blob: 61703761a2d9346972ec53a202901c9b7716015d [file] [log] [blame]
Baptiste Assmann325137d2015-04-13 23:40:55 +02001/*
2 * Name server resolution
3 *
4 * Copyright 2014 Baptiste Assmann <bedis9@gmail.com>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <errno.h>
14#include <fcntl.h>
15#include <stdio.h>
16#include <stdlib.h>
17#include <string.h>
18#include <unistd.h>
19
20#include <sys/types.h>
21
Baptiste Assmann044fd5b2018-08-10 10:56:38 +020022#include <common/cfgparse.h>
Christopher Faulet67957bd2017-09-27 11:00:59 +020023#include <common/errors.h>
Willy Tarreau0108d902018-11-25 19:14:37 +010024#include <common/initcall.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020025#include <common/time.h>
26#include <common/ticks.h>
Olivier Houchard8da5f982017-08-04 18:35:36 +020027#include <common/net_helper.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020028
Baptiste Assmann333939c2019-01-21 08:34:50 +010029#include <types/action.h>
William Lallemand69e96442016-11-19 00:58:54 +010030#include <types/applet.h>
31#include <types/cli.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020032#include <types/global.h>
33#include <types/dns.h>
William Lallemand69e96442016-11-19 00:58:54 +010034#include <types/stats.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020035
Baptiste Assmann333939c2019-01-21 08:34:50 +010036#include <proto/action.h>
William Lallemand69e96442016-11-19 00:58:54 +010037#include <proto/channel.h>
38#include <proto/cli.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020039#include <proto/checks.h>
40#include <proto/dns.h>
41#include <proto/fd.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010042#include <proto/proto_http.h>
43#include <proto/http_rules.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020044#include <proto/log.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010045#include <proto/sample.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020046#include <proto/server.h>
47#include <proto/task.h>
48#include <proto/proto_udp.h>
Christopher Faulet67957bd2017-09-27 11:00:59 +020049#include <proto/proxy.h>
William Lallemand69e96442016-11-19 00:58:54 +010050#include <proto/stream_interface.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010051#include <proto/tcp_rules.h>
52#include <proto/vars.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020053
Christopher Faulet67957bd2017-09-27 11:00:59 +020054struct list dns_resolvers = LIST_HEAD_INIT(dns_resolvers);
55struct list dns_srvrq_list = LIST_HEAD_INIT(dns_srvrq_list);
Baptiste Assmann325137d2015-04-13 23:40:55 +020056
Tim Duesterhus7e91ef92020-01-18 02:04:12 +010057static THREAD_LOCAL uint64_t dns_query_id_seed = 0; /* random seed */
Willy Tarreau8ceae722018-11-26 11:58:30 +010058
59DECLARE_STATIC_POOL(dns_answer_item_pool, "dns_answer_item", sizeof(struct dns_answer_item));
60DECLARE_STATIC_POOL(dns_resolution_pool, "dns_resolution", sizeof(struct dns_resolution));
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +010061DECLARE_POOL(dns_requester_pool, "dns_requester", sizeof(struct dns_requester));
Willy Tarreau8ceae722018-11-26 11:58:30 +010062
Christopher Faulet67957bd2017-09-27 11:00:59 +020063static unsigned int resolution_uuid = 1;
Baptiste Assmann333939c2019-01-21 08:34:50 +010064unsigned int dns_failed_resolutions = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020065
Christopher Faulet67957bd2017-09-27 11:00:59 +020066/* Returns a pointer to the resolvers matching the id <id>. NULL is returned if
67 * no match is found.
Baptiste Assmann325137d2015-04-13 23:40:55 +020068 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020069struct dns_resolvers *find_resolvers_by_id(const char *id)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020070{
Christopher Faulet67957bd2017-09-27 11:00:59 +020071 struct dns_resolvers *res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020072
Christopher Faulet67957bd2017-09-27 11:00:59 +020073 list_for_each_entry(res, &dns_resolvers, list) {
74 if (!strcmp(res->id, id))
75 return res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020076 }
Christopher Faulet67957bd2017-09-27 11:00:59 +020077 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020078}
79
Olivier Houcharde5188a42020-04-01 18:30:27 +020080/* Compare hostnames in a case-insensitive way .
81 * Returns 0 if they are the same, non-zero otherwise
82 */
83static __inline int dns_hostname_cmp(const char *name1, const char *name2, int len)
84{
85 int i;
86
87 for (i = 0; i < len; i++)
88 if (tolower(name1[i]) != tolower(name2[i]))
89 return -1;
90 return 0;
91}
92
Christopher Faulet67957bd2017-09-27 11:00:59 +020093/* Returns a pointer on the SRV request matching the name <name> for the proxy
94 * <px>. NULL is returned if no match is found.
Baptiste Assmann201c07f2017-05-22 15:17:15 +020095 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020096struct dns_srvrq *find_srvrq_by_name(const char *name, struct proxy *px)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020097{
Christopher Faulet67957bd2017-09-27 11:00:59 +020098 struct dns_srvrq *srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020099
Christopher Faulet67957bd2017-09-27 11:00:59 +0200100 list_for_each_entry(srvrq, &dns_srvrq_list, list) {
101 if (srvrq->proxy == px && !strcmp(srvrq->name, name))
102 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200103 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200104 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200105}
106
Christopher Faulet67957bd2017-09-27 11:00:59 +0200107/* Allocates a new SRVRQ for the given server with the name <fqdn>. It returns
108 * NULL if an error occurred. */
109struct dns_srvrq *new_dns_srvrq(struct server *srv, char *fqdn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200110{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200111 struct proxy *px = srv->proxy;
112 struct dns_srvrq *srvrq = NULL;
113 int fqdn_len, hostname_dn_len;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200114
Christopher Faulet67957bd2017-09-27 11:00:59 +0200115 fqdn_len = strlen(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200116 hostname_dn_len = dns_str_to_dn_label(fqdn, fqdn_len + 1, trash.area,
117 trash.size);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200118 if (hostname_dn_len == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100119 ha_alert("config : %s '%s', server '%s': failed to parse FQDN '%s'\n",
120 proxy_type_str(px), px->id, srv->id, fqdn);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200121 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200122 }
123
Christopher Faulet67957bd2017-09-27 11:00:59 +0200124 if ((srvrq = calloc(1, sizeof(*srvrq))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100125 ha_alert("config : %s '%s', server '%s': out of memory\n",
126 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200127 goto err;
128 }
129 srvrq->obj_type = OBJ_TYPE_SRVRQ;
130 srvrq->proxy = px;
131 srvrq->name = strdup(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200132 srvrq->hostname_dn = strdup(trash.area);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200133 srvrq->hostname_dn_len = hostname_dn_len;
134 if (!srvrq->name || !srvrq->hostname_dn) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100135 ha_alert("config : %s '%s', server '%s': out of memory\n",
136 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200137 goto err;
138 }
139 LIST_ADDQ(&dns_srvrq_list, &srvrq->list);
140 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200141
Christopher Faulet67957bd2017-09-27 11:00:59 +0200142 err:
143 if (srvrq) {
144 free(srvrq->name);
145 free(srvrq->hostname_dn);
146 free(srvrq);
147 }
148 return NULL;
149}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200150
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200151
Christopher Faulet67957bd2017-09-27 11:00:59 +0200152/* 2 bytes random generator to generate DNS query ID */
153static inline uint16_t dns_rnd16(void)
154{
Christopher Fauletb2812a62017-10-04 16:17:58 +0200155 if (!dns_query_id_seed)
156 dns_query_id_seed = now_ms;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200157 dns_query_id_seed ^= dns_query_id_seed << 13;
158 dns_query_id_seed ^= dns_query_id_seed >> 7;
159 dns_query_id_seed ^= dns_query_id_seed << 17;
160 return dns_query_id_seed;
161}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200162
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200163
Christopher Faulet67957bd2017-09-27 11:00:59 +0200164static inline int dns_resolution_timeout(struct dns_resolution *res)
165{
Baptiste Assmann3697f032019-11-07 11:02:18 +0100166 return res->resolvers->timeout.resolve;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200167}
168
Christopher Faulet67957bd2017-09-27 11:00:59 +0200169/* Updates a resolvers' task timeout for next wake up and queue it */
170static void dns_update_resolvers_timeout(struct dns_resolvers *resolvers)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200171{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200172 struct dns_resolution *res;
173 int next;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200174
Christopher Faulet67957bd2017-09-27 11:00:59 +0200175 next = tick_add(now_ms, resolvers->timeout.resolve);
176 if (!LIST_ISEMPTY(&resolvers->resolutions.curr)) {
177 res = LIST_NEXT(&resolvers->resolutions.curr, struct dns_resolution *, list);
178 next = MIN(next, tick_add(res->last_query, resolvers->timeout.retry));
179 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200180
Christopher Faulet67957bd2017-09-27 11:00:59 +0200181 list_for_each_entry(res, &resolvers->resolutions.wait, list)
182 next = MIN(next, tick_add(res->last_resolution, dns_resolution_timeout(res)));
Baptiste Assmann325137d2015-04-13 23:40:55 +0200183
Christopher Faulet67957bd2017-09-27 11:00:59 +0200184 resolvers->t->expire = next;
185 task_queue(resolvers->t);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200186}
187
Christopher Faulet67957bd2017-09-27 11:00:59 +0200188/* Opens an UDP socket on the namesaver's IP/Port, if required. Returns 0 on
189 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200190 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200191static int dns_connect_namesaver(struct dns_nameserver *ns)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200192{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200193 struct dgram_conn *dgram = ns->dgram;
194 int fd;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200195
Christopher Faulet67957bd2017-09-27 11:00:59 +0200196 /* Already connected */
197 if (dgram->t.sock.fd != -1)
198 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200199
Christopher Faulet67957bd2017-09-27 11:00:59 +0200200 /* Create an UDP socket and connect it on the nameserver's IP/Port */
201 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
202 send_log(NULL, LOG_WARNING,
203 "DNS : resolvers '%s': can't create socket for nameserver '%s'.\n",
204 ns->resolvers->id, ns->id);
205 return -1;
206 }
207 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
208 send_log(NULL, LOG_WARNING,
209 "DNS : resolvers '%s': can't connect socket for nameserver '%s'.\n",
210 ns->resolvers->id, ns->id);
211 close(fd);
212 return -1;
213 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200214
Christopher Faulet67957bd2017-09-27 11:00:59 +0200215 /* Make the socket non blocking */
216 fcntl(fd, F_SETFL, O_NONBLOCK);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200217
Christopher Faulet67957bd2017-09-27 11:00:59 +0200218 /* Add the fd in the fd list and update its parameters */
219 dgram->t.sock.fd = fd;
Willy Tarreaua9786b62018-01-25 07:22:13 +0100220 fd_insert(fd, dgram, dgram_fd_handler, MAX_THREADS_MASK);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200221 fd_want_recv(fd);
222 return 0;
223}
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200224
Christopher Faulet67957bd2017-09-27 11:00:59 +0200225/* Forges a DNS query. It needs the following information from the caller:
226 * - <query_id> : the DNS query id corresponding to this query
227 * - <query_type> : DNS_RTYPE_* request DNS record type (A, AAAA, ANY...)
228 * - <hostname_dn> : hostname in domain name format
229 * - <hostname_dn_len> : length of <hostname_dn>
230 *
231 * To store the query, the caller must pass a buffer <buf> and its size
232 * <bufsize>. It returns the number of written bytes in success, -1 if <buf> is
233 * too short.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200234 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200235static int dns_build_query(int query_id, int query_type, unsigned int accepted_payload_size,
236 char *hostname_dn, int hostname_dn_len, char *buf, int bufsize)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200237{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200238 struct dns_header dns_hdr;
239 struct dns_question qinfo;
240 struct dns_additional_record edns;
241 char *p = buf;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200242
Christopher Faulet67957bd2017-09-27 11:00:59 +0200243 if (sizeof(dns_hdr) + sizeof(qinfo) + sizeof(edns) + hostname_dn_len >= bufsize)
244 return -1;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200245
Christopher Faulet67957bd2017-09-27 11:00:59 +0200246 memset(buf, 0, bufsize);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200247
Christopher Faulet67957bd2017-09-27 11:00:59 +0200248 /* Set dns query headers */
249 dns_hdr.id = (unsigned short) htons(query_id);
250 dns_hdr.flags = htons(0x0100); /* qr=0, opcode=0, aa=0, tc=0, rd=1, ra=0, z=0, rcode=0 */
251 dns_hdr.qdcount = htons(1); /* 1 question */
252 dns_hdr.ancount = 0;
253 dns_hdr.nscount = 0;
254 dns_hdr.arcount = htons(1);
255 memcpy(p, &dns_hdr, sizeof(dns_hdr));
256 p += sizeof(dns_hdr);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200257
Christopher Faulet67957bd2017-09-27 11:00:59 +0200258 /* Set up query hostname */
259 memcpy(p, hostname_dn, hostname_dn_len);
260 p += hostname_dn_len;
261 *p++ = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200262
Christopher Faulet67957bd2017-09-27 11:00:59 +0200263 /* Set up query info (type and class) */
264 qinfo.qtype = htons(query_type);
265 qinfo.qclass = htons(DNS_RCLASS_IN);
266 memcpy(p, &qinfo, sizeof(qinfo));
267 p += sizeof(qinfo);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200268
Christopher Faulet67957bd2017-09-27 11:00:59 +0200269 /* Set the DNS extension */
270 edns.name = 0;
271 edns.type = htons(DNS_RTYPE_OPT);
272 edns.udp_payload_size = htons(accepted_payload_size);
273 edns.extension = 0;
274 edns.data_length = 0;
275 memcpy(p, &edns, sizeof(edns));
276 p += sizeof(edns);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200277
Christopher Faulet67957bd2017-09-27 11:00:59 +0200278 return (p - buf);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200279}
280
Christopher Faulet67957bd2017-09-27 11:00:59 +0200281/* Sends a DNS query to resolvers associated to a resolution. It returns 0 on
282 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200283 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200284static int dns_send_query(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200285{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200286 struct dns_resolvers *resolvers = resolution->resolvers;
287 struct dns_nameserver *ns;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200288
Christopher Faulet67957bd2017-09-27 11:00:59 +0200289 list_for_each_entry(ns, &resolvers->nameservers, list) {
290 int fd = ns->dgram->t.sock.fd;
291 if (fd == -1) {
292 if (dns_connect_namesaver(ns) == -1)
293 continue;
294 fd = ns->dgram->t.sock.fd;
295 resolvers->nb_nameservers++;
296 }
297 fd_want_send(fd);
298 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200299
Christopher Faulet67957bd2017-09-27 11:00:59 +0200300 /* Update resolution */
301 resolution->nb_queries = 0;
302 resolution->nb_responses = 0;
303 resolution->last_query = now_ms;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200304
Christopher Faulet67957bd2017-09-27 11:00:59 +0200305 /* Push the resolution at the end of the active list */
306 LIST_DEL(&resolution->list);
307 LIST_ADDQ(&resolvers->resolutions.curr, &resolution->list);
308 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200309}
310
Christopher Faulet67957bd2017-09-27 11:00:59 +0200311/* Prepares and sends a DNS resolution. It returns 1 if the query was sent, 0 if
312 * skipped and -1 if an error occurred.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200313 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200314static int
315dns_run_resolution(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200316{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200317 struct dns_resolvers *resolvers = resolution->resolvers;
318 int query_id, i;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200319
Christopher Faulet67957bd2017-09-27 11:00:59 +0200320 /* Avoid sending requests for resolutions that don't yet have an
321 * hostname, ie resolutions linked to servers that do not yet have an
322 * fqdn */
323 if (!resolution->hostname_dn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200324 return 0;
325
Christopher Faulet67957bd2017-09-27 11:00:59 +0200326 /* Check if a resolution has already been started for this server return
327 * directly to avoid resolution pill up. */
328 if (resolution->step != RSLV_STEP_NONE)
329 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200330
Christopher Faulet67957bd2017-09-27 11:00:59 +0200331 /* Generates a new query id. We try at most 100 times to find a free
332 * query id */
333 for (i = 0; i < 100; ++i) {
334 query_id = dns_rnd16();
335 if (!eb32_lookup(&resolvers->query_ids, query_id))
Olivier Houchard8da5f982017-08-04 18:35:36 +0200336 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200337 query_id = -1;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200338 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200339 if (query_id == -1) {
340 send_log(NULL, LOG_NOTICE,
341 "could not generate a query id for %s, in resolvers %s.\n",
342 resolution->hostname_dn, resolvers->id);
343 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200344 }
345
Christopher Faulet67957bd2017-09-27 11:00:59 +0200346 /* Update resolution parameters */
347 resolution->query_id = query_id;
348 resolution->qid.key = query_id;
349 resolution->step = RSLV_STEP_RUNNING;
350 resolution->query_type = resolution->prefered_query_type;
351 resolution->try = resolvers->resolve_retries;
352 eb32_insert(&resolvers->query_ids, &resolution->qid);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200353
Christopher Faulet67957bd2017-09-27 11:00:59 +0200354 /* Send the DNS query */
355 resolution->try -= 1;
356 dns_send_query(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200357 return 1;
358}
359
Christopher Faulet67957bd2017-09-27 11:00:59 +0200360/* Performs a name resolution for the requester <req> */
361void dns_trigger_resolution(struct dns_requester *req)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200362{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200363 struct dns_resolvers *resolvers;
364 struct dns_resolution *res;
365 int exp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200366
Christopher Faulet67957bd2017-09-27 11:00:59 +0200367 if (!req || !req->resolution)
368 return;
369 res = req->resolution;
370 resolvers = res->resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200371
Christopher Faulet67957bd2017-09-27 11:00:59 +0200372 /* The resolution must not be triggered yet. Use the cached response, if
373 * valid */
374 exp = tick_add(res->last_resolution, resolvers->hold.valid);
Olivier Houchardf3d9e602018-05-22 18:40:07 +0200375 if (resolvers->t && (res->status != RSLV_STATUS_VALID ||
376 !tick_isset(res->last_resolution) || tick_is_expired(exp, now_ms)))
377 task_wakeup(resolvers->t, TASK_WOKEN_OTHER);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200378}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200379
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200380
Christopher Faulet67957bd2017-09-27 11:00:59 +0200381/* Resets some resolution parameters to initial values and also delete the query
382 * ID from the resolver's tree.
383 */
384static void dns_reset_resolution(struct dns_resolution *resolution)
385{
386 /* update resolution status */
387 resolution->step = RSLV_STEP_NONE;
388 resolution->try = 0;
389 resolution->last_resolution = now_ms;
390 resolution->nb_queries = 0;
391 resolution->nb_responses = 0;
392 resolution->query_type = resolution->prefered_query_type;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200393
Christopher Faulet67957bd2017-09-27 11:00:59 +0200394 /* clean up query id */
395 eb32_delete(&resolution->qid);
396 resolution->query_id = 0;
397 resolution->qid.key = 0;
398}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200399
Christopher Faulet67957bd2017-09-27 11:00:59 +0200400/* Returns the query id contained in a DNS response */
401static inline unsigned short dns_response_get_query_id(unsigned char *resp)
402{
403 return resp[0] * 256 + resp[1];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200404}
405
Christopher Faulet67957bd2017-09-27 11:00:59 +0200406
407/* Analyses, re-builds and copies the name <name> from the DNS response packet
408 * <buffer>. <name> must point to the 'data_len' information or pointer 'c0'
409 * for compressed data. The result is copied into <dest>, ensuring we don't
410 * overflow using <dest_len> Returns the number of bytes the caller can move
411 * forward. If 0 it means an error occurred while parsing the name. <offset> is
412 * the number of bytes the caller could move forward.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200413 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200414int dns_read_name(unsigned char *buffer, unsigned char *bufend,
415 unsigned char *name, char *destination, int dest_len,
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100416 int *offset, unsigned int depth)
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200417{
418 int nb_bytes = 0, n = 0;
419 int label_len;
420 unsigned char *reader = name;
421 char *dest = destination;
422
423 while (1) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100424 if (reader >= bufend)
425 goto err;
426
Christopher Faulet67957bd2017-09-27 11:00:59 +0200427 /* Name compression is in use */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200428 if ((*reader & 0xc0) == 0xc0) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100429 if (reader + 1 >= bufend)
430 goto err;
431
Christopher Faulet67957bd2017-09-27 11:00:59 +0200432 /* Must point BEFORE current position */
433 if ((buffer + reader[1]) > reader)
434 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200435
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100436 if (depth++ > 100)
437 goto err;
438
Nikhil Agrawal2fa66c32018-12-20 10:50:59 +0530439 n = dns_read_name(buffer, bufend, buffer + (*reader & 0x3f)*256 + reader[1],
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100440 dest, dest_len - nb_bytes, offset, depth);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200441 if (n == 0)
Christopher Faulet67957bd2017-09-27 11:00:59 +0200442 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200443
Christopher Faulet67957bd2017-09-27 11:00:59 +0200444 dest += n;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200445 nb_bytes += n;
446 goto out;
447 }
448
449 label_len = *reader;
450 if (label_len == 0)
451 goto out;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200452
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200453 /* Check if:
454 * - we won't read outside the buffer
455 * - there is enough place in the destination
456 */
457 if ((reader + label_len >= bufend) || (nb_bytes + label_len >= dest_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +0200458 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200459
460 /* +1 to take label len + label string */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200461 label_len++;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200462
463 memcpy(dest, reader, label_len);
464
Christopher Faulet67957bd2017-09-27 11:00:59 +0200465 dest += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200466 nb_bytes += label_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200467 reader += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200468 }
469
Christopher Faulet67957bd2017-09-27 11:00:59 +0200470 out:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200471 /* offset computation:
472 * parse from <name> until finding either NULL or a pointer "c0xx"
473 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200474 reader = name;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200475 *offset = 0;
476 while (reader < bufend) {
477 if ((reader[0] & 0xc0) == 0xc0) {
478 *offset += 2;
479 break;
480 }
481 else if (*reader == 0) {
482 *offset += 1;
483 break;
484 }
485 *offset += 1;
486 ++reader;
487 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200488 return nb_bytes;
489
Christopher Faulet67957bd2017-09-27 11:00:59 +0200490 err:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200491 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200492}
493
Christopher Faulet67957bd2017-09-27 11:00:59 +0200494/* Checks for any obsolete record, also identify any SRV request, and try to
495 * find a corresponding server.
496*/
497static void dns_check_dns_response(struct dns_resolution *res)
498{
499 struct dns_resolvers *resolvers = res->resolvers;
500 struct dns_requester *req, *reqback;
501 struct dns_answer_item *item, *itemback;
502 struct server *srv;
503 struct dns_srvrq *srvrq;
504
505 list_for_each_entry_safe(item, itemback, &res->response.answer_list, list) {
506
507 /* Remove obsolete items */
508 if ((item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
509 if (item->type != DNS_RTYPE_SRV)
510 goto rm_obselete_item;
511
512 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
513 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
514 continue;
515
516 /* Remove any associated server */
517 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100518 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200519 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
520 item->data_len == srv->hostname_dn_len &&
Olivier Houcharde5188a42020-04-01 18:30:27 +0200521 !dns_hostname_cmp(srv->hostname_dn, item->target, item->data_len)) {
Christopher Faulet52c10d72021-03-10 21:33:21 +0100522 dns_unlink_resolution(srv->dns_requester);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200523 snr_update_srv_status(srv, 1);
524 free(srv->hostname);
525 free(srv->hostname_dn);
526 srv->hostname = NULL;
527 srv->hostname_dn = NULL;
528 srv->hostname_dn_len = 0;
Christopher Fauletbbb63782021-02-23 12:24:09 +0100529 memset(&srv->addr, 0, sizeof(srv->addr));
530 srv->svc_port = 0;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200531 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100532 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200533 }
534 }
535
536 rm_obselete_item:
537 LIST_DEL(&item->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +0100538 pool_free(dns_answer_item_pool, item);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200539 continue;
540 }
541
542 if (item->type != DNS_RTYPE_SRV)
543 continue;
544
545 /* Now process SRV records */
546 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
547 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
548 continue;
549
550 /* Check if a server already uses that hostname */
551 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100552 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200553 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
554 item->data_len == srv->hostname_dn_len &&
Olivier Houcharde5188a42020-04-01 18:30:27 +0200555 !dns_hostname_cmp(srv->hostname_dn, item->target, item->data_len)) {
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100556 int ha_weight;
557
Baptiste Assmannba0244b2019-10-21 15:13:48 +0200558 /* DNS weight range if from 0 to 65535
559 * HAProxy weight is from 0 to 256
560 * The rule below ensures that weight 0 is well respected
561 * while allowing a "mapping" from DNS weight into HAProxy's one.
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100562 */
Baptiste Assmannba0244b2019-10-21 15:13:48 +0200563 ha_weight = (item->weight + 255) / 256;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100564 if (srv->uweight != ha_weight) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200565 char weight[9];
566
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100567 snprintf(weight, sizeof(weight), "%d", ha_weight);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200568 server_parse_weight_change_request(srv, weight);
569 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100570 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200571 break;
572 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100573 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200574 }
575 if (srv)
576 continue;
577
578 /* If not, try to find a server with undefined hostname */
579 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100580 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200581 if (srv->srvrq == srvrq && !srv->hostname_dn)
582 break;
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100583 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200584 }
585 /* And update this server, if found */
586 if (srv) {
587 const char *msg = NULL;
588 char weight[9];
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100589 int ha_weight;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200590 char hostname[DNS_MAX_NAME_SIZE];
591
592 if (dns_dn_label_to_str(item->target, item->data_len+1,
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100593 hostname, DNS_MAX_NAME_SIZE) == -1) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100594 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200595 continue;
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100596 }
Olivier Houchardd16bfe62017-10-31 15:21:19 +0100597 msg = update_server_fqdn(srv, hostname, "SRV record", 1);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200598 if (msg)
599 send_log(srv->proxy, LOG_NOTICE, "%s", msg);
600
601 srv->svc_port = item->port;
602 srv->flags &= ~SRV_F_MAPPORTS;
603 if ((srv->check.state & CHK_ST_CONFIGURED) &&
604 !(srv->flags & SRV_F_CHECKPORT))
605 srv->check.port = item->port;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100606
Baptiste Assmannba0244b2019-10-21 15:13:48 +0200607 /* DNS weight range if from 0 to 65535
608 * HAProxy weight is from 0 to 256
609 * The rule below ensures that weight 0 is well respected
610 * while allowing a "mapping" from DNS weight into HAProxy's one.
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100611 */
Baptiste Assmannba0244b2019-10-21 15:13:48 +0200612 ha_weight = (item->weight + 255) / 256;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100613
614 snprintf(weight, sizeof(weight), "%d", ha_weight);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200615 server_parse_weight_change_request(srv, weight);
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100616 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200617 }
618 }
619 }
620}
621
622/* Validates that the buffer DNS response provided in <resp> and finishing
623 * before <bufend> is valid from a DNS protocol point of view.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200624 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200625 * The result is stored in <resolution>' response, buf_response,
626 * response_query_records and response_answer_records members.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200627 *
628 * This function returns one of the DNS_RESP_* code to indicate the type of
629 * error found.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200630 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200631static int dns_validate_dns_response(unsigned char *resp, unsigned char *bufend,
632 struct dns_resolution *resolution, int max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200633{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200634 unsigned char *reader;
635 char *previous_dname, tmpname[DNS_MAX_NAME_SIZE];
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200636 int len, flags, offset;
637 int dns_query_record_id;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200638 int nb_saved_records;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200639 struct dns_query_item *dns_query;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200640 struct dns_answer_item *dns_answer_record, *tmp_record;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200641 struct dns_response_packet *dns_p;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200642 int i, found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200643
Christopher Faulet67957bd2017-09-27 11:00:59 +0200644 reader = resp;
645 len = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200646 previous_dname = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200647 dns_query = NULL;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200648
Christopher Faulet67957bd2017-09-27 11:00:59 +0200649 /* Initialization of response buffer and structure */
Baptiste Assmann729c9012017-05-22 15:13:10 +0200650 dns_p = &resolution->response;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200651
652 /* query id */
653 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200654 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200655 dns_p->header.id = reader[0] * 256 + reader[1];
656 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200657
Christopher Faulet67957bd2017-09-27 11:00:59 +0200658 /* Flags and rcode are stored over 2 bytes
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200659 * First byte contains:
660 * - response flag (1 bit)
661 * - opcode (4 bits)
662 * - authoritative (1 bit)
663 * - truncated (1 bit)
664 * - recursion desired (1 bit)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200665 */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200666 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200667 return DNS_RESP_INVALID;
668
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200669 flags = reader[0] * 256 + reader[1];
670
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200671 if ((flags & DNS_FLAG_REPLYCODE) != DNS_RCODE_NO_ERROR) {
672 if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_NX_DOMAIN)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200673 return DNS_RESP_NX_DOMAIN;
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200674 else if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_REFUSED)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200675 return DNS_RESP_REFUSED;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200676 return DNS_RESP_ERROR;
677 }
678
Christopher Faulet67957bd2017-09-27 11:00:59 +0200679 /* Move forward 2 bytes for flags */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200680 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200681
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200682 /* 2 bytes for question count */
683 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200684 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200685 dns_p->header.qdcount = reader[0] * 256 + reader[1];
Christopher Faulet67957bd2017-09-27 11:00:59 +0200686 /* (for now) we send one query only, so we expect only one in the
687 * response too */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200688 if (dns_p->header.qdcount != 1)
689 return DNS_RESP_QUERY_COUNT_ERROR;
690 if (dns_p->header.qdcount > DNS_MAX_QUERY_RECORDS)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200691 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200692 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200693
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200694 /* 2 bytes for answer count */
695 if (reader + 2 >= bufend)
696 return DNS_RESP_INVALID;
697 dns_p->header.ancount = reader[0] * 256 + reader[1];
698 if (dns_p->header.ancount == 0)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200699 return DNS_RESP_ANCOUNT_ZERO;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200700 /* Check if too many records are announced */
Baptiste Assmann9d8dbbc2017-08-18 23:35:08 +0200701 if (dns_p->header.ancount > max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200702 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200703 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200704
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200705 /* 2 bytes authority count */
706 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200707 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200708 dns_p->header.nscount = reader[0] * 256 + reader[1];
709 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200710
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200711 /* 2 bytes additional count */
712 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200713 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200714 dns_p->header.arcount = reader[0] * 256 + reader[1];
715 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200716
Christopher Faulet67957bd2017-09-27 11:00:59 +0200717 /* Parsing dns queries */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200718 LIST_INIT(&dns_p->query_list);
719 for (dns_query_record_id = 0; dns_query_record_id < dns_p->header.qdcount; dns_query_record_id++) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200720 /* Use next pre-allocated dns_query_item after ensuring there is
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200721 * still one available.
Christopher Faulet67957bd2017-09-27 11:00:59 +0200722 * It's then added to our packet query list. */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200723 if (dns_query_record_id > DNS_MAX_QUERY_RECORDS)
724 return DNS_RESP_INVALID;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200725 dns_query = &resolution->response_query_records[dns_query_record_id];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200726 LIST_ADDQ(&dns_p->query_list, &dns_query->list);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200727
Christopher Faulet67957bd2017-09-27 11:00:59 +0200728 /* Name is a NULL terminated string in our case, since we have
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200729 * one query per response and the first one can't be compressed
Christopher Faulet67957bd2017-09-27 11:00:59 +0200730 * (using the 0x0c format) */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200731 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100732 len = dns_read_name(resp, bufend, reader, dns_query->name, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200733
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200734 if (len == 0)
735 return DNS_RESP_INVALID;
736
737 reader += offset;
738 previous_dname = dns_query->name;
739
740 /* move forward 2 bytes for question type */
741 if (reader + 2 >= bufend)
742 return DNS_RESP_INVALID;
743 dns_query->type = reader[0] * 256 + reader[1];
744 reader += 2;
745
746 /* move forward 2 bytes for question class */
747 if (reader + 2 >= bufend)
748 return DNS_RESP_INVALID;
749 dns_query->class = reader[0] * 256 + reader[1];
750 reader += 2;
751 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200752
Baptiste Assmann251abb92017-08-11 09:58:27 +0200753 /* TRUNCATED flag must be checked after we could read the query type
Christopher Faulet67957bd2017-09-27 11:00:59 +0200754 * because a TRUNCATED SRV query type response can still be exploited */
Baptiste Assmann251abb92017-08-11 09:58:27 +0200755 if (dns_query->type != DNS_RTYPE_SRV && flags & DNS_FLAG_TRUNCATED)
756 return DNS_RESP_TRUNCATED;
757
Baptiste Assmann325137d2015-04-13 23:40:55 +0200758 /* now parsing response records */
Baptiste Assmann69fce672017-05-04 08:37:45 +0200759 nb_saved_records = 0;
Olivier Houchard8da5f982017-08-04 18:35:36 +0200760 for (i = 0; i < dns_p->header.ancount; i++) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200761 if (reader >= bufend)
762 return DNS_RESP_INVALID;
763
Willy Tarreaubafbe012017-11-24 17:34:44 +0100764 dns_answer_record = pool_alloc(dns_answer_item_pool);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200765 if (dns_answer_record == NULL)
766 return (DNS_RESP_INVALID);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200767
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200768 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100769 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200770
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200771 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100772 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200773 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200774 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200775
Christopher Faulet67957bd2017-09-27 11:00:59 +0200776 /* Check if the current record dname is valid. previous_dname
777 * points either to queried dname or last CNAME target */
Olivier Houcharde5188a42020-04-01 18:30:27 +0200778 if (dns_query->type != DNS_RTYPE_SRV && dns_hostname_cmp(previous_dname, tmpname, len) != 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100779 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200780 if (i == 0) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200781 /* First record, means a mismatch issue between
782 * queried dname and dname found in the first
783 * record */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200784 return DNS_RESP_INVALID;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200785 }
786 else {
787 /* If not the first record, this means we have a
788 * CNAME resolution error */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200789 return DNS_RESP_CNAME_ERROR;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200790 }
791
Baptiste Assmann325137d2015-04-13 23:40:55 +0200792 }
793
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200794 memcpy(dns_answer_record->name, tmpname, len);
795 dns_answer_record->name[len] = 0;
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200796
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200797 reader += offset;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200798 if (reader >= bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100799 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200800 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200801 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200802
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200803 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200804 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100805 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200806 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200807 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200808 dns_answer_record->type = reader[0] * 256 + reader[1];
809 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200810
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200811 /* 2 bytes for class (2) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200812 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100813 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200814 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200815 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200816 dns_answer_record->class = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200817 reader += 2;
818
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200819 /* 4 bytes for ttl (4) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200820 if (reader + 4 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100821 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200822 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200823 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200824 dns_answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
825 + reader[2] * 256 + reader[3];
826 reader += 4;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200827
Christopher Faulet67957bd2017-09-27 11:00:59 +0200828 /* Now reading data len */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200829 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100830 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200831 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200832 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200833 dns_answer_record->data_len = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200834
Christopher Faulet67957bd2017-09-27 11:00:59 +0200835 /* Move forward 2 bytes for data len */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200836 reader += 2;
837
Jérôme Magnin8d4e7dc2018-12-20 16:47:31 +0100838 if (reader + dns_answer_record->data_len > bufend) {
Remi Gacogneefbbdf72018-12-05 17:56:29 +0100839 pool_free(dns_answer_item_pool, dns_answer_record);
840 return DNS_RESP_INVALID;
841 }
842
Christopher Faulet67957bd2017-09-27 11:00:59 +0200843 /* Analyzing record content */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200844 switch (dns_answer_record->type) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200845 case DNS_RTYPE_A:
846 /* ipv4 is stored on 4 bytes */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200847 if (dns_answer_record->data_len != 4) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100848 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200849 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200850 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200851 dns_answer_record->address.sa_family = AF_INET;
852 memcpy(&(((struct sockaddr_in *)&dns_answer_record->address)->sin_addr),
853 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200854 break;
855
856 case DNS_RTYPE_CNAME:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200857 /* Check if this is the last record and update the caller about the status:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200858 * no IP could be found and last record was a CNAME. Could be triggered
859 * by a wrong query type
860 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200861 * + 1 because dns_answer_record_id starts at 0
862 * while number of answers is an integer and
863 * starts at 1.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200864 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200865 if (i + 1 == dns_p->header.ancount) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100866 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200867 return DNS_RESP_CNAME_ERROR;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200868 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200869
870 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100871 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200872 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100873 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200874 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200875 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200876
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200877 memcpy(dns_answer_record->target, tmpname, len);
878 dns_answer_record->target[len] = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200879 previous_dname = dns_answer_record->target;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200880 break;
881
Olivier Houchard8da5f982017-08-04 18:35:36 +0200882
883 case DNS_RTYPE_SRV:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200884 /* Answer must contain :
Olivier Houchard8da5f982017-08-04 18:35:36 +0200885 * - 2 bytes for the priority
886 * - 2 bytes for the weight
887 * - 2 bytes for the port
888 * - the target hostname
889 */
890 if (dns_answer_record->data_len <= 6) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100891 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200892 return DNS_RESP_INVALID;
893 }
Willy Tarreaud5370e12017-09-19 14:59:52 +0200894 dns_answer_record->priority = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200895 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200896 dns_answer_record->weight = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200897 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200898 dns_answer_record->port = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200899 reader += sizeof(uint16_t);
900 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100901 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200902 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100903 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200904 return DNS_RESP_INVALID;
905 }
Olivier Houchard8da5f982017-08-04 18:35:36 +0200906 dns_answer_record->data_len = len;
907 memcpy(dns_answer_record->target, tmpname, len);
908 dns_answer_record->target[len] = 0;
909 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200910
Baptiste Assmann325137d2015-04-13 23:40:55 +0200911 case DNS_RTYPE_AAAA:
912 /* ipv6 is stored on 16 bytes */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200913 if (dns_answer_record->data_len != 16) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100914 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200915 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200916 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200917 dns_answer_record->address.sa_family = AF_INET6;
918 memcpy(&(((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr),
919 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200920 break;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200921
Baptiste Assmann325137d2015-04-13 23:40:55 +0200922 } /* switch (record type) */
923
Christopher Faulet67957bd2017-09-27 11:00:59 +0200924 /* Increment the counter for number of records saved into our
925 * local response */
926 nb_saved_records++;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200927
Christopher Faulet67957bd2017-09-27 11:00:59 +0200928 /* Move forward dns_answer_record->data_len for analyzing next
929 * record in the response */
930 reader += ((dns_answer_record->type == DNS_RTYPE_SRV)
931 ? offset
932 : dns_answer_record->data_len);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200933
934 /* Lookup to see if we already had this entry */
Olivier Houchard8da5f982017-08-04 18:35:36 +0200935 found = 0;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200936 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
937 if (tmp_record->type != dns_answer_record->type)
938 continue;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200939
940 switch(tmp_record->type) {
941 case DNS_RTYPE_A:
942 if (!memcmp(&((struct sockaddr_in *)&dns_answer_record->address)->sin_addr,
943 &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
944 sizeof(in_addr_t)))
945 found = 1;
946 break;
947
948 case DNS_RTYPE_AAAA:
949 if (!memcmp(&((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr,
950 &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
951 sizeof(struct in6_addr)))
952 found = 1;
953 break;
954
Olivier Houchard8da5f982017-08-04 18:35:36 +0200955 case DNS_RTYPE_SRV:
956 if (dns_answer_record->data_len == tmp_record->data_len &&
Olivier Houcharde5188a42020-04-01 18:30:27 +0200957 !dns_hostname_cmp(dns_answer_record->target, tmp_record->target, dns_answer_record->data_len) &&
Olivier Houchard8da5f982017-08-04 18:35:36 +0200958 dns_answer_record->port == tmp_record->port) {
959 tmp_record->weight = dns_answer_record->weight;
960 found = 1;
961 }
962 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200963
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200964 default:
965 break;
966 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200967
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200968 if (found == 1)
969 break;
970 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200971
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200972 if (found == 1) {
973 tmp_record->last_seen = now.tv_sec;
Willy Tarreaubafbe012017-11-24 17:34:44 +0100974 pool_free(dns_answer_item_pool, dns_answer_record);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200975 }
976 else {
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200977 dns_answer_record->last_seen = now.tv_sec;
978 LIST_ADDQ(&dns_p->answer_list, &dns_answer_record->list);
979 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200980 } /* for i 0 to ancount */
981
Christopher Faulet67957bd2017-09-27 11:00:59 +0200982 /* Save the number of records we really own */
Baptiste Assmann69fce672017-05-04 08:37:45 +0200983 dns_p->header.ancount = nb_saved_records;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200984 dns_check_dns_response(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200985 return DNS_RESP_VALID;
986}
987
Christopher Faulet67957bd2017-09-27 11:00:59 +0200988/* Searches dn_name resolution in resp.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200989 * If existing IP not found, return the first IP matching family_priority,
990 * otherwise, first ip found
991 * The following tasks are the responsibility of the caller:
Baptiste Assmann3cf7f982016-04-17 22:43:26 +0200992 * - <dns_p> contains an error free DNS response
Baptiste Assmann325137d2015-04-13 23:40:55 +0200993 * For both cases above, dns_validate_dns_response is required
994 * returns one of the DNS_UPD_* code
995 */
Baptiste Assmannfb7091e2017-05-03 15:43:12 +0200996int dns_get_ip_from_response(struct dns_response_packet *dns_p,
Baptiste Assmann42746372017-05-03 12:12:02 +0200997 struct dns_options *dns_opts, void *currentip,
Thierry Fournierada34842016-02-17 21:25:09 +0100998 short currentip_sin_family,
Baptiste Assmannfb7091e2017-05-03 15:43:12 +0200999 void **newip, short *newip_sin_family,
1000 void *owner)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001001{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +02001002 struct dns_answer_item *record;
Thierry Fournierada34842016-02-17 21:25:09 +01001003 int family_priority;
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001004 int currentip_found;
Baptiste Assmann3cf7f982016-04-17 22:43:26 +02001005 unsigned char *newip4, *newip6;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001006 int currentip_sel;
1007 int j;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001008 int score, max_score;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001009 int allowed_duplicated_ip;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001010
Christopher Faulet67957bd2017-09-27 11:00:59 +02001011 family_priority = dns_opts->family_prio;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001012 allowed_duplicated_ip = dns_opts->accept_duplicate_ip;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001013 *newip = newip4 = newip6 = NULL;
1014 currentip_found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001015 *newip_sin_family = AF_UNSPEC;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001016 max_score = -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001017
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001018 /* Select an IP regarding configuration preference.
Joseph Herlant42cf6392018-11-15 10:33:28 -08001019 * Top priority is the preferred network ip version,
1020 * second priority is the preferred network.
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001021 * the last priority is the currently used IP,
1022 *
1023 * For these three priorities, a score is calculated. The
1024 * weight are:
Joseph Herlant42cf6392018-11-15 10:33:28 -08001025 * 8 - preferred ip version.
1026 * 4 - preferred network.
Baptistefc725902016-12-26 23:21:08 +01001027 * 2 - if the ip in the record is not affected to any other server in the same backend (duplication)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001028 * 1 - current ip.
1029 * The result with the biggest score is returned.
1030 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001031
1032 list_for_each_entry(record, &dns_p->answer_list, list) {
1033 void *ip;
1034 unsigned char ip_type;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001035
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001036 if (record->type == DNS_RTYPE_A) {
1037 ip = &(((struct sockaddr_in *)&record->address)->sin_addr);
1038 ip_type = AF_INET;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001039 }
1040 else if (record->type == DNS_RTYPE_AAAA) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001041 ip_type = AF_INET6;
1042 ip = &(((struct sockaddr_in6 *)&record->address)->sin6_addr);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001043 }
1044 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001045 continue;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001046 score = 0;
1047
Joseph Herlant42cf6392018-11-15 10:33:28 -08001048 /* Check for preferred ip protocol. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001049 if (ip_type == family_priority)
Baptistefc725902016-12-26 23:21:08 +01001050 score += 8;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001051
Joseph Herlant42cf6392018-11-15 10:33:28 -08001052 /* Check for preferred network. */
Baptiste Assmann42746372017-05-03 12:12:02 +02001053 for (j = 0; j < dns_opts->pref_net_nb; j++) {
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001054
1055 /* Compare only the same adresses class. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001056 if (dns_opts->pref_net[j].family != ip_type)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001057 continue;
1058
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001059 if ((ip_type == AF_INET &&
1060 in_net_ipv4(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001061 &dns_opts->pref_net[j].mask.in4,
1062 &dns_opts->pref_net[j].addr.in4)) ||
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001063 (ip_type == AF_INET6 &&
1064 in_net_ipv6(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001065 &dns_opts->pref_net[j].mask.in6,
1066 &dns_opts->pref_net[j].addr.in6))) {
Baptistefc725902016-12-26 23:21:08 +01001067 score += 4;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001068 break;
1069 }
1070 }
1071
Christopher Faulet67957bd2017-09-27 11:00:59 +02001072 /* Check if the IP found in the record is already affected to a
Baptiste Assmann84221b42018-06-22 13:03:50 +02001073 * member of a group. If not, the score should be incremented
Christopher Faulet67957bd2017-09-27 11:00:59 +02001074 * by 2. */
Baptiste Assmann84221b42018-06-22 13:03:50 +02001075 if (owner && snr_check_ip_callback(owner, ip, &ip_type)) {
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001076 if (!allowed_duplicated_ip) {
1077 continue;
1078 }
Baptiste Assmann84221b42018-06-22 13:03:50 +02001079 } else {
1080 score += 2;
1081 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001082
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001083 /* Check for current ip matching. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001084 if (ip_type == currentip_sin_family &&
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001085 ((currentip_sin_family == AF_INET &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001086 !memcmp(ip, currentip, 4)) ||
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001087 (currentip_sin_family == AF_INET6 &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001088 !memcmp(ip, currentip, 16)))) {
1089 score++;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001090 currentip_sel = 1;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001091 }
1092 else
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001093 currentip_sel = 0;
1094
1095 /* Keep the address if the score is better than the previous
Christopher Faulet67957bd2017-09-27 11:00:59 +02001096 * score. The maximum score is 15, if this value is reached, we
1097 * break the parsing. Implicitly, this score is reached the ip
1098 * selected is the current ip. */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001099 if (score > max_score) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001100 if (ip_type == AF_INET)
1101 newip4 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001102 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001103 newip6 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001104 currentip_found = currentip_sel;
Baptistefc725902016-12-26 23:21:08 +01001105 if (score == 15)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001106 return DNS_UPD_NO;
1107 max_score = score;
1108 }
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001109 } /* list for each record entries */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001110
Christopher Faulet67957bd2017-09-27 11:00:59 +02001111 /* No IP found in the response */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001112 if (!newip4 && !newip6)
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001113 return DNS_UPD_NO_IP_FOUND;
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001114
Christopher Faulet67957bd2017-09-27 11:00:59 +02001115 /* Case when the caller looks first for an IPv4 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001116 if (family_priority == AF_INET) {
1117 if (newip4) {
1118 *newip = newip4;
1119 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001120 }
1121 else if (newip6) {
1122 *newip = newip6;
1123 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001124 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001125 if (!currentip_found)
1126 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001127 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001128 /* Case when the caller looks first for an IPv6 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001129 else if (family_priority == AF_INET6) {
1130 if (newip6) {
1131 *newip = newip6;
1132 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001133 }
1134 else if (newip4) {
1135 *newip = newip4;
1136 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001137 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001138 if (!currentip_found)
1139 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001140 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001141 /* Case when the caller have no preference (we prefer IPv6) */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001142 else if (family_priority == AF_UNSPEC) {
1143 if (newip6) {
1144 *newip = newip6;
1145 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001146 }
1147 else if (newip4) {
1148 *newip = newip4;
1149 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001150 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001151 if (!currentip_found)
1152 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001153 }
1154
Christopher Faulet67957bd2017-09-27 11:00:59 +02001155 /* No reason why we should change the server's IP address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001156 return DNS_UPD_NO;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001157
Christopher Faulet67957bd2017-09-27 11:00:59 +02001158 not_found:
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001159 list_for_each_entry(record, &dns_p->answer_list, list) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001160 /* Move the first record to the end of the list, for internal
1161 * round robin */
1162 LIST_DEL(&record->list);
1163 LIST_ADDQ(&dns_p->answer_list, &record->list);
1164 break;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001165 }
1166 return DNS_UPD_SRVIP_NOT_FOUND;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001167}
1168
Christopher Faulet67957bd2017-09-27 11:00:59 +02001169/* Turns a domain name label into a string.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001170 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001171 * <dn> must be a null-terminated string. <dn_len> must include the terminating
1172 * null byte. <str> must be allocated and its size must be passed in <str_len>.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001173 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001174 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1175 * <str> (including the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001176 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001177int dns_dn_label_to_str(const char *dn, int dn_len, char *str, int str_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001178{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001179 char *ptr;
1180 int i, sz;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001181
Christopher Faulet67957bd2017-09-27 11:00:59 +02001182 if (str_len < dn_len - 1)
Baptiste Assmann2af08fe2017-08-14 00:13:01 +02001183 return -1;
1184
Christopher Faulet67957bd2017-09-27 11:00:59 +02001185 ptr = str;
1186 for (i = 0; i < dn_len-1; ++i) {
1187 sz = dn[i];
1188 if (i)
1189 *ptr++ = '.';
1190 memcpy(ptr, dn+i+1, sz);
1191 ptr += sz;
1192 i += sz;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001193 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001194 *ptr++ = '\0';
1195 return (ptr - str);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001196}
1197
Christopher Faulet67957bd2017-09-27 11:00:59 +02001198/* Turns a string into domain name label: www.haproxy.org into 3www7haproxy3org
1199 *
1200 * <str> must be a null-terminated string. <str_len> must include the
1201 * terminating null byte. <dn> buffer must be allocated and its size must be
1202 * passed in <dn_len>.
1203 *
1204 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1205 * <dn> (excluding the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001206 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001207int dns_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001208{
Baptiste Assmann325137d2015-04-13 23:40:55 +02001209 int i, offset;
1210
Christopher Faulet67957bd2017-09-27 11:00:59 +02001211 if (dn_len < str_len + 1)
1212 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001213
Christopher Faulet67957bd2017-09-27 11:00:59 +02001214 /* First byte of dn will be used to store the length of the first
1215 * label */
1216 offset = 0;
1217 for (i = 0; i < str_len; ++i) {
1218 if (str[i] == '.') {
1219 /* 2 or more consecutive dots is invalid */
1220 if (i == offset)
1221 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001222
Lukas Tribus76d4ff02020-02-27 15:47:24 +01001223 /* ignore trailing dot */
1224 if (i + 2 == str_len) {
1225 i++;
1226 break;
1227 }
1228
Christopher Faulet67957bd2017-09-27 11:00:59 +02001229 dn[offset] = (i - offset);
1230 offset = i+1;
1231 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001232 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001233 dn[i+1] = str[i];
Baptiste Assmann325137d2015-04-13 23:40:55 +02001234 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001235 dn[offset] = (i - offset - 1);
1236 dn[i] = '\0';
1237 return i;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001238}
1239
Christopher Faulet67957bd2017-09-27 11:00:59 +02001240/* Validates host name:
Baptiste Assmann325137d2015-04-13 23:40:55 +02001241 * - total size
1242 * - each label size individually
1243 * returns:
1244 * 0 in case of error. If <err> is not NULL, an error message is stored there.
1245 * 1 when no error. <err> is left unaffected.
1246 */
1247int dns_hostname_validation(const char *string, char **err)
1248{
Baptiste Assmann325137d2015-04-13 23:40:55 +02001249 int i;
1250
1251 if (strlen(string) > DNS_MAX_NAME_SIZE) {
1252 if (err)
1253 *err = DNS_TOO_LONG_FQDN;
1254 return 0;
1255 }
1256
William Dauchy5d2ca062020-01-26 19:52:34 +01001257 while (*string) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001258 i = 0;
William Dauchy5d2ca062020-01-26 19:52:34 +01001259 while (*string && *string != '.' && i < DNS_MAX_LABEL_SIZE) {
1260 if (!(*string == '-' || *string == '_' ||
1261 (*string >= 'a' && *string <= 'z') ||
1262 (*string >= 'A' && *string <= 'Z') ||
1263 (*string >= '0' && *string <= '9'))) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001264 if (err)
1265 *err = DNS_INVALID_CHARACTER;
1266 return 0;
1267 }
William Dauchy5d2ca062020-01-26 19:52:34 +01001268 i++;
1269 string++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001270 }
1271
William Dauchy5d2ca062020-01-26 19:52:34 +01001272 if (!(*string))
1273 break;
1274
1275 if (*string != '.' && i >= DNS_MAX_LABEL_SIZE) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001276 if (err)
1277 *err = DNS_LABEL_TOO_LONG;
1278 return 0;
1279 }
1280
William Dauchy5d2ca062020-01-26 19:52:34 +01001281 string++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001282 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001283 return 1;
1284}
1285
Christopher Faulet67957bd2017-09-27 11:00:59 +02001286/* Picks up an available resolution from the different resolution list
1287 * associated to a resolvers section, in this order:
1288 * 1. check in resolutions.curr for the same hostname and query_type
1289 * 2. check in resolutions.wait for the same hostname and query_type
1290 * 3. Get a new resolution from resolution pool
1291 *
1292 * Returns an available resolution, NULL if none found.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001293 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001294static struct dns_resolution *dns_pick_resolution(struct dns_resolvers *resolvers,
1295 char **hostname_dn, int hostname_dn_len,
1296 int query_type)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001297{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001298 struct dns_resolution *res;
1299
1300 if (!*hostname_dn)
1301 goto from_pool;
1302
1303 /* Search for same hostname and query type in resolutions.curr */
1304 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
1305 if (!res->hostname_dn)
1306 continue;
1307 if ((query_type == res->prefered_query_type) &&
1308 hostname_dn_len == res->hostname_dn_len &&
Olivier Houcharde5188a42020-04-01 18:30:27 +02001309 !dns_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +02001310 return res;
1311 }
1312
1313 /* Search for same hostname and query type in resolutions.wait */
1314 list_for_each_entry(res, &resolvers->resolutions.wait, list) {
1315 if (!res->hostname_dn)
1316 continue;
1317 if ((query_type == res->prefered_query_type) &&
1318 hostname_dn_len == res->hostname_dn_len &&
Olivier Houcharde5188a42020-04-01 18:30:27 +02001319 !dns_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +02001320 return res;
1321 }
1322
1323 from_pool:
1324 /* No resolution could be found, so let's allocate a new one */
Willy Tarreaubafbe012017-11-24 17:34:44 +01001325 res = pool_alloc(dns_resolution_pool);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001326 if (res) {
1327 memset(res, 0, sizeof(*res));
1328 res->resolvers = resolvers;
1329 res->uuid = resolution_uuid;
1330 res->status = RSLV_STATUS_NONE;
1331 res->step = RSLV_STEP_NONE;
1332 res->last_valid = now_ms;
1333
1334 LIST_INIT(&res->requesters);
1335 LIST_INIT(&res->response.answer_list);
1336
1337 res->prefered_query_type = query_type;
1338 res->query_type = query_type;
1339 res->hostname_dn = *hostname_dn;
1340 res->hostname_dn_len = hostname_dn_len;
1341
1342 ++resolution_uuid;
1343
1344 /* Move the resolution to the resolvers wait queue */
1345 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1346 }
1347 return res;
1348}
1349
Christopher Faulete530c762021-03-10 14:40:39 +01001350void dns_purge_resolution_answer_records(struct dns_resolution *resolution)
1351{
1352 struct dns_answer_item *item, *itemback;
1353
1354 list_for_each_entry_safe(item, itemback, &resolution->response.answer_list, list) {
1355 LIST_DEL(&item->list);
1356 pool_free(dns_answer_item_pool, item);
1357 }
1358}
1359
Christopher Faulet67957bd2017-09-27 11:00:59 +02001360/* Releases a resolution from its requester(s) and move it back to the pool */
1361static void dns_free_resolution(struct dns_resolution *resolution)
1362{
1363 struct dns_requester *req, *reqback;
1364
1365 /* clean up configuration */
1366 dns_reset_resolution(resolution);
1367 resolution->hostname_dn = NULL;
1368 resolution->hostname_dn_len = 0;
1369
1370 list_for_each_entry_safe(req, reqback, &resolution->requesters, list) {
1371 LIST_DEL(&req->list);
1372 req->resolution = NULL;
1373 }
1374
Christopher Faulete530c762021-03-10 14:40:39 +01001375 dns_purge_resolution_answer_records(resolution);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001376 LIST_DEL(&resolution->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +01001377 pool_free(dns_resolution_pool, resolution);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001378}
1379
1380/* Links a requester (a server or a dns_srvrq) with a resolution. It returns 0
1381 * on success, -1 otherwise.
1382 */
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001383int dns_link_resolution(void *requester, int requester_type, int requester_locked)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001384{
1385 struct dns_resolution *res = NULL;
1386 struct dns_requester *req;
1387 struct dns_resolvers *resolvers;
1388 struct server *srv = NULL;
1389 struct dns_srvrq *srvrq = NULL;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001390 struct stream *stream = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001391 char **hostname_dn;
1392 int hostname_dn_len, query_type;
1393
1394 switch (requester_type) {
1395 case OBJ_TYPE_SERVER:
1396 srv = (struct server *)requester;
1397 hostname_dn = &srv->hostname_dn;
1398 hostname_dn_len = srv->hostname_dn_len;
1399 resolvers = srv->resolvers;
1400 query_type = ((srv->dns_opts.family_prio == AF_INET)
1401 ? DNS_RTYPE_A
1402 : DNS_RTYPE_AAAA);
1403 break;
1404
1405 case OBJ_TYPE_SRVRQ:
1406 srvrq = (struct dns_srvrq *)requester;
1407 hostname_dn = &srvrq->hostname_dn;
1408 hostname_dn_len = srvrq->hostname_dn_len;
1409 resolvers = srvrq->resolvers;
1410 query_type = DNS_RTYPE_SRV;
1411 break;
1412
Baptiste Assmann333939c2019-01-21 08:34:50 +01001413 case OBJ_TYPE_STREAM:
1414 stream = (struct stream *)requester;
1415 hostname_dn = &stream->dns_ctx.hostname_dn;
1416 hostname_dn_len = stream->dns_ctx.hostname_dn_len;
1417 resolvers = stream->dns_ctx.parent->arg.dns.resolvers;
1418 query_type = ((stream->dns_ctx.parent->arg.dns.dns_opts.family_prio == AF_INET)
1419 ? DNS_RTYPE_A
1420 : DNS_RTYPE_AAAA);
1421 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001422 default:
1423 goto err;
1424 }
1425
1426 /* Get a resolution from the resolvers' wait queue or pool */
1427 if ((res = dns_pick_resolution(resolvers, hostname_dn, hostname_dn_len, query_type)) == NULL)
1428 goto err;
1429
1430 if (srv) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001431 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001432 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001433 if (srv->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001434 if ((req = pool_alloc(dns_requester_pool)) == NULL) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001435 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001436 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001437 goto err;
Willy Tarreau5ec84572017-11-05 10:35:57 +01001438 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001439 req->owner = &srv->obj_type;
1440 srv->dns_requester = req;
1441 }
1442 else
1443 req = srv->dns_requester;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001444 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001445 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001446
1447 req->requester_cb = snr_resolution_cb;
1448 req->requester_error_cb = snr_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001449 }
1450 else if (srvrq) {
1451 if (srvrq->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001452 if ((req = pool_alloc(dns_requester_pool)) == NULL)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001453 goto err;
1454 req->owner = &srvrq->obj_type;
1455 srvrq->dns_requester = req;
1456 }
1457 else
1458 req = srvrq->dns_requester;
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001459
1460 req->requester_cb = snr_resolution_cb;
Baptiste Assmann132d25f2020-11-19 22:38:33 +01001461 req->requester_error_cb = srvrq_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001462 }
Baptiste Assmann333939c2019-01-21 08:34:50 +01001463 else if (stream) {
1464 if (stream->dns_ctx.dns_requester == NULL) {
1465 if ((req = pool_alloc(dns_requester_pool)) == NULL)
1466 goto err;
1467 req->owner = &stream->obj_type;
1468 stream->dns_ctx.dns_requester = req;
1469 }
1470 else
1471 req = stream->dns_ctx.dns_requester;
1472
1473 req->requester_cb = act_resolution_cb;
1474 req->requester_error_cb = act_resolution_error_cb;
1475 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001476 else
1477 goto err;
1478
1479 req->resolution = res;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001480
1481 LIST_ADDQ(&res->requesters, &req->list);
1482 return 0;
1483
1484 err:
1485 if (res && LIST_ISEMPTY(&res->requesters))
1486 dns_free_resolution(res);
1487 return -1;
1488}
1489
1490/* Removes a requester from a DNS resoltion. It takes takes care of all the
1491 * consequences. It also cleans up some parameters from the requester.
1492 */
1493void dns_unlink_resolution(struct dns_requester *requester)
1494{
1495 struct dns_resolution *res;
1496 struct dns_requester *req;
1497
1498 /* Nothing to do */
1499 if (!requester || !requester->resolution)
1500 return;
1501 res = requester->resolution;
1502
1503 /* Clean up the requester */
1504 LIST_DEL(&requester->list);
1505 requester->resolution = NULL;
1506
1507 /* We need to find another requester linked on this resolution */
1508 if (!LIST_ISEMPTY(&res->requesters))
1509 req = LIST_NEXT(&res->requesters, struct dns_requester *, list);
1510 else {
1511 dns_free_resolution(res);
1512 return;
1513 }
1514
1515 /* Move hostname_dn related pointers to the next requester */
1516 switch (obj_type(req->owner)) {
1517 case OBJ_TYPE_SERVER:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001518 res->hostname_dn = __objt_server(req->owner)->hostname_dn;
1519 res->hostname_dn_len = __objt_server(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001520 break;
1521 case OBJ_TYPE_SRVRQ:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001522 res->hostname_dn = __objt_dns_srvrq(req->owner)->hostname_dn;
1523 res->hostname_dn_len = __objt_dns_srvrq(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001524 break;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001525 case OBJ_TYPE_STREAM:
1526 res->hostname_dn = __objt_stream(req->owner)->dns_ctx.hostname_dn;
1527 res->hostname_dn_len = __objt_stream(req->owner)->dns_ctx.hostname_dn_len;
1528 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001529 default:
1530 res->hostname_dn = NULL;
1531 res->hostname_dn_len = 0;
1532 break;
1533 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001534}
1535
Christopher Faulet67957bd2017-09-27 11:00:59 +02001536/* Called when a network IO is generated on a name server socket for an incoming
1537 * packet. It performs the following actions:
1538 * - check if the packet requires processing (not outdated resolution)
1539 * - ensure the DNS packet received is valid and call requester's callback
1540 * - call requester's error callback if invalid response
1541 * - check the dn_name in the packet against the one sent
1542 */
1543static void dns_resolve_recv(struct dgram_conn *dgram)
1544{
1545 struct dns_nameserver *ns, *tmpns;
1546 struct dns_resolvers *resolvers;
1547 struct dns_resolution *res;
1548 struct dns_query_item *query;
1549 unsigned char buf[DNS_MAX_UDP_MESSAGE + 1];
1550 unsigned char *bufend;
1551 int fd, buflen, dns_resp;
1552 int max_answer_records;
1553 unsigned short query_id;
1554 struct eb32_node *eb;
1555 struct dns_requester *req;
1556
1557 fd = dgram->t.sock.fd;
1558
1559 /* check if ready for reading */
1560 if (!fd_recv_ready(fd))
1561 return;
1562
1563 /* no need to go further if we can't retrieve the nameserver */
Willy Tarreau1899dbf2019-12-10 18:38:09 +01001564 if ((ns = dgram->owner) == NULL) {
1565 _HA_ATOMIC_AND(&fdtab[fd].ev, ~(FD_POLL_HUP|FD_POLL_ERR));
1566 fd_stop_recv(fd);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001567 return;
Willy Tarreau1899dbf2019-12-10 18:38:09 +01001568 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001569
1570 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001571 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001572
1573 /* process all pending input messages */
Willy Tarreau1899dbf2019-12-10 18:38:09 +01001574 while (fd_recv_ready(fd)) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001575 /* read message received */
1576 memset(buf, '\0', resolvers->accepted_payload_size + 1);
1577 if ((buflen = recv(fd, (char*)buf , resolvers->accepted_payload_size + 1, 0)) < 0) {
Willy Tarreau1899dbf2019-12-10 18:38:09 +01001578 /* FIXME : for now we consider EAGAIN only, but at
1579 * least we purge sticky errors that would cause us to
1580 * be called in loops.
1581 */
1582 _HA_ATOMIC_AND(&fdtab[fd].ev, ~(FD_POLL_HUP|FD_POLL_ERR));
Christopher Faulet67957bd2017-09-27 11:00:59 +02001583 fd_cant_recv(fd);
1584 break;
1585 }
1586
1587 /* message too big */
1588 if (buflen > resolvers->accepted_payload_size) {
1589 ns->counters.too_big++;
1590 continue;
1591 }
1592
1593 /* initializing variables */
1594 bufend = buf + buflen; /* pointer to mark the end of the buffer */
1595
1596 /* read the query id from the packet (16 bits) */
1597 if (buf + 2 > bufend) {
1598 ns->counters.invalid++;
1599 continue;
1600 }
1601 query_id = dns_response_get_query_id(buf);
1602
1603 /* search the query_id in the pending resolution tree */
1604 eb = eb32_lookup(&resolvers->query_ids, query_id);
1605 if (eb == NULL) {
1606 /* unknown query id means an outdated response and can be safely ignored */
1607 ns->counters.outdated++;
1608 continue;
1609 }
1610
1611 /* known query id means a resolution in prgress */
1612 res = eb32_entry(eb, struct dns_resolution, qid);
1613 if (!res) {
1614 ns->counters.outdated++;
1615 continue;
1616 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001617
Christopher Faulet67957bd2017-09-27 11:00:59 +02001618 /* number of responses received */
1619 res->nb_responses++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001620
Christopher Faulet67957bd2017-09-27 11:00:59 +02001621 max_answer_records = (resolvers->accepted_payload_size - DNS_HEADER_SIZE) / DNS_MIN_RECORD_SIZE;
1622 dns_resp = dns_validate_dns_response(buf, bufend, res, max_answer_records);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001623
Christopher Faulet67957bd2017-09-27 11:00:59 +02001624 switch (dns_resp) {
1625 case DNS_RESP_VALID:
1626 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001627
Christopher Faulet67957bd2017-09-27 11:00:59 +02001628 case DNS_RESP_INVALID:
1629 case DNS_RESP_QUERY_COUNT_ERROR:
1630 case DNS_RESP_WRONG_NAME:
1631 res->status = RSLV_STATUS_INVALID;
1632 ns->counters.invalid++;
1633 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001634
Christopher Faulet67957bd2017-09-27 11:00:59 +02001635 case DNS_RESP_NX_DOMAIN:
1636 res->status = RSLV_STATUS_NX;
1637 ns->counters.nx++;
1638 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001639
Christopher Faulet67957bd2017-09-27 11:00:59 +02001640 case DNS_RESP_REFUSED:
1641 res->status = RSLV_STATUS_REFUSED;
1642 ns->counters.refused++;
1643 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001644
Christopher Faulet67957bd2017-09-27 11:00:59 +02001645 case DNS_RESP_ANCOUNT_ZERO:
1646 res->status = RSLV_STATUS_OTHER;
1647 ns->counters.any_err++;
1648 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001649
Christopher Faulet67957bd2017-09-27 11:00:59 +02001650 case DNS_RESP_CNAME_ERROR:
1651 res->status = RSLV_STATUS_OTHER;
1652 ns->counters.cname_error++;
1653 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001654
Christopher Faulet67957bd2017-09-27 11:00:59 +02001655 case DNS_RESP_TRUNCATED:
1656 res->status = RSLV_STATUS_OTHER;
1657 ns->counters.truncated++;
1658 break;
Baptiste Assmanne70bc052017-08-21 16:51:09 +02001659
Christopher Faulet67957bd2017-09-27 11:00:59 +02001660 case DNS_RESP_NO_EXPECTED_RECORD:
1661 case DNS_RESP_ERROR:
1662 case DNS_RESP_INTERNAL:
1663 res->status = RSLV_STATUS_OTHER;
1664 ns->counters.other++;
1665 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001666 }
1667
Christopher Faulet67957bd2017-09-27 11:00:59 +02001668 /* Wait all nameservers response to handle errors */
1669 if (dns_resp != DNS_RESP_VALID && res->nb_responses < resolvers->nb_nameservers)
1670 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001671
Christopher Faulet67957bd2017-09-27 11:00:59 +02001672 /* Process error codes */
1673 if (dns_resp != DNS_RESP_VALID) {
1674 if (res->prefered_query_type != res->query_type) {
1675 /* The fallback on the query type was already performed,
1676 * so check the try counter. If it falls to 0, we can
1677 * report an error. Else, wait the next attempt. */
1678 if (!res->try)
1679 goto report_res_error;
1680 }
1681 else {
1682 /* Fallback from A to AAAA or the opposite and re-send
1683 * the resolution immediately. try counter is not
1684 * decremented. */
1685 if (res->prefered_query_type == DNS_RTYPE_A) {
1686 res->query_type = DNS_RTYPE_AAAA;
1687 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001688 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001689 else if (res->prefered_query_type == DNS_RTYPE_AAAA) {
1690 res->query_type = DNS_RTYPE_A;
1691 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001692 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001693 }
1694 continue;
1695 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001696
Christopher Faulet67957bd2017-09-27 11:00:59 +02001697 /* Now let's check the query's dname corresponds to the one we
1698 * sent. We can check only the first query of the list. We send
1699 * one query at a time so we get one query in the response */
1700 query = LIST_NEXT(&res->response.query_list, struct dns_query_item *, list);
Olivier Houcharde5188a42020-04-01 18:30:27 +02001701 if (query && dns_hostname_cmp(query->name, res->hostname_dn, res->hostname_dn_len) != 0) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001702 dns_resp = DNS_RESP_WRONG_NAME;
1703 ns->counters.other++;
1704 goto report_res_error;
1705 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001706
Christopher Faulet67957bd2017-09-27 11:00:59 +02001707 /* So the resolution succeeded */
1708 res->status = RSLV_STATUS_VALID;
1709 res->last_valid = now_ms;
1710 ns->counters.valid++;
1711 goto report_res_success;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001712
Christopher Faulet67957bd2017-09-27 11:00:59 +02001713 report_res_error:
1714 list_for_each_entry(req, &res->requesters, list)
1715 req->requester_error_cb(req, dns_resp);
1716 dns_reset_resolution(res);
1717 LIST_DEL(&res->list);
1718 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1719 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001720
Christopher Faulet67957bd2017-09-27 11:00:59 +02001721 report_res_success:
1722 /* Only the 1rst requester s managed by the server, others are
1723 * from the cache */
1724 tmpns = ns;
1725 list_for_each_entry(req, &res->requesters, list) {
Olivier Houchard28381072017-11-06 17:30:28 +01001726 struct server *s = objt_server(req->owner);
1727
1728 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001729 HA_SPIN_LOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001730 req->requester_cb(req, tmpns);
Olivier Houchard28381072017-11-06 17:30:28 +01001731 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001732 HA_SPIN_UNLOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001733 tmpns = NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001734 }
Baptiste Assmann42746372017-05-03 12:12:02 +02001735
Christopher Faulet67957bd2017-09-27 11:00:59 +02001736 dns_reset_resolution(res);
1737 LIST_DEL(&res->list);
1738 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1739 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001740 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001741 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001742 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001743}
William Lallemand69e96442016-11-19 00:58:54 +01001744
Christopher Faulet67957bd2017-09-27 11:00:59 +02001745/* Called when a resolvers network socket is ready to send data */
1746static void dns_resolve_send(struct dgram_conn *dgram)
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001747{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001748 struct dns_resolvers *resolvers;
1749 struct dns_nameserver *ns;
1750 struct dns_resolution *res;
1751 int fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001752
Christopher Faulet67957bd2017-09-27 11:00:59 +02001753 fd = dgram->t.sock.fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001754
Christopher Faulet67957bd2017-09-27 11:00:59 +02001755 /* check if ready for sending */
1756 if (!fd_send_ready(fd))
1757 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001758
Christopher Faulet67957bd2017-09-27 11:00:59 +02001759 /* we don't want/need to be waked up any more for sending */
1760 fd_stop_send(fd);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001761
Christopher Faulet67957bd2017-09-27 11:00:59 +02001762 /* no need to go further if we can't retrieve the nameserver */
1763 if ((ns = dgram->owner) == NULL)
1764 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001765
Christopher Faulet67957bd2017-09-27 11:00:59 +02001766 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001767 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02001768
Christopher Faulet67957bd2017-09-27 11:00:59 +02001769 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001770 int ret, len;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001771
Christopher Faulet67957bd2017-09-27 11:00:59 +02001772 if (res->nb_queries == resolvers->nb_nameservers)
1773 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001774
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001775 len = dns_build_query(res->query_id, res->query_type,
1776 resolvers->accepted_payload_size,
1777 res->hostname_dn, res->hostname_dn_len,
1778 trash.area, trash.size);
1779 if (len == -1)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001780 goto snd_error;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001781
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001782 ret = send(fd, trash.area, len, 0);
1783 if (ret != len)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001784 goto snd_error;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001785
Christopher Faulet67957bd2017-09-27 11:00:59 +02001786 ns->counters.sent++;
1787 res->nb_queries++;
1788 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001789
Christopher Faulet67957bd2017-09-27 11:00:59 +02001790 snd_error:
1791 ns->counters.snd_error++;
1792 res->nb_queries++;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001793 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001794 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001795}
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001796
Christopher Faulet67957bd2017-09-27 11:00:59 +02001797/* Processes DNS resolution. First, it checks the active list to detect expired
1798 * resolutions and retry them if possible. Else a timeout is reported. Then, it
1799 * checks the wait list to trigger new resolutions.
1800 */
Olivier Houchard9f6af332018-05-25 14:04:04 +02001801static struct task *dns_process_resolvers(struct task *t, void *context, unsigned short state)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001802{
Olivier Houchard9f6af332018-05-25 14:04:04 +02001803 struct dns_resolvers *resolvers = context;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001804 struct dns_resolution *res, *resback;
1805 int exp;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001806
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001807 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02001808
Christopher Faulet67957bd2017-09-27 11:00:59 +02001809 /* Handle all expired resolutions from the active list */
1810 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
1811 /* When we find the first resolution in the future, then we can
1812 * stop here */
1813 exp = tick_add(res->last_query, resolvers->timeout.retry);
1814 if (!tick_is_expired(exp, now_ms))
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001815 break;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001816
Christopher Faulet67957bd2017-09-27 11:00:59 +02001817 /* If current resolution has been tried too many times and
1818 * finishes in timeout we update its status and remove it from
1819 * the list */
1820 if (!res->try) {
1821 struct dns_requester *req;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001822
Christopher Faulet67957bd2017-09-27 11:00:59 +02001823 /* Notify the result to the requesters */
1824 if (!res->nb_responses)
1825 res->status = RSLV_STATUS_TIMEOUT;
1826 list_for_each_entry(req, &res->requesters, list)
1827 req->requester_error_cb(req, res->status);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001828
Christopher Faulet67957bd2017-09-27 11:00:59 +02001829 /* Clean up resolution info and remove it from the
1830 * current list */
1831 dns_reset_resolution(res);
1832 LIST_DEL(&res->list);
1833 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
William Lallemand69e96442016-11-19 00:58:54 +01001834 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001835 else {
1836 /* Otherwise resend the DNS query and requeue the resolution */
1837 if (!res->nb_responses || res->prefered_query_type != res->query_type) {
1838 /* No response received (a real timeout) or fallback already done */
1839 res->query_type = res->prefered_query_type;
1840 res->try--;
1841 }
1842 else {
1843 /* Fallback from A to AAAA or the opposite and re-send
1844 * the resolution immediately. try counter is not
1845 * decremented. */
1846 if (res->prefered_query_type == DNS_RTYPE_A)
1847 res->query_type = DNS_RTYPE_AAAA;
1848 else if (res->prefered_query_type == DNS_RTYPE_AAAA)
1849 res->query_type = DNS_RTYPE_A;
1850 else
1851 res->try--;
1852 }
1853 dns_send_query(res);
William Lallemand69e96442016-11-19 00:58:54 +01001854 }
1855 }
William Lallemand69e96442016-11-19 00:58:54 +01001856
Christopher Faulet67957bd2017-09-27 11:00:59 +02001857 /* Handle all resolutions in the wait list */
1858 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
1859 exp = tick_add(res->last_resolution, dns_resolution_timeout(res));
1860 if (tick_isset(res->last_resolution) && !tick_is_expired(exp, now_ms))
1861 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001862
Christopher Faulet67957bd2017-09-27 11:00:59 +02001863 if (dns_run_resolution(res) != 1) {
1864 res->last_resolution = now_ms;
1865 LIST_DEL(&res->list);
1866 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001867 }
1868 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001869
Christopher Faulet67957bd2017-09-27 11:00:59 +02001870 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001871 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001872 return t;
1873}
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001874
Christopher Faulet67957bd2017-09-27 11:00:59 +02001875/* proto_udp callback functions for a DNS resolution */
1876struct dgram_data_cb resolve_dgram_cb = {
1877 .recv = dns_resolve_recv,
1878 .send = dns_resolve_send,
1879};
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001880
Christopher Faulet67957bd2017-09-27 11:00:59 +02001881/* Release memory allocated by DNS */
1882static void dns_deinit(void)
1883{
1884 struct dns_resolvers *resolvers, *resolversback;
1885 struct dns_nameserver *ns, *nsback;
1886 struct dns_resolution *res, *resback;
1887 struct dns_requester *req, *reqback;
1888 struct dns_srvrq *srvrq, *srvrqback;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001889
Christopher Faulet67957bd2017-09-27 11:00:59 +02001890 list_for_each_entry_safe(resolvers, resolversback, &dns_resolvers, list) {
1891 list_for_each_entry_safe(ns, nsback, &resolvers->nameservers, list) {
1892 free(ns->id);
1893 free((char *)ns->conf.file);
1894 if (ns->dgram && ns->dgram->t.sock.fd != -1)
1895 fd_delete(ns->dgram->t.sock.fd);
1896 free(ns->dgram);
1897 LIST_DEL(&ns->list);
1898 free(ns);
1899 }
1900
1901 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
1902 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
1903 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001904 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001905 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001906 dns_free_resolution(res);
1907 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001908
Christopher Faulet67957bd2017-09-27 11:00:59 +02001909 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
1910 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
1911 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001912 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001913 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001914 dns_free_resolution(res);
1915 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001916
Christopher Faulet67957bd2017-09-27 11:00:59 +02001917 free(resolvers->id);
1918 free((char *)resolvers->conf.file);
Olivier Houchard3f795f72019-04-17 22:51:06 +02001919 task_destroy(resolvers->t);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001920 LIST_DEL(&resolvers->list);
1921 free(resolvers);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001922 }
1923
Christopher Faulet67957bd2017-09-27 11:00:59 +02001924 list_for_each_entry_safe(srvrq, srvrqback, &dns_srvrq_list, list) {
1925 free(srvrq->name);
1926 free(srvrq->hostname_dn);
1927 LIST_DEL(&srvrq->list);
1928 free(srvrq);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001929 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001930}
1931
Christopher Faulet67957bd2017-09-27 11:00:59 +02001932/* Finalizes the DNS configuration by allocating required resources and checking
1933 * live parameters.
1934 * Returns 0 on success, ERR_* flags otherwise.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001935 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001936static int dns_finalize_config(void)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001937{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001938 struct dns_resolvers *resolvers;
1939 struct proxy *px;
1940 int err_code = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001941
Christopher Faulet67957bd2017-09-27 11:00:59 +02001942 /* allocate pool of resolution per resolvers */
1943 list_for_each_entry(resolvers, &dns_resolvers, list) {
1944 struct dns_nameserver *ns;
1945 struct task *t;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001946
Christopher Faulet67957bd2017-09-27 11:00:59 +02001947 /* Check if we can create the socket with nameservers info */
1948 list_for_each_entry(ns, &resolvers->nameservers, list) {
1949 struct dgram_conn *dgram = NULL;
1950 int fd;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001951
Christopher Faulet67957bd2017-09-27 11:00:59 +02001952 /* Check nameserver info */
1953 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001954 ha_alert("config : resolvers '%s': can't create socket for nameserver '%s'.\n",
1955 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001956 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001957 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001958 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001959 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001960 ha_alert("config : resolvers '%s': can't connect socket for nameserver '%s'.\n",
1961 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001962 close(fd);
1963 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001964 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001965 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001966 close(fd);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001967
Christopher Faulet67957bd2017-09-27 11:00:59 +02001968 /* Create dgram structure that will hold the UPD socket
1969 * and attach it on the current nameserver */
1970 if ((dgram = calloc(1, sizeof(*dgram))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001971 ha_alert("config: resolvers '%s' : out of memory.\n",
1972 resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001973 err_code |= (ERR_ALERT|ERR_ABORT);
1974 goto err;
1975 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001976
Christopher Faulet67957bd2017-09-27 11:00:59 +02001977 /* Leave dgram partially initialized, no FD attached for
1978 * now. */
1979 dgram->owner = ns;
1980 dgram->data = &resolve_dgram_cb;
1981 dgram->t.sock.fd = -1;
1982 ns->dgram = dgram;
1983 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001984
Christopher Faulet67957bd2017-09-27 11:00:59 +02001985 /* Create the task associated to the resolvers section */
Emeric Brunc60def82017-09-27 14:59:38 +02001986 if ((t = task_new(MAX_THREADS_MASK)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001987 ha_alert("config : resolvers '%s' : out of memory.\n", resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001988 err_code |= (ERR_ALERT|ERR_ABORT);
1989 goto err;
1990 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001991
Christopher Faulet67957bd2017-09-27 11:00:59 +02001992 /* Update task's parameters */
1993 t->process = dns_process_resolvers;
1994 t->context = resolvers;
1995 resolvers->t = t;
1996 task_wakeup(t, TASK_WOKEN_INIT);
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001997 }
1998
Olivier Houchardfbc74e82017-11-24 16:54:05 +01001999 for (px = proxies_list; px; px = px->next) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002000 struct server *srv;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002001
Christopher Faulet67957bd2017-09-27 11:00:59 +02002002 for (srv = px->srv; srv; srv = srv->next) {
2003 struct dns_resolvers *resolvers;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002004
Christopher Faulet67957bd2017-09-27 11:00:59 +02002005 if (!srv->resolvers_id)
2006 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002007
Christopher Faulet67957bd2017-09-27 11:00:59 +02002008 if ((resolvers = find_resolvers_by_id(srv->resolvers_id)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002009 ha_alert("config : %s '%s', server '%s': unable to find required resolvers '%s'\n",
2010 proxy_type_str(px), px->id, srv->id, srv->resolvers_id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002011 err_code |= (ERR_ALERT|ERR_ABORT);
2012 continue;
2013 }
2014 srv->resolvers = resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002015
Christopher Faulet67957bd2017-09-27 11:00:59 +02002016 if (srv->srvrq && !srv->srvrq->resolvers) {
2017 srv->srvrq->resolvers = srv->resolvers;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01002018 if (dns_link_resolution(srv->srvrq, OBJ_TYPE_SRVRQ, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002019 ha_alert("config : %s '%s' : unable to set DNS resolution for server '%s'.\n",
2020 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002021 err_code |= (ERR_ALERT|ERR_ABORT);
2022 continue;
2023 }
2024 }
Olivier Houchard55dcdf42017-11-06 15:15:04 +01002025 if (dns_link_resolution(srv, OBJ_TYPE_SERVER, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002026 ha_alert("config : %s '%s', unable to set DNS resolution for server '%s'.\n",
2027 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002028 err_code |= (ERR_ALERT|ERR_ABORT);
2029 continue;
2030 }
2031 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002032 }
2033
Christopher Faulet67957bd2017-09-27 11:00:59 +02002034 if (err_code & (ERR_ALERT|ERR_ABORT))
2035 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002036
Christopher Faulet67957bd2017-09-27 11:00:59 +02002037 return err_code;
2038 err:
2039 dns_deinit();
2040 return err_code;
2041
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002042}
2043
Christopher Faulet67957bd2017-09-27 11:00:59 +02002044/* if an arg is found, it sets the resolvers section pointer into cli.p0 */
Aurélien Nephtaliabbf6072018-04-18 13:26:46 +02002045static int cli_parse_stat_resolvers(char **args, char *payload, struct appctx *appctx, void *private)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002046{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002047 struct dns_resolvers *presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002048
Christopher Faulet67957bd2017-09-27 11:00:59 +02002049 if (*args[2]) {
2050 list_for_each_entry(presolvers, &dns_resolvers, list) {
2051 if (strcmp(presolvers->id, args[2]) == 0) {
2052 appctx->ctx.cli.p0 = presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002053 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002054 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002055 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002056 if (appctx->ctx.cli.p0 == NULL) {
2057 appctx->ctx.cli.severity = LOG_ERR;
2058 appctx->ctx.cli.msg = "Can't find that resolvers section\n";
2059 appctx->st0 = CLI_ST_PRINT;
2060 return 1;
2061 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002062 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002063 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002064}
2065
Christopher Faulet67957bd2017-09-27 11:00:59 +02002066/* Dumps counters from all resolvers section and associated name servers. It
2067 * returns 0 if the output buffer is full and it needs to be called again,
2068 * otherwise non-zero. It may limit itself to the resolver pointed to by
Willy Tarreau777b5602016-12-16 18:06:26 +01002069 * <cli.p0> if it's not null.
William Lallemand69e96442016-11-19 00:58:54 +01002070 */
2071static int cli_io_handler_dump_resolvers_to_buffer(struct appctx *appctx)
2072{
2073 struct stream_interface *si = appctx->owner;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002074 struct dns_resolvers *resolvers;
2075 struct dns_nameserver *ns;
William Lallemand69e96442016-11-19 00:58:54 +01002076
2077 chunk_reset(&trash);
2078
2079 switch (appctx->st2) {
2080 case STAT_ST_INIT:
2081 appctx->st2 = STAT_ST_LIST; /* let's start producing data */
2082 /* fall through */
2083
2084 case STAT_ST_LIST:
2085 if (LIST_ISEMPTY(&dns_resolvers)) {
2086 chunk_appendf(&trash, "No resolvers found\n");
2087 }
2088 else {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002089 list_for_each_entry(resolvers, &dns_resolvers, list) {
2090 if (appctx->ctx.cli.p0 != NULL && appctx->ctx.cli.p0 != resolvers)
William Lallemand69e96442016-11-19 00:58:54 +01002091 continue;
2092
Christopher Faulet67957bd2017-09-27 11:00:59 +02002093 chunk_appendf(&trash, "Resolvers section %s\n", resolvers->id);
2094 list_for_each_entry(ns, &resolvers->nameservers, list) {
2095 chunk_appendf(&trash, " nameserver %s:\n", ns->id);
2096 chunk_appendf(&trash, " sent: %lld\n", ns->counters.sent);
2097 chunk_appendf(&trash, " snd_error: %lld\n", ns->counters.snd_error);
2098 chunk_appendf(&trash, " valid: %lld\n", ns->counters.valid);
2099 chunk_appendf(&trash, " update: %lld\n", ns->counters.update);
2100 chunk_appendf(&trash, " cname: %lld\n", ns->counters.cname);
2101 chunk_appendf(&trash, " cname_error: %lld\n", ns->counters.cname_error);
2102 chunk_appendf(&trash, " any_err: %lld\n", ns->counters.any_err);
2103 chunk_appendf(&trash, " nx: %lld\n", ns->counters.nx);
2104 chunk_appendf(&trash, " timeout: %lld\n", ns->counters.timeout);
2105 chunk_appendf(&trash, " refused: %lld\n", ns->counters.refused);
2106 chunk_appendf(&trash, " other: %lld\n", ns->counters.other);
2107 chunk_appendf(&trash, " invalid: %lld\n", ns->counters.invalid);
2108 chunk_appendf(&trash, " too_big: %lld\n", ns->counters.too_big);
2109 chunk_appendf(&trash, " truncated: %lld\n", ns->counters.truncated);
2110 chunk_appendf(&trash, " outdated: %lld\n", ns->counters.outdated);
William Lallemand69e96442016-11-19 00:58:54 +01002111 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002112 chunk_appendf(&trash, "\n");
William Lallemand69e96442016-11-19 00:58:54 +01002113 }
2114 }
2115
2116 /* display response */
Willy Tarreau06d80a92017-10-19 14:32:15 +02002117 if (ci_putchk(si_ic(si), &trash) == -1) {
William Lallemand69e96442016-11-19 00:58:54 +01002118 /* let's try again later from this session. We add ourselves into
2119 * this session's users so that it can remove us upon termination.
2120 */
Willy Tarreaudb398432018-11-15 11:08:52 +01002121 si_rx_room_blk(si);
William Lallemand69e96442016-11-19 00:58:54 +01002122 return 0;
2123 }
William Lallemand69e96442016-11-19 00:58:54 +01002124 /* fall through */
2125
2126 default:
2127 appctx->st2 = STAT_ST_FIN;
2128 return 1;
2129 }
2130}
2131
2132/* register cli keywords */
Christopher Fauletff88efb2017-10-03 16:00:57 +02002133static struct cli_kw_list cli_kws = {{ }, {
2134 { { "show", "resolvers", NULL }, "show resolvers [id]: dumps counters from all resolvers section and\n"
2135 " associated name servers",
2136 cli_parse_stat_resolvers, cli_io_handler_dump_resolvers_to_buffer },
2137 {{},}
2138 }
2139};
William Lallemand69e96442016-11-19 00:58:54 +01002140
Willy Tarreau0108d902018-11-25 19:14:37 +01002141INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
William Lallemand69e96442016-11-19 00:58:54 +01002142
Baptiste Assmann333939c2019-01-21 08:34:50 +01002143/*
2144 * Prepare <rule> for hostname resolution.
2145 * Returns -1 in case of any allocation failure, 0 if not.
2146 * On error, a global failure counter is also incremented.
2147 */
2148static int action_prepare_for_resolution(struct stream *stream, const char *hostname)
2149{
2150 char *hostname_dn;
2151 int hostname_len, hostname_dn_len;
2152 struct buffer *tmp = get_trash_chunk();
2153
2154 if (!hostname)
2155 return 0;
2156
2157 hostname_len = strlen(hostname);
2158 hostname_dn = tmp->area;
2159 hostname_dn_len = dns_str_to_dn_label(hostname, hostname_len + 1,
2160 hostname_dn, tmp->size);
2161 if (hostname_dn_len == -1)
2162 goto err;
2163
2164
2165 stream->dns_ctx.hostname_dn = strdup(hostname_dn);
2166 stream->dns_ctx.hostname_dn_len = hostname_dn_len;
2167 if (!stream->dns_ctx.hostname_dn)
2168 goto err;
2169
2170 return 0;
2171
2172 err:
2173 free(stream->dns_ctx.hostname_dn); stream->dns_ctx.hostname_dn = NULL;
2174 dns_failed_resolutions += 1;
2175 return -1;
2176}
2177
2178
2179/*
2180 * Execute the "do-resolution" action. May be called from {tcp,http}request.
2181 */
2182enum act_return dns_action_do_resolve(struct act_rule *rule, struct proxy *px,
2183 struct session *sess, struct stream *s, int flags)
2184{
Baptiste Assmann333939c2019-01-21 08:34:50 +01002185 struct dns_resolution *resolution;
Willy Tarreau85835ee2019-07-17 10:38:45 +02002186 struct sample *smp;
2187 char *fqdn;
Baptiste Assmann44af0d02019-10-30 16:06:53 +01002188 struct dns_requester *req;
2189 struct dns_resolvers *resolvers;
2190 struct dns_resolution *res;
Christopher Fauletef131ae2020-07-22 11:46:32 +02002191 int exp, locked = 0;
2192 enum act_return ret = ACT_RET_CONT;
2193
2194 resolvers = rule->arg.dns.resolvers;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002195
2196 /* we have a response to our DNS resolution */
Baptiste Assmann44af0d02019-10-30 16:06:53 +01002197 use_cache:
Baptiste Assmann333939c2019-01-21 08:34:50 +01002198 if (s->dns_ctx.dns_requester && s->dns_ctx.dns_requester->resolution != NULL) {
2199 resolution = s->dns_ctx.dns_requester->resolution;
Christopher Fauletef131ae2020-07-22 11:46:32 +02002200 if (!locked) {
2201 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
2202 locked = 1;
2203 }
2204
Christopher Faulet74d704f2020-07-28 10:21:54 +02002205 if (resolution->step == RSLV_STEP_RUNNING)
2206 goto yield;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002207 if (resolution->step == RSLV_STEP_NONE) {
2208 /* We update the variable only if we have a valid response. */
2209 if (resolution->status == RSLV_STATUS_VALID) {
2210 struct sample smp;
2211 short ip_sin_family = 0;
2212 void *ip = NULL;
2213
2214 dns_get_ip_from_response(&resolution->response, &rule->arg.dns.dns_opts, NULL,
2215 0, &ip, &ip_sin_family, NULL);
2216
2217 switch (ip_sin_family) {
2218 case AF_INET:
2219 smp.data.type = SMP_T_IPV4;
2220 memcpy(&smp.data.u.ipv4, ip, 4);
2221 break;
2222 case AF_INET6:
2223 smp.data.type = SMP_T_IPV6;
2224 memcpy(&smp.data.u.ipv6, ip, 16);
2225 break;
2226 default:
2227 ip = NULL;
2228 }
2229
2230 if (ip) {
2231 smp.px = px;
2232 smp.sess = sess;
2233 smp.strm = s;
2234
2235 vars_set_by_name(rule->arg.dns.varname, strlen(rule->arg.dns.varname), &smp);
2236 }
2237 }
2238 }
2239
Christopher Faulet74d704f2020-07-28 10:21:54 +02002240 goto release_requester;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002241 }
2242
2243 /* need to configure and start a new DNS resolution */
Willy Tarreau85835ee2019-07-17 10:38:45 +02002244 smp = sample_fetch_as_type(px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.dns.expr, SMP_T_STR);
2245 if (smp == NULL)
Christopher Fauletef131ae2020-07-22 11:46:32 +02002246 goto end;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002247
Willy Tarreau85835ee2019-07-17 10:38:45 +02002248 fqdn = smp->data.u.str.area;
2249 if (action_prepare_for_resolution(s, fqdn) == -1)
Christopher Fauletef131ae2020-07-22 11:46:32 +02002250 goto end; /* on error, ignore the action */
Baptiste Assmann333939c2019-01-21 08:34:50 +01002251
Willy Tarreau85835ee2019-07-17 10:38:45 +02002252 s->dns_ctx.parent = rule;
Christopher Fauletef131ae2020-07-22 11:46:32 +02002253
2254 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
2255 locked = 1;
2256
Willy Tarreau85835ee2019-07-17 10:38:45 +02002257 dns_link_resolution(s, OBJ_TYPE_STREAM, 0);
Baptiste Assmann44af0d02019-10-30 16:06:53 +01002258
2259 /* Check if there is a fresh enough response in the cache of our associated resolution */
2260 req = s->dns_ctx.dns_requester;
Christopher Faulet74d704f2020-07-28 10:21:54 +02002261 if (!req || !req->resolution)
2262 goto release_requester; /* on error, ignore the action */
Christopher Fauletef131ae2020-07-22 11:46:32 +02002263 res = req->resolution;
Baptiste Assmann44af0d02019-10-30 16:06:53 +01002264
2265 exp = tick_add(res->last_resolution, resolvers->hold.valid);
2266 if (resolvers->t && res->status == RSLV_STATUS_VALID && tick_isset(res->last_resolution)
Christopher Faulet74d704f2020-07-28 10:21:54 +02002267 && !tick_is_expired(exp, now_ms)) {
Baptiste Assmann44af0d02019-10-30 16:06:53 +01002268 goto use_cache;
2269 }
2270
Willy Tarreau85835ee2019-07-17 10:38:45 +02002271 dns_trigger_resolution(s->dns_ctx.dns_requester);
Christopher Faulet74d704f2020-07-28 10:21:54 +02002272
2273 yield:
2274 if (flags & ACT_FLAG_FINAL)
2275 goto release_requester;
Christopher Fauletef131ae2020-07-22 11:46:32 +02002276 ret = ACT_RET_YIELD;
2277
2278 end:
2279 if (locked)
2280 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
2281 return ret;
Christopher Faulet74d704f2020-07-28 10:21:54 +02002282
2283 release_requester:
2284 free(s->dns_ctx.hostname_dn);
2285 s->dns_ctx.hostname_dn = NULL;
2286 s->dns_ctx.hostname_dn_len = 0;
2287 if (s->dns_ctx.dns_requester) {
2288 dns_unlink_resolution(s->dns_ctx.dns_requester);
2289 pool_free(dns_requester_pool, s->dns_ctx.dns_requester);
2290 s->dns_ctx.dns_requester = NULL;
2291 }
2292 goto end;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002293}
2294
2295
2296/* parse "do-resolve" action
2297 * This action takes the following arguments:
2298 * do-resolve(<varName>,<resolversSectionName>,<resolvePrefer>) <expr>
2299 *
2300 * - <varName> is the variable name where the result of the DNS resolution will be stored
2301 * (mandatory)
2302 * - <resolversSectionName> is the name of the resolvers section to use to perform the resolution
2303 * (mandatory)
2304 * - <resolvePrefer> can be either 'ipv4' or 'ipv6' and is the IP family we would like to resolve first
2305 * (optional), defaults to ipv6
2306 * - <expr> is an HAProxy expression used to fetch the name to be resolved
2307 */
2308enum act_parse_ret dns_parse_do_resolve(const char **args, int *orig_arg, struct proxy *px, struct act_rule *rule, char **err)
2309{
2310 int cur_arg;
2311 struct sample_expr *expr;
2312 unsigned int where;
2313 const char *beg, *end;
2314
2315 /* orig_arg points to the first argument, but we need to analyse the command itself first */
2316 cur_arg = *orig_arg - 1;
2317
2318 /* locate varName, which is mandatory */
2319 beg = strchr(args[cur_arg], '(');
2320 if (beg == NULL)
2321 goto do_resolve_parse_error;
2322 beg = beg + 1; /* beg should points to the first character after opening parenthesis '(' */
2323 end = strchr(beg, ',');
2324 if (end == NULL)
2325 goto do_resolve_parse_error;
2326 rule->arg.dns.varname = my_strndup(beg, end - beg);
2327 if (rule->arg.dns.varname == NULL)
2328 goto do_resolve_parse_error;
2329
2330
2331 /* locate resolversSectionName, which is mandatory.
2332 * Since next parameters are optional, the delimiter may be comma ','
2333 * or closing parenthesis ')'
2334 */
2335 beg = end + 1;
2336 end = strchr(beg, ',');
2337 if (end == NULL)
2338 end = strchr(beg, ')');
2339 if (end == NULL)
2340 goto do_resolve_parse_error;
2341 rule->arg.dns.resolvers_id = my_strndup(beg, end - beg);
2342 if (rule->arg.dns.resolvers_id == NULL)
2343 goto do_resolve_parse_error;
2344
2345
2346 /* Default priority is ipv6 */
2347 rule->arg.dns.dns_opts.family_prio = AF_INET6;
2348
2349 /* optional arguments accepted for now:
2350 * ipv4 or ipv6
2351 */
2352 while (*end != ')') {
2353 beg = end + 1;
2354 end = strchr(beg, ',');
2355 if (end == NULL)
2356 end = strchr(beg, ')');
2357 if (end == NULL)
2358 goto do_resolve_parse_error;
2359
2360 if (strncmp(beg, "ipv4", end - beg) == 0) {
2361 rule->arg.dns.dns_opts.family_prio = AF_INET;
2362 }
2363 else if (strncmp(beg, "ipv6", end - beg) == 0) {
2364 rule->arg.dns.dns_opts.family_prio = AF_INET6;
2365 }
2366 else {
2367 goto do_resolve_parse_error;
2368 }
2369 }
2370
2371 cur_arg = cur_arg + 1;
2372
2373 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args);
2374 if (!expr)
2375 goto do_resolve_parse_error;
2376
2377
2378 where = 0;
2379 if (px->cap & PR_CAP_FE)
2380 where |= SMP_VAL_FE_HRQ_HDR;
2381 if (px->cap & PR_CAP_BE)
2382 where |= SMP_VAL_BE_HRQ_HDR;
2383
2384 if (!(expr->fetch->val & where)) {
2385 memprintf(err,
2386 "fetch method '%s' extracts information from '%s', none of which is available here",
2387 args[cur_arg-1], sample_src_names(expr->fetch->use));
2388 free(expr);
2389 return ACT_RET_PRS_ERR;
2390 }
2391 rule->arg.dns.expr = expr;
2392 rule->action = ACT_CUSTOM;
2393 rule->action_ptr = dns_action_do_resolve;
2394 *orig_arg = cur_arg;
2395
2396 rule->check_ptr = check_action_do_resolve;
2397
2398 return ACT_RET_PRS_OK;
2399
2400 do_resolve_parse_error:
2401 free(rule->arg.dns.varname); rule->arg.dns.varname = NULL;
2402 free(rule->arg.dns.resolvers_id); rule->arg.dns.resolvers_id = NULL;
2403 memprintf(err, "Can't parse '%s'. Expects 'do-resolve(<varname>,<resolvers>[,<options>]) <expr>'. Available options are 'ipv4' and 'ipv6'",
2404 args[cur_arg]);
2405 return ACT_RET_PRS_ERR;
2406}
2407
2408static struct action_kw_list http_req_kws = { { }, {
2409 { "do-resolve", dns_parse_do_resolve, 1 },
2410 { /* END */ }
2411}};
2412
2413INITCALL1(STG_REGISTER, http_req_keywords_register, &http_req_kws);
2414
2415static struct action_kw_list tcp_req_cont_actions = {ILH, {
2416 { "do-resolve", dns_parse_do_resolve, 1 },
2417 { /* END */ }
2418}};
2419
2420INITCALL1(STG_REGISTER, tcp_req_cont_keywords_register, &tcp_req_cont_actions);
2421
2422/* Check an "http-request do-resolve" action.
2423 *
2424 * The function returns 1 in success case, otherwise, it returns 0 and err is
2425 * filled.
2426 */
2427int check_action_do_resolve(struct act_rule *rule, struct proxy *px, char **err)
2428{
2429 struct dns_resolvers *resolvers = NULL;
2430
2431 if (rule->arg.dns.resolvers_id == NULL) {
2432 memprintf(err,"Proxy '%s': %s", px->id, "do-resolve action without resolvers");
2433 return 0;
2434 }
2435
2436 resolvers = find_resolvers_by_id(rule->arg.dns.resolvers_id);
2437 if (resolvers == NULL) {
2438 memprintf(err,"Can't find resolvers section '%s' for do-resolve action", rule->arg.dns.resolvers_id);
2439 return 0;
2440 }
2441 rule->arg.dns.resolvers = resolvers;
2442
2443 return 1;
2444}
2445
Willy Tarreau172f5ce2018-11-26 11:21:50 +01002446REGISTER_POST_DEINIT(dns_deinit);
Willy Tarreaue6552512018-11-26 11:33:13 +01002447REGISTER_CONFIG_POSTPARSER("dns runtime resolver", dns_finalize_config);