blob: 503eb674bcbfc6a94add3ca395251d25f6b264cb [file] [log] [blame]
Baptiste Assmann325137d2015-04-13 23:40:55 +02001/*
2 * Name server resolution
3 *
4 * Copyright 2014 Baptiste Assmann <bedis9@gmail.com>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <errno.h>
14#include <fcntl.h>
15#include <stdio.h>
16#include <stdlib.h>
17#include <string.h>
18#include <unistd.h>
19
20#include <sys/types.h>
21
Baptiste Assmann044fd5b2018-08-10 10:56:38 +020022#include <common/cfgparse.h>
Christopher Faulet67957bd2017-09-27 11:00:59 +020023#include <common/errors.h>
Willy Tarreau0108d902018-11-25 19:14:37 +010024#include <common/initcall.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020025#include <common/time.h>
26#include <common/ticks.h>
Olivier Houchard8da5f982017-08-04 18:35:36 +020027#include <common/net_helper.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020028
Baptiste Assmann333939c2019-01-21 08:34:50 +010029#include <types/action.h>
William Lallemand69e96442016-11-19 00:58:54 +010030#include <types/applet.h>
31#include <types/cli.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020032#include <types/global.h>
33#include <types/dns.h>
William Lallemand69e96442016-11-19 00:58:54 +010034#include <types/stats.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020035
Baptiste Assmann333939c2019-01-21 08:34:50 +010036#include <proto/action.h>
William Lallemand69e96442016-11-19 00:58:54 +010037#include <proto/channel.h>
38#include <proto/cli.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020039#include <proto/checks.h>
40#include <proto/dns.h>
41#include <proto/fd.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010042#include <proto/proto_http.h>
43#include <proto/http_rules.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020044#include <proto/log.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010045#include <proto/sample.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020046#include <proto/server.h>
47#include <proto/task.h>
48#include <proto/proto_udp.h>
Christopher Faulet67957bd2017-09-27 11:00:59 +020049#include <proto/proxy.h>
William Lallemand69e96442016-11-19 00:58:54 +010050#include <proto/stream_interface.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010051#include <proto/tcp_rules.h>
52#include <proto/vars.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020053
Christopher Faulet67957bd2017-09-27 11:00:59 +020054struct list dns_resolvers = LIST_HEAD_INIT(dns_resolvers);
55struct list dns_srvrq_list = LIST_HEAD_INIT(dns_srvrq_list);
Baptiste Assmann325137d2015-04-13 23:40:55 +020056
Christopher Fauletb2812a62017-10-04 16:17:58 +020057static THREAD_LOCAL int64_t dns_query_id_seed = 0; /* random seed */
Willy Tarreau8ceae722018-11-26 11:58:30 +010058
59DECLARE_STATIC_POOL(dns_answer_item_pool, "dns_answer_item", sizeof(struct dns_answer_item));
60DECLARE_STATIC_POOL(dns_resolution_pool, "dns_resolution", sizeof(struct dns_resolution));
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +010061DECLARE_POOL(dns_requester_pool, "dns_requester", sizeof(struct dns_requester));
Willy Tarreau8ceae722018-11-26 11:58:30 +010062
Christopher Faulet67957bd2017-09-27 11:00:59 +020063static unsigned int resolution_uuid = 1;
Baptiste Assmann333939c2019-01-21 08:34:50 +010064unsigned int dns_failed_resolutions = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020065
Christopher Faulet67957bd2017-09-27 11:00:59 +020066/* Returns a pointer to the resolvers matching the id <id>. NULL is returned if
67 * no match is found.
Baptiste Assmann325137d2015-04-13 23:40:55 +020068 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020069struct dns_resolvers *find_resolvers_by_id(const char *id)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020070{
Christopher Faulet67957bd2017-09-27 11:00:59 +020071 struct dns_resolvers *res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020072
Christopher Faulet67957bd2017-09-27 11:00:59 +020073 list_for_each_entry(res, &dns_resolvers, list) {
74 if (!strcmp(res->id, id))
75 return res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020076 }
Christopher Faulet67957bd2017-09-27 11:00:59 +020077 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020078}
79
Christopher Faulet67957bd2017-09-27 11:00:59 +020080/* Returns a pointer on the SRV request matching the name <name> for the proxy
81 * <px>. NULL is returned if no match is found.
Baptiste Assmann201c07f2017-05-22 15:17:15 +020082 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020083struct dns_srvrq *find_srvrq_by_name(const char *name, struct proxy *px)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020084{
Christopher Faulet67957bd2017-09-27 11:00:59 +020085 struct dns_srvrq *srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020086
Christopher Faulet67957bd2017-09-27 11:00:59 +020087 list_for_each_entry(srvrq, &dns_srvrq_list, list) {
88 if (srvrq->proxy == px && !strcmp(srvrq->name, name))
89 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020090 }
Christopher Faulet67957bd2017-09-27 11:00:59 +020091 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020092}
93
Christopher Faulet67957bd2017-09-27 11:00:59 +020094/* Allocates a new SRVRQ for the given server with the name <fqdn>. It returns
95 * NULL if an error occurred. */
96struct dns_srvrq *new_dns_srvrq(struct server *srv, char *fqdn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020097{
Christopher Faulet67957bd2017-09-27 11:00:59 +020098 struct proxy *px = srv->proxy;
99 struct dns_srvrq *srvrq = NULL;
100 int fqdn_len, hostname_dn_len;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200101
Christopher Faulet67957bd2017-09-27 11:00:59 +0200102 fqdn_len = strlen(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200103 hostname_dn_len = dns_str_to_dn_label(fqdn, fqdn_len + 1, trash.area,
104 trash.size);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200105 if (hostname_dn_len == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100106 ha_alert("config : %s '%s', server '%s': failed to parse FQDN '%s'\n",
107 proxy_type_str(px), px->id, srv->id, fqdn);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200108 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200109 }
110
Christopher Faulet67957bd2017-09-27 11:00:59 +0200111 if ((srvrq = calloc(1, sizeof(*srvrq))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100112 ha_alert("config : %s '%s', server '%s': out of memory\n",
113 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200114 goto err;
115 }
116 srvrq->obj_type = OBJ_TYPE_SRVRQ;
117 srvrq->proxy = px;
118 srvrq->name = strdup(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200119 srvrq->hostname_dn = strdup(trash.area);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200120 srvrq->hostname_dn_len = hostname_dn_len;
121 if (!srvrq->name || !srvrq->hostname_dn) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100122 ha_alert("config : %s '%s', server '%s': out of memory\n",
123 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200124 goto err;
125 }
126 LIST_ADDQ(&dns_srvrq_list, &srvrq->list);
127 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200128
Christopher Faulet67957bd2017-09-27 11:00:59 +0200129 err:
130 if (srvrq) {
131 free(srvrq->name);
132 free(srvrq->hostname_dn);
133 free(srvrq);
134 }
135 return NULL;
136}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200137
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200138
Christopher Faulet67957bd2017-09-27 11:00:59 +0200139/* 2 bytes random generator to generate DNS query ID */
140static inline uint16_t dns_rnd16(void)
141{
Christopher Fauletb2812a62017-10-04 16:17:58 +0200142 if (!dns_query_id_seed)
143 dns_query_id_seed = now_ms;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200144 dns_query_id_seed ^= dns_query_id_seed << 13;
145 dns_query_id_seed ^= dns_query_id_seed >> 7;
146 dns_query_id_seed ^= dns_query_id_seed << 17;
147 return dns_query_id_seed;
148}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200149
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200150
Christopher Faulet67957bd2017-09-27 11:00:59 +0200151static inline int dns_resolution_timeout(struct dns_resolution *res)
152{
153 switch (res->status) {
154 case RSLV_STATUS_VALID: return res->resolvers->hold.valid;
155 default: return res->resolvers->timeout.resolve;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200156 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200157}
158
Christopher Faulet67957bd2017-09-27 11:00:59 +0200159/* Updates a resolvers' task timeout for next wake up and queue it */
160static void dns_update_resolvers_timeout(struct dns_resolvers *resolvers)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200161{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200162 struct dns_resolution *res;
163 int next;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200164
Christopher Faulet67957bd2017-09-27 11:00:59 +0200165 next = tick_add(now_ms, resolvers->timeout.resolve);
166 if (!LIST_ISEMPTY(&resolvers->resolutions.curr)) {
167 res = LIST_NEXT(&resolvers->resolutions.curr, struct dns_resolution *, list);
168 next = MIN(next, tick_add(res->last_query, resolvers->timeout.retry));
169 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200170
Christopher Faulet67957bd2017-09-27 11:00:59 +0200171 list_for_each_entry(res, &resolvers->resolutions.wait, list)
172 next = MIN(next, tick_add(res->last_resolution, dns_resolution_timeout(res)));
Baptiste Assmann325137d2015-04-13 23:40:55 +0200173
Christopher Faulet67957bd2017-09-27 11:00:59 +0200174 resolvers->t->expire = next;
175 task_queue(resolvers->t);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200176}
177
Christopher Faulet67957bd2017-09-27 11:00:59 +0200178/* Opens an UDP socket on the namesaver's IP/Port, if required. Returns 0 on
179 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200180 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200181static int dns_connect_namesaver(struct dns_nameserver *ns)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200182{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200183 struct dgram_conn *dgram = ns->dgram;
184 int fd;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200185
Christopher Faulet67957bd2017-09-27 11:00:59 +0200186 /* Already connected */
187 if (dgram->t.sock.fd != -1)
188 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200189
Christopher Faulet67957bd2017-09-27 11:00:59 +0200190 /* Create an UDP socket and connect it on the nameserver's IP/Port */
191 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
192 send_log(NULL, LOG_WARNING,
193 "DNS : resolvers '%s': can't create socket for nameserver '%s'.\n",
194 ns->resolvers->id, ns->id);
195 return -1;
196 }
197 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
198 send_log(NULL, LOG_WARNING,
199 "DNS : resolvers '%s': can't connect socket for nameserver '%s'.\n",
200 ns->resolvers->id, ns->id);
201 close(fd);
202 return -1;
203 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200204
Christopher Faulet67957bd2017-09-27 11:00:59 +0200205 /* Make the socket non blocking */
206 fcntl(fd, F_SETFL, O_NONBLOCK);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200207
Christopher Faulet67957bd2017-09-27 11:00:59 +0200208 /* Add the fd in the fd list and update its parameters */
209 dgram->t.sock.fd = fd;
Willy Tarreaua9786b62018-01-25 07:22:13 +0100210 fd_insert(fd, dgram, dgram_fd_handler, MAX_THREADS_MASK);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200211 fd_want_recv(fd);
212 return 0;
213}
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200214
Christopher Faulet67957bd2017-09-27 11:00:59 +0200215/* Forges a DNS query. It needs the following information from the caller:
216 * - <query_id> : the DNS query id corresponding to this query
217 * - <query_type> : DNS_RTYPE_* request DNS record type (A, AAAA, ANY...)
218 * - <hostname_dn> : hostname in domain name format
219 * - <hostname_dn_len> : length of <hostname_dn>
220 *
221 * To store the query, the caller must pass a buffer <buf> and its size
222 * <bufsize>. It returns the number of written bytes in success, -1 if <buf> is
223 * too short.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200224 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200225static int dns_build_query(int query_id, int query_type, unsigned int accepted_payload_size,
226 char *hostname_dn, int hostname_dn_len, char *buf, int bufsize)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200227{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200228 struct dns_header dns_hdr;
229 struct dns_question qinfo;
230 struct dns_additional_record edns;
231 char *p = buf;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200232
Christopher Faulet67957bd2017-09-27 11:00:59 +0200233 if (sizeof(dns_hdr) + sizeof(qinfo) + sizeof(edns) + hostname_dn_len >= bufsize)
234 return -1;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200235
Christopher Faulet67957bd2017-09-27 11:00:59 +0200236 memset(buf, 0, bufsize);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200237
Christopher Faulet67957bd2017-09-27 11:00:59 +0200238 /* Set dns query headers */
239 dns_hdr.id = (unsigned short) htons(query_id);
240 dns_hdr.flags = htons(0x0100); /* qr=0, opcode=0, aa=0, tc=0, rd=1, ra=0, z=0, rcode=0 */
241 dns_hdr.qdcount = htons(1); /* 1 question */
242 dns_hdr.ancount = 0;
243 dns_hdr.nscount = 0;
244 dns_hdr.arcount = htons(1);
245 memcpy(p, &dns_hdr, sizeof(dns_hdr));
246 p += sizeof(dns_hdr);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200247
Christopher Faulet67957bd2017-09-27 11:00:59 +0200248 /* Set up query hostname */
249 memcpy(p, hostname_dn, hostname_dn_len);
250 p += hostname_dn_len;
251 *p++ = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200252
Christopher Faulet67957bd2017-09-27 11:00:59 +0200253 /* Set up query info (type and class) */
254 qinfo.qtype = htons(query_type);
255 qinfo.qclass = htons(DNS_RCLASS_IN);
256 memcpy(p, &qinfo, sizeof(qinfo));
257 p += sizeof(qinfo);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200258
Christopher Faulet67957bd2017-09-27 11:00:59 +0200259 /* Set the DNS extension */
260 edns.name = 0;
261 edns.type = htons(DNS_RTYPE_OPT);
262 edns.udp_payload_size = htons(accepted_payload_size);
263 edns.extension = 0;
264 edns.data_length = 0;
265 memcpy(p, &edns, sizeof(edns));
266 p += sizeof(edns);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200267
Christopher Faulet67957bd2017-09-27 11:00:59 +0200268 return (p - buf);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200269}
270
Christopher Faulet67957bd2017-09-27 11:00:59 +0200271/* Sends a DNS query to resolvers associated to a resolution. It returns 0 on
272 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200273 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200274static int dns_send_query(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200275{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200276 struct dns_resolvers *resolvers = resolution->resolvers;
277 struct dns_nameserver *ns;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200278
Christopher Faulet67957bd2017-09-27 11:00:59 +0200279 list_for_each_entry(ns, &resolvers->nameservers, list) {
280 int fd = ns->dgram->t.sock.fd;
281 if (fd == -1) {
282 if (dns_connect_namesaver(ns) == -1)
283 continue;
284 fd = ns->dgram->t.sock.fd;
285 resolvers->nb_nameservers++;
286 }
287 fd_want_send(fd);
288 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200289
Christopher Faulet67957bd2017-09-27 11:00:59 +0200290 /* Update resolution */
291 resolution->nb_queries = 0;
292 resolution->nb_responses = 0;
293 resolution->last_query = now_ms;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200294
Christopher Faulet67957bd2017-09-27 11:00:59 +0200295 /* Push the resolution at the end of the active list */
296 LIST_DEL(&resolution->list);
297 LIST_ADDQ(&resolvers->resolutions.curr, &resolution->list);
298 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200299}
300
Christopher Faulet67957bd2017-09-27 11:00:59 +0200301/* Prepares and sends a DNS resolution. It returns 1 if the query was sent, 0 if
302 * skipped and -1 if an error occurred.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200303 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200304static int
305dns_run_resolution(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200306{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200307 struct dns_resolvers *resolvers = resolution->resolvers;
308 int query_id, i;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200309
Christopher Faulet67957bd2017-09-27 11:00:59 +0200310 /* Avoid sending requests for resolutions that don't yet have an
311 * hostname, ie resolutions linked to servers that do not yet have an
312 * fqdn */
313 if (!resolution->hostname_dn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200314 return 0;
315
Christopher Faulet67957bd2017-09-27 11:00:59 +0200316 /* Check if a resolution has already been started for this server return
317 * directly to avoid resolution pill up. */
318 if (resolution->step != RSLV_STEP_NONE)
319 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200320
Christopher Faulet67957bd2017-09-27 11:00:59 +0200321 /* Generates a new query id. We try at most 100 times to find a free
322 * query id */
323 for (i = 0; i < 100; ++i) {
324 query_id = dns_rnd16();
325 if (!eb32_lookup(&resolvers->query_ids, query_id))
Olivier Houchard8da5f982017-08-04 18:35:36 +0200326 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200327 query_id = -1;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200328 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200329 if (query_id == -1) {
330 send_log(NULL, LOG_NOTICE,
331 "could not generate a query id for %s, in resolvers %s.\n",
332 resolution->hostname_dn, resolvers->id);
333 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200334 }
335
Christopher Faulet67957bd2017-09-27 11:00:59 +0200336 /* Update resolution parameters */
337 resolution->query_id = query_id;
338 resolution->qid.key = query_id;
339 resolution->step = RSLV_STEP_RUNNING;
340 resolution->query_type = resolution->prefered_query_type;
341 resolution->try = resolvers->resolve_retries;
342 eb32_insert(&resolvers->query_ids, &resolution->qid);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200343
Christopher Faulet67957bd2017-09-27 11:00:59 +0200344 /* Send the DNS query */
345 resolution->try -= 1;
346 dns_send_query(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200347 return 1;
348}
349
Christopher Faulet67957bd2017-09-27 11:00:59 +0200350/* Performs a name resolution for the requester <req> */
351void dns_trigger_resolution(struct dns_requester *req)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200352{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200353 struct dns_resolvers *resolvers;
354 struct dns_resolution *res;
355 int exp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200356
Christopher Faulet67957bd2017-09-27 11:00:59 +0200357 if (!req || !req->resolution)
358 return;
359 res = req->resolution;
360 resolvers = res->resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200361
Christopher Faulet67957bd2017-09-27 11:00:59 +0200362 /* The resolution must not be triggered yet. Use the cached response, if
363 * valid */
364 exp = tick_add(res->last_resolution, resolvers->hold.valid);
Olivier Houchardf3d9e602018-05-22 18:40:07 +0200365 if (resolvers->t && (res->status != RSLV_STATUS_VALID ||
366 !tick_isset(res->last_resolution) || tick_is_expired(exp, now_ms)))
367 task_wakeup(resolvers->t, TASK_WOKEN_OTHER);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200368}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200369
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200370
Christopher Faulet67957bd2017-09-27 11:00:59 +0200371/* Resets some resolution parameters to initial values and also delete the query
372 * ID from the resolver's tree.
373 */
374static void dns_reset_resolution(struct dns_resolution *resolution)
375{
376 /* update resolution status */
377 resolution->step = RSLV_STEP_NONE;
378 resolution->try = 0;
379 resolution->last_resolution = now_ms;
380 resolution->nb_queries = 0;
381 resolution->nb_responses = 0;
382 resolution->query_type = resolution->prefered_query_type;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200383
Christopher Faulet67957bd2017-09-27 11:00:59 +0200384 /* clean up query id */
385 eb32_delete(&resolution->qid);
386 resolution->query_id = 0;
387 resolution->qid.key = 0;
388}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200389
Christopher Faulet67957bd2017-09-27 11:00:59 +0200390/* Returns the query id contained in a DNS response */
391static inline unsigned short dns_response_get_query_id(unsigned char *resp)
392{
393 return resp[0] * 256 + resp[1];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200394}
395
Christopher Faulet67957bd2017-09-27 11:00:59 +0200396
397/* Analyses, re-builds and copies the name <name> from the DNS response packet
398 * <buffer>. <name> must point to the 'data_len' information or pointer 'c0'
399 * for compressed data. The result is copied into <dest>, ensuring we don't
400 * overflow using <dest_len> Returns the number of bytes the caller can move
401 * forward. If 0 it means an error occurred while parsing the name. <offset> is
402 * the number of bytes the caller could move forward.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200403 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200404int dns_read_name(unsigned char *buffer, unsigned char *bufend,
405 unsigned char *name, char *destination, int dest_len,
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100406 int *offset, unsigned int depth)
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200407{
408 int nb_bytes = 0, n = 0;
409 int label_len;
410 unsigned char *reader = name;
411 char *dest = destination;
412
413 while (1) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100414 if (reader >= bufend)
415 goto err;
416
Christopher Faulet67957bd2017-09-27 11:00:59 +0200417 /* Name compression is in use */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200418 if ((*reader & 0xc0) == 0xc0) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100419 if (reader + 1 >= bufend)
420 goto err;
421
Christopher Faulet67957bd2017-09-27 11:00:59 +0200422 /* Must point BEFORE current position */
423 if ((buffer + reader[1]) > reader)
424 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200425
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100426 if (depth++ > 100)
427 goto err;
428
Nikhil Agrawal2fa66c32018-12-20 10:50:59 +0530429 n = dns_read_name(buffer, bufend, buffer + (*reader & 0x3f)*256 + reader[1],
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100430 dest, dest_len - nb_bytes, offset, depth);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200431 if (n == 0)
Christopher Faulet67957bd2017-09-27 11:00:59 +0200432 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200433
Christopher Faulet67957bd2017-09-27 11:00:59 +0200434 dest += n;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200435 nb_bytes += n;
436 goto out;
437 }
438
439 label_len = *reader;
440 if (label_len == 0)
441 goto out;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200442
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200443 /* Check if:
444 * - we won't read outside the buffer
445 * - there is enough place in the destination
446 */
447 if ((reader + label_len >= bufend) || (nb_bytes + label_len >= dest_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +0200448 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200449
450 /* +1 to take label len + label string */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200451 label_len++;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200452
453 memcpy(dest, reader, label_len);
454
Christopher Faulet67957bd2017-09-27 11:00:59 +0200455 dest += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200456 nb_bytes += label_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200457 reader += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200458 }
459
Christopher Faulet67957bd2017-09-27 11:00:59 +0200460 out:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200461 /* offset computation:
462 * parse from <name> until finding either NULL or a pointer "c0xx"
463 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200464 reader = name;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200465 *offset = 0;
466 while (reader < bufend) {
467 if ((reader[0] & 0xc0) == 0xc0) {
468 *offset += 2;
469 break;
470 }
471 else if (*reader == 0) {
472 *offset += 1;
473 break;
474 }
475 *offset += 1;
476 ++reader;
477 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200478 return nb_bytes;
479
Christopher Faulet67957bd2017-09-27 11:00:59 +0200480 err:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200481 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200482}
483
Christopher Faulet67957bd2017-09-27 11:00:59 +0200484/* Checks for any obsolete record, also identify any SRV request, and try to
485 * find a corresponding server.
486*/
487static void dns_check_dns_response(struct dns_resolution *res)
488{
489 struct dns_resolvers *resolvers = res->resolvers;
490 struct dns_requester *req, *reqback;
491 struct dns_answer_item *item, *itemback;
492 struct server *srv;
493 struct dns_srvrq *srvrq;
494
495 list_for_each_entry_safe(item, itemback, &res->response.answer_list, list) {
496
497 /* Remove obsolete items */
498 if ((item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
499 if (item->type != DNS_RTYPE_SRV)
500 goto rm_obselete_item;
501
502 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
503 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
504 continue;
505
506 /* Remove any associated server */
507 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100508 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200509 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
510 item->data_len == srv->hostname_dn_len &&
511 !memcmp(srv->hostname_dn, item->target, item->data_len)) {
512 snr_update_srv_status(srv, 1);
513 free(srv->hostname);
514 free(srv->hostname_dn);
515 srv->hostname = NULL;
516 srv->hostname_dn = NULL;
517 srv->hostname_dn_len = 0;
518 dns_unlink_resolution(srv->dns_requester);
519 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100520 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200521 }
522 }
523
524 rm_obselete_item:
525 LIST_DEL(&item->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +0100526 pool_free(dns_answer_item_pool, item);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200527 continue;
528 }
529
530 if (item->type != DNS_RTYPE_SRV)
531 continue;
532
533 /* Now process SRV records */
534 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
535 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
536 continue;
537
538 /* Check if a server already uses that hostname */
539 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100540 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200541 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
542 item->data_len == srv->hostname_dn_len &&
543 !memcmp(srv->hostname_dn, item->target, item->data_len)) {
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100544 int ha_weight;
545
546 /* Make sure weight is at least 1, so
547 * that the server will be used.
548 */
549 ha_weight = item->weight / 256 + 1;
550 if (srv->uweight != ha_weight) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200551 char weight[9];
552
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100553 snprintf(weight, sizeof(weight), "%d", ha_weight);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200554 server_parse_weight_change_request(srv, weight);
555 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100556 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200557 break;
558 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100559 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200560 }
561 if (srv)
562 continue;
563
564 /* If not, try to find a server with undefined hostname */
565 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100566 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200567 if (srv->srvrq == srvrq && !srv->hostname_dn)
568 break;
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100569 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200570 }
571 /* And update this server, if found */
572 if (srv) {
573 const char *msg = NULL;
574 char weight[9];
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100575 int ha_weight;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200576 char hostname[DNS_MAX_NAME_SIZE];
577
578 if (dns_dn_label_to_str(item->target, item->data_len+1,
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100579 hostname, DNS_MAX_NAME_SIZE) == -1) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100580 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200581 continue;
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100582 }
Olivier Houchardd16bfe62017-10-31 15:21:19 +0100583 msg = update_server_fqdn(srv, hostname, "SRV record", 1);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200584 if (msg)
585 send_log(srv->proxy, LOG_NOTICE, "%s", msg);
586
587 srv->svc_port = item->port;
588 srv->flags &= ~SRV_F_MAPPORTS;
589 if ((srv->check.state & CHK_ST_CONFIGURED) &&
590 !(srv->flags & SRV_F_CHECKPORT))
591 srv->check.port = item->port;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100592
593 /* Make sure weight is at least 1, so
594 * that the server will be used.
595 */
596 ha_weight = item->weight / 256 + 1;
597
598 snprintf(weight, sizeof(weight), "%d", ha_weight);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200599 server_parse_weight_change_request(srv, weight);
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100600 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200601 }
602 }
603 }
604}
605
606/* Validates that the buffer DNS response provided in <resp> and finishing
607 * before <bufend> is valid from a DNS protocol point of view.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200608 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200609 * The result is stored in <resolution>' response, buf_response,
610 * response_query_records and response_answer_records members.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200611 *
612 * This function returns one of the DNS_RESP_* code to indicate the type of
613 * error found.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200614 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200615static int dns_validate_dns_response(unsigned char *resp, unsigned char *bufend,
616 struct dns_resolution *resolution, int max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200617{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200618 unsigned char *reader;
619 char *previous_dname, tmpname[DNS_MAX_NAME_SIZE];
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200620 int len, flags, offset;
621 int dns_query_record_id;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200622 int nb_saved_records;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200623 struct dns_query_item *dns_query;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200624 struct dns_answer_item *dns_answer_record, *tmp_record;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200625 struct dns_response_packet *dns_p;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200626 int i, found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200627
Christopher Faulet67957bd2017-09-27 11:00:59 +0200628 reader = resp;
629 len = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200630 previous_dname = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200631 dns_query = NULL;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200632
Christopher Faulet67957bd2017-09-27 11:00:59 +0200633 /* Initialization of response buffer and structure */
Baptiste Assmann729c9012017-05-22 15:13:10 +0200634 dns_p = &resolution->response;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200635
636 /* query id */
637 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200638 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200639 dns_p->header.id = reader[0] * 256 + reader[1];
640 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200641
Christopher Faulet67957bd2017-09-27 11:00:59 +0200642 /* Flags and rcode are stored over 2 bytes
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200643 * First byte contains:
644 * - response flag (1 bit)
645 * - opcode (4 bits)
646 * - authoritative (1 bit)
647 * - truncated (1 bit)
648 * - recursion desired (1 bit)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200649 */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200650 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200651 return DNS_RESP_INVALID;
652
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200653 flags = reader[0] * 256 + reader[1];
654
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200655 if ((flags & DNS_FLAG_REPLYCODE) != DNS_RCODE_NO_ERROR) {
656 if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_NX_DOMAIN)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200657 return DNS_RESP_NX_DOMAIN;
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200658 else if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_REFUSED)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200659 return DNS_RESP_REFUSED;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200660 return DNS_RESP_ERROR;
661 }
662
Christopher Faulet67957bd2017-09-27 11:00:59 +0200663 /* Move forward 2 bytes for flags */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200664 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200665
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200666 /* 2 bytes for question count */
667 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200668 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200669 dns_p->header.qdcount = reader[0] * 256 + reader[1];
Christopher Faulet67957bd2017-09-27 11:00:59 +0200670 /* (for now) we send one query only, so we expect only one in the
671 * response too */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200672 if (dns_p->header.qdcount != 1)
673 return DNS_RESP_QUERY_COUNT_ERROR;
674 if (dns_p->header.qdcount > DNS_MAX_QUERY_RECORDS)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200675 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200676 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200677
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200678 /* 2 bytes for answer count */
679 if (reader + 2 >= bufend)
680 return DNS_RESP_INVALID;
681 dns_p->header.ancount = reader[0] * 256 + reader[1];
682 if (dns_p->header.ancount == 0)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200683 return DNS_RESP_ANCOUNT_ZERO;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200684 /* Check if too many records are announced */
Baptiste Assmann9d8dbbc2017-08-18 23:35:08 +0200685 if (dns_p->header.ancount > max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200686 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200687 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200688
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200689 /* 2 bytes authority count */
690 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200691 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200692 dns_p->header.nscount = reader[0] * 256 + reader[1];
693 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200694
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200695 /* 2 bytes additional count */
696 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200697 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200698 dns_p->header.arcount = reader[0] * 256 + reader[1];
699 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200700
Christopher Faulet67957bd2017-09-27 11:00:59 +0200701 /* Parsing dns queries */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200702 LIST_INIT(&dns_p->query_list);
703 for (dns_query_record_id = 0; dns_query_record_id < dns_p->header.qdcount; dns_query_record_id++) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200704 /* Use next pre-allocated dns_query_item after ensuring there is
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200705 * still one available.
Christopher Faulet67957bd2017-09-27 11:00:59 +0200706 * It's then added to our packet query list. */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200707 if (dns_query_record_id > DNS_MAX_QUERY_RECORDS)
708 return DNS_RESP_INVALID;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200709 dns_query = &resolution->response_query_records[dns_query_record_id];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200710 LIST_ADDQ(&dns_p->query_list, &dns_query->list);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200711
Christopher Faulet67957bd2017-09-27 11:00:59 +0200712 /* Name is a NULL terminated string in our case, since we have
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200713 * one query per response and the first one can't be compressed
Christopher Faulet67957bd2017-09-27 11:00:59 +0200714 * (using the 0x0c format) */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200715 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100716 len = dns_read_name(resp, bufend, reader, dns_query->name, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200717
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200718 if (len == 0)
719 return DNS_RESP_INVALID;
720
721 reader += offset;
722 previous_dname = dns_query->name;
723
724 /* move forward 2 bytes for question type */
725 if (reader + 2 >= bufend)
726 return DNS_RESP_INVALID;
727 dns_query->type = reader[0] * 256 + reader[1];
728 reader += 2;
729
730 /* move forward 2 bytes for question class */
731 if (reader + 2 >= bufend)
732 return DNS_RESP_INVALID;
733 dns_query->class = reader[0] * 256 + reader[1];
734 reader += 2;
735 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200736
Baptiste Assmann251abb92017-08-11 09:58:27 +0200737 /* TRUNCATED flag must be checked after we could read the query type
Christopher Faulet67957bd2017-09-27 11:00:59 +0200738 * because a TRUNCATED SRV query type response can still be exploited */
Baptiste Assmann251abb92017-08-11 09:58:27 +0200739 if (dns_query->type != DNS_RTYPE_SRV && flags & DNS_FLAG_TRUNCATED)
740 return DNS_RESP_TRUNCATED;
741
Baptiste Assmann325137d2015-04-13 23:40:55 +0200742 /* now parsing response records */
Baptiste Assmann69fce672017-05-04 08:37:45 +0200743 nb_saved_records = 0;
Olivier Houchard8da5f982017-08-04 18:35:36 +0200744 for (i = 0; i < dns_p->header.ancount; i++) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200745 if (reader >= bufend)
746 return DNS_RESP_INVALID;
747
Willy Tarreaubafbe012017-11-24 17:34:44 +0100748 dns_answer_record = pool_alloc(dns_answer_item_pool);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200749 if (dns_answer_record == NULL)
750 return (DNS_RESP_INVALID);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200751
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200752 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100753 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200754
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200755 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100756 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200757 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200758 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200759
Christopher Faulet67957bd2017-09-27 11:00:59 +0200760 /* Check if the current record dname is valid. previous_dname
761 * points either to queried dname or last CNAME target */
Baptiste Assmannddc8ce62017-08-11 10:31:22 +0200762 if (dns_query->type != DNS_RTYPE_SRV && memcmp(previous_dname, tmpname, len) != 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100763 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200764 if (i == 0) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200765 /* First record, means a mismatch issue between
766 * queried dname and dname found in the first
767 * record */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200768 return DNS_RESP_INVALID;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200769 }
770 else {
771 /* If not the first record, this means we have a
772 * CNAME resolution error */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200773 return DNS_RESP_CNAME_ERROR;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200774 }
775
Baptiste Assmann325137d2015-04-13 23:40:55 +0200776 }
777
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200778 memcpy(dns_answer_record->name, tmpname, len);
779 dns_answer_record->name[len] = 0;
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200780
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200781 reader += offset;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200782 if (reader >= bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100783 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200784 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200785 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200786
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200787 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200788 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100789 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200790 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200791 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200792 dns_answer_record->type = reader[0] * 256 + reader[1];
793 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200794
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200795 /* 2 bytes for class (2) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200796 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100797 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200798 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200799 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200800 dns_answer_record->class = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200801 reader += 2;
802
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200803 /* 4 bytes for ttl (4) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200804 if (reader + 4 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100805 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200806 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200807 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200808 dns_answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
809 + reader[2] * 256 + reader[3];
810 reader += 4;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200811
Christopher Faulet67957bd2017-09-27 11:00:59 +0200812 /* Now reading data len */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200813 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100814 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200815 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200816 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200817 dns_answer_record->data_len = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200818
Christopher Faulet67957bd2017-09-27 11:00:59 +0200819 /* Move forward 2 bytes for data len */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200820 reader += 2;
821
Jérôme Magnin8d4e7dc2018-12-20 16:47:31 +0100822 if (reader + dns_answer_record->data_len > bufend) {
Remi Gacogneefbbdf72018-12-05 17:56:29 +0100823 pool_free(dns_answer_item_pool, dns_answer_record);
824 return DNS_RESP_INVALID;
825 }
826
Christopher Faulet67957bd2017-09-27 11:00:59 +0200827 /* Analyzing record content */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200828 switch (dns_answer_record->type) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200829 case DNS_RTYPE_A:
830 /* ipv4 is stored on 4 bytes */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200831 if (dns_answer_record->data_len != 4) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100832 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200833 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200834 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200835 dns_answer_record->address.sa_family = AF_INET;
836 memcpy(&(((struct sockaddr_in *)&dns_answer_record->address)->sin_addr),
837 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200838 break;
839
840 case DNS_RTYPE_CNAME:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200841 /* Check if this is the last record and update the caller about the status:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200842 * no IP could be found and last record was a CNAME. Could be triggered
843 * by a wrong query type
844 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200845 * + 1 because dns_answer_record_id starts at 0
846 * while number of answers is an integer and
847 * starts at 1.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200848 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200849 if (i + 1 == dns_p->header.ancount) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100850 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200851 return DNS_RESP_CNAME_ERROR;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200852 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200853
854 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100855 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200856 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100857 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200858 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200859 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200860
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200861 memcpy(dns_answer_record->target, tmpname, len);
862 dns_answer_record->target[len] = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200863 previous_dname = dns_answer_record->target;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200864 break;
865
Olivier Houchard8da5f982017-08-04 18:35:36 +0200866
867 case DNS_RTYPE_SRV:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200868 /* Answer must contain :
Olivier Houchard8da5f982017-08-04 18:35:36 +0200869 * - 2 bytes for the priority
870 * - 2 bytes for the weight
871 * - 2 bytes for the port
872 * - the target hostname
873 */
874 if (dns_answer_record->data_len <= 6) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100875 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200876 return DNS_RESP_INVALID;
877 }
Willy Tarreaud5370e12017-09-19 14:59:52 +0200878 dns_answer_record->priority = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200879 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200880 dns_answer_record->weight = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200881 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200882 dns_answer_record->port = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200883 reader += sizeof(uint16_t);
884 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100885 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200886 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100887 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200888 return DNS_RESP_INVALID;
889 }
Olivier Houchard8da5f982017-08-04 18:35:36 +0200890 dns_answer_record->data_len = len;
891 memcpy(dns_answer_record->target, tmpname, len);
892 dns_answer_record->target[len] = 0;
893 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200894
Baptiste Assmann325137d2015-04-13 23:40:55 +0200895 case DNS_RTYPE_AAAA:
896 /* ipv6 is stored on 16 bytes */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200897 if (dns_answer_record->data_len != 16) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100898 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200899 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200900 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200901 dns_answer_record->address.sa_family = AF_INET6;
902 memcpy(&(((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr),
903 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200904 break;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200905
Baptiste Assmann325137d2015-04-13 23:40:55 +0200906 } /* switch (record type) */
907
Christopher Faulet67957bd2017-09-27 11:00:59 +0200908 /* Increment the counter for number of records saved into our
909 * local response */
910 nb_saved_records++;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200911
Christopher Faulet67957bd2017-09-27 11:00:59 +0200912 /* Move forward dns_answer_record->data_len for analyzing next
913 * record in the response */
914 reader += ((dns_answer_record->type == DNS_RTYPE_SRV)
915 ? offset
916 : dns_answer_record->data_len);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200917
918 /* Lookup to see if we already had this entry */
Olivier Houchard8da5f982017-08-04 18:35:36 +0200919 found = 0;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200920 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
921 if (tmp_record->type != dns_answer_record->type)
922 continue;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200923
924 switch(tmp_record->type) {
925 case DNS_RTYPE_A:
926 if (!memcmp(&((struct sockaddr_in *)&dns_answer_record->address)->sin_addr,
927 &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
928 sizeof(in_addr_t)))
929 found = 1;
930 break;
931
932 case DNS_RTYPE_AAAA:
933 if (!memcmp(&((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr,
934 &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
935 sizeof(struct in6_addr)))
936 found = 1;
937 break;
938
Olivier Houchard8da5f982017-08-04 18:35:36 +0200939 case DNS_RTYPE_SRV:
940 if (dns_answer_record->data_len == tmp_record->data_len &&
Christopher Faulet67957bd2017-09-27 11:00:59 +0200941 !memcmp(dns_answer_record->target, tmp_record->target, dns_answer_record->data_len) &&
Olivier Houchard8da5f982017-08-04 18:35:36 +0200942 dns_answer_record->port == tmp_record->port) {
943 tmp_record->weight = dns_answer_record->weight;
944 found = 1;
945 }
946 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200947
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200948 default:
949 break;
950 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200951
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200952 if (found == 1)
953 break;
954 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200955
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200956 if (found == 1) {
957 tmp_record->last_seen = now.tv_sec;
Willy Tarreaubafbe012017-11-24 17:34:44 +0100958 pool_free(dns_answer_item_pool, dns_answer_record);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200959 }
960 else {
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200961 dns_answer_record->last_seen = now.tv_sec;
962 LIST_ADDQ(&dns_p->answer_list, &dns_answer_record->list);
963 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200964 } /* for i 0 to ancount */
965
Christopher Faulet67957bd2017-09-27 11:00:59 +0200966 /* Save the number of records we really own */
Baptiste Assmann69fce672017-05-04 08:37:45 +0200967 dns_p->header.ancount = nb_saved_records;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200968 dns_check_dns_response(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200969 return DNS_RESP_VALID;
970}
971
Christopher Faulet67957bd2017-09-27 11:00:59 +0200972/* Searches dn_name resolution in resp.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200973 * If existing IP not found, return the first IP matching family_priority,
974 * otherwise, first ip found
975 * The following tasks are the responsibility of the caller:
Baptiste Assmann3cf7f982016-04-17 22:43:26 +0200976 * - <dns_p> contains an error free DNS response
Baptiste Assmann325137d2015-04-13 23:40:55 +0200977 * For both cases above, dns_validate_dns_response is required
978 * returns one of the DNS_UPD_* code
979 */
Baptiste Assmannfb7091e2017-05-03 15:43:12 +0200980int dns_get_ip_from_response(struct dns_response_packet *dns_p,
Baptiste Assmann42746372017-05-03 12:12:02 +0200981 struct dns_options *dns_opts, void *currentip,
Thierry Fournierada34842016-02-17 21:25:09 +0100982 short currentip_sin_family,
Baptiste Assmannfb7091e2017-05-03 15:43:12 +0200983 void **newip, short *newip_sin_family,
984 void *owner)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200985{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200986 struct dns_answer_item *record;
Thierry Fournierada34842016-02-17 21:25:09 +0100987 int family_priority;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200988 int currentip_found;
Baptiste Assmann3cf7f982016-04-17 22:43:26 +0200989 unsigned char *newip4, *newip6;
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100990 int currentip_sel;
991 int j;
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100992 int score, max_score;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +0200993 int allowed_duplicated_ip;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200994
Christopher Faulet67957bd2017-09-27 11:00:59 +0200995 family_priority = dns_opts->family_prio;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +0200996 allowed_duplicated_ip = dns_opts->accept_duplicate_ip;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200997 *newip = newip4 = newip6 = NULL;
998 currentip_found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200999 *newip_sin_family = AF_UNSPEC;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001000 max_score = -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001001
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001002 /* Select an IP regarding configuration preference.
Joseph Herlant42cf6392018-11-15 10:33:28 -08001003 * Top priority is the preferred network ip version,
1004 * second priority is the preferred network.
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001005 * the last priority is the currently used IP,
1006 *
1007 * For these three priorities, a score is calculated. The
1008 * weight are:
Joseph Herlant42cf6392018-11-15 10:33:28 -08001009 * 8 - preferred ip version.
1010 * 4 - preferred network.
Baptistefc725902016-12-26 23:21:08 +01001011 * 2 - if the ip in the record is not affected to any other server in the same backend (duplication)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001012 * 1 - current ip.
1013 * The result with the biggest score is returned.
1014 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001015
1016 list_for_each_entry(record, &dns_p->answer_list, list) {
1017 void *ip;
1018 unsigned char ip_type;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001019
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001020 if (record->type == DNS_RTYPE_A) {
1021 ip = &(((struct sockaddr_in *)&record->address)->sin_addr);
1022 ip_type = AF_INET;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001023 }
1024 else if (record->type == DNS_RTYPE_AAAA) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001025 ip_type = AF_INET6;
1026 ip = &(((struct sockaddr_in6 *)&record->address)->sin6_addr);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001027 }
1028 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001029 continue;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001030 score = 0;
1031
Joseph Herlant42cf6392018-11-15 10:33:28 -08001032 /* Check for preferred ip protocol. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001033 if (ip_type == family_priority)
Baptistefc725902016-12-26 23:21:08 +01001034 score += 8;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001035
Joseph Herlant42cf6392018-11-15 10:33:28 -08001036 /* Check for preferred network. */
Baptiste Assmann42746372017-05-03 12:12:02 +02001037 for (j = 0; j < dns_opts->pref_net_nb; j++) {
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001038
1039 /* Compare only the same adresses class. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001040 if (dns_opts->pref_net[j].family != ip_type)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001041 continue;
1042
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001043 if ((ip_type == AF_INET &&
1044 in_net_ipv4(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001045 &dns_opts->pref_net[j].mask.in4,
1046 &dns_opts->pref_net[j].addr.in4)) ||
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001047 (ip_type == AF_INET6 &&
1048 in_net_ipv6(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001049 &dns_opts->pref_net[j].mask.in6,
1050 &dns_opts->pref_net[j].addr.in6))) {
Baptistefc725902016-12-26 23:21:08 +01001051 score += 4;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001052 break;
1053 }
1054 }
1055
Christopher Faulet67957bd2017-09-27 11:00:59 +02001056 /* Check if the IP found in the record is already affected to a
Baptiste Assmann84221b42018-06-22 13:03:50 +02001057 * member of a group. If not, the score should be incremented
Christopher Faulet67957bd2017-09-27 11:00:59 +02001058 * by 2. */
Baptiste Assmann84221b42018-06-22 13:03:50 +02001059 if (owner && snr_check_ip_callback(owner, ip, &ip_type)) {
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001060 if (!allowed_duplicated_ip) {
1061 continue;
1062 }
Baptiste Assmann84221b42018-06-22 13:03:50 +02001063 } else {
1064 score += 2;
1065 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001066
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001067 /* Check for current ip matching. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001068 if (ip_type == currentip_sin_family &&
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001069 ((currentip_sin_family == AF_INET &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001070 !memcmp(ip, currentip, 4)) ||
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001071 (currentip_sin_family == AF_INET6 &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001072 !memcmp(ip, currentip, 16)))) {
1073 score++;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001074 currentip_sel = 1;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001075 }
1076 else
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001077 currentip_sel = 0;
1078
1079 /* Keep the address if the score is better than the previous
Christopher Faulet67957bd2017-09-27 11:00:59 +02001080 * score. The maximum score is 15, if this value is reached, we
1081 * break the parsing. Implicitly, this score is reached the ip
1082 * selected is the current ip. */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001083 if (score > max_score) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001084 if (ip_type == AF_INET)
1085 newip4 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001086 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001087 newip6 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001088 currentip_found = currentip_sel;
Baptistefc725902016-12-26 23:21:08 +01001089 if (score == 15)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001090 return DNS_UPD_NO;
1091 max_score = score;
1092 }
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001093 } /* list for each record entries */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001094
Christopher Faulet67957bd2017-09-27 11:00:59 +02001095 /* No IP found in the response */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001096 if (!newip4 && !newip6)
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001097 return DNS_UPD_NO_IP_FOUND;
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001098
Christopher Faulet67957bd2017-09-27 11:00:59 +02001099 /* Case when the caller looks first for an IPv4 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001100 if (family_priority == AF_INET) {
1101 if (newip4) {
1102 *newip = newip4;
1103 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001104 }
1105 else if (newip6) {
1106 *newip = newip6;
1107 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001108 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001109 if (!currentip_found)
1110 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001111 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001112 /* Case when the caller looks first for an IPv6 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001113 else if (family_priority == AF_INET6) {
1114 if (newip6) {
1115 *newip = newip6;
1116 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001117 }
1118 else if (newip4) {
1119 *newip = newip4;
1120 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001121 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001122 if (!currentip_found)
1123 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001124 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001125 /* Case when the caller have no preference (we prefer IPv6) */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001126 else if (family_priority == AF_UNSPEC) {
1127 if (newip6) {
1128 *newip = newip6;
1129 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001130 }
1131 else if (newip4) {
1132 *newip = newip4;
1133 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001134 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001135 if (!currentip_found)
1136 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001137 }
1138
Christopher Faulet67957bd2017-09-27 11:00:59 +02001139 /* No reason why we should change the server's IP address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001140 return DNS_UPD_NO;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001141
Christopher Faulet67957bd2017-09-27 11:00:59 +02001142 not_found:
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001143 list_for_each_entry(record, &dns_p->answer_list, list) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001144 /* Move the first record to the end of the list, for internal
1145 * round robin */
1146 LIST_DEL(&record->list);
1147 LIST_ADDQ(&dns_p->answer_list, &record->list);
1148 break;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001149 }
1150 return DNS_UPD_SRVIP_NOT_FOUND;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001151}
1152
Christopher Faulet67957bd2017-09-27 11:00:59 +02001153/* Turns a domain name label into a string.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001154 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001155 * <dn> must be a null-terminated string. <dn_len> must include the terminating
1156 * null byte. <str> must be allocated and its size must be passed in <str_len>.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001157 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001158 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1159 * <str> (including the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001160 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001161int dns_dn_label_to_str(const char *dn, int dn_len, char *str, int str_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001162{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001163 char *ptr;
1164 int i, sz;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001165
Christopher Faulet67957bd2017-09-27 11:00:59 +02001166 if (str_len < dn_len - 1)
Baptiste Assmann2af08fe2017-08-14 00:13:01 +02001167 return -1;
1168
Christopher Faulet67957bd2017-09-27 11:00:59 +02001169 ptr = str;
1170 for (i = 0; i < dn_len-1; ++i) {
1171 sz = dn[i];
1172 if (i)
1173 *ptr++ = '.';
1174 memcpy(ptr, dn+i+1, sz);
1175 ptr += sz;
1176 i += sz;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001177 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001178 *ptr++ = '\0';
1179 return (ptr - str);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001180}
1181
Christopher Faulet67957bd2017-09-27 11:00:59 +02001182/* Turns a string into domain name label: www.haproxy.org into 3www7haproxy3org
1183 *
1184 * <str> must be a null-terminated string. <str_len> must include the
1185 * terminating null byte. <dn> buffer must be allocated and its size must be
1186 * passed in <dn_len>.
1187 *
1188 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1189 * <dn> (excluding the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001190 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001191int dns_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001192{
Baptiste Assmann325137d2015-04-13 23:40:55 +02001193 int i, offset;
1194
Christopher Faulet67957bd2017-09-27 11:00:59 +02001195 if (dn_len < str_len + 1)
1196 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001197
Christopher Faulet67957bd2017-09-27 11:00:59 +02001198 /* First byte of dn will be used to store the length of the first
1199 * label */
1200 offset = 0;
1201 for (i = 0; i < str_len; ++i) {
1202 if (str[i] == '.') {
1203 /* 2 or more consecutive dots is invalid */
1204 if (i == offset)
1205 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001206
Christopher Faulet67957bd2017-09-27 11:00:59 +02001207 dn[offset] = (i - offset);
1208 offset = i+1;
1209 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001210 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001211 dn[i+1] = str[i];
Baptiste Assmann325137d2015-04-13 23:40:55 +02001212 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001213 dn[offset] = (i - offset - 1);
1214 dn[i] = '\0';
1215 return i;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001216}
1217
Christopher Faulet67957bd2017-09-27 11:00:59 +02001218/* Validates host name:
Baptiste Assmann325137d2015-04-13 23:40:55 +02001219 * - total size
1220 * - each label size individually
1221 * returns:
1222 * 0 in case of error. If <err> is not NULL, an error message is stored there.
1223 * 1 when no error. <err> is left unaffected.
1224 */
1225int dns_hostname_validation(const char *string, char **err)
1226{
1227 const char *c, *d;
1228 int i;
1229
1230 if (strlen(string) > DNS_MAX_NAME_SIZE) {
1231 if (err)
1232 *err = DNS_TOO_LONG_FQDN;
1233 return 0;
1234 }
1235
1236 c = string;
1237 while (*c) {
1238 d = c;
1239
1240 i = 0;
1241 while (*d != '.' && *d && i <= DNS_MAX_LABEL_SIZE) {
1242 i++;
1243 if (!((*d == '-') || (*d == '_') ||
1244 ((*d >= 'a') && (*d <= 'z')) ||
1245 ((*d >= 'A') && (*d <= 'Z')) ||
1246 ((*d >= '0') && (*d <= '9')))) {
1247 if (err)
1248 *err = DNS_INVALID_CHARACTER;
1249 return 0;
1250 }
1251 d++;
1252 }
1253
1254 if ((i >= DNS_MAX_LABEL_SIZE) && (d[i] != '.')) {
1255 if (err)
1256 *err = DNS_LABEL_TOO_LONG;
1257 return 0;
1258 }
1259
1260 if (*d == '\0')
1261 goto out;
1262
1263 c = ++d;
1264 }
1265 out:
1266 return 1;
1267}
1268
Christopher Faulet67957bd2017-09-27 11:00:59 +02001269/* Picks up an available resolution from the different resolution list
1270 * associated to a resolvers section, in this order:
1271 * 1. check in resolutions.curr for the same hostname and query_type
1272 * 2. check in resolutions.wait for the same hostname and query_type
1273 * 3. Get a new resolution from resolution pool
1274 *
1275 * Returns an available resolution, NULL if none found.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001276 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001277static struct dns_resolution *dns_pick_resolution(struct dns_resolvers *resolvers,
1278 char **hostname_dn, int hostname_dn_len,
1279 int query_type)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001280{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001281 struct dns_resolution *res;
1282
1283 if (!*hostname_dn)
1284 goto from_pool;
1285
1286 /* Search for same hostname and query type in resolutions.curr */
1287 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
1288 if (!res->hostname_dn)
1289 continue;
1290 if ((query_type == res->prefered_query_type) &&
1291 hostname_dn_len == res->hostname_dn_len &&
1292 !memcmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
1293 return res;
1294 }
1295
1296 /* Search for same hostname and query type in resolutions.wait */
1297 list_for_each_entry(res, &resolvers->resolutions.wait, list) {
1298 if (!res->hostname_dn)
1299 continue;
1300 if ((query_type == res->prefered_query_type) &&
1301 hostname_dn_len == res->hostname_dn_len &&
1302 !memcmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
1303 return res;
1304 }
1305
1306 from_pool:
1307 /* No resolution could be found, so let's allocate a new one */
Willy Tarreaubafbe012017-11-24 17:34:44 +01001308 res = pool_alloc(dns_resolution_pool);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001309 if (res) {
1310 memset(res, 0, sizeof(*res));
1311 res->resolvers = resolvers;
1312 res->uuid = resolution_uuid;
1313 res->status = RSLV_STATUS_NONE;
1314 res->step = RSLV_STEP_NONE;
1315 res->last_valid = now_ms;
1316
1317 LIST_INIT(&res->requesters);
1318 LIST_INIT(&res->response.answer_list);
1319
1320 res->prefered_query_type = query_type;
1321 res->query_type = query_type;
1322 res->hostname_dn = *hostname_dn;
1323 res->hostname_dn_len = hostname_dn_len;
1324
1325 ++resolution_uuid;
1326
1327 /* Move the resolution to the resolvers wait queue */
1328 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1329 }
1330 return res;
1331}
1332
1333/* Releases a resolution from its requester(s) and move it back to the pool */
1334static void dns_free_resolution(struct dns_resolution *resolution)
1335{
1336 struct dns_requester *req, *reqback;
1337
1338 /* clean up configuration */
1339 dns_reset_resolution(resolution);
1340 resolution->hostname_dn = NULL;
1341 resolution->hostname_dn_len = 0;
1342
1343 list_for_each_entry_safe(req, reqback, &resolution->requesters, list) {
1344 LIST_DEL(&req->list);
1345 req->resolution = NULL;
1346 }
1347
1348 LIST_DEL(&resolution->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +01001349 pool_free(dns_resolution_pool, resolution);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001350}
1351
1352/* Links a requester (a server or a dns_srvrq) with a resolution. It returns 0
1353 * on success, -1 otherwise.
1354 */
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001355int dns_link_resolution(void *requester, int requester_type, int requester_locked)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001356{
1357 struct dns_resolution *res = NULL;
1358 struct dns_requester *req;
1359 struct dns_resolvers *resolvers;
1360 struct server *srv = NULL;
1361 struct dns_srvrq *srvrq = NULL;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001362 struct stream *stream = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001363 char **hostname_dn;
1364 int hostname_dn_len, query_type;
1365
1366 switch (requester_type) {
1367 case OBJ_TYPE_SERVER:
1368 srv = (struct server *)requester;
1369 hostname_dn = &srv->hostname_dn;
1370 hostname_dn_len = srv->hostname_dn_len;
1371 resolvers = srv->resolvers;
1372 query_type = ((srv->dns_opts.family_prio == AF_INET)
1373 ? DNS_RTYPE_A
1374 : DNS_RTYPE_AAAA);
1375 break;
1376
1377 case OBJ_TYPE_SRVRQ:
1378 srvrq = (struct dns_srvrq *)requester;
1379 hostname_dn = &srvrq->hostname_dn;
1380 hostname_dn_len = srvrq->hostname_dn_len;
1381 resolvers = srvrq->resolvers;
1382 query_type = DNS_RTYPE_SRV;
1383 break;
1384
Baptiste Assmann333939c2019-01-21 08:34:50 +01001385 case OBJ_TYPE_STREAM:
1386 stream = (struct stream *)requester;
1387 hostname_dn = &stream->dns_ctx.hostname_dn;
1388 hostname_dn_len = stream->dns_ctx.hostname_dn_len;
1389 resolvers = stream->dns_ctx.parent->arg.dns.resolvers;
1390 query_type = ((stream->dns_ctx.parent->arg.dns.dns_opts.family_prio == AF_INET)
1391 ? DNS_RTYPE_A
1392 : DNS_RTYPE_AAAA);
1393 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001394 default:
1395 goto err;
1396 }
1397
1398 /* Get a resolution from the resolvers' wait queue or pool */
1399 if ((res = dns_pick_resolution(resolvers, hostname_dn, hostname_dn_len, query_type)) == NULL)
1400 goto err;
1401
1402 if (srv) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001403 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001404 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001405 if (srv->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001406 if ((req = pool_alloc(dns_requester_pool)) == NULL) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001407 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001408 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001409 goto err;
Willy Tarreau5ec84572017-11-05 10:35:57 +01001410 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001411 req->owner = &srv->obj_type;
1412 srv->dns_requester = req;
1413 }
1414 else
1415 req = srv->dns_requester;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001416 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001417 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001418
1419 req->requester_cb = snr_resolution_cb;
1420 req->requester_error_cb = snr_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001421 }
1422 else if (srvrq) {
1423 if (srvrq->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001424 if ((req = pool_alloc(dns_requester_pool)) == NULL)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001425 goto err;
1426 req->owner = &srvrq->obj_type;
1427 srvrq->dns_requester = req;
1428 }
1429 else
1430 req = srvrq->dns_requester;
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001431
1432 req->requester_cb = snr_resolution_cb;
1433 req->requester_error_cb = snr_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001434 }
Baptiste Assmann333939c2019-01-21 08:34:50 +01001435 else if (stream) {
1436 if (stream->dns_ctx.dns_requester == NULL) {
1437 if ((req = pool_alloc(dns_requester_pool)) == NULL)
1438 goto err;
1439 req->owner = &stream->obj_type;
1440 stream->dns_ctx.dns_requester = req;
1441 }
1442 else
1443 req = stream->dns_ctx.dns_requester;
1444
1445 req->requester_cb = act_resolution_cb;
1446 req->requester_error_cb = act_resolution_error_cb;
1447 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001448 else
1449 goto err;
1450
1451 req->resolution = res;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001452
1453 LIST_ADDQ(&res->requesters, &req->list);
1454 return 0;
1455
1456 err:
1457 if (res && LIST_ISEMPTY(&res->requesters))
1458 dns_free_resolution(res);
1459 return -1;
1460}
1461
1462/* Removes a requester from a DNS resoltion. It takes takes care of all the
1463 * consequences. It also cleans up some parameters from the requester.
1464 */
1465void dns_unlink_resolution(struct dns_requester *requester)
1466{
1467 struct dns_resolution *res;
1468 struct dns_requester *req;
1469
1470 /* Nothing to do */
1471 if (!requester || !requester->resolution)
1472 return;
1473 res = requester->resolution;
1474
1475 /* Clean up the requester */
1476 LIST_DEL(&requester->list);
1477 requester->resolution = NULL;
1478
1479 /* We need to find another requester linked on this resolution */
1480 if (!LIST_ISEMPTY(&res->requesters))
1481 req = LIST_NEXT(&res->requesters, struct dns_requester *, list);
1482 else {
1483 dns_free_resolution(res);
1484 return;
1485 }
1486
1487 /* Move hostname_dn related pointers to the next requester */
1488 switch (obj_type(req->owner)) {
1489 case OBJ_TYPE_SERVER:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001490 res->hostname_dn = __objt_server(req->owner)->hostname_dn;
1491 res->hostname_dn_len = __objt_server(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001492 break;
1493 case OBJ_TYPE_SRVRQ:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001494 res->hostname_dn = __objt_dns_srvrq(req->owner)->hostname_dn;
1495 res->hostname_dn_len = __objt_dns_srvrq(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001496 break;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001497 case OBJ_TYPE_STREAM:
1498 res->hostname_dn = __objt_stream(req->owner)->dns_ctx.hostname_dn;
1499 res->hostname_dn_len = __objt_stream(req->owner)->dns_ctx.hostname_dn_len;
1500 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001501 default:
1502 res->hostname_dn = NULL;
1503 res->hostname_dn_len = 0;
1504 break;
1505 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001506}
1507
Christopher Faulet67957bd2017-09-27 11:00:59 +02001508/* Called when a network IO is generated on a name server socket for an incoming
1509 * packet. It performs the following actions:
1510 * - check if the packet requires processing (not outdated resolution)
1511 * - ensure the DNS packet received is valid and call requester's callback
1512 * - call requester's error callback if invalid response
1513 * - check the dn_name in the packet against the one sent
1514 */
1515static void dns_resolve_recv(struct dgram_conn *dgram)
1516{
1517 struct dns_nameserver *ns, *tmpns;
1518 struct dns_resolvers *resolvers;
1519 struct dns_resolution *res;
1520 struct dns_query_item *query;
1521 unsigned char buf[DNS_MAX_UDP_MESSAGE + 1];
1522 unsigned char *bufend;
1523 int fd, buflen, dns_resp;
1524 int max_answer_records;
1525 unsigned short query_id;
1526 struct eb32_node *eb;
1527 struct dns_requester *req;
1528
1529 fd = dgram->t.sock.fd;
1530
1531 /* check if ready for reading */
1532 if (!fd_recv_ready(fd))
1533 return;
1534
1535 /* no need to go further if we can't retrieve the nameserver */
1536 if ((ns = dgram->owner) == NULL)
1537 return;
1538
1539 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001540 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001541
1542 /* process all pending input messages */
1543 while (1) {
1544 /* read message received */
1545 memset(buf, '\0', resolvers->accepted_payload_size + 1);
1546 if ((buflen = recv(fd, (char*)buf , resolvers->accepted_payload_size + 1, 0)) < 0) {
1547 /* FIXME : for now we consider EAGAIN only */
1548 fd_cant_recv(fd);
1549 break;
1550 }
1551
1552 /* message too big */
1553 if (buflen > resolvers->accepted_payload_size) {
1554 ns->counters.too_big++;
1555 continue;
1556 }
1557
1558 /* initializing variables */
1559 bufend = buf + buflen; /* pointer to mark the end of the buffer */
1560
1561 /* read the query id from the packet (16 bits) */
1562 if (buf + 2 > bufend) {
1563 ns->counters.invalid++;
1564 continue;
1565 }
1566 query_id = dns_response_get_query_id(buf);
1567
1568 /* search the query_id in the pending resolution tree */
1569 eb = eb32_lookup(&resolvers->query_ids, query_id);
1570 if (eb == NULL) {
1571 /* unknown query id means an outdated response and can be safely ignored */
1572 ns->counters.outdated++;
1573 continue;
1574 }
1575
1576 /* known query id means a resolution in prgress */
1577 res = eb32_entry(eb, struct dns_resolution, qid);
1578 if (!res) {
1579 ns->counters.outdated++;
1580 continue;
1581 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001582
Christopher Faulet67957bd2017-09-27 11:00:59 +02001583 /* number of responses received */
1584 res->nb_responses++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001585
Christopher Faulet67957bd2017-09-27 11:00:59 +02001586 max_answer_records = (resolvers->accepted_payload_size - DNS_HEADER_SIZE) / DNS_MIN_RECORD_SIZE;
1587 dns_resp = dns_validate_dns_response(buf, bufend, res, max_answer_records);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001588
Christopher Faulet67957bd2017-09-27 11:00:59 +02001589 switch (dns_resp) {
1590 case DNS_RESP_VALID:
1591 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001592
Christopher Faulet67957bd2017-09-27 11:00:59 +02001593 case DNS_RESP_INVALID:
1594 case DNS_RESP_QUERY_COUNT_ERROR:
1595 case DNS_RESP_WRONG_NAME:
1596 res->status = RSLV_STATUS_INVALID;
1597 ns->counters.invalid++;
1598 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001599
Christopher Faulet67957bd2017-09-27 11:00:59 +02001600 case DNS_RESP_NX_DOMAIN:
1601 res->status = RSLV_STATUS_NX;
1602 ns->counters.nx++;
1603 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001604
Christopher Faulet67957bd2017-09-27 11:00:59 +02001605 case DNS_RESP_REFUSED:
1606 res->status = RSLV_STATUS_REFUSED;
1607 ns->counters.refused++;
1608 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001609
Christopher Faulet67957bd2017-09-27 11:00:59 +02001610 case DNS_RESP_ANCOUNT_ZERO:
1611 res->status = RSLV_STATUS_OTHER;
1612 ns->counters.any_err++;
1613 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001614
Christopher Faulet67957bd2017-09-27 11:00:59 +02001615 case DNS_RESP_CNAME_ERROR:
1616 res->status = RSLV_STATUS_OTHER;
1617 ns->counters.cname_error++;
1618 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001619
Christopher Faulet67957bd2017-09-27 11:00:59 +02001620 case DNS_RESP_TRUNCATED:
1621 res->status = RSLV_STATUS_OTHER;
1622 ns->counters.truncated++;
1623 break;
Baptiste Assmanne70bc052017-08-21 16:51:09 +02001624
Christopher Faulet67957bd2017-09-27 11:00:59 +02001625 case DNS_RESP_NO_EXPECTED_RECORD:
1626 case DNS_RESP_ERROR:
1627 case DNS_RESP_INTERNAL:
1628 res->status = RSLV_STATUS_OTHER;
1629 ns->counters.other++;
1630 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001631 }
1632
Christopher Faulet67957bd2017-09-27 11:00:59 +02001633 /* Wait all nameservers response to handle errors */
1634 if (dns_resp != DNS_RESP_VALID && res->nb_responses < resolvers->nb_nameservers)
1635 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001636
Christopher Faulet67957bd2017-09-27 11:00:59 +02001637 /* Process error codes */
1638 if (dns_resp != DNS_RESP_VALID) {
1639 if (res->prefered_query_type != res->query_type) {
1640 /* The fallback on the query type was already performed,
1641 * so check the try counter. If it falls to 0, we can
1642 * report an error. Else, wait the next attempt. */
1643 if (!res->try)
1644 goto report_res_error;
1645 }
1646 else {
1647 /* Fallback from A to AAAA or the opposite and re-send
1648 * the resolution immediately. try counter is not
1649 * decremented. */
1650 if (res->prefered_query_type == DNS_RTYPE_A) {
1651 res->query_type = DNS_RTYPE_AAAA;
1652 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001653 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001654 else if (res->prefered_query_type == DNS_RTYPE_AAAA) {
1655 res->query_type = DNS_RTYPE_A;
1656 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001657 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001658 }
1659 continue;
1660 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001661
Christopher Faulet67957bd2017-09-27 11:00:59 +02001662 /* Now let's check the query's dname corresponds to the one we
1663 * sent. We can check only the first query of the list. We send
1664 * one query at a time so we get one query in the response */
1665 query = LIST_NEXT(&res->response.query_list, struct dns_query_item *, list);
1666 if (query && memcmp(query->name, res->hostname_dn, res->hostname_dn_len) != 0) {
1667 dns_resp = DNS_RESP_WRONG_NAME;
1668 ns->counters.other++;
1669 goto report_res_error;
1670 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001671
Christopher Faulet67957bd2017-09-27 11:00:59 +02001672 /* So the resolution succeeded */
1673 res->status = RSLV_STATUS_VALID;
1674 res->last_valid = now_ms;
1675 ns->counters.valid++;
1676 goto report_res_success;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001677
Christopher Faulet67957bd2017-09-27 11:00:59 +02001678 report_res_error:
1679 list_for_each_entry(req, &res->requesters, list)
1680 req->requester_error_cb(req, dns_resp);
1681 dns_reset_resolution(res);
1682 LIST_DEL(&res->list);
1683 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1684 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001685
Christopher Faulet67957bd2017-09-27 11:00:59 +02001686 report_res_success:
1687 /* Only the 1rst requester s managed by the server, others are
1688 * from the cache */
1689 tmpns = ns;
1690 list_for_each_entry(req, &res->requesters, list) {
Olivier Houchard28381072017-11-06 17:30:28 +01001691 struct server *s = objt_server(req->owner);
1692
1693 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001694 HA_SPIN_LOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001695 req->requester_cb(req, tmpns);
Olivier Houchard28381072017-11-06 17:30:28 +01001696 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001697 HA_SPIN_UNLOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001698 tmpns = NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001699 }
Baptiste Assmann42746372017-05-03 12:12:02 +02001700
Christopher Faulet67957bd2017-09-27 11:00:59 +02001701 dns_reset_resolution(res);
1702 LIST_DEL(&res->list);
1703 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1704 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001705 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001706 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001707 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001708}
William Lallemand69e96442016-11-19 00:58:54 +01001709
Christopher Faulet67957bd2017-09-27 11:00:59 +02001710/* Called when a resolvers network socket is ready to send data */
1711static void dns_resolve_send(struct dgram_conn *dgram)
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001712{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001713 struct dns_resolvers *resolvers;
1714 struct dns_nameserver *ns;
1715 struct dns_resolution *res;
1716 int fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001717
Christopher Faulet67957bd2017-09-27 11:00:59 +02001718 fd = dgram->t.sock.fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001719
Christopher Faulet67957bd2017-09-27 11:00:59 +02001720 /* check if ready for sending */
1721 if (!fd_send_ready(fd))
1722 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001723
Christopher Faulet67957bd2017-09-27 11:00:59 +02001724 /* we don't want/need to be waked up any more for sending */
1725 fd_stop_send(fd);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001726
Christopher Faulet67957bd2017-09-27 11:00:59 +02001727 /* no need to go further if we can't retrieve the nameserver */
1728 if ((ns = dgram->owner) == NULL)
1729 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001730
Christopher Faulet67957bd2017-09-27 11:00:59 +02001731 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001732 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02001733
Christopher Faulet67957bd2017-09-27 11:00:59 +02001734 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001735 int ret, len;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001736
Christopher Faulet67957bd2017-09-27 11:00:59 +02001737 if (res->nb_queries == resolvers->nb_nameservers)
1738 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001739
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001740 len = dns_build_query(res->query_id, res->query_type,
1741 resolvers->accepted_payload_size,
1742 res->hostname_dn, res->hostname_dn_len,
1743 trash.area, trash.size);
1744 if (len == -1)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001745 goto snd_error;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001746
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001747 ret = send(fd, trash.area, len, 0);
1748 if (ret != len)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001749 goto snd_error;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001750
Christopher Faulet67957bd2017-09-27 11:00:59 +02001751 ns->counters.sent++;
1752 res->nb_queries++;
1753 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001754
Christopher Faulet67957bd2017-09-27 11:00:59 +02001755 snd_error:
1756 ns->counters.snd_error++;
1757 res->nb_queries++;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001758 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001759 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001760}
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001761
Christopher Faulet67957bd2017-09-27 11:00:59 +02001762/* Processes DNS resolution. First, it checks the active list to detect expired
1763 * resolutions and retry them if possible. Else a timeout is reported. Then, it
1764 * checks the wait list to trigger new resolutions.
1765 */
Olivier Houchard9f6af332018-05-25 14:04:04 +02001766static struct task *dns_process_resolvers(struct task *t, void *context, unsigned short state)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001767{
Olivier Houchard9f6af332018-05-25 14:04:04 +02001768 struct dns_resolvers *resolvers = context;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001769 struct dns_resolution *res, *resback;
1770 int exp;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001771
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001772 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02001773
Christopher Faulet67957bd2017-09-27 11:00:59 +02001774 /* Handle all expired resolutions from the active list */
1775 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
1776 /* When we find the first resolution in the future, then we can
1777 * stop here */
1778 exp = tick_add(res->last_query, resolvers->timeout.retry);
1779 if (!tick_is_expired(exp, now_ms))
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001780 break;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001781
Christopher Faulet67957bd2017-09-27 11:00:59 +02001782 /* If current resolution has been tried too many times and
1783 * finishes in timeout we update its status and remove it from
1784 * the list */
1785 if (!res->try) {
1786 struct dns_requester *req;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001787
Christopher Faulet67957bd2017-09-27 11:00:59 +02001788 /* Notify the result to the requesters */
1789 if (!res->nb_responses)
1790 res->status = RSLV_STATUS_TIMEOUT;
1791 list_for_each_entry(req, &res->requesters, list)
1792 req->requester_error_cb(req, res->status);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001793
Christopher Faulet67957bd2017-09-27 11:00:59 +02001794 /* Clean up resolution info and remove it from the
1795 * current list */
1796 dns_reset_resolution(res);
1797 LIST_DEL(&res->list);
1798 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
William Lallemand69e96442016-11-19 00:58:54 +01001799 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001800 else {
1801 /* Otherwise resend the DNS query and requeue the resolution */
1802 if (!res->nb_responses || res->prefered_query_type != res->query_type) {
1803 /* No response received (a real timeout) or fallback already done */
1804 res->query_type = res->prefered_query_type;
1805 res->try--;
1806 }
1807 else {
1808 /* Fallback from A to AAAA or the opposite and re-send
1809 * the resolution immediately. try counter is not
1810 * decremented. */
1811 if (res->prefered_query_type == DNS_RTYPE_A)
1812 res->query_type = DNS_RTYPE_AAAA;
1813 else if (res->prefered_query_type == DNS_RTYPE_AAAA)
1814 res->query_type = DNS_RTYPE_A;
1815 else
1816 res->try--;
1817 }
1818 dns_send_query(res);
William Lallemand69e96442016-11-19 00:58:54 +01001819 }
1820 }
William Lallemand69e96442016-11-19 00:58:54 +01001821
Christopher Faulet67957bd2017-09-27 11:00:59 +02001822 /* Handle all resolutions in the wait list */
1823 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
1824 exp = tick_add(res->last_resolution, dns_resolution_timeout(res));
1825 if (tick_isset(res->last_resolution) && !tick_is_expired(exp, now_ms))
1826 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001827
Christopher Faulet67957bd2017-09-27 11:00:59 +02001828 if (dns_run_resolution(res) != 1) {
1829 res->last_resolution = now_ms;
1830 LIST_DEL(&res->list);
1831 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001832 }
1833 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001834
Christopher Faulet67957bd2017-09-27 11:00:59 +02001835 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001836 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001837 return t;
1838}
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001839
Christopher Faulet67957bd2017-09-27 11:00:59 +02001840/* proto_udp callback functions for a DNS resolution */
1841struct dgram_data_cb resolve_dgram_cb = {
1842 .recv = dns_resolve_recv,
1843 .send = dns_resolve_send,
1844};
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001845
Christopher Faulet67957bd2017-09-27 11:00:59 +02001846/* Release memory allocated by DNS */
1847static void dns_deinit(void)
1848{
1849 struct dns_resolvers *resolvers, *resolversback;
1850 struct dns_nameserver *ns, *nsback;
1851 struct dns_resolution *res, *resback;
1852 struct dns_requester *req, *reqback;
1853 struct dns_srvrq *srvrq, *srvrqback;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001854
Christopher Faulet67957bd2017-09-27 11:00:59 +02001855 list_for_each_entry_safe(resolvers, resolversback, &dns_resolvers, list) {
1856 list_for_each_entry_safe(ns, nsback, &resolvers->nameservers, list) {
1857 free(ns->id);
1858 free((char *)ns->conf.file);
1859 if (ns->dgram && ns->dgram->t.sock.fd != -1)
1860 fd_delete(ns->dgram->t.sock.fd);
1861 free(ns->dgram);
1862 LIST_DEL(&ns->list);
1863 free(ns);
1864 }
1865
1866 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
1867 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
1868 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001869 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001870 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001871 dns_free_resolution(res);
1872 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001873
Christopher Faulet67957bd2017-09-27 11:00:59 +02001874 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
1875 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
1876 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001877 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001878 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001879 dns_free_resolution(res);
1880 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001881
Christopher Faulet67957bd2017-09-27 11:00:59 +02001882 free(resolvers->id);
1883 free((char *)resolvers->conf.file);
Olivier Houchard3f795f72019-04-17 22:51:06 +02001884 task_destroy(resolvers->t);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001885 LIST_DEL(&resolvers->list);
1886 free(resolvers);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001887 }
1888
Christopher Faulet67957bd2017-09-27 11:00:59 +02001889 list_for_each_entry_safe(srvrq, srvrqback, &dns_srvrq_list, list) {
1890 free(srvrq->name);
1891 free(srvrq->hostname_dn);
1892 LIST_DEL(&srvrq->list);
1893 free(srvrq);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001894 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001895}
1896
Christopher Faulet67957bd2017-09-27 11:00:59 +02001897/* Finalizes the DNS configuration by allocating required resources and checking
1898 * live parameters.
1899 * Returns 0 on success, ERR_* flags otherwise.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001900 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001901static int dns_finalize_config(void)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001902{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001903 struct dns_resolvers *resolvers;
1904 struct proxy *px;
1905 int err_code = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001906
Christopher Faulet67957bd2017-09-27 11:00:59 +02001907 /* allocate pool of resolution per resolvers */
1908 list_for_each_entry(resolvers, &dns_resolvers, list) {
1909 struct dns_nameserver *ns;
1910 struct task *t;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001911
Christopher Faulet67957bd2017-09-27 11:00:59 +02001912 /* Check if we can create the socket with nameservers info */
1913 list_for_each_entry(ns, &resolvers->nameservers, list) {
1914 struct dgram_conn *dgram = NULL;
1915 int fd;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001916
Christopher Faulet67957bd2017-09-27 11:00:59 +02001917 /* Check nameserver info */
1918 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001919 ha_alert("config : resolvers '%s': can't create socket for nameserver '%s'.\n",
1920 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001921 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001922 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001923 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001924 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001925 ha_alert("config : resolvers '%s': can't connect socket for nameserver '%s'.\n",
1926 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001927 close(fd);
1928 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001929 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001930 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001931 close(fd);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001932
Christopher Faulet67957bd2017-09-27 11:00:59 +02001933 /* Create dgram structure that will hold the UPD socket
1934 * and attach it on the current nameserver */
1935 if ((dgram = calloc(1, sizeof(*dgram))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001936 ha_alert("config: resolvers '%s' : out of memory.\n",
1937 resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001938 err_code |= (ERR_ALERT|ERR_ABORT);
1939 goto err;
1940 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001941
Christopher Faulet67957bd2017-09-27 11:00:59 +02001942 /* Leave dgram partially initialized, no FD attached for
1943 * now. */
1944 dgram->owner = ns;
1945 dgram->data = &resolve_dgram_cb;
1946 dgram->t.sock.fd = -1;
1947 ns->dgram = dgram;
1948 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001949
Christopher Faulet67957bd2017-09-27 11:00:59 +02001950 /* Create the task associated to the resolvers section */
Emeric Brunc60def82017-09-27 14:59:38 +02001951 if ((t = task_new(MAX_THREADS_MASK)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001952 ha_alert("config : resolvers '%s' : out of memory.\n", resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001953 err_code |= (ERR_ALERT|ERR_ABORT);
1954 goto err;
1955 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001956
Christopher Faulet67957bd2017-09-27 11:00:59 +02001957 /* Update task's parameters */
1958 t->process = dns_process_resolvers;
1959 t->context = resolvers;
1960 resolvers->t = t;
1961 task_wakeup(t, TASK_WOKEN_INIT);
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001962 }
1963
Olivier Houchardfbc74e82017-11-24 16:54:05 +01001964 for (px = proxies_list; px; px = px->next) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001965 struct server *srv;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001966
Christopher Faulet67957bd2017-09-27 11:00:59 +02001967 for (srv = px->srv; srv; srv = srv->next) {
1968 struct dns_resolvers *resolvers;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001969
Christopher Faulet67957bd2017-09-27 11:00:59 +02001970 if (!srv->resolvers_id)
1971 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001972
Christopher Faulet67957bd2017-09-27 11:00:59 +02001973 if ((resolvers = find_resolvers_by_id(srv->resolvers_id)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001974 ha_alert("config : %s '%s', server '%s': unable to find required resolvers '%s'\n",
1975 proxy_type_str(px), px->id, srv->id, srv->resolvers_id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001976 err_code |= (ERR_ALERT|ERR_ABORT);
1977 continue;
1978 }
1979 srv->resolvers = resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001980
Christopher Faulet67957bd2017-09-27 11:00:59 +02001981 if (srv->srvrq && !srv->srvrq->resolvers) {
1982 srv->srvrq->resolvers = srv->resolvers;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001983 if (dns_link_resolution(srv->srvrq, OBJ_TYPE_SRVRQ, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001984 ha_alert("config : %s '%s' : unable to set DNS resolution for server '%s'.\n",
1985 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001986 err_code |= (ERR_ALERT|ERR_ABORT);
1987 continue;
1988 }
1989 }
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001990 if (dns_link_resolution(srv, OBJ_TYPE_SERVER, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001991 ha_alert("config : %s '%s', unable to set DNS resolution for server '%s'.\n",
1992 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001993 err_code |= (ERR_ALERT|ERR_ABORT);
1994 continue;
1995 }
1996 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001997 }
1998
Christopher Faulet67957bd2017-09-27 11:00:59 +02001999 if (err_code & (ERR_ALERT|ERR_ABORT))
2000 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002001
Christopher Faulet67957bd2017-09-27 11:00:59 +02002002 return err_code;
2003 err:
2004 dns_deinit();
2005 return err_code;
2006
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002007}
2008
Christopher Faulet67957bd2017-09-27 11:00:59 +02002009/* if an arg is found, it sets the resolvers section pointer into cli.p0 */
Aurélien Nephtaliabbf6072018-04-18 13:26:46 +02002010static int cli_parse_stat_resolvers(char **args, char *payload, struct appctx *appctx, void *private)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002011{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002012 struct dns_resolvers *presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002013
Christopher Faulet67957bd2017-09-27 11:00:59 +02002014 if (*args[2]) {
2015 list_for_each_entry(presolvers, &dns_resolvers, list) {
2016 if (strcmp(presolvers->id, args[2]) == 0) {
2017 appctx->ctx.cli.p0 = presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002018 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002019 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002020 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002021 if (appctx->ctx.cli.p0 == NULL) {
2022 appctx->ctx.cli.severity = LOG_ERR;
2023 appctx->ctx.cli.msg = "Can't find that resolvers section\n";
2024 appctx->st0 = CLI_ST_PRINT;
2025 return 1;
2026 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002027 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002028 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002029}
2030
Christopher Faulet67957bd2017-09-27 11:00:59 +02002031/* Dumps counters from all resolvers section and associated name servers. It
2032 * returns 0 if the output buffer is full and it needs to be called again,
2033 * otherwise non-zero. It may limit itself to the resolver pointed to by
Willy Tarreau777b5602016-12-16 18:06:26 +01002034 * <cli.p0> if it's not null.
William Lallemand69e96442016-11-19 00:58:54 +01002035 */
2036static int cli_io_handler_dump_resolvers_to_buffer(struct appctx *appctx)
2037{
2038 struct stream_interface *si = appctx->owner;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002039 struct dns_resolvers *resolvers;
2040 struct dns_nameserver *ns;
William Lallemand69e96442016-11-19 00:58:54 +01002041
2042 chunk_reset(&trash);
2043
2044 switch (appctx->st2) {
2045 case STAT_ST_INIT:
2046 appctx->st2 = STAT_ST_LIST; /* let's start producing data */
2047 /* fall through */
2048
2049 case STAT_ST_LIST:
2050 if (LIST_ISEMPTY(&dns_resolvers)) {
2051 chunk_appendf(&trash, "No resolvers found\n");
2052 }
2053 else {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002054 list_for_each_entry(resolvers, &dns_resolvers, list) {
2055 if (appctx->ctx.cli.p0 != NULL && appctx->ctx.cli.p0 != resolvers)
William Lallemand69e96442016-11-19 00:58:54 +01002056 continue;
2057
Christopher Faulet67957bd2017-09-27 11:00:59 +02002058 chunk_appendf(&trash, "Resolvers section %s\n", resolvers->id);
2059 list_for_each_entry(ns, &resolvers->nameservers, list) {
2060 chunk_appendf(&trash, " nameserver %s:\n", ns->id);
2061 chunk_appendf(&trash, " sent: %lld\n", ns->counters.sent);
2062 chunk_appendf(&trash, " snd_error: %lld\n", ns->counters.snd_error);
2063 chunk_appendf(&trash, " valid: %lld\n", ns->counters.valid);
2064 chunk_appendf(&trash, " update: %lld\n", ns->counters.update);
2065 chunk_appendf(&trash, " cname: %lld\n", ns->counters.cname);
2066 chunk_appendf(&trash, " cname_error: %lld\n", ns->counters.cname_error);
2067 chunk_appendf(&trash, " any_err: %lld\n", ns->counters.any_err);
2068 chunk_appendf(&trash, " nx: %lld\n", ns->counters.nx);
2069 chunk_appendf(&trash, " timeout: %lld\n", ns->counters.timeout);
2070 chunk_appendf(&trash, " refused: %lld\n", ns->counters.refused);
2071 chunk_appendf(&trash, " other: %lld\n", ns->counters.other);
2072 chunk_appendf(&trash, " invalid: %lld\n", ns->counters.invalid);
2073 chunk_appendf(&trash, " too_big: %lld\n", ns->counters.too_big);
2074 chunk_appendf(&trash, " truncated: %lld\n", ns->counters.truncated);
2075 chunk_appendf(&trash, " outdated: %lld\n", ns->counters.outdated);
William Lallemand69e96442016-11-19 00:58:54 +01002076 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002077 chunk_appendf(&trash, "\n");
William Lallemand69e96442016-11-19 00:58:54 +01002078 }
2079 }
2080
2081 /* display response */
Willy Tarreau06d80a92017-10-19 14:32:15 +02002082 if (ci_putchk(si_ic(si), &trash) == -1) {
William Lallemand69e96442016-11-19 00:58:54 +01002083 /* let's try again later from this session. We add ourselves into
2084 * this session's users so that it can remove us upon termination.
2085 */
Willy Tarreaudb398432018-11-15 11:08:52 +01002086 si_rx_room_blk(si);
William Lallemand69e96442016-11-19 00:58:54 +01002087 return 0;
2088 }
William Lallemand69e96442016-11-19 00:58:54 +01002089 /* fall through */
2090
2091 default:
2092 appctx->st2 = STAT_ST_FIN;
2093 return 1;
2094 }
2095}
2096
2097/* register cli keywords */
Christopher Fauletff88efb2017-10-03 16:00:57 +02002098static struct cli_kw_list cli_kws = {{ }, {
2099 { { "show", "resolvers", NULL }, "show resolvers [id]: dumps counters from all resolvers section and\n"
2100 " associated name servers",
2101 cli_parse_stat_resolvers, cli_io_handler_dump_resolvers_to_buffer },
2102 {{},}
2103 }
2104};
William Lallemand69e96442016-11-19 00:58:54 +01002105
Willy Tarreau0108d902018-11-25 19:14:37 +01002106INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
William Lallemand69e96442016-11-19 00:58:54 +01002107
Baptiste Assmann333939c2019-01-21 08:34:50 +01002108/*
2109 * Prepare <rule> for hostname resolution.
2110 * Returns -1 in case of any allocation failure, 0 if not.
2111 * On error, a global failure counter is also incremented.
2112 */
2113static int action_prepare_for_resolution(struct stream *stream, const char *hostname)
2114{
2115 char *hostname_dn;
2116 int hostname_len, hostname_dn_len;
2117 struct buffer *tmp = get_trash_chunk();
2118
2119 if (!hostname)
2120 return 0;
2121
2122 hostname_len = strlen(hostname);
2123 hostname_dn = tmp->area;
2124 hostname_dn_len = dns_str_to_dn_label(hostname, hostname_len + 1,
2125 hostname_dn, tmp->size);
2126 if (hostname_dn_len == -1)
2127 goto err;
2128
2129
2130 stream->dns_ctx.hostname_dn = strdup(hostname_dn);
2131 stream->dns_ctx.hostname_dn_len = hostname_dn_len;
2132 if (!stream->dns_ctx.hostname_dn)
2133 goto err;
2134
2135 return 0;
2136
2137 err:
2138 free(stream->dns_ctx.hostname_dn); stream->dns_ctx.hostname_dn = NULL;
2139 dns_failed_resolutions += 1;
2140 return -1;
2141}
2142
2143
2144/*
2145 * Execute the "do-resolution" action. May be called from {tcp,http}request.
2146 */
2147enum act_return dns_action_do_resolve(struct act_rule *rule, struct proxy *px,
2148 struct session *sess, struct stream *s, int flags)
2149{
Baptiste Assmann333939c2019-01-21 08:34:50 +01002150 struct dns_resolution *resolution;
Willy Tarreau45726fd2019-07-17 10:38:45 +02002151 struct sample *smp;
2152 char *fqdn;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002153
2154 /* we have a response to our DNS resolution */
2155 if (s->dns_ctx.dns_requester && s->dns_ctx.dns_requester->resolution != NULL) {
2156 resolution = s->dns_ctx.dns_requester->resolution;
2157 if (resolution->step == RSLV_STEP_NONE) {
2158 /* We update the variable only if we have a valid response. */
2159 if (resolution->status == RSLV_STATUS_VALID) {
2160 struct sample smp;
2161 short ip_sin_family = 0;
2162 void *ip = NULL;
2163
2164 dns_get_ip_from_response(&resolution->response, &rule->arg.dns.dns_opts, NULL,
2165 0, &ip, &ip_sin_family, NULL);
2166
2167 switch (ip_sin_family) {
2168 case AF_INET:
2169 smp.data.type = SMP_T_IPV4;
2170 memcpy(&smp.data.u.ipv4, ip, 4);
2171 break;
2172 case AF_INET6:
2173 smp.data.type = SMP_T_IPV6;
2174 memcpy(&smp.data.u.ipv6, ip, 16);
2175 break;
2176 default:
2177 ip = NULL;
2178 }
2179
2180 if (ip) {
2181 smp.px = px;
2182 smp.sess = sess;
2183 smp.strm = s;
2184
2185 vars_set_by_name(rule->arg.dns.varname, strlen(rule->arg.dns.varname), &smp);
2186 }
2187 }
2188 }
2189
2190 free(s->dns_ctx.hostname_dn); s->dns_ctx.hostname_dn = NULL;
2191 s->dns_ctx.hostname_dn_len = 0;
2192 dns_unlink_resolution(s->dns_ctx.dns_requester);
2193
2194 pool_free(dns_requester_pool, s->dns_ctx.dns_requester);
2195 s->dns_ctx.dns_requester = NULL;
2196
2197 return ACT_RET_CONT;
2198 }
2199
2200 /* need to configure and start a new DNS resolution */
Willy Tarreau45726fd2019-07-17 10:38:45 +02002201 smp = sample_fetch_as_type(px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.dns.expr, SMP_T_STR);
2202 if (smp == NULL)
2203 return ACT_RET_CONT;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002204
Willy Tarreau45726fd2019-07-17 10:38:45 +02002205 fqdn = smp->data.u.str.area;
2206 if (action_prepare_for_resolution(s, fqdn) == -1)
2207 return ACT_RET_ERR;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002208
Willy Tarreau45726fd2019-07-17 10:38:45 +02002209 s->dns_ctx.parent = rule;
2210 dns_link_resolution(s, OBJ_TYPE_STREAM, 0);
2211 dns_trigger_resolution(s->dns_ctx.dns_requester);
Baptiste Assmann333939c2019-01-21 08:34:50 +01002212 return ACT_RET_YIELD;
2213}
2214
2215
2216/* parse "do-resolve" action
2217 * This action takes the following arguments:
2218 * do-resolve(<varName>,<resolversSectionName>,<resolvePrefer>) <expr>
2219 *
2220 * - <varName> is the variable name where the result of the DNS resolution will be stored
2221 * (mandatory)
2222 * - <resolversSectionName> is the name of the resolvers section to use to perform the resolution
2223 * (mandatory)
2224 * - <resolvePrefer> can be either 'ipv4' or 'ipv6' and is the IP family we would like to resolve first
2225 * (optional), defaults to ipv6
2226 * - <expr> is an HAProxy expression used to fetch the name to be resolved
2227 */
2228enum act_parse_ret dns_parse_do_resolve(const char **args, int *orig_arg, struct proxy *px, struct act_rule *rule, char **err)
2229{
2230 int cur_arg;
2231 struct sample_expr *expr;
2232 unsigned int where;
2233 const char *beg, *end;
2234
2235 /* orig_arg points to the first argument, but we need to analyse the command itself first */
2236 cur_arg = *orig_arg - 1;
2237
2238 /* locate varName, which is mandatory */
2239 beg = strchr(args[cur_arg], '(');
2240 if (beg == NULL)
2241 goto do_resolve_parse_error;
2242 beg = beg + 1; /* beg should points to the first character after opening parenthesis '(' */
2243 end = strchr(beg, ',');
2244 if (end == NULL)
2245 goto do_resolve_parse_error;
2246 rule->arg.dns.varname = my_strndup(beg, end - beg);
2247 if (rule->arg.dns.varname == NULL)
2248 goto do_resolve_parse_error;
2249
2250
2251 /* locate resolversSectionName, which is mandatory.
2252 * Since next parameters are optional, the delimiter may be comma ','
2253 * or closing parenthesis ')'
2254 */
2255 beg = end + 1;
2256 end = strchr(beg, ',');
2257 if (end == NULL)
2258 end = strchr(beg, ')');
2259 if (end == NULL)
2260 goto do_resolve_parse_error;
2261 rule->arg.dns.resolvers_id = my_strndup(beg, end - beg);
2262 if (rule->arg.dns.resolvers_id == NULL)
2263 goto do_resolve_parse_error;
2264
2265
2266 /* Default priority is ipv6 */
2267 rule->arg.dns.dns_opts.family_prio = AF_INET6;
2268
2269 /* optional arguments accepted for now:
2270 * ipv4 or ipv6
2271 */
2272 while (*end != ')') {
2273 beg = end + 1;
2274 end = strchr(beg, ',');
2275 if (end == NULL)
2276 end = strchr(beg, ')');
2277 if (end == NULL)
2278 goto do_resolve_parse_error;
2279
2280 if (strncmp(beg, "ipv4", end - beg) == 0) {
2281 rule->arg.dns.dns_opts.family_prio = AF_INET;
2282 }
2283 else if (strncmp(beg, "ipv6", end - beg) == 0) {
2284 rule->arg.dns.dns_opts.family_prio = AF_INET6;
2285 }
2286 else {
2287 goto do_resolve_parse_error;
2288 }
2289 }
2290
2291 cur_arg = cur_arg + 1;
2292
2293 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args);
2294 if (!expr)
2295 goto do_resolve_parse_error;
2296
2297
2298 where = 0;
2299 if (px->cap & PR_CAP_FE)
2300 where |= SMP_VAL_FE_HRQ_HDR;
2301 if (px->cap & PR_CAP_BE)
2302 where |= SMP_VAL_BE_HRQ_HDR;
2303
2304 if (!(expr->fetch->val & where)) {
2305 memprintf(err,
2306 "fetch method '%s' extracts information from '%s', none of which is available here",
2307 args[cur_arg-1], sample_src_names(expr->fetch->use));
2308 free(expr);
2309 return ACT_RET_PRS_ERR;
2310 }
2311 rule->arg.dns.expr = expr;
2312 rule->action = ACT_CUSTOM;
2313 rule->action_ptr = dns_action_do_resolve;
2314 *orig_arg = cur_arg;
2315
2316 rule->check_ptr = check_action_do_resolve;
2317
2318 return ACT_RET_PRS_OK;
2319
2320 do_resolve_parse_error:
2321 free(rule->arg.dns.varname); rule->arg.dns.varname = NULL;
2322 free(rule->arg.dns.resolvers_id); rule->arg.dns.resolvers_id = NULL;
2323 memprintf(err, "Can't parse '%s'. Expects 'do-resolve(<varname>,<resolvers>[,<options>]) <expr>'. Available options are 'ipv4' and 'ipv6'",
2324 args[cur_arg]);
2325 return ACT_RET_PRS_ERR;
2326}
2327
2328static struct action_kw_list http_req_kws = { { }, {
2329 { "do-resolve", dns_parse_do_resolve, 1 },
2330 { /* END */ }
2331}};
2332
2333INITCALL1(STG_REGISTER, http_req_keywords_register, &http_req_kws);
2334
2335static struct action_kw_list tcp_req_cont_actions = {ILH, {
2336 { "do-resolve", dns_parse_do_resolve, 1 },
2337 { /* END */ }
2338}};
2339
2340INITCALL1(STG_REGISTER, tcp_req_cont_keywords_register, &tcp_req_cont_actions);
2341
2342/* Check an "http-request do-resolve" action.
2343 *
2344 * The function returns 1 in success case, otherwise, it returns 0 and err is
2345 * filled.
2346 */
2347int check_action_do_resolve(struct act_rule *rule, struct proxy *px, char **err)
2348{
2349 struct dns_resolvers *resolvers = NULL;
2350
2351 if (rule->arg.dns.resolvers_id == NULL) {
2352 memprintf(err,"Proxy '%s': %s", px->id, "do-resolve action without resolvers");
2353 return 0;
2354 }
2355
2356 resolvers = find_resolvers_by_id(rule->arg.dns.resolvers_id);
2357 if (resolvers == NULL) {
2358 memprintf(err,"Can't find resolvers section '%s' for do-resolve action", rule->arg.dns.resolvers_id);
2359 return 0;
2360 }
2361 rule->arg.dns.resolvers = resolvers;
2362
2363 return 1;
2364}
2365
Willy Tarreau172f5ce2018-11-26 11:21:50 +01002366REGISTER_POST_DEINIT(dns_deinit);
Willy Tarreaue6552512018-11-26 11:33:13 +01002367REGISTER_CONFIG_POSTPARSER("dns runtime resolver", dns_finalize_config);