->srvrq_check->expire = TICK_ETERNITY;
Christopher Faulet5f8ccff2021-06-15 16:08:48 +0200667}
668
Christopher Faulet2c0f5272021-06-15 16:17:17 +0200669/* Takes care to cleanup a server resolution when it is outdated. This only
670 * happens for a server relying on a SRV record.
671 */
672static struct task *resolv_srvrq_expire_task(struct task *t, void *context, unsigned int state)
673{
674 struct server *srv = context;
675
676 if (!tick_is_expired(t->expire, now_ms))
677 goto end;
678
Christopher Faulet7a3a5362021-11-02 16:25:05 +0100679 enter_resolver_code();
Christopher Faulet152b50c2021-06-18 09:05:49 +0200680 HA_SPIN_LOCK(DNS_LOCK, &srv->srvrq->resolvers->lock);
Willy Tarreau20751652021-10-18 16:46:38 +0200681 resolv_srvrq_cleanup_srv(srv);
Christopher Faulet152b50c2021-06-18 09:05:49 +0200682 HA_SPIN_UNLOCK(DNS_LOCK, &srv->srvrq->resolvers->lock);
Christopher Faulet7a3a5362021-11-02 16:25:05 +0100683 leave_resolver_code();
Christopher Faulet2c0f5272021-06-15 16:17:17 +0200684
685 end:
686 return t;
687}
688
Emeric Brunc9437992021-02-12 19:42:55 +0100689/* Checks for any obsolete record, also identify any SRV request, and try to
Christopher Faulet7a3a5362021-11-02 16:25:05 +0100690 * find a corresponding server.
Willy Tarreau20751652021-10-18 16:46:38 +0200691 */
Emeric Brunc9437992021-02-12 19:42:55 +0100692static void resolv_check_response(struct resolv_resolution *res)
693{
694 struct resolvers *resolvers = res->resolvers;
Christopher Fauletdb31b442021-03-11 18:19:41 +0100695 struct resolv_requester *req;
Emeric Brunc9437992021-02-12 19:42:55 +0100696 struct resolv_answer_item *item, *itemback;
Emeric Brunf9ca5d82021-06-11 10:08:05 +0200697 struct server *srv, *srvback;
Emeric Brunc9437992021-02-12 19:42:55 +0100698 struct resolv_srvrq *srvrq;
699
700 list_for_each_entry_safe(item, itemback, &res->response.answer_list, list) {
701 struct resolv_answer_item *ar_item = item->ar_item;
702
703 /* clean up obsolete Additional record */
Christopher Faulet55c1c402021-03-11 09:36:05 +0100704 if (ar_item && tick_is_lt(tick_add(ar_item->last_seen, resolvers->hold.obsolete), now_ms)) {
Christopher Faulet3e0600f2021-03-10 18:38:37 +0100705 /* Cleaning up the AR item will trigger an extra DNS resolution, except if the SRV
706 * item is also obsolete.
707 */
Emeric Brunc9437992021-02-12 19:42:55 +0100708 pool_free(resolv_answer_item_pool, ar_item);
709 item->ar_item = NULL;
710 }
711
712 /* Remove obsolete items */
Christopher Faulet55c1c402021-03-11 09:36:05 +0100713 if (tick_is_lt(tick_add(item->last_seen, resolvers->hold.obsolete), now_ms)) {
Emeric Brunf9ca5d82021-06-11 10:08:05 +0200714 if (item->type == DNS_RTYPE_A || item->type == DNS_RTYPE_AAAA) {
Emeric Brunc9437992021-02-12 19:42:55 +0100715 /* Remove any associated server */
Emeric Brunf9ca5d82021-06-11 10:08:05 +0200716 list_for_each_entry_safe(srv, srvback, &item->attached_servers, ip_rec_item) {
717 LIST_DEL_INIT(&srv->ip_rec_item);
718 }
719 }
720 else if (item->type == DNS_RTYPE_SRV) {
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200721 /* Remove any associated server */
Christopher Faulet5f8ccff2021-06-15 16:08:48 +0200722 list_for_each_entry_safe(srv, srvback, &item->attached_servers, srv_rec_item)
Willy Tarreau20751652021-10-18 16:46:38 +0200723 resolv_srvrq_cleanup_srv(srv);
Emeric Brunc9437992021-02-12 19:42:55 +0100724 }
725
Willy Tarreau8c3c5232021-10-19 22:01:36 +0200726 LIST_DEL_INIT(&item->list);
Emeric Brunc9437992021-02-12 19:42:55 +0100727 if (item->ar_item) {
728 pool_free(resolv_answer_item_pool, item->ar_item);
729 item->ar_item = NULL;
730 }
731 pool_free(resolv_answer_item_pool, item);
732 continue;
733 }
734
735 if (item->type != DNS_RTYPE_SRV)
736 continue;
737
738 /* Now process SRV records */
Christopher Fauletdb31b442021-03-11 18:19:41 +0100739 list_for_each_entry(req, &res->requesters, list) {
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200740 struct ebpt_node *node;
741 char target[DNS_MAX_NAME_SIZE+1];
742
743 int i;
Emeric Brunc9437992021-02-12 19:42:55 +0100744 if ((srvrq = objt_resolv_srvrq(req->owner)) == NULL)
745 continue;
746
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200747 /* Check if a server already uses that record */
748 srv = NULL;
749 list_for_each_entry(srv, &item->attached_servers, srv_rec_item) {
750 if (srv->srvrq == srvrq) {
751 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
752 goto srv_found;
Emeric Brunc9437992021-02-12 19:42:55 +0100753 }
Emeric Brunc9437992021-02-12 19:42:55 +0100754 }
755
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200756
757 /* If not empty we try to match a server
758 * in server state file tree with the same hostname
759 */
760 if (!eb_is_empty(&srvrq->named_servers)) {
761 srv = NULL;
762
763 /* convert the key to lookup in lower case */
Willy Tarreau20a02372021-10-14 22:52:04 +0200764 for (i = 0 ; item->data.target[i] ; i++)
765 target[i] = tolower(item->data.target[i]);
Christopher Fauletc20d6422021-07-22 14:29:26 +0200766 target[i] = 0;
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200767
768 node = ebis_lookup(&srvrq->named_servers, target);
769 if (node) {
770 srv = ebpt_entry(node, struct server, host_dn);
Emeric Brunc9437992021-02-12 19:42:55 +0100771 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200772
773 /* an entry was found with the same hostname
774 * let check this node if the port matches
775 * and try next node if the hostname
776 * is still the same
777 */
778 while (1) {
779 if (srv->svc_port == item->port) {
780 /* server found, we remove it from tree */
781 ebpt_delete(node);
Christopher Fauleta62d9742021-06-15 16:14:37 +0200782 ha_free(&srv->host_dn.key);
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200783 goto srv_found;
784 }
785
786 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
787
788 node = ebpt_next(node);
789 if (!node)
790 break;
791
792 srv = ebpt_entry(node, struct server, host_dn);
793 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
794
795 if ((item->data_len != srv->hostname_dn_len)
Willy Tarreau20a02372021-10-14 22:52:04 +0200796 || resolv_hostname_cmp(srv->hostname_dn, item->data.target, item->data_len)) {
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200797 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
798 break;
799 }
800 }
Emeric Brunc9437992021-02-12 19:42:55 +0100801 }
802 }
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200803
804 /* Pick the first server listed in srvrq (those ones don't
805 * have hostname and are free to use)
806 */
807 srv = NULL;
808 list_for_each_entry(srv, &srvrq->attached_servers, srv_rec_item) {
809 LIST_DEL_INIT(&srv->srv_rec_item);
810 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
811 goto srv_found;
812 }
813 srv = NULL;
Emeric Brunc9437992021-02-12 19:42:55 +0100814
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200815srv_found:
Emeric Brunc9437992021-02-12 19:42:55 +0100816 /* And update this server, if found (srv is locked here) */
817 if (srv) {
Christopher Faulet3e0600f2021-03-10 18:38:37 +0100818 /* re-enable DNS resolution for this server by default */
819 srv->flags &= ~SRV_F_NO_RESOLUTION;
Christopher Faulet2c0f5272021-06-15 16:17:17 +0200820 srv->srvrq_check->expire = TICK_ETERNITY;
Christopher Faulet3e0600f2021-03-10 18:38:37 +0100821
Christopher Fauleta6173cd2022-11-03 16:41:46 +0100822 srv->svc_port = item->port;
823 srv->flags &= ~SRV_F_MAPPORTS;
824
Emeric Brunc9437992021-02-12 19:42:55 +0100825 /* Check if an Additional Record is associated to this SRV record.
826 * Perform some sanity checks too to ensure the record can be used.
827 * If all fine, we simply pick up the IP address found and associate
Christopher Faulet3e0600f2021-03-10 18:38:37 +0100828 * it to the server. And DNS resolution is disabled for this server.
Emeric Brunc9437992021-02-12 19:42:55 +0100829 */
830 if ((item->ar_item != NULL) &&
831 (item->ar_item->type == DNS_RTYPE_A || item->ar_item->type == DNS_RTYPE_AAAA))
Christopher Faulet3e0600f2021-03-10 18:38:37 +0100832 {
Emeric Brunc9437992021-02-12 19:42:55 +0100833
834 switch (item->ar_item->type) {
835 case DNS_RTYPE_A:
Willy Tarreau20a02372021-10-14 22:52:04 +0200836 srv_update_addr(srv, &item->ar_item->data.in4.sin_addr, AF_INET, "DNS additional record");
Emeric Brunc9437992021-02-12 19:42:55 +0100837 break;
838 case DNS_RTYPE_AAAA:
Willy Tarreau20a02372021-10-14 22:52:04 +0200839 srv_update_addr(srv, &item->ar_item->data.in6.sin6_addr, AF_INET6, "DNS additional record");
Emeric Brunc9437992021-02-12 19:42:55 +0100840 break;
841 }
842
843 srv->flags |= SRV_F_NO_RESOLUTION;
Christopher Faulet3e0600f2021-03-10 18:38:37 +0100844
845 /* Unlink A/AAAA resolution for this server if there is an AR item.
846 * It is usless to perform an extra resolution
847 */
Willy Tarreau33360872021-10-20 14:07:31 +0200848 _resolv_unlink_resolution(srv->resolv_requester);
Emeric Brunc9437992021-02-12 19:42:55 +0100849 }
850
851 if (!srv->hostname_dn) {
852 const char *msg = NULL;
Willy Tarreau2859c162021-10-14 08:00:38 +0200853 char hostname[DNS_MAX_NAME_SIZE+1];
Emeric Brunc9437992021-02-12 19:42:55 +0100854
Willy Tarreau20a02372021-10-14 22:52:04 +0200855 if (resolv_dn_label_to_str(item->data.target, item->data_len,
Willy Tarreau2859c162021-10-14 08:00:38 +0200856 hostname, sizeof(hostname)) == -1) {
Emeric Brunc9437992021-02-12 19:42:55 +0100857 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
858 continue;
859 }
Christopher Faulet69beaa92021-02-16 12:07:47 +0100860 msg = srv_update_fqdn(srv, hostname, "SRV record", 1);
Emeric Brunc9437992021-02-12 19:42:55 +0100861 if (msg)
862 send_log(srv->proxy, LOG_NOTICE, "%s", msg);
863 }
864
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200865 if (!LIST_INLIST(&srv->srv_rec_item))
866 LIST_APPEND(&item->attached_servers, &srv->srv_rec_item);
867
Christopher Faulet3e0600f2021-03-10 18:38:37 +0100868 if (!(srv->flags & SRV_F_NO_RESOLUTION)) {
869 /* If there is no AR item responsible of the FQDN resolution,
870 * trigger a dedicated DNS resolution
871 */
872 if (!srv->resolv_requester || !srv->resolv_requester->resolution)
873 resolv_link_resolution(srv, OBJ_TYPE_SERVER, 1);
874 }
875
Christopher Fauletab177ac2021-03-10 15:34:52 +0100876 /* Update the server status */
Christopher Faulet6b117ae2021-03-11 18:06:23 +0100877 srvrq_update_srv_status(srv, (srv->addr.ss_family != AF_INET && srv->addr.ss_family != AF_INET6));
Emeric Brunc9437992021-02-12 19:42:55 +0100878
Emeric Brunc9437992021-02-12 19:42:55 +0100879 if (!srv->resolv_opts.ignore_weight) {
880 char weight[9];
881 int ha_weight;
882
883 /* DNS weight range if from 0 to 65535
884 * HAProxy weight is from 0 to 256
885 * The rule below ensures that weight 0 is well respected
886 * while allowing a "mapping" from DNS weight into HAProxy's one.
887 */
888 ha_weight = (item->weight + 255) / 256;
889
890 snprintf(weight, sizeof(weight), "%d", ha_weight);
891 server_parse_weight_change_request(srv, weight);
892 }
893 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
894 }
895 }
896 }
897}
898
899/* Validates that the buffer DNS response provided in <resp> and finishing
900 * before <bufend> is valid from a DNS protocol point of view.
901 *
902 * The result is stored in <resolution>' response, buf_response,
903 * response_query_records and response_answer_records members.
904 *
905 * This function returns one of the RSLV_RESP_* code to indicate the type of
906 * error found.
907 */
908static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufend,
909 struct resolv_resolution *resolution, int max_answer_records)
910{
911 unsigned char *reader;
912 char *previous_dname, tmpname[DNS_MAX_NAME_SIZE];
913 int len, flags, offset;
914 int query_record_id;
915 int nb_saved_records;
916 struct resolv_query_item *query;
917 struct resolv_answer_item *answer_record, *tmp_record;
918 struct resolv_response *r_res;
919 int i, found = 0;
920 int cause = RSLV_RESP_ERROR;
921
922 reader = resp;
923 len = 0;
924 previous_dname = NULL;
925 query = NULL;
926 answer_record = NULL;
927
928 /* Initialization of response buffer and structure */
929 r_res = &resolution->response;
930
931 /* query id */
932 if (reader + 2 >= bufend)
933 goto invalid_resp;
934
935 r_res->header.id = reader[0] * 256 + reader[1];
936 reader += 2;
937
938 /* Flags and rcode are stored over 2 bytes
939 * First byte contains:
940 * - response flag (1 bit)
941 * - opcode (4 bits)
942 * - authoritative (1 bit)
943 * - truncated (1 bit)
944 * - recursion desired (1 bit)
945 */
946 if (reader + 2 >= bufend)
947 goto invalid_resp;
948
949 flags = reader[0] * 256 + reader[1];
950
951 if ((flags & DNS_FLAG_REPLYCODE) != DNS_RCODE_NO_ERROR) {
952 if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_NX_DOMAIN) {
953 cause = RSLV_RESP_NX_DOMAIN;
954 goto return_error;
955 }
956 else if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_REFUSED) {
957 cause = RSLV_RESP_REFUSED;
958 goto return_error;
959 }
960 else {
961 cause = RSLV_RESP_ERROR;
962 goto return_error;
963 }
964 }
965
966 /* Move forward 2 bytes for flags */
967 reader += 2;
968
969 /* 2 bytes for question count */
970 if (reader + 2 >= bufend)
971 goto invalid_resp;
972 r_res->header.qdcount = reader[0] * 256 + reader[1];
973 /* (for now) we send one query only, so we expect only one in the
974 * response too */
975 if (r_res->header.qdcount != 1) {
976 cause = RSLV_RESP_QUERY_COUNT_ERROR;
977 goto return_error;
978 }
979
980 if (r_res->header.qdcount > DNS_MAX_QUERY_RECORDS)
981 goto invalid_resp;
982 reader += 2;
983
984 /* 2 bytes for answer count */
985 if (reader + 2 >= bufend)
986 goto invalid_resp;
987 r_res->header.ancount = reader[0] * 256 + reader[1];
988 if (r_res->header.ancount == 0) {
989 cause = RSLV_RESP_ANCOUNT_ZERO;
990 goto return_error;
991 }
992
993 /* Check if too many records are announced */
994 if (r_res->header.ancount > max_answer_records)
995 goto invalid_resp;
996 reader += 2;
997
998 /* 2 bytes authority count */
999 if (reader + 2 >= bufend)
1000 goto invalid_resp;
1001 r_res->header.nscount = reader[0] * 256 + reader[1];
1002 reader += 2;
1003
1004 /* 2 bytes additional count */
1005 if (reader + 2 >= bufend)
1006 goto invalid_resp;
1007 r_res->header.arcount = reader[0] * 256 + reader[1];
1008 reader += 2;
1009
1010 /* Parsing dns queries */
Willy Tarreau51128f82021-10-19 11:17:33 +02001011 BUG_ON(!LIST_ISEMPTY(&r_res->query_list));
Emeric Brunc9437992021-02-12 19:42:55 +01001012 for (query_record_id = 0; query_record_id < r_res->header.qdcount; query_record_id++) {
1013 /* Use next pre-allocated resolv_query_item after ensuring there is
1014 * still one available.
1015 * It's then added to our packet query list. */
1016 if (query_record_id > DNS_MAX_QUERY_RECORDS)
1017 goto invalid_resp;
1018 query = &resolution->response_query_records[query_record_id];
Willy Tarreau2b718102021-04-21 07:32:39 +02001019 LIST_APPEND(&r_res->query_list, &query->list);
Emeric Brunc9437992021-02-12 19:42:55 +01001020
1021 /* Name is a NULL terminated string in our case, since we have
1022 * one query per response and the first one can't be compressed
1023 * (using the 0x0c format) */
1024 offset = 0;
1025 len = resolv_read_name(resp, bufend, reader, query->name, DNS_MAX_NAME_SIZE, &offset, 0);
1026
1027 if (len == 0)
1028 goto invalid_resp;
1029
1030 reader += offset;
1031 previous_dname = query->name;
1032
1033 /* move forward 2 bytes for question type */
1034 if (reader + 2 >= bufend)
1035 goto invalid_resp;
1036 query->type = reader[0] * 256 + reader[1];
1037 reader += 2;
1038
1039 /* move forward 2 bytes for question class */
1040 if (reader + 2 >= bufend)
1041 goto invalid_resp;
1042 query->class = reader[0] * 256 + reader[1];
1043 reader += 2;
1044 }
1045
Willy Tarreau3a8897f2021-10-20 17:29:28 +02001046 /* Let's just make gcc happy. The tests above make it clear that
1047 * qdcount==1 hence that we necessarily enter into the loop at least
1048 * once, but gcc seems to be having difficulties following it and
1049 * warns about the risk of NULL dereference at the next line, even
1050 * if a BUG_ON(!query) is used.
1051 */
1052 ALREADY_CHECKED(query);
1053
Emeric Brunc9437992021-02-12 19:42:55 +01001054 /* TRUNCATED flag must be checked after we could read the query type
Willy Tarreau3a8897f2021-10-20 17:29:28 +02001055 * because a TRUNCATED SRV query type response can still be exploited
1056 */
Emeric Brunc9437992021-02-12 19:42:55 +01001057 if (query->type != DNS_RTYPE_SRV && flags & DNS_FLAG_TRUNCATED) {
1058 cause = RSLV_RESP_TRUNCATED;
1059 goto return_error;
1060 }
1061
1062 /* now parsing response records */
1063 nb_saved_records = 0;
1064 for (i = 0; i < r_res->header.ancount; i++) {
1065 if (reader >= bufend)
1066 goto invalid_resp;
1067
1068 answer_record = pool_alloc(resolv_answer_item_pool);
1069 if (answer_record == NULL)
1070 goto invalid_resp;
1071
1072 /* initialization */
1073 answer_record->ar_item = NULL;
Christopher Faulet55c1c402021-03-11 09:36:05 +01001074 answer_record->last_seen = TICK_ETERNITY;
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001075 LIST_INIT(&answer_record->attached_servers);
Willy Tarreaua2373e82021-10-19 11:29:21 +02001076 LIST_INIT(&answer_record->list);
Emeric Brunc9437992021-02-12 19:42:55 +01001077
1078 offset = 0;
1079 len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
1080
1081 if (len == 0)
1082 goto invalid_resp;
1083
1084 /* Check if the current record dname is valid. previous_dname
1085 * points either to queried dname or last CNAME target */
1086 if (query->type != DNS_RTYPE_SRV && resolv_hostname_cmp(previous_dname, tmpname, len) != 0) {
1087 if (i == 0) {
1088 /* First record, means a mismatch issue between
1089 * queried dname and dname found in the first
1090 * record */
1091 goto invalid_resp;
1092 }
1093 else {
1094 /* If not the first record, this means we have a
1095 * CNAME resolution error.
1096 */
1097 cause = RSLV_RESP_CNAME_ERROR;
1098 goto return_error;
1099 }
1100
1101 }
1102
1103 memcpy(answer_record->name, tmpname, len);
1104 answer_record->name[len] = 0;
1105
1106 reader += offset;
1107 if (reader >= bufend)
1108 goto invalid_resp;
1109
1110 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
1111 if (reader + 2 > bufend)
1112 goto invalid_resp;
1113
1114 answer_record->type = reader[0] * 256 + reader[1];
1115 reader += 2;
1116
1117 /* 2 bytes for class (2) */
1118 if (reader + 2 > bufend)
1119 goto invalid_resp;
1120
1121 answer_record->class = reader[0] * 256 + reader[1];
1122 reader += 2;
1123
1124 /* 4 bytes for ttl (4) */
1125 if (reader + 4 > bufend)
1126 goto invalid_resp;
1127
1128 answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
1129 + reader[2] * 256 + reader[3];
1130 reader += 4;
1131
1132 /* Now reading data len */
1133 if (reader + 2 > bufend)
1134 goto invalid_resp;
1135
1136 answer_record->data_len = reader[0] * 256 + reader[1];
1137
1138 /* Move forward 2 bytes for data len */
1139 reader += 2;
1140
1141 if (reader + answer_record->data_len > bufend)
1142 goto invalid_resp;
1143
1144 /* Analyzing record content */
1145 switch (answer_record->type) {
1146 case DNS_RTYPE_A:
1147 /* ipv4 is stored on 4 bytes */
1148 if (answer_record->data_len != 4)
1149 goto invalid_resp;
1150
Willy Tarreau20a02372021-10-14 22:52:04 +02001151 answer_record->data.in4.sin_family = AF_INET;
1152 memcpy(&answer_record->data.in4.sin_addr, reader, answer_record->data_len);
Emeric Brunc9437992021-02-12 19:42:55 +01001153 break;
1154
1155 case DNS_RTYPE_CNAME:
1156 /* Check if this is the last record and update the caller about the status:
1157 * no IP could be found and last record was a CNAME. Could be triggered
1158 * by a wrong query type
1159 *
1160 * + 1 because answer_record_id starts at 0
1161 * while number of answers is an integer and
1162 * starts at 1.
1163 */
1164 if (i + 1 == r_res->header.ancount) {
1165 cause = RSLV_RESP_CNAME_ERROR;
1166 goto return_error;
1167 }
1168
1169 offset = 0;
1170 len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
1171 if (len == 0)
1172 goto invalid_resp;
1173
Willy Tarreau20a02372021-10-14 22:52:04 +02001174 memcpy(answer_record->data.target, tmpname, len);
1175 answer_record->data.target[len] = 0;
1176 previous_dname = answer_record->data.target;
Emeric Brunc9437992021-02-12 19:42:55 +01001177 break;
1178
1179
1180 case DNS_RTYPE_SRV:
1181 /* Answer must contain :
1182 * - 2 bytes for the priority
1183 * - 2 bytes for the weight
1184 * - 2 bytes for the port
1185 * - the target hostname
1186 */
1187 if (answer_record->data_len <= 6)
1188 goto invalid_resp;
1189
1190 answer_record->priority = read_n16(reader);
1191 reader += sizeof(uint16_t);
1192 answer_record->weight = read_n16(reader);
1193 reader += sizeof(uint16_t);
1194 answer_record->port = read_n16(reader);
1195 reader += sizeof(uint16_t);
1196 offset = 0;
1197 len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
1198 if (len == 0)
1199 goto invalid_resp;
1200
1201 answer_record->data_len = len;
Willy Tarreau20a02372021-10-14 22:52:04 +02001202 memcpy(answer_record->data.target, tmpname, len);
1203 answer_record->data.target[len] = 0;
Emeric Brunc9437992021-02-12 19:42:55 +01001204 if (answer_record->ar_item != NULL) {
1205 pool_free(resolv_answer_item_pool, answer_record->ar_item);
1206 answer_record->ar_item = NULL;
1207 }
1208 break;
1209
1210 case DNS_RTYPE_AAAA:
1211 /* ipv6 is stored on 16 bytes */
1212 if (answer_record->data_len != 16)
1213 goto invalid_resp;
1214
Willy Tarreau20a02372021-10-14 22:52:04 +02001215 answer_record->data.in6.sin6_family = AF_INET6;
1216 memcpy(&answer_record->data.in6.sin6_addr, reader, answer_record->data_len);
Emeric Brunc9437992021-02-12 19:42:55 +01001217 break;
1218
1219 } /* switch (record type) */
1220
1221 /* Increment the counter for number of records saved into our
1222 * local response */
1223 nb_saved_records++;
1224
1225 /* Move forward answer_record->data_len for analyzing next
1226 * record in the response */
1227 reader += ((answer_record->type == DNS_RTYPE_SRV)
1228 ? offset
1229 : answer_record->data_len);
1230
1231 /* Lookup to see if we already had this entry */
1232 found = 0;
1233 list_for_each_entry(tmp_record, &r_res->answer_list, list) {
1234 if (tmp_record->type != answer_record->type)
1235 continue;
1236
1237 switch(tmp_record->type) {
1238 case DNS_RTYPE_A:
Willy Tarreau20a02372021-10-14 22:52:04 +02001239 if (!memcmp(&answer_record->data.in4.sin_addr,
1240 &tmp_record->data.in4.sin_addr,
1241 sizeof(answer_record->data.in4.sin_addr)))
Emeric Brunc9437992021-02-12 19:42:55 +01001242 found = 1;
1243 break;
1244
1245 case DNS_RTYPE_AAAA:
Willy Tarreau20a02372021-10-14 22:52:04 +02001246 if (!memcmp(&answer_record->data.in6.sin6_addr,
1247 &tmp_record->data.in6.sin6_addr,
1248 sizeof(answer_record->data.in6.sin6_addr)))
Emeric Brunc9437992021-02-12 19:42:55 +01001249 found = 1;
1250 break;
1251
1252 case DNS_RTYPE_SRV:
1253 if (answer_record->data_len == tmp_record->data_len &&
Willy Tarreau20a02372021-10-14 22:52:04 +02001254 !resolv_hostname_cmp(answer_record->data.target, tmp_record->data.target, answer_record->data_len) &&
Emeric Brunc9437992021-02-12 19:42:55 +01001255 answer_record->port == tmp_record->port) {
1256 tmp_record->weight = answer_record->weight;
1257 found = 1;
1258 }
1259 break;
1260
1261 default:
1262 break;
1263 }
1264
1265 if (found == 1)
1266 break;
1267 }
1268
1269 if (found == 1) {
Christopher Faulet55c1c402021-03-11 09:36:05 +01001270 tmp_record->last_seen = now_ms;
Emeric Brunc9437992021-02-12 19:42:55 +01001271 pool_free(resolv_answer_item_pool, answer_record);
1272 answer_record = NULL;
1273 }
1274 else {
Christopher Faulet55c1c402021-03-11 09:36:05 +01001275 answer_record->last_seen = now_ms;
Emeric Brunc9437992021-02-12 19:42:55 +01001276 answer_record->ar_item = NULL;
Willy Tarreau2b718102021-04-21 07:32:39 +02001277 LIST_APPEND(&r_res->answer_list, &answer_record->list);
Emeric Brunc9437992021-02-12 19:42:55 +01001278 answer_record = NULL;
1279 }
1280 } /* for i 0 to ancount */
1281
1282 /* Save the number of records we really own */
1283 r_res->header.ancount = nb_saved_records;
1284
1285 /* now parsing additional records for SRV queries only */
1286 if (query->type != DNS_RTYPE_SRV)
1287 goto skip_parsing_additional_records;
1288
1289 /* if we find Authority records, just skip them */
1290 for (i = 0; i < r_res->header.nscount; i++) {
1291 offset = 0;
1292 len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE,
1293 &offset, 0);
1294 if (len == 0)
1295 continue;
1296
1297 if (reader + offset + 10 >= bufend)
1298 goto invalid_resp;
1299
1300 reader += offset;
1301 /* skip 2 bytes for class */
1302 reader += 2;
1303 /* skip 2 bytes for type */
1304 reader += 2;
1305 /* skip 4 bytes for ttl */
1306 reader += 4;
1307 /* read data len */
1308 len = reader[0] * 256 + reader[1];
1309 reader += 2;
1310
1311 if (reader + len >= bufend)
1312 goto invalid_resp;
1313
1314 reader += len;
1315 }
1316
1317 nb_saved_records = 0;
1318 for (i = 0; i < r_res->header.arcount; i++) {
1319 if (reader >= bufend)
1320 goto invalid_resp;
1321
1322 answer_record = pool_alloc(resolv_answer_item_pool);
1323 if (answer_record == NULL)
1324 goto invalid_resp;
Christopher Faulet55c1c402021-03-11 09:36:05 +01001325 answer_record->last_seen = TICK_ETERNITY;
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001326 LIST_INIT(&answer_record->attached_servers);
Emeric Brunc9437992021-02-12 19:42:55 +01001327
1328 offset = 0;
1329 len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
1330
1331 if (len == 0) {
1332 pool_free(resolv_answer_item_pool, answer_record);
1333 answer_record = NULL;
1334 continue;
1335 }
1336
1337 memcpy(answer_record->name, tmpname, len);
1338 answer_record->name[len] = 0;
1339
1340 reader += offset;
1341 if (reader >= bufend)
1342 goto invalid_resp;
1343
1344 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
1345 if (reader + 2 > bufend)
1346 goto invalid_resp;
1347
1348 answer_record->type = reader[0] * 256 + reader[1];
1349 reader += 2;
1350
1351 /* 2 bytes for class (2) */
1352 if (reader + 2 > bufend)
1353 goto invalid_resp;
1354
1355 answer_record->class = reader[0] * 256 + reader[1];
1356 reader += 2;
1357
1358 /* 4 bytes for ttl (4) */
1359 if (reader + 4 > bufend)
1360 goto invalid_resp;
1361
1362 answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
1363 + reader[2] * 256 + reader[3];
1364 reader += 4;
1365
1366 /* Now reading data len */
1367 if (reader + 2 > bufend)
1368 goto invalid_resp;
1369
1370 answer_record->data_len = reader[0] * 256 + reader[1];
1371
1372 /* Move forward 2 bytes for data len */
1373 reader += 2;
1374
1375 if (reader + answer_record->data_len > bufend)
1376 goto invalid_resp;
1377
1378 /* Analyzing record content */
1379 switch (answer_record->type) {
1380 case DNS_RTYPE_A:
1381 /* ipv4 is stored on 4 bytes */
1382 if (answer_record->data_len != 4)
1383 goto invalid_resp;
1384
Willy Tarreau20a02372021-10-14 22:52:04 +02001385 answer_record->data.in4.sin_family = AF_INET;
1386 memcpy(&answer_record->data.in4.sin_addr, reader, answer_record->data_len);
Emeric Brunc9437992021-02-12 19:42:55 +01001387 break;
1388
1389 case DNS_RTYPE_AAAA:
1390 /* ipv6 is stored on 16 bytes */
1391 if (answer_record->data_len != 16)
1392 goto invalid_resp;
1393
Willy Tarreau20a02372021-10-14 22:52:04 +02001394 answer_record->data.in6.sin6_family = AF_INET6;
1395 memcpy(&answer_record->data.in6.sin6_addr, reader, answer_record->data_len);
Emeric Brunc9437992021-02-12 19:42:55 +01001396 break;
1397
1398 default:
1399 pool_free(resolv_answer_item_pool, answer_record);
1400 answer_record = NULL;
1401 continue;
1402
1403 } /* switch (record type) */
1404
1405 /* Increment the counter for number of records saved into our
1406 * local response */
1407 nb_saved_records++;
1408
1409 /* Move forward answer_record->data_len for analyzing next
1410 * record in the response */
Christopher Faulet77f86062021-03-10 15:19:57 +01001411 reader += answer_record->data_len;
Emeric Brunc9437992021-02-12 19:42:55 +01001412
1413 /* Lookup to see if we already had this entry */
1414 found = 0;
1415 list_for_each_entry(tmp_record, &r_res->answer_list, list) {
Christopher Faulet77f86062021-03-10 15:19:57 +01001416 struct resolv_answer_item *ar_item;
1417
1418 if (tmp_record->type != DNS_RTYPE_SRV || !tmp_record->ar_item)
1419 continue;
1420
1421 ar_item = tmp_record->ar_item;
Christopher Faulete8674c72021-03-12 16:42:45 +01001422 if (ar_item->type != answer_record->type || ar_item->last_seen == now_ms ||
Christopher Faulet77f86062021-03-10 15:19:57 +01001423 len != tmp_record->data_len ||
Willy Tarreau20a02372021-10-14 22:52:04 +02001424 resolv_hostname_cmp(answer_record->name, tmp_record->data.target, tmp_record->data_len))
Emeric Brunc9437992021-02-12 19:42:55 +01001425 continue;
1426
Christopher Faulet77f86062021-03-10 15:19:57 +01001427 switch(ar_item->type) {
Emeric Brunc9437992021-02-12 19:42:55 +01001428 case DNS_RTYPE_A:
Willy Tarreau20a02372021-10-14 22:52:04 +02001429 if (!memcmp(&answer_record->data.in4.sin_addr,
1430 &ar_item->data.in4.sin_addr,
1431 sizeof(answer_record->data.in4.sin_addr)))
Emeric Brunc9437992021-02-12 19:42:55 +01001432 found = 1;
1433 break;
1434
1435 case DNS_RTYPE_AAAA:
Willy Tarreau20a02372021-10-14 22:52:04 +02001436 if (!memcmp(&answer_record->data.in6.sin6_addr,
1437 &ar_item->data.in6.sin6_addr,
1438 sizeof(answer_record->data.in6.sin6_addr)))
Emeric Brunc9437992021-02-12 19:42:55 +01001439 found = 1;
1440 break;
1441
1442 default:
1443 break;
1444 }
1445
1446 if (found == 1)
1447 break;
1448 }
1449
1450 if (found == 1) {
Christopher Faulet55c1c402021-03-11 09:36:05 +01001451 tmp_record->ar_item->last_seen = now_ms;
Emeric Brunc9437992021-02-12 19:42:55 +01001452 pool_free(resolv_answer_item_pool, answer_record);
1453 answer_record = NULL;
1454 }
1455 else {
Christopher Faulet55c1c402021-03-11 09:36:05 +01001456 answer_record->last_seen = now_ms;
Emeric Brunc9437992021-02-12 19:42:55 +01001457 answer_record->ar_item = NULL;
1458
1459 // looking for the SRV record in the response list linked to this additional record
1460 list_for_each_entry(tmp_record, &r_res->answer_list, list) {
1461 if (tmp_record->type == DNS_RTYPE_SRV &&
1462 tmp_record->ar_item == NULL &&
Willy Tarreau20a02372021-10-14 22:52:04 +02001463 !resolv_hostname_cmp(tmp_record->data.target, answer_record->name, tmp_record->data_len)) {
Emeric Brunc9437992021-02-12 19:42:55 +01001464 /* Always use the received additional record to refresh info */
1465 if (tmp_record->ar_item)
1466 pool_free(resolv_answer_item_pool, tmp_record->ar_item);
1467 tmp_record->ar_item = answer_record;
Christopher Faulet9c246a42021-02-23 11:59:19 +01001468 answer_record = NULL;
Emeric Brunc9437992021-02-12 19:42:55 +01001469 break;
1470 }
1471 }
Christopher Faulet9c246a42021-02-23 11:59:19 +01001472 if (answer_record) {
Emeric Brunc9437992021-02-12 19:42:55 +01001473 pool_free(resolv_answer_item_pool, answer_record);
Christopher Faulet9c246a42021-02-23 11:59:19 +01001474 answer_record = NULL;
1475 }
Emeric Brunc9437992021-02-12 19:42:55 +01001476 }
1477 } /* for i 0 to arcount */
1478
1479 skip_parsing_additional_records:
1480
1481 /* Save the number of records we really own */
1482 r_res->header.arcount = nb_saved_records;
Emeric Brunc9437992021-02-12 19:42:55 +01001483 resolv_check_response(resolution);
1484 return RSLV_RESP_VALID;
1485
1486 invalid_resp:
1487 cause = RSLV_RESP_INVALID;
1488
1489 return_error:
Christopher Faulet67f6af52021-12-01 10:18:08 +01001490 if (query)
1491 LIST_DEL_INIT(&query->list);
Emeric Brunc9437992021-02-12 19:42:55 +01001492 pool_free(resolv_answer_item_pool, answer_record);
1493 return cause;
1494}
1495
1496/* Searches dn_name resolution in resp.
1497 * If existing IP not found, return the first IP matching family_priority,
1498 * otherwise, first ip found
1499 * The following tasks are the responsibility of the caller:
1500 * - <r_res> contains an error free DNS response
1501 * For both cases above, resolv_validate_dns_response is required
1502 * returns one of the RSLV_UPD_* code
1503 */
1504int resolv_get_ip_from_response(struct resolv_response *r_res,
1505 struct resolv_options *resolv_opts, void *currentip,
1506 short currentip_sin_family,
1507 void **newip, short *newip_sin_family,
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001508 struct server *owner)
Emeric Brunc9437992021-02-12 19:42:55 +01001509{
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001510 struct resolv_answer_item *record, *found_record = NULL;
Emeric Brunc9437992021-02-12 19:42:55 +01001511 int family_priority;
1512 int currentip_found;
1513 unsigned char *newip4, *newip6;
1514 int currentip_sel;
1515 int j;
1516 int score, max_score;
1517 int allowed_duplicated_ip;
1518
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001519 /* srv is linked to an alive ip record */
1520 if (owner && LIST_INLIST(&owner->ip_rec_item))
1521 return RSLV_UPD_NO;
1522
Emeric Brunc9437992021-02-12 19:42:55 +01001523 family_priority = resolv_opts->family_prio;
1524 allowed_duplicated_ip = resolv_opts->accept_duplicate_ip;
1525 *newip = newip4 = newip6 = NULL;
1526 currentip_found = 0;
1527 *newip_sin_family = AF_UNSPEC;
1528 max_score = -1;
1529
1530 /* Select an IP regarding configuration preference.
1531 * Top priority is the preferred network ip version,
1532 * second priority is the preferred network.
1533 * the last priority is the currently used IP,
1534 *
1535 * For these three priorities, a score is calculated. The
1536 * weight are:
1537 * 8 - preferred ip version.
1538 * 4 - preferred network.
1539 * 2 - if the ip in the record is not affected to any other server in the same backend (duplication)
1540 * 1 - current ip.
1541 * The result with the biggest score is returned.
1542 */
1543
1544 list_for_each_entry(record, &r_res->answer_list, list) {
1545 void *ip;
1546 unsigned char ip_type;
1547
1548 if (record->type == DNS_RTYPE_A) {
Emeric Brunc9437992021-02-12 19:42:55 +01001549 ip_type = AF_INET;
Willy Tarreau20a02372021-10-14 22:52:04 +02001550 ip = &record->data.in4.sin_addr;
Emeric Brunc9437992021-02-12 19:42:55 +01001551 }
1552 else if (record->type == DNS_RTYPE_AAAA) {
1553 ip_type = AF_INET6;
Willy Tarreau20a02372021-10-14 22:52:04 +02001554 ip = &record->data.in6.sin6_addr;
Emeric Brunc9437992021-02-12 19:42:55 +01001555 }
1556 else
1557 continue;
1558 score = 0;
1559
1560 /* Check for preferred ip protocol. */
1561 if (ip_type == family_priority)
1562 score += 8;
1563
1564 /* Check for preferred network. */
1565 for (j = 0; j < resolv_opts->pref_net_nb; j++) {
1566
1567 /* Compare only the same addresses class. */
1568 if (resolv_opts->pref_net[j].family != ip_type)
1569 continue;
1570
1571 if ((ip_type == AF_INET &&
1572 in_net_ipv4(ip,
1573 &resolv_opts->pref_net[j].mask.in4,
1574 &resolv_opts->pref_net[j].addr.in4)) ||
1575 (ip_type == AF_INET6 &&
1576 in_net_ipv6(ip,
1577 &resolv_opts->pref_net[j].mask.in6,
1578 &resolv_opts->pref_net[j].addr.in6))) {
1579 score += 4;
1580 break;
1581 }
1582 }
1583
1584 /* Check if the IP found in the record is already affected to a
1585 * member of a group. If not, the score should be incremented
1586 * by 2. */
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001587 if (owner) {
1588 struct server *srv;
1589 int already_used = 0;
1590
1591 list_for_each_entry(srv, &record->attached_servers, ip_rec_item) {
1592 if (srv == owner)
1593 continue;
1594 if (srv->proxy == owner->proxy) {
1595 already_used = 1;
1596 break;
1597 }
1598 }
1599 if (already_used) {
1600 if (!allowed_duplicated_ip) {
1601 continue;
1602 }
1603 }
1604 else {
1605 score += 2;
Emeric Brunc9437992021-02-12 19:42:55 +01001606 }
1607 } else {
1608 score += 2;
1609 }
1610
1611 /* Check for current ip matching. */
1612 if (ip_type == currentip_sin_family &&
1613 ((currentip_sin_family == AF_INET &&
1614 !memcmp(ip, currentip, 4)) ||
1615 (currentip_sin_family == AF_INET6 &&
1616 !memcmp(ip, currentip, 16)))) {
1617 score++;
1618 currentip_sel = 1;
1619 }
1620 else
1621 currentip_sel = 0;
1622
1623 /* Keep the address if the score is better than the previous
1624 * score. The maximum score is 15, if this value is reached, we
1625 * break the parsing. Implicitly, this score is reached the ip
1626 * selected is the current ip. */
1627 if (score > max_score) {
1628 if (ip_type == AF_INET)
1629 newip4 = ip;
1630 else
1631 newip6 = ip;
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001632 found_record = record;
Emeric Brunc9437992021-02-12 19:42:55 +01001633 currentip_found = currentip_sel;
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001634 if (score == 15) {
1635 /* this was not registered on the current record but it matches
1636 * let's fix it (it may comes from state file */
1637 if (owner)
1638 LIST_APPEND(&found_record->attached_servers, &owner->ip_rec_item);
Emeric Brunc9437992021-02-12 19:42:55 +01001639 return RSLV_UPD_NO;
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001640 }
Emeric Brunc9437992021-02-12 19:42:55 +01001641 max_score = score;
1642 }
1643 } /* list for each record entries */
1644
1645 /* No IP found in the response */
1646 if (!newip4 && !newip6)
1647 return RSLV_UPD_NO_IP_FOUND;
1648
1649 /* Case when the caller looks first for an IPv4 address */
1650 if (family_priority == AF_INET) {
1651 if (newip4) {
1652 *newip = newip4;
1653 *newip_sin_family = AF_INET;
1654 }
1655 else if (newip6) {
1656 *newip = newip6;
1657 *newip_sin_family = AF_INET6;
1658 }
Emeric Brunc9437992021-02-12 19:42:55 +01001659 }
1660 /* Case when the caller looks first for an IPv6 address */
1661 else if (family_priority == AF_INET6) {
1662 if (newip6) {
1663 *newip = newip6;
1664 *newip_sin_family = AF_INET6;
1665 }
1666 else if (newip4) {
1667 *newip = newip4;
1668 *newip_sin_family = AF_INET;
1669 }
Emeric Brunc9437992021-02-12 19:42:55 +01001670 }
1671 /* Case when the caller have no preference (we prefer IPv6) */
1672 else if (family_priority == AF_UNSPEC) {
1673 if (newip6) {
1674 *newip = newip6;
1675 *newip_sin_family = AF_INET6;
1676 }
1677 else if (newip4) {
1678 *newip = newip4;
1679 *newip_sin_family = AF_INET;
1680 }
Emeric Brunc9437992021-02-12 19:42:55 +01001681 }
1682
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001683 /* the ip of this record was chosen for the server */
1684 if (owner && found_record) {
Christopher Faulet2558d5a2021-06-24 15:16:48 +02001685 LIST_DEL_INIT(&owner->ip_rec_item);
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001686 LIST_APPEND(&found_record->attached_servers, &owner->ip_rec_item);
1687 }
1688
Emeric Brunc9437992021-02-12 19:42:55 +01001689 list_for_each_entry(record, &r_res->answer_list, list) {
1690 /* Move the first record to the end of the list, for internal
1691 * round robin */
Willy Tarreau8c3c5232021-10-19 22:01:36 +02001692 LIST_DEL_INIT(&record->list);
Willy Tarreau2b718102021-04-21 07:32:39 +02001693 LIST_APPEND(&r_res->answer_list, &record->list);
Emeric Brunc9437992021-02-12 19:42:55 +01001694 break;
1695 }
Christopher Faulet2558d5a2021-06-24 15:16:48 +02001696
1697 return (currentip_found ? RSLV_UPD_NO : RSLV_UPD_SRVIP_NOT_FOUND);
Emeric Brunc9437992021-02-12 19:42:55 +01001698}
1699
Willy Tarreauca0170b2021-10-14 08:05:25 +02001700/* Turns a domain name label into a string: 3www7haproxy3org into www.haproxy.org
Emeric Brunc9437992021-02-12 19:42:55 +01001701 *
Willy Tarreauca0170b2021-10-14 08:05:25 +02001702 * <dn> contains the input label of <dn_len> bytes long and does not need to be
1703 * null-terminated. <str> must be allocated large enough to contain a full host
1704 * name plus the trailing zero, and the allocated size must be passed in
1705 * <str_len>.
Emeric Brunc9437992021-02-12 19:42:55 +01001706 *
Willy Tarreauca0170b2021-10-14 08:05:25 +02001707 * In case of error, -1 is returned, otherwise, the number of bytes copied in
Emeric Brunc9437992021-02-12 19:42:55 +01001708 * <str> (including the terminating null byte).
1709 */
1710int resolv_dn_label_to_str(const char *dn, int dn_len, char *str, int str_len)
1711{
1712 char *ptr;
1713 int i, sz;
1714
Willy Tarreauca0170b2021-10-14 08:05:25 +02001715 if (str_len < dn_len)
Emeric Brunc9437992021-02-12 19:42:55 +01001716 return -1;
1717
1718 ptr = str;
Willy Tarreauca0170b2021-10-14 08:05:25 +02001719 for (i = 0; i < dn_len; ++i) {
Emeric Brunc9437992021-02-12 19:42:55 +01001720 sz = dn[i];
1721 if (i)
1722 *ptr++ = '.';
1723 memcpy(ptr, dn+i+1, sz);
1724 ptr += sz;
1725 i += sz;
1726 }
1727 *ptr++ = '\0';
1728 return (ptr - str);
1729}
1730
1731/* Turns a string into domain name label: www.haproxy.org into 3www7haproxy3org
1732 *
Willy Tarreauc1c765f2021-10-14 07:49:49 +02001733 * <str> contains the input string that is <str_len> bytes long (trailing zero
1734 * not needed). <dn> buffer must be allocated large enough to contain the
1735 * encoded string and a trailing zero, so it must be at least str_len+2, and
1736 * this allocated buffer size must be passed in <dn_len>.
Emeric Brunc9437992021-02-12 19:42:55 +01001737 *
Willy Tarreauc1c765f2021-10-14 07:49:49 +02001738 * In case of error, -1 is returned, otherwise, the number of bytes copied in
Emeric Brunc9437992021-02-12 19:42:55 +01001739 * <dn> (excluding the terminating null byte).
1740 */
1741int resolv_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len)
1742{
1743 int i, offset;
1744
Willy Tarreauc1c765f2021-10-14 07:49:49 +02001745 if (dn_len < str_len + 2)
Emeric Brunc9437992021-02-12 19:42:55 +01001746 return -1;
1747
1748 /* First byte of dn will be used to store the length of the first
1749 * label */
1750 offset = 0;
1751 for (i = 0; i < str_len; ++i) {
1752 if (str[i] == '.') {
1753 /* 2 or more consecutive dots is invalid */
1754 if (i == offset)
1755 return -1;
1756
1757 /* ignore trailing dot */
Christopher Faulet5c3e6862022-01-28 17:47:57 +01001758 if (i + 1 == str_len)
Emeric Brunc9437992021-02-12 19:42:55 +01001759 break;
Emeric Brunc9437992021-02-12 19:42:55 +01001760
1761 dn[offset] = (i - offset);
1762 offset = i+1;
1763 continue;
1764 }
1765 dn[i+1] = str[i];
1766 }
Willy Tarreauc1c765f2021-10-14 07:49:49 +02001767 dn[offset] = i - offset;
Willy Tarreau68c7b362021-10-15 08:09:25 +02001768 dn[i+1] = '\0';
1769 return i+1;
Emeric Brunc9437992021-02-12 19:42:55 +01001770}
1771
1772/* Validates host name:
1773 * - total size
1774 * - each label size individually
1775 * returns:
1776 * 0 in case of error. If <err> is not NULL, an error message is stored there.
1777 * 1 when no error. <err> is left unaffected.
1778 */
1779int resolv_hostname_validation(const char *string, char **err)
1780{
1781 int i;
1782
1783 if (strlen(string) > DNS_MAX_NAME_SIZE) {
1784 if (err)
1785 *err = DNS_TOO_LONG_FQDN;
1786 return 0;
1787 }
1788
1789 while (*string) {
1790 i = 0;
1791 while (*string && *string != '.' && i < DNS_MAX_LABEL_SIZE) {
1792 if (!(*string == '-' || *string == '_' ||
1793 (*string >= 'a' && *string <= 'z') ||
1794 (*string >= 'A' && *string <= 'Z') ||
1795 (*string >= '0' && *string <= '9'))) {
1796 if (err)
1797 *err = DNS_INVALID_CHARACTER;
1798 return 0;
1799 }
1800 i++;
1801 string++;
1802 }
1803
1804 if (!(*string))
1805 break;
1806
1807 if (*string != '.' && i >= DNS_MAX_LABEL_SIZE) {
1808 if (err)
1809 *err = DNS_LABEL_TOO_LONG;
1810 return 0;
1811 }
1812
1813 string++;
1814 }
1815 return 1;
1816}
1817
1818/* Picks up an available resolution from the different resolution list
1819 * associated to a resolvers section, in this order:
1820 * 1. check in resolutions.curr for the same hostname and query_type
1821 * 2. check in resolutions.wait for the same hostname and query_type
1822 * 3. Get a new resolution from resolution pool
1823 *
1824 * Returns an available resolution, NULL if none found.
1825 */
1826static struct resolv_resolution *resolv_pick_resolution(struct resolvers *resolvers,
1827 char **hostname_dn, int hostname_dn_len,
1828 int query_type)
1829{
1830 struct resolv_resolution *res;
1831
1832 if (!*hostname_dn)
1833 goto from_pool;
1834
1835 /* Search for same hostname and query type in resolutions.curr */
1836 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
1837 if (!res->hostname_dn)
1838 continue;
1839 if ((query_type == res->prefered_query_type) &&
1840 hostname_dn_len == res->hostname_dn_len &&
1841 !resolv_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
1842 return res;
1843 }
1844
1845 /* Search for same hostname and query type in resolutions.wait */
1846 list_for_each_entry(res, &resolvers->resolutions.wait, list) {
1847 if (!res->hostname_dn)
1848 continue;
1849 if ((query_type == res->prefered_query_type) &&
1850 hostname_dn_len == res->hostname_dn_len &&
1851 !resolv_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
1852 return res;
1853 }
1854
1855 from_pool:
1856 /* No resolution could be found, so let's allocate a new one */
Willy Tarreau70490eb2021-03-22 21:08:50 +01001857 res = pool_zalloc(resolv_resolution_pool);
Emeric Brunc9437992021-02-12 19:42:55 +01001858 if (res) {
Willy Tarreau51128f82021-10-19 11:17:33 +02001859 int i;
1860
Emeric Brunc9437992021-02-12 19:42:55 +01001861 res->resolvers = resolvers;
1862 res->uuid = resolution_uuid;
1863 res->status = RSLV_STATUS_NONE;
1864 res->step = RSLV_STEP_NONE;
1865 res->last_valid = now_ms;
1866
1867 LIST_INIT(&res->requesters);
Willy Tarreau51128f82021-10-19 11:17:33 +02001868 LIST_INIT(&res->response.query_list);
Emeric Brunc9437992021-02-12 19:42:55 +01001869 LIST_INIT(&res->response.answer_list);
1870
Willy Tarreau51128f82021-10-19 11:17:33 +02001871 for (i = 0; i < DNS_MAX_QUERY_RECORDS; i++)
1872 LIST_INIT(&res->response_query_records[i].list);
1873
Emeric Brunc9437992021-02-12 19:42:55 +01001874 res->prefered_query_type = query_type;
1875 res->query_type = query_type;
1876 res->hostname_dn = *hostname_dn;
1877 res->hostname_dn_len = hostname_dn_len;
1878
1879 ++resolution_uuid;
1880
1881 /* Move the resolution to the resolvers wait queue */
Willy Tarreau2b718102021-04-21 07:32:39 +02001882 LIST_APPEND(&resolvers->resolutions.wait, &res->list);
Emeric Brunc9437992021-02-12 19:42:55 +01001883 }
1884 return res;
1885}
1886
Willy Tarreauaab75932021-10-19 11:16:11 +02001887/* deletes and frees all answer_items from the resolution's answer_list */
1888static void resolv_purge_resolution_answer_records(struct resolv_resolution *resolution)
Christopher Faulet1dec5c72021-03-10 14:40:39 +01001889{
1890 struct resolv_answer_item *item, *itemback;
1891
1892 list_for_each_entry_safe(item, itemback, &resolution->response.answer_list, list) {
Willy Tarreau8c3c5232021-10-19 22:01:36 +02001893 LIST_DEL_INIT(&item->list);
Christopher Faulet1dec5c72021-03-10 14:40:39 +01001894 pool_free(resolv_answer_item_pool, item->ar_item);
1895 pool_free(resolv_answer_item_pool, item);
1896 }
1897}
1898
Willy Tarreau51128f82021-10-19 11:17:33 +02001899/* deletes all query_items from the resolution's query_list */
1900static void resolv_purge_resolution_query_items(struct resolv_resolution *resolution)
1901{
1902 struct resolv_query_item *item, *itemback;
1903
1904 list_for_each_entry_safe(item, itemback, &resolution->response.query_list, list)
1905 LIST_DEL_INIT(&item->list);
1906}
1907
Emeric Brunc9437992021-02-12 19:42:55 +01001908/* Releases a resolution from its requester(s) and move it back to the pool */
1909static void resolv_free_resolution(struct resolv_resolution *resolution)
1910{
1911 struct resolv_requester *req, *reqback;
Emeric Brunc9437992021-02-12 19:42:55 +01001912
1913 /* clean up configuration */
1914 resolv_reset_resolution(resolution);
1915 resolution->hostname_dn = NULL;
1916 resolution->hostname_dn_len = 0;
1917
1918 list_for_each_entry_safe(req, reqback, &resolution->requesters, list) {
Willy Tarreau8c3c5232021-10-19 22:01:36 +02001919 LIST_DEL_INIT(&req->list);
Emeric Brunc9437992021-02-12 19:42:55 +01001920 req->resolution = NULL;
1921 }
Christopher Faulet1dec5c72021-03-10 14:40:39 +01001922 resolv_purge_resolution_answer_records(resolution);
Willy Tarreau51128f82021-10-19 11:17:33 +02001923 resolv_purge_resolution_query_items(resolution);
1924
Willy Tarreau8c3c5232021-10-19 22:01:36 +02001925 LIST_DEL_INIT(&resolution->list);
Emeric Brunc9437992021-02-12 19:42:55 +01001926 pool_free(resolv_resolution_pool, resolution);
1927}
1928
Willy Tarreau4d7ca912021-10-19 11:59:25 +02001929/* If *<req> is not NULL, returns it, otherwise tries to allocate a requester
1930 * and makes it owned by this obj_type, with the proposed callback and error
1931 * callback. On success, *req is assigned the allocated requester. Returns
1932 * NULL on allocation failure.
1933 */
1934static struct resolv_requester *
1935resolv_get_requester(struct resolv_requester **req, enum obj_type *owner,
1936 int (*cb)(struct resolv_requester *, struct dns_counters *),
1937 int (*err_cb)(struct resolv_requester *, int))
1938{
1939 struct resolv_requester *tmp;
1940
1941 if (*req)
1942 return *req;
1943
1944 tmp = pool_alloc(resolv_requester_pool);
1945 if (!tmp)
1946 goto end;
1947
1948 LIST_INIT(&tmp->list);
1949 tmp->owner = owner;
1950 tmp->resolution = NULL;
1951 tmp->requester_cb = cb;
1952 tmp->requester_error_cb = err_cb;
1953 *req = tmp;
1954 end:
1955 return tmp;
1956}
1957
Emeric Brunc9437992021-02-12 19:42:55 +01001958/* Links a requester (a server or a resolv_srvrq) with a resolution. It returns 0
Christopher Faulet7a3a5362021-11-02 16:25:05 +01001959 * on success, -1 otherwise.
Emeric Brunc9437992021-02-12 19:42:55 +01001960 */
1961int resolv_link_resolution(void *requester, int requester_type, int requester_locked)
1962{
1963 struct resolv_resolution *res = NULL;
1964 struct resolv_requester *req;
1965 struct resolvers *resolvers;
1966 struct server *srv = NULL;
1967 struct resolv_srvrq *srvrq = NULL;
1968 struct stream *stream = NULL;
1969 char **hostname_dn;
1970 int hostname_dn_len, query_type;
1971
Christopher Faulet7a3a5362021-11-02 16:25:05 +01001972 enter_resolver_code();
Emeric Brunc9437992021-02-12 19:42:55 +01001973 switch (requester_type) {
1974 case OBJ_TYPE_SERVER:
1975 srv = (struct server *)requester;
Willy Tarreau4d7ca912021-10-19 11:59:25 +02001976
1977 if (!requester_locked)
1978 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
1979
1980 req = resolv_get_requester(&srv->resolv_requester,
1981 &srv->obj_type,
1982 snr_resolution_cb,
1983 snr_resolution_error_cb);
1984
1985 if (!requester_locked)
1986 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
1987
1988 if (!req)
1989 goto err;
1990
Emeric Brunc9437992021-02-12 19:42:55 +01001991 hostname_dn = &srv->hostname_dn;
1992 hostname_dn_len = srv->hostname_dn_len;
1993 resolvers = srv->resolvers;
1994 query_type = ((srv->resolv_opts.family_prio == AF_INET)
1995 ? DNS_RTYPE_A
1996 : DNS_RTYPE_AAAA);
1997 break;
1998
1999 case OBJ_TYPE_SRVRQ:
2000 srvrq = (struct resolv_srvrq *)requester;
Willy Tarreau4d7ca912021-10-19 11:59:25 +02002001
2002 req = resolv_get_requester(&srvrq->requester,
2003 &srvrq->obj_type,
2004 snr_resolution_cb,
2005 srvrq_resolution_error_cb);
2006 if (!req)
2007 goto err;
2008
Emeric Brunc9437992021-02-12 19:42:55 +01002009 hostname_dn = &srvrq->hostname_dn;
2010 hostname_dn_len = srvrq->hostname_dn_len;
2011 resolvers = srvrq->resolvers;
2012 query_type = DNS_RTYPE_SRV;
2013 break;
2014
2015 case OBJ_TYPE_STREAM:
2016 stream = (struct stream *)requester;
Willy Tarreau4d7ca912021-10-19 11:59:25 +02002017
2018 req = resolv_get_requester(&stream->resolv_ctx.requester,
2019 &stream->obj_type,
2020 act_resolution_cb,
2021 act_resolution_error_cb);
2022 if (!req)
2023 goto err;
2024
Emeric Brunc9437992021-02-12 19:42:55 +01002025 hostname_dn = &stream->resolv_ctx.hostname_dn;
2026 hostname_dn_len = stream->resolv_ctx.hostname_dn_len;
2027 resolvers = stream->resolv_ctx.parent->arg.resolv.resolvers;
2028 query_type = ((stream->resolv_ctx.parent->arg.resolv.opts->family_prio == AF_INET)
2029 ? DNS_RTYPE_A
2030 : DNS_RTYPE_AAAA);
2031 break;
2032 default:
2033 goto err;
2034 }
2035
2036 /* Get a resolution from the resolvers' wait queue or pool */
2037 if ((res = resolv_pick_resolution(resolvers, hostname_dn, hostname_dn_len, query_type)) == NULL)
2038 goto err;
2039
Willy Tarreau4d7ca912021-10-19 11:59:25 +02002040 req->resolution = res;
Emeric Brunc9437992021-02-12 19:42:55 +01002041
Willy Tarreau2b718102021-04-21 07:32:39 +02002042 LIST_APPEND(&res->requesters, &req->list);
Christopher Faulet7a3a5362021-11-02 16:25:05 +01002043 leave_resolver_code();
Emeric Brunc9437992021-02-12 19:42:55 +01002044 return 0;
2045
2046 err:
2047 if (res && LIST_ISEMPTY(&res->requesters))
2048 resolv_free_resolution(res);
Christopher Faulet7a3a5362021-11-02 16:25:05 +01002049 leave_resolver_code();
Emeric Brunc9437992021-02-12 19:42:55 +01002050 return -1;
2051}
2052
Christopher Faulet7a3a5362021-11-02 16:25:05 +01002053/* This function removes all server/srvrq references on answer items. */
Willy Tarreau33360872021-10-20 14:07:31 +02002054void resolv_detach_from_resolution_answer_items(struct resolv_resolution *res, struct resolv_requester *req)
Emeric Brun0c4a8a32021-06-11 10:48:45 +02002055{
2056 struct resolv_answer_item *item, *itemback;
2057 struct server *srv, *srvback;
2058 struct resolv_srvrq *srvrq;
2059
Christopher Faulet7a3a5362021-11-02 16:25:05 +01002060 enter_resolver_code();
Emeric Brun0c4a8a32021-06-11 10:48:45 +02002061 if ((srv = objt_server(req->owner)) != NULL) {
2062 LIST_DEL_INIT(&srv->ip_rec_item);
2063 }
2064 else if ((srvrq = objt_resolv_srvrq(req->owner)) != NULL) {
2065 list_for_each_entry_safe(item, itemback, &res->response.answer_list, list) {
2066 if (item->type == DNS_RTYPE_SRV) {
2067 list_for_each_entry_safe(srv, srvback, &item->attached_servers, srv_rec_item) {
Christopher Faulet5f8ccff2021-06-15 16:08:48 +02002068 if (srv->srvrq == srvrq)
Willy Tarreau20751652021-10-18 16:46:38 +02002069 resolv_srvrq_cleanup_srv(srv);
Emeric Brun0c4a8a32021-06-11 10:48:45 +02002070 }
2071 }
2072 }
2073 }
Christopher Faulet7a3a5362021-11-02 16:25:05 +01002074 leave_resolver_code();
Emeric Brun0c4a8a32021-06-11 10:48:45 +02002075}
2076
Emeric Brunc9437992021-02-12 19:42:55 +01002077/* Removes a requester from a DNS resolution. It takes takes care of all the
2078 * consequences. It also cleans up some parameters from the requester.
2079 */
Willy Tarreau33360872021-10-20 14:07:31 +02002080static void _resolv_unlink_resolution(struct resolv_requester *requester)
Emeric Brunc9437992021-02-12 19:42:55 +01002081{
2082 struct resolv_resolution *res;
2083 struct resolv_requester *req;
2084
2085 /* Nothing to do */
2086 if (!requester || !requester->resolution)
2087 return;
2088 res = requester->resolution;
2089
2090 /* Clean up the requester */
Willy Tarreau8c3c5232021-10-19 22:01:36 +02002091 LIST_DEL_INIT(&requester->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002092 requester->resolution = NULL;
2093
Christopher Faulete7e0e4b2021-10-29 10:38:15 +02002094 /* remove ref from the resolution answer item list to the requester */
2095 resolv_detach_from_resolution_answer_items(res, requester);
2096
Emeric Brunc9437992021-02-12 19:42:55 +01002097 /* We need to find another requester linked on this resolution */
2098 if (!LIST_ISEMPTY(&res->requesters))
2099 req = LIST_NEXT(&res->requesters, struct resolv_requester *, list);
2100 else {
Willy Tarreau20751652021-10-18 16:46:38 +02002101 abort_resolution(res);
Emeric Brunc9437992021-02-12 19:42:55 +01002102 return;
2103 }
2104
2105 /* Move hostname_dn related pointers to the next requester */
2106 switch (obj_type(req->owner)) {
2107 case OBJ_TYPE_SERVER:
2108 res->hostname_dn = __objt_server(req->owner)->hostname_dn;
2109 res->hostname_dn_len = __objt_server(req->owner)->hostname_dn_len;
2110 break;
2111 case OBJ_TYPE_SRVRQ:
2112 res->hostname_dn = __objt_resolv_srvrq(req->owner)->hostname_dn;
2113 res->hostname_dn_len = __objt_resolv_srvrq(req->owner)->hostname_dn_len;
2114 break;
2115 case OBJ_TYPE_STREAM:
2116 res->hostname_dn = __objt_stream(req->owner)->resolv_ctx.hostname_dn;
2117 res->hostname_dn_len = __objt_stream(req->owner)->resolv_ctx.hostname_dn_len;
2118 break;
2119 default:
2120 res->hostname_dn = NULL;
2121 res->hostname_dn_len = 0;
2122 break;
2123 }
2124}
2125
Willy Tarreau20751652021-10-18 16:46:38 +02002126/* The public version of the function above that deals with the death row. */
Willy Tarreau33360872021-10-20 14:07:31 +02002127void resolv_unlink_resolution(struct resolv_requester *requester)
Willy Tarreau20751652021-10-18 16:46:38 +02002128{
Christopher Faulet7a3a5362021-11-02 16:25:05 +01002129 enter_resolver_code();
Willy Tarreau33360872021-10-20 14:07:31 +02002130 _resolv_unlink_resolution(requester);
Christopher Faulet7a3a5362021-11-02 16:25:05 +01002131 leave_resolver_code();
Willy Tarreau20751652021-10-18 16:46:38 +02002132}
2133
Emeric Brunc9437992021-02-12 19:42:55 +01002134/* Called when a network IO is generated on a name server socket for an incoming
2135 * packet. It performs the following actions:
2136 * - check if the packet requires processing (not outdated resolution)
2137 * - ensure the DNS packet received is valid and call requester's callback
2138 * - call requester's error callback if invalid response
2139 * - check the dn_name in the packet against the one sent
2140 */
2141static int resolv_process_responses(struct dns_nameserver *ns)
2142{
2143 struct dns_counters *tmpcounters;
2144 struct resolvers *resolvers;
2145 struct resolv_resolution *res;
2146 struct resolv_query_item *query;
2147 unsigned char buf[DNS_MAX_UDP_MESSAGE + 1];
2148 unsigned char *bufend;
2149 int buflen, dns_resp;
2150 int max_answer_records;
2151 unsigned short query_id;
2152 struct eb32_node *eb;
2153 struct resolv_requester *req;
Emeric Brun43839d02021-06-10 15:25:25 +02002154 int keep_answer_items;
Emeric Brunc9437992021-02-12 19:42:55 +01002155
2156 resolvers = ns->parent;
Christopher Faulet7a3a5362021-11-02 16:25:05 +01002157 enter_resolver_code();
Emeric Brunc9437992021-02-12 19:42:55 +01002158 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
2159
2160 /* process all pending input messages */
2161 while (1) {
2162 /* read message received */
2163 memset(buf, '\0', resolvers->accepted_payload_size + 1);
2164 if ((buflen = dns_recv_nameserver(ns, (void *)buf, sizeof(buf))) <= 0) {
2165 break;
2166 }
2167
2168 /* message too big */
2169 if (buflen > resolvers->accepted_payload_size) {
2170 ns->counters->too_big++;
2171 continue;
2172 }
2173
2174 /* initializing variables */
2175 bufend = buf + buflen; /* pointer to mark the end of the buffer */
2176
2177 /* read the query id from the packet (16 bits) */
2178 if (buf + 2 > bufend) {
2179 ns->counters->invalid++;
2180 continue;
2181 }
2182 query_id = resolv_response_get_query_id(buf);
2183
2184 /* search the query_id in the pending resolution tree */
2185 eb = eb32_lookup(&resolvers->query_ids, query_id);
2186 if (eb == NULL) {
2187 /* unknown query id means an outdated response and can be safely ignored */
2188 ns->counters->outdated++;
2189 continue;
2190 }
2191
2192 /* known query id means a resolution in progress */
2193 res = eb32_entry(eb, struct resolv_resolution, qid);
2194 /* number of responses received */
2195 res->nb_responses++;
2196
2197 max_answer_records = (resolvers->accepted_payload_size - DNS_HEADER_SIZE) / DNS_MIN_RECORD_SIZE;
2198 dns_resp = resolv_validate_dns_response(buf, bufend, res, max_answer_records);
2199
2200 switch (dns_resp) {
2201 case RSLV_RESP_VALID:
2202 break;
2203
2204 case RSLV_RESP_INVALID:
2205 case RSLV_RESP_QUERY_COUNT_ERROR:
2206 case RSLV_RESP_WRONG_NAME:
2207 res->status = RSLV_STATUS_INVALID;
2208 ns->counters->invalid++;
2209 break;
2210
2211 case RSLV_RESP_NX_DOMAIN:
2212 res->status = RSLV_STATUS_NX;
2213 ns->counters->nx++;
2214 break;
2215
2216 case RSLV_RESP_REFUSED:
2217 res->status = RSLV_STATUS_REFUSED;
2218 ns->counters->refused++;
2219 break;
2220
2221 case RSLV_RESP_ANCOUNT_ZERO:
2222 res->status = RSLV_STATUS_OTHER;
2223 ns->counters->any_err++;
2224 break;
2225
2226 case RSLV_RESP_CNAME_ERROR:
2227 res->status = RSLV_STATUS_OTHER;
2228 ns->counters->cname_error++;
2229 break;
2230
2231 case RSLV_RESP_TRUNCATED:
2232 res->status = RSLV_STATUS_OTHER;
2233 ns->counters->truncated++;
2234 break;
2235
2236 case RSLV_RESP_NO_EXPECTED_RECORD:
2237 case RSLV_RESP_ERROR:
2238 case RSLV_RESP_INTERNAL:
2239 res->status = RSLV_STATUS_OTHER;
2240 ns->counters->other++;
2241 break;
2242 }
2243
2244 /* Wait all nameservers response to handle errors */
2245 if (dns_resp != RSLV_RESP_VALID && res->nb_responses < res->nb_queries)
2246 continue;
2247
2248 /* Process error codes */
2249 if (dns_resp != RSLV_RESP_VALID) {
2250 if (res->prefered_query_type != res->query_type) {
2251 /* The fallback on the query type was already performed,
2252 * so check the try counter. If it falls to 0, we can
2253 * report an error. Else, wait the next attempt. */
2254 if (!res->try)
2255 goto report_res_error;
2256 }
2257 else {
2258 /* Fallback from A to AAAA or the opposite and re-send
2259 * the resolution immediately. try counter is not
2260 * decremented. */
2261 if (res->prefered_query_type == DNS_RTYPE_A) {
2262 res->query_type = DNS_RTYPE_AAAA;
2263 resolv_send_query(res);
2264 }
2265 else if (res->prefered_query_type == DNS_RTYPE_AAAA) {
2266 res->query_type = DNS_RTYPE_A;
2267 resolv_send_query(res);
2268 }
2269 }
2270 continue;
2271 }
2272
2273 /* Now let's check the query's dname corresponds to the one we
2274 * sent. We can check only the first query of the list. We send
Willy Tarreau51128f82021-10-19 11:17:33 +02002275 * one query at a time so we get one query in the response.
2276 */
2277 if (!LIST_ISEMPTY(&res->response.query_list)) {
2278 query = LIST_NEXT(&res->response.query_list, struct resolv_query_item *, list);
2279 LIST_DEL_INIT(&query->list);
2280 if (resolv_hostname_cmp(query->name, res->hostname_dn, res->hostname_dn_len) != 0) {
2281 dns_resp = RSLV_RESP_WRONG_NAME;
2282 ns->counters->other++;
2283 goto report_res_error;
2284 }
Emeric Brunc9437992021-02-12 19:42:55 +01002285 }
2286
2287 /* So the resolution succeeded */
2288 res->status = RSLV_STATUS_VALID;
2289 res->last_valid = now_ms;
2290 ns->counters->valid++;
2291 goto report_res_success;
2292
2293 report_res_error:
Emeric Brun43839d02021-06-10 15:25:25 +02002294 keep_answer_items = 0;
Emeric Brunc9437992021-02-12 19:42:55 +01002295 list_for_each_entry(req, &res->requesters, list)
Emeric Brun43839d02021-06-10 15:25:25 +02002296 keep_answer_items |= req->requester_error_cb(req, dns_resp);
2297 if (!keep_answer_items)
2298 resolv_purge_resolution_answer_records(res);
Emeric Brunc9437992021-02-12 19:42:55 +01002299 resolv_reset_resolution(res);
Willy Tarreau8c3c5232021-10-19 22:01:36 +02002300 LIST_DEL_INIT(&res->list);
Willy Tarreau2b718102021-04-21 07:32:39 +02002301 LIST_APPEND(&resolvers->resolutions.wait, &res->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002302 continue;
2303
2304 report_res_success:
2305 /* Only the 1rst requester s managed by the server, others are
2306 * from the cache */
2307 tmpcounters = ns->counters;
2308 list_for_each_entry(req, &res->requesters, list) {
2309 struct server *s = objt_server(req->owner);
2310
2311 if (s)
2312 HA_SPIN_LOCK(SERVER_LOCK, &s->lock);
2313 req->requester_cb(req, tmpcounters);
2314 if (s)
2315 HA_SPIN_UNLOCK(SERVER_LOCK, &s->lock);
2316 tmpcounters = NULL;
2317 }
2318
2319 resolv_reset_resolution(res);
Willy Tarreau8c3c5232021-10-19 22:01:36 +02002320 LIST_DEL_INIT(&res->list);
Willy Tarreau2b718102021-04-21 07:32:39 +02002321 LIST_APPEND(&resolvers->resolutions.wait, &res->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002322 continue;
2323 }
2324 resolv_update_resolvers_timeout(resolvers);
2325 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet7a3a5362021-11-02 16:25:05 +01002326 leave_resolver_code();
Emeric Brunc9437992021-02-12 19:42:55 +01002327 return buflen;
2328}
2329
2330/* Processes DNS resolution. First, it checks the active list to detect expired
2331 * resolutions and retry them if possible. Else a timeout is reported. Then, it
2332 * checks the wait list to trigger new resolutions.
2333 */
Willy Tarreau144f84a2021-03-02 16:09:26 +01002334static struct task *process_resolvers(struct task *t, void *context, unsigned int state)
Emeric Brunc9437992021-02-12 19:42:55 +01002335{
2336 struct resolvers *resolvers = context;
2337 struct resolv_resolution *res, *resback;
2338 int exp;
2339
Christopher Faulet7a3a5362021-11-02 16:25:05 +01002340 enter_resolver_code();
Emeric Brunc9437992021-02-12 19:42:55 +01002341 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
2342
Willy Tarreau20751652021-10-18 16:46:38 +02002343 /* Handle all expired resolutions from the active list. Elements that
2344 * need to be removed will in fact be moved to the death_row. Other
2345 * ones will be handled normally.
2346 */
2347
Willy Tarreau20751652021-10-18 16:46:38 +02002348 res = LIST_NEXT(&resolvers->resolutions.curr, struct resolv_resolution *, list);
2349 while (&res->list != &resolvers->resolutions.curr) {
2350 resback = LIST_NEXT(&res->list, struct resolv_resolution *, list);
2351
Christopher Faulet0efc0992021-03-11 18:09:53 +01002352 if (LIST_ISEMPTY(&res->requesters)) {
Willy Tarreau20751652021-10-18 16:46:38 +02002353 abort_resolution(res);
2354 res = resback;
Christopher Faulet0efc0992021-03-11 18:09:53 +01002355 continue;
2356 }
2357
Emeric Brunc9437992021-02-12 19:42:55 +01002358 /* When we find the first resolution in the future, then we can
2359 * stop here */
2360 exp = tick_add(res->last_query, resolvers->timeout.retry);
2361 if (!tick_is_expired(exp, now_ms))
2362 break;
2363
2364 /* If current resolution has been tried too many times and
2365 * finishes in timeout we update its status and remove it from
2366 * the list */
2367 if (!res->try) {
2368 struct resolv_requester *req;
Emeric Brun43839d02021-06-10 15:25:25 +02002369 int keep_answer_items = 0;
Emeric Brunc9437992021-02-12 19:42:55 +01002370
2371 /* Notify the result to the requesters */
2372 if (!res->nb_responses)
2373 res->status = RSLV_STATUS_TIMEOUT;
2374 list_for_each_entry(req, &res->requesters, list)
Emeric Brun43839d02021-06-10 15:25:25 +02002375 keep_answer_items |= req->requester_error_cb(req, res->status);
2376 if (!keep_answer_items)
2377 resolv_purge_resolution_answer_records(res);
Emeric Brunc9437992021-02-12 19:42:55 +01002378
2379 /* Clean up resolution info and remove it from the
2380 * current list */
2381 resolv_reset_resolution(res);
Willy Tarreau20751652021-10-18 16:46:38 +02002382
2383 /* subsequent entries might have been deleted here */
2384 resback = LIST_NEXT(&res->list, struct resolv_resolution *, list);
Willy Tarreau8c3c5232021-10-19 22:01:36 +02002385 LIST_DEL_INIT(&res->list);
Willy Tarreau2b718102021-04-21 07:32:39 +02002386 LIST_APPEND(&resolvers->resolutions.wait, &res->list);
Willy Tarreau20751652021-10-18 16:46:38 +02002387 res = resback;
Emeric Brunc9437992021-02-12 19:42:55 +01002388 }
2389 else {
2390 /* Otherwise resend the DNS query and requeue the resolution */
2391 if (!res->nb_responses || res->prefered_query_type != res->query_type) {
2392 /* No response received (a real timeout) or fallback already done */
2393 res->query_type = res->prefered_query_type;
2394 res->try--;
2395 }
2396 else {
2397 /* Fallback from A to AAAA or the opposite and re-send
2398 * the resolution immediately. try counter is not
2399 * decremented. */
2400 if (res->prefered_query_type == DNS_RTYPE_A)
2401 res->query_type = DNS_RTYPE_AAAA;
2402 else if (res->prefered_query_type == DNS_RTYPE_AAAA)
2403 res->query_type = DNS_RTYPE_A;
2404 else
2405 res->try--;
2406 }
2407 resolv_send_query(res);
Willy Tarreau20751652021-10-18 16:46:38 +02002408 resback = LIST_NEXT(&res->list, struct resolv_resolution *, list);
2409 res = resback;
Emeric Brunc9437992021-02-12 19:42:55 +01002410 }
2411 }
2412
2413 /* Handle all resolutions in the wait list */
2414 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
Christopher Faulet0efc0992021-03-11 18:09:53 +01002415 if (LIST_ISEMPTY(&res->requesters)) {
Willy Tarreau20751652021-10-18 16:46:38 +02002416 abort_resolution(res);
Christopher Faulet0efc0992021-03-11 18:09:53 +01002417 continue;
2418 }
2419
Emeric Brunc9437992021-02-12 19:42:55 +01002420 exp = tick_add(res->last_resolution, resolv_resolution_timeout(res));
2421 if (tick_isset(res->last_resolution) && !tick_is_expired(exp, now_ms))
2422 continue;
2423
2424 if (resolv_run_resolution(res) != 1) {
2425 res->last_resolution = now_ms;
Willy Tarreau8c3c5232021-10-19 22:01:36 +02002426 LIST_DEL_INIT(&res->list);
Willy Tarreau2b718102021-04-21 07:32:39 +02002427 LIST_APPEND(&resolvers->resolutions.wait, &res->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002428 }
2429 }
Emeric Brunc9437992021-02-12 19:42:55 +01002430 resolv_update_resolvers_timeout(resolvers);
2431 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet7a3a5362021-11-02 16:25:05 +01002432
2433 /* now we can purge all queued deletions */
2434 leave_resolver_code();
Emeric Brunc9437992021-02-12 19:42:55 +01002435 return t;
2436}
2437
2438/* Release memory allocated by DNS */
2439static void resolvers_deinit(void)
2440{
2441 struct resolvers *resolvers, *resolversback;
2442 struct dns_nameserver *ns, *nsback;
2443 struct resolv_resolution *res, *resback;
2444 struct resolv_requester *req, *reqback;
2445 struct resolv_srvrq *srvrq, *srvrqback;
2446
2447 list_for_each_entry_safe(resolvers, resolversback, &sec_resolvers, list) {
2448 list_for_each_entry_safe(ns, nsback, &resolvers->nameservers, list) {
2449 free(ns->id);
2450 free((char *)ns->conf.file);
2451 if (ns->dgram) {
2452 if (ns->dgram->conn.t.sock.fd != -1) {
2453 fd_delete(ns->dgram->conn.t.sock.fd);
2454 close(ns->dgram->conn.t.sock.fd);
2455 }
2456 if (ns->dgram->ring_req)
2457 ring_free(ns->dgram->ring_req);
2458 free(ns->dgram);
2459 }
Emeric Brun56fc5d92021-02-12 20:05:45 +01002460 if (ns->stream) {
2461 if (ns->stream->ring_req)
2462 ring_free(ns->stream->ring_req);
2463 if (ns->stream->task_req)
2464 task_destroy(ns->stream->task_req);
2465 if (ns->stream->task_rsp)
2466 task_destroy(ns->stream->task_rsp);
2467 free(ns->stream);
2468 }
Willy Tarreau8c3c5232021-10-19 22:01:36 +02002469 LIST_DEL_INIT(&ns->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002470 EXTRA_COUNTERS_FREE(ns->extra_counters);
2471 free(ns);
2472 }
2473
2474 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
2475 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
Willy Tarreau8c3c5232021-10-19 22:01:36 +02002476 LIST_DEL_INIT(&req->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002477 pool_free(resolv_requester_pool, req);
2478 }
Christopher Faulet53df5172022-05-24 18:10:42 +02002479 resolv_free_resolution(res);
Emeric Brunc9437992021-02-12 19:42:55 +01002480 }
2481
2482 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
2483 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
Willy Tarreau8c3c5232021-10-19 22:01:36 +02002484 LIST_DEL_INIT(&req->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002485 pool_free(resolv_requester_pool, req);
2486 }
Christopher Faulet53df5172022-05-24 18:10:42 +02002487 resolv_free_resolution(res);
Emeric Brunc9437992021-02-12 19:42:55 +01002488 }
2489
Tim Duesterhus7c718222022-04-26 23:28:47 +02002490 free_proxy(resolvers->px);
Emeric Brunc9437992021-02-12 19:42:55 +01002491 free(resolvers->id);
2492 free((char *)resolvers->conf.file);
2493 task_destroy(resolvers->t);
Willy Tarreau8c3c5232021-10-19 22:01:36 +02002494 LIST_DEL_INIT(&resolvers->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002495 free(resolvers);
2496 }
2497
2498 list_for_each_entry_safe(srvrq, srvrqback, &resolv_srvrq_list, list) {
2499 free(srvrq->name);
2500 free(srvrq->hostname_dn);
Willy Tarreau8c3c5232021-10-19 22:01:36 +02002501 LIST_DEL_INIT(&srvrq->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002502 free(srvrq);
2503 }
2504}
2505
2506/* Finalizes the DNS configuration by allocating required resources and checking
2507 * live parameters.
William Lallemand15bdf582022-08-24 09:58:31 +02002508 * Returns 0 on success, 1 on error.
Emeric Brunc9437992021-02-12 19:42:55 +01002509 */
2510static int resolvers_finalize_config(void)
2511{
2512 struct resolvers *resolvers;
2513 struct proxy *px;
2514 int err_code = 0;
2515
Christopher Faulet7a3a5362021-11-02 16:25:05 +01002516 enter_resolver_code();
Willy Tarreau20751652021-10-18 16:46:38 +02002517
Emeric Brunc9437992021-02-12 19:42:55 +01002518 /* allocate pool of resolution per resolvers */
2519 list_for_each_entry(resolvers, &sec_resolvers, list) {
2520 struct dns_nameserver *ns;
2521 struct task *t;
2522
2523 /* Check if we can create the socket with nameservers info */
2524 list_for_each_entry(ns, &resolvers->nameservers, list) {
2525 int fd;
2526
2527 if (ns->dgram) {
2528 /* Check nameserver info */
2529 if ((fd = socket(ns->dgram->conn.addr.to.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
2530 ha_alert("config : resolvers '%s': can't create socket for nameserver '%s'.\n",
2531 resolvers->id, ns->id);
2532 err_code |= (ERR_ALERT|ERR_ABORT);
2533 continue;
2534 }
2535 if (connect(fd, (struct sockaddr*)&ns->dgram->conn.addr.to, get_addr_len(&ns->dgram->conn.addr.to)) == -1) {
2536 ha_alert("config : resolvers '%s': can't connect socket for nameserver '%s'.\n",
2537 resolvers->id, ns->id);
2538 close(fd);
2539 err_code |= (ERR_ALERT|ERR_ABORT);
2540 continue;
2541 }
2542 close(fd);
2543 }
2544 }
2545
2546 /* Create the task associated to the resolvers section */
2547 if ((t = task_new(MAX_THREADS_MASK)) == NULL) {
2548 ha_alert("config : resolvers '%s' : out of memory.\n", resolvers->id);
2549 err_code |= (ERR_ALERT|ERR_ABORT);
2550 goto err;
2551 }
2552
2553 /* Update task's parameters */
2554 t->process = process_resolvers;
2555 t->context = resolvers;
2556 resolvers->t = t;
2557 task_wakeup(t, TASK_WOKEN_INIT);
2558 }
2559
2560 for (px = proxies_list; px; px = px->next) {
2561 struct server *srv;
2562
Willy Tarreau2da308e2022-06-10 11:11:44 +02002563 if (px->disabled) {
2564 /* must not run and will not work anyway since
2565 * nothing in the proxy is initialized.
2566 */
2567 continue;
2568 }
2569
Emeric Brunc9437992021-02-12 19:42:55 +01002570 for (srv = px->srv; srv; srv = srv->next) {
2571 struct resolvers *resolvers;
2572
2573 if (!srv->resolvers_id)
2574 continue;
2575
2576 if ((resolvers = find_resolvers_by_id(srv->resolvers_id)) == NULL) {
2577 ha_alert("config : %s '%s', server '%s': unable to find required resolvers '%s'\n",
2578 proxy_type_str(px), px->id, srv->id, srv->resolvers_id);
2579 err_code |= (ERR_ALERT|ERR_ABORT);
2580 continue;
2581 }
2582 srv->resolvers = resolvers;
Christopher Faulet2c0f5272021-06-15 16:17:17 +02002583 srv->srvrq_check = NULL;
2584 if (srv->srvrq) {
2585 if (!srv->srvrq->resolvers) {
2586 srv->srvrq->resolvers = srv->resolvers;
2587 if (resolv_link_resolution(srv->srvrq, OBJ_TYPE_SRVRQ, 0) == -1) {
2588 ha_alert("config : %s '%s' : unable to set DNS resolution for server '%s'.\n",
2589 proxy_type_str(px), px->id, srv->id);
2590 err_code |= (ERR_ALERT|ERR_ABORT);
2591 continue;
2592 }
2593 }
Emeric Brunc9437992021-02-12 19:42:55 +01002594
Christopher Faulet2c0f5272021-06-15 16:17:17 +02002595 srv->srvrq_check = task_new(MAX_THREADS_MASK);
2596 if (!srv->srvrq_check) {
2597 ha_alert("config: %s '%s' : unable to create SRVRQ task for server '%s'.\n",
Emeric Brunc9437992021-02-12 19:42:55 +01002598 proxy_type_str(px), px->id, srv->id);
2599 err_code |= (ERR_ALERT|ERR_ABORT);
Christopher Faulet2c0f5272021-06-15 16:17:17 +02002600 goto err;
Emeric Brunc9437992021-02-12 19:42:55 +01002601 }
Christopher Faulet2c0f5272021-06-15 16:17:17 +02002602 srv->srvrq_check->process = resolv_srvrq_expire_task;
2603 srv->srvrq_check->context = srv;
2604 srv->srvrq_check->expire = TICK_ETERNITY;
Emeric Brunc9437992021-02-12 19:42:55 +01002605 }
Christopher Faulet2c0f5272021-06-15 16:17:17 +02002606 else if (resolv_link_resolution(srv, OBJ_TYPE_SERVER, 0) == -1) {
Emeric Brunc9437992021-02-12 19:42:55 +01002607 ha_alert("config : %s '%s', unable to set DNS resolution for server '%s'.\n",
2608 proxy_type_str(px), px->id, srv->id);
2609 err_code |= (ERR_ALERT|ERR_ABORT);
2610 continue;
2611 }
2612 }
2613 }
2614
2615 if (err_code & (ERR_ALERT|ERR_ABORT))
2616 goto err;
2617
Christopher Faulet7a3a5362021-11-02 16:25:05 +01002618 leave_resolver_code();
William Lallemand15bdf582022-08-24 09:58:31 +02002619 return 0;
Emeric Brunc9437992021-02-12 19:42:55 +01002620 err:
Christopher Faulet7a3a5362021-11-02 16:25:05 +01002621 leave_resolver_code();
Emeric Brunc9437992021-02-12 19:42:55 +01002622 resolvers_deinit();
William Lallemand15bdf582022-08-24 09:58:31 +02002623 return 1;
Emeric Brunc9437992021-02-12 19:42:55 +01002624
2625}
2626
2627static int stats_dump_resolv_to_buffer(struct stream_interface *si,
2628 struct dns_nameserver *ns,
2629 struct field *stats, size_t stats_count,
2630 struct list *stat_modules)
2631{
2632 struct appctx *appctx = __objt_appctx(si->end);
2633 struct channel *rep = si_ic(si);
2634 struct stats_module *mod;
2635 size_t idx = 0;
2636
2637 memset(stats, 0, sizeof(struct field) * stats_count);
2638
2639 list_for_each_entry(mod, stat_modules, list) {
2640 struct counters_node *counters = EXTRA_COUNTERS_GET(ns->extra_counters, mod);
2641
2642 mod->fill_stats(counters, stats + idx);
2643 idx += mod->stats_count;
2644 }
2645
2646 if (!stats_dump_one_line(stats, idx, appctx))
2647 return 0;
2648
2649 if (!stats_putchk(rep, NULL, &trash))
2650 goto full;
2651
2652 return 1;
2653
2654 full:
2655 si_rx_room_rdy(si);
2656 return 0;
2657}
2658
2659/* Uses <appctx.ctx.stats.obj1> as a pointer to the current resolver and <obj2>
2660 * as a pointer to the current nameserver.
2661 */
2662int stats_dump_resolvers(struct stream_interface *si,
2663 struct field *stats, size_t stats_count,
2664 struct list *stat_modules)
2665{
2666 struct appctx *appctx = __objt_appctx(si->end);
2667 struct channel *rep = si_ic(si);
2668 struct resolvers *resolver = appctx->ctx.stats.obj1;
2669 struct dns_nameserver *ns = appctx->ctx.stats.obj2;
2670
2671 if (!resolver)
2672 resolver = LIST_NEXT(&sec_resolvers, struct resolvers *, list);
2673
2674 /* dump resolvers */
2675 list_for_each_entry_from(resolver, &sec_resolvers, list) {
2676 appctx->ctx.stats.obj1 = resolver;
2677
2678 ns = appctx->ctx.stats.obj2 ?
2679 appctx->ctx.stats.obj2 :
2680 LIST_NEXT(&resolver->nameservers, struct dns_nameserver *, list);
2681
2682 list_for_each_entry_from(ns, &resolver->nameservers, list) {
2683 appctx->ctx.stats.obj2 = ns;
2684
2685 if (buffer_almost_full(&rep->buf))
2686 goto full;
2687
2688 if (!stats_dump_resolv_to_buffer(si, ns,
2689 stats, stats_count,
2690 stat_modules)) {
2691 return 0;
2692 }
2693 }
2694
2695 appctx->ctx.stats.obj2 = NULL;
2696 }
2697
2698 return 1;
2699
2700 full:
2701 si_rx_room_blk(si);
2702 return 0;
2703}
2704
2705void resolv_stats_clear_counters(int clrall, struct list *stat_modules)
2706{
2707 struct resolvers *resolvers;
2708 struct dns_nameserver *ns;
2709 struct stats_module *mod;
2710 void *counters;
2711
2712 list_for_each_entry(mod, stat_modules, list) {
2713 if (!mod->clearable && !clrall)
2714 continue;
2715
2716 list_for_each_entry(resolvers, &sec_resolvers, list) {
2717 list_for_each_entry(ns, &resolvers->nameservers, list) {
2718 counters = EXTRA_COUNTERS_GET(ns->extra_counters, mod);
2719 memcpy(counters, mod->counters, mod->counters_size);
2720 }
2721 }
2722 }
2723
2724}
2725
2726int resolv_allocate_counters(struct list *stat_modules)
2727{
2728 struct stats_module *mod;
2729 struct resolvers *resolvers;
2730 struct dns_nameserver *ns;
2731
2732 list_for_each_entry(resolvers, &sec_resolvers, list) {
2733 list_for_each_entry(ns, &resolvers->nameservers, list) {
2734 EXTRA_COUNTERS_REGISTER(&ns->extra_counters, COUNTERS_DNS,
2735 alloc_failed);
2736
2737 list_for_each_entry(mod, stat_modules, list) {
2738 EXTRA_COUNTERS_ADD(mod,
2739 ns->extra_counters,
2740 mod->counters,
2741 mod->counters_size);
2742 }
2743
2744 EXTRA_COUNTERS_ALLOC(ns->extra_counters, alloc_failed);
2745
2746 list_for_each_entry(mod, stat_modules, list) {
2747 memcpy(ns->extra_counters->data + mod->counters_off[ns->extra_counters->type],
2748 mod->counters, mod->counters_size);
2749
2750 /* Store the ns counters pointer */
2751 if (strcmp(mod->name, "dns") == 0) {
2752 ns->counters = (struct dns_counters *)ns->extra_counters->data + mod->counters_off[COUNTERS_DNS];
2753 ns->counters->id = ns->id;
2754 ns->counters->pid = resolvers->id;
2755 }
2756 }
2757 }
2758 }
2759
2760 return 1;
2761
2762alloc_failed:
2763 return 0;
2764}
2765
2766/* if an arg is found, it sets the resolvers section pointer into cli.p0 */
2767static int cli_parse_stat_resolvers(char **args, char *payload, struct appctx *appctx, void *private)
2768{
2769 struct resolvers *presolvers;
2770
2771 if (*args[2]) {
2772 list_for_each_entry(presolvers, &sec_resolvers, list) {
2773 if (strcmp(presolvers->id, args[2]) == 0) {
2774 appctx->ctx.cli.p0 = presolvers;
2775 break;
2776 }
2777 }
2778 if (appctx->ctx.cli.p0 == NULL)
2779 return cli_err(appctx, "Can't find that resolvers section\n");
2780 }
2781 return 0;
2782}
2783
2784/* Dumps counters from all resolvers section and associated name servers. It
2785 * returns 0 if the output buffer is full and it needs to be called again,
2786 * otherwise non-zero. It may limit itself to the resolver pointed to by
Willy Tarreau5c556222022-05-05 16:00:45 +02002787 * <cli.p0> if it's not null, and takes the current resolver section from p1
2788 * and the current resolver from p2.
Emeric Brunc9437992021-02-12 19:42:55 +01002789 */
2790static int cli_io_handler_dump_resolvers_to_buffer(struct appctx *appctx)
2791{
2792 struct stream_interface *si = appctx->owner;
Willy Tarreau5c556222022-05-05 16:00:45 +02002793 struct resolvers *resolvers = appctx->ctx.cli.p1;
Emeric Brunc9437992021-02-12 19:42:55 +01002794 struct dns_nameserver *ns;
2795
2796 chunk_reset(&trash);
2797
2798 switch (appctx->st2) {
2799 case STAT_ST_INIT:
2800 appctx->st2 = STAT_ST_LIST; /* let's start producing data */
2801 /* fall through */
2802
2803 case STAT_ST_LIST:
2804 if (LIST_ISEMPTY(&sec_resolvers)) {
Willy Tarreau5c556222022-05-05 16:00:45 +02002805 if (ci_putstr(si_ic(si), "No resolvers found\n") == -1)
2806 goto full;
Emeric Brunc9437992021-02-12 19:42:55 +01002807 }
2808 else {
Willy Tarreau5c556222022-05-05 16:00:45 +02002809 if (!resolvers)
2810 resolvers = LIST_ELEM(sec_resolvers.n, typeof(resolvers), list);
2811
2812 list_for_each_entry_from(resolvers, &sec_resolvers, list) {
Emeric Brunc9437992021-02-12 19:42:55 +01002813 if (appctx->ctx.cli.p0 != NULL && appctx->ctx.cli.p0 != resolvers)
2814 continue;
2815
Willy Tarreau5c556222022-05-05 16:00:45 +02002816 appctx->ctx.cli.p1 = resolvers;
2817 ns = appctx->ctx.cli.p2;
2818
2819 if (!ns) {
2820 chunk_printf(&trash, "Resolvers section %s\n", resolvers->id);
2821 if (ci_putchk(si_ic(si), &trash) == -1)
2822 goto full;
2823
2824 ns = LIST_ELEM(resolvers->nameservers.n, typeof(ns), list);
2825 appctx->ctx.cli.p2 = ns;
2826 }
2827
2828 list_for_each_entry_from(ns, &resolvers->nameservers, list) {
2829 chunk_reset(&trash);
Emeric Brunc9437992021-02-12 19:42:55 +01002830 chunk_appendf(&trash, " nameserver %s:\n", ns->id);
2831 chunk_appendf(&trash, " sent: %lld\n", ns->counters->sent);
2832 chunk_appendf(&trash, " snd_error: %lld\n", ns->counters->snd_error);
2833 chunk_appendf(&trash, " valid: %lld\n", ns->counters->valid);
2834 chunk_appendf(&trash, " update: %lld\n", ns->counters->update);
2835 chunk_appendf(&trash, " cname: %lld\n", ns->counters->cname);
2836 chunk_appendf(&trash, " cname_error: %lld\n", ns->counters->cname_error);
2837 chunk_appendf(&trash, " any_err: %lld\n", ns->counters->any_err);
2838 chunk_appendf(&trash, " nx: %lld\n", ns->counters->nx);
2839 chunk_appendf(&trash, " timeout: %lld\n", ns->counters->timeout);
2840 chunk_appendf(&trash, " refused: %lld\n", ns->counters->refused);
2841 chunk_appendf(&trash, " other: %lld\n", ns->counters->other);
2842 chunk_appendf(&trash, " invalid: %lld\n", ns->counters->invalid);
2843 chunk_appendf(&trash, " too_big: %lld\n", ns->counters->too_big);
2844 chunk_appendf(&trash, " truncated: %lld\n", ns->counters->truncated);
2845 chunk_appendf(&trash, " outdated: %lld\n", ns->counters->outdated);
Willy Tarreau5c556222022-05-05 16:00:45 +02002846 if (ci_putchk(si_ic(si), &trash) == -1)
2847 goto full;
2848 appctx->ctx.cli.p2 = ns;
Emeric Brunc9437992021-02-12 19:42:55 +01002849 }
Willy Tarreau5c556222022-05-05 16:00:45 +02002850
2851 appctx->ctx.cli.p2 = NULL;
2852
2853 /* was this the only section to dump ? */
2854 if (appctx->ctx.cli.p0)
2855 break;
Emeric Brunc9437992021-02-12 19:42:55 +01002856 }
2857 }
2858
Emeric Brunc9437992021-02-12 19:42:55 +01002859 /* fall through */
2860
2861 default:
2862 appctx->st2 = STAT_ST_FIN;
2863 return 1;
2864 }
Willy Tarreau5c556222022-05-05 16:00:45 +02002865 full:
2866 /* the output buffer is full, retry later */
2867 si_rx_room_blk(si);
2868 return 0;
Emeric Brunc9437992021-02-12 19:42:55 +01002869}
2870
2871/* register cli keywords */
2872static struct cli_kw_list cli_kws = {{ }, {
Willy Tarreaub205bfd2021-05-07 11:38:37 +02002873 { { "show", "resolvers", NULL }, "show resolvers [id] : dumps counters from all resolvers section and associated name servers",
Emeric Brunc9437992021-02-12 19:42:55 +01002874 cli_parse_stat_resolvers, cli_io_handler_dump_resolvers_to_buffer },
2875 {{},}
2876 }
2877};
2878
2879INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
2880
2881/*
2882 * Prepare <rule> for hostname resolution.
2883 * Returns -1 in case of any allocation failure, 0 if not.
2884 * On error, a global failure counter is also incremented.
2885 */
Willy Tarreaua13a6102021-10-14 08:11:48 +02002886static int action_prepare_for_resolution(struct stream *stream, const char *hostname, int hostname_len)
Emeric Brunc9437992021-02-12 19:42:55 +01002887{
2888 char *hostname_dn;
Willy Tarreaua13a6102021-10-14 08:11:48 +02002889 int hostname_dn_len;
Emeric Brunc9437992021-02-12 19:42:55 +01002890 struct buffer *tmp = get_trash_chunk();
2891
2892 if (!hostname)
2893 return 0;
2894
Emeric Brunc9437992021-02-12 19:42:55 +01002895 hostname_dn = tmp->area;
Willy Tarreauc1c765f2021-10-14 07:49:49 +02002896 hostname_dn_len = resolv_str_to_dn_label(hostname, hostname_len,
Emeric Brunc9437992021-02-12 19:42:55 +01002897 hostname_dn, tmp->size);
2898 if (hostname_dn_len == -1)
2899 goto err;
2900
2901
2902 stream->resolv_ctx.hostname_dn = strdup(hostname_dn);
2903 stream->resolv_ctx.hostname_dn_len = hostname_dn_len;
2904 if (!stream->resolv_ctx.hostname_dn)
2905 goto err;
2906
2907 return 0;
2908
2909 err:
Willy Tarreau61cfdf42021-02-20 10:46:51 +01002910 ha_free(&stream->resolv_ctx.hostname_dn);
Emeric Brunc9437992021-02-12 19:42:55 +01002911 resolv_failed_resolutions += 1;
2912 return -1;
2913}
2914
2915
2916/*
2917 * Execute the "do-resolution" action. May be called from {tcp,http}request.
2918 */
2919enum act_return resolv_action_do_resolve(struct act_rule *rule, struct proxy *px,
2920 struct session *sess, struct stream *s, int flags)
2921{
2922 struct resolv_resolution *resolution;
2923 struct sample *smp;
Emeric Brunc9437992021-02-12 19:42:55 +01002924 struct resolv_requester *req;
2925 struct resolvers *resolvers;
2926 struct resolv_resolution *res;
2927 int exp, locked = 0;
2928 enum act_return ret = ACT_RET_CONT;
2929
2930 resolvers = rule->arg.resolv.resolvers;
2931
Christopher Faulet7a3a5362021-11-02 16:25:05 +01002932 enter_resolver_code();
Willy Tarreau20751652021-10-18 16:46:38 +02002933
Emeric Brunc9437992021-02-12 19:42:55 +01002934 /* we have a response to our DNS resolution */
2935 use_cache:
2936 if (s->resolv_ctx.requester && s->resolv_ctx.requester->resolution != NULL) {
2937 resolution = s->resolv_ctx.requester->resolution;
2938 if (!locked) {
2939 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
2940 locked = 1;
2941 }
2942
2943 if (resolution->step == RSLV_STEP_RUNNING)
2944 goto yield;
2945 if (resolution->step == RSLV_STEP_NONE) {
2946 /* We update the variable only if we have a valid response. */
2947 if (resolution->status == RSLV_STATUS_VALID) {
2948 struct sample smp;
2949 short ip_sin_family = 0;
2950 void *ip = NULL;
2951
2952 resolv_get_ip_from_response(&resolution->response, rule->arg.resolv.opts, NULL,
2953 0, &ip, &ip_sin_family, NULL);
2954
2955 switch (ip_sin_family) {
2956 case AF_INET:
2957 smp.data.type = SMP_T_IPV4;
2958 memcpy(&smp.data.u.ipv4, ip, 4);
2959 break;
2960 case AF_INET6:
2961 smp.data.type = SMP_T_IPV6;
2962 memcpy(&smp.data.u.ipv6, ip, 16);
2963 break;
2964 default:
2965 ip = NULL;
2966 }
2967
2968 if (ip) {
2969 smp.px = px;
2970 smp.sess = sess;
2971 smp.strm = s;
2972
2973 vars_set_by_name(rule->arg.resolv.varname, strlen(rule->arg.resolv.varname), &smp);
2974 }
2975 }
2976 }
2977
2978 goto release_requester;
2979 }
2980
2981 /* need to configure and start a new DNS resolution */
2982 smp = sample_fetch_as_type(px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.resolv.expr, SMP_T_STR);
2983 if (smp == NULL)
2984 goto end;
2985
Willy Tarreaua13a6102021-10-14 08:11:48 +02002986 if (action_prepare_for_resolution(s, smp->data.u.str.area, smp->data.u.str.data) == -1)
Emeric Brunc9437992021-02-12 19:42:55 +01002987 goto end; /* on error, ignore the action */
2988
2989 s->resolv_ctx.parent = rule;
2990
2991 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
2992 locked = 1;
2993
2994 resolv_link_resolution(s, OBJ_TYPE_STREAM, 0);
2995
2996 /* Check if there is a fresh enough response in the cache of our associated resolution */
2997 req = s->resolv_ctx.requester;
2998 if (!req || !req->resolution)
2999 goto release_requester; /* on error, ignore the action */
3000 res = req->resolution;
3001
3002 exp = tick_add(res->last_resolution, resolvers->hold.valid);
3003 if (resolvers->t && res->status == RSLV_STATUS_VALID && tick_isset(res->last_resolution)
3004 && !tick_is_expired(exp, now_ms)) {
3005 goto use_cache;
3006 }
3007
3008 resolv_trigger_resolution(s->resolv_ctx.requester);
3009
3010 yield:
3011 if (flags & ACT_OPT_FINAL)
3012 goto release_requester;
3013 ret = ACT_RET_YIELD;
3014
3015 end:
Christopher Faulet7a3a5362021-11-02 16:25:05 +01003016 leave_resolver_code();
Emeric Brunc9437992021-02-12 19:42:55 +01003017 if (locked)
3018 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
3019 return ret;
3020
3021 release_requester:
Willy Tarreau61cfdf42021-02-20 10:46:51 +01003022 ha_free(&s->resolv_ctx.hostname_dn);
Emeric Brunc9437992021-02-12 19:42:55 +01003023 s->resolv_ctx.hostname_dn_len = 0;
3024 if (s->resolv_ctx.requester) {
Willy Tarreau33360872021-10-20 14:07:31 +02003025 _resolv_unlink_resolution(s->resolv_ctx.requester);
Emeric Brunc9437992021-02-12 19:42:55 +01003026 pool_free(resolv_requester_pool, s->resolv_ctx.requester);
3027 s->resolv_ctx.requester = NULL;
3028 }
3029 goto end;
3030}
3031
3032static void release_resolv_action(struct act_rule *rule)
3033{
3034 release_sample_expr(rule->arg.resolv.expr);
3035 free(rule->arg.resolv.varname);
3036 free(rule->arg.resolv.resolvers_id);
3037 free(rule->arg.resolv.opts);
3038}
3039
3040
3041/* parse "do-resolve" action
3042 * This action takes the following arguments:
3043 * do-resolve(<varName>,<resolversSectionName>,<resolvePrefer>) <expr>
3044 *
3045 * - <varName> is the variable name where the result of the DNS resolution will be stored
3046 * (mandatory)
3047 * - <resolversSectionName> is the name of the resolvers section to use to perform the resolution
3048 * (mandatory)
3049 * - <resolvePrefer> can be either 'ipv4' or 'ipv6' and is the IP family we would like to resolve first
3050 * (optional), defaults to ipv6
3051 * - <expr> is an HAProxy expression used to fetch the name to be resolved
3052 */
3053enum act_parse_ret resolv_parse_do_resolve(const char **args, int *orig_arg, struct proxy *px, struct act_rule *rule, char **err)
3054{
3055 int cur_arg;
3056 struct sample_expr *expr;
3057 unsigned int where;
3058 const char *beg, *end;
3059
3060 /* orig_arg points to the first argument, but we need to analyse the command itself first */
3061 cur_arg = *orig_arg - 1;
3062
3063 /* locate varName, which is mandatory */
3064 beg = strchr(args[cur_arg], '(');
3065 if (beg == NULL)
3066 goto do_resolve_parse_error;
3067 beg = beg + 1; /* beg should points to the first character after opening parenthesis '(' */
3068 end = strchr(beg, ',');
3069 if (end == NULL)
3070 goto do_resolve_parse_error;
3071 rule->arg.resolv.varname = my_strndup(beg, end - beg);
3072 if (rule->arg.resolv.varname == NULL)
3073 goto do_resolve_parse_error;
3074
3075
3076 /* locate resolversSectionName, which is mandatory.
3077 * Since next parameters are optional, the delimiter may be comma ','
3078 * or closing parenthesis ')'
3079 */
3080 beg = end + 1;
3081 end = strchr(beg, ',');
3082 if (end == NULL)
3083 end = strchr(beg, ')');
3084 if (end == NULL)
3085 goto do_resolve_parse_error;
3086 rule->arg.resolv.resolvers_id = my_strndup(beg, end - beg);
3087 if (rule->arg.resolv.resolvers_id == NULL)
3088 goto do_resolve_parse_error;
3089
3090
3091 rule->arg.resolv.opts = calloc(1, sizeof(*rule->arg.resolv.opts));
3092 if (rule->arg.resolv.opts == NULL)
3093 goto do_resolve_parse_error;
3094
3095 /* Default priority is ipv6 */
3096 rule->arg.resolv.opts->family_prio = AF_INET6;
3097
3098 /* optional arguments accepted for now:
3099 * ipv4 or ipv6
3100 */
3101 while (*end != ')') {
3102 beg = end + 1;
3103 end = strchr(beg, ',');
3104 if (end == NULL)
3105 end = strchr(beg, ')');
3106 if (end == NULL)
3107 goto do_resolve_parse_error;
3108
3109 if (strncmp(beg, "ipv4", end - beg) == 0) {
3110 rule->arg.resolv.opts->family_prio = AF_INET;
3111 }
3112 else if (strncmp(beg, "ipv6", end - beg) == 0) {
3113 rule->arg.resolv.opts->family_prio = AF_INET6;
3114 }
3115 else {
3116 goto do_resolve_parse_error;
3117 }
3118 }
3119
3120 cur_arg = cur_arg + 1;
3121
3122 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args, NULL);
3123 if (!expr)
3124 goto do_resolve_parse_error;
3125
3126
3127 where = 0;
3128 if (px->cap & PR_CAP_FE)
3129 where |= SMP_VAL_FE_HRQ_HDR;
3130 if (px->cap & PR_CAP_BE)
3131 where |= SMP_VAL_BE_HRQ_HDR;
3132
3133 if (!(expr->fetch->val & where)) {
3134 memprintf(err,
3135 "fetch method '%s' extracts information from '%s', none of which is available here",
3136 args[cur_arg-1], sample_src_names(expr->fetch->use));
3137 free(expr);
3138 return ACT_RET_PRS_ERR;
3139 }
3140 rule->arg.resolv.expr = expr;
3141 rule->action = ACT_CUSTOM;
3142 rule->action_ptr = resolv_action_do_resolve;
3143 *orig_arg = cur_arg;
3144
3145 rule->check_ptr = check_action_do_resolve;
3146 rule->release_ptr = release_resolv_action;
3147
3148 return ACT_RET_PRS_OK;
3149
3150 do_resolve_parse_error:
Willy Tarreau61cfdf42021-02-20 10:46:51 +01003151 ha_free(&rule->arg.resolv.varname);
3152 ha_free(&rule->arg.resolv.resolvers_id);
Emeric Brunc9437992021-02-12 19:42:55 +01003153 memprintf(err, "Can't parse '%s'. Expects 'do-resolve(<varname>,<resolvers>[,<options>]) <expr>'. Available options are 'ipv4' and 'ipv6'",
3154 args[cur_arg]);
3155 return ACT_RET_PRS_ERR;
3156}
3157
3158static struct action_kw_list http_req_kws = { { }, {
Amaury Denoyellee4a617c2021-05-06 15:33:09 +02003159 { "do-resolve", resolv_parse_do_resolve, KWF_MATCH_PREFIX },
Emeric Brunc9437992021-02-12 19:42:55 +01003160 { /* END */ }
3161}};
3162
3163INITCALL1(STG_REGISTER, http_req_keywords_register, &http_req_kws);
3164
3165static struct action_kw_list tcp_req_cont_actions = {ILH, {
Amaury Denoyellee4a617c2021-05-06 15:33:09 +02003166 { "do-resolve", resolv_parse_do_resolve, KWF_MATCH_PREFIX },
Emeric Brunc9437992021-02-12 19:42:55 +01003167 { /* END */ }
3168}};
3169
3170INITCALL1(STG_REGISTER, tcp_req_cont_keywords_register, &tcp_req_cont_actions);
3171
3172/* Check an "http-request do-resolve" action.
3173 *
3174 * The function returns 1 in success case, otherwise, it returns 0 and err is
3175 * filled.
3176 */
3177int check_action_do_resolve(struct act_rule *rule, struct proxy *px, char **err)
3178{
3179 struct resolvers *resolvers = NULL;
3180
3181 if (rule->arg.resolv.resolvers_id == NULL) {
3182 memprintf(err,"Proxy '%s': %s", px->id, "do-resolve action without resolvers");
3183 return 0;
3184 }
3185
3186 resolvers = find_resolvers_by_id(rule->arg.resolv.resolvers_id);
3187 if (resolvers == NULL) {
3188 memprintf(err,"Can't find resolvers section '%s' for do-resolve action", rule->arg.resolv.resolvers_id);
3189 return 0;
3190 }
3191 rule->arg.resolv.resolvers = resolvers;
3192
3193 return 1;
3194}
3195
3196void resolvers_setup_proxy(struct proxy *px)
3197{
3198 px->last_change = now.tv_sec;
3199 px->cap = PR_CAP_FE | PR_CAP_BE;
3200 px->maxconn = 0;
3201 px->conn_retries = 1;
3202 px->timeout.server = TICK_ETERNITY;
3203 px->timeout.client = TICK_ETERNITY;
3204 px->timeout.connect = TICK_ETERNITY;
3205 px->accept = NULL;
3206 px->options2 |= PR_O2_INDEPSTR | PR_O2_SMARTCON;
3207 px->bind_proc = 0; /* will be filled by users */
3208}
3209
3210/*
3211 * Parse a <resolvers> section.
3212 * Returns the error code, 0 if OK, or any combination of :
3213 * - ERR_ABORT: must abort ASAP
3214 * - ERR_FATAL: we can continue parsing but not start the service
3215 * - ERR_WARN: a warning has been emitted
3216 * - ERR_ALERT: an alert has been emitted
3217 * Only the two first ones can stop processing, the two others are just
3218 * indicators.
3219 */
3220int cfg_parse_resolvers(const char *file, int linenum, char **args, int kwm)
3221{
3222 const char *err;
3223 int err_code = 0;
3224 char *errmsg = NULL;
3225 struct proxy *p;
3226
3227 if (strcmp(args[0], "resolvers") == 0) { /* new resolvers section */
3228 if (!*args[1]) {
3229 ha_alert("parsing [%s:%d] : missing name for resolvers section.\n", file, linenum);
3230 err_code |= ERR_ALERT | ERR_ABORT;
3231 goto out;
3232 }
3233
3234 err = invalid_char(args[1]);
3235 if (err) {
3236 ha_alert("parsing [%s:%d] : character '%c' is not permitted in '%s' name '%s'.\n",
3237 file, linenum, *err, args[0], args[1]);
3238 err_code |= ERR_ALERT | ERR_ABORT;
3239 goto out;
3240 }
3241
3242 list_for_each_entry(curr_resolvers, &sec_resolvers, list) {
3243 /* Error if two resolvers owns the same name */
3244 if (strcmp(curr_resolvers->id, args[1]) == 0) {
3245 ha_alert("Parsing [%s:%d]: resolvers '%s' has same name as another resolvers (declared at %s:%d).\n",
3246 file, linenum, args[1], curr_resolvers->conf.file, curr_resolvers->conf.line);
3247 err_code |= ERR_ALERT | ERR_ABORT;
3248 }
3249 }
3250
3251 if ((curr_resolvers = calloc(1, sizeof(*curr_resolvers))) == NULL) {
3252 ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
3253 err_code |= ERR_ALERT | ERR_ABORT;
3254 goto out;
3255 }
3256
3257 /* allocate new proxy to tcp servers */
3258 p = calloc(1, sizeof *p);
3259 if (!p) {
3260 ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
3261 err_code |= ERR_ALERT | ERR_FATAL;
3262 goto out;
3263 }
3264
3265 init_new_proxy(p);
3266 resolvers_setup_proxy(p);
3267 p->parent = curr_resolvers;
3268 p->id = strdup(args[1]);
3269 p->conf.args.file = p->conf.file = strdup(file);
3270 p->conf.args.line = p->conf.line = linenum;
3271 curr_resolvers->px = p;
3272
3273 /* default values */
Willy Tarreau2b718102021-04-21 07:32:39 +02003274 LIST_APPEND(&sec_resolvers, &curr_resolvers->list);
Emeric Brunc9437992021-02-12 19:42:55 +01003275 curr_resolvers->conf.file = strdup(file);
3276 curr_resolvers->conf.line = linenum;
3277 curr_resolvers->id = strdup(args[1]);
3278 curr_resolvers->query_ids = EB_ROOT;
3279 /* default maximum response size */
3280 curr_resolvers->accepted_payload_size = 512;
3281 /* default hold period for nx, other, refuse and timeout is 30s */
3282 curr_resolvers->hold.nx = 30000;
3283 curr_resolvers->hold.other = 30000;
3284 curr_resolvers->hold.refused = 30000;
3285 curr_resolvers->hold.timeout = 30000;
3286 curr_resolvers->hold.obsolete = 0;
3287 /* default hold period for valid is 10s */
3288 curr_resolvers->hold.valid = 10000;
3289 curr_resolvers->timeout.resolve = 1000;
3290 curr_resolvers->timeout.retry = 1000;
3291 curr_resolvers->resolve_retries = 3;
3292 LIST_INIT(&curr_resolvers->nameservers);
3293 LIST_INIT(&curr_resolvers->resolutions.curr);
3294 LIST_INIT(&curr_resolvers->resolutions.wait);
3295 HA_SPIN_INIT(&curr_resolvers->lock);
3296 }
3297 else if (strcmp(args[0], "nameserver") == 0) { /* nameserver definition */
3298 struct dns_nameserver *newnameserver = NULL;
3299 struct sockaddr_storage *sk;
3300 int port1, port2;
Emeric Brunc8f3e452021-04-07 16:04:54 +02003301 struct protocol *proto;
Emeric Brunc9437992021-02-12 19:42:55 +01003302
3303 if (!*args[2]) {
3304 ha_alert("parsing [%s:%d] : '%s' expects <name> and <addr>[:<port>] as arguments.\n",
3305 file, linenum, args[0]);
3306 err_code |= ERR_ALERT | ERR_FATAL;
3307 goto out;
3308 }
3309
3310 err = invalid_char(args[1]);
3311 if (err) {
3312 ha_alert("parsing [%s:%d] : character '%c' is not permitted in server name '%s'.\n",
3313 file, linenum, *err, args[1]);
3314 err_code |= ERR_ALERT | ERR_FATAL;
3315 goto out;
3316 }
3317
3318 list_for_each_entry(newnameserver, &curr_resolvers->nameservers, list) {
3319 /* Error if two resolvers owns the same name */
3320 if (strcmp(newnameserver->id, args[1]) == 0) {
3321 ha_alert("Parsing [%s:%d]: nameserver '%s' has same name as another nameserver (declared at %s:%d).\n",
3322 file, linenum, args[1], newnameserver->conf.file, newnameserver->conf.line);
3323 err_code |= ERR_ALERT | ERR_FATAL;
3324 }
3325 }
3326
Emeric Brunc8f3e452021-04-07 16:04:54 +02003327 sk = str2sa_range(args[2], NULL, &port1, &port2, NULL, &proto,
3328 &errmsg, NULL, NULL, PA_O_RESOLVE | PA_O_PORT_OK | PA_O_PORT_MAND | PA_O_DGRAM | PA_O_STREAM | PA_O_DEFAULT_DGRAM);
Emeric Brunc9437992021-02-12 19:42:55 +01003329 if (!sk) {
3330 ha_alert("parsing [%s:%d] : '%s %s' : %s\n", file, linenum, args[0], args[1], errmsg);
3331 err_code |= ERR_ALERT | ERR_FATAL;
3332 goto out;
3333 }
3334
3335 if ((newnameserver = calloc(1, sizeof(*newnameserver))) == NULL) {
3336 ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
3337 err_code |= ERR_ALERT | ERR_ABORT;
3338 goto out;
3339 }
3340
Emeric Brunc8f3e452021-04-07 16:04:54 +02003341 if (proto && proto->ctrl_type == SOCK_STREAM) {
3342 err_code |= parse_server(file, linenum, args, curr_resolvers->px, NULL,
3343 SRV_PARSE_PARSE_ADDR|SRV_PARSE_INITIAL_RESOLVE);
3344 if (err_code & (ERR_FATAL|ERR_ABORT)) {
3345 err_code |= ERR_ABORT;
3346 goto out;
3347 }
3348
3349 if (dns_stream_init(newnameserver, curr_resolvers->px->srv) < 0) {
3350 ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
3351 err_code |= ERR_ALERT|ERR_ABORT;
3352 goto out;
3353 }
3354 }
3355 else if (dns_dgram_init(newnameserver, sk) < 0) {
Emeric Brunc9437992021-02-12 19:42:55 +01003356 ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
3357 err_code |= ERR_ALERT | ERR_ABORT;
3358 goto out;
3359 }
3360
3361 if ((newnameserver->conf.file = strdup(file)) == NULL) {
3362 ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
3363 err_code |= ERR_ALERT | ERR_ABORT;
3364 goto out;
3365 }
3366
3367 if ((newnameserver->id = strdup(args[1])) == NULL) {
3368 ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
3369 err_code |= ERR_ALERT | ERR_ABORT;
3370 goto out;
3371 }
3372
3373 newnameserver->parent = curr_resolvers;
3374 newnameserver->process_responses = resolv_process_responses;
3375 newnameserver->conf.line = linenum;
3376 /* the nameservers are linked backward first */
Willy Tarreau2b718102021-04-21 07:32:39 +02003377 LIST_APPEND(&curr_resolvers->nameservers, &newnameserver->list);
Emeric Brunc9437992021-02-12 19:42:55 +01003378 }
3379 else if (strcmp(args[0], "parse-resolv-conf") == 0) {
3380 struct dns_nameserver *newnameserver = NULL;
3381 const char *whitespace = "\r\n\t ";
3382 char *resolv_line = NULL;
3383 int resolv_linenum = 0;
3384 FILE *f = NULL;
3385 char *address = NULL;
3386 struct sockaddr_storage *sk = NULL;
3387 struct protocol *proto;
3388 int duplicate_name = 0;
3389
3390 if ((resolv_line = malloc(sizeof(*resolv_line) * LINESIZE)) == NULL) {
3391 ha_alert("parsing [%s:%d] : out of memory.\n",
3392 file, linenum);
3393 err_code |= ERR_ALERT | ERR_FATAL;
3394 goto resolv_out;
3395 }
3396
3397 if ((f = fopen("/etc/resolv.conf", "r")) == NULL) {
3398 ha_alert("parsing [%s:%d] : failed to open /etc/resolv.conf.\n",
3399 file, linenum);
3400 err_code |= ERR_ALERT | ERR_FATAL;
3401 goto resolv_out;
3402 }
3403
3404 sk = calloc(1, sizeof(*sk));
3405 if (sk == NULL) {
3406 ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n",
3407 resolv_linenum);
3408 err_code |= ERR_ALERT | ERR_FATAL;
3409 goto resolv_out;
3410 }
3411
3412 while (fgets(resolv_line, LINESIZE, f) != NULL) {
3413 resolv_linenum++;
3414 if (strncmp(resolv_line, "nameserver", 10) != 0)
3415 continue;
3416
3417 address = strtok(resolv_line + 10, whitespace);
3418 if (address == resolv_line + 10)
3419 continue;
3420
3421 if (address == NULL) {
3422 ha_warning("parsing [/etc/resolv.conf:%d] : nameserver line is missing address.\n",
3423 resolv_linenum);
3424 err_code |= ERR_WARN;
3425 continue;
3426 }
3427
3428 duplicate_name = 0;
3429 list_for_each_entry(newnameserver, &curr_resolvers->nameservers, list) {
3430 if (strcmp(newnameserver->id, address) == 0) {
3431 ha_warning("Parsing [/etc/resolv.conf:%d] : generated name for /etc/resolv.conf nameserver '%s' conflicts with another nameserver (declared at %s:%d), it appears to be a duplicate and will be excluded.\n",
3432 resolv_linenum, address, newnameserver->conf.file, newnameserver->conf.line);
3433 err_code |= ERR_WARN;
3434 duplicate_name = 1;
3435 }
3436 }
3437
3438 if (duplicate_name)
3439 continue;
3440
3441 memset(sk, 0, sizeof(*sk));
3442 if (!str2ip2(address, sk, 1)) {
3443 ha_warning("parsing [/etc/resolv.conf:%d] : address '%s' could not be recognized, nameserver will be excluded.\n",
3444 resolv_linenum, address);
3445 err_code |= ERR_WARN;
3446 continue;
3447 }
3448
3449 set_host_port(sk, 53);
3450
3451 proto = protocol_by_family(sk->ss_family);
3452 if (!proto || !proto->connect) {
3453 ha_warning("parsing [/etc/resolv.conf:%d] : '%s' : connect() not supported for this address family.\n",
3454 resolv_linenum, address);
3455 err_code |= ERR_WARN;
3456 continue;
3457 }
3458
3459 if ((newnameserver = calloc(1, sizeof(*newnameserver))) == NULL) {
3460 ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n", resolv_linenum);
3461 err_code |= ERR_ALERT | ERR_FATAL;
3462 goto resolv_out;
3463 }
3464
3465 if (dns_dgram_init(newnameserver, sk) < 0) {
3466 ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n", resolv_linenum);
3467 err_code |= ERR_ALERT | ERR_FATAL;
3468 free(newnameserver);
3469 goto resolv_out;
3470 }
3471
3472 newnameserver->conf.file = strdup("/etc/resolv.conf");
3473 if (newnameserver->conf.file == NULL) {
3474 ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n", resolv_linenum);
3475 err_code |= ERR_ALERT | ERR_FATAL;
3476 free(newnameserver);
3477 goto resolv_out;
3478 }
3479
3480 newnameserver->id = strdup(address);
3481 if (newnameserver->id == NULL) {
3482 ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n", resolv_linenum);
3483 err_code |= ERR_ALERT | ERR_FATAL;
3484 free((char *)newnameserver->conf.file);
3485 free(newnameserver);
3486 goto resolv_out;
3487 }
3488
3489 newnameserver->parent = curr_resolvers;
3490 newnameserver->process_responses = resolv_process_responses;
3491 newnameserver->conf.line = resolv_linenum;
Willy Tarreau2b718102021-04-21 07:32:39 +02003492 LIST_APPEND(&curr_resolvers->nameservers, &newnameserver->list);
Emeric Brunc9437992021-02-12 19:42:55 +01003493 }
3494
3495resolv_out:
3496 free(sk);
3497 free(resolv_line);
3498 if (f != NULL)
3499 fclose(f);
3500 }
3501 else if (strcmp(args[0], "hold") == 0) { /* hold periods */
3502 const char *res;
3503 unsigned int time;
3504
3505 if (!*args[2]) {
3506 ha_alert("parsing [%s:%d] : '%s' expects an <event> and a <time> as arguments.\n",
3507 file, linenum, args[0]);
3508 ha_alert("<event> can be either 'valid', 'nx', 'refused', 'timeout', or 'other'\n");
3509 err_code |= ERR_ALERT | ERR_FATAL;
3510 goto out;
3511 }
3512 res = parse_time_err(args[2], &time, TIME_UNIT_MS);
3513 if (res == PARSE_TIME_OVER) {
3514 ha_alert("parsing [%s:%d]: timer overflow in argument <%s> to <%s>, maximum value is 2147483647 ms (~24.8 days).\n",
3515 file, linenum, args[1], args[0]);
3516 err_code |= ERR_ALERT | ERR_FATAL;
3517 goto out;
3518 }
3519 else if (res == PARSE_TIME_UNDER) {
3520 ha_alert("parsing [%s:%d]: timer underflow in argument <%s> to <%s>, minimum non-null value is 1 ms.\n",
3521 file, linenum, args[1], args[0]);
3522 err_code |= ERR_ALERT | ERR_FATAL;
3523 goto out;
3524 }
3525 else if (res) {
3526 ha_alert("parsing [%s:%d]: unexpected character '%c' in argument to <%s>.\n",
3527 file, linenum, *res, args[0]);
3528 err_code |= ERR_ALERT | ERR_FATAL;
3529 goto out;
3530 }
3531 if (strcmp(args[1], "nx") == 0)
3532 curr_resolvers->hold.nx = time;
3533 else if (strcmp(args[1], "other") == 0)
3534 curr_resolvers->hold.other = time;
3535 else if (strcmp(args[1], "refused") == 0)
3536 curr_resolvers->hold.refused = time;
3537 else if (strcmp(args[1], "timeout") == 0)
3538 curr_resolvers->hold.timeout = time;
3539 else if (strcmp(args[1], "valid") == 0)
3540 curr_resolvers->hold.valid = time;
3541 else if (strcmp(args[1], "obsolete") == 0)
3542 curr_resolvers->hold.obsolete = time;
3543 else {
3544 ha_alert("parsing [%s:%d] : '%s' unknown <event>: '%s', expects either 'nx', 'timeout', 'valid', 'obsolete' or 'other'.\n",
3545 file, linenum, args[0], args[1]);
3546 err_code |= ERR_ALERT | ERR_FATAL;
3547 goto out;
3548 }
3549
3550 }
3551 else if (strcmp(args[0], "accepted_payload_size") == 0) {
3552 int i = 0;
3553
3554 if (!*args[1]) {
3555 ha_alert("parsing [%s:%d] : '%s' expects <nb> as argument.\n",
3556 file, linenum, args[0]);
3557 err_code |= ERR_ALERT | ERR_FATAL;
3558 goto out;
3559 }
3560
3561 i = atoi(args[1]);
3562 if (i < DNS_HEADER_SIZE || i > DNS_MAX_UDP_MESSAGE) {
3563 ha_alert("parsing [%s:%d] : '%s' must be between %d and %d inclusive (was %s).\n",
3564 file, linenum, args[0], DNS_HEADER_SIZE, DNS_MAX_UDP_MESSAGE, args[1]);
3565 err_code |= ERR_ALERT | ERR_FATAL;
3566 goto out;
3567 }
3568
3569 curr_resolvers->accepted_payload_size = i;
3570 }
3571 else if (strcmp(args[0], "resolution_pool_size") == 0) {
3572 ha_alert("parsing [%s:%d] : '%s' directive is not supported anymore (it never appeared in a stable release).\n",
3573 file, linenum, args[0]);
3574 err_code |= ERR_ALERT | ERR_FATAL;
3575 goto out;
3576 }
3577 else if (strcmp(args[0], "resolve_retries") == 0) {
3578 if (!*args[1]) {
3579 ha_alert("parsing [%s:%d] : '%s' expects <nb> as argument.\n",
3580 file, linenum, args[0]);
3581 err_code |= ERR_ALERT | ERR_FATAL;
3582 goto out;
3583 }
3584 curr_resolvers->resolve_retries = atoi(args[1]);
3585 }
3586 else if (strcmp(args[0], "timeout") == 0) {
3587 if (!*args[1]) {
3588 ha_alert("parsing [%s:%d] : '%s' expects 'retry' or 'resolve' and <time> as arguments.\n",
3589 file, linenum, args[0]);
3590 err_code |= ERR_ALERT | ERR_FATAL;
3591 goto out;
3592 }
3593 else if (strcmp(args[1], "retry") == 0 ||
3594 strcmp(args[1], "resolve") == 0) {
3595 const char *res;
3596 unsigned int tout;
3597
3598 if (!*args[2]) {
3599 ha_alert("parsing [%s:%d] : '%s %s' expects <time> as argument.\n",
3600 file, linenum, args[0], args[1]);
3601 err_code |= ERR_ALERT | ERR_FATAL;
3602 goto out;
3603 }
3604 res = parse_time_err(args[2], &tout, TIME_UNIT_MS);
3605 if (res == PARSE_TIME_OVER) {
3606 ha_alert("parsing [%s:%d]: timer overflow in argument <%s> to <%s %s>, maximum value is 2147483647 ms (~24.8 days).\n",
3607 file, linenum, args[2], args[0], args[1]);
3608 err_code |= ERR_ALERT | ERR_FATAL;
3609 goto out;
3610 }
3611 else if (res == PARSE_TIME_UNDER) {
3612 ha_alert("parsing [%s:%d]: timer underflow in argument <%s> to <%s %s>, minimum non-null value is 1 ms.\n",
3613 file, linenum, args[2], args[0], args[1]);
3614 err_code |= ERR_ALERT | ERR_FATAL;
3615 goto out;
3616 }
3617 else if (res) {
3618 ha_alert("parsing [%s:%d]: unexpected character '%c' in argument to <%s %s>.\n",
3619 file, linenum, *res, args[0], args[1]);
3620 err_code |= ERR_ALERT | ERR_FATAL;
3621 goto out;
3622 }
3623 if (args[1][2] == 't')
3624 curr_resolvers->timeout.retry = tout;
3625 else
3626 curr_resolvers->timeout.resolve = tout;
3627 }
3628 else {
3629 ha_alert("parsing [%s:%d] : '%s' expects 'retry' or 'resolve' and <time> as arguments got '%s'.\n",
3630 file, linenum, args[0], args[1]);
3631 err_code |= ERR_ALERT | ERR_FATAL;
3632 goto out;
3633 }
3634 }
3635 else if (*args[0] != 0) {
3636 ha_alert("parsing [%s:%d] : unknown keyword '%s' in '%s' section\n", file, linenum, args[0], cursection);
3637 err_code |= ERR_ALERT | ERR_FATAL;
3638 goto out;
3639 }
3640
3641 out:
3642 free(errmsg);
3643 return err_code;
3644}
Emeric Brun56fc5d92021-02-12 20:05:45 +01003645int cfg_post_parse_resolvers()
3646{
3647 int err_code = 0;
3648 struct server *srv;
3649
3650 if (curr_resolvers) {
3651
3652 /* prepare forward server descriptors */
3653 if (curr_resolvers->px) {
3654 srv = curr_resolvers->px->srv;
3655 while (srv) {
Emeric Brun56fc5d92021-02-12 20:05:45 +01003656 /* init ssl if needed */
3657 if (srv->use_ssl == 1 && xprt_get(XPRT_SSL) && xprt_get(XPRT_SSL)->prepare_srv) {
3658 if (xprt_get(XPRT_SSL)->prepare_srv(srv)) {
3659 ha_alert("unable to prepare SSL for server '%s' in resolvers section '%s'.\n", srv->id, curr_resolvers->id);
3660 err_code |= ERR_ALERT | ERR_FATAL;
3661 break;
3662 }
3663 }
Emeric Brun56fc5d92021-02-12 20:05:45 +01003664 srv = srv->next;
3665 }
3666 }
3667 }
3668 curr_resolvers = NULL;
3669 return err_code;
3670}
Emeric Brunc9437992021-02-12 19:42:55 +01003671
Emeric Brun56fc5d92021-02-12 20:05:45 +01003672REGISTER_CONFIG_SECTION("resolvers", cfg_parse_resolvers, cfg_post_parse_resolvers);
Emeric Brunc9437992021-02-12 19:42:55 +01003673REGISTER_POST_DEINIT(resolvers_deinit);
3674REGISTER_CONFIG_POSTPARSER("dns runtime resolver", resolvers_finalize_config);