blob: 5bce18b030a2bdd18403b357cc9e8aec795ff7d2 [file] [log] [blame]
Baptiste Assmann325137d2015-04-13 23:40:55 +02001/*
2 * Name server resolution
3 *
4 * Copyright 2014 Baptiste Assmann <bedis9@gmail.com>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <errno.h>
14#include <fcntl.h>
15#include <stdio.h>
16#include <stdlib.h>
17#include <string.h>
18#include <unistd.h>
19
20#include <sys/types.h>
21
Baptiste Assmann044fd5b2018-08-10 10:56:38 +020022#include <common/cfgparse.h>
Christopher Faulet67957bd2017-09-27 11:00:59 +020023#include <common/errors.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020024#include <common/time.h>
25#include <common/ticks.h>
Olivier Houchard8da5f982017-08-04 18:35:36 +020026#include <common/net_helper.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020027
William Lallemand69e96442016-11-19 00:58:54 +010028#include <types/applet.h>
29#include <types/cli.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020030#include <types/global.h>
31#include <types/dns.h>
William Lallemand69e96442016-11-19 00:58:54 +010032#include <types/stats.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020033
William Lallemand69e96442016-11-19 00:58:54 +010034#include <proto/channel.h>
35#include <proto/cli.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020036#include <proto/checks.h>
37#include <proto/dns.h>
38#include <proto/fd.h>
39#include <proto/log.h>
40#include <proto/server.h>
41#include <proto/task.h>
42#include <proto/proto_udp.h>
Christopher Faulet67957bd2017-09-27 11:00:59 +020043#include <proto/proxy.h>
William Lallemand69e96442016-11-19 00:58:54 +010044#include <proto/stream_interface.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020045
Christopher Faulet67957bd2017-09-27 11:00:59 +020046struct list dns_resolvers = LIST_HEAD_INIT(dns_resolvers);
47struct list dns_srvrq_list = LIST_HEAD_INIT(dns_srvrq_list);
Baptiste Assmann325137d2015-04-13 23:40:55 +020048
Christopher Fauletb2812a62017-10-04 16:17:58 +020049static THREAD_LOCAL int64_t dns_query_id_seed = 0; /* random seed */
Christopher Faulet67957bd2017-09-27 11:00:59 +020050static struct pool_head *dns_answer_item_pool = NULL;
51static struct pool_head *dns_resolution_pool = NULL;
52static unsigned int resolution_uuid = 1;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020053
Christopher Faulet67957bd2017-09-27 11:00:59 +020054/* Returns a pointer to the resolvers matching the id <id>. NULL is returned if
55 * no match is found.
Baptiste Assmann325137d2015-04-13 23:40:55 +020056 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020057struct dns_resolvers *find_resolvers_by_id(const char *id)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020058{
Christopher Faulet67957bd2017-09-27 11:00:59 +020059 struct dns_resolvers *res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020060
Christopher Faulet67957bd2017-09-27 11:00:59 +020061 list_for_each_entry(res, &dns_resolvers, list) {
62 if (!strcmp(res->id, id))
63 return res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020064 }
Christopher Faulet67957bd2017-09-27 11:00:59 +020065 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020066}
67
Christopher Faulet67957bd2017-09-27 11:00:59 +020068/* Returns a pointer on the SRV request matching the name <name> for the proxy
69 * <px>. NULL is returned if no match is found.
Baptiste Assmann201c07f2017-05-22 15:17:15 +020070 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020071struct dns_srvrq *find_srvrq_by_name(const char *name, struct proxy *px)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020072{
Christopher Faulet67957bd2017-09-27 11:00:59 +020073 struct dns_srvrq *srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020074
Christopher Faulet67957bd2017-09-27 11:00:59 +020075 list_for_each_entry(srvrq, &dns_srvrq_list, list) {
76 if (srvrq->proxy == px && !strcmp(srvrq->name, name))
77 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020078 }
Christopher Faulet67957bd2017-09-27 11:00:59 +020079 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020080}
81
Christopher Faulet67957bd2017-09-27 11:00:59 +020082/* Allocates a new SRVRQ for the given server with the name <fqdn>. It returns
83 * NULL if an error occurred. */
84struct dns_srvrq *new_dns_srvrq(struct server *srv, char *fqdn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020085{
Christopher Faulet67957bd2017-09-27 11:00:59 +020086 struct proxy *px = srv->proxy;
87 struct dns_srvrq *srvrq = NULL;
88 int fqdn_len, hostname_dn_len;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020089
Christopher Faulet67957bd2017-09-27 11:00:59 +020090 fqdn_len = strlen(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +020091 hostname_dn_len = dns_str_to_dn_label(fqdn, fqdn_len + 1, trash.area,
92 trash.size);
Christopher Faulet67957bd2017-09-27 11:00:59 +020093 if (hostname_dn_len == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +010094 ha_alert("config : %s '%s', server '%s': failed to parse FQDN '%s'\n",
95 proxy_type_str(px), px->id, srv->id, fqdn);
Christopher Faulet67957bd2017-09-27 11:00:59 +020096 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020097 }
98
Christopher Faulet67957bd2017-09-27 11:00:59 +020099 if ((srvrq = calloc(1, sizeof(*srvrq))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100100 ha_alert("config : %s '%s', server '%s': out of memory\n",
101 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200102 goto err;
103 }
104 srvrq->obj_type = OBJ_TYPE_SRVRQ;
105 srvrq->proxy = px;
106 srvrq->name = strdup(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200107 srvrq->hostname_dn = strdup(trash.area);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200108 srvrq->hostname_dn_len = hostname_dn_len;
109 if (!srvrq->name || !srvrq->hostname_dn) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100110 ha_alert("config : %s '%s', server '%s': out of memory\n",
111 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200112 goto err;
113 }
114 LIST_ADDQ(&dns_srvrq_list, &srvrq->list);
115 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200116
Christopher Faulet67957bd2017-09-27 11:00:59 +0200117 err:
118 if (srvrq) {
119 free(srvrq->name);
120 free(srvrq->hostname_dn);
121 free(srvrq);
122 }
123 return NULL;
124}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200125
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200126
Christopher Faulet67957bd2017-09-27 11:00:59 +0200127/* 2 bytes random generator to generate DNS query ID */
128static inline uint16_t dns_rnd16(void)
129{
Christopher Fauletb2812a62017-10-04 16:17:58 +0200130 if (!dns_query_id_seed)
131 dns_query_id_seed = now_ms;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200132 dns_query_id_seed ^= dns_query_id_seed << 13;
133 dns_query_id_seed ^= dns_query_id_seed >> 7;
134 dns_query_id_seed ^= dns_query_id_seed << 17;
135 return dns_query_id_seed;
136}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200137
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200138
Christopher Faulet67957bd2017-09-27 11:00:59 +0200139static inline int dns_resolution_timeout(struct dns_resolution *res)
140{
141 switch (res->status) {
142 case RSLV_STATUS_VALID: return res->resolvers->hold.valid;
143 default: return res->resolvers->timeout.resolve;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200144 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200145}
146
Christopher Faulet67957bd2017-09-27 11:00:59 +0200147/* Updates a resolvers' task timeout for next wake up and queue it */
148static void dns_update_resolvers_timeout(struct dns_resolvers *resolvers)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200149{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200150 struct dns_resolution *res;
151 int next;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200152
Christopher Faulet67957bd2017-09-27 11:00:59 +0200153 next = tick_add(now_ms, resolvers->timeout.resolve);
154 if (!LIST_ISEMPTY(&resolvers->resolutions.curr)) {
155 res = LIST_NEXT(&resolvers->resolutions.curr, struct dns_resolution *, list);
156 next = MIN(next, tick_add(res->last_query, resolvers->timeout.retry));
157 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200158
Christopher Faulet67957bd2017-09-27 11:00:59 +0200159 list_for_each_entry(res, &resolvers->resolutions.wait, list)
160 next = MIN(next, tick_add(res->last_resolution, dns_resolution_timeout(res)));
Baptiste Assmann325137d2015-04-13 23:40:55 +0200161
Christopher Faulet67957bd2017-09-27 11:00:59 +0200162 resolvers->t->expire = next;
163 task_queue(resolvers->t);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200164}
165
Christopher Faulet67957bd2017-09-27 11:00:59 +0200166/* Opens an UDP socket on the namesaver's IP/Port, if required. Returns 0 on
167 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200168 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200169static int dns_connect_namesaver(struct dns_nameserver *ns)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200170{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200171 struct dgram_conn *dgram = ns->dgram;
172 int fd;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200173
Christopher Faulet67957bd2017-09-27 11:00:59 +0200174 /* Already connected */
175 if (dgram->t.sock.fd != -1)
176 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200177
Christopher Faulet67957bd2017-09-27 11:00:59 +0200178 /* Create an UDP socket and connect it on the nameserver's IP/Port */
179 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
180 send_log(NULL, LOG_WARNING,
181 "DNS : resolvers '%s': can't create socket for nameserver '%s'.\n",
182 ns->resolvers->id, ns->id);
183 return -1;
184 }
185 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
186 send_log(NULL, LOG_WARNING,
187 "DNS : resolvers '%s': can't connect socket for nameserver '%s'.\n",
188 ns->resolvers->id, ns->id);
189 close(fd);
190 return -1;
191 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200192
Christopher Faulet67957bd2017-09-27 11:00:59 +0200193 /* Make the socket non blocking */
194 fcntl(fd, F_SETFL, O_NONBLOCK);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200195
Christopher Faulet67957bd2017-09-27 11:00:59 +0200196 /* Add the fd in the fd list and update its parameters */
197 dgram->t.sock.fd = fd;
Willy Tarreaua9786b62018-01-25 07:22:13 +0100198 fd_insert(fd, dgram, dgram_fd_handler, MAX_THREADS_MASK);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200199 fd_want_recv(fd);
200 return 0;
201}
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200202
Christopher Faulet67957bd2017-09-27 11:00:59 +0200203/* Forges a DNS query. It needs the following information from the caller:
204 * - <query_id> : the DNS query id corresponding to this query
205 * - <query_type> : DNS_RTYPE_* request DNS record type (A, AAAA, ANY...)
206 * - <hostname_dn> : hostname in domain name format
207 * - <hostname_dn_len> : length of <hostname_dn>
208 *
209 * To store the query, the caller must pass a buffer <buf> and its size
210 * <bufsize>. It returns the number of written bytes in success, -1 if <buf> is
211 * too short.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200212 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200213static int dns_build_query(int query_id, int query_type, unsigned int accepted_payload_size,
214 char *hostname_dn, int hostname_dn_len, char *buf, int bufsize)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200215{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200216 struct dns_header dns_hdr;
217 struct dns_question qinfo;
218 struct dns_additional_record edns;
219 char *p = buf;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200220
Christopher Faulet67957bd2017-09-27 11:00:59 +0200221 if (sizeof(dns_hdr) + sizeof(qinfo) + sizeof(edns) + hostname_dn_len >= bufsize)
222 return -1;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200223
Christopher Faulet67957bd2017-09-27 11:00:59 +0200224 memset(buf, 0, bufsize);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200225
Christopher Faulet67957bd2017-09-27 11:00:59 +0200226 /* Set dns query headers */
227 dns_hdr.id = (unsigned short) htons(query_id);
228 dns_hdr.flags = htons(0x0100); /* qr=0, opcode=0, aa=0, tc=0, rd=1, ra=0, z=0, rcode=0 */
229 dns_hdr.qdcount = htons(1); /* 1 question */
230 dns_hdr.ancount = 0;
231 dns_hdr.nscount = 0;
232 dns_hdr.arcount = htons(1);
233 memcpy(p, &dns_hdr, sizeof(dns_hdr));
234 p += sizeof(dns_hdr);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200235
Christopher Faulet67957bd2017-09-27 11:00:59 +0200236 /* Set up query hostname */
237 memcpy(p, hostname_dn, hostname_dn_len);
238 p += hostname_dn_len;
239 *p++ = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200240
Christopher Faulet67957bd2017-09-27 11:00:59 +0200241 /* Set up query info (type and class) */
242 qinfo.qtype = htons(query_type);
243 qinfo.qclass = htons(DNS_RCLASS_IN);
244 memcpy(p, &qinfo, sizeof(qinfo));
245 p += sizeof(qinfo);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200246
Christopher Faulet67957bd2017-09-27 11:00:59 +0200247 /* Set the DNS extension */
248 edns.name = 0;
249 edns.type = htons(DNS_RTYPE_OPT);
250 edns.udp_payload_size = htons(accepted_payload_size);
251 edns.extension = 0;
252 edns.data_length = 0;
253 memcpy(p, &edns, sizeof(edns));
254 p += sizeof(edns);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200255
Christopher Faulet67957bd2017-09-27 11:00:59 +0200256 return (p - buf);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200257}
258
Christopher Faulet67957bd2017-09-27 11:00:59 +0200259/* Sends a DNS query to resolvers associated to a resolution. It returns 0 on
260 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200261 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200262static int dns_send_query(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200263{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200264 struct dns_resolvers *resolvers = resolution->resolvers;
265 struct dns_nameserver *ns;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200266
Christopher Faulet67957bd2017-09-27 11:00:59 +0200267 list_for_each_entry(ns, &resolvers->nameservers, list) {
268 int fd = ns->dgram->t.sock.fd;
269 if (fd == -1) {
270 if (dns_connect_namesaver(ns) == -1)
271 continue;
272 fd = ns->dgram->t.sock.fd;
273 resolvers->nb_nameservers++;
274 }
275 fd_want_send(fd);
276 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200277
Christopher Faulet67957bd2017-09-27 11:00:59 +0200278 /* Update resolution */
279 resolution->nb_queries = 0;
280 resolution->nb_responses = 0;
281 resolution->last_query = now_ms;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200282
Christopher Faulet67957bd2017-09-27 11:00:59 +0200283 /* Push the resolution at the end of the active list */
284 LIST_DEL(&resolution->list);
285 LIST_ADDQ(&resolvers->resolutions.curr, &resolution->list);
286 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200287}
288
Christopher Faulet67957bd2017-09-27 11:00:59 +0200289/* Prepares and sends a DNS resolution. It returns 1 if the query was sent, 0 if
290 * skipped and -1 if an error occurred.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200291 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200292static int
293dns_run_resolution(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200294{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200295 struct dns_resolvers *resolvers = resolution->resolvers;
296 int query_id, i;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200297
Christopher Faulet67957bd2017-09-27 11:00:59 +0200298 /* Avoid sending requests for resolutions that don't yet have an
299 * hostname, ie resolutions linked to servers that do not yet have an
300 * fqdn */
301 if (!resolution->hostname_dn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200302 return 0;
303
Christopher Faulet67957bd2017-09-27 11:00:59 +0200304 /* Check if a resolution has already been started for this server return
305 * directly to avoid resolution pill up. */
306 if (resolution->step != RSLV_STEP_NONE)
307 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200308
Christopher Faulet67957bd2017-09-27 11:00:59 +0200309 /* Generates a new query id. We try at most 100 times to find a free
310 * query id */
311 for (i = 0; i < 100; ++i) {
312 query_id = dns_rnd16();
313 if (!eb32_lookup(&resolvers->query_ids, query_id))
Olivier Houchard8da5f982017-08-04 18:35:36 +0200314 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200315 query_id = -1;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200316 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200317 if (query_id == -1) {
318 send_log(NULL, LOG_NOTICE,
319 "could not generate a query id for %s, in resolvers %s.\n",
320 resolution->hostname_dn, resolvers->id);
321 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200322 }
323
Christopher Faulet67957bd2017-09-27 11:00:59 +0200324 /* Update resolution parameters */
325 resolution->query_id = query_id;
326 resolution->qid.key = query_id;
327 resolution->step = RSLV_STEP_RUNNING;
328 resolution->query_type = resolution->prefered_query_type;
329 resolution->try = resolvers->resolve_retries;
330 eb32_insert(&resolvers->query_ids, &resolution->qid);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200331
Christopher Faulet67957bd2017-09-27 11:00:59 +0200332 /* Send the DNS query */
333 resolution->try -= 1;
334 dns_send_query(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200335 return 1;
336}
337
Christopher Faulet67957bd2017-09-27 11:00:59 +0200338/* Performs a name resolution for the requester <req> */
339void dns_trigger_resolution(struct dns_requester *req)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200340{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200341 struct dns_resolvers *resolvers;
342 struct dns_resolution *res;
343 int exp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200344
Christopher Faulet67957bd2017-09-27 11:00:59 +0200345 if (!req || !req->resolution)
346 return;
347 res = req->resolution;
348 resolvers = res->resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200349
Christopher Faulet67957bd2017-09-27 11:00:59 +0200350 /* The resolution must not be triggered yet. Use the cached response, if
351 * valid */
352 exp = tick_add(res->last_resolution, resolvers->hold.valid);
Olivier Houchardf3d9e602018-05-22 18:40:07 +0200353 if (resolvers->t && (res->status != RSLV_STATUS_VALID ||
354 !tick_isset(res->last_resolution) || tick_is_expired(exp, now_ms)))
355 task_wakeup(resolvers->t, TASK_WOKEN_OTHER);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200356}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200357
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200358
Christopher Faulet67957bd2017-09-27 11:00:59 +0200359/* Resets some resolution parameters to initial values and also delete the query
360 * ID from the resolver's tree.
361 */
362static void dns_reset_resolution(struct dns_resolution *resolution)
363{
364 /* update resolution status */
365 resolution->step = RSLV_STEP_NONE;
366 resolution->try = 0;
367 resolution->last_resolution = now_ms;
368 resolution->nb_queries = 0;
369 resolution->nb_responses = 0;
370 resolution->query_type = resolution->prefered_query_type;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200371
Christopher Faulet67957bd2017-09-27 11:00:59 +0200372 /* clean up query id */
373 eb32_delete(&resolution->qid);
374 resolution->query_id = 0;
375 resolution->qid.key = 0;
376}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200377
Christopher Faulet67957bd2017-09-27 11:00:59 +0200378/* Returns the query id contained in a DNS response */
379static inline unsigned short dns_response_get_query_id(unsigned char *resp)
380{
381 return resp[0] * 256 + resp[1];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200382}
383
Christopher Faulet67957bd2017-09-27 11:00:59 +0200384
385/* Analyses, re-builds and copies the name <name> from the DNS response packet
386 * <buffer>. <name> must point to the 'data_len' information or pointer 'c0'
387 * for compressed data. The result is copied into <dest>, ensuring we don't
388 * overflow using <dest_len> Returns the number of bytes the caller can move
389 * forward. If 0 it means an error occurred while parsing the name. <offset> is
390 * the number of bytes the caller could move forward.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200391 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200392int dns_read_name(unsigned char *buffer, unsigned char *bufend,
393 unsigned char *name, char *destination, int dest_len,
394 int *offset)
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200395{
396 int nb_bytes = 0, n = 0;
397 int label_len;
398 unsigned char *reader = name;
399 char *dest = destination;
400
401 while (1) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200402 /* Name compression is in use */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200403 if ((*reader & 0xc0) == 0xc0) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200404 /* Must point BEFORE current position */
405 if ((buffer + reader[1]) > reader)
406 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200407
Christopher Faulet67957bd2017-09-27 11:00:59 +0200408 n = dns_read_name(buffer, bufend, buffer + reader[1],
409 dest, dest_len - nb_bytes, offset);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200410 if (n == 0)
Christopher Faulet67957bd2017-09-27 11:00:59 +0200411 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200412
Christopher Faulet67957bd2017-09-27 11:00:59 +0200413 dest += n;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200414 nb_bytes += n;
415 goto out;
416 }
417
418 label_len = *reader;
419 if (label_len == 0)
420 goto out;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200421
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200422 /* Check if:
423 * - we won't read outside the buffer
424 * - there is enough place in the destination
425 */
426 if ((reader + label_len >= bufend) || (nb_bytes + label_len >= dest_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +0200427 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200428
429 /* +1 to take label len + label string */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200430 label_len++;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200431
432 memcpy(dest, reader, label_len);
433
Christopher Faulet67957bd2017-09-27 11:00:59 +0200434 dest += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200435 nb_bytes += label_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200436 reader += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200437 }
438
Christopher Faulet67957bd2017-09-27 11:00:59 +0200439 out:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200440 /* offset computation:
441 * parse from <name> until finding either NULL or a pointer "c0xx"
442 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200443 reader = name;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200444 *offset = 0;
445 while (reader < bufend) {
446 if ((reader[0] & 0xc0) == 0xc0) {
447 *offset += 2;
448 break;
449 }
450 else if (*reader == 0) {
451 *offset += 1;
452 break;
453 }
454 *offset += 1;
455 ++reader;
456 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200457 return nb_bytes;
458
Christopher Faulet67957bd2017-09-27 11:00:59 +0200459 err:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200460 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200461}
462
Christopher Faulet67957bd2017-09-27 11:00:59 +0200463/* Checks for any obsolete record, also identify any SRV request, and try to
464 * find a corresponding server.
465*/
466static void dns_check_dns_response(struct dns_resolution *res)
467{
468 struct dns_resolvers *resolvers = res->resolvers;
469 struct dns_requester *req, *reqback;
470 struct dns_answer_item *item, *itemback;
471 struct server *srv;
472 struct dns_srvrq *srvrq;
473
474 list_for_each_entry_safe(item, itemback, &res->response.answer_list, list) {
475
476 /* Remove obsolete items */
477 if ((item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
478 if (item->type != DNS_RTYPE_SRV)
479 goto rm_obselete_item;
480
481 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
482 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
483 continue;
484
485 /* Remove any associated server */
486 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100487 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200488 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
489 item->data_len == srv->hostname_dn_len &&
490 !memcmp(srv->hostname_dn, item->target, item->data_len)) {
491 snr_update_srv_status(srv, 1);
492 free(srv->hostname);
493 free(srv->hostname_dn);
494 srv->hostname = NULL;
495 srv->hostname_dn = NULL;
496 srv->hostname_dn_len = 0;
497 dns_unlink_resolution(srv->dns_requester);
498 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100499 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200500 }
501 }
502
503 rm_obselete_item:
504 LIST_DEL(&item->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +0100505 pool_free(dns_answer_item_pool, item);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200506 continue;
507 }
508
509 if (item->type != DNS_RTYPE_SRV)
510 continue;
511
512 /* Now process SRV records */
513 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
514 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
515 continue;
516
517 /* Check if a server already uses that hostname */
518 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100519 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200520 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
521 item->data_len == srv->hostname_dn_len &&
522 !memcmp(srv->hostname_dn, item->target, item->data_len)) {
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100523 int ha_weight;
524
525 /* Make sure weight is at least 1, so
526 * that the server will be used.
527 */
528 ha_weight = item->weight / 256 + 1;
529 if (srv->uweight != ha_weight) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200530 char weight[9];
531
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100532 snprintf(weight, sizeof(weight), "%d", ha_weight);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200533 server_parse_weight_change_request(srv, weight);
534 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100535 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200536 break;
537 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100538 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200539 }
540 if (srv)
541 continue;
542
543 /* If not, try to find a server with undefined hostname */
544 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100545 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200546 if (srv->srvrq == srvrq && !srv->hostname_dn)
547 break;
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100548 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200549 }
550 /* And update this server, if found */
551 if (srv) {
552 const char *msg = NULL;
553 char weight[9];
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100554 int ha_weight;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200555 char hostname[DNS_MAX_NAME_SIZE];
556
557 if (dns_dn_label_to_str(item->target, item->data_len+1,
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100558 hostname, DNS_MAX_NAME_SIZE) == -1) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100559 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200560 continue;
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100561 }
Olivier Houchardd16bfe62017-10-31 15:21:19 +0100562 msg = update_server_fqdn(srv, hostname, "SRV record", 1);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200563 if (msg)
564 send_log(srv->proxy, LOG_NOTICE, "%s", msg);
565
566 srv->svc_port = item->port;
567 srv->flags &= ~SRV_F_MAPPORTS;
568 if ((srv->check.state & CHK_ST_CONFIGURED) &&
569 !(srv->flags & SRV_F_CHECKPORT))
570 srv->check.port = item->port;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100571
572 /* Make sure weight is at least 1, so
573 * that the server will be used.
574 */
575 ha_weight = item->weight / 256 + 1;
576
577 snprintf(weight, sizeof(weight), "%d", ha_weight);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200578 server_parse_weight_change_request(srv, weight);
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100579 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200580 }
581 }
582 }
583}
584
585/* Validates that the buffer DNS response provided in <resp> and finishing
586 * before <bufend> is valid from a DNS protocol point of view.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200587 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200588 * The result is stored in <resolution>' response, buf_response,
589 * response_query_records and response_answer_records members.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200590 *
591 * This function returns one of the DNS_RESP_* code to indicate the type of
592 * error found.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200593 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200594static int dns_validate_dns_response(unsigned char *resp, unsigned char *bufend,
595 struct dns_resolution *resolution, int max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200596{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200597 unsigned char *reader;
598 char *previous_dname, tmpname[DNS_MAX_NAME_SIZE];
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200599 int len, flags, offset;
600 int dns_query_record_id;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200601 int nb_saved_records;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200602 struct dns_query_item *dns_query;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200603 struct dns_answer_item *dns_answer_record, *tmp_record;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200604 struct dns_response_packet *dns_p;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200605 int i, found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200606
Christopher Faulet67957bd2017-09-27 11:00:59 +0200607 reader = resp;
608 len = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200609 previous_dname = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200610 dns_query = NULL;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200611
Christopher Faulet67957bd2017-09-27 11:00:59 +0200612 /* Initialization of response buffer and structure */
Baptiste Assmann729c9012017-05-22 15:13:10 +0200613 dns_p = &resolution->response;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200614
615 /* query id */
616 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200617 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200618 dns_p->header.id = reader[0] * 256 + reader[1];
619 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200620
Christopher Faulet67957bd2017-09-27 11:00:59 +0200621 /* Flags and rcode are stored over 2 bytes
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200622 * First byte contains:
623 * - response flag (1 bit)
624 * - opcode (4 bits)
625 * - authoritative (1 bit)
626 * - truncated (1 bit)
627 * - recursion desired (1 bit)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200628 */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200629 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200630 return DNS_RESP_INVALID;
631
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200632 flags = reader[0] * 256 + reader[1];
633
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200634 if ((flags & DNS_FLAG_REPLYCODE) != DNS_RCODE_NO_ERROR) {
635 if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_NX_DOMAIN)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200636 return DNS_RESP_NX_DOMAIN;
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200637 else if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_REFUSED)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200638 return DNS_RESP_REFUSED;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200639 return DNS_RESP_ERROR;
640 }
641
Christopher Faulet67957bd2017-09-27 11:00:59 +0200642 /* Move forward 2 bytes for flags */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200643 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200644
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200645 /* 2 bytes for question count */
646 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200647 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200648 dns_p->header.qdcount = reader[0] * 256 + reader[1];
Christopher Faulet67957bd2017-09-27 11:00:59 +0200649 /* (for now) we send one query only, so we expect only one in the
650 * response too */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200651 if (dns_p->header.qdcount != 1)
652 return DNS_RESP_QUERY_COUNT_ERROR;
653 if (dns_p->header.qdcount > DNS_MAX_QUERY_RECORDS)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200654 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200655 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200656
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200657 /* 2 bytes for answer count */
658 if (reader + 2 >= bufend)
659 return DNS_RESP_INVALID;
660 dns_p->header.ancount = reader[0] * 256 + reader[1];
661 if (dns_p->header.ancount == 0)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200662 return DNS_RESP_ANCOUNT_ZERO;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200663 /* Check if too many records are announced */
Baptiste Assmann9d8dbbc2017-08-18 23:35:08 +0200664 if (dns_p->header.ancount > max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200665 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200666 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200667
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200668 /* 2 bytes authority count */
669 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200670 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200671 dns_p->header.nscount = reader[0] * 256 + reader[1];
672 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200673
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200674 /* 2 bytes additional count */
675 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200676 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200677 dns_p->header.arcount = reader[0] * 256 + reader[1];
678 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200679
Christopher Faulet67957bd2017-09-27 11:00:59 +0200680 /* Parsing dns queries */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200681 LIST_INIT(&dns_p->query_list);
682 for (dns_query_record_id = 0; dns_query_record_id < dns_p->header.qdcount; dns_query_record_id++) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200683 /* Use next pre-allocated dns_query_item after ensuring there is
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200684 * still one available.
Christopher Faulet67957bd2017-09-27 11:00:59 +0200685 * It's then added to our packet query list. */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200686 if (dns_query_record_id > DNS_MAX_QUERY_RECORDS)
687 return DNS_RESP_INVALID;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200688 dns_query = &resolution->response_query_records[dns_query_record_id];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200689 LIST_ADDQ(&dns_p->query_list, &dns_query->list);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200690
Christopher Faulet67957bd2017-09-27 11:00:59 +0200691 /* Name is a NULL terminated string in our case, since we have
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200692 * one query per response and the first one can't be compressed
Christopher Faulet67957bd2017-09-27 11:00:59 +0200693 * (using the 0x0c format) */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200694 offset = 0;
695 len = dns_read_name(resp, bufend, reader, dns_query->name, DNS_MAX_NAME_SIZE, &offset);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200696
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200697 if (len == 0)
698 return DNS_RESP_INVALID;
699
700 reader += offset;
701 previous_dname = dns_query->name;
702
703 /* move forward 2 bytes for question type */
704 if (reader + 2 >= bufend)
705 return DNS_RESP_INVALID;
706 dns_query->type = reader[0] * 256 + reader[1];
707 reader += 2;
708
709 /* move forward 2 bytes for question class */
710 if (reader + 2 >= bufend)
711 return DNS_RESP_INVALID;
712 dns_query->class = reader[0] * 256 + reader[1];
713 reader += 2;
714 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200715
Baptiste Assmann251abb92017-08-11 09:58:27 +0200716 /* TRUNCATED flag must be checked after we could read the query type
Christopher Faulet67957bd2017-09-27 11:00:59 +0200717 * because a TRUNCATED SRV query type response can still be exploited */
Baptiste Assmann251abb92017-08-11 09:58:27 +0200718 if (dns_query->type != DNS_RTYPE_SRV && flags & DNS_FLAG_TRUNCATED)
719 return DNS_RESP_TRUNCATED;
720
Baptiste Assmann325137d2015-04-13 23:40:55 +0200721 /* now parsing response records */
Baptiste Assmann69fce672017-05-04 08:37:45 +0200722 nb_saved_records = 0;
Olivier Houchard8da5f982017-08-04 18:35:36 +0200723 for (i = 0; i < dns_p->header.ancount; i++) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200724 if (reader >= bufend)
725 return DNS_RESP_INVALID;
726
Willy Tarreaubafbe012017-11-24 17:34:44 +0100727 dns_answer_record = pool_alloc(dns_answer_item_pool);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200728 if (dns_answer_record == NULL)
729 return (DNS_RESP_INVALID);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200730
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200731 offset = 0;
732 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200733
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200734 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100735 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200736 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200737 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200738
Christopher Faulet67957bd2017-09-27 11:00:59 +0200739 /* Check if the current record dname is valid. previous_dname
740 * points either to queried dname or last CNAME target */
Baptiste Assmannddc8ce62017-08-11 10:31:22 +0200741 if (dns_query->type != DNS_RTYPE_SRV && memcmp(previous_dname, tmpname, len) != 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100742 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200743 if (i == 0) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200744 /* First record, means a mismatch issue between
745 * queried dname and dname found in the first
746 * record */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200747 return DNS_RESP_INVALID;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200748 }
749 else {
750 /* If not the first record, this means we have a
751 * CNAME resolution error */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200752 return DNS_RESP_CNAME_ERROR;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200753 }
754
Baptiste Assmann325137d2015-04-13 23:40:55 +0200755 }
756
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200757 memcpy(dns_answer_record->name, tmpname, len);
758 dns_answer_record->name[len] = 0;
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200759
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200760 reader += offset;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200761 if (reader >= bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100762 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200763 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200764 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200765
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200766 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200767 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100768 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200769 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200770 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200771 dns_answer_record->type = reader[0] * 256 + reader[1];
772 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200773
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200774 /* 2 bytes for class (2) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200775 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100776 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200777 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200778 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200779 dns_answer_record->class = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200780 reader += 2;
781
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200782 /* 4 bytes for ttl (4) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200783 if (reader + 4 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100784 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200785 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200786 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200787 dns_answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
788 + reader[2] * 256 + reader[3];
789 reader += 4;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200790
Christopher Faulet67957bd2017-09-27 11:00:59 +0200791 /* Now reading data len */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200792 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100793 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200794 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200795 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200796 dns_answer_record->data_len = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200797
Christopher Faulet67957bd2017-09-27 11:00:59 +0200798 /* Move forward 2 bytes for data len */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200799 reader += 2;
800
Christopher Faulet67957bd2017-09-27 11:00:59 +0200801 /* Analyzing record content */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200802 switch (dns_answer_record->type) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200803 case DNS_RTYPE_A:
804 /* ipv4 is stored on 4 bytes */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200805 if (dns_answer_record->data_len != 4) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100806 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200807 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200808 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200809 dns_answer_record->address.sa_family = AF_INET;
810 memcpy(&(((struct sockaddr_in *)&dns_answer_record->address)->sin_addr),
811 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200812 break;
813
814 case DNS_RTYPE_CNAME:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200815 /* Check if this is the last record and update the caller about the status:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200816 * no IP could be found and last record was a CNAME. Could be triggered
817 * by a wrong query type
818 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200819 * + 1 because dns_answer_record_id starts at 0
820 * while number of answers is an integer and
821 * starts at 1.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200822 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200823 if (i + 1 == dns_p->header.ancount) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100824 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200825 return DNS_RESP_CNAME_ERROR;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200826 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200827
828 offset = 0;
829 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200830 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100831 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200832 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200833 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200834
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200835 memcpy(dns_answer_record->target, tmpname, len);
836 dns_answer_record->target[len] = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200837 previous_dname = dns_answer_record->target;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200838 break;
839
Olivier Houchard8da5f982017-08-04 18:35:36 +0200840
841 case DNS_RTYPE_SRV:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200842 /* Answer must contain :
Olivier Houchard8da5f982017-08-04 18:35:36 +0200843 * - 2 bytes for the priority
844 * - 2 bytes for the weight
845 * - 2 bytes for the port
846 * - the target hostname
847 */
848 if (dns_answer_record->data_len <= 6) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100849 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200850 return DNS_RESP_INVALID;
851 }
Willy Tarreaud5370e12017-09-19 14:59:52 +0200852 dns_answer_record->priority = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200853 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200854 dns_answer_record->weight = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200855 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200856 dns_answer_record->port = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200857 reader += sizeof(uint16_t);
858 offset = 0;
859 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset);
860 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100861 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200862 return DNS_RESP_INVALID;
863 }
Olivier Houchard8da5f982017-08-04 18:35:36 +0200864 dns_answer_record->data_len = len;
865 memcpy(dns_answer_record->target, tmpname, len);
866 dns_answer_record->target[len] = 0;
867 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200868
Baptiste Assmann325137d2015-04-13 23:40:55 +0200869 case DNS_RTYPE_AAAA:
870 /* ipv6 is stored on 16 bytes */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200871 if (dns_answer_record->data_len != 16) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100872 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200873 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200874 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200875 dns_answer_record->address.sa_family = AF_INET6;
876 memcpy(&(((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr),
877 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200878 break;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200879
Baptiste Assmann325137d2015-04-13 23:40:55 +0200880 } /* switch (record type) */
881
Christopher Faulet67957bd2017-09-27 11:00:59 +0200882 /* Increment the counter for number of records saved into our
883 * local response */
884 nb_saved_records++;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200885
Christopher Faulet67957bd2017-09-27 11:00:59 +0200886 /* Move forward dns_answer_record->data_len for analyzing next
887 * record in the response */
888 reader += ((dns_answer_record->type == DNS_RTYPE_SRV)
889 ? offset
890 : dns_answer_record->data_len);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200891
892 /* Lookup to see if we already had this entry */
Olivier Houchard8da5f982017-08-04 18:35:36 +0200893 found = 0;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200894 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
895 if (tmp_record->type != dns_answer_record->type)
896 continue;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200897
898 switch(tmp_record->type) {
899 case DNS_RTYPE_A:
900 if (!memcmp(&((struct sockaddr_in *)&dns_answer_record->address)->sin_addr,
901 &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
902 sizeof(in_addr_t)))
903 found = 1;
904 break;
905
906 case DNS_RTYPE_AAAA:
907 if (!memcmp(&((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr,
908 &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
909 sizeof(struct in6_addr)))
910 found = 1;
911 break;
912
Olivier Houchard8da5f982017-08-04 18:35:36 +0200913 case DNS_RTYPE_SRV:
914 if (dns_answer_record->data_len == tmp_record->data_len &&
Christopher Faulet67957bd2017-09-27 11:00:59 +0200915 !memcmp(dns_answer_record->target, tmp_record->target, dns_answer_record->data_len) &&
Olivier Houchard8da5f982017-08-04 18:35:36 +0200916 dns_answer_record->port == tmp_record->port) {
917 tmp_record->weight = dns_answer_record->weight;
918 found = 1;
919 }
920 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200921
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200922 default:
923 break;
924 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200925
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200926 if (found == 1)
927 break;
928 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200929
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200930 if (found == 1) {
931 tmp_record->last_seen = now.tv_sec;
Willy Tarreaubafbe012017-11-24 17:34:44 +0100932 pool_free(dns_answer_item_pool, dns_answer_record);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200933 }
934 else {
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200935 dns_answer_record->last_seen = now.tv_sec;
936 LIST_ADDQ(&dns_p->answer_list, &dns_answer_record->list);
937 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200938 } /* for i 0 to ancount */
939
Christopher Faulet67957bd2017-09-27 11:00:59 +0200940 /* Save the number of records we really own */
Baptiste Assmann69fce672017-05-04 08:37:45 +0200941 dns_p->header.ancount = nb_saved_records;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200942 dns_check_dns_response(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200943 return DNS_RESP_VALID;
944}
945
Christopher Faulet67957bd2017-09-27 11:00:59 +0200946/* Searches dn_name resolution in resp.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200947 * If existing IP not found, return the first IP matching family_priority,
948 * otherwise, first ip found
949 * The following tasks are the responsibility of the caller:
Baptiste Assmann3cf7f982016-04-17 22:43:26 +0200950 * - <dns_p> contains an error free DNS response
Baptiste Assmann325137d2015-04-13 23:40:55 +0200951 * For both cases above, dns_validate_dns_response is required
952 * returns one of the DNS_UPD_* code
953 */
Baptiste Assmannfb7091e2017-05-03 15:43:12 +0200954int dns_get_ip_from_response(struct dns_response_packet *dns_p,
Baptiste Assmann42746372017-05-03 12:12:02 +0200955 struct dns_options *dns_opts, void *currentip,
Thierry Fournierada34842016-02-17 21:25:09 +0100956 short currentip_sin_family,
Baptiste Assmannfb7091e2017-05-03 15:43:12 +0200957 void **newip, short *newip_sin_family,
958 void *owner)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200959{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200960 struct dns_answer_item *record;
Thierry Fournierada34842016-02-17 21:25:09 +0100961 int family_priority;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200962 int currentip_found;
Baptiste Assmann3cf7f982016-04-17 22:43:26 +0200963 unsigned char *newip4, *newip6;
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100964 int currentip_sel;
965 int j;
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100966 int score, max_score;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +0200967 int allowed_duplicated_ip;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200968
Christopher Faulet67957bd2017-09-27 11:00:59 +0200969 family_priority = dns_opts->family_prio;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +0200970 allowed_duplicated_ip = dns_opts->accept_duplicate_ip;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200971 *newip = newip4 = newip6 = NULL;
972 currentip_found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200973 *newip_sin_family = AF_UNSPEC;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200974 max_score = -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200975
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100976 /* Select an IP regarding configuration preference.
Joseph Herlant42cf6392018-11-15 10:33:28 -0800977 * Top priority is the preferred network ip version,
978 * second priority is the preferred network.
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100979 * the last priority is the currently used IP,
980 *
981 * For these three priorities, a score is calculated. The
982 * weight are:
Joseph Herlant42cf6392018-11-15 10:33:28 -0800983 * 8 - preferred ip version.
984 * 4 - preferred network.
Baptistefc725902016-12-26 23:21:08 +0100985 * 2 - if the ip in the record is not affected to any other server in the same backend (duplication)
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100986 * 1 - current ip.
987 * The result with the biggest score is returned.
988 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200989
990 list_for_each_entry(record, &dns_p->answer_list, list) {
991 void *ip;
992 unsigned char ip_type;
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100993
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200994 if (record->type == DNS_RTYPE_A) {
995 ip = &(((struct sockaddr_in *)&record->address)->sin_addr);
996 ip_type = AF_INET;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200997 }
998 else if (record->type == DNS_RTYPE_AAAA) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200999 ip_type = AF_INET6;
1000 ip = &(((struct sockaddr_in6 *)&record->address)->sin6_addr);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001001 }
1002 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001003 continue;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001004 score = 0;
1005
Joseph Herlant42cf6392018-11-15 10:33:28 -08001006 /* Check for preferred ip protocol. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001007 if (ip_type == family_priority)
Baptistefc725902016-12-26 23:21:08 +01001008 score += 8;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001009
Joseph Herlant42cf6392018-11-15 10:33:28 -08001010 /* Check for preferred network. */
Baptiste Assmann42746372017-05-03 12:12:02 +02001011 for (j = 0; j < dns_opts->pref_net_nb; j++) {
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001012
1013 /* Compare only the same adresses class. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001014 if (dns_opts->pref_net[j].family != ip_type)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001015 continue;
1016
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001017 if ((ip_type == AF_INET &&
1018 in_net_ipv4(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001019 &dns_opts->pref_net[j].mask.in4,
1020 &dns_opts->pref_net[j].addr.in4)) ||
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001021 (ip_type == AF_INET6 &&
1022 in_net_ipv6(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001023 &dns_opts->pref_net[j].mask.in6,
1024 &dns_opts->pref_net[j].addr.in6))) {
Baptistefc725902016-12-26 23:21:08 +01001025 score += 4;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001026 break;
1027 }
1028 }
1029
Christopher Faulet67957bd2017-09-27 11:00:59 +02001030 /* Check if the IP found in the record is already affected to a
Baptiste Assmann84221b42018-06-22 13:03:50 +02001031 * member of a group. If not, the score should be incremented
Christopher Faulet67957bd2017-09-27 11:00:59 +02001032 * by 2. */
Baptiste Assmann84221b42018-06-22 13:03:50 +02001033 if (owner && snr_check_ip_callback(owner, ip, &ip_type)) {
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001034 if (!allowed_duplicated_ip) {
1035 continue;
1036 }
Baptiste Assmann84221b42018-06-22 13:03:50 +02001037 } else {
1038 score += 2;
1039 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001040
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001041 /* Check for current ip matching. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001042 if (ip_type == currentip_sin_family &&
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001043 ((currentip_sin_family == AF_INET &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001044 !memcmp(ip, currentip, 4)) ||
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001045 (currentip_sin_family == AF_INET6 &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001046 !memcmp(ip, currentip, 16)))) {
1047 score++;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001048 currentip_sel = 1;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001049 }
1050 else
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001051 currentip_sel = 0;
1052
1053 /* Keep the address if the score is better than the previous
Christopher Faulet67957bd2017-09-27 11:00:59 +02001054 * score. The maximum score is 15, if this value is reached, we
1055 * break the parsing. Implicitly, this score is reached the ip
1056 * selected is the current ip. */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001057 if (score > max_score) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001058 if (ip_type == AF_INET)
1059 newip4 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001060 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001061 newip6 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001062 currentip_found = currentip_sel;
Baptistefc725902016-12-26 23:21:08 +01001063 if (score == 15)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001064 return DNS_UPD_NO;
1065 max_score = score;
1066 }
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001067 } /* list for each record entries */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001068
Christopher Faulet67957bd2017-09-27 11:00:59 +02001069 /* No IP found in the response */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001070 if (!newip4 && !newip6)
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001071 return DNS_UPD_NO_IP_FOUND;
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001072
Christopher Faulet67957bd2017-09-27 11:00:59 +02001073 /* Case when the caller looks first for an IPv4 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001074 if (family_priority == AF_INET) {
1075 if (newip4) {
1076 *newip = newip4;
1077 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001078 }
1079 else if (newip6) {
1080 *newip = newip6;
1081 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001082 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001083 if (!currentip_found)
1084 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001085 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001086 /* Case when the caller looks first for an IPv6 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001087 else if (family_priority == AF_INET6) {
1088 if (newip6) {
1089 *newip = newip6;
1090 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001091 }
1092 else if (newip4) {
1093 *newip = newip4;
1094 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001095 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001096 if (!currentip_found)
1097 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001098 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001099 /* Case when the caller have no preference (we prefer IPv6) */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001100 else if (family_priority == AF_UNSPEC) {
1101 if (newip6) {
1102 *newip = newip6;
1103 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001104 }
1105 else if (newip4) {
1106 *newip = newip4;
1107 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001108 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001109 if (!currentip_found)
1110 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001111 }
1112
Christopher Faulet67957bd2017-09-27 11:00:59 +02001113 /* No reason why we should change the server's IP address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001114 return DNS_UPD_NO;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001115
Christopher Faulet67957bd2017-09-27 11:00:59 +02001116 not_found:
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001117 list_for_each_entry(record, &dns_p->answer_list, list) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001118 /* Move the first record to the end of the list, for internal
1119 * round robin */
1120 LIST_DEL(&record->list);
1121 LIST_ADDQ(&dns_p->answer_list, &record->list);
1122 break;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001123 }
1124 return DNS_UPD_SRVIP_NOT_FOUND;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001125}
1126
Christopher Faulet67957bd2017-09-27 11:00:59 +02001127/* Turns a domain name label into a string.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001128 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001129 * <dn> must be a null-terminated string. <dn_len> must include the terminating
1130 * null byte. <str> must be allocated and its size must be passed in <str_len>.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001131 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001132 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1133 * <str> (including the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001134 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001135int dns_dn_label_to_str(const char *dn, int dn_len, char *str, int str_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001136{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001137 char *ptr;
1138 int i, sz;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001139
Christopher Faulet67957bd2017-09-27 11:00:59 +02001140 if (str_len < dn_len - 1)
Baptiste Assmann2af08fe2017-08-14 00:13:01 +02001141 return -1;
1142
Christopher Faulet67957bd2017-09-27 11:00:59 +02001143 ptr = str;
1144 for (i = 0; i < dn_len-1; ++i) {
1145 sz = dn[i];
1146 if (i)
1147 *ptr++ = '.';
1148 memcpy(ptr, dn+i+1, sz);
1149 ptr += sz;
1150 i += sz;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001151 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001152 *ptr++ = '\0';
1153 return (ptr - str);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001154}
1155
Christopher Faulet67957bd2017-09-27 11:00:59 +02001156/* Turns a string into domain name label: www.haproxy.org into 3www7haproxy3org
1157 *
1158 * <str> must be a null-terminated string. <str_len> must include the
1159 * terminating null byte. <dn> buffer must be allocated and its size must be
1160 * passed in <dn_len>.
1161 *
1162 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1163 * <dn> (excluding the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001164 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001165int dns_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001166{
Baptiste Assmann325137d2015-04-13 23:40:55 +02001167 int i, offset;
1168
Christopher Faulet67957bd2017-09-27 11:00:59 +02001169 if (dn_len < str_len + 1)
1170 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001171
Christopher Faulet67957bd2017-09-27 11:00:59 +02001172 /* First byte of dn will be used to store the length of the first
1173 * label */
1174 offset = 0;
1175 for (i = 0; i < str_len; ++i) {
1176 if (str[i] == '.') {
1177 /* 2 or more consecutive dots is invalid */
1178 if (i == offset)
1179 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001180
Christopher Faulet67957bd2017-09-27 11:00:59 +02001181 dn[offset] = (i - offset);
1182 offset = i+1;
1183 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001184 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001185 dn[i+1] = str[i];
Baptiste Assmann325137d2015-04-13 23:40:55 +02001186 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001187 dn[offset] = (i - offset - 1);
1188 dn[i] = '\0';
1189 return i;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001190}
1191
Christopher Faulet67957bd2017-09-27 11:00:59 +02001192/* Validates host name:
Baptiste Assmann325137d2015-04-13 23:40:55 +02001193 * - total size
1194 * - each label size individually
1195 * returns:
1196 * 0 in case of error. If <err> is not NULL, an error message is stored there.
1197 * 1 when no error. <err> is left unaffected.
1198 */
1199int dns_hostname_validation(const char *string, char **err)
1200{
1201 const char *c, *d;
1202 int i;
1203
1204 if (strlen(string) > DNS_MAX_NAME_SIZE) {
1205 if (err)
1206 *err = DNS_TOO_LONG_FQDN;
1207 return 0;
1208 }
1209
1210 c = string;
1211 while (*c) {
1212 d = c;
1213
1214 i = 0;
1215 while (*d != '.' && *d && i <= DNS_MAX_LABEL_SIZE) {
1216 i++;
1217 if (!((*d == '-') || (*d == '_') ||
1218 ((*d >= 'a') && (*d <= 'z')) ||
1219 ((*d >= 'A') && (*d <= 'Z')) ||
1220 ((*d >= '0') && (*d <= '9')))) {
1221 if (err)
1222 *err = DNS_INVALID_CHARACTER;
1223 return 0;
1224 }
1225 d++;
1226 }
1227
1228 if ((i >= DNS_MAX_LABEL_SIZE) && (d[i] != '.')) {
1229 if (err)
1230 *err = DNS_LABEL_TOO_LONG;
1231 return 0;
1232 }
1233
1234 if (*d == '\0')
1235 goto out;
1236
1237 c = ++d;
1238 }
1239 out:
1240 return 1;
1241}
1242
Christopher Faulet67957bd2017-09-27 11:00:59 +02001243/* Picks up an available resolution from the different resolution list
1244 * associated to a resolvers section, in this order:
1245 * 1. check in resolutions.curr for the same hostname and query_type
1246 * 2. check in resolutions.wait for the same hostname and query_type
1247 * 3. Get a new resolution from resolution pool
1248 *
1249 * Returns an available resolution, NULL if none found.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001250 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001251static struct dns_resolution *dns_pick_resolution(struct dns_resolvers *resolvers,
1252 char **hostname_dn, int hostname_dn_len,
1253 int query_type)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001254{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001255 struct dns_resolution *res;
1256
1257 if (!*hostname_dn)
1258 goto from_pool;
1259
1260 /* Search for same hostname and query type in resolutions.curr */
1261 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
1262 if (!res->hostname_dn)
1263 continue;
1264 if ((query_type == res->prefered_query_type) &&
1265 hostname_dn_len == res->hostname_dn_len &&
1266 !memcmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
1267 return res;
1268 }
1269
1270 /* Search for same hostname and query type in resolutions.wait */
1271 list_for_each_entry(res, &resolvers->resolutions.wait, list) {
1272 if (!res->hostname_dn)
1273 continue;
1274 if ((query_type == res->prefered_query_type) &&
1275 hostname_dn_len == res->hostname_dn_len &&
1276 !memcmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
1277 return res;
1278 }
1279
1280 from_pool:
1281 /* No resolution could be found, so let's allocate a new one */
Willy Tarreaubafbe012017-11-24 17:34:44 +01001282 res = pool_alloc(dns_resolution_pool);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001283 if (res) {
1284 memset(res, 0, sizeof(*res));
1285 res->resolvers = resolvers;
1286 res->uuid = resolution_uuid;
1287 res->status = RSLV_STATUS_NONE;
1288 res->step = RSLV_STEP_NONE;
1289 res->last_valid = now_ms;
1290
1291 LIST_INIT(&res->requesters);
1292 LIST_INIT(&res->response.answer_list);
1293
1294 res->prefered_query_type = query_type;
1295 res->query_type = query_type;
1296 res->hostname_dn = *hostname_dn;
1297 res->hostname_dn_len = hostname_dn_len;
1298
1299 ++resolution_uuid;
1300
1301 /* Move the resolution to the resolvers wait queue */
1302 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1303 }
1304 return res;
1305}
1306
1307/* Releases a resolution from its requester(s) and move it back to the pool */
1308static void dns_free_resolution(struct dns_resolution *resolution)
1309{
1310 struct dns_requester *req, *reqback;
1311
1312 /* clean up configuration */
1313 dns_reset_resolution(resolution);
1314 resolution->hostname_dn = NULL;
1315 resolution->hostname_dn_len = 0;
1316
1317 list_for_each_entry_safe(req, reqback, &resolution->requesters, list) {
1318 LIST_DEL(&req->list);
1319 req->resolution = NULL;
1320 }
1321
1322 LIST_DEL(&resolution->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +01001323 pool_free(dns_resolution_pool, resolution);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001324}
1325
1326/* Links a requester (a server or a dns_srvrq) with a resolution. It returns 0
1327 * on success, -1 otherwise.
1328 */
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001329int dns_link_resolution(void *requester, int requester_type, int requester_locked)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001330{
1331 struct dns_resolution *res = NULL;
1332 struct dns_requester *req;
1333 struct dns_resolvers *resolvers;
1334 struct server *srv = NULL;
1335 struct dns_srvrq *srvrq = NULL;
1336 char **hostname_dn;
1337 int hostname_dn_len, query_type;
1338
1339 switch (requester_type) {
1340 case OBJ_TYPE_SERVER:
1341 srv = (struct server *)requester;
1342 hostname_dn = &srv->hostname_dn;
1343 hostname_dn_len = srv->hostname_dn_len;
1344 resolvers = srv->resolvers;
1345 query_type = ((srv->dns_opts.family_prio == AF_INET)
1346 ? DNS_RTYPE_A
1347 : DNS_RTYPE_AAAA);
1348 break;
1349
1350 case OBJ_TYPE_SRVRQ:
1351 srvrq = (struct dns_srvrq *)requester;
1352 hostname_dn = &srvrq->hostname_dn;
1353 hostname_dn_len = srvrq->hostname_dn_len;
1354 resolvers = srvrq->resolvers;
1355 query_type = DNS_RTYPE_SRV;
1356 break;
1357
1358 default:
1359 goto err;
1360 }
1361
1362 /* Get a resolution from the resolvers' wait queue or pool */
1363 if ((res = dns_pick_resolution(resolvers, hostname_dn, hostname_dn_len, query_type)) == NULL)
1364 goto err;
1365
1366 if (srv) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001367 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001368 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001369 if (srv->dns_requester == NULL) {
Willy Tarreau5ec84572017-11-05 10:35:57 +01001370 if ((req = calloc(1, sizeof(*req))) == NULL) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001371 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001372 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001373 goto err;
Willy Tarreau5ec84572017-11-05 10:35:57 +01001374 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001375 req->owner = &srv->obj_type;
1376 srv->dns_requester = req;
1377 }
1378 else
1379 req = srv->dns_requester;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001380 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001381 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001382 }
1383 else if (srvrq) {
1384 if (srvrq->dns_requester == NULL) {
1385 if ((req = calloc(1, sizeof(*req))) == NULL)
1386 goto err;
1387 req->owner = &srvrq->obj_type;
1388 srvrq->dns_requester = req;
1389 }
1390 else
1391 req = srvrq->dns_requester;
1392 }
1393 else
1394 goto err;
1395
1396 req->resolution = res;
1397 req->requester_cb = snr_resolution_cb;
1398 req->requester_error_cb = snr_resolution_error_cb;
1399
1400 LIST_ADDQ(&res->requesters, &req->list);
1401 return 0;
1402
1403 err:
1404 if (res && LIST_ISEMPTY(&res->requesters))
1405 dns_free_resolution(res);
1406 return -1;
1407}
1408
1409/* Removes a requester from a DNS resoltion. It takes takes care of all the
1410 * consequences. It also cleans up some parameters from the requester.
1411 */
1412void dns_unlink_resolution(struct dns_requester *requester)
1413{
1414 struct dns_resolution *res;
1415 struct dns_requester *req;
1416
1417 /* Nothing to do */
1418 if (!requester || !requester->resolution)
1419 return;
1420 res = requester->resolution;
1421
1422 /* Clean up the requester */
1423 LIST_DEL(&requester->list);
1424 requester->resolution = NULL;
1425
1426 /* We need to find another requester linked on this resolution */
1427 if (!LIST_ISEMPTY(&res->requesters))
1428 req = LIST_NEXT(&res->requesters, struct dns_requester *, list);
1429 else {
1430 dns_free_resolution(res);
1431 return;
1432 }
1433
1434 /* Move hostname_dn related pointers to the next requester */
1435 switch (obj_type(req->owner)) {
1436 case OBJ_TYPE_SERVER:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001437 res->hostname_dn = __objt_server(req->owner)->hostname_dn;
1438 res->hostname_dn_len = __objt_server(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001439 break;
1440 case OBJ_TYPE_SRVRQ:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001441 res->hostname_dn = __objt_dns_srvrq(req->owner)->hostname_dn;
1442 res->hostname_dn_len = __objt_dns_srvrq(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001443 break;
1444 default:
1445 res->hostname_dn = NULL;
1446 res->hostname_dn_len = 0;
1447 break;
1448 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001449}
1450
Christopher Faulet67957bd2017-09-27 11:00:59 +02001451/* Called when a network IO is generated on a name server socket for an incoming
1452 * packet. It performs the following actions:
1453 * - check if the packet requires processing (not outdated resolution)
1454 * - ensure the DNS packet received is valid and call requester's callback
1455 * - call requester's error callback if invalid response
1456 * - check the dn_name in the packet against the one sent
1457 */
1458static void dns_resolve_recv(struct dgram_conn *dgram)
1459{
1460 struct dns_nameserver *ns, *tmpns;
1461 struct dns_resolvers *resolvers;
1462 struct dns_resolution *res;
1463 struct dns_query_item *query;
1464 unsigned char buf[DNS_MAX_UDP_MESSAGE + 1];
1465 unsigned char *bufend;
1466 int fd, buflen, dns_resp;
1467 int max_answer_records;
1468 unsigned short query_id;
1469 struct eb32_node *eb;
1470 struct dns_requester *req;
1471
1472 fd = dgram->t.sock.fd;
1473
1474 /* check if ready for reading */
1475 if (!fd_recv_ready(fd))
1476 return;
1477
1478 /* no need to go further if we can't retrieve the nameserver */
1479 if ((ns = dgram->owner) == NULL)
1480 return;
1481
1482 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001483 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001484
1485 /* process all pending input messages */
1486 while (1) {
1487 /* read message received */
1488 memset(buf, '\0', resolvers->accepted_payload_size + 1);
1489 if ((buflen = recv(fd, (char*)buf , resolvers->accepted_payload_size + 1, 0)) < 0) {
1490 /* FIXME : for now we consider EAGAIN only */
1491 fd_cant_recv(fd);
1492 break;
1493 }
1494
1495 /* message too big */
1496 if (buflen > resolvers->accepted_payload_size) {
1497 ns->counters.too_big++;
1498 continue;
1499 }
1500
1501 /* initializing variables */
1502 bufend = buf + buflen; /* pointer to mark the end of the buffer */
1503
1504 /* read the query id from the packet (16 bits) */
1505 if (buf + 2 > bufend) {
1506 ns->counters.invalid++;
1507 continue;
1508 }
1509 query_id = dns_response_get_query_id(buf);
1510
1511 /* search the query_id in the pending resolution tree */
1512 eb = eb32_lookup(&resolvers->query_ids, query_id);
1513 if (eb == NULL) {
1514 /* unknown query id means an outdated response and can be safely ignored */
1515 ns->counters.outdated++;
1516 continue;
1517 }
1518
1519 /* known query id means a resolution in prgress */
1520 res = eb32_entry(eb, struct dns_resolution, qid);
1521 if (!res) {
1522 ns->counters.outdated++;
1523 continue;
1524 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001525
Christopher Faulet67957bd2017-09-27 11:00:59 +02001526 /* number of responses received */
1527 res->nb_responses++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001528
Christopher Faulet67957bd2017-09-27 11:00:59 +02001529 max_answer_records = (resolvers->accepted_payload_size - DNS_HEADER_SIZE) / DNS_MIN_RECORD_SIZE;
1530 dns_resp = dns_validate_dns_response(buf, bufend, res, max_answer_records);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001531
Christopher Faulet67957bd2017-09-27 11:00:59 +02001532 switch (dns_resp) {
1533 case DNS_RESP_VALID:
1534 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001535
Christopher Faulet67957bd2017-09-27 11:00:59 +02001536 case DNS_RESP_INVALID:
1537 case DNS_RESP_QUERY_COUNT_ERROR:
1538 case DNS_RESP_WRONG_NAME:
1539 res->status = RSLV_STATUS_INVALID;
1540 ns->counters.invalid++;
1541 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001542
Christopher Faulet67957bd2017-09-27 11:00:59 +02001543 case DNS_RESP_NX_DOMAIN:
1544 res->status = RSLV_STATUS_NX;
1545 ns->counters.nx++;
1546 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001547
Christopher Faulet67957bd2017-09-27 11:00:59 +02001548 case DNS_RESP_REFUSED:
1549 res->status = RSLV_STATUS_REFUSED;
1550 ns->counters.refused++;
1551 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001552
Christopher Faulet67957bd2017-09-27 11:00:59 +02001553 case DNS_RESP_ANCOUNT_ZERO:
1554 res->status = RSLV_STATUS_OTHER;
1555 ns->counters.any_err++;
1556 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001557
Christopher Faulet67957bd2017-09-27 11:00:59 +02001558 case DNS_RESP_CNAME_ERROR:
1559 res->status = RSLV_STATUS_OTHER;
1560 ns->counters.cname_error++;
1561 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001562
Christopher Faulet67957bd2017-09-27 11:00:59 +02001563 case DNS_RESP_TRUNCATED:
1564 res->status = RSLV_STATUS_OTHER;
1565 ns->counters.truncated++;
1566 break;
Baptiste Assmanne70bc052017-08-21 16:51:09 +02001567
Christopher Faulet67957bd2017-09-27 11:00:59 +02001568 case DNS_RESP_NO_EXPECTED_RECORD:
1569 case DNS_RESP_ERROR:
1570 case DNS_RESP_INTERNAL:
1571 res->status = RSLV_STATUS_OTHER;
1572 ns->counters.other++;
1573 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001574 }
1575
Christopher Faulet67957bd2017-09-27 11:00:59 +02001576 /* Wait all nameservers response to handle errors */
1577 if (dns_resp != DNS_RESP_VALID && res->nb_responses < resolvers->nb_nameservers)
1578 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001579
Christopher Faulet67957bd2017-09-27 11:00:59 +02001580 /* Process error codes */
1581 if (dns_resp != DNS_RESP_VALID) {
1582 if (res->prefered_query_type != res->query_type) {
1583 /* The fallback on the query type was already performed,
1584 * so check the try counter. If it falls to 0, we can
1585 * report an error. Else, wait the next attempt. */
1586 if (!res->try)
1587 goto report_res_error;
1588 }
1589 else {
1590 /* Fallback from A to AAAA or the opposite and re-send
1591 * the resolution immediately. try counter is not
1592 * decremented. */
1593 if (res->prefered_query_type == DNS_RTYPE_A) {
1594 res->query_type = DNS_RTYPE_AAAA;
1595 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001596 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001597 else if (res->prefered_query_type == DNS_RTYPE_AAAA) {
1598 res->query_type = DNS_RTYPE_A;
1599 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001600 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001601 }
1602 continue;
1603 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001604
Christopher Faulet67957bd2017-09-27 11:00:59 +02001605 /* Now let's check the query's dname corresponds to the one we
1606 * sent. We can check only the first query of the list. We send
1607 * one query at a time so we get one query in the response */
1608 query = LIST_NEXT(&res->response.query_list, struct dns_query_item *, list);
1609 if (query && memcmp(query->name, res->hostname_dn, res->hostname_dn_len) != 0) {
1610 dns_resp = DNS_RESP_WRONG_NAME;
1611 ns->counters.other++;
1612 goto report_res_error;
1613 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001614
Christopher Faulet67957bd2017-09-27 11:00:59 +02001615 /* So the resolution succeeded */
1616 res->status = RSLV_STATUS_VALID;
1617 res->last_valid = now_ms;
1618 ns->counters.valid++;
1619 goto report_res_success;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001620
Christopher Faulet67957bd2017-09-27 11:00:59 +02001621 report_res_error:
1622 list_for_each_entry(req, &res->requesters, list)
1623 req->requester_error_cb(req, dns_resp);
1624 dns_reset_resolution(res);
1625 LIST_DEL(&res->list);
1626 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1627 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001628
Christopher Faulet67957bd2017-09-27 11:00:59 +02001629 report_res_success:
1630 /* Only the 1rst requester s managed by the server, others are
1631 * from the cache */
1632 tmpns = ns;
1633 list_for_each_entry(req, &res->requesters, list) {
Olivier Houchard28381072017-11-06 17:30:28 +01001634 struct server *s = objt_server(req->owner);
1635
1636 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001637 HA_SPIN_LOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001638 req->requester_cb(req, tmpns);
Olivier Houchard28381072017-11-06 17:30:28 +01001639 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001640 HA_SPIN_UNLOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001641 tmpns = NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001642 }
Baptiste Assmann42746372017-05-03 12:12:02 +02001643
Christopher Faulet67957bd2017-09-27 11:00:59 +02001644 dns_reset_resolution(res);
1645 LIST_DEL(&res->list);
1646 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1647 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001648 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001649 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001650 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001651}
William Lallemand69e96442016-11-19 00:58:54 +01001652
Christopher Faulet67957bd2017-09-27 11:00:59 +02001653/* Called when a resolvers network socket is ready to send data */
1654static void dns_resolve_send(struct dgram_conn *dgram)
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001655{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001656 struct dns_resolvers *resolvers;
1657 struct dns_nameserver *ns;
1658 struct dns_resolution *res;
1659 int fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001660
Christopher Faulet67957bd2017-09-27 11:00:59 +02001661 fd = dgram->t.sock.fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001662
Christopher Faulet67957bd2017-09-27 11:00:59 +02001663 /* check if ready for sending */
1664 if (!fd_send_ready(fd))
1665 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001666
Christopher Faulet67957bd2017-09-27 11:00:59 +02001667 /* we don't want/need to be waked up any more for sending */
1668 fd_stop_send(fd);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001669
Christopher Faulet67957bd2017-09-27 11:00:59 +02001670 /* no need to go further if we can't retrieve the nameserver */
1671 if ((ns = dgram->owner) == NULL)
1672 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001673
Christopher Faulet67957bd2017-09-27 11:00:59 +02001674 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001675 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02001676
Christopher Faulet67957bd2017-09-27 11:00:59 +02001677 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001678 int ret, len;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001679
Christopher Faulet67957bd2017-09-27 11:00:59 +02001680 if (res->nb_queries == resolvers->nb_nameservers)
1681 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001682
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001683 len = dns_build_query(res->query_id, res->query_type,
1684 resolvers->accepted_payload_size,
1685 res->hostname_dn, res->hostname_dn_len,
1686 trash.area, trash.size);
1687 if (len == -1)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001688 goto snd_error;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001689
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001690 ret = send(fd, trash.area, len, 0);
1691 if (ret != len)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001692 goto snd_error;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001693
Christopher Faulet67957bd2017-09-27 11:00:59 +02001694 ns->counters.sent++;
1695 res->nb_queries++;
1696 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001697
Christopher Faulet67957bd2017-09-27 11:00:59 +02001698 snd_error:
1699 ns->counters.snd_error++;
1700 res->nb_queries++;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001701 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001702 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001703}
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001704
Christopher Faulet67957bd2017-09-27 11:00:59 +02001705/* Processes DNS resolution. First, it checks the active list to detect expired
1706 * resolutions and retry them if possible. Else a timeout is reported. Then, it
1707 * checks the wait list to trigger new resolutions.
1708 */
Olivier Houchard9f6af332018-05-25 14:04:04 +02001709static struct task *dns_process_resolvers(struct task *t, void *context, unsigned short state)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001710{
Olivier Houchard9f6af332018-05-25 14:04:04 +02001711 struct dns_resolvers *resolvers = context;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001712 struct dns_resolution *res, *resback;
1713 int exp;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001714
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001715 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02001716
Christopher Faulet67957bd2017-09-27 11:00:59 +02001717 /* Handle all expired resolutions from the active list */
1718 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
1719 /* When we find the first resolution in the future, then we can
1720 * stop here */
1721 exp = tick_add(res->last_query, resolvers->timeout.retry);
1722 if (!tick_is_expired(exp, now_ms))
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001723 break;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001724
Christopher Faulet67957bd2017-09-27 11:00:59 +02001725 /* If current resolution has been tried too many times and
1726 * finishes in timeout we update its status and remove it from
1727 * the list */
1728 if (!res->try) {
1729 struct dns_requester *req;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001730
Christopher Faulet67957bd2017-09-27 11:00:59 +02001731 /* Notify the result to the requesters */
1732 if (!res->nb_responses)
1733 res->status = RSLV_STATUS_TIMEOUT;
1734 list_for_each_entry(req, &res->requesters, list)
1735 req->requester_error_cb(req, res->status);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001736
Christopher Faulet67957bd2017-09-27 11:00:59 +02001737 /* Clean up resolution info and remove it from the
1738 * current list */
1739 dns_reset_resolution(res);
1740 LIST_DEL(&res->list);
1741 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
William Lallemand69e96442016-11-19 00:58:54 +01001742 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001743 else {
1744 /* Otherwise resend the DNS query and requeue the resolution */
1745 if (!res->nb_responses || res->prefered_query_type != res->query_type) {
1746 /* No response received (a real timeout) or fallback already done */
1747 res->query_type = res->prefered_query_type;
1748 res->try--;
1749 }
1750 else {
1751 /* Fallback from A to AAAA or the opposite and re-send
1752 * the resolution immediately. try counter is not
1753 * decremented. */
1754 if (res->prefered_query_type == DNS_RTYPE_A)
1755 res->query_type = DNS_RTYPE_AAAA;
1756 else if (res->prefered_query_type == DNS_RTYPE_AAAA)
1757 res->query_type = DNS_RTYPE_A;
1758 else
1759 res->try--;
1760 }
1761 dns_send_query(res);
William Lallemand69e96442016-11-19 00:58:54 +01001762 }
1763 }
William Lallemand69e96442016-11-19 00:58:54 +01001764
Christopher Faulet67957bd2017-09-27 11:00:59 +02001765 /* Handle all resolutions in the wait list */
1766 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
1767 exp = tick_add(res->last_resolution, dns_resolution_timeout(res));
1768 if (tick_isset(res->last_resolution) && !tick_is_expired(exp, now_ms))
1769 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001770
Christopher Faulet67957bd2017-09-27 11:00:59 +02001771 if (dns_run_resolution(res) != 1) {
1772 res->last_resolution = now_ms;
1773 LIST_DEL(&res->list);
1774 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001775 }
1776 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001777
Christopher Faulet67957bd2017-09-27 11:00:59 +02001778 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001779 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001780 return t;
1781}
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001782
Christopher Faulet67957bd2017-09-27 11:00:59 +02001783/* proto_udp callback functions for a DNS resolution */
1784struct dgram_data_cb resolve_dgram_cb = {
1785 .recv = dns_resolve_recv,
1786 .send = dns_resolve_send,
1787};
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001788
Christopher Faulet67957bd2017-09-27 11:00:59 +02001789/* Release memory allocated by DNS */
1790static void dns_deinit(void)
1791{
1792 struct dns_resolvers *resolvers, *resolversback;
1793 struct dns_nameserver *ns, *nsback;
1794 struct dns_resolution *res, *resback;
1795 struct dns_requester *req, *reqback;
1796 struct dns_srvrq *srvrq, *srvrqback;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001797
Christopher Faulet67957bd2017-09-27 11:00:59 +02001798 list_for_each_entry_safe(resolvers, resolversback, &dns_resolvers, list) {
1799 list_for_each_entry_safe(ns, nsback, &resolvers->nameservers, list) {
1800 free(ns->id);
1801 free((char *)ns->conf.file);
1802 if (ns->dgram && ns->dgram->t.sock.fd != -1)
1803 fd_delete(ns->dgram->t.sock.fd);
1804 free(ns->dgram);
1805 LIST_DEL(&ns->list);
1806 free(ns);
1807 }
1808
1809 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
1810 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
1811 LIST_DEL(&req->list);
1812 free(req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001813 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001814 dns_free_resolution(res);
1815 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001816
Christopher Faulet67957bd2017-09-27 11:00:59 +02001817 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
1818 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
1819 LIST_DEL(&req->list);
1820 free(req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001821 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001822 dns_free_resolution(res);
1823 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001824
Christopher Faulet67957bd2017-09-27 11:00:59 +02001825 free(resolvers->id);
1826 free((char *)resolvers->conf.file);
1827 task_delete(resolvers->t);
1828 task_free(resolvers->t);
1829 LIST_DEL(&resolvers->list);
1830 free(resolvers);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001831 }
1832
Christopher Faulet67957bd2017-09-27 11:00:59 +02001833 list_for_each_entry_safe(srvrq, srvrqback, &dns_srvrq_list, list) {
1834 free(srvrq->name);
1835 free(srvrq->hostname_dn);
1836 LIST_DEL(&srvrq->list);
1837 free(srvrq);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001838 }
1839
Willy Tarreaubafbe012017-11-24 17:34:44 +01001840 pool_destroy(dns_answer_item_pool);
1841 pool_destroy(dns_resolution_pool);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001842}
1843
Christopher Faulet67957bd2017-09-27 11:00:59 +02001844/* Finalizes the DNS configuration by allocating required resources and checking
1845 * live parameters.
1846 * Returns 0 on success, ERR_* flags otherwise.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001847 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001848static int dns_finalize_config(void)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001849{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001850 struct dns_resolvers *resolvers;
1851 struct proxy *px;
1852 int err_code = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001853
Christopher Faulet67957bd2017-09-27 11:00:59 +02001854 /* allocate pool of resolution per resolvers */
1855 list_for_each_entry(resolvers, &dns_resolvers, list) {
1856 struct dns_nameserver *ns;
1857 struct task *t;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001858
Christopher Faulet67957bd2017-09-27 11:00:59 +02001859 /* Check if we can create the socket with nameservers info */
1860 list_for_each_entry(ns, &resolvers->nameservers, list) {
1861 struct dgram_conn *dgram = NULL;
1862 int fd;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001863
Christopher Faulet67957bd2017-09-27 11:00:59 +02001864 /* Check nameserver info */
1865 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001866 ha_alert("config : resolvers '%s': can't create socket for nameserver '%s'.\n",
1867 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001868 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001869 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001870 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001871 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001872 ha_alert("config : resolvers '%s': can't connect socket for nameserver '%s'.\n",
1873 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001874 close(fd);
1875 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001876 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001877 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001878 close(fd);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001879
Christopher Faulet67957bd2017-09-27 11:00:59 +02001880 /* Create dgram structure that will hold the UPD socket
1881 * and attach it on the current nameserver */
1882 if ((dgram = calloc(1, sizeof(*dgram))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001883 ha_alert("config: resolvers '%s' : out of memory.\n",
1884 resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001885 err_code |= (ERR_ALERT|ERR_ABORT);
1886 goto err;
1887 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001888
Christopher Faulet67957bd2017-09-27 11:00:59 +02001889 /* Leave dgram partially initialized, no FD attached for
1890 * now. */
1891 dgram->owner = ns;
1892 dgram->data = &resolve_dgram_cb;
1893 dgram->t.sock.fd = -1;
1894 ns->dgram = dgram;
1895 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001896
Christopher Faulet67957bd2017-09-27 11:00:59 +02001897 /* Create the task associated to the resolvers section */
Emeric Brunc60def82017-09-27 14:59:38 +02001898 if ((t = task_new(MAX_THREADS_MASK)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001899 ha_alert("config : resolvers '%s' : out of memory.\n", resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001900 err_code |= (ERR_ALERT|ERR_ABORT);
1901 goto err;
1902 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001903
Christopher Faulet67957bd2017-09-27 11:00:59 +02001904 /* Update task's parameters */
1905 t->process = dns_process_resolvers;
1906 t->context = resolvers;
1907 resolvers->t = t;
1908 task_wakeup(t, TASK_WOKEN_INIT);
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001909 }
1910
Olivier Houchardfbc74e82017-11-24 16:54:05 +01001911 for (px = proxies_list; px; px = px->next) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001912 struct server *srv;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001913
Christopher Faulet67957bd2017-09-27 11:00:59 +02001914 for (srv = px->srv; srv; srv = srv->next) {
1915 struct dns_resolvers *resolvers;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001916
Christopher Faulet67957bd2017-09-27 11:00:59 +02001917 if (!srv->resolvers_id)
1918 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001919
Christopher Faulet67957bd2017-09-27 11:00:59 +02001920 if ((resolvers = find_resolvers_by_id(srv->resolvers_id)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001921 ha_alert("config : %s '%s', server '%s': unable to find required resolvers '%s'\n",
1922 proxy_type_str(px), px->id, srv->id, srv->resolvers_id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001923 err_code |= (ERR_ALERT|ERR_ABORT);
1924 continue;
1925 }
1926 srv->resolvers = resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001927
Christopher Faulet67957bd2017-09-27 11:00:59 +02001928 if (srv->srvrq && !srv->srvrq->resolvers) {
1929 srv->srvrq->resolvers = srv->resolvers;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001930 if (dns_link_resolution(srv->srvrq, OBJ_TYPE_SRVRQ, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001931 ha_alert("config : %s '%s' : unable to set DNS resolution for server '%s'.\n",
1932 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001933 err_code |= (ERR_ALERT|ERR_ABORT);
1934 continue;
1935 }
1936 }
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001937 if (dns_link_resolution(srv, OBJ_TYPE_SERVER, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001938 ha_alert("config : %s '%s', unable to set DNS resolution for server '%s'.\n",
1939 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001940 err_code |= (ERR_ALERT|ERR_ABORT);
1941 continue;
1942 }
1943 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001944 }
1945
Christopher Faulet67957bd2017-09-27 11:00:59 +02001946 if (err_code & (ERR_ALERT|ERR_ABORT))
1947 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001948
Christopher Faulet67957bd2017-09-27 11:00:59 +02001949 return err_code;
1950 err:
1951 dns_deinit();
1952 return err_code;
1953
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001954}
1955
Christopher Faulet67957bd2017-09-27 11:00:59 +02001956/* if an arg is found, it sets the resolvers section pointer into cli.p0 */
Aurélien Nephtaliabbf6072018-04-18 13:26:46 +02001957static int cli_parse_stat_resolvers(char **args, char *payload, struct appctx *appctx, void *private)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001958{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001959 struct dns_resolvers *presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001960
Christopher Faulet67957bd2017-09-27 11:00:59 +02001961 if (*args[2]) {
1962 list_for_each_entry(presolvers, &dns_resolvers, list) {
1963 if (strcmp(presolvers->id, args[2]) == 0) {
1964 appctx->ctx.cli.p0 = presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001965 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001966 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001967 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001968 if (appctx->ctx.cli.p0 == NULL) {
1969 appctx->ctx.cli.severity = LOG_ERR;
1970 appctx->ctx.cli.msg = "Can't find that resolvers section\n";
1971 appctx->st0 = CLI_ST_PRINT;
1972 return 1;
1973 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001974 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001975 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001976}
1977
Christopher Faulet67957bd2017-09-27 11:00:59 +02001978/* Dumps counters from all resolvers section and associated name servers. It
1979 * returns 0 if the output buffer is full and it needs to be called again,
1980 * otherwise non-zero. It may limit itself to the resolver pointed to by
Willy Tarreau777b5602016-12-16 18:06:26 +01001981 * <cli.p0> if it's not null.
William Lallemand69e96442016-11-19 00:58:54 +01001982 */
1983static int cli_io_handler_dump_resolvers_to_buffer(struct appctx *appctx)
1984{
1985 struct stream_interface *si = appctx->owner;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001986 struct dns_resolvers *resolvers;
1987 struct dns_nameserver *ns;
William Lallemand69e96442016-11-19 00:58:54 +01001988
1989 chunk_reset(&trash);
1990
1991 switch (appctx->st2) {
1992 case STAT_ST_INIT:
1993 appctx->st2 = STAT_ST_LIST; /* let's start producing data */
1994 /* fall through */
1995
1996 case STAT_ST_LIST:
1997 if (LIST_ISEMPTY(&dns_resolvers)) {
1998 chunk_appendf(&trash, "No resolvers found\n");
1999 }
2000 else {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002001 list_for_each_entry(resolvers, &dns_resolvers, list) {
2002 if (appctx->ctx.cli.p0 != NULL && appctx->ctx.cli.p0 != resolvers)
William Lallemand69e96442016-11-19 00:58:54 +01002003 continue;
2004
Christopher Faulet67957bd2017-09-27 11:00:59 +02002005 chunk_appendf(&trash, "Resolvers section %s\n", resolvers->id);
2006 list_for_each_entry(ns, &resolvers->nameservers, list) {
2007 chunk_appendf(&trash, " nameserver %s:\n", ns->id);
2008 chunk_appendf(&trash, " sent: %lld\n", ns->counters.sent);
2009 chunk_appendf(&trash, " snd_error: %lld\n", ns->counters.snd_error);
2010 chunk_appendf(&trash, " valid: %lld\n", ns->counters.valid);
2011 chunk_appendf(&trash, " update: %lld\n", ns->counters.update);
2012 chunk_appendf(&trash, " cname: %lld\n", ns->counters.cname);
2013 chunk_appendf(&trash, " cname_error: %lld\n", ns->counters.cname_error);
2014 chunk_appendf(&trash, " any_err: %lld\n", ns->counters.any_err);
2015 chunk_appendf(&trash, " nx: %lld\n", ns->counters.nx);
2016 chunk_appendf(&trash, " timeout: %lld\n", ns->counters.timeout);
2017 chunk_appendf(&trash, " refused: %lld\n", ns->counters.refused);
2018 chunk_appendf(&trash, " other: %lld\n", ns->counters.other);
2019 chunk_appendf(&trash, " invalid: %lld\n", ns->counters.invalid);
2020 chunk_appendf(&trash, " too_big: %lld\n", ns->counters.too_big);
2021 chunk_appendf(&trash, " truncated: %lld\n", ns->counters.truncated);
2022 chunk_appendf(&trash, " outdated: %lld\n", ns->counters.outdated);
William Lallemand69e96442016-11-19 00:58:54 +01002023 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002024 chunk_appendf(&trash, "\n");
William Lallemand69e96442016-11-19 00:58:54 +01002025 }
2026 }
2027
2028 /* display response */
Willy Tarreau06d80a92017-10-19 14:32:15 +02002029 if (ci_putchk(si_ic(si), &trash) == -1) {
William Lallemand69e96442016-11-19 00:58:54 +01002030 /* let's try again later from this session. We add ourselves into
2031 * this session's users so that it can remove us upon termination.
2032 */
Willy Tarreaudb398432018-11-15 11:08:52 +01002033 si_rx_room_blk(si);
William Lallemand69e96442016-11-19 00:58:54 +01002034 return 0;
2035 }
William Lallemand69e96442016-11-19 00:58:54 +01002036 /* fall through */
2037
2038 default:
2039 appctx->st2 = STAT_ST_FIN;
2040 return 1;
2041 }
2042}
2043
2044/* register cli keywords */
Christopher Fauletff88efb2017-10-03 16:00:57 +02002045static struct cli_kw_list cli_kws = {{ }, {
2046 { { "show", "resolvers", NULL }, "show resolvers [id]: dumps counters from all resolvers section and\n"
2047 " associated name servers",
2048 cli_parse_stat_resolvers, cli_io_handler_dump_resolvers_to_buffer },
2049 {{},}
2050 }
2051};
William Lallemand69e96442016-11-19 00:58:54 +01002052
2053
2054__attribute__((constructor))
2055static void __dns_init(void)
2056{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002057 dns_answer_item_pool = create_pool("dns_answer_item", sizeof(struct dns_answer_item), MEM_F_SHARED);
2058 dns_resolution_pool = create_pool("dns_resolution", sizeof(struct dns_resolution), MEM_F_SHARED);
2059
Baptiste Assmann044fd5b2018-08-10 10:56:38 +02002060 cfg_register_postparser("dns runtime resolver", dns_finalize_config);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002061 hap_register_post_deinit(dns_deinit);
2062
William Lallemand69e96442016-11-19 00:58:54 +01002063 cli_register_kw(&cli_kws);
2064}