blob: c854744df08fae606e1b3de74d78a01eea7bbdda [file] [log] [blame]
Baptiste Assmann325137d2015-04-13 23:40:55 +02001/*
2 * Name server resolution
3 *
4 * Copyright 2014 Baptiste Assmann <bedis9@gmail.com>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <errno.h>
14#include <fcntl.h>
15#include <stdio.h>
16#include <stdlib.h>
17#include <string.h>
18#include <unistd.h>
19
20#include <sys/types.h>
21
22#include <common/time.h>
23#include <common/ticks.h>
24
25#include <types/global.h>
26#include <types/dns.h>
27#include <types/proto_udp.h>
28
29#include <proto/checks.h>
30#include <proto/dns.h>
31#include <proto/fd.h>
32#include <proto/log.h>
33#include <proto/server.h>
34#include <proto/task.h>
35#include <proto/proto_udp.h>
36
37struct list dns_resolvers = LIST_HEAD_INIT(dns_resolvers);
38struct dns_resolution *resolution = NULL;
39
40static int64_t dns_query_id_seed; /* random seed */
41
42/* proto_udp callback functions for a DNS resolution */
43struct dgram_data_cb resolve_dgram_cb = {
44 .recv = dns_resolve_recv,
45 .send = dns_resolve_send,
46};
47
48#if DEBUG
49/*
50 * go through the resolutions associated to a resolvers section and print the ID and hostname in
51 * domain name format
52 * should be used for debug purpose only
53 */
54void dns_print_current_resolutions(struct dns_resolvers *resolvers)
55{
56 list_for_each_entry(resolution, &resolvers->curr_resolution, list) {
57 printf(" resolution %d for %s\n", resolution->query_id, resolution->hostname_dn);
58 }
59}
60#endif
61
62/*
63 * check if there is more than 1 resolution in the resolver's resolution list
64 * return value:
65 * 0: empty list
66 * 1: exactly one entry in the list
67 * 2: more than one entry in the list
68 */
69int dns_check_resolution_queue(struct dns_resolvers *resolvers)
70{
71
72 if (LIST_ISEMPTY(&resolvers->curr_resolution))
73 return 0;
74
75 if ((resolvers->curr_resolution.n) && (resolvers->curr_resolution.n == resolvers->curr_resolution.p))
76 return 1;
77
78 if (! ((resolvers->curr_resolution.n == resolvers->curr_resolution.p)
79 && (&resolvers->curr_resolution != resolvers->curr_resolution.n)))
80 return 2;
81
82 return 0;
83}
84
85/*
86 * reset all parameters of a DNS resolution to 0 (or equivalent)
87 * and clean it up from all associated lists (resolution->qid and resolution->list)
88 */
89void dns_reset_resolution(struct dns_resolution *resolution)
90{
91 /* update resolution status */
92 resolution->step = RSLV_STEP_NONE;
93
94 resolution->try = 0;
95 resolution->try_cname = 0;
96 resolution->last_resolution = now_ms;
97 resolution->nb_responses = 0;
98
99 /* clean up query id */
100 eb32_delete(&resolution->qid);
101 resolution->query_id = 0;
102 resolution->qid.key = 0;
103
104 /* default values */
Thierry Fournierada34842016-02-17 21:25:09 +0100105 if (resolution->opts->family_prio == AF_INET) {
Andrew Hayworthe6a4a322015-10-19 22:29:51 +0000106 resolution->query_type = DNS_RTYPE_A;
107 } else {
108 resolution->query_type = DNS_RTYPE_AAAA;
109 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200110
111 /* the second resolution in the queue becomes the first one */
112 LIST_DEL(&resolution->list);
113}
114
115/*
116 * function called when a network IO is generated on a name server socket for an incoming packet
117 * It performs the following actions:
118 * - check if the packet requires processing (not outdated resolution)
119 * - ensure the DNS packet received is valid and call requester's callback
120 * - call requester's error callback if invalid response
121 */
122void dns_resolve_recv(struct dgram_conn *dgram)
123{
124 struct dns_nameserver *nameserver;
125 struct dns_resolvers *resolvers;
126 struct dns_resolution *resolution;
127 unsigned char buf[DNS_MAX_UDP_MESSAGE + 1];
128 unsigned char *bufend;
129 int fd, buflen, ret;
130 unsigned short query_id;
131 struct eb32_node *eb;
132
133 fd = dgram->t.sock.fd;
134
135 /* check if ready for reading */
136 if (!fd_recv_ready(fd))
137 return;
138
139 /* no need to go further if we can't retrieve the nameserver */
140 if ((nameserver = (struct dns_nameserver *)dgram->owner) == NULL)
141 return;
142
143 resolvers = nameserver->resolvers;
144
145 /* process all pending input messages */
146 while (1) {
147 /* read message received */
148 memset(buf, '\0', DNS_MAX_UDP_MESSAGE + 1);
149 if ((buflen = recv(fd, (char*)buf , DNS_MAX_UDP_MESSAGE, 0)) < 0) {
150 /* FIXME : for now we consider EAGAIN only */
151 fd_cant_recv(fd);
152 break;
153 }
154
155 /* message too big */
156 if (buflen > DNS_MAX_UDP_MESSAGE) {
157 nameserver->counters.too_big += 1;
158 continue;
159 }
160
161 /* initializing variables */
162 bufend = buf + buflen; /* pointer to mark the end of the buffer */
163
164 /* read the query id from the packet (16 bits) */
165 if (buf + 2 > bufend) {
166 nameserver->counters.invalid += 1;
167 continue;
168 }
169 query_id = dns_response_get_query_id(buf);
170
171 /* search the query_id in the pending resolution tree */
Baptiste Assmann01daef32015-09-02 22:05:24 +0200172 eb = eb32_lookup(&resolvers->query_ids, query_id);
173 if (eb == NULL) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200174 /* unknown query id means an outdated response and can be safely ignored */
175 nameserver->counters.outdated += 1;
176 continue;
177 }
178
179 /* known query id means a resolution in prgress */
180 resolution = eb32_entry(eb, struct dns_resolution, qid);
181
182 if (!resolution) {
183 nameserver->counters.outdated += 1;
184 continue;
185 }
186
187 /* number of responses received */
188 resolution->nb_responses += 1;
189
190 ret = dns_validate_dns_response(buf, bufend, resolution->hostname_dn, resolution->hostname_dn_len);
191
192 /* treat only errors */
193 switch (ret) {
194 case DNS_RESP_INVALID:
195 case DNS_RESP_WRONG_NAME:
196 nameserver->counters.invalid += 1;
197 resolution->requester_error_cb(resolution, DNS_RESP_INVALID);
198 continue;
199
200 case DNS_RESP_ERROR:
201 nameserver->counters.other += 1;
202 resolution->requester_error_cb(resolution, DNS_RESP_ERROR);
203 continue;
204
205 case DNS_RESP_ANCOUNT_ZERO:
206 nameserver->counters.any_err += 1;
207 resolution->requester_error_cb(resolution, DNS_RESP_ANCOUNT_ZERO);
208 continue;
209
210 case DNS_RESP_NX_DOMAIN:
211 nameserver->counters.nx += 1;
212 resolution->requester_error_cb(resolution, DNS_RESP_NX_DOMAIN);
213 continue;
214
215 case DNS_RESP_REFUSED:
216 nameserver->counters.refused += 1;
217 resolution->requester_error_cb(resolution, DNS_RESP_REFUSED);
218 continue;
219
220 case DNS_RESP_CNAME_ERROR:
221 nameserver->counters.cname_error += 1;
222 resolution->requester_error_cb(resolution, DNS_RESP_CNAME_ERROR);
223 continue;
224
Baptiste Assmann0df5d962015-09-02 21:58:32 +0200225 case DNS_RESP_TRUNCATED:
226 nameserver->counters.truncated += 1;
227 resolution->requester_error_cb(resolution, DNS_RESP_TRUNCATED);
228 continue;
Baptiste Assmann96972bc2015-09-09 00:46:58 +0200229
230 case DNS_RESP_NO_EXPECTED_RECORD:
231 nameserver->counters.other += 1;
232 resolution->requester_error_cb(resolution, DNS_RESP_NO_EXPECTED_RECORD);
233 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200234 }
235
Baptiste Assmann37bb3722015-08-07 10:18:32 +0200236 nameserver->counters.valid += 1;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200237 resolution->requester_cb(resolution, nameserver, buf, buflen);
238 }
239}
240
241/*
242 * function called when a resolvers network socket is ready to send data
243 * It performs the following actions:
244 */
245void dns_resolve_send(struct dgram_conn *dgram)
246{
247 int fd;
248 struct dns_nameserver *nameserver;
249 struct dns_resolvers *resolvers;
250 struct dns_resolution *resolution;
251
252 fd = dgram->t.sock.fd;
253
254 /* check if ready for sending */
255 if (!fd_send_ready(fd))
256 return;
257
258 /* we don't want/need to be waked up any more for sending */
259 fd_stop_send(fd);
260
261 /* no need to go further if we can't retrieve the nameserver */
262 if ((nameserver = (struct dns_nameserver *)dgram->owner) == NULL)
263 return;
264
265 resolvers = nameserver->resolvers;
266 resolution = LIST_NEXT(&resolvers->curr_resolution, struct dns_resolution *, list);
267
268 dns_send_query(resolution);
269 dns_update_resolvers_timeout(resolvers);
270}
271
272/*
273 * forge and send a DNS query to resolvers associated to a resolution
274 * It performs the following actions:
275 * returns:
276 * 0 in case of error or safe ignorance
277 * 1 if no error
278 */
279int dns_send_query(struct dns_resolution *resolution)
280{
281 struct dns_resolvers *resolvers;
282 struct dns_nameserver *nameserver;
283 int ret, send_error, bufsize, fd;
284
285 resolvers = resolution->resolvers;
286
287 ret = send_error = 0;
288 bufsize = dns_build_query(resolution->query_id, resolution->query_type, resolution->hostname_dn,
289 resolution->hostname_dn_len, trash.str, trash.size);
290
291 if (bufsize == -1)
292 return 0;
293
294 list_for_each_entry(nameserver, &resolvers->nameserver_list, list) {
295 fd = nameserver->dgram->t.sock.fd;
296 errno = 0;
297
298 ret = send(fd, trash.str, bufsize, 0);
299
300 if (ret > 0)
301 nameserver->counters.sent += 1;
302
303 if (ret == 0 || errno == EAGAIN) {
304 /* nothing written, let's update the poller that we wanted to send
305 * but we were not able to */
306 fd_want_send(fd);
307 fd_cant_send(fd);
308 }
309 }
310
311 /* update resolution */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200312 resolution->nb_responses = 0;
313 resolution->last_sent_packet = now_ms;
314
315 return 1;
316}
317
318/*
319 * update a resolvers' task timeout for next wake up
320 */
321void dns_update_resolvers_timeout(struct dns_resolvers *resolvers)
322{
323 struct dns_resolution *resolution;
324
325 if (LIST_ISEMPTY(&resolvers->curr_resolution)) {
326 /* no more resolution pending, so no wakeup anymore */
327 resolvers->t->expire = TICK_ETERNITY;
328 }
329 else {
330 resolution = LIST_NEXT(&resolvers->curr_resolution, struct dns_resolution *, list);
331 resolvers->t->expire = tick_add(resolution->last_sent_packet, resolvers->timeout.retry);
332 }
333}
334
335/*
336 * Function to validate that the buffer DNS response provided in <resp> and
337 * finishing before <bufend> is valid from a DNS protocol point of view.
338 * The caller can also ask the function to check if the response contains data
339 * for a domain name <dn_name> whose length is <dn_name_len> returns one of the
340 * DNS_RESP_* code.
341 */
342int dns_validate_dns_response(unsigned char *resp, unsigned char *bufend, char *dn_name, int dn_name_len)
343{
344 unsigned char *reader, *cname, *ptr;
Baptiste Assmann96972bc2015-09-09 00:46:58 +0200345 int i, len, flags, type, ancount, cnamelen, expected_record;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200346
347 reader = resp;
348 cname = NULL;
349 cnamelen = 0;
350 len = 0;
Baptiste Assmann96972bc2015-09-09 00:46:58 +0200351 expected_record = 0; /* flag to report if at least one expected record type is found in the response.
352 * For now, only records containing an IP address (A and AAAA) are
353 * considered as expected.
354 * Later, this function may be updated to let the caller decide what type
355 * of record is expected to consider the response as valid. (SRV or TXT types)
356 */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200357
358 /* move forward 2 bytes for the query id */
359 reader += 2;
360 if (reader >= bufend)
361 return DNS_RESP_INVALID;
362
363 /*
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200364 * flags are stored over 2 bytes
365 * First byte contains:
366 * - response flag (1 bit)
367 * - opcode (4 bits)
368 * - authoritative (1 bit)
369 * - truncated (1 bit)
370 * - recursion desired (1 bit)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200371 */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200372 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200373 return DNS_RESP_INVALID;
374
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200375 flags = reader[0] * 256 + reader[1];
376
377 if (flags & DNS_FLAG_TRUNCATED)
378 return DNS_RESP_TRUNCATED;
379
380 if ((flags & DNS_FLAG_REPLYCODE) != DNS_RCODE_NO_ERROR) {
381 if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_NX_DOMAIN)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200382 return DNS_RESP_NX_DOMAIN;
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200383 else if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_REFUSED)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200384 return DNS_RESP_REFUSED;
385
386 return DNS_RESP_ERROR;
387 }
388
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200389 /* move forward 2 bytes for flags */
390 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200391 if (reader >= bufend)
392 return DNS_RESP_INVALID;
393
394 /* move forward 2 bytes for question count */
395 reader += 2;
396 if (reader >= bufend)
397 return DNS_RESP_INVALID;
398
399 /* analyzing answer count */
400 if (reader + 2 > bufend)
401 return DNS_RESP_INVALID;
402 ancount = reader[0] * 256 + reader[1];
403
404 if (ancount == 0)
405 return DNS_RESP_ANCOUNT_ZERO;
406
407 /* move forward 2 bytes for answer count */
408 reader += 2;
409 if (reader >= bufend)
410 return DNS_RESP_INVALID;
411
412 /* move forward 4 bytes authority and additional count */
413 reader += 4;
414 if (reader >= bufend)
415 return DNS_RESP_INVALID;
416
417 /* check if the name can stand in response */
418 if (dn_name && ((reader + dn_name_len + 1) > bufend))
419 return DNS_RESP_INVALID;
420
421 /* check hostname */
422 if (dn_name && (memcmp(reader, dn_name, dn_name_len) != 0))
423 return DNS_RESP_WRONG_NAME;
424
425 /* move forward hostname len bytes + 1 for NULL byte */
426 if (dn_name) {
427 reader = reader + dn_name_len + 1;
428 }
429 else {
430 ptr = reader;
431 while (*ptr) {
432 ptr++;
433 if (ptr >= bufend)
434 return DNS_RESP_INVALID;
435 }
436 reader = ptr + 1;
437 }
438
439 /* move forward 4 bytes for question type and question class */
440 reader += 4;
441 if (reader >= bufend)
442 return DNS_RESP_INVALID;
443
444 /* now parsing response records */
445 for (i = 1; i <= ancount; i++) {
446 if (reader >= bufend)
447 return DNS_RESP_INVALID;
448
449 /*
450 * name can be a pointer, so move forward reader cursor accordingly
451 * if 1st byte is '11XXXXXX', it means name is a pointer
452 * and 2nd byte gives the offset from resp where the hostname can
453 * be found
454 */
455 if ((*reader & 0xc0) == 0xc0) {
456 /*
457 * pointer, hostname can be found at resp + *(reader + 1)
458 */
459 if (reader + 1 > bufend)
460 return DNS_RESP_INVALID;
461
462 ptr = resp + *(reader + 1);
463
464 /* check if the pointer points inside the buffer */
465 if (ptr >= bufend)
466 return DNS_RESP_INVALID;
467 }
468 else {
469 /*
470 * name is a string which starts at first byte
471 * checking against last cname when recursing through the response
472 */
473 /* look for the end of the string and ensure it's in the buffer */
474 ptr = reader;
475 len = 0;
476 while (*ptr) {
477 ++len;
478 ++ptr;
479 if (ptr >= bufend)
480 return DNS_RESP_INVALID;
481 }
482
483 /* if cname is set, it means a CNAME recursion is in progress */
484 ptr = reader;
485 }
486
487 /* ptr now points to the name */
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200488 if ((*reader & 0xc0) != 0xc0) {
489 /* if cname is set, it means a CNAME recursion is in progress */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200490 if (cname) {
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200491 /* check if the name can stand in response */
492 if ((reader + cnamelen) > bufend)
493 return DNS_RESP_INVALID;
494 /* compare cname and current name */
495 if (memcmp(ptr, cname, cnamelen) != 0)
496 return DNS_RESP_CNAME_ERROR;
497
Baptiste Assmann325137d2015-04-13 23:40:55 +0200498 cname = reader;
499 cnamelen = dns_str_to_dn_label_len((const char *)cname);
500
501 /* move forward cnamelen bytes + NULL byte */
502 reader += (cnamelen + 1);
503 }
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200504 /* compare server hostname to current name */
505 else if (dn_name) {
506 /* check if the name can stand in response */
507 if ((reader + dn_name_len) > bufend)
508 return DNS_RESP_INVALID;
509 if (memcmp(ptr, dn_name, dn_name_len) != 0)
510 return DNS_RESP_WRONG_NAME;
Baptiste Assmann5d681ba2015-10-15 15:23:28 +0200511
512 reader += (dn_name_len + 1);
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200513 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200514 else {
515 reader += (len + 1);
516 }
517 }
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200518 else {
519 /* shortname in progress */
520 /* move forward 2 bytes for information pointer and address pointer */
521 reader += 2;
522 }
523
Baptiste Assmann325137d2015-04-13 23:40:55 +0200524 if (reader >= bufend)
525 return DNS_RESP_INVALID;
526
527 /*
528 * we know the record is either for our server hostname
529 * or a valid CNAME in a crecursion
530 */
531
532 /* now reading record type (A, AAAA, CNAME, etc...) */
533 if (reader + 2 > bufend)
534 return DNS_RESP_INVALID;
535 type = reader[0] * 256 + reader[1];
536
537 /* move forward 2 bytes for type (2) */
538 reader += 2;
539
540 /* move forward 6 bytes for class (2) and ttl (4) */
541 reader += 6;
542 if (reader >= bufend)
543 return DNS_RESP_INVALID;
544
545 /* now reading data len */
546 if (reader + 2 > bufend)
547 return DNS_RESP_INVALID;
548 len = reader[0] * 256 + reader[1];
549
550 /* move forward 2 bytes for data len */
551 reader += 2;
552
553 /* analyzing record content */
554 switch (type) {
555 case DNS_RTYPE_A:
556 /* ipv4 is stored on 4 bytes */
557 if (len != 4)
558 return DNS_RESP_INVALID;
Baptiste Assmann96972bc2015-09-09 00:46:58 +0200559 expected_record = 1;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200560 break;
561
562 case DNS_RTYPE_CNAME:
563 cname = reader;
564 cnamelen = len;
565 break;
566
567 case DNS_RTYPE_AAAA:
568 /* ipv6 is stored on 16 bytes */
569 if (len != 16)
570 return DNS_RESP_INVALID;
Baptiste Assmann96972bc2015-09-09 00:46:58 +0200571 expected_record = 1;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200572 break;
573 } /* switch (record type) */
574
575 /* move forward len for analyzing next record in the response */
576 reader += len;
577 } /* for i 0 to ancount */
578
Baptiste Assmann96972bc2015-09-09 00:46:58 +0200579 if (expected_record == 0)
580 return DNS_RESP_NO_EXPECTED_RECORD;
581
Baptiste Assmann325137d2015-04-13 23:40:55 +0200582 return DNS_RESP_VALID;
583}
584
585/*
586 * search dn_name resolution in resp.
587 * If existing IP not found, return the first IP matching family_priority,
588 * otherwise, first ip found
589 * The following tasks are the responsibility of the caller:
590 * - resp contains an error free DNS response
591 * - the response matches the dn_name
592 * For both cases above, dns_validate_dns_response is required
593 * returns one of the DNS_UPD_* code
594 */
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100595#define DNS_MAX_IP_REC 20
Baptiste Assmann325137d2015-04-13 23:40:55 +0200596int dns_get_ip_from_response(unsigned char *resp, unsigned char *resp_end,
Thierry Fournierada34842016-02-17 21:25:09 +0100597 struct dns_resolution *resol, void *currentip,
598 short currentip_sin_family,
599 void **newip, short *newip_sin_family)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200600{
Thierry Fournierada34842016-02-17 21:25:09 +0100601 int family_priority;
602 char *dn_name;
603 int dn_name_len;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200604 int i, ancount, cnamelen, type, data_len, currentip_found;
605 unsigned char *reader, *cname, *ptr, *newip4, *newip6;
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100606 struct {
607 unsigned char *ip;
608 unsigned char type;
609 } rec[DNS_MAX_IP_REC];
610 int currentip_sel;
611 int j;
612 int rec_nb = 0;
613 int score, max_score;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200614
Thierry Fournierada34842016-02-17 21:25:09 +0100615 family_priority = resol->opts->family_prio;
616 dn_name = resol->hostname_dn;
617 dn_name_len = resol->hostname_dn_len;
618
Baptiste Assmann325137d2015-04-13 23:40:55 +0200619 cname = *newip = newip4 = newip6 = NULL;
620 cnamelen = currentip_found = 0;
621 *newip_sin_family = AF_UNSPEC;
622 ancount = (((struct dns_header *)resp)->ancount);
623 ancount = *(resp + 7);
624
625 /* bypass DNS response header */
626 reader = resp + sizeof(struct dns_header);
627
628 /* bypass DNS query section */
629 /* move forward hostname len bytes + 1 for NULL byte */
630 reader = reader + dn_name_len + 1;
631
632 /* move forward 4 bytes for question type and question class */
633 reader += 4;
634
635 /* now parsing response records */
636 for (i = 1; i <= ancount; i++) {
637 /*
638 * name can be a pointer, so move forward reader cursor accordingly
639 * if 1st byte is '11XXXXXX', it means name is a pointer
640 * and 2nd byte gives the offset from buf where the hostname can
641 * be found
642 */
643 if ((*reader & 0xc0) == 0xc0)
644 ptr = resp + *(reader + 1);
645 else
646 ptr = reader;
647
Baptiste Assmanne4c4b7d2015-10-28 02:10:02 +0100648 if (cname) {
649 if (memcmp(ptr, cname, cnamelen)) {
650 return DNS_UPD_NAME_ERROR;
651 }
652 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200653 else if (memcmp(ptr, dn_name, dn_name_len))
654 return DNS_UPD_NAME_ERROR;
655
656 if ((*reader & 0xc0) == 0xc0) {
657 /* move forward 2 bytes for information pointer and address pointer */
658 reader += 2;
659 }
660 else {
661 if (cname) {
662 cname = reader;
663 cnamelen = dns_str_to_dn_label_len((char *)cname);
664
665 /* move forward cnamelen bytes + NULL byte */
666 reader += (cnamelen + 1);
667 }
668 else {
669 /* move forward dn_name_len bytes + NULL byte */
670 reader += (dn_name_len + 1);
671 }
672 }
673
674 /*
675 * we know the record is either for our server hostname
676 * or a valid CNAME in a crecursion
677 */
678
679 /* now reading record type (A, AAAA, CNAME, etc...) */
680 type = reader[0] * 256 + reader[1];
681
682 /* move forward 2 bytes for type (2) */
683 reader += 2;
684
685 /* move forward 6 bytes for class (2) and ttl (4) */
686 reader += 6;
687
688 /* now reading data len */
689 data_len = reader[0] * 256 + reader[1];
690
691 /* move forward 2 bytes for data len */
692 reader += 2;
693
694 /* analyzing record content */
695 switch (type) {
696 case DNS_RTYPE_A:
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100697 /* Store IPv4, only if some room is avalaible. */
698 if (rec_nb < DNS_MAX_IP_REC) {
699 rec[rec_nb].ip = reader;
700 rec[rec_nb].type = AF_INET;
701 rec_nb++;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200702 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200703 /* move forward data_len for analyzing next record in the response */
704 reader += data_len;
705 break;
706
707 case DNS_RTYPE_CNAME:
708 cname = reader;
709 cnamelen = data_len;
710
711 reader += data_len;
712 break;
713
714 case DNS_RTYPE_AAAA:
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100715 /* Store IPv6, only if some room is avalaible. */
716 if (rec_nb < DNS_MAX_IP_REC) {
717 rec[rec_nb].ip = reader;
718 rec[rec_nb].type = AF_INET6;
719 rec_nb++;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200720 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200721 /* move forward data_len for analyzing next record in the response */
722 reader += data_len;
723 break;
724
725 default:
726 /* not supported record type */
727 /* move forward data_len for analyzing next record in the response */
728 reader += data_len;
729 } /* switch (record type) */
730 } /* for i 0 to ancount */
731
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100732 /* Select an IP regarding configuration preference.
733 * Top priority is the prefered network ip version,
734 * second priority is the prefered network.
735 * the last priority is the currently used IP,
736 *
737 * For these three priorities, a score is calculated. The
738 * weight are:
739 * 4 - prefered netwok ip version.
740 * 2 - prefered network.
741 * 1 - current ip.
742 * The result with the biggest score is returned.
743 */
744 max_score = -1;
745 for (i = 0; i < rec_nb; i++) {
746
747 score = 0;
748
749 /* Check for prefered ip protocol. */
750 if (rec[i].type == family_priority)
751 score += 4;
752
753 /* Check for prefered network. */
754 for (j = 0; j < resol->opts->pref_net_nb; j++) {
755
756 /* Compare only the same adresses class. */
757 if (resol->opts->pref_net[j].family != rec[i].type)
758 continue;
759
760 if ((rec[i].type == AF_INET &&
761 in_net_ipv4((struct in_addr *)rec[i].ip,
762 &resol->opts->pref_net[j].mask.in4,
763 &resol->opts->pref_net[j].addr.in4)) ||
764 (rec[i].type == AF_INET6 &&
765 in_net_ipv6((struct in6_addr *)rec[i].ip,
766 &resol->opts->pref_net[j].mask.in6,
767 &resol->opts->pref_net[j].addr.in6))) {
768 score += 2;
769 break;
770 }
771 }
772
773 /* Check for current ip matching. */
774 if (rec[i].type == currentip_sin_family &&
775 ((currentip_sin_family == AF_INET &&
776 *(uint32_t *)rec[i].ip == *(uint32_t *)currentip) ||
777 (currentip_sin_family == AF_INET6 &&
778 memcmp(rec[i].ip, currentip, 16) == 0))) {
779 score += 1;
780 currentip_sel = 1;
781 } else
782 currentip_sel = 0;
783
784 /* Keep the address if the score is better than the previous
785 * score. The maximum score is 7, if this value is reached,
786 * we break the parsing. Implicitly, this score is reached
787 * the ip selected is the current ip.
788 */
789 if (score > max_score) {
790 if (rec[i].type == AF_INET)
791 newip4 = rec[i].ip;
792 else
793 newip6 = rec[i].ip;
794 currentip_found = currentip_sel;
795 if (score == 7)
796 return DNS_UPD_NO;
797 max_score = score;
798 }
799 }
800
Baptiste Assmann325137d2015-04-13 23:40:55 +0200801 /* only CNAMEs in the response, no IP found */
802 if (cname && !newip4 && !newip6) {
803 return DNS_UPD_CNAME;
804 }
805
Baptiste Assmann0453a1d2015-09-09 00:51:08 +0200806 /* no IP found in the response */
807 if (!newip4 && !newip6) {
808 return DNS_UPD_NO_IP_FOUND;
809 }
810
Baptiste Assmann325137d2015-04-13 23:40:55 +0200811 /* case when the caller looks first for an IPv4 address */
812 if (family_priority == AF_INET) {
813 if (newip4) {
814 *newip = newip4;
815 *newip_sin_family = AF_INET;
816 if (currentip_found == 1)
817 return DNS_UPD_NO;
818 return DNS_UPD_SRVIP_NOT_FOUND;
819 }
820 else if (newip6) {
821 *newip = newip6;
822 *newip_sin_family = AF_INET6;
823 if (currentip_found == 1)
824 return DNS_UPD_NO;
825 return DNS_UPD_SRVIP_NOT_FOUND;
826 }
827 }
828 /* case when the caller looks first for an IPv6 address */
829 else if (family_priority == AF_INET6) {
830 if (newip6) {
831 *newip = newip6;
832 *newip_sin_family = AF_INET6;
833 if (currentip_found == 1)
834 return DNS_UPD_NO;
835 return DNS_UPD_SRVIP_NOT_FOUND;
836 }
837 else if (newip4) {
838 *newip = newip4;
839 *newip_sin_family = AF_INET;
840 if (currentip_found == 1)
841 return DNS_UPD_NO;
842 return DNS_UPD_SRVIP_NOT_FOUND;
843 }
844 }
845 /* case when the caller have no preference (we prefer IPv6) */
846 else if (family_priority == AF_UNSPEC) {
847 if (newip6) {
848 *newip = newip6;
849 *newip_sin_family = AF_INET6;
850 if (currentip_found == 1)
851 return DNS_UPD_NO;
852 return DNS_UPD_SRVIP_NOT_FOUND;
853 }
854 else if (newip4) {
855 *newip = newip4;
856 *newip_sin_family = AF_INET;
857 if (currentip_found == 1)
858 return DNS_UPD_NO;
859 return DNS_UPD_SRVIP_NOT_FOUND;
860 }
861 }
862
863 /* no reason why we should change the server's IP address */
864 return DNS_UPD_NO;
865}
866
867/*
868 * returns the query id contained in a DNS response
869 */
Thiago Farinab1af23e2016-01-20 23:46:34 +0100870unsigned short dns_response_get_query_id(unsigned char *resp)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200871{
872 /* read the query id from the response */
873 return resp[0] * 256 + resp[1];
874}
875
876/*
877 * used during haproxy's init phase
878 * parses resolvers sections and initializes:
879 * - task (time events) for each resolvers section
880 * - the datagram layer (network IO events) for each nameserver
881 * returns:
882 * 0 in case of error
883 * 1 when no error
884 */
885int dns_init_resolvers(void)
886{
887 struct dns_resolvers *curr_resolvers;
888 struct dns_nameserver *curnameserver;
889 struct dgram_conn *dgram;
890 struct task *t;
891 int fd;
892
893 /* give a first random value to our dns query_id seed */
894 dns_query_id_seed = random();
895
896 /* run through the resolvers section list */
897 list_for_each_entry(curr_resolvers, &dns_resolvers, list) {
898 /* create the task associated to the resolvers section */
899 if ((t = task_new()) == NULL) {
900 Alert("Starting [%s] resolvers: out of memory.\n", curr_resolvers->id);
901 return 0;
902 }
903
904 /* update task's parameters */
905 t->process = dns_process_resolve;
906 t->context = curr_resolvers;
907 t->expire = TICK_ETERNITY;
908
909 curr_resolvers->t = t;
910
911 list_for_each_entry(curnameserver, &curr_resolvers->nameserver_list, list) {
912 if ((dgram = calloc(1, sizeof(struct dgram_conn))) == NULL) {
913 Alert("Starting [%s/%s] nameserver: out of memory.\n", curr_resolvers->id,
914 curnameserver->id);
915 return 0;
916 }
917 /* update datagram's parameters */
918 dgram->owner = (void *)curnameserver;
919 dgram->data = &resolve_dgram_cb;
920
921 /* create network UDP socket for this nameserver */
922 if ((fd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
923 Alert("Starting [%s/%s] nameserver: can't create socket.\n", curr_resolvers->id,
924 curnameserver->id);
925 free(dgram);
926 dgram = NULL;
927 return 0;
928 }
929
930 /* "connect" the UDP socket to the name server IP */
Baptiste Assmann8c62c472015-09-21 20:55:08 +0200931 if (connect(fd, (struct sockaddr*)&curnameserver->addr, get_addr_len(&curnameserver->addr)) == -1) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200932 Alert("Starting [%s/%s] nameserver: can't connect socket.\n", curr_resolvers->id,
933 curnameserver->id);
934 close(fd);
935 free(dgram);
936 dgram = NULL;
937 return 0;
938 }
939
940 /* make the socket non blocking */
941 fcntl(fd, F_SETFL, O_NONBLOCK);
942
943 /* add the fd in the fd list and update its parameters */
944 fd_insert(fd);
945 fdtab[fd].owner = dgram;
946 fdtab[fd].iocb = dgram_fd_handler;
947 fd_want_recv(fd);
948 dgram->t.sock.fd = fd;
949
950 /* update nameserver's datagram property */
951 curnameserver->dgram = dgram;
952
953 continue;
954 }
955
956 /* task can be queued */
957 task_queue(t);
958 }
959
960 return 1;
961}
962
963/*
964 * Forge a DNS query. It needs the following information from the caller:
965 * - <query_id>: the DNS query id corresponding to this query
966 * - <query_type>: DNS_RTYPE_* request DNS record type (A, AAAA, ANY, etc...)
967 * - <hostname_dn>: hostname in domain name format
968 * - <hostname_dn_len>: length of <hostname_dn>
969 * To store the query, the caller must pass a buffer <buf> and its size <bufsize>
970 *
971 * the DNS query is stored in <buf>
972 * returns:
973 * -1 if <buf> is too short
974 */
975int dns_build_query(int query_id, int query_type, char *hostname_dn, int hostname_dn_len, char *buf, int bufsize)
976{
977 struct dns_header *dns;
978 struct dns_question *qinfo;
979 char *ptr, *bufend;
980
981 memset(buf, '\0', bufsize);
982 ptr = buf;
983 bufend = buf + bufsize;
984
985 /* check if there is enough room for DNS headers */
986 if (ptr + sizeof(struct dns_header) >= bufend)
987 return -1;
988
989 /* set dns query headers */
990 dns = (struct dns_header *)ptr;
991 dns->id = (unsigned short) htons(query_id);
992 dns->qr = 0; /* query */
993 dns->opcode = 0;
994 dns->aa = 0;
995 dns->tc = 0;
996 dns->rd = 1; /* recursion desired */
997 dns->ra = 0;
998 dns->z = 0;
999 dns->rcode = 0;
1000 dns->qdcount = htons(1); /* 1 question */
1001 dns->ancount = 0;
1002 dns->nscount = 0;
1003 dns->arcount = 0;
1004
1005 /* move forward ptr */
1006 ptr += sizeof(struct dns_header);
1007
1008 /* check if there is enough room for query hostname */
1009 if ((ptr + hostname_dn_len) >= bufend)
1010 return -1;
1011
1012 /* set up query hostname */
1013 memcpy(ptr, hostname_dn, hostname_dn_len);
1014 ptr[hostname_dn_len + 1] = '\0';
1015
1016 /* move forward ptr */
1017 ptr += (hostname_dn_len + 1);
1018
1019 /* check if there is enough room for query hostname*/
1020 if (ptr + sizeof(struct dns_question) >= bufend)
1021 return -1;
1022
1023 /* set up query info (type and class) */
1024 qinfo = (struct dns_question *)ptr;
1025 qinfo->qtype = htons(query_type);
1026 qinfo->qclass = htons(DNS_RCLASS_IN);
1027
1028 ptr += sizeof(struct dns_question);
1029
1030 return ptr - buf;
1031}
1032
1033/*
1034 * turn a string into domain name label:
1035 * www.haproxy.org into 3www7haproxy3org
1036 * if dn memory is pre-allocated, you must provide its size in dn_len
1037 * if dn memory isn't allocated, dn_len must be set to 0.
1038 * In the second case, memory will be allocated.
1039 * in case of error, -1 is returned, otherwise, number of bytes copied in dn
1040 */
Willy Tarreau2100b492015-07-22 16:42:43 +02001041char *dns_str_to_dn_label(const char *string, char *dn, int dn_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001042{
1043 char *c, *d;
1044 int i, offset;
1045
1046 /* offset between string size and theorical dn size */
1047 offset = 1;
1048
1049 /*
1050 * first, get the size of the string turned into its domain name version
1051 * This function also validates the string respect the RFC
1052 */
1053 if ((i = dns_str_to_dn_label_len(string)) == -1)
1054 return NULL;
1055
1056 /* yes, so let's check there is enough memory */
1057 if (dn_len < i + offset)
1058 return NULL;
1059
Willy Tarreaud69d6f32015-07-22 16:45:36 +02001060 i = strlen(string);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001061 memcpy(dn + offset, string, i);
1062 dn[i + offset] = '\0';
1063 /* avoid a '\0' at the beginning of dn string which may prevent the for loop
1064 * below from working.
1065 * Actually, this is the reason of the offset. */
1066 dn[0] = '0';
1067
1068 for (c = dn; *c ; ++c) {
1069 /* c points to the first '0' char or a dot, which we don't want to read */
1070 d = c + offset;
1071 i = 0;
1072 while (*d != '.' && *d) {
1073 i++;
1074 d++;
1075 }
1076 *c = i;
1077
1078 c = d - 1; /* because of c++ of the for loop */
1079 }
1080
1081 return dn;
1082}
1083
1084/*
1085 * compute and return the length of <string> it it were translated into domain name
1086 * label:
1087 * www.haproxy.org into 3www7haproxy3org would return 16
1088 * NOTE: add +1 for '\0' when allocating memory ;)
1089 */
1090int dns_str_to_dn_label_len(const char *string)
1091{
1092 return strlen(string) + 1;
1093}
1094
1095/*
1096 * validates host name:
1097 * - total size
1098 * - each label size individually
1099 * returns:
1100 * 0 in case of error. If <err> is not NULL, an error message is stored there.
1101 * 1 when no error. <err> is left unaffected.
1102 */
1103int dns_hostname_validation(const char *string, char **err)
1104{
1105 const char *c, *d;
1106 int i;
1107
1108 if (strlen(string) > DNS_MAX_NAME_SIZE) {
1109 if (err)
1110 *err = DNS_TOO_LONG_FQDN;
1111 return 0;
1112 }
1113
1114 c = string;
1115 while (*c) {
1116 d = c;
1117
1118 i = 0;
1119 while (*d != '.' && *d && i <= DNS_MAX_LABEL_SIZE) {
1120 i++;
1121 if (!((*d == '-') || (*d == '_') ||
1122 ((*d >= 'a') && (*d <= 'z')) ||
1123 ((*d >= 'A') && (*d <= 'Z')) ||
1124 ((*d >= '0') && (*d <= '9')))) {
1125 if (err)
1126 *err = DNS_INVALID_CHARACTER;
1127 return 0;
1128 }
1129 d++;
1130 }
1131
1132 if ((i >= DNS_MAX_LABEL_SIZE) && (d[i] != '.')) {
1133 if (err)
1134 *err = DNS_LABEL_TOO_LONG;
1135 return 0;
1136 }
1137
1138 if (*d == '\0')
1139 goto out;
1140
1141 c = ++d;
1142 }
1143 out:
1144 return 1;
1145}
1146
1147/*
1148 * 2 bytes random generator to generate DNS query ID
1149 */
1150uint16_t dns_rnd16(void)
1151{
1152 dns_query_id_seed ^= dns_query_id_seed << 13;
1153 dns_query_id_seed ^= dns_query_id_seed >> 7;
1154 dns_query_id_seed ^= dns_query_id_seed << 17;
1155 return dns_query_id_seed;
1156}
1157
1158
1159/*
1160 * function called when a timeout occurs during name resolution process
1161 * if max number of tries is reached, then stop, otherwise, retry.
1162 */
1163struct task *dns_process_resolve(struct task *t)
1164{
1165 struct dns_resolvers *resolvers = t->context;
1166 struct dns_resolution *resolution, *res_back;
1167
1168 /* timeout occurs inevitably for the first element of the FIFO queue */
1169 if (LIST_ISEMPTY(&resolvers->curr_resolution)) {
1170 /* no first entry, so wake up was useless */
1171 t->expire = TICK_ETERNITY;
1172 return t;
1173 }
1174
1175 /* look for the first resolution which is not expired */
1176 list_for_each_entry_safe(resolution, res_back, &resolvers->curr_resolution, list) {
1177 /* when we find the first resolution in the future, then we can stop here */
1178 if (tick_is_le(now_ms, resolution->last_sent_packet))
1179 goto out;
1180
1181 /*
1182 * if current resolution has been tried too many times and finishes in timeout
1183 * we update its status and remove it from the list
1184 */
Baptiste Assmannf778bb42015-09-09 00:54:38 +02001185 if (resolution->try <= 0) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001186 /* clean up resolution information and remove from the list */
1187 dns_reset_resolution(resolution);
1188
1189 /* notify the result to the requester */
1190 resolution->requester_error_cb(resolution, DNS_RESP_TIMEOUT);
1191 }
1192
Baptiste Assmannf778bb42015-09-09 00:54:38 +02001193 resolution->try -= 1;
1194
Baptiste Assmann325137d2015-04-13 23:40:55 +02001195 /* check current resolution status */
1196 if (resolution->step == RSLV_STEP_RUNNING) {
1197 /* resend the DNS query */
1198 dns_send_query(resolution);
1199
1200 /* check if we have more than one resolution in the list */
1201 if (dns_check_resolution_queue(resolvers) > 1) {
1202 /* move the rsolution to the end of the list */
1203 LIST_DEL(&resolution->list);
1204 LIST_ADDQ(&resolvers->curr_resolution, &resolution->list);
1205 }
1206 }
1207 }
1208
1209 out:
1210 dns_update_resolvers_timeout(resolvers);
1211 return t;
1212}