blob: 3b3dfc59e065da04d6eb2eddd6ac6db5c6180a5c [file] [log] [blame]
Baptiste Assmann325137d2015-04-13 23:40:55 +02001/*
2 * Name server resolution
3 *
4 * Copyright 2014 Baptiste Assmann <bedis9@gmail.com>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <errno.h>
14#include <fcntl.h>
15#include <stdio.h>
16#include <stdlib.h>
17#include <string.h>
18#include <unistd.h>
19
20#include <sys/types.h>
21
22#include <common/time.h>
23#include <common/ticks.h>
24
25#include <types/global.h>
26#include <types/dns.h>
27#include <types/proto_udp.h>
28
29#include <proto/checks.h>
30#include <proto/dns.h>
31#include <proto/fd.h>
32#include <proto/log.h>
33#include <proto/server.h>
34#include <proto/task.h>
35#include <proto/proto_udp.h>
36
37struct list dns_resolvers = LIST_HEAD_INIT(dns_resolvers);
38struct dns_resolution *resolution = NULL;
39
40static int64_t dns_query_id_seed; /* random seed */
41
42/* proto_udp callback functions for a DNS resolution */
43struct dgram_data_cb resolve_dgram_cb = {
44 .recv = dns_resolve_recv,
45 .send = dns_resolve_send,
46};
47
48#if DEBUG
49/*
50 * go through the resolutions associated to a resolvers section and print the ID and hostname in
51 * domain name format
52 * should be used for debug purpose only
53 */
54void dns_print_current_resolutions(struct dns_resolvers *resolvers)
55{
56 list_for_each_entry(resolution, &resolvers->curr_resolution, list) {
57 printf(" resolution %d for %s\n", resolution->query_id, resolution->hostname_dn);
58 }
59}
60#endif
61
62/*
63 * check if there is more than 1 resolution in the resolver's resolution list
64 * return value:
65 * 0: empty list
66 * 1: exactly one entry in the list
67 * 2: more than one entry in the list
68 */
69int dns_check_resolution_queue(struct dns_resolvers *resolvers)
70{
71
72 if (LIST_ISEMPTY(&resolvers->curr_resolution))
73 return 0;
74
75 if ((resolvers->curr_resolution.n) && (resolvers->curr_resolution.n == resolvers->curr_resolution.p))
76 return 1;
77
78 if (! ((resolvers->curr_resolution.n == resolvers->curr_resolution.p)
79 && (&resolvers->curr_resolution != resolvers->curr_resolution.n)))
80 return 2;
81
82 return 0;
83}
84
85/*
86 * reset all parameters of a DNS resolution to 0 (or equivalent)
87 * and clean it up from all associated lists (resolution->qid and resolution->list)
88 */
89void dns_reset_resolution(struct dns_resolution *resolution)
90{
91 /* update resolution status */
92 resolution->step = RSLV_STEP_NONE;
93
94 resolution->try = 0;
95 resolution->try_cname = 0;
96 resolution->last_resolution = now_ms;
97 resolution->nb_responses = 0;
98
99 /* clean up query id */
100 eb32_delete(&resolution->qid);
101 resolution->query_id = 0;
102 resolution->qid.key = 0;
103
104 /* default values */
Thierry Fournierada34842016-02-17 21:25:09 +0100105 if (resolution->opts->family_prio == AF_INET) {
Andrew Hayworthe6a4a322015-10-19 22:29:51 +0000106 resolution->query_type = DNS_RTYPE_A;
107 } else {
108 resolution->query_type = DNS_RTYPE_AAAA;
109 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200110
111 /* the second resolution in the queue becomes the first one */
112 LIST_DEL(&resolution->list);
113}
114
115/*
116 * function called when a network IO is generated on a name server socket for an incoming packet
117 * It performs the following actions:
118 * - check if the packet requires processing (not outdated resolution)
119 * - ensure the DNS packet received is valid and call requester's callback
120 * - call requester's error callback if invalid response
121 */
122void dns_resolve_recv(struct dgram_conn *dgram)
123{
124 struct dns_nameserver *nameserver;
125 struct dns_resolvers *resolvers;
126 struct dns_resolution *resolution;
127 unsigned char buf[DNS_MAX_UDP_MESSAGE + 1];
128 unsigned char *bufend;
129 int fd, buflen, ret;
130 unsigned short query_id;
131 struct eb32_node *eb;
132
133 fd = dgram->t.sock.fd;
134
135 /* check if ready for reading */
136 if (!fd_recv_ready(fd))
137 return;
138
139 /* no need to go further if we can't retrieve the nameserver */
Vincent Bernat3c2f2f22016-04-03 13:48:42 +0200140 if ((nameserver = dgram->owner) == NULL)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200141 return;
142
143 resolvers = nameserver->resolvers;
144
145 /* process all pending input messages */
146 while (1) {
147 /* read message received */
148 memset(buf, '\0', DNS_MAX_UDP_MESSAGE + 1);
149 if ((buflen = recv(fd, (char*)buf , DNS_MAX_UDP_MESSAGE, 0)) < 0) {
150 /* FIXME : for now we consider EAGAIN only */
151 fd_cant_recv(fd);
152 break;
153 }
154
155 /* message too big */
156 if (buflen > DNS_MAX_UDP_MESSAGE) {
157 nameserver->counters.too_big += 1;
158 continue;
159 }
160
161 /* initializing variables */
162 bufend = buf + buflen; /* pointer to mark the end of the buffer */
163
164 /* read the query id from the packet (16 bits) */
165 if (buf + 2 > bufend) {
166 nameserver->counters.invalid += 1;
167 continue;
168 }
169 query_id = dns_response_get_query_id(buf);
170
171 /* search the query_id in the pending resolution tree */
Baptiste Assmann01daef32015-09-02 22:05:24 +0200172 eb = eb32_lookup(&resolvers->query_ids, query_id);
173 if (eb == NULL) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200174 /* unknown query id means an outdated response and can be safely ignored */
175 nameserver->counters.outdated += 1;
176 continue;
177 }
178
179 /* known query id means a resolution in prgress */
180 resolution = eb32_entry(eb, struct dns_resolution, qid);
181
182 if (!resolution) {
183 nameserver->counters.outdated += 1;
184 continue;
185 }
186
187 /* number of responses received */
188 resolution->nb_responses += 1;
189
190 ret = dns_validate_dns_response(buf, bufend, resolution->hostname_dn, resolution->hostname_dn_len);
191
192 /* treat only errors */
193 switch (ret) {
194 case DNS_RESP_INVALID:
195 case DNS_RESP_WRONG_NAME:
196 nameserver->counters.invalid += 1;
197 resolution->requester_error_cb(resolution, DNS_RESP_INVALID);
198 continue;
199
200 case DNS_RESP_ERROR:
201 nameserver->counters.other += 1;
202 resolution->requester_error_cb(resolution, DNS_RESP_ERROR);
203 continue;
204
205 case DNS_RESP_ANCOUNT_ZERO:
206 nameserver->counters.any_err += 1;
207 resolution->requester_error_cb(resolution, DNS_RESP_ANCOUNT_ZERO);
208 continue;
209
210 case DNS_RESP_NX_DOMAIN:
211 nameserver->counters.nx += 1;
212 resolution->requester_error_cb(resolution, DNS_RESP_NX_DOMAIN);
213 continue;
214
215 case DNS_RESP_REFUSED:
216 nameserver->counters.refused += 1;
217 resolution->requester_error_cb(resolution, DNS_RESP_REFUSED);
218 continue;
219
220 case DNS_RESP_CNAME_ERROR:
221 nameserver->counters.cname_error += 1;
222 resolution->requester_error_cb(resolution, DNS_RESP_CNAME_ERROR);
223 continue;
224
Baptiste Assmann0df5d962015-09-02 21:58:32 +0200225 case DNS_RESP_TRUNCATED:
226 nameserver->counters.truncated += 1;
227 resolution->requester_error_cb(resolution, DNS_RESP_TRUNCATED);
228 continue;
Baptiste Assmann96972bc2015-09-09 00:46:58 +0200229
230 case DNS_RESP_NO_EXPECTED_RECORD:
231 nameserver->counters.other += 1;
232 resolution->requester_error_cb(resolution, DNS_RESP_NO_EXPECTED_RECORD);
233 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200234 }
235
Baptiste Assmann37bb3722015-08-07 10:18:32 +0200236 nameserver->counters.valid += 1;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200237 resolution->requester_cb(resolution, nameserver, buf, buflen);
238 }
239}
240
241/*
242 * function called when a resolvers network socket is ready to send data
243 * It performs the following actions:
244 */
245void dns_resolve_send(struct dgram_conn *dgram)
246{
247 int fd;
248 struct dns_nameserver *nameserver;
249 struct dns_resolvers *resolvers;
250 struct dns_resolution *resolution;
251
252 fd = dgram->t.sock.fd;
253
254 /* check if ready for sending */
255 if (!fd_send_ready(fd))
256 return;
257
258 /* we don't want/need to be waked up any more for sending */
259 fd_stop_send(fd);
260
261 /* no need to go further if we can't retrieve the nameserver */
Vincent Bernat3c2f2f22016-04-03 13:48:42 +0200262 if ((nameserver = dgram->owner) == NULL)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200263 return;
264
265 resolvers = nameserver->resolvers;
266 resolution = LIST_NEXT(&resolvers->curr_resolution, struct dns_resolution *, list);
267
268 dns_send_query(resolution);
269 dns_update_resolvers_timeout(resolvers);
270}
271
272/*
273 * forge and send a DNS query to resolvers associated to a resolution
274 * It performs the following actions:
275 * returns:
276 * 0 in case of error or safe ignorance
277 * 1 if no error
278 */
279int dns_send_query(struct dns_resolution *resolution)
280{
281 struct dns_resolvers *resolvers;
282 struct dns_nameserver *nameserver;
283 int ret, send_error, bufsize, fd;
284
285 resolvers = resolution->resolvers;
286
287 ret = send_error = 0;
288 bufsize = dns_build_query(resolution->query_id, resolution->query_type, resolution->hostname_dn,
289 resolution->hostname_dn_len, trash.str, trash.size);
290
291 if (bufsize == -1)
292 return 0;
293
294 list_for_each_entry(nameserver, &resolvers->nameserver_list, list) {
295 fd = nameserver->dgram->t.sock.fd;
296 errno = 0;
297
298 ret = send(fd, trash.str, bufsize, 0);
299
300 if (ret > 0)
301 nameserver->counters.sent += 1;
302
303 if (ret == 0 || errno == EAGAIN) {
304 /* nothing written, let's update the poller that we wanted to send
305 * but we were not able to */
306 fd_want_send(fd);
307 fd_cant_send(fd);
308 }
309 }
310
311 /* update resolution */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200312 resolution->nb_responses = 0;
313 resolution->last_sent_packet = now_ms;
314
315 return 1;
316}
317
318/*
319 * update a resolvers' task timeout for next wake up
320 */
321void dns_update_resolvers_timeout(struct dns_resolvers *resolvers)
322{
323 struct dns_resolution *resolution;
324
325 if (LIST_ISEMPTY(&resolvers->curr_resolution)) {
326 /* no more resolution pending, so no wakeup anymore */
327 resolvers->t->expire = TICK_ETERNITY;
328 }
329 else {
330 resolution = LIST_NEXT(&resolvers->curr_resolution, struct dns_resolution *, list);
331 resolvers->t->expire = tick_add(resolution->last_sent_packet, resolvers->timeout.retry);
332 }
333}
334
335/*
336 * Function to validate that the buffer DNS response provided in <resp> and
337 * finishing before <bufend> is valid from a DNS protocol point of view.
338 * The caller can also ask the function to check if the response contains data
339 * for a domain name <dn_name> whose length is <dn_name_len> returns one of the
340 * DNS_RESP_* code.
341 */
342int dns_validate_dns_response(unsigned char *resp, unsigned char *bufend, char *dn_name, int dn_name_len)
343{
344 unsigned char *reader, *cname, *ptr;
Baptiste Assmann96972bc2015-09-09 00:46:58 +0200345 int i, len, flags, type, ancount, cnamelen, expected_record;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200346
347 reader = resp;
348 cname = NULL;
349 cnamelen = 0;
350 len = 0;
Baptiste Assmann96972bc2015-09-09 00:46:58 +0200351 expected_record = 0; /* flag to report if at least one expected record type is found in the response.
352 * For now, only records containing an IP address (A and AAAA) are
353 * considered as expected.
354 * Later, this function may be updated to let the caller decide what type
355 * of record is expected to consider the response as valid. (SRV or TXT types)
356 */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200357
358 /* move forward 2 bytes for the query id */
359 reader += 2;
360 if (reader >= bufend)
361 return DNS_RESP_INVALID;
362
363 /*
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200364 * flags are stored over 2 bytes
365 * First byte contains:
366 * - response flag (1 bit)
367 * - opcode (4 bits)
368 * - authoritative (1 bit)
369 * - truncated (1 bit)
370 * - recursion desired (1 bit)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200371 */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200372 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200373 return DNS_RESP_INVALID;
374
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200375 flags = reader[0] * 256 + reader[1];
376
377 if (flags & DNS_FLAG_TRUNCATED)
378 return DNS_RESP_TRUNCATED;
379
380 if ((flags & DNS_FLAG_REPLYCODE) != DNS_RCODE_NO_ERROR) {
381 if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_NX_DOMAIN)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200382 return DNS_RESP_NX_DOMAIN;
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200383 else if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_REFUSED)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200384 return DNS_RESP_REFUSED;
385
386 return DNS_RESP_ERROR;
387 }
388
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200389 /* move forward 2 bytes for flags */
390 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200391 if (reader >= bufend)
392 return DNS_RESP_INVALID;
393
394 /* move forward 2 bytes for question count */
395 reader += 2;
396 if (reader >= bufend)
397 return DNS_RESP_INVALID;
398
399 /* analyzing answer count */
400 if (reader + 2 > bufend)
401 return DNS_RESP_INVALID;
402 ancount = reader[0] * 256 + reader[1];
403
404 if (ancount == 0)
405 return DNS_RESP_ANCOUNT_ZERO;
406
407 /* move forward 2 bytes for answer count */
408 reader += 2;
409 if (reader >= bufend)
410 return DNS_RESP_INVALID;
411
412 /* move forward 4 bytes authority and additional count */
413 reader += 4;
414 if (reader >= bufend)
415 return DNS_RESP_INVALID;
416
417 /* check if the name can stand in response */
418 if (dn_name && ((reader + dn_name_len + 1) > bufend))
419 return DNS_RESP_INVALID;
420
421 /* check hostname */
422 if (dn_name && (memcmp(reader, dn_name, dn_name_len) != 0))
423 return DNS_RESP_WRONG_NAME;
424
425 /* move forward hostname len bytes + 1 for NULL byte */
426 if (dn_name) {
427 reader = reader + dn_name_len + 1;
428 }
429 else {
430 ptr = reader;
431 while (*ptr) {
432 ptr++;
433 if (ptr >= bufend)
434 return DNS_RESP_INVALID;
435 }
436 reader = ptr + 1;
437 }
438
439 /* move forward 4 bytes for question type and question class */
440 reader += 4;
441 if (reader >= bufend)
442 return DNS_RESP_INVALID;
443
444 /* now parsing response records */
445 for (i = 1; i <= ancount; i++) {
446 if (reader >= bufend)
447 return DNS_RESP_INVALID;
448
449 /*
450 * name can be a pointer, so move forward reader cursor accordingly
451 * if 1st byte is '11XXXXXX', it means name is a pointer
452 * and 2nd byte gives the offset from resp where the hostname can
453 * be found
454 */
455 if ((*reader & 0xc0) == 0xc0) {
456 /*
457 * pointer, hostname can be found at resp + *(reader + 1)
458 */
459 if (reader + 1 > bufend)
460 return DNS_RESP_INVALID;
461
462 ptr = resp + *(reader + 1);
463
464 /* check if the pointer points inside the buffer */
465 if (ptr >= bufend)
466 return DNS_RESP_INVALID;
467 }
468 else {
469 /*
470 * name is a string which starts at first byte
471 * checking against last cname when recursing through the response
472 */
473 /* look for the end of the string and ensure it's in the buffer */
474 ptr = reader;
475 len = 0;
476 while (*ptr) {
477 ++len;
478 ++ptr;
479 if (ptr >= bufend)
480 return DNS_RESP_INVALID;
481 }
482
483 /* if cname is set, it means a CNAME recursion is in progress */
484 ptr = reader;
485 }
486
487 /* ptr now points to the name */
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200488 if ((*reader & 0xc0) != 0xc0) {
489 /* if cname is set, it means a CNAME recursion is in progress */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200490 if (cname) {
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200491 /* check if the name can stand in response */
492 if ((reader + cnamelen) > bufend)
493 return DNS_RESP_INVALID;
494 /* compare cname and current name */
495 if (memcmp(ptr, cname, cnamelen) != 0)
496 return DNS_RESP_CNAME_ERROR;
497
Baptiste Assmann325137d2015-04-13 23:40:55 +0200498 cname = reader;
499 cnamelen = dns_str_to_dn_label_len((const char *)cname);
500
501 /* move forward cnamelen bytes + NULL byte */
502 reader += (cnamelen + 1);
503 }
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200504 /* compare server hostname to current name */
505 else if (dn_name) {
506 /* check if the name can stand in response */
507 if ((reader + dn_name_len) > bufend)
508 return DNS_RESP_INVALID;
509 if (memcmp(ptr, dn_name, dn_name_len) != 0)
510 return DNS_RESP_WRONG_NAME;
Baptiste Assmann5d681ba2015-10-15 15:23:28 +0200511
512 reader += (dn_name_len + 1);
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200513 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200514 else {
515 reader += (len + 1);
516 }
517 }
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200518 else {
519 /* shortname in progress */
520 /* move forward 2 bytes for information pointer and address pointer */
521 reader += 2;
522 }
523
Baptiste Assmann325137d2015-04-13 23:40:55 +0200524 if (reader >= bufend)
525 return DNS_RESP_INVALID;
526
527 /*
528 * we know the record is either for our server hostname
529 * or a valid CNAME in a crecursion
530 */
531
532 /* now reading record type (A, AAAA, CNAME, etc...) */
533 if (reader + 2 > bufend)
534 return DNS_RESP_INVALID;
535 type = reader[0] * 256 + reader[1];
536
537 /* move forward 2 bytes for type (2) */
538 reader += 2;
539
540 /* move forward 6 bytes for class (2) and ttl (4) */
541 reader += 6;
542 if (reader >= bufend)
543 return DNS_RESP_INVALID;
544
545 /* now reading data len */
546 if (reader + 2 > bufend)
547 return DNS_RESP_INVALID;
548 len = reader[0] * 256 + reader[1];
549
550 /* move forward 2 bytes for data len */
551 reader += 2;
552
553 /* analyzing record content */
554 switch (type) {
555 case DNS_RTYPE_A:
556 /* ipv4 is stored on 4 bytes */
557 if (len != 4)
558 return DNS_RESP_INVALID;
Baptiste Assmann96972bc2015-09-09 00:46:58 +0200559 expected_record = 1;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200560 break;
561
562 case DNS_RTYPE_CNAME:
563 cname = reader;
564 cnamelen = len;
565 break;
566
567 case DNS_RTYPE_AAAA:
568 /* ipv6 is stored on 16 bytes */
569 if (len != 16)
570 return DNS_RESP_INVALID;
Baptiste Assmann96972bc2015-09-09 00:46:58 +0200571 expected_record = 1;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200572 break;
573 } /* switch (record type) */
574
575 /* move forward len for analyzing next record in the response */
576 reader += len;
577 } /* for i 0 to ancount */
578
Baptiste Assmann96972bc2015-09-09 00:46:58 +0200579 if (expected_record == 0)
580 return DNS_RESP_NO_EXPECTED_RECORD;
581
Baptiste Assmann325137d2015-04-13 23:40:55 +0200582 return DNS_RESP_VALID;
583}
584
585/*
586 * search dn_name resolution in resp.
587 * If existing IP not found, return the first IP matching family_priority,
588 * otherwise, first ip found
589 * The following tasks are the responsibility of the caller:
590 * - resp contains an error free DNS response
591 * - the response matches the dn_name
592 * For both cases above, dns_validate_dns_response is required
593 * returns one of the DNS_UPD_* code
594 */
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100595#define DNS_MAX_IP_REC 20
Baptiste Assmann325137d2015-04-13 23:40:55 +0200596int dns_get_ip_from_response(unsigned char *resp, unsigned char *resp_end,
Thierry Fournierada34842016-02-17 21:25:09 +0100597 struct dns_resolution *resol, void *currentip,
598 short currentip_sin_family,
599 void **newip, short *newip_sin_family)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200600{
Thierry Fournierada34842016-02-17 21:25:09 +0100601 int family_priority;
602 char *dn_name;
603 int dn_name_len;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200604 int i, ancount, cnamelen, type, data_len, currentip_found;
605 unsigned char *reader, *cname, *ptr, *newip4, *newip6;
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100606 struct {
607 unsigned char *ip;
608 unsigned char type;
609 } rec[DNS_MAX_IP_REC];
610 int currentip_sel;
611 int j;
612 int rec_nb = 0;
613 int score, max_score;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200614
Thierry Fournierada34842016-02-17 21:25:09 +0100615 family_priority = resol->opts->family_prio;
616 dn_name = resol->hostname_dn;
617 dn_name_len = resol->hostname_dn_len;
618
Baptiste Assmann325137d2015-04-13 23:40:55 +0200619 cname = *newip = newip4 = newip6 = NULL;
620 cnamelen = currentip_found = 0;
621 *newip_sin_family = AF_UNSPEC;
Vincent Bernat9b7125c2016-04-08 22:17:45 +0200622 ancount = *(resp + 7); /* Assume no more than 256 answers */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200623
624 /* bypass DNS response header */
625 reader = resp + sizeof(struct dns_header);
626
627 /* bypass DNS query section */
628 /* move forward hostname len bytes + 1 for NULL byte */
629 reader = reader + dn_name_len + 1;
630
631 /* move forward 4 bytes for question type and question class */
632 reader += 4;
633
634 /* now parsing response records */
635 for (i = 1; i <= ancount; i++) {
636 /*
637 * name can be a pointer, so move forward reader cursor accordingly
638 * if 1st byte is '11XXXXXX', it means name is a pointer
639 * and 2nd byte gives the offset from buf where the hostname can
640 * be found
641 */
642 if ((*reader & 0xc0) == 0xc0)
643 ptr = resp + *(reader + 1);
644 else
645 ptr = reader;
646
Baptiste Assmanne4c4b7d2015-10-28 02:10:02 +0100647 if (cname) {
648 if (memcmp(ptr, cname, cnamelen)) {
649 return DNS_UPD_NAME_ERROR;
650 }
651 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200652 else if (memcmp(ptr, dn_name, dn_name_len))
653 return DNS_UPD_NAME_ERROR;
654
655 if ((*reader & 0xc0) == 0xc0) {
656 /* move forward 2 bytes for information pointer and address pointer */
657 reader += 2;
658 }
659 else {
660 if (cname) {
661 cname = reader;
662 cnamelen = dns_str_to_dn_label_len((char *)cname);
663
664 /* move forward cnamelen bytes + NULL byte */
665 reader += (cnamelen + 1);
666 }
667 else {
668 /* move forward dn_name_len bytes + NULL byte */
669 reader += (dn_name_len + 1);
670 }
671 }
672
673 /*
674 * we know the record is either for our server hostname
675 * or a valid CNAME in a crecursion
676 */
677
678 /* now reading record type (A, AAAA, CNAME, etc...) */
679 type = reader[0] * 256 + reader[1];
680
681 /* move forward 2 bytes for type (2) */
682 reader += 2;
683
684 /* move forward 6 bytes for class (2) and ttl (4) */
685 reader += 6;
686
687 /* now reading data len */
688 data_len = reader[0] * 256 + reader[1];
689
690 /* move forward 2 bytes for data len */
691 reader += 2;
692
693 /* analyzing record content */
694 switch (type) {
695 case DNS_RTYPE_A:
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100696 /* Store IPv4, only if some room is avalaible. */
697 if (rec_nb < DNS_MAX_IP_REC) {
698 rec[rec_nb].ip = reader;
699 rec[rec_nb].type = AF_INET;
700 rec_nb++;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200701 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200702 /* move forward data_len for analyzing next record in the response */
703 reader += data_len;
704 break;
705
706 case DNS_RTYPE_CNAME:
707 cname = reader;
708 cnamelen = data_len;
709
710 reader += data_len;
711 break;
712
713 case DNS_RTYPE_AAAA:
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100714 /* Store IPv6, only if some room is avalaible. */
715 if (rec_nb < DNS_MAX_IP_REC) {
716 rec[rec_nb].ip = reader;
717 rec[rec_nb].type = AF_INET6;
718 rec_nb++;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200719 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200720 /* move forward data_len for analyzing next record in the response */
721 reader += data_len;
722 break;
723
724 default:
725 /* not supported record type */
726 /* move forward data_len for analyzing next record in the response */
727 reader += data_len;
728 } /* switch (record type) */
729 } /* for i 0 to ancount */
730
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100731 /* Select an IP regarding configuration preference.
732 * Top priority is the prefered network ip version,
733 * second priority is the prefered network.
734 * the last priority is the currently used IP,
735 *
736 * For these three priorities, a score is calculated. The
737 * weight are:
738 * 4 - prefered netwok ip version.
739 * 2 - prefered network.
740 * 1 - current ip.
741 * The result with the biggest score is returned.
742 */
743 max_score = -1;
744 for (i = 0; i < rec_nb; i++) {
745
746 score = 0;
747
748 /* Check for prefered ip protocol. */
749 if (rec[i].type == family_priority)
750 score += 4;
751
752 /* Check for prefered network. */
753 for (j = 0; j < resol->opts->pref_net_nb; j++) {
754
755 /* Compare only the same adresses class. */
756 if (resol->opts->pref_net[j].family != rec[i].type)
757 continue;
758
759 if ((rec[i].type == AF_INET &&
760 in_net_ipv4((struct in_addr *)rec[i].ip,
761 &resol->opts->pref_net[j].mask.in4,
762 &resol->opts->pref_net[j].addr.in4)) ||
763 (rec[i].type == AF_INET6 &&
764 in_net_ipv6((struct in6_addr *)rec[i].ip,
765 &resol->opts->pref_net[j].mask.in6,
766 &resol->opts->pref_net[j].addr.in6))) {
767 score += 2;
768 break;
769 }
770 }
771
772 /* Check for current ip matching. */
773 if (rec[i].type == currentip_sin_family &&
774 ((currentip_sin_family == AF_INET &&
775 *(uint32_t *)rec[i].ip == *(uint32_t *)currentip) ||
776 (currentip_sin_family == AF_INET6 &&
777 memcmp(rec[i].ip, currentip, 16) == 0))) {
778 score += 1;
779 currentip_sel = 1;
780 } else
781 currentip_sel = 0;
782
783 /* Keep the address if the score is better than the previous
784 * score. The maximum score is 7, if this value is reached,
785 * we break the parsing. Implicitly, this score is reached
786 * the ip selected is the current ip.
787 */
788 if (score > max_score) {
789 if (rec[i].type == AF_INET)
790 newip4 = rec[i].ip;
791 else
792 newip6 = rec[i].ip;
793 currentip_found = currentip_sel;
794 if (score == 7)
795 return DNS_UPD_NO;
796 max_score = score;
797 }
798 }
799
Baptiste Assmann325137d2015-04-13 23:40:55 +0200800 /* only CNAMEs in the response, no IP found */
801 if (cname && !newip4 && !newip6) {
802 return DNS_UPD_CNAME;
803 }
804
Baptiste Assmann0453a1d2015-09-09 00:51:08 +0200805 /* no IP found in the response */
806 if (!newip4 && !newip6) {
807 return DNS_UPD_NO_IP_FOUND;
808 }
809
Baptiste Assmann325137d2015-04-13 23:40:55 +0200810 /* case when the caller looks first for an IPv4 address */
811 if (family_priority == AF_INET) {
812 if (newip4) {
813 *newip = newip4;
814 *newip_sin_family = AF_INET;
815 if (currentip_found == 1)
816 return DNS_UPD_NO;
817 return DNS_UPD_SRVIP_NOT_FOUND;
818 }
819 else if (newip6) {
820 *newip = newip6;
821 *newip_sin_family = AF_INET6;
822 if (currentip_found == 1)
823 return DNS_UPD_NO;
824 return DNS_UPD_SRVIP_NOT_FOUND;
825 }
826 }
827 /* case when the caller looks first for an IPv6 address */
828 else if (family_priority == AF_INET6) {
829 if (newip6) {
830 *newip = newip6;
831 *newip_sin_family = AF_INET6;
832 if (currentip_found == 1)
833 return DNS_UPD_NO;
834 return DNS_UPD_SRVIP_NOT_FOUND;
835 }
836 else if (newip4) {
837 *newip = newip4;
838 *newip_sin_family = AF_INET;
839 if (currentip_found == 1)
840 return DNS_UPD_NO;
841 return DNS_UPD_SRVIP_NOT_FOUND;
842 }
843 }
844 /* case when the caller have no preference (we prefer IPv6) */
845 else if (family_priority == AF_UNSPEC) {
846 if (newip6) {
847 *newip = newip6;
848 *newip_sin_family = AF_INET6;
849 if (currentip_found == 1)
850 return DNS_UPD_NO;
851 return DNS_UPD_SRVIP_NOT_FOUND;
852 }
853 else if (newip4) {
854 *newip = newip4;
855 *newip_sin_family = AF_INET;
856 if (currentip_found == 1)
857 return DNS_UPD_NO;
858 return DNS_UPD_SRVIP_NOT_FOUND;
859 }
860 }
861
862 /* no reason why we should change the server's IP address */
863 return DNS_UPD_NO;
864}
865
866/*
867 * returns the query id contained in a DNS response
868 */
Thiago Farinab1af23e2016-01-20 23:46:34 +0100869unsigned short dns_response_get_query_id(unsigned char *resp)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200870{
871 /* read the query id from the response */
872 return resp[0] * 256 + resp[1];
873}
874
875/*
876 * used during haproxy's init phase
877 * parses resolvers sections and initializes:
878 * - task (time events) for each resolvers section
879 * - the datagram layer (network IO events) for each nameserver
880 * returns:
881 * 0 in case of error
882 * 1 when no error
883 */
884int dns_init_resolvers(void)
885{
886 struct dns_resolvers *curr_resolvers;
887 struct dns_nameserver *curnameserver;
888 struct dgram_conn *dgram;
889 struct task *t;
890 int fd;
891
892 /* give a first random value to our dns query_id seed */
893 dns_query_id_seed = random();
894
895 /* run through the resolvers section list */
896 list_for_each_entry(curr_resolvers, &dns_resolvers, list) {
897 /* create the task associated to the resolvers section */
898 if ((t = task_new()) == NULL) {
899 Alert("Starting [%s] resolvers: out of memory.\n", curr_resolvers->id);
900 return 0;
901 }
902
903 /* update task's parameters */
904 t->process = dns_process_resolve;
905 t->context = curr_resolvers;
906 t->expire = TICK_ETERNITY;
907
908 curr_resolvers->t = t;
909
910 list_for_each_entry(curnameserver, &curr_resolvers->nameserver_list, list) {
Vincent Bernat02779b62016-04-03 13:48:43 +0200911 if ((dgram = calloc(1, sizeof(*dgram))) == NULL) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200912 Alert("Starting [%s/%s] nameserver: out of memory.\n", curr_resolvers->id,
913 curnameserver->id);
914 return 0;
915 }
916 /* update datagram's parameters */
917 dgram->owner = (void *)curnameserver;
918 dgram->data = &resolve_dgram_cb;
919
920 /* create network UDP socket for this nameserver */
921 if ((fd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
922 Alert("Starting [%s/%s] nameserver: can't create socket.\n", curr_resolvers->id,
923 curnameserver->id);
924 free(dgram);
925 dgram = NULL;
926 return 0;
927 }
928
929 /* "connect" the UDP socket to the name server IP */
Baptiste Assmann8c62c472015-09-21 20:55:08 +0200930 if (connect(fd, (struct sockaddr*)&curnameserver->addr, get_addr_len(&curnameserver->addr)) == -1) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200931 Alert("Starting [%s/%s] nameserver: can't connect socket.\n", curr_resolvers->id,
932 curnameserver->id);
933 close(fd);
934 free(dgram);
935 dgram = NULL;
936 return 0;
937 }
938
939 /* make the socket non blocking */
940 fcntl(fd, F_SETFL, O_NONBLOCK);
941
942 /* add the fd in the fd list and update its parameters */
943 fd_insert(fd);
944 fdtab[fd].owner = dgram;
945 fdtab[fd].iocb = dgram_fd_handler;
946 fd_want_recv(fd);
947 dgram->t.sock.fd = fd;
948
949 /* update nameserver's datagram property */
950 curnameserver->dgram = dgram;
951
952 continue;
953 }
954
955 /* task can be queued */
956 task_queue(t);
957 }
958
959 return 1;
960}
961
962/*
963 * Forge a DNS query. It needs the following information from the caller:
964 * - <query_id>: the DNS query id corresponding to this query
965 * - <query_type>: DNS_RTYPE_* request DNS record type (A, AAAA, ANY, etc...)
966 * - <hostname_dn>: hostname in domain name format
967 * - <hostname_dn_len>: length of <hostname_dn>
968 * To store the query, the caller must pass a buffer <buf> and its size <bufsize>
969 *
970 * the DNS query is stored in <buf>
971 * returns:
972 * -1 if <buf> is too short
973 */
974int dns_build_query(int query_id, int query_type, char *hostname_dn, int hostname_dn_len, char *buf, int bufsize)
975{
976 struct dns_header *dns;
Vincent Bernat9b7125c2016-04-08 22:17:45 +0200977 struct dns_question qinfo;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200978 char *ptr, *bufend;
979
980 memset(buf, '\0', bufsize);
981 ptr = buf;
982 bufend = buf + bufsize;
983
984 /* check if there is enough room for DNS headers */
985 if (ptr + sizeof(struct dns_header) >= bufend)
986 return -1;
987
988 /* set dns query headers */
989 dns = (struct dns_header *)ptr;
990 dns->id = (unsigned short) htons(query_id);
991 dns->qr = 0; /* query */
992 dns->opcode = 0;
993 dns->aa = 0;
994 dns->tc = 0;
995 dns->rd = 1; /* recursion desired */
996 dns->ra = 0;
997 dns->z = 0;
998 dns->rcode = 0;
999 dns->qdcount = htons(1); /* 1 question */
1000 dns->ancount = 0;
1001 dns->nscount = 0;
1002 dns->arcount = 0;
1003
1004 /* move forward ptr */
1005 ptr += sizeof(struct dns_header);
1006
1007 /* check if there is enough room for query hostname */
1008 if ((ptr + hostname_dn_len) >= bufend)
1009 return -1;
1010
1011 /* set up query hostname */
1012 memcpy(ptr, hostname_dn, hostname_dn_len);
1013 ptr[hostname_dn_len + 1] = '\0';
1014
1015 /* move forward ptr */
1016 ptr += (hostname_dn_len + 1);
1017
1018 /* check if there is enough room for query hostname*/
1019 if (ptr + sizeof(struct dns_question) >= bufend)
1020 return -1;
1021
1022 /* set up query info (type and class) */
Vincent Bernat9b7125c2016-04-08 22:17:45 +02001023 qinfo.qtype = htons(query_type);
1024 qinfo.qclass = htons(DNS_RCLASS_IN);
1025 memcpy(ptr, &qinfo, sizeof(qinfo));
Baptiste Assmann325137d2015-04-13 23:40:55 +02001026
1027 ptr += sizeof(struct dns_question);
1028
1029 return ptr - buf;
1030}
1031
1032/*
1033 * turn a string into domain name label:
1034 * www.haproxy.org into 3www7haproxy3org
1035 * if dn memory is pre-allocated, you must provide its size in dn_len
1036 * if dn memory isn't allocated, dn_len must be set to 0.
1037 * In the second case, memory will be allocated.
1038 * in case of error, -1 is returned, otherwise, number of bytes copied in dn
1039 */
Willy Tarreau2100b492015-07-22 16:42:43 +02001040char *dns_str_to_dn_label(const char *string, char *dn, int dn_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001041{
1042 char *c, *d;
1043 int i, offset;
1044
1045 /* offset between string size and theorical dn size */
1046 offset = 1;
1047
1048 /*
1049 * first, get the size of the string turned into its domain name version
1050 * This function also validates the string respect the RFC
1051 */
1052 if ((i = dns_str_to_dn_label_len(string)) == -1)
1053 return NULL;
1054
1055 /* yes, so let's check there is enough memory */
1056 if (dn_len < i + offset)
1057 return NULL;
1058
Willy Tarreaud69d6f32015-07-22 16:45:36 +02001059 i = strlen(string);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001060 memcpy(dn + offset, string, i);
1061 dn[i + offset] = '\0';
1062 /* avoid a '\0' at the beginning of dn string which may prevent the for loop
1063 * below from working.
1064 * Actually, this is the reason of the offset. */
1065 dn[0] = '0';
1066
1067 for (c = dn; *c ; ++c) {
1068 /* c points to the first '0' char or a dot, which we don't want to read */
1069 d = c + offset;
1070 i = 0;
1071 while (*d != '.' && *d) {
1072 i++;
1073 d++;
1074 }
1075 *c = i;
1076
1077 c = d - 1; /* because of c++ of the for loop */
1078 }
1079
1080 return dn;
1081}
1082
1083/*
1084 * compute and return the length of <string> it it were translated into domain name
1085 * label:
1086 * www.haproxy.org into 3www7haproxy3org would return 16
1087 * NOTE: add +1 for '\0' when allocating memory ;)
1088 */
1089int dns_str_to_dn_label_len(const char *string)
1090{
1091 return strlen(string) + 1;
1092}
1093
1094/*
1095 * validates host name:
1096 * - total size
1097 * - each label size individually
1098 * returns:
1099 * 0 in case of error. If <err> is not NULL, an error message is stored there.
1100 * 1 when no error. <err> is left unaffected.
1101 */
1102int dns_hostname_validation(const char *string, char **err)
1103{
1104 const char *c, *d;
1105 int i;
1106
1107 if (strlen(string) > DNS_MAX_NAME_SIZE) {
1108 if (err)
1109 *err = DNS_TOO_LONG_FQDN;
1110 return 0;
1111 }
1112
1113 c = string;
1114 while (*c) {
1115 d = c;
1116
1117 i = 0;
1118 while (*d != '.' && *d && i <= DNS_MAX_LABEL_SIZE) {
1119 i++;
1120 if (!((*d == '-') || (*d == '_') ||
1121 ((*d >= 'a') && (*d <= 'z')) ||
1122 ((*d >= 'A') && (*d <= 'Z')) ||
1123 ((*d >= '0') && (*d <= '9')))) {
1124 if (err)
1125 *err = DNS_INVALID_CHARACTER;
1126 return 0;
1127 }
1128 d++;
1129 }
1130
1131 if ((i >= DNS_MAX_LABEL_SIZE) && (d[i] != '.')) {
1132 if (err)
1133 *err = DNS_LABEL_TOO_LONG;
1134 return 0;
1135 }
1136
1137 if (*d == '\0')
1138 goto out;
1139
1140 c = ++d;
1141 }
1142 out:
1143 return 1;
1144}
1145
1146/*
1147 * 2 bytes random generator to generate DNS query ID
1148 */
1149uint16_t dns_rnd16(void)
1150{
1151 dns_query_id_seed ^= dns_query_id_seed << 13;
1152 dns_query_id_seed ^= dns_query_id_seed >> 7;
1153 dns_query_id_seed ^= dns_query_id_seed << 17;
1154 return dns_query_id_seed;
1155}
1156
1157
1158/*
1159 * function called when a timeout occurs during name resolution process
1160 * if max number of tries is reached, then stop, otherwise, retry.
1161 */
1162struct task *dns_process_resolve(struct task *t)
1163{
1164 struct dns_resolvers *resolvers = t->context;
1165 struct dns_resolution *resolution, *res_back;
Baptiste Assmann060e5732016-01-06 02:01:59 +01001166 int res_preferred_afinet, res_preferred_afinet6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001167
1168 /* timeout occurs inevitably for the first element of the FIFO queue */
1169 if (LIST_ISEMPTY(&resolvers->curr_resolution)) {
1170 /* no first entry, so wake up was useless */
1171 t->expire = TICK_ETERNITY;
1172 return t;
1173 }
1174
1175 /* look for the first resolution which is not expired */
1176 list_for_each_entry_safe(resolution, res_back, &resolvers->curr_resolution, list) {
1177 /* when we find the first resolution in the future, then we can stop here */
1178 if (tick_is_le(now_ms, resolution->last_sent_packet))
1179 goto out;
1180
1181 /*
1182 * if current resolution has been tried too many times and finishes in timeout
1183 * we update its status and remove it from the list
1184 */
Baptiste Assmannf778bb42015-09-09 00:54:38 +02001185 if (resolution->try <= 0) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001186 /* clean up resolution information and remove from the list */
1187 dns_reset_resolution(resolution);
1188
1189 /* notify the result to the requester */
1190 resolution->requester_error_cb(resolution, DNS_RESP_TIMEOUT);
Baptiste Assmann382824c2016-01-06 01:53:46 +01001191 goto out;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001192 }
1193
Baptiste Assmannf778bb42015-09-09 00:54:38 +02001194 resolution->try -= 1;
1195
Baptiste Assmann6f79aca2016-04-05 21:19:51 +02001196 res_preferred_afinet = resolution->opts->family_prio == AF_INET && resolution->query_type == DNS_RTYPE_A;
1197 res_preferred_afinet6 = resolution->opts->family_prio == AF_INET6 && resolution->query_type == DNS_RTYPE_AAAA;
Baptiste Assmann060e5732016-01-06 02:01:59 +01001198
1199 /* let's change the query type if needed */
1200 if (res_preferred_afinet6) {
1201 /* fallback from AAAA to A */
1202 resolution->query_type = DNS_RTYPE_A;
1203 }
1204 else if (res_preferred_afinet) {
1205 /* fallback from A to AAAA */
1206 resolution->query_type = DNS_RTYPE_AAAA;
1207 }
1208
Baptiste Assmann382824c2016-01-06 01:53:46 +01001209 /* resend the DNS query */
1210 dns_send_query(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001211
Baptiste Assmann382824c2016-01-06 01:53:46 +01001212 /* check if we have more than one resolution in the list */
1213 if (dns_check_resolution_queue(resolvers) > 1) {
1214 /* move the rsolution to the end of the list */
1215 LIST_DEL(&resolution->list);
1216 LIST_ADDQ(&resolvers->curr_resolution, &resolution->list);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001217 }
1218 }
1219
1220 out:
1221 dns_update_resolvers_timeout(resolvers);
1222 return t;
1223}