blob: 6f951ab5a8a729001af2fcc3b6f717e239c81e77 [file] [log] [blame]
Baptiste Assmann325137d2015-04-13 23:40:55 +02001/*
2 * Name server resolution
3 *
4 * Copyright 2014 Baptiste Assmann <bedis9@gmail.com>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <errno.h>
14#include <fcntl.h>
15#include <stdio.h>
16#include <stdlib.h>
17#include <string.h>
18#include <unistd.h>
19
20#include <sys/types.h>
21
Willy Tarreau122eba92020-06-04 10:15:32 +020022#include <haproxy/action.h>
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020023#include <haproxy/api.h>
Willy Tarreau6be78492020-06-05 00:00:29 +020024#include <haproxy/cfgparse.h>
Willy Tarreauf1d32c42020-06-04 21:07:02 +020025#include <haproxy/channel.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020026#include <haproxy/check.h>
Willy Tarreau83487a82020-06-04 20:19:54 +020027#include <haproxy/cli.h>
Willy Tarreau7c18b542020-06-11 09:23:02 +020028#include <haproxy/dgram.h>
Willy Tarreaueb92deb2020-06-04 10:53:16 +020029#include <haproxy/dns.h>
Willy Tarreau8d366972020-05-27 16:10:29 +020030#include <haproxy/errors.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020031#include <haproxy/fd.h>
32#include <haproxy/global.h>
Willy Tarreauc761f842020-06-04 11:40:28 +020033#include <haproxy/http_rules.h>
Willy Tarreauaeed4a82020-06-04 22:01:04 +020034#include <haproxy/log.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020035#include <haproxy/net_helper.h>
Willy Tarreaua264d962020-06-04 22:29:18 +020036#include <haproxy/proxy.h>
Willy Tarreaue6ce10b2020-06-04 15:33:47 +020037#include <haproxy/sample.h>
Willy Tarreau1e56f922020-06-04 23:20:13 +020038#include <haproxy/server.h>
Willy Tarreau2eec9b52020-06-04 19:58:55 +020039#include <haproxy/stats-t.h>
Willy Tarreau5e539c92020-06-04 20:45:39 +020040#include <haproxy/stream_interface.h>
Willy Tarreaucea0e1b2020-06-04 17:25:40 +020041#include <haproxy/task.h>
Willy Tarreau8b550af2020-06-04 17:42:48 +020042#include <haproxy/tcp_rules.h>
Willy Tarreauc2f7c582020-06-02 18:15:32 +020043#include <haproxy/ticks.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020044#include <haproxy/time.h>
Willy Tarreaua1718922020-06-04 16:25:31 +020045#include <haproxy/vars.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020046
Baptiste Assmann325137d2015-04-13 23:40:55 +020047
Christopher Faulet67957bd2017-09-27 11:00:59 +020048struct list dns_resolvers = LIST_HEAD_INIT(dns_resolvers);
49struct list dns_srvrq_list = LIST_HEAD_INIT(dns_srvrq_list);
Baptiste Assmann325137d2015-04-13 23:40:55 +020050
Tim Duesterhusfcac33d2020-01-18 02:04:12 +010051static THREAD_LOCAL uint64_t dns_query_id_seed = 0; /* random seed */
Willy Tarreau8ceae722018-11-26 11:58:30 +010052
53DECLARE_STATIC_POOL(dns_answer_item_pool, "dns_answer_item", sizeof(struct dns_answer_item));
54DECLARE_STATIC_POOL(dns_resolution_pool, "dns_resolution", sizeof(struct dns_resolution));
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +010055DECLARE_POOL(dns_requester_pool, "dns_requester", sizeof(struct dns_requester));
Willy Tarreau8ceae722018-11-26 11:58:30 +010056
Christopher Faulet67957bd2017-09-27 11:00:59 +020057static unsigned int resolution_uuid = 1;
Baptiste Assmann333939c2019-01-21 08:34:50 +010058unsigned int dns_failed_resolutions = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020059
Christopher Faulet67957bd2017-09-27 11:00:59 +020060/* Returns a pointer to the resolvers matching the id <id>. NULL is returned if
61 * no match is found.
Baptiste Assmann325137d2015-04-13 23:40:55 +020062 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020063struct dns_resolvers *find_resolvers_by_id(const char *id)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020064{
Christopher Faulet67957bd2017-09-27 11:00:59 +020065 struct dns_resolvers *res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020066
Christopher Faulet67957bd2017-09-27 11:00:59 +020067 list_for_each_entry(res, &dns_resolvers, list) {
68 if (!strcmp(res->id, id))
69 return res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020070 }
Christopher Faulet67957bd2017-09-27 11:00:59 +020071 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020072}
73
Olivier Houchardb17b8842020-04-01 18:30:27 +020074/* Compare hostnames in a case-insensitive way .
75 * Returns 0 if they are the same, non-zero otherwise
76 */
77static __inline int dns_hostname_cmp(const char *name1, const char *name2, int len)
78{
79 int i;
80
81 for (i = 0; i < len; i++)
82 if (tolower(name1[i]) != tolower(name2[i]))
83 return -1;
84 return 0;
85}
86
Christopher Faulet67957bd2017-09-27 11:00:59 +020087/* Returns a pointer on the SRV request matching the name <name> for the proxy
88 * <px>. NULL is returned if no match is found.
Baptiste Assmann201c07f2017-05-22 15:17:15 +020089 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020090struct dns_srvrq *find_srvrq_by_name(const char *name, struct proxy *px)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020091{
Christopher Faulet67957bd2017-09-27 11:00:59 +020092 struct dns_srvrq *srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020093
Christopher Faulet67957bd2017-09-27 11:00:59 +020094 list_for_each_entry(srvrq, &dns_srvrq_list, list) {
95 if (srvrq->proxy == px && !strcmp(srvrq->name, name))
96 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020097 }
Christopher Faulet67957bd2017-09-27 11:00:59 +020098 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020099}
100
Christopher Faulet67957bd2017-09-27 11:00:59 +0200101/* Allocates a new SRVRQ for the given server with the name <fqdn>. It returns
102 * NULL if an error occurred. */
103struct dns_srvrq *new_dns_srvrq(struct server *srv, char *fqdn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200104{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200105 struct proxy *px = srv->proxy;
106 struct dns_srvrq *srvrq = NULL;
107 int fqdn_len, hostname_dn_len;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200108
Christopher Faulet67957bd2017-09-27 11:00:59 +0200109 fqdn_len = strlen(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200110 hostname_dn_len = dns_str_to_dn_label(fqdn, fqdn_len + 1, trash.area,
111 trash.size);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200112 if (hostname_dn_len == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100113 ha_alert("config : %s '%s', server '%s': failed to parse FQDN '%s'\n",
114 proxy_type_str(px), px->id, srv->id, fqdn);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200115 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200116 }
117
Christopher Faulet67957bd2017-09-27 11:00:59 +0200118 if ((srvrq = calloc(1, sizeof(*srvrq))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100119 ha_alert("config : %s '%s', server '%s': out of memory\n",
120 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200121 goto err;
122 }
123 srvrq->obj_type = OBJ_TYPE_SRVRQ;
124 srvrq->proxy = px;
125 srvrq->name = strdup(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200126 srvrq->hostname_dn = strdup(trash.area);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200127 srvrq->hostname_dn_len = hostname_dn_len;
128 if (!srvrq->name || !srvrq->hostname_dn) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100129 ha_alert("config : %s '%s', server '%s': out of memory\n",
130 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200131 goto err;
132 }
133 LIST_ADDQ(&dns_srvrq_list, &srvrq->list);
134 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200135
Christopher Faulet67957bd2017-09-27 11:00:59 +0200136 err:
137 if (srvrq) {
138 free(srvrq->name);
139 free(srvrq->hostname_dn);
140 free(srvrq);
141 }
142 return NULL;
143}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200144
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200145
Christopher Faulet67957bd2017-09-27 11:00:59 +0200146/* 2 bytes random generator to generate DNS query ID */
147static inline uint16_t dns_rnd16(void)
148{
Christopher Fauletb2812a62017-10-04 16:17:58 +0200149 if (!dns_query_id_seed)
150 dns_query_id_seed = now_ms;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200151 dns_query_id_seed ^= dns_query_id_seed << 13;
152 dns_query_id_seed ^= dns_query_id_seed >> 7;
153 dns_query_id_seed ^= dns_query_id_seed << 17;
154 return dns_query_id_seed;
155}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200156
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200157
Christopher Faulet67957bd2017-09-27 11:00:59 +0200158static inline int dns_resolution_timeout(struct dns_resolution *res)
159{
Baptiste Assmannf50e1ac2019-11-07 11:02:18 +0100160 return res->resolvers->timeout.resolve;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200161}
162
Christopher Faulet67957bd2017-09-27 11:00:59 +0200163/* Updates a resolvers' task timeout for next wake up and queue it */
164static void dns_update_resolvers_timeout(struct dns_resolvers *resolvers)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200165{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200166 struct dns_resolution *res;
167 int next;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200168
Christopher Faulet67957bd2017-09-27 11:00:59 +0200169 next = tick_add(now_ms, resolvers->timeout.resolve);
170 if (!LIST_ISEMPTY(&resolvers->resolutions.curr)) {
171 res = LIST_NEXT(&resolvers->resolutions.curr, struct dns_resolution *, list);
172 next = MIN(next, tick_add(res->last_query, resolvers->timeout.retry));
173 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200174
Christopher Faulet67957bd2017-09-27 11:00:59 +0200175 list_for_each_entry(res, &resolvers->resolutions.wait, list)
176 next = MIN(next, tick_add(res->last_resolution, dns_resolution_timeout(res)));
Baptiste Assmann325137d2015-04-13 23:40:55 +0200177
Christopher Faulet67957bd2017-09-27 11:00:59 +0200178 resolvers->t->expire = next;
179 task_queue(resolvers->t);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200180}
181
Christopher Faulet67957bd2017-09-27 11:00:59 +0200182/* Opens an UDP socket on the namesaver's IP/Port, if required. Returns 0 on
183 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200184 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200185static int dns_connect_namesaver(struct dns_nameserver *ns)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200186{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200187 struct dgram_conn *dgram = ns->dgram;
188 int fd;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200189
Christopher Faulet67957bd2017-09-27 11:00:59 +0200190 /* Already connected */
191 if (dgram->t.sock.fd != -1)
192 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200193
Christopher Faulet67957bd2017-09-27 11:00:59 +0200194 /* Create an UDP socket and connect it on the nameserver's IP/Port */
195 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
196 send_log(NULL, LOG_WARNING,
197 "DNS : resolvers '%s': can't create socket for nameserver '%s'.\n",
198 ns->resolvers->id, ns->id);
199 return -1;
200 }
201 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
202 send_log(NULL, LOG_WARNING,
203 "DNS : resolvers '%s': can't connect socket for nameserver '%s'.\n",
204 ns->resolvers->id, ns->id);
205 close(fd);
206 return -1;
207 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200208
Christopher Faulet67957bd2017-09-27 11:00:59 +0200209 /* Make the socket non blocking */
210 fcntl(fd, F_SETFL, O_NONBLOCK);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200211
Christopher Faulet67957bd2017-09-27 11:00:59 +0200212 /* Add the fd in the fd list and update its parameters */
213 dgram->t.sock.fd = fd;
Willy Tarreaua9786b62018-01-25 07:22:13 +0100214 fd_insert(fd, dgram, dgram_fd_handler, MAX_THREADS_MASK);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200215 fd_want_recv(fd);
216 return 0;
217}
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200218
Christopher Faulet67957bd2017-09-27 11:00:59 +0200219/* Forges a DNS query. It needs the following information from the caller:
220 * - <query_id> : the DNS query id corresponding to this query
221 * - <query_type> : DNS_RTYPE_* request DNS record type (A, AAAA, ANY...)
222 * - <hostname_dn> : hostname in domain name format
223 * - <hostname_dn_len> : length of <hostname_dn>
224 *
225 * To store the query, the caller must pass a buffer <buf> and its size
226 * <bufsize>. It returns the number of written bytes in success, -1 if <buf> is
227 * too short.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200228 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200229static int dns_build_query(int query_id, int query_type, unsigned int accepted_payload_size,
230 char *hostname_dn, int hostname_dn_len, char *buf, int bufsize)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200231{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200232 struct dns_header dns_hdr;
233 struct dns_question qinfo;
234 struct dns_additional_record edns;
235 char *p = buf;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200236
Christopher Faulet67957bd2017-09-27 11:00:59 +0200237 if (sizeof(dns_hdr) + sizeof(qinfo) + sizeof(edns) + hostname_dn_len >= bufsize)
238 return -1;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200239
Christopher Faulet67957bd2017-09-27 11:00:59 +0200240 memset(buf, 0, bufsize);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200241
Christopher Faulet67957bd2017-09-27 11:00:59 +0200242 /* Set dns query headers */
243 dns_hdr.id = (unsigned short) htons(query_id);
244 dns_hdr.flags = htons(0x0100); /* qr=0, opcode=0, aa=0, tc=0, rd=1, ra=0, z=0, rcode=0 */
245 dns_hdr.qdcount = htons(1); /* 1 question */
246 dns_hdr.ancount = 0;
247 dns_hdr.nscount = 0;
248 dns_hdr.arcount = htons(1);
249 memcpy(p, &dns_hdr, sizeof(dns_hdr));
250 p += sizeof(dns_hdr);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200251
Christopher Faulet67957bd2017-09-27 11:00:59 +0200252 /* Set up query hostname */
253 memcpy(p, hostname_dn, hostname_dn_len);
254 p += hostname_dn_len;
255 *p++ = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200256
Christopher Faulet67957bd2017-09-27 11:00:59 +0200257 /* Set up query info (type and class) */
258 qinfo.qtype = htons(query_type);
259 qinfo.qclass = htons(DNS_RCLASS_IN);
260 memcpy(p, &qinfo, sizeof(qinfo));
261 p += sizeof(qinfo);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200262
Christopher Faulet67957bd2017-09-27 11:00:59 +0200263 /* Set the DNS extension */
264 edns.name = 0;
265 edns.type = htons(DNS_RTYPE_OPT);
266 edns.udp_payload_size = htons(accepted_payload_size);
267 edns.extension = 0;
268 edns.data_length = 0;
269 memcpy(p, &edns, sizeof(edns));
270 p += sizeof(edns);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200271
Christopher Faulet67957bd2017-09-27 11:00:59 +0200272 return (p - buf);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200273}
274
Christopher Faulet67957bd2017-09-27 11:00:59 +0200275/* Sends a DNS query to resolvers associated to a resolution. It returns 0 on
276 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200277 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200278static int dns_send_query(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200279{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200280 struct dns_resolvers *resolvers = resolution->resolvers;
281 struct dns_nameserver *ns;
Willy Tarreau0eae6322019-12-20 11:18:54 +0100282 int len;
283
284 /* Update resolution */
285 resolution->nb_queries = 0;
286 resolution->nb_responses = 0;
287 resolution->last_query = now_ms;
288
289 len = dns_build_query(resolution->query_id, resolution->query_type,
290 resolvers->accepted_payload_size,
291 resolution->hostname_dn, resolution->hostname_dn_len,
292 trash.area, trash.size);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200293
Christopher Faulet67957bd2017-09-27 11:00:59 +0200294 list_for_each_entry(ns, &resolvers->nameservers, list) {
295 int fd = ns->dgram->t.sock.fd;
Willy Tarreau0eae6322019-12-20 11:18:54 +0100296 int ret;
297
Christopher Faulet67957bd2017-09-27 11:00:59 +0200298 if (fd == -1) {
299 if (dns_connect_namesaver(ns) == -1)
300 continue;
301 fd = ns->dgram->t.sock.fd;
302 resolvers->nb_nameservers++;
303 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200304
Willy Tarreau0eae6322019-12-20 11:18:54 +0100305 if (len < 0)
306 goto snd_error;
307
308 ret = send(fd, trash.area, len, 0);
309 if (ret == len) {
310 ns->counters.sent++;
311 resolution->nb_queries++;
312 continue;
313 }
314
315 if (ret == -1 && errno == EAGAIN) {
316 /* retry once the socket is ready */
317 fd_cant_send(fd);
318 continue;
319 }
320
321 snd_error:
322 ns->counters.snd_error++;
323 resolution->nb_queries++;
324 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200325
Christopher Faulet67957bd2017-09-27 11:00:59 +0200326 /* Push the resolution at the end of the active list */
327 LIST_DEL(&resolution->list);
328 LIST_ADDQ(&resolvers->resolutions.curr, &resolution->list);
329 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200330}
331
Christopher Faulet67957bd2017-09-27 11:00:59 +0200332/* Prepares and sends a DNS resolution. It returns 1 if the query was sent, 0 if
333 * skipped and -1 if an error occurred.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200334 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200335static int
336dns_run_resolution(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200337{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200338 struct dns_resolvers *resolvers = resolution->resolvers;
339 int query_id, i;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200340
Christopher Faulet67957bd2017-09-27 11:00:59 +0200341 /* Avoid sending requests for resolutions that don't yet have an
342 * hostname, ie resolutions linked to servers that do not yet have an
343 * fqdn */
344 if (!resolution->hostname_dn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200345 return 0;
346
Christopher Faulet67957bd2017-09-27 11:00:59 +0200347 /* Check if a resolution has already been started for this server return
348 * directly to avoid resolution pill up. */
349 if (resolution->step != RSLV_STEP_NONE)
350 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200351
Christopher Faulet67957bd2017-09-27 11:00:59 +0200352 /* Generates a new query id. We try at most 100 times to find a free
353 * query id */
354 for (i = 0; i < 100; ++i) {
355 query_id = dns_rnd16();
356 if (!eb32_lookup(&resolvers->query_ids, query_id))
Olivier Houchard8da5f982017-08-04 18:35:36 +0200357 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200358 query_id = -1;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200359 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200360 if (query_id == -1) {
361 send_log(NULL, LOG_NOTICE,
362 "could not generate a query id for %s, in resolvers %s.\n",
363 resolution->hostname_dn, resolvers->id);
364 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200365 }
366
Christopher Faulet67957bd2017-09-27 11:00:59 +0200367 /* Update resolution parameters */
368 resolution->query_id = query_id;
369 resolution->qid.key = query_id;
370 resolution->step = RSLV_STEP_RUNNING;
371 resolution->query_type = resolution->prefered_query_type;
372 resolution->try = resolvers->resolve_retries;
373 eb32_insert(&resolvers->query_ids, &resolution->qid);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200374
Christopher Faulet67957bd2017-09-27 11:00:59 +0200375 /* Send the DNS query */
376 resolution->try -= 1;
377 dns_send_query(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200378 return 1;
379}
380
Christopher Faulet67957bd2017-09-27 11:00:59 +0200381/* Performs a name resolution for the requester <req> */
382void dns_trigger_resolution(struct dns_requester *req)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200383{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200384 struct dns_resolvers *resolvers;
385 struct dns_resolution *res;
386 int exp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200387
Christopher Faulet67957bd2017-09-27 11:00:59 +0200388 if (!req || !req->resolution)
389 return;
390 res = req->resolution;
391 resolvers = res->resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200392
Christopher Faulet67957bd2017-09-27 11:00:59 +0200393 /* The resolution must not be triggered yet. Use the cached response, if
394 * valid */
395 exp = tick_add(res->last_resolution, resolvers->hold.valid);
Olivier Houchardf3d9e602018-05-22 18:40:07 +0200396 if (resolvers->t && (res->status != RSLV_STATUS_VALID ||
397 !tick_isset(res->last_resolution) || tick_is_expired(exp, now_ms)))
398 task_wakeup(resolvers->t, TASK_WOKEN_OTHER);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200399}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200400
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200401
Christopher Faulet67957bd2017-09-27 11:00:59 +0200402/* Resets some resolution parameters to initial values and also delete the query
403 * ID from the resolver's tree.
404 */
405static void dns_reset_resolution(struct dns_resolution *resolution)
406{
407 /* update resolution status */
408 resolution->step = RSLV_STEP_NONE;
409 resolution->try = 0;
410 resolution->last_resolution = now_ms;
411 resolution->nb_queries = 0;
412 resolution->nb_responses = 0;
413 resolution->query_type = resolution->prefered_query_type;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200414
Christopher Faulet67957bd2017-09-27 11:00:59 +0200415 /* clean up query id */
416 eb32_delete(&resolution->qid);
417 resolution->query_id = 0;
418 resolution->qid.key = 0;
419}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200420
Christopher Faulet67957bd2017-09-27 11:00:59 +0200421/* Returns the query id contained in a DNS response */
422static inline unsigned short dns_response_get_query_id(unsigned char *resp)
423{
424 return resp[0] * 256 + resp[1];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200425}
426
Christopher Faulet67957bd2017-09-27 11:00:59 +0200427
428/* Analyses, re-builds and copies the name <name> from the DNS response packet
429 * <buffer>. <name> must point to the 'data_len' information or pointer 'c0'
430 * for compressed data. The result is copied into <dest>, ensuring we don't
431 * overflow using <dest_len> Returns the number of bytes the caller can move
432 * forward. If 0 it means an error occurred while parsing the name. <offset> is
433 * the number of bytes the caller could move forward.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200434 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200435int dns_read_name(unsigned char *buffer, unsigned char *bufend,
436 unsigned char *name, char *destination, int dest_len,
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100437 int *offset, unsigned int depth)
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200438{
439 int nb_bytes = 0, n = 0;
440 int label_len;
441 unsigned char *reader = name;
442 char *dest = destination;
443
444 while (1) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100445 if (reader >= bufend)
446 goto err;
447
Christopher Faulet67957bd2017-09-27 11:00:59 +0200448 /* Name compression is in use */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200449 if ((*reader & 0xc0) == 0xc0) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100450 if (reader + 1 >= bufend)
451 goto err;
452
Christopher Faulet67957bd2017-09-27 11:00:59 +0200453 /* Must point BEFORE current position */
454 if ((buffer + reader[1]) > reader)
455 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200456
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100457 if (depth++ > 100)
458 goto err;
459
Nikhil Agrawal2fa66c32018-12-20 10:50:59 +0530460 n = dns_read_name(buffer, bufend, buffer + (*reader & 0x3f)*256 + reader[1],
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100461 dest, dest_len - nb_bytes, offset, depth);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200462 if (n == 0)
Christopher Faulet67957bd2017-09-27 11:00:59 +0200463 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200464
Christopher Faulet67957bd2017-09-27 11:00:59 +0200465 dest += n;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200466 nb_bytes += n;
467 goto out;
468 }
469
470 label_len = *reader;
471 if (label_len == 0)
472 goto out;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200473
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200474 /* Check if:
475 * - we won't read outside the buffer
476 * - there is enough place in the destination
477 */
478 if ((reader + label_len >= bufend) || (nb_bytes + label_len >= dest_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +0200479 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200480
481 /* +1 to take label len + label string */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200482 label_len++;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200483
484 memcpy(dest, reader, label_len);
485
Christopher Faulet67957bd2017-09-27 11:00:59 +0200486 dest += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200487 nb_bytes += label_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200488 reader += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200489 }
490
Christopher Faulet67957bd2017-09-27 11:00:59 +0200491 out:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200492 /* offset computation:
493 * parse from <name> until finding either NULL or a pointer "c0xx"
494 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200495 reader = name;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200496 *offset = 0;
497 while (reader < bufend) {
498 if ((reader[0] & 0xc0) == 0xc0) {
499 *offset += 2;
500 break;
501 }
502 else if (*reader == 0) {
503 *offset += 1;
504 break;
505 }
506 *offset += 1;
507 ++reader;
508 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200509 return nb_bytes;
510
Christopher Faulet67957bd2017-09-27 11:00:59 +0200511 err:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200512 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200513}
514
Christopher Faulet67957bd2017-09-27 11:00:59 +0200515/* Checks for any obsolete record, also identify any SRV request, and try to
516 * find a corresponding server.
517*/
518static void dns_check_dns_response(struct dns_resolution *res)
519{
520 struct dns_resolvers *resolvers = res->resolvers;
521 struct dns_requester *req, *reqback;
522 struct dns_answer_item *item, *itemback;
523 struct server *srv;
524 struct dns_srvrq *srvrq;
525
Baptiste Assmann13a92322019-06-07 09:40:55 +0200526 /* clean up obsolete Additional records */
527 list_for_each_entry_safe(item, itemback, &res->response.ar_list, list) {
528 if ((item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
529 LIST_DEL(&item->list);
530 pool_free(dns_answer_item_pool, item);
531 }
532 }
533
Christopher Faulet67957bd2017-09-27 11:00:59 +0200534 list_for_each_entry_safe(item, itemback, &res->response.answer_list, list) {
535
536 /* Remove obsolete items */
537 if ((item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
538 if (item->type != DNS_RTYPE_SRV)
539 goto rm_obselete_item;
540
541 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
542 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
543 continue;
544
545 /* Remove any associated server */
546 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100547 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200548 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
549 item->data_len == srv->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +0200550 !dns_hostname_cmp(srv->hostname_dn, item->target, item->data_len)) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200551 snr_update_srv_status(srv, 1);
552 free(srv->hostname);
553 free(srv->hostname_dn);
554 srv->hostname = NULL;
555 srv->hostname_dn = NULL;
556 srv->hostname_dn_len = 0;
557 dns_unlink_resolution(srv->dns_requester);
558 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100559 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200560 }
561 }
562
563 rm_obselete_item:
564 LIST_DEL(&item->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +0100565 pool_free(dns_answer_item_pool, item);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200566 continue;
567 }
568
569 if (item->type != DNS_RTYPE_SRV)
570 continue;
571
572 /* Now process SRV records */
573 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
574 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
575 continue;
576
577 /* Check if a server already uses that hostname */
578 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100579 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200580 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
581 item->data_len == srv->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +0200582 !dns_hostname_cmp(srv->hostname_dn, item->target, item->data_len) &&
Daniel Corbettf8716912019-11-17 09:48:56 -0500583 !srv->dns_opts.ignore_weight) {
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100584 int ha_weight;
585
Baptiste Assmann25e6fc22019-10-21 15:13:48 +0200586 /* DNS weight range if from 0 to 65535
587 * HAProxy weight is from 0 to 256
588 * The rule below ensures that weight 0 is well respected
589 * while allowing a "mapping" from DNS weight into HAProxy's one.
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100590 */
Baptiste Assmann25e6fc22019-10-21 15:13:48 +0200591 ha_weight = (item->weight + 255) / 256;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100592 if (srv->uweight != ha_weight) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200593 char weight[9];
594
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100595 snprintf(weight, sizeof(weight), "%d", ha_weight);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200596 server_parse_weight_change_request(srv, weight);
597 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100598 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200599 break;
600 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100601 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200602 }
603 if (srv)
604 continue;
605
606 /* If not, try to find a server with undefined hostname */
607 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100608 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200609 if (srv->srvrq == srvrq && !srv->hostname_dn)
610 break;
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100611 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200612 }
613 /* And update this server, if found */
614 if (srv) {
615 const char *msg = NULL;
616 char weight[9];
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100617 int ha_weight;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200618 char hostname[DNS_MAX_NAME_SIZE];
619
620 if (dns_dn_label_to_str(item->target, item->data_len+1,
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100621 hostname, DNS_MAX_NAME_SIZE) == -1) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100622 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200623 continue;
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100624 }
Baptiste Assmann13a92322019-06-07 09:40:55 +0200625
626 /* Check if an Additional Record is associated to this SRV record.
627 * Perform some sanity checks too to ensure the record can be used.
628 * If all fine, we simply pick up the IP address found and associate
629 * it to the server.
630 */
631 if ((item->ar_item != NULL) &&
632 (item->ar_item->type == DNS_RTYPE_A || item->ar_item->type == DNS_RTYPE_AAAA))
633 {
634
635 switch (item->ar_item->type) {
636 case DNS_RTYPE_A:
637 update_server_addr(srv, &(((struct sockaddr_in*)&item->ar_item->address)->sin_addr), AF_INET, "DNS additional recrd");
638 break;
639 case DNS_RTYPE_AAAA:
640 update_server_addr(srv, &(((struct sockaddr_in6*)&item->ar_item->address)->sin6_addr), AF_INET6, "DNS additional recrd");
641 break;
642 }
643
644 srv->flags |= SRV_F_NO_RESOLUTION;
645 }
646
Olivier Houchardd16bfe62017-10-31 15:21:19 +0100647 msg = update_server_fqdn(srv, hostname, "SRV record", 1);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200648 if (msg)
649 send_log(srv->proxy, LOG_NOTICE, "%s", msg);
650
651 srv->svc_port = item->port;
652 srv->flags &= ~SRV_F_MAPPORTS;
653 if ((srv->check.state & CHK_ST_CONFIGURED) &&
654 !(srv->flags & SRV_F_CHECKPORT))
655 srv->check.port = item->port;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100656
Daniel Corbettf8716912019-11-17 09:48:56 -0500657 if (!srv->dns_opts.ignore_weight) {
658 /* DNS weight range if from 0 to 65535
659 * HAProxy weight is from 0 to 256
660 * The rule below ensures that weight 0 is well respected
661 * while allowing a "mapping" from DNS weight into HAProxy's one.
662 */
663 ha_weight = (item->weight + 255) / 256;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100664
Daniel Corbettf8716912019-11-17 09:48:56 -0500665 snprintf(weight, sizeof(weight), "%d", ha_weight);
666 server_parse_weight_change_request(srv, weight);
667 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100668 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200669 }
670 }
671 }
672}
673
674/* Validates that the buffer DNS response provided in <resp> and finishing
675 * before <bufend> is valid from a DNS protocol point of view.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200676 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200677 * The result is stored in <resolution>' response, buf_response,
678 * response_query_records and response_answer_records members.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200679 *
680 * This function returns one of the DNS_RESP_* code to indicate the type of
681 * error found.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200682 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200683static int dns_validate_dns_response(unsigned char *resp, unsigned char *bufend,
684 struct dns_resolution *resolution, int max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200685{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200686 unsigned char *reader;
687 char *previous_dname, tmpname[DNS_MAX_NAME_SIZE];
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200688 int len, flags, offset;
689 int dns_query_record_id;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200690 int nb_saved_records;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200691 struct dns_query_item *dns_query;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200692 struct dns_answer_item *dns_answer_record, *tmp_record;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200693 struct dns_response_packet *dns_p;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200694 int i, found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200695
Christopher Faulet67957bd2017-09-27 11:00:59 +0200696 reader = resp;
697 len = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200698 previous_dname = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200699 dns_query = NULL;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200700
Christopher Faulet67957bd2017-09-27 11:00:59 +0200701 /* Initialization of response buffer and structure */
Baptiste Assmann729c9012017-05-22 15:13:10 +0200702 dns_p = &resolution->response;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200703
704 /* query id */
705 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200706 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200707 dns_p->header.id = reader[0] * 256 + reader[1];
708 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200709
Christopher Faulet67957bd2017-09-27 11:00:59 +0200710 /* Flags and rcode are stored over 2 bytes
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200711 * First byte contains:
712 * - response flag (1 bit)
713 * - opcode (4 bits)
714 * - authoritative (1 bit)
715 * - truncated (1 bit)
716 * - recursion desired (1 bit)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200717 */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200718 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200719 return DNS_RESP_INVALID;
720
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200721 flags = reader[0] * 256 + reader[1];
722
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200723 if ((flags & DNS_FLAG_REPLYCODE) != DNS_RCODE_NO_ERROR) {
724 if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_NX_DOMAIN)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200725 return DNS_RESP_NX_DOMAIN;
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200726 else if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_REFUSED)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200727 return DNS_RESP_REFUSED;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200728 return DNS_RESP_ERROR;
729 }
730
Christopher Faulet67957bd2017-09-27 11:00:59 +0200731 /* Move forward 2 bytes for flags */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200732 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200733
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200734 /* 2 bytes for question count */
735 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200736 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200737 dns_p->header.qdcount = reader[0] * 256 + reader[1];
Christopher Faulet67957bd2017-09-27 11:00:59 +0200738 /* (for now) we send one query only, so we expect only one in the
739 * response too */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200740 if (dns_p->header.qdcount != 1)
741 return DNS_RESP_QUERY_COUNT_ERROR;
742 if (dns_p->header.qdcount > DNS_MAX_QUERY_RECORDS)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200743 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200744 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200745
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200746 /* 2 bytes for answer count */
747 if (reader + 2 >= bufend)
748 return DNS_RESP_INVALID;
749 dns_p->header.ancount = reader[0] * 256 + reader[1];
750 if (dns_p->header.ancount == 0)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200751 return DNS_RESP_ANCOUNT_ZERO;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200752 /* Check if too many records are announced */
Baptiste Assmann9d8dbbc2017-08-18 23:35:08 +0200753 if (dns_p->header.ancount > max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200754 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200755 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200756
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200757 /* 2 bytes authority count */
758 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200759 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200760 dns_p->header.nscount = reader[0] * 256 + reader[1];
761 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200762
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200763 /* 2 bytes additional count */
764 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200765 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200766 dns_p->header.arcount = reader[0] * 256 + reader[1];
767 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200768
Christopher Faulet67957bd2017-09-27 11:00:59 +0200769 /* Parsing dns queries */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200770 LIST_INIT(&dns_p->query_list);
771 for (dns_query_record_id = 0; dns_query_record_id < dns_p->header.qdcount; dns_query_record_id++) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200772 /* Use next pre-allocated dns_query_item after ensuring there is
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200773 * still one available.
Christopher Faulet67957bd2017-09-27 11:00:59 +0200774 * It's then added to our packet query list. */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200775 if (dns_query_record_id > DNS_MAX_QUERY_RECORDS)
776 return DNS_RESP_INVALID;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200777 dns_query = &resolution->response_query_records[dns_query_record_id];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200778 LIST_ADDQ(&dns_p->query_list, &dns_query->list);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200779
Christopher Faulet67957bd2017-09-27 11:00:59 +0200780 /* Name is a NULL terminated string in our case, since we have
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200781 * one query per response and the first one can't be compressed
Christopher Faulet67957bd2017-09-27 11:00:59 +0200782 * (using the 0x0c format) */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200783 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100784 len = dns_read_name(resp, bufend, reader, dns_query->name, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200785
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200786 if (len == 0)
787 return DNS_RESP_INVALID;
788
789 reader += offset;
790 previous_dname = dns_query->name;
791
792 /* move forward 2 bytes for question type */
793 if (reader + 2 >= bufend)
794 return DNS_RESP_INVALID;
795 dns_query->type = reader[0] * 256 + reader[1];
796 reader += 2;
797
798 /* move forward 2 bytes for question class */
799 if (reader + 2 >= bufend)
800 return DNS_RESP_INVALID;
801 dns_query->class = reader[0] * 256 + reader[1];
802 reader += 2;
803 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200804
Baptiste Assmann251abb92017-08-11 09:58:27 +0200805 /* TRUNCATED flag must be checked after we could read the query type
Christopher Faulet67957bd2017-09-27 11:00:59 +0200806 * because a TRUNCATED SRV query type response can still be exploited */
Baptiste Assmann251abb92017-08-11 09:58:27 +0200807 if (dns_query->type != DNS_RTYPE_SRV && flags & DNS_FLAG_TRUNCATED)
808 return DNS_RESP_TRUNCATED;
809
Baptiste Assmann325137d2015-04-13 23:40:55 +0200810 /* now parsing response records */
Baptiste Assmann69fce672017-05-04 08:37:45 +0200811 nb_saved_records = 0;
Olivier Houchard8da5f982017-08-04 18:35:36 +0200812 for (i = 0; i < dns_p->header.ancount; i++) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200813 if (reader >= bufend)
814 return DNS_RESP_INVALID;
815
Willy Tarreaubafbe012017-11-24 17:34:44 +0100816 dns_answer_record = pool_alloc(dns_answer_item_pool);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200817 if (dns_answer_record == NULL)
818 return (DNS_RESP_INVALID);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200819
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200820 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100821 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200822
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200823 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100824 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200825 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200826 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200827
Christopher Faulet67957bd2017-09-27 11:00:59 +0200828 /* Check if the current record dname is valid. previous_dname
829 * points either to queried dname or last CNAME target */
Olivier Houchardb17b8842020-04-01 18:30:27 +0200830 if (dns_query->type != DNS_RTYPE_SRV && dns_hostname_cmp(previous_dname, tmpname, len) != 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100831 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200832 if (i == 0) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200833 /* First record, means a mismatch issue between
834 * queried dname and dname found in the first
835 * record */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200836 return DNS_RESP_INVALID;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200837 }
838 else {
839 /* If not the first record, this means we have a
840 * CNAME resolution error */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200841 return DNS_RESP_CNAME_ERROR;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200842 }
843
Baptiste Assmann325137d2015-04-13 23:40:55 +0200844 }
845
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200846 memcpy(dns_answer_record->name, tmpname, len);
847 dns_answer_record->name[len] = 0;
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200848
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200849 reader += offset;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200850 if (reader >= bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100851 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200852 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200853 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200854
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200855 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200856 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100857 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200858 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200859 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200860 dns_answer_record->type = reader[0] * 256 + reader[1];
861 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200862
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200863 /* 2 bytes for class (2) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200864 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100865 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200866 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200867 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200868 dns_answer_record->class = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200869 reader += 2;
870
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200871 /* 4 bytes for ttl (4) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200872 if (reader + 4 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100873 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200874 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200875 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200876 dns_answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
877 + reader[2] * 256 + reader[3];
878 reader += 4;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200879
Christopher Faulet67957bd2017-09-27 11:00:59 +0200880 /* Now reading data len */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200881 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100882 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200883 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200884 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200885 dns_answer_record->data_len = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200886
Christopher Faulet67957bd2017-09-27 11:00:59 +0200887 /* Move forward 2 bytes for data len */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200888 reader += 2;
889
Jérôme Magnin8d4e7dc2018-12-20 16:47:31 +0100890 if (reader + dns_answer_record->data_len > bufend) {
Remi Gacogneefbbdf72018-12-05 17:56:29 +0100891 pool_free(dns_answer_item_pool, dns_answer_record);
892 return DNS_RESP_INVALID;
893 }
894
Christopher Faulet67957bd2017-09-27 11:00:59 +0200895 /* Analyzing record content */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200896 switch (dns_answer_record->type) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200897 case DNS_RTYPE_A:
898 /* ipv4 is stored on 4 bytes */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200899 if (dns_answer_record->data_len != 4) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100900 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200901 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200902 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200903 dns_answer_record->address.sa_family = AF_INET;
904 memcpy(&(((struct sockaddr_in *)&dns_answer_record->address)->sin_addr),
905 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200906 break;
907
908 case DNS_RTYPE_CNAME:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200909 /* Check if this is the last record and update the caller about the status:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200910 * no IP could be found and last record was a CNAME. Could be triggered
911 * by a wrong query type
912 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200913 * + 1 because dns_answer_record_id starts at 0
914 * while number of answers is an integer and
915 * starts at 1.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200916 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200917 if (i + 1 == dns_p->header.ancount) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100918 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200919 return DNS_RESP_CNAME_ERROR;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200920 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200921
922 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100923 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200924 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100925 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200926 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200927 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200928
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200929 memcpy(dns_answer_record->target, tmpname, len);
930 dns_answer_record->target[len] = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200931 previous_dname = dns_answer_record->target;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200932 break;
933
Olivier Houchard8da5f982017-08-04 18:35:36 +0200934
935 case DNS_RTYPE_SRV:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200936 /* Answer must contain :
Olivier Houchard8da5f982017-08-04 18:35:36 +0200937 * - 2 bytes for the priority
938 * - 2 bytes for the weight
939 * - 2 bytes for the port
940 * - the target hostname
941 */
942 if (dns_answer_record->data_len <= 6) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100943 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200944 return DNS_RESP_INVALID;
945 }
Willy Tarreaud5370e12017-09-19 14:59:52 +0200946 dns_answer_record->priority = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200947 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200948 dns_answer_record->weight = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200949 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200950 dns_answer_record->port = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200951 reader += sizeof(uint16_t);
952 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100953 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200954 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100955 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200956 return DNS_RESP_INVALID;
957 }
Olivier Houchard8da5f982017-08-04 18:35:36 +0200958 dns_answer_record->data_len = len;
959 memcpy(dns_answer_record->target, tmpname, len);
960 dns_answer_record->target[len] = 0;
961 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200962
Baptiste Assmann325137d2015-04-13 23:40:55 +0200963 case DNS_RTYPE_AAAA:
964 /* ipv6 is stored on 16 bytes */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200965 if (dns_answer_record->data_len != 16) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100966 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200967 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200968 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200969 dns_answer_record->address.sa_family = AF_INET6;
970 memcpy(&(((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr),
971 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200972 break;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200973
Baptiste Assmann325137d2015-04-13 23:40:55 +0200974 } /* switch (record type) */
975
Christopher Faulet67957bd2017-09-27 11:00:59 +0200976 /* Increment the counter for number of records saved into our
977 * local response */
978 nb_saved_records++;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200979
Christopher Faulet67957bd2017-09-27 11:00:59 +0200980 /* Move forward dns_answer_record->data_len for analyzing next
981 * record in the response */
982 reader += ((dns_answer_record->type == DNS_RTYPE_SRV)
983 ? offset
984 : dns_answer_record->data_len);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200985
986 /* Lookup to see if we already had this entry */
Olivier Houchard8da5f982017-08-04 18:35:36 +0200987 found = 0;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200988 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
989 if (tmp_record->type != dns_answer_record->type)
990 continue;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200991
992 switch(tmp_record->type) {
993 case DNS_RTYPE_A:
994 if (!memcmp(&((struct sockaddr_in *)&dns_answer_record->address)->sin_addr,
995 &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
996 sizeof(in_addr_t)))
997 found = 1;
998 break;
999
1000 case DNS_RTYPE_AAAA:
1001 if (!memcmp(&((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr,
1002 &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
1003 sizeof(struct in6_addr)))
1004 found = 1;
1005 break;
1006
Olivier Houchard8da5f982017-08-04 18:35:36 +02001007 case DNS_RTYPE_SRV:
1008 if (dns_answer_record->data_len == tmp_record->data_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001009 !dns_hostname_cmp(dns_answer_record->target, tmp_record->target, dns_answer_record->data_len) &&
Olivier Houchard8da5f982017-08-04 18:35:36 +02001010 dns_answer_record->port == tmp_record->port) {
1011 tmp_record->weight = dns_answer_record->weight;
1012 found = 1;
1013 }
1014 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001015
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001016 default:
1017 break;
1018 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001019
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001020 if (found == 1)
1021 break;
1022 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001023
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001024 if (found == 1) {
1025 tmp_record->last_seen = now.tv_sec;
Willy Tarreaubafbe012017-11-24 17:34:44 +01001026 pool_free(dns_answer_item_pool, dns_answer_record);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001027 }
1028 else {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001029 dns_answer_record->last_seen = now.tv_sec;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001030 dns_answer_record->ar_item = NULL;
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001031 LIST_ADDQ(&dns_p->answer_list, &dns_answer_record->list);
1032 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001033 } /* for i 0 to ancount */
1034
Christopher Faulet67957bd2017-09-27 11:00:59 +02001035 /* Save the number of records we really own */
Baptiste Assmann69fce672017-05-04 08:37:45 +02001036 dns_p->header.ancount = nb_saved_records;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001037
Baptiste Assmann37950c82020-02-19 01:08:51 +01001038 /* now parsing additional records for SRV queries only */
1039 if (dns_query->type != DNS_RTYPE_SRV)
1040 goto skip_parsing_additional_records;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001041 nb_saved_records = 0;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001042 for (i = 0; i < dns_p->header.arcount; i++) {
1043 if (reader >= bufend)
1044 return DNS_RESP_INVALID;
1045
1046 dns_answer_record = pool_alloc(dns_answer_item_pool);
1047 if (dns_answer_record == NULL)
1048 return (DNS_RESP_INVALID);
1049
1050 offset = 0;
1051 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
1052
1053 if (len == 0) {
1054 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann37950c82020-02-19 01:08:51 +01001055 continue;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001056 }
1057
1058 memcpy(dns_answer_record->name, tmpname, len);
1059 dns_answer_record->name[len] = 0;
1060
1061 reader += offset;
1062 if (reader >= bufend) {
1063 pool_free(dns_answer_item_pool, dns_answer_record);
1064 return DNS_RESP_INVALID;
1065 }
1066
1067 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
1068 if (reader + 2 > bufend) {
1069 pool_free(dns_answer_item_pool, dns_answer_record);
1070 return DNS_RESP_INVALID;
1071 }
1072 dns_answer_record->type = reader[0] * 256 + reader[1];
1073 reader += 2;
1074
1075 /* 2 bytes for class (2) */
1076 if (reader + 2 > bufend) {
1077 pool_free(dns_answer_item_pool, dns_answer_record);
1078 return DNS_RESP_INVALID;
1079 }
1080 dns_answer_record->class = reader[0] * 256 + reader[1];
1081 reader += 2;
1082
1083 /* 4 bytes for ttl (4) */
1084 if (reader + 4 > bufend) {
1085 pool_free(dns_answer_item_pool, dns_answer_record);
1086 return DNS_RESP_INVALID;
1087 }
1088 dns_answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
1089 + reader[2] * 256 + reader[3];
1090 reader += 4;
1091
1092 /* Now reading data len */
1093 if (reader + 2 > bufend) {
1094 pool_free(dns_answer_item_pool, dns_answer_record);
1095 return DNS_RESP_INVALID;
1096 }
1097 dns_answer_record->data_len = reader[0] * 256 + reader[1];
1098
1099 /* Move forward 2 bytes for data len */
1100 reader += 2;
1101
1102 if (reader + dns_answer_record->data_len > bufend) {
1103 pool_free(dns_answer_item_pool, dns_answer_record);
1104 return DNS_RESP_INVALID;
1105 }
1106
1107 /* Analyzing record content */
1108 switch (dns_answer_record->type) {
1109 case DNS_RTYPE_A:
1110 /* ipv4 is stored on 4 bytes */
1111 if (dns_answer_record->data_len != 4) {
1112 pool_free(dns_answer_item_pool, dns_answer_record);
1113 return DNS_RESP_INVALID;
1114 }
1115 dns_answer_record->address.sa_family = AF_INET;
1116 memcpy(&(((struct sockaddr_in *)&dns_answer_record->address)->sin_addr),
1117 reader, dns_answer_record->data_len);
1118 break;
1119
1120 case DNS_RTYPE_AAAA:
1121 /* ipv6 is stored on 16 bytes */
1122 if (dns_answer_record->data_len != 16) {
1123 pool_free(dns_answer_item_pool, dns_answer_record);
1124 return DNS_RESP_INVALID;
1125 }
1126 dns_answer_record->address.sa_family = AF_INET6;
1127 memcpy(&(((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr),
1128 reader, dns_answer_record->data_len);
1129 break;
1130
1131 default:
1132 pool_free(dns_answer_item_pool, dns_answer_record);
1133 continue;
1134
1135 } /* switch (record type) */
1136
1137 /* Increment the counter for number of records saved into our
1138 * local response */
1139 nb_saved_records++;
1140
1141 /* Move forward dns_answer_record->data_len for analyzing next
1142 * record in the response */
1143 reader += ((dns_answer_record->type == DNS_RTYPE_SRV)
1144 ? offset
1145 : dns_answer_record->data_len);
1146
1147 /* Lookup to see if we already had this entry */
1148 found = 0;
1149 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
1150 if (tmp_record->type != dns_answer_record->type)
1151 continue;
1152
1153 switch(tmp_record->type) {
1154 case DNS_RTYPE_A:
1155 if (!memcmp(&((struct sockaddr_in *)&dns_answer_record->address)->sin_addr,
1156 &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
1157 sizeof(in_addr_t)))
1158 found = 1;
1159 break;
1160
1161 case DNS_RTYPE_AAAA:
1162 if (!memcmp(&((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr,
1163 &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
1164 sizeof(struct in6_addr)))
1165 found = 1;
1166 break;
1167
1168 default:
1169 break;
1170 }
1171
1172 if (found == 1)
1173 break;
1174 }
1175
1176 if (found == 1) {
1177 tmp_record->last_seen = now.tv_sec;
1178 pool_free(dns_answer_item_pool, dns_answer_record);
1179 }
1180 else {
1181 dns_answer_record->last_seen = now.tv_sec;
1182 dns_answer_record->ar_item = NULL;
1183
1184 // looking for the SRV record in the response list linked to this additional record
1185 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
1186 if ( !(
1187 (tmp_record->type == DNS_RTYPE_SRV) &&
1188 (tmp_record->ar_item == NULL) &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001189 (dns_hostname_cmp(tmp_record->target, dns_answer_record->name, tmp_record->data_len) == 0)
Baptiste Assmann13a92322019-06-07 09:40:55 +02001190 )
1191 )
1192 continue;
1193 tmp_record->ar_item = dns_answer_record;
1194 }
Baptiste Assmann13a92322019-06-07 09:40:55 +02001195
1196 LIST_ADDQ(&dns_p->ar_list, &dns_answer_record->list);
1197 }
1198 } /* for i 0 to arcount */
1199
Baptiste Assmann37950c82020-02-19 01:08:51 +01001200 skip_parsing_additional_records:
1201
Baptiste Assmann13a92322019-06-07 09:40:55 +02001202 /* Save the number of records we really own */
1203 dns_p->header.arcount = nb_saved_records;
1204
Christopher Faulet67957bd2017-09-27 11:00:59 +02001205 dns_check_dns_response(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001206 return DNS_RESP_VALID;
1207}
1208
Christopher Faulet67957bd2017-09-27 11:00:59 +02001209/* Searches dn_name resolution in resp.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001210 * If existing IP not found, return the first IP matching family_priority,
1211 * otherwise, first ip found
1212 * The following tasks are the responsibility of the caller:
Baptiste Assmann3cf7f982016-04-17 22:43:26 +02001213 * - <dns_p> contains an error free DNS response
Baptiste Assmann325137d2015-04-13 23:40:55 +02001214 * For both cases above, dns_validate_dns_response is required
1215 * returns one of the DNS_UPD_* code
1216 */
Baptiste Assmannfb7091e2017-05-03 15:43:12 +02001217int dns_get_ip_from_response(struct dns_response_packet *dns_p,
Baptiste Assmann42746372017-05-03 12:12:02 +02001218 struct dns_options *dns_opts, void *currentip,
Thierry Fournierada34842016-02-17 21:25:09 +01001219 short currentip_sin_family,
Baptiste Assmannfb7091e2017-05-03 15:43:12 +02001220 void **newip, short *newip_sin_family,
1221 void *owner)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001222{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +02001223 struct dns_answer_item *record;
Thierry Fournierada34842016-02-17 21:25:09 +01001224 int family_priority;
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001225 int currentip_found;
Baptiste Assmann3cf7f982016-04-17 22:43:26 +02001226 unsigned char *newip4, *newip6;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001227 int currentip_sel;
1228 int j;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001229 int score, max_score;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001230 int allowed_duplicated_ip;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001231
Christopher Faulet67957bd2017-09-27 11:00:59 +02001232 family_priority = dns_opts->family_prio;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001233 allowed_duplicated_ip = dns_opts->accept_duplicate_ip;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001234 *newip = newip4 = newip6 = NULL;
1235 currentip_found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001236 *newip_sin_family = AF_UNSPEC;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001237 max_score = -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001238
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001239 /* Select an IP regarding configuration preference.
Joseph Herlant42cf6392018-11-15 10:33:28 -08001240 * Top priority is the preferred network ip version,
1241 * second priority is the preferred network.
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001242 * the last priority is the currently used IP,
1243 *
1244 * For these three priorities, a score is calculated. The
1245 * weight are:
Joseph Herlant42cf6392018-11-15 10:33:28 -08001246 * 8 - preferred ip version.
1247 * 4 - preferred network.
Baptistefc725902016-12-26 23:21:08 +01001248 * 2 - if the ip in the record is not affected to any other server in the same backend (duplication)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001249 * 1 - current ip.
1250 * The result with the biggest score is returned.
1251 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001252
1253 list_for_each_entry(record, &dns_p->answer_list, list) {
1254 void *ip;
1255 unsigned char ip_type;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001256
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001257 if (record->type == DNS_RTYPE_A) {
1258 ip = &(((struct sockaddr_in *)&record->address)->sin_addr);
1259 ip_type = AF_INET;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001260 }
1261 else if (record->type == DNS_RTYPE_AAAA) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001262 ip_type = AF_INET6;
1263 ip = &(((struct sockaddr_in6 *)&record->address)->sin6_addr);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001264 }
1265 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001266 continue;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001267 score = 0;
1268
Joseph Herlant42cf6392018-11-15 10:33:28 -08001269 /* Check for preferred ip protocol. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001270 if (ip_type == family_priority)
Baptistefc725902016-12-26 23:21:08 +01001271 score += 8;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001272
Joseph Herlant42cf6392018-11-15 10:33:28 -08001273 /* Check for preferred network. */
Baptiste Assmann42746372017-05-03 12:12:02 +02001274 for (j = 0; j < dns_opts->pref_net_nb; j++) {
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001275
1276 /* Compare only the same adresses class. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001277 if (dns_opts->pref_net[j].family != ip_type)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001278 continue;
1279
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001280 if ((ip_type == AF_INET &&
1281 in_net_ipv4(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001282 &dns_opts->pref_net[j].mask.in4,
1283 &dns_opts->pref_net[j].addr.in4)) ||
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001284 (ip_type == AF_INET6 &&
1285 in_net_ipv6(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001286 &dns_opts->pref_net[j].mask.in6,
1287 &dns_opts->pref_net[j].addr.in6))) {
Baptistefc725902016-12-26 23:21:08 +01001288 score += 4;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001289 break;
1290 }
1291 }
1292
Christopher Faulet67957bd2017-09-27 11:00:59 +02001293 /* Check if the IP found in the record is already affected to a
Baptiste Assmann84221b42018-06-22 13:03:50 +02001294 * member of a group. If not, the score should be incremented
Christopher Faulet67957bd2017-09-27 11:00:59 +02001295 * by 2. */
Baptiste Assmann84221b42018-06-22 13:03:50 +02001296 if (owner && snr_check_ip_callback(owner, ip, &ip_type)) {
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001297 if (!allowed_duplicated_ip) {
1298 continue;
1299 }
Baptiste Assmann84221b42018-06-22 13:03:50 +02001300 } else {
1301 score += 2;
1302 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001303
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001304 /* Check for current ip matching. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001305 if (ip_type == currentip_sin_family &&
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001306 ((currentip_sin_family == AF_INET &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001307 !memcmp(ip, currentip, 4)) ||
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001308 (currentip_sin_family == AF_INET6 &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001309 !memcmp(ip, currentip, 16)))) {
1310 score++;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001311 currentip_sel = 1;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001312 }
1313 else
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001314 currentip_sel = 0;
1315
1316 /* Keep the address if the score is better than the previous
Christopher Faulet67957bd2017-09-27 11:00:59 +02001317 * score. The maximum score is 15, if this value is reached, we
1318 * break the parsing. Implicitly, this score is reached the ip
1319 * selected is the current ip. */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001320 if (score > max_score) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001321 if (ip_type == AF_INET)
1322 newip4 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001323 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001324 newip6 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001325 currentip_found = currentip_sel;
Baptistefc725902016-12-26 23:21:08 +01001326 if (score == 15)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001327 return DNS_UPD_NO;
1328 max_score = score;
1329 }
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001330 } /* list for each record entries */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001331
Christopher Faulet67957bd2017-09-27 11:00:59 +02001332 /* No IP found in the response */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001333 if (!newip4 && !newip6)
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001334 return DNS_UPD_NO_IP_FOUND;
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001335
Christopher Faulet67957bd2017-09-27 11:00:59 +02001336 /* Case when the caller looks first for an IPv4 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001337 if (family_priority == AF_INET) {
1338 if (newip4) {
1339 *newip = newip4;
1340 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001341 }
1342 else if (newip6) {
1343 *newip = newip6;
1344 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001345 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001346 if (!currentip_found)
1347 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001348 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001349 /* Case when the caller looks first for an IPv6 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001350 else if (family_priority == AF_INET6) {
1351 if (newip6) {
1352 *newip = newip6;
1353 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001354 }
1355 else if (newip4) {
1356 *newip = newip4;
1357 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001358 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001359 if (!currentip_found)
1360 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001361 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001362 /* Case when the caller have no preference (we prefer IPv6) */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001363 else if (family_priority == AF_UNSPEC) {
1364 if (newip6) {
1365 *newip = newip6;
1366 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001367 }
1368 else if (newip4) {
1369 *newip = newip4;
1370 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001371 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001372 if (!currentip_found)
1373 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001374 }
1375
Christopher Faulet67957bd2017-09-27 11:00:59 +02001376 /* No reason why we should change the server's IP address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001377 return DNS_UPD_NO;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001378
Christopher Faulet67957bd2017-09-27 11:00:59 +02001379 not_found:
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001380 list_for_each_entry(record, &dns_p->answer_list, list) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001381 /* Move the first record to the end of the list, for internal
1382 * round robin */
1383 LIST_DEL(&record->list);
1384 LIST_ADDQ(&dns_p->answer_list, &record->list);
1385 break;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001386 }
1387 return DNS_UPD_SRVIP_NOT_FOUND;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001388}
1389
Christopher Faulet67957bd2017-09-27 11:00:59 +02001390/* Turns a domain name label into a string.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001391 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001392 * <dn> must be a null-terminated string. <dn_len> must include the terminating
1393 * null byte. <str> must be allocated and its size must be passed in <str_len>.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001394 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001395 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1396 * <str> (including the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001397 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001398int dns_dn_label_to_str(const char *dn, int dn_len, char *str, int str_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001399{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001400 char *ptr;
1401 int i, sz;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001402
Christopher Faulet67957bd2017-09-27 11:00:59 +02001403 if (str_len < dn_len - 1)
Baptiste Assmann2af08fe2017-08-14 00:13:01 +02001404 return -1;
1405
Christopher Faulet67957bd2017-09-27 11:00:59 +02001406 ptr = str;
1407 for (i = 0; i < dn_len-1; ++i) {
1408 sz = dn[i];
1409 if (i)
1410 *ptr++ = '.';
1411 memcpy(ptr, dn+i+1, sz);
1412 ptr += sz;
1413 i += sz;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001414 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001415 *ptr++ = '\0';
1416 return (ptr - str);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001417}
1418
Christopher Faulet67957bd2017-09-27 11:00:59 +02001419/* Turns a string into domain name label: www.haproxy.org into 3www7haproxy3org
1420 *
1421 * <str> must be a null-terminated string. <str_len> must include the
1422 * terminating null byte. <dn> buffer must be allocated and its size must be
1423 * passed in <dn_len>.
1424 *
1425 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1426 * <dn> (excluding the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001427 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001428int dns_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001429{
Baptiste Assmann325137d2015-04-13 23:40:55 +02001430 int i, offset;
1431
Christopher Faulet67957bd2017-09-27 11:00:59 +02001432 if (dn_len < str_len + 1)
1433 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001434
Christopher Faulet67957bd2017-09-27 11:00:59 +02001435 /* First byte of dn will be used to store the length of the first
1436 * label */
1437 offset = 0;
1438 for (i = 0; i < str_len; ++i) {
1439 if (str[i] == '.') {
1440 /* 2 or more consecutive dots is invalid */
1441 if (i == offset)
1442 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001443
Lukas Tribus81725b82020-02-27 15:47:24 +01001444 /* ignore trailing dot */
1445 if (i + 2 == str_len) {
1446 i++;
1447 break;
1448 }
1449
Christopher Faulet67957bd2017-09-27 11:00:59 +02001450 dn[offset] = (i - offset);
1451 offset = i+1;
1452 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001453 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001454 dn[i+1] = str[i];
Baptiste Assmann325137d2015-04-13 23:40:55 +02001455 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001456 dn[offset] = (i - offset - 1);
1457 dn[i] = '\0';
1458 return i;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001459}
1460
Christopher Faulet67957bd2017-09-27 11:00:59 +02001461/* Validates host name:
Baptiste Assmann325137d2015-04-13 23:40:55 +02001462 * - total size
1463 * - each label size individually
1464 * returns:
1465 * 0 in case of error. If <err> is not NULL, an error message is stored there.
1466 * 1 when no error. <err> is left unaffected.
1467 */
1468int dns_hostname_validation(const char *string, char **err)
1469{
Baptiste Assmann325137d2015-04-13 23:40:55 +02001470 int i;
1471
1472 if (strlen(string) > DNS_MAX_NAME_SIZE) {
1473 if (err)
1474 *err = DNS_TOO_LONG_FQDN;
1475 return 0;
1476 }
1477
William Dauchyaecd5dc2020-01-26 19:52:34 +01001478 while (*string) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001479 i = 0;
William Dauchyaecd5dc2020-01-26 19:52:34 +01001480 while (*string && *string != '.' && i < DNS_MAX_LABEL_SIZE) {
1481 if (!(*string == '-' || *string == '_' ||
1482 (*string >= 'a' && *string <= 'z') ||
1483 (*string >= 'A' && *string <= 'Z') ||
1484 (*string >= '0' && *string <= '9'))) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001485 if (err)
1486 *err = DNS_INVALID_CHARACTER;
1487 return 0;
1488 }
William Dauchyaecd5dc2020-01-26 19:52:34 +01001489 i++;
1490 string++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001491 }
1492
William Dauchyaecd5dc2020-01-26 19:52:34 +01001493 if (!(*string))
1494 break;
1495
1496 if (*string != '.' && i >= DNS_MAX_LABEL_SIZE) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001497 if (err)
1498 *err = DNS_LABEL_TOO_LONG;
1499 return 0;
1500 }
1501
William Dauchyaecd5dc2020-01-26 19:52:34 +01001502 string++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001503 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001504 return 1;
1505}
1506
Christopher Faulet67957bd2017-09-27 11:00:59 +02001507/* Picks up an available resolution from the different resolution list
1508 * associated to a resolvers section, in this order:
1509 * 1. check in resolutions.curr for the same hostname and query_type
1510 * 2. check in resolutions.wait for the same hostname and query_type
1511 * 3. Get a new resolution from resolution pool
1512 *
1513 * Returns an available resolution, NULL if none found.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001514 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001515static struct dns_resolution *dns_pick_resolution(struct dns_resolvers *resolvers,
1516 char **hostname_dn, int hostname_dn_len,
1517 int query_type)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001518{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001519 struct dns_resolution *res;
1520
1521 if (!*hostname_dn)
1522 goto from_pool;
1523
1524 /* Search for same hostname and query type in resolutions.curr */
1525 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
1526 if (!res->hostname_dn)
1527 continue;
1528 if ((query_type == res->prefered_query_type) &&
1529 hostname_dn_len == res->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001530 !dns_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +02001531 return res;
1532 }
1533
1534 /* Search for same hostname and query type in resolutions.wait */
1535 list_for_each_entry(res, &resolvers->resolutions.wait, list) {
1536 if (!res->hostname_dn)
1537 continue;
1538 if ((query_type == res->prefered_query_type) &&
1539 hostname_dn_len == res->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001540 !dns_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +02001541 return res;
1542 }
1543
1544 from_pool:
1545 /* No resolution could be found, so let's allocate a new one */
Willy Tarreaubafbe012017-11-24 17:34:44 +01001546 res = pool_alloc(dns_resolution_pool);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001547 if (res) {
1548 memset(res, 0, sizeof(*res));
1549 res->resolvers = resolvers;
1550 res->uuid = resolution_uuid;
1551 res->status = RSLV_STATUS_NONE;
1552 res->step = RSLV_STEP_NONE;
1553 res->last_valid = now_ms;
1554
1555 LIST_INIT(&res->requesters);
1556 LIST_INIT(&res->response.answer_list);
Baptiste Assmann13a92322019-06-07 09:40:55 +02001557 LIST_INIT(&res->response.ar_list);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001558
1559 res->prefered_query_type = query_type;
1560 res->query_type = query_type;
1561 res->hostname_dn = *hostname_dn;
1562 res->hostname_dn_len = hostname_dn_len;
1563
1564 ++resolution_uuid;
1565
1566 /* Move the resolution to the resolvers wait queue */
1567 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1568 }
1569 return res;
1570}
1571
1572/* Releases a resolution from its requester(s) and move it back to the pool */
1573static void dns_free_resolution(struct dns_resolution *resolution)
1574{
1575 struct dns_requester *req, *reqback;
1576
1577 /* clean up configuration */
1578 dns_reset_resolution(resolution);
1579 resolution->hostname_dn = NULL;
1580 resolution->hostname_dn_len = 0;
1581
1582 list_for_each_entry_safe(req, reqback, &resolution->requesters, list) {
1583 LIST_DEL(&req->list);
1584 req->resolution = NULL;
1585 }
1586
1587 LIST_DEL(&resolution->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +01001588 pool_free(dns_resolution_pool, resolution);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001589}
1590
1591/* Links a requester (a server or a dns_srvrq) with a resolution. It returns 0
1592 * on success, -1 otherwise.
1593 */
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001594int dns_link_resolution(void *requester, int requester_type, int requester_locked)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001595{
1596 struct dns_resolution *res = NULL;
1597 struct dns_requester *req;
1598 struct dns_resolvers *resolvers;
1599 struct server *srv = NULL;
1600 struct dns_srvrq *srvrq = NULL;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001601 struct stream *stream = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001602 char **hostname_dn;
1603 int hostname_dn_len, query_type;
1604
1605 switch (requester_type) {
1606 case OBJ_TYPE_SERVER:
1607 srv = (struct server *)requester;
1608 hostname_dn = &srv->hostname_dn;
1609 hostname_dn_len = srv->hostname_dn_len;
1610 resolvers = srv->resolvers;
1611 query_type = ((srv->dns_opts.family_prio == AF_INET)
1612 ? DNS_RTYPE_A
1613 : DNS_RTYPE_AAAA);
1614 break;
1615
1616 case OBJ_TYPE_SRVRQ:
1617 srvrq = (struct dns_srvrq *)requester;
1618 hostname_dn = &srvrq->hostname_dn;
1619 hostname_dn_len = srvrq->hostname_dn_len;
1620 resolvers = srvrq->resolvers;
1621 query_type = DNS_RTYPE_SRV;
1622 break;
1623
Baptiste Assmann333939c2019-01-21 08:34:50 +01001624 case OBJ_TYPE_STREAM:
1625 stream = (struct stream *)requester;
1626 hostname_dn = &stream->dns_ctx.hostname_dn;
1627 hostname_dn_len = stream->dns_ctx.hostname_dn_len;
1628 resolvers = stream->dns_ctx.parent->arg.dns.resolvers;
Christopher Fauleta4168432020-01-24 18:08:42 +01001629 query_type = ((stream->dns_ctx.parent->arg.dns.dns_opts->family_prio == AF_INET)
Baptiste Assmann333939c2019-01-21 08:34:50 +01001630 ? DNS_RTYPE_A
1631 : DNS_RTYPE_AAAA);
1632 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001633 default:
1634 goto err;
1635 }
1636
1637 /* Get a resolution from the resolvers' wait queue or pool */
1638 if ((res = dns_pick_resolution(resolvers, hostname_dn, hostname_dn_len, query_type)) == NULL)
1639 goto err;
1640
1641 if (srv) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001642 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001643 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001644 if (srv->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001645 if ((req = pool_alloc(dns_requester_pool)) == NULL) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001646 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001647 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001648 goto err;
Willy Tarreau5ec84572017-11-05 10:35:57 +01001649 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001650 req->owner = &srv->obj_type;
1651 srv->dns_requester = req;
1652 }
1653 else
1654 req = srv->dns_requester;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001655 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001656 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001657
1658 req->requester_cb = snr_resolution_cb;
1659 req->requester_error_cb = snr_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001660 }
1661 else if (srvrq) {
1662 if (srvrq->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001663 if ((req = pool_alloc(dns_requester_pool)) == NULL)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001664 goto err;
1665 req->owner = &srvrq->obj_type;
1666 srvrq->dns_requester = req;
1667 }
1668 else
1669 req = srvrq->dns_requester;
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001670
1671 req->requester_cb = snr_resolution_cb;
1672 req->requester_error_cb = snr_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001673 }
Baptiste Assmann333939c2019-01-21 08:34:50 +01001674 else if (stream) {
1675 if (stream->dns_ctx.dns_requester == NULL) {
1676 if ((req = pool_alloc(dns_requester_pool)) == NULL)
1677 goto err;
1678 req->owner = &stream->obj_type;
1679 stream->dns_ctx.dns_requester = req;
1680 }
1681 else
1682 req = stream->dns_ctx.dns_requester;
1683
1684 req->requester_cb = act_resolution_cb;
1685 req->requester_error_cb = act_resolution_error_cb;
1686 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001687 else
1688 goto err;
1689
1690 req->resolution = res;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001691
1692 LIST_ADDQ(&res->requesters, &req->list);
1693 return 0;
1694
1695 err:
1696 if (res && LIST_ISEMPTY(&res->requesters))
1697 dns_free_resolution(res);
1698 return -1;
1699}
1700
1701/* Removes a requester from a DNS resoltion. It takes takes care of all the
1702 * consequences. It also cleans up some parameters from the requester.
1703 */
1704void dns_unlink_resolution(struct dns_requester *requester)
1705{
1706 struct dns_resolution *res;
1707 struct dns_requester *req;
1708
1709 /* Nothing to do */
1710 if (!requester || !requester->resolution)
1711 return;
1712 res = requester->resolution;
1713
1714 /* Clean up the requester */
1715 LIST_DEL(&requester->list);
1716 requester->resolution = NULL;
1717
1718 /* We need to find another requester linked on this resolution */
1719 if (!LIST_ISEMPTY(&res->requesters))
1720 req = LIST_NEXT(&res->requesters, struct dns_requester *, list);
1721 else {
1722 dns_free_resolution(res);
1723 return;
1724 }
1725
1726 /* Move hostname_dn related pointers to the next requester */
1727 switch (obj_type(req->owner)) {
1728 case OBJ_TYPE_SERVER:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001729 res->hostname_dn = __objt_server(req->owner)->hostname_dn;
1730 res->hostname_dn_len = __objt_server(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001731 break;
1732 case OBJ_TYPE_SRVRQ:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001733 res->hostname_dn = __objt_dns_srvrq(req->owner)->hostname_dn;
1734 res->hostname_dn_len = __objt_dns_srvrq(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001735 break;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001736 case OBJ_TYPE_STREAM:
1737 res->hostname_dn = __objt_stream(req->owner)->dns_ctx.hostname_dn;
1738 res->hostname_dn_len = __objt_stream(req->owner)->dns_ctx.hostname_dn_len;
1739 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001740 default:
1741 res->hostname_dn = NULL;
1742 res->hostname_dn_len = 0;
1743 break;
1744 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001745}
1746
Christopher Faulet67957bd2017-09-27 11:00:59 +02001747/* Called when a network IO is generated on a name server socket for an incoming
1748 * packet. It performs the following actions:
1749 * - check if the packet requires processing (not outdated resolution)
1750 * - ensure the DNS packet received is valid and call requester's callback
1751 * - call requester's error callback if invalid response
1752 * - check the dn_name in the packet against the one sent
1753 */
1754static void dns_resolve_recv(struct dgram_conn *dgram)
1755{
1756 struct dns_nameserver *ns, *tmpns;
1757 struct dns_resolvers *resolvers;
1758 struct dns_resolution *res;
1759 struct dns_query_item *query;
1760 unsigned char buf[DNS_MAX_UDP_MESSAGE + 1];
1761 unsigned char *bufend;
1762 int fd, buflen, dns_resp;
1763 int max_answer_records;
1764 unsigned short query_id;
1765 struct eb32_node *eb;
1766 struct dns_requester *req;
1767
1768 fd = dgram->t.sock.fd;
1769
1770 /* check if ready for reading */
1771 if (!fd_recv_ready(fd))
1772 return;
1773
1774 /* no need to go further if we can't retrieve the nameserver */
Willy Tarreau1c759952019-12-10 18:38:09 +01001775 if ((ns = dgram->owner) == NULL) {
1776 _HA_ATOMIC_AND(&fdtab[fd].ev, ~(FD_POLL_HUP|FD_POLL_ERR));
1777 fd_stop_recv(fd);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001778 return;
Willy Tarreau1c759952019-12-10 18:38:09 +01001779 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001780
1781 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001782 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001783
1784 /* process all pending input messages */
Willy Tarreau1c759952019-12-10 18:38:09 +01001785 while (fd_recv_ready(fd)) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001786 /* read message received */
1787 memset(buf, '\0', resolvers->accepted_payload_size + 1);
1788 if ((buflen = recv(fd, (char*)buf , resolvers->accepted_payload_size + 1, 0)) < 0) {
Willy Tarreau1c759952019-12-10 18:38:09 +01001789 /* FIXME : for now we consider EAGAIN only, but at
1790 * least we purge sticky errors that would cause us to
1791 * be called in loops.
1792 */
1793 _HA_ATOMIC_AND(&fdtab[fd].ev, ~(FD_POLL_HUP|FD_POLL_ERR));
Christopher Faulet67957bd2017-09-27 11:00:59 +02001794 fd_cant_recv(fd);
1795 break;
1796 }
1797
1798 /* message too big */
1799 if (buflen > resolvers->accepted_payload_size) {
1800 ns->counters.too_big++;
1801 continue;
1802 }
1803
1804 /* initializing variables */
1805 bufend = buf + buflen; /* pointer to mark the end of the buffer */
1806
1807 /* read the query id from the packet (16 bits) */
1808 if (buf + 2 > bufend) {
1809 ns->counters.invalid++;
1810 continue;
1811 }
1812 query_id = dns_response_get_query_id(buf);
1813
1814 /* search the query_id in the pending resolution tree */
1815 eb = eb32_lookup(&resolvers->query_ids, query_id);
1816 if (eb == NULL) {
1817 /* unknown query id means an outdated response and can be safely ignored */
1818 ns->counters.outdated++;
1819 continue;
1820 }
1821
William Dauchybe8a3872019-11-27 23:32:41 +01001822 /* known query id means a resolution in progress */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001823 res = eb32_entry(eb, struct dns_resolution, qid);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001824 /* number of responses received */
1825 res->nb_responses++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001826
Christopher Faulet67957bd2017-09-27 11:00:59 +02001827 max_answer_records = (resolvers->accepted_payload_size - DNS_HEADER_SIZE) / DNS_MIN_RECORD_SIZE;
1828 dns_resp = dns_validate_dns_response(buf, bufend, res, max_answer_records);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001829
Christopher Faulet67957bd2017-09-27 11:00:59 +02001830 switch (dns_resp) {
1831 case DNS_RESP_VALID:
1832 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001833
Christopher Faulet67957bd2017-09-27 11:00:59 +02001834 case DNS_RESP_INVALID:
1835 case DNS_RESP_QUERY_COUNT_ERROR:
1836 case DNS_RESP_WRONG_NAME:
1837 res->status = RSLV_STATUS_INVALID;
1838 ns->counters.invalid++;
1839 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001840
Christopher Faulet67957bd2017-09-27 11:00:59 +02001841 case DNS_RESP_NX_DOMAIN:
1842 res->status = RSLV_STATUS_NX;
1843 ns->counters.nx++;
1844 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001845
Christopher Faulet67957bd2017-09-27 11:00:59 +02001846 case DNS_RESP_REFUSED:
1847 res->status = RSLV_STATUS_REFUSED;
1848 ns->counters.refused++;
1849 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001850
Christopher Faulet67957bd2017-09-27 11:00:59 +02001851 case DNS_RESP_ANCOUNT_ZERO:
1852 res->status = RSLV_STATUS_OTHER;
1853 ns->counters.any_err++;
1854 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001855
Christopher Faulet67957bd2017-09-27 11:00:59 +02001856 case DNS_RESP_CNAME_ERROR:
1857 res->status = RSLV_STATUS_OTHER;
1858 ns->counters.cname_error++;
1859 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001860
Christopher Faulet67957bd2017-09-27 11:00:59 +02001861 case DNS_RESP_TRUNCATED:
1862 res->status = RSLV_STATUS_OTHER;
1863 ns->counters.truncated++;
1864 break;
Baptiste Assmanne70bc052017-08-21 16:51:09 +02001865
Christopher Faulet67957bd2017-09-27 11:00:59 +02001866 case DNS_RESP_NO_EXPECTED_RECORD:
1867 case DNS_RESP_ERROR:
1868 case DNS_RESP_INTERNAL:
1869 res->status = RSLV_STATUS_OTHER;
1870 ns->counters.other++;
1871 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001872 }
1873
Christopher Faulet67957bd2017-09-27 11:00:59 +02001874 /* Wait all nameservers response to handle errors */
1875 if (dns_resp != DNS_RESP_VALID && res->nb_responses < resolvers->nb_nameservers)
1876 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001877
Christopher Faulet67957bd2017-09-27 11:00:59 +02001878 /* Process error codes */
1879 if (dns_resp != DNS_RESP_VALID) {
1880 if (res->prefered_query_type != res->query_type) {
1881 /* The fallback on the query type was already performed,
1882 * so check the try counter. If it falls to 0, we can
1883 * report an error. Else, wait the next attempt. */
1884 if (!res->try)
1885 goto report_res_error;
1886 }
1887 else {
1888 /* Fallback from A to AAAA or the opposite and re-send
1889 * the resolution immediately. try counter is not
1890 * decremented. */
1891 if (res->prefered_query_type == DNS_RTYPE_A) {
1892 res->query_type = DNS_RTYPE_AAAA;
1893 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001894 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001895 else if (res->prefered_query_type == DNS_RTYPE_AAAA) {
1896 res->query_type = DNS_RTYPE_A;
1897 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001898 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001899 }
1900 continue;
1901 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001902
Christopher Faulet67957bd2017-09-27 11:00:59 +02001903 /* Now let's check the query's dname corresponds to the one we
1904 * sent. We can check only the first query of the list. We send
1905 * one query at a time so we get one query in the response */
1906 query = LIST_NEXT(&res->response.query_list, struct dns_query_item *, list);
Olivier Houchardb17b8842020-04-01 18:30:27 +02001907 if (query && dns_hostname_cmp(query->name, res->hostname_dn, res->hostname_dn_len) != 0) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001908 dns_resp = DNS_RESP_WRONG_NAME;
1909 ns->counters.other++;
1910 goto report_res_error;
1911 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001912
Christopher Faulet67957bd2017-09-27 11:00:59 +02001913 /* So the resolution succeeded */
1914 res->status = RSLV_STATUS_VALID;
1915 res->last_valid = now_ms;
1916 ns->counters.valid++;
1917 goto report_res_success;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001918
Christopher Faulet67957bd2017-09-27 11:00:59 +02001919 report_res_error:
1920 list_for_each_entry(req, &res->requesters, list)
1921 req->requester_error_cb(req, dns_resp);
1922 dns_reset_resolution(res);
1923 LIST_DEL(&res->list);
1924 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1925 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001926
Christopher Faulet67957bd2017-09-27 11:00:59 +02001927 report_res_success:
1928 /* Only the 1rst requester s managed by the server, others are
1929 * from the cache */
1930 tmpns = ns;
1931 list_for_each_entry(req, &res->requesters, list) {
Olivier Houchard28381072017-11-06 17:30:28 +01001932 struct server *s = objt_server(req->owner);
1933
1934 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001935 HA_SPIN_LOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001936 req->requester_cb(req, tmpns);
Olivier Houchard28381072017-11-06 17:30:28 +01001937 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001938 HA_SPIN_UNLOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001939 tmpns = NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001940 }
Baptiste Assmann42746372017-05-03 12:12:02 +02001941
Christopher Faulet67957bd2017-09-27 11:00:59 +02001942 dns_reset_resolution(res);
1943 LIST_DEL(&res->list);
1944 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1945 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001946 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001947 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001948 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001949}
William Lallemand69e96442016-11-19 00:58:54 +01001950
Christopher Faulet67957bd2017-09-27 11:00:59 +02001951/* Called when a resolvers network socket is ready to send data */
1952static void dns_resolve_send(struct dgram_conn *dgram)
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001953{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001954 struct dns_resolvers *resolvers;
1955 struct dns_nameserver *ns;
1956 struct dns_resolution *res;
1957 int fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001958
Christopher Faulet67957bd2017-09-27 11:00:59 +02001959 fd = dgram->t.sock.fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001960
Christopher Faulet67957bd2017-09-27 11:00:59 +02001961 /* check if ready for sending */
1962 if (!fd_send_ready(fd))
1963 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001964
Christopher Faulet67957bd2017-09-27 11:00:59 +02001965 /* we don't want/need to be waked up any more for sending */
1966 fd_stop_send(fd);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001967
Christopher Faulet67957bd2017-09-27 11:00:59 +02001968 /* no need to go further if we can't retrieve the nameserver */
1969 if ((ns = dgram->owner) == NULL)
1970 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001971
Christopher Faulet67957bd2017-09-27 11:00:59 +02001972 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001973 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02001974
Christopher Faulet67957bd2017-09-27 11:00:59 +02001975 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001976 int ret, len;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001977
Christopher Faulet67957bd2017-09-27 11:00:59 +02001978 if (res->nb_queries == resolvers->nb_nameservers)
1979 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001980
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001981 len = dns_build_query(res->query_id, res->query_type,
1982 resolvers->accepted_payload_size,
1983 res->hostname_dn, res->hostname_dn_len,
1984 trash.area, trash.size);
1985 if (len == -1)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001986 goto snd_error;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001987
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001988 ret = send(fd, trash.area, len, 0);
Willy Tarreau0eae6322019-12-20 11:18:54 +01001989 if (ret != len) {
1990 if (ret == -1 && errno == EAGAIN) {
1991 /* retry once the socket is ready */
1992 fd_cant_send(fd);
1993 continue;
1994 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001995 goto snd_error;
Willy Tarreau0eae6322019-12-20 11:18:54 +01001996 }
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001997
Christopher Faulet67957bd2017-09-27 11:00:59 +02001998 ns->counters.sent++;
1999 res->nb_queries++;
2000 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002001
Christopher Faulet67957bd2017-09-27 11:00:59 +02002002 snd_error:
2003 ns->counters.snd_error++;
2004 res->nb_queries++;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002005 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002006 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002007}
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002008
Christopher Faulet67957bd2017-09-27 11:00:59 +02002009/* Processes DNS resolution. First, it checks the active list to detect expired
2010 * resolutions and retry them if possible. Else a timeout is reported. Then, it
2011 * checks the wait list to trigger new resolutions.
2012 */
Olivier Houchard9f6af332018-05-25 14:04:04 +02002013static struct task *dns_process_resolvers(struct task *t, void *context, unsigned short state)
Christopher Faulet67957bd2017-09-27 11:00:59 +02002014{
Olivier Houchard9f6af332018-05-25 14:04:04 +02002015 struct dns_resolvers *resolvers = context;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002016 struct dns_resolution *res, *resback;
2017 int exp;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002018
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002019 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02002020
Christopher Faulet67957bd2017-09-27 11:00:59 +02002021 /* Handle all expired resolutions from the active list */
2022 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
2023 /* When we find the first resolution in the future, then we can
2024 * stop here */
2025 exp = tick_add(res->last_query, resolvers->timeout.retry);
2026 if (!tick_is_expired(exp, now_ms))
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002027 break;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002028
Christopher Faulet67957bd2017-09-27 11:00:59 +02002029 /* If current resolution has been tried too many times and
2030 * finishes in timeout we update its status and remove it from
2031 * the list */
2032 if (!res->try) {
2033 struct dns_requester *req;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002034
Christopher Faulet67957bd2017-09-27 11:00:59 +02002035 /* Notify the result to the requesters */
2036 if (!res->nb_responses)
2037 res->status = RSLV_STATUS_TIMEOUT;
2038 list_for_each_entry(req, &res->requesters, list)
2039 req->requester_error_cb(req, res->status);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002040
Christopher Faulet67957bd2017-09-27 11:00:59 +02002041 /* Clean up resolution info and remove it from the
2042 * current list */
2043 dns_reset_resolution(res);
2044 LIST_DEL(&res->list);
2045 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
William Lallemand69e96442016-11-19 00:58:54 +01002046 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002047 else {
2048 /* Otherwise resend the DNS query and requeue the resolution */
2049 if (!res->nb_responses || res->prefered_query_type != res->query_type) {
2050 /* No response received (a real timeout) or fallback already done */
2051 res->query_type = res->prefered_query_type;
2052 res->try--;
2053 }
2054 else {
2055 /* Fallback from A to AAAA or the opposite and re-send
2056 * the resolution immediately. try counter is not
2057 * decremented. */
2058 if (res->prefered_query_type == DNS_RTYPE_A)
2059 res->query_type = DNS_RTYPE_AAAA;
2060 else if (res->prefered_query_type == DNS_RTYPE_AAAA)
2061 res->query_type = DNS_RTYPE_A;
2062 else
2063 res->try--;
2064 }
2065 dns_send_query(res);
William Lallemand69e96442016-11-19 00:58:54 +01002066 }
2067 }
William Lallemand69e96442016-11-19 00:58:54 +01002068
Christopher Faulet67957bd2017-09-27 11:00:59 +02002069 /* Handle all resolutions in the wait list */
2070 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
2071 exp = tick_add(res->last_resolution, dns_resolution_timeout(res));
2072 if (tick_isset(res->last_resolution) && !tick_is_expired(exp, now_ms))
2073 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002074
Christopher Faulet67957bd2017-09-27 11:00:59 +02002075 if (dns_run_resolution(res) != 1) {
2076 res->last_resolution = now_ms;
2077 LIST_DEL(&res->list);
2078 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002079 }
2080 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002081
Christopher Faulet67957bd2017-09-27 11:00:59 +02002082 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002083 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002084 return t;
2085}
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002086
Christopher Faulet67957bd2017-09-27 11:00:59 +02002087/* proto_udp callback functions for a DNS resolution */
2088struct dgram_data_cb resolve_dgram_cb = {
2089 .recv = dns_resolve_recv,
2090 .send = dns_resolve_send,
2091};
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002092
Christopher Faulet67957bd2017-09-27 11:00:59 +02002093/* Release memory allocated by DNS */
2094static void dns_deinit(void)
2095{
2096 struct dns_resolvers *resolvers, *resolversback;
2097 struct dns_nameserver *ns, *nsback;
2098 struct dns_resolution *res, *resback;
2099 struct dns_requester *req, *reqback;
2100 struct dns_srvrq *srvrq, *srvrqback;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002101
Christopher Faulet67957bd2017-09-27 11:00:59 +02002102 list_for_each_entry_safe(resolvers, resolversback, &dns_resolvers, list) {
2103 list_for_each_entry_safe(ns, nsback, &resolvers->nameservers, list) {
2104 free(ns->id);
2105 free((char *)ns->conf.file);
2106 if (ns->dgram && ns->dgram->t.sock.fd != -1)
2107 fd_delete(ns->dgram->t.sock.fd);
2108 free(ns->dgram);
2109 LIST_DEL(&ns->list);
2110 free(ns);
2111 }
2112
2113 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
2114 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
2115 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01002116 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002117 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002118 dns_free_resolution(res);
2119 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02002120
Christopher Faulet67957bd2017-09-27 11:00:59 +02002121 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
2122 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
2123 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01002124 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002125 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002126 dns_free_resolution(res);
2127 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02002128
Christopher Faulet67957bd2017-09-27 11:00:59 +02002129 free(resolvers->id);
2130 free((char *)resolvers->conf.file);
Olivier Houchard3f795f72019-04-17 22:51:06 +02002131 task_destroy(resolvers->t);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002132 LIST_DEL(&resolvers->list);
2133 free(resolvers);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002134 }
2135
Christopher Faulet67957bd2017-09-27 11:00:59 +02002136 list_for_each_entry_safe(srvrq, srvrqback, &dns_srvrq_list, list) {
2137 free(srvrq->name);
2138 free(srvrq->hostname_dn);
2139 LIST_DEL(&srvrq->list);
2140 free(srvrq);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002141 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002142}
2143
Christopher Faulet67957bd2017-09-27 11:00:59 +02002144/* Finalizes the DNS configuration by allocating required resources and checking
2145 * live parameters.
2146 * Returns 0 on success, ERR_* flags otherwise.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002147 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02002148static int dns_finalize_config(void)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002149{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002150 struct dns_resolvers *resolvers;
2151 struct proxy *px;
2152 int err_code = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002153
Christopher Faulet67957bd2017-09-27 11:00:59 +02002154 /* allocate pool of resolution per resolvers */
2155 list_for_each_entry(resolvers, &dns_resolvers, list) {
2156 struct dns_nameserver *ns;
2157 struct task *t;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002158
Christopher Faulet67957bd2017-09-27 11:00:59 +02002159 /* Check if we can create the socket with nameservers info */
2160 list_for_each_entry(ns, &resolvers->nameservers, list) {
2161 struct dgram_conn *dgram = NULL;
2162 int fd;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002163
Christopher Faulet67957bd2017-09-27 11:00:59 +02002164 /* Check nameserver info */
2165 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002166 ha_alert("config : resolvers '%s': can't create socket for nameserver '%s'.\n",
2167 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002168 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002169 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02002170 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002171 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002172 ha_alert("config : resolvers '%s': can't connect socket for nameserver '%s'.\n",
2173 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002174 close(fd);
2175 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002176 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02002177 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002178 close(fd);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002179
Christopher Faulet67957bd2017-09-27 11:00:59 +02002180 /* Create dgram structure that will hold the UPD socket
2181 * and attach it on the current nameserver */
2182 if ((dgram = calloc(1, sizeof(*dgram))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002183 ha_alert("config: resolvers '%s' : out of memory.\n",
2184 resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002185 err_code |= (ERR_ALERT|ERR_ABORT);
2186 goto err;
2187 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002188
Christopher Faulet67957bd2017-09-27 11:00:59 +02002189 /* Leave dgram partially initialized, no FD attached for
2190 * now. */
2191 dgram->owner = ns;
2192 dgram->data = &resolve_dgram_cb;
2193 dgram->t.sock.fd = -1;
2194 ns->dgram = dgram;
2195 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002196
Christopher Faulet67957bd2017-09-27 11:00:59 +02002197 /* Create the task associated to the resolvers section */
Emeric Brunc60def82017-09-27 14:59:38 +02002198 if ((t = task_new(MAX_THREADS_MASK)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002199 ha_alert("config : resolvers '%s' : out of memory.\n", resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002200 err_code |= (ERR_ALERT|ERR_ABORT);
2201 goto err;
2202 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002203
Christopher Faulet67957bd2017-09-27 11:00:59 +02002204 /* Update task's parameters */
2205 t->process = dns_process_resolvers;
2206 t->context = resolvers;
2207 resolvers->t = t;
2208 task_wakeup(t, TASK_WOKEN_INIT);
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002209 }
2210
Olivier Houchardfbc74e82017-11-24 16:54:05 +01002211 for (px = proxies_list; px; px = px->next) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002212 struct server *srv;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002213
Christopher Faulet67957bd2017-09-27 11:00:59 +02002214 for (srv = px->srv; srv; srv = srv->next) {
2215 struct dns_resolvers *resolvers;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002216
Christopher Faulet67957bd2017-09-27 11:00:59 +02002217 if (!srv->resolvers_id)
2218 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002219
Christopher Faulet67957bd2017-09-27 11:00:59 +02002220 if ((resolvers = find_resolvers_by_id(srv->resolvers_id)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002221 ha_alert("config : %s '%s', server '%s': unable to find required resolvers '%s'\n",
2222 proxy_type_str(px), px->id, srv->id, srv->resolvers_id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002223 err_code |= (ERR_ALERT|ERR_ABORT);
2224 continue;
2225 }
2226 srv->resolvers = resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002227
Christopher Faulet67957bd2017-09-27 11:00:59 +02002228 if (srv->srvrq && !srv->srvrq->resolvers) {
2229 srv->srvrq->resolvers = srv->resolvers;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01002230 if (dns_link_resolution(srv->srvrq, OBJ_TYPE_SRVRQ, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002231 ha_alert("config : %s '%s' : unable to set DNS resolution for server '%s'.\n",
2232 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002233 err_code |= (ERR_ALERT|ERR_ABORT);
2234 continue;
2235 }
2236 }
Olivier Houchard55dcdf42017-11-06 15:15:04 +01002237 if (dns_link_resolution(srv, OBJ_TYPE_SERVER, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002238 ha_alert("config : %s '%s', unable to set DNS resolution for server '%s'.\n",
2239 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002240 err_code |= (ERR_ALERT|ERR_ABORT);
2241 continue;
2242 }
2243 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002244 }
2245
Christopher Faulet67957bd2017-09-27 11:00:59 +02002246 if (err_code & (ERR_ALERT|ERR_ABORT))
2247 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002248
Christopher Faulet67957bd2017-09-27 11:00:59 +02002249 return err_code;
2250 err:
2251 dns_deinit();
2252 return err_code;
2253
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002254}
2255
Christopher Faulet67957bd2017-09-27 11:00:59 +02002256/* if an arg is found, it sets the resolvers section pointer into cli.p0 */
Aurélien Nephtaliabbf6072018-04-18 13:26:46 +02002257static int cli_parse_stat_resolvers(char **args, char *payload, struct appctx *appctx, void *private)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002258{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002259 struct dns_resolvers *presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002260
Christopher Faulet67957bd2017-09-27 11:00:59 +02002261 if (*args[2]) {
2262 list_for_each_entry(presolvers, &dns_resolvers, list) {
2263 if (strcmp(presolvers->id, args[2]) == 0) {
2264 appctx->ctx.cli.p0 = presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002265 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002266 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002267 }
Willy Tarreau9d008692019-08-09 11:21:01 +02002268 if (appctx->ctx.cli.p0 == NULL)
2269 return cli_err(appctx, "Can't find that resolvers section\n");
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002270 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002271 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002272}
2273
Christopher Faulet67957bd2017-09-27 11:00:59 +02002274/* Dumps counters from all resolvers section and associated name servers. It
2275 * returns 0 if the output buffer is full and it needs to be called again,
2276 * otherwise non-zero. It may limit itself to the resolver pointed to by
Willy Tarreau777b5602016-12-16 18:06:26 +01002277 * <cli.p0> if it's not null.
William Lallemand69e96442016-11-19 00:58:54 +01002278 */
2279static int cli_io_handler_dump_resolvers_to_buffer(struct appctx *appctx)
2280{
2281 struct stream_interface *si = appctx->owner;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002282 struct dns_resolvers *resolvers;
2283 struct dns_nameserver *ns;
William Lallemand69e96442016-11-19 00:58:54 +01002284
2285 chunk_reset(&trash);
2286
2287 switch (appctx->st2) {
2288 case STAT_ST_INIT:
2289 appctx->st2 = STAT_ST_LIST; /* let's start producing data */
2290 /* fall through */
2291
2292 case STAT_ST_LIST:
2293 if (LIST_ISEMPTY(&dns_resolvers)) {
2294 chunk_appendf(&trash, "No resolvers found\n");
2295 }
2296 else {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002297 list_for_each_entry(resolvers, &dns_resolvers, list) {
2298 if (appctx->ctx.cli.p0 != NULL && appctx->ctx.cli.p0 != resolvers)
William Lallemand69e96442016-11-19 00:58:54 +01002299 continue;
2300
Christopher Faulet67957bd2017-09-27 11:00:59 +02002301 chunk_appendf(&trash, "Resolvers section %s\n", resolvers->id);
2302 list_for_each_entry(ns, &resolvers->nameservers, list) {
2303 chunk_appendf(&trash, " nameserver %s:\n", ns->id);
2304 chunk_appendf(&trash, " sent: %lld\n", ns->counters.sent);
2305 chunk_appendf(&trash, " snd_error: %lld\n", ns->counters.snd_error);
2306 chunk_appendf(&trash, " valid: %lld\n", ns->counters.valid);
2307 chunk_appendf(&trash, " update: %lld\n", ns->counters.update);
2308 chunk_appendf(&trash, " cname: %lld\n", ns->counters.cname);
2309 chunk_appendf(&trash, " cname_error: %lld\n", ns->counters.cname_error);
2310 chunk_appendf(&trash, " any_err: %lld\n", ns->counters.any_err);
2311 chunk_appendf(&trash, " nx: %lld\n", ns->counters.nx);
2312 chunk_appendf(&trash, " timeout: %lld\n", ns->counters.timeout);
2313 chunk_appendf(&trash, " refused: %lld\n", ns->counters.refused);
2314 chunk_appendf(&trash, " other: %lld\n", ns->counters.other);
2315 chunk_appendf(&trash, " invalid: %lld\n", ns->counters.invalid);
2316 chunk_appendf(&trash, " too_big: %lld\n", ns->counters.too_big);
2317 chunk_appendf(&trash, " truncated: %lld\n", ns->counters.truncated);
2318 chunk_appendf(&trash, " outdated: %lld\n", ns->counters.outdated);
William Lallemand69e96442016-11-19 00:58:54 +01002319 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002320 chunk_appendf(&trash, "\n");
William Lallemand69e96442016-11-19 00:58:54 +01002321 }
2322 }
2323
2324 /* display response */
Willy Tarreau06d80a92017-10-19 14:32:15 +02002325 if (ci_putchk(si_ic(si), &trash) == -1) {
William Lallemand69e96442016-11-19 00:58:54 +01002326 /* let's try again later from this session. We add ourselves into
2327 * this session's users so that it can remove us upon termination.
2328 */
Willy Tarreaudb398432018-11-15 11:08:52 +01002329 si_rx_room_blk(si);
William Lallemand69e96442016-11-19 00:58:54 +01002330 return 0;
2331 }
William Lallemand69e96442016-11-19 00:58:54 +01002332 /* fall through */
2333
2334 default:
2335 appctx->st2 = STAT_ST_FIN;
2336 return 1;
2337 }
2338}
2339
2340/* register cli keywords */
Christopher Fauletff88efb2017-10-03 16:00:57 +02002341static struct cli_kw_list cli_kws = {{ }, {
2342 { { "show", "resolvers", NULL }, "show resolvers [id]: dumps counters from all resolvers section and\n"
2343 " associated name servers",
2344 cli_parse_stat_resolvers, cli_io_handler_dump_resolvers_to_buffer },
2345 {{},}
2346 }
2347};
William Lallemand69e96442016-11-19 00:58:54 +01002348
Willy Tarreau0108d902018-11-25 19:14:37 +01002349INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
William Lallemand69e96442016-11-19 00:58:54 +01002350
Baptiste Assmann333939c2019-01-21 08:34:50 +01002351/*
2352 * Prepare <rule> for hostname resolution.
2353 * Returns -1 in case of any allocation failure, 0 if not.
2354 * On error, a global failure counter is also incremented.
2355 */
2356static int action_prepare_for_resolution(struct stream *stream, const char *hostname)
2357{
2358 char *hostname_dn;
2359 int hostname_len, hostname_dn_len;
2360 struct buffer *tmp = get_trash_chunk();
2361
2362 if (!hostname)
2363 return 0;
2364
2365 hostname_len = strlen(hostname);
2366 hostname_dn = tmp->area;
2367 hostname_dn_len = dns_str_to_dn_label(hostname, hostname_len + 1,
2368 hostname_dn, tmp->size);
2369 if (hostname_dn_len == -1)
2370 goto err;
2371
2372
2373 stream->dns_ctx.hostname_dn = strdup(hostname_dn);
2374 stream->dns_ctx.hostname_dn_len = hostname_dn_len;
2375 if (!stream->dns_ctx.hostname_dn)
2376 goto err;
2377
2378 return 0;
2379
2380 err:
2381 free(stream->dns_ctx.hostname_dn); stream->dns_ctx.hostname_dn = NULL;
2382 dns_failed_resolutions += 1;
2383 return -1;
2384}
2385
2386
2387/*
2388 * Execute the "do-resolution" action. May be called from {tcp,http}request.
2389 */
2390enum act_return dns_action_do_resolve(struct act_rule *rule, struct proxy *px,
2391 struct session *sess, struct stream *s, int flags)
2392{
Baptiste Assmann333939c2019-01-21 08:34:50 +01002393 struct dns_resolution *resolution;
Willy Tarreau45726fd2019-07-17 10:38:45 +02002394 struct sample *smp;
2395 char *fqdn;
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002396 struct dns_requester *req;
2397 struct dns_resolvers *resolvers;
2398 struct dns_resolution *res;
2399 int exp;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002400
2401 /* we have a response to our DNS resolution */
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002402 use_cache:
Baptiste Assmann333939c2019-01-21 08:34:50 +01002403 if (s->dns_ctx.dns_requester && s->dns_ctx.dns_requester->resolution != NULL) {
2404 resolution = s->dns_ctx.dns_requester->resolution;
Baptiste Assmann4c52e4b2019-10-01 15:32:40 +02002405 if (resolution->step == RSLV_STEP_RUNNING) {
2406 return ACT_RET_YIELD;
2407 }
Baptiste Assmann333939c2019-01-21 08:34:50 +01002408 if (resolution->step == RSLV_STEP_NONE) {
2409 /* We update the variable only if we have a valid response. */
2410 if (resolution->status == RSLV_STATUS_VALID) {
2411 struct sample smp;
2412 short ip_sin_family = 0;
2413 void *ip = NULL;
2414
Christopher Fauleta4168432020-01-24 18:08:42 +01002415 dns_get_ip_from_response(&resolution->response, rule->arg.dns.dns_opts, NULL,
Baptiste Assmann333939c2019-01-21 08:34:50 +01002416 0, &ip, &ip_sin_family, NULL);
2417
2418 switch (ip_sin_family) {
2419 case AF_INET:
2420 smp.data.type = SMP_T_IPV4;
2421 memcpy(&smp.data.u.ipv4, ip, 4);
2422 break;
2423 case AF_INET6:
2424 smp.data.type = SMP_T_IPV6;
2425 memcpy(&smp.data.u.ipv6, ip, 16);
2426 break;
2427 default:
2428 ip = NULL;
2429 }
2430
2431 if (ip) {
2432 smp.px = px;
2433 smp.sess = sess;
2434 smp.strm = s;
2435
2436 vars_set_by_name(rule->arg.dns.varname, strlen(rule->arg.dns.varname), &smp);
2437 }
2438 }
2439 }
2440
2441 free(s->dns_ctx.hostname_dn); s->dns_ctx.hostname_dn = NULL;
2442 s->dns_ctx.hostname_dn_len = 0;
2443 dns_unlink_resolution(s->dns_ctx.dns_requester);
2444
2445 pool_free(dns_requester_pool, s->dns_ctx.dns_requester);
2446 s->dns_ctx.dns_requester = NULL;
2447
2448 return ACT_RET_CONT;
2449 }
2450
2451 /* need to configure and start a new DNS resolution */
Willy Tarreau45726fd2019-07-17 10:38:45 +02002452 smp = sample_fetch_as_type(px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.dns.expr, SMP_T_STR);
2453 if (smp == NULL)
2454 return ACT_RET_CONT;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002455
Willy Tarreau45726fd2019-07-17 10:38:45 +02002456 fqdn = smp->data.u.str.area;
2457 if (action_prepare_for_resolution(s, fqdn) == -1)
Christopher Faulet13403762019-12-13 09:01:57 +01002458 return ACT_RET_CONT; /* on error, ignore the action */
Baptiste Assmann333939c2019-01-21 08:34:50 +01002459
Willy Tarreau45726fd2019-07-17 10:38:45 +02002460 s->dns_ctx.parent = rule;
2461 dns_link_resolution(s, OBJ_TYPE_STREAM, 0);
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002462
2463 /* Check if there is a fresh enough response in the cache of our associated resolution */
2464 req = s->dns_ctx.dns_requester;
2465 if (!req || !req->resolution) {
2466 dns_trigger_resolution(s->dns_ctx.dns_requester);
2467 return ACT_RET_YIELD;
2468 }
2469 res = req->resolution;
2470 resolvers = res->resolvers;
2471
2472 exp = tick_add(res->last_resolution, resolvers->hold.valid);
2473 if (resolvers->t && res->status == RSLV_STATUS_VALID && tick_isset(res->last_resolution)
2474 && !tick_is_expired(exp, now_ms)) {
2475 goto use_cache;
2476 }
2477
Willy Tarreau45726fd2019-07-17 10:38:45 +02002478 dns_trigger_resolution(s->dns_ctx.dns_requester);
Baptiste Assmann333939c2019-01-21 08:34:50 +01002479 return ACT_RET_YIELD;
2480}
2481
Christopher Faulet3b2bb632020-01-24 18:12:58 +01002482static void release_dns_action(struct act_rule *rule)
2483{
2484 release_sample_expr(rule->arg.dns.expr);
2485 free(rule->arg.dns.varname);
2486 free(rule->arg.dns.resolvers_id);
2487 free(rule->arg.dns.dns_opts);
2488}
2489
Baptiste Assmann333939c2019-01-21 08:34:50 +01002490
2491/* parse "do-resolve" action
2492 * This action takes the following arguments:
2493 * do-resolve(<varName>,<resolversSectionName>,<resolvePrefer>) <expr>
2494 *
2495 * - <varName> is the variable name where the result of the DNS resolution will be stored
2496 * (mandatory)
2497 * - <resolversSectionName> is the name of the resolvers section to use to perform the resolution
2498 * (mandatory)
2499 * - <resolvePrefer> can be either 'ipv4' or 'ipv6' and is the IP family we would like to resolve first
2500 * (optional), defaults to ipv6
2501 * - <expr> is an HAProxy expression used to fetch the name to be resolved
2502 */
2503enum act_parse_ret dns_parse_do_resolve(const char **args, int *orig_arg, struct proxy *px, struct act_rule *rule, char **err)
2504{
2505 int cur_arg;
2506 struct sample_expr *expr;
2507 unsigned int where;
2508 const char *beg, *end;
2509
2510 /* orig_arg points to the first argument, but we need to analyse the command itself first */
2511 cur_arg = *orig_arg - 1;
2512
2513 /* locate varName, which is mandatory */
2514 beg = strchr(args[cur_arg], '(');
2515 if (beg == NULL)
2516 goto do_resolve_parse_error;
2517 beg = beg + 1; /* beg should points to the first character after opening parenthesis '(' */
2518 end = strchr(beg, ',');
2519 if (end == NULL)
2520 goto do_resolve_parse_error;
2521 rule->arg.dns.varname = my_strndup(beg, end - beg);
2522 if (rule->arg.dns.varname == NULL)
2523 goto do_resolve_parse_error;
2524
2525
2526 /* locate resolversSectionName, which is mandatory.
2527 * Since next parameters are optional, the delimiter may be comma ','
2528 * or closing parenthesis ')'
2529 */
2530 beg = end + 1;
2531 end = strchr(beg, ',');
2532 if (end == NULL)
2533 end = strchr(beg, ')');
2534 if (end == NULL)
2535 goto do_resolve_parse_error;
2536 rule->arg.dns.resolvers_id = my_strndup(beg, end - beg);
2537 if (rule->arg.dns.resolvers_id == NULL)
2538 goto do_resolve_parse_error;
2539
2540
Christopher Fauleta4168432020-01-24 18:08:42 +01002541 rule->arg.dns.dns_opts = calloc(1, sizeof(*rule->arg.dns.dns_opts));
2542 if (rule->arg.dns.dns_opts == NULL)
2543 goto do_resolve_parse_error;
2544
Baptiste Assmann333939c2019-01-21 08:34:50 +01002545 /* Default priority is ipv6 */
Christopher Fauleta4168432020-01-24 18:08:42 +01002546 rule->arg.dns.dns_opts->family_prio = AF_INET6;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002547
2548 /* optional arguments accepted for now:
2549 * ipv4 or ipv6
2550 */
2551 while (*end != ')') {
2552 beg = end + 1;
2553 end = strchr(beg, ',');
2554 if (end == NULL)
2555 end = strchr(beg, ')');
2556 if (end == NULL)
2557 goto do_resolve_parse_error;
2558
2559 if (strncmp(beg, "ipv4", end - beg) == 0) {
Christopher Fauleta4168432020-01-24 18:08:42 +01002560 rule->arg.dns.dns_opts->family_prio = AF_INET;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002561 }
2562 else if (strncmp(beg, "ipv6", end - beg) == 0) {
Christopher Fauleta4168432020-01-24 18:08:42 +01002563 rule->arg.dns.dns_opts->family_prio = AF_INET6;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002564 }
2565 else {
2566 goto do_resolve_parse_error;
2567 }
2568 }
2569
2570 cur_arg = cur_arg + 1;
2571
Willy Tarreaue3b57bf2020-02-14 16:50:14 +01002572 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args, NULL);
Baptiste Assmann333939c2019-01-21 08:34:50 +01002573 if (!expr)
2574 goto do_resolve_parse_error;
2575
2576
2577 where = 0;
2578 if (px->cap & PR_CAP_FE)
2579 where |= SMP_VAL_FE_HRQ_HDR;
2580 if (px->cap & PR_CAP_BE)
2581 where |= SMP_VAL_BE_HRQ_HDR;
2582
2583 if (!(expr->fetch->val & where)) {
2584 memprintf(err,
2585 "fetch method '%s' extracts information from '%s', none of which is available here",
2586 args[cur_arg-1], sample_src_names(expr->fetch->use));
2587 free(expr);
2588 return ACT_RET_PRS_ERR;
2589 }
2590 rule->arg.dns.expr = expr;
2591 rule->action = ACT_CUSTOM;
2592 rule->action_ptr = dns_action_do_resolve;
2593 *orig_arg = cur_arg;
2594
2595 rule->check_ptr = check_action_do_resolve;
Christopher Faulet3b2bb632020-01-24 18:12:58 +01002596 rule->release_ptr = release_dns_action;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002597
2598 return ACT_RET_PRS_OK;
2599
2600 do_resolve_parse_error:
2601 free(rule->arg.dns.varname); rule->arg.dns.varname = NULL;
2602 free(rule->arg.dns.resolvers_id); rule->arg.dns.resolvers_id = NULL;
2603 memprintf(err, "Can't parse '%s'. Expects 'do-resolve(<varname>,<resolvers>[,<options>]) <expr>'. Available options are 'ipv4' and 'ipv6'",
2604 args[cur_arg]);
2605 return ACT_RET_PRS_ERR;
2606}
2607
2608static struct action_kw_list http_req_kws = { { }, {
2609 { "do-resolve", dns_parse_do_resolve, 1 },
2610 { /* END */ }
2611}};
2612
2613INITCALL1(STG_REGISTER, http_req_keywords_register, &http_req_kws);
2614
2615static struct action_kw_list tcp_req_cont_actions = {ILH, {
2616 { "do-resolve", dns_parse_do_resolve, 1 },
2617 { /* END */ }
2618}};
2619
2620INITCALL1(STG_REGISTER, tcp_req_cont_keywords_register, &tcp_req_cont_actions);
2621
2622/* Check an "http-request do-resolve" action.
2623 *
2624 * The function returns 1 in success case, otherwise, it returns 0 and err is
2625 * filled.
2626 */
2627int check_action_do_resolve(struct act_rule *rule, struct proxy *px, char **err)
2628{
2629 struct dns_resolvers *resolvers = NULL;
2630
2631 if (rule->arg.dns.resolvers_id == NULL) {
2632 memprintf(err,"Proxy '%s': %s", px->id, "do-resolve action without resolvers");
2633 return 0;
2634 }
2635
2636 resolvers = find_resolvers_by_id(rule->arg.dns.resolvers_id);
2637 if (resolvers == NULL) {
2638 memprintf(err,"Can't find resolvers section '%s' for do-resolve action", rule->arg.dns.resolvers_id);
2639 return 0;
2640 }
2641 rule->arg.dns.resolvers = resolvers;
2642
2643 return 1;
2644}
2645
Willy Tarreau172f5ce2018-11-26 11:21:50 +01002646REGISTER_POST_DEINIT(dns_deinit);
Willy Tarreaue6552512018-11-26 11:33:13 +01002647REGISTER_CONFIG_POSTPARSER("dns runtime resolver", dns_finalize_config);