blob: 11e3f362198308e9b37eb00c97a625b5440ab839 [file] [log] [blame]
Emeric Brunc9437992021-02-12 19:42:55 +01001/*
2 * Name server resolution
3 *
4 * Copyright 2014 Baptiste Assmann <bedis9@gmail.com>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <errno.h>
14#include <fcntl.h>
15#include <stdio.h>
16#include <stdlib.h>
17#include <string.h>
18#include <unistd.h>
19
20#include <sys/types.h>
21
Emeric Brun0c4a8a32021-06-11 10:48:45 +020022#include <import/ebistree.h>
23
Emeric Brunc9437992021-02-12 19:42:55 +010024#include <haproxy/action.h>
25#include <haproxy/api.h>
26#include <haproxy/cfgparse.h>
27#include <haproxy/channel.h>
28#include <haproxy/check.h>
29#include <haproxy/cli.h>
30#include <haproxy/dns.h>
31#include <haproxy/errors.h>
32#include <haproxy/fd.h>
Emeric Brunc9437992021-02-12 19:42:55 +010033#include <haproxy/http_rules.h>
34#include <haproxy/log.h>
35#include <haproxy/net_helper.h>
36#include <haproxy/protocol.h>
37#include <haproxy/proxy.h>
38#include <haproxy/resolvers.h>
39#include <haproxy/ring.h>
40#include <haproxy/sample.h>
41#include <haproxy/server.h>
42#include <haproxy/stats.h>
43#include <haproxy/stream_interface.h>
44#include <haproxy/task.h>
45#include <haproxy/tcp_rules.h>
46#include <haproxy/ticks.h>
47#include <haproxy/time.h>
Willy Tarreauca14dd52021-05-08 12:59:47 +020048#include <haproxy/tools.h>
Emeric Brunc9437992021-02-12 19:42:55 +010049#include <haproxy/vars.h>
50
51
52struct list sec_resolvers = LIST_HEAD_INIT(sec_resolvers);
53struct list resolv_srvrq_list = LIST_HEAD_INIT(resolv_srvrq_list);
54
55static THREAD_LOCAL uint64_t resolv_query_id_seed = 0; /* random seed */
56struct resolvers *curr_resolvers = NULL;
57
58DECLARE_STATIC_POOL(resolv_answer_item_pool, "resolv_answer_item", sizeof(struct resolv_answer_item));
59DECLARE_STATIC_POOL(resolv_resolution_pool, "resolv_resolution", sizeof(struct resolv_resolution));
60DECLARE_POOL(resolv_requester_pool, "resolv_requester", sizeof(struct resolv_requester));
61
62static unsigned int resolution_uuid = 1;
63unsigned int resolv_failed_resolutions = 0;
64
65enum {
66 DNS_STAT_ID,
67 DNS_STAT_PID,
68 DNS_STAT_SENT,
69 DNS_STAT_SND_ERROR,
70 DNS_STAT_VALID,
71 DNS_STAT_UPDATE,
72 DNS_STAT_CNAME,
73 DNS_STAT_CNAME_ERROR,
74 DNS_STAT_ANY_ERR,
75 DNS_STAT_NX,
76 DNS_STAT_TIMEOUT,
77 DNS_STAT_REFUSED,
78 DNS_STAT_OTHER,
79 DNS_STAT_INVALID,
80 DNS_STAT_TOO_BIG,
81 DNS_STAT_TRUNCATED,
82 DNS_STAT_OUTDATED,
83 DNS_STAT_END,
84};
85
86static struct name_desc dns_stats[] = {
87 [DNS_STAT_ID] = { .name = "id", .desc = "ID" },
88 [DNS_STAT_PID] = { .name = "pid", .desc = "Parent ID" },
89 [DNS_STAT_SENT] = { .name = "sent", .desc = "Sent" },
90 [DNS_STAT_SND_ERROR] = { .name = "send_error", .desc = "Send error" },
91 [DNS_STAT_VALID] = { .name = "valid", .desc = "Valid" },
92 [DNS_STAT_UPDATE] = { .name = "update", .desc = "Update" },
93 [DNS_STAT_CNAME] = { .name = "cname", .desc = "CNAME" },
94 [DNS_STAT_CNAME_ERROR] = { .name = "cname_error", .desc = "CNAME error" },
95 [DNS_STAT_ANY_ERR] = { .name = "any_err", .desc = "Any errors" },
96 [DNS_STAT_NX] = { .name = "nx", .desc = "NX" },
97 [DNS_STAT_TIMEOUT] = { .name = "timeout", .desc = "Timeout" },
98 [DNS_STAT_REFUSED] = { .name = "refused", .desc = "Refused" },
99 [DNS_STAT_OTHER] = { .name = "other", .desc = "Other" },
100 [DNS_STAT_INVALID] = { .name = "invalid", .desc = "Invalid" },
101 [DNS_STAT_TOO_BIG] = { .name = "too_big", .desc = "Too big" },
102 [DNS_STAT_TRUNCATED] = { .name = "truncated", .desc = "Truncated" },
103 [DNS_STAT_OUTDATED] = { .name = "outdated", .desc = "Outdated" },
104};
105
106static struct dns_counters dns_counters;
107
108static void dns_fill_stats(void *d, struct field *stats)
109{
110 struct dns_counters *counters = d;
111 stats[DNS_STAT_ID] = mkf_str(FO_CONFIG, counters->id);
112 stats[DNS_STAT_PID] = mkf_str(FO_CONFIG, counters->pid);
113 stats[DNS_STAT_SENT] = mkf_u64(FN_GAUGE, counters->sent);
114 stats[DNS_STAT_SND_ERROR] = mkf_u64(FN_GAUGE, counters->snd_error);
115 stats[DNS_STAT_VALID] = mkf_u64(FN_GAUGE, counters->valid);
116 stats[DNS_STAT_UPDATE] = mkf_u64(FN_GAUGE, counters->update);
117 stats[DNS_STAT_CNAME] = mkf_u64(FN_GAUGE, counters->cname);
118 stats[DNS_STAT_CNAME_ERROR] = mkf_u64(FN_GAUGE, counters->cname_error);
119 stats[DNS_STAT_ANY_ERR] = mkf_u64(FN_GAUGE, counters->any_err);
120 stats[DNS_STAT_NX] = mkf_u64(FN_GAUGE, counters->nx);
121 stats[DNS_STAT_TIMEOUT] = mkf_u64(FN_GAUGE, counters->timeout);
122 stats[DNS_STAT_REFUSED] = mkf_u64(FN_GAUGE, counters->refused);
123 stats[DNS_STAT_OTHER] = mkf_u64(FN_GAUGE, counters->other);
124 stats[DNS_STAT_INVALID] = mkf_u64(FN_GAUGE, counters->invalid);
125 stats[DNS_STAT_TOO_BIG] = mkf_u64(FN_GAUGE, counters->too_big);
126 stats[DNS_STAT_TRUNCATED] = mkf_u64(FN_GAUGE, counters->truncated);
127 stats[DNS_STAT_OUTDATED] = mkf_u64(FN_GAUGE, counters->outdated);
128}
129
130static struct stats_module dns_stats_module = {
131 .name = "dns",
132 .domain_flags = STATS_DOMAIN_DNS << STATS_DOMAIN,
133 .fill_stats = dns_fill_stats,
134 .stats = dns_stats,
135 .stats_count = DNS_STAT_END,
136 .counters = &dns_counters,
137 .counters_size = sizeof(dns_counters),
138 .clearable = 0,
139};
140
141INITCALL1(STG_REGISTER, stats_register_module, &dns_stats_module);
142
143/* Returns a pointer to the resolvers matching the id <id>. NULL is returned if
144 * no match is found.
145 */
146struct resolvers *find_resolvers_by_id(const char *id)
147{
148 struct resolvers *res;
149
150 list_for_each_entry(res, &sec_resolvers, list) {
151 if (strcmp(res->id, id) == 0)
152 return res;
153 }
154 return NULL;
155}
156
157/* Compare hostnames in a case-insensitive way .
158 * Returns 0 if they are the same, non-zero otherwise
159 */
160static __inline int resolv_hostname_cmp(const char *name1, const char *name2, int len)
161{
162 int i;
163
164 for (i = 0; i < len; i++)
165 if (tolower((unsigned char)name1[i]) != tolower((unsigned char)name2[i]))
166 return -1;
167 return 0;
168}
169
170/* Returns a pointer on the SRV request matching the name <name> for the proxy
171 * <px>. NULL is returned if no match is found.
172 */
173struct resolv_srvrq *find_srvrq_by_name(const char *name, struct proxy *px)
174{
175 struct resolv_srvrq *srvrq;
176
177 list_for_each_entry(srvrq, &resolv_srvrq_list, list) {
178 if (srvrq->proxy == px && strcmp(srvrq->name, name) == 0)
179 return srvrq;
180 }
181 return NULL;
182}
183
184/* Allocates a new SRVRQ for the given server with the name <fqdn>. It returns
185 * NULL if an error occurred. */
186struct resolv_srvrq *new_resolv_srvrq(struct server *srv, char *fqdn)
187{
188 struct proxy *px = srv->proxy;
189 struct resolv_srvrq *srvrq = NULL;
190 int fqdn_len, hostname_dn_len;
191
192 fqdn_len = strlen(fqdn);
193 hostname_dn_len = resolv_str_to_dn_label(fqdn, fqdn_len + 1, trash.area,
194 trash.size);
195 if (hostname_dn_len == -1) {
196 ha_alert("config : %s '%s', server '%s': failed to parse FQDN '%s'\n",
197 proxy_type_str(px), px->id, srv->id, fqdn);
198 goto err;
199 }
200
201 if ((srvrq = calloc(1, sizeof(*srvrq))) == NULL) {
202 ha_alert("config : %s '%s', server '%s': out of memory\n",
203 proxy_type_str(px), px->id, srv->id);
204 goto err;
205 }
206 srvrq->obj_type = OBJ_TYPE_SRVRQ;
207 srvrq->proxy = px;
208 srvrq->name = strdup(fqdn);
209 srvrq->hostname_dn = strdup(trash.area);
210 srvrq->hostname_dn_len = hostname_dn_len;
211 if (!srvrq->name || !srvrq->hostname_dn) {
212 ha_alert("config : %s '%s', server '%s': out of memory\n",
213 proxy_type_str(px), px->id, srv->id);
214 goto err;
215 }
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200216 LIST_INIT(&srvrq->attached_servers);
217 srvrq->named_servers = EB_ROOT;
Willy Tarreau2b718102021-04-21 07:32:39 +0200218 LIST_APPEND(&resolv_srvrq_list, &srvrq->list);
Emeric Brunc9437992021-02-12 19:42:55 +0100219 return srvrq;
220
221 err:
222 if (srvrq) {
223 free(srvrq->name);
224 free(srvrq->hostname_dn);
225 free(srvrq);
226 }
227 return NULL;
228}
229
230
Baptiste Assmann6a8d11d2021-03-10 12:22:18 +0100231/* finds and return the SRV answer item associated to a requester (whose type is 'server').
232 *
233 * returns NULL in case of error or not found.
234 */
235struct resolv_answer_item *find_srvrq_answer_record(const struct resolv_requester *requester)
236{
237 struct resolv_resolution *res;
238 struct resolv_answer_item *item;
239 struct server *srv;
240
241 if (!requester)
242 return NULL;
243
244 if ((srv = objt_server(requester->owner)) == NULL)
245 return NULL;
246 /* check if the server is managed by a SRV record */
247 if (srv->srvrq == NULL)
248 return NULL;
249
250 res = srv->srvrq->requester->resolution;
251 /* search an ANSWER record whose target points to the server's hostname and whose port is
252 * the same as server's svc_port */
253 list_for_each_entry(item, &res->response.answer_list, list) {
254 if (resolv_hostname_cmp(srv->hostname_dn, item->target, srv->hostname_dn_len) == 0 &&
255 (srv->svc_port == item->port))
256 return item;
257 }
258
259 return NULL;
260}
261
Emeric Brunc9437992021-02-12 19:42:55 +0100262/* 2 bytes random generator to generate DNS query ID */
263static inline uint16_t resolv_rnd16(void)
264{
265 if (!resolv_query_id_seed)
266 resolv_query_id_seed = now_ms;
267 resolv_query_id_seed ^= resolv_query_id_seed << 13;
268 resolv_query_id_seed ^= resolv_query_id_seed >> 7;
269 resolv_query_id_seed ^= resolv_query_id_seed << 17;
270 return resolv_query_id_seed;
271}
272
273
274static inline int resolv_resolution_timeout(struct resolv_resolution *res)
275{
276 return res->resolvers->timeout.resolve;
277}
278
279/* Updates a resolvers' task timeout for next wake up and queue it */
280static void resolv_update_resolvers_timeout(struct resolvers *resolvers)
281{
282 struct resolv_resolution *res;
283 int next;
284
285 next = tick_add(now_ms, resolvers->timeout.resolve);
286 if (!LIST_ISEMPTY(&resolvers->resolutions.curr)) {
287 res = LIST_NEXT(&resolvers->resolutions.curr, struct resolv_resolution *, list);
288 next = MIN(next, tick_add(res->last_query, resolvers->timeout.retry));
289 }
290
291 list_for_each_entry(res, &resolvers->resolutions.wait, list)
292 next = MIN(next, tick_add(res->last_resolution, resolv_resolution_timeout(res)));
293
294 resolvers->t->expire = next;
295 task_queue(resolvers->t);
296}
297
298/* Forges a DNS query. It needs the following information from the caller:
299 * - <query_id> : the DNS query id corresponding to this query
300 * - <query_type> : DNS_RTYPE_* request DNS record type (A, AAAA, ANY...)
301 * - <hostname_dn> : hostname in domain name format
302 * - <hostname_dn_len> : length of <hostname_dn>
303 *
304 * To store the query, the caller must pass a buffer <buf> and its size
305 * <bufsize>. It returns the number of written bytes in success, -1 if <buf> is
306 * too short.
307 */
308static int resolv_build_query(int query_id, int query_type, unsigned int accepted_payload_size,
309 char *hostname_dn, int hostname_dn_len, char *buf, int bufsize)
310{
311 struct dns_header dns_hdr;
312 struct dns_question qinfo;
313 struct dns_additional_record edns;
314 char *p = buf;
315
316 if (sizeof(dns_hdr) + sizeof(qinfo) + sizeof(edns) + hostname_dn_len >= bufsize)
317 return -1;
318
319 memset(buf, 0, bufsize);
320
321 /* Set dns query headers */
322 dns_hdr.id = (unsigned short) htons(query_id);
323 dns_hdr.flags = htons(0x0100); /* qr=0, opcode=0, aa=0, tc=0, rd=1, ra=0, z=0, rcode=0 */
324 dns_hdr.qdcount = htons(1); /* 1 question */
325 dns_hdr.ancount = 0;
326 dns_hdr.nscount = 0;
327 dns_hdr.arcount = htons(1);
328 memcpy(p, &dns_hdr, sizeof(dns_hdr));
329 p += sizeof(dns_hdr);
330
331 /* Set up query hostname */
332 memcpy(p, hostname_dn, hostname_dn_len);
333 p += hostname_dn_len;
334 *p++ = 0;
335
336 /* Set up query info (type and class) */
337 qinfo.qtype = htons(query_type);
338 qinfo.qclass = htons(DNS_RCLASS_IN);
339 memcpy(p, &qinfo, sizeof(qinfo));
340 p += sizeof(qinfo);
341
342 /* Set the DNS extension */
343 edns.name = 0;
344 edns.type = htons(DNS_RTYPE_OPT);
345 edns.udp_payload_size = htons(accepted_payload_size);
346 edns.extension = 0;
347 edns.data_length = 0;
348 memcpy(p, &edns, sizeof(edns));
349 p += sizeof(edns);
350
351 return (p - buf);
352}
353
354/* Sends a DNS query to resolvers associated to a resolution. It returns 0 on
355 * success, -1 otherwise.
356 */
357static int resolv_send_query(struct resolv_resolution *resolution)
358{
359 struct resolvers *resolvers = resolution->resolvers;
360 struct dns_nameserver *ns;
361 int len;
362
363 /* Update resolution */
364 resolution->nb_queries = 0;
365 resolution->nb_responses = 0;
366 resolution->last_query = now_ms;
367
368 len = resolv_build_query(resolution->query_id, resolution->query_type,
369 resolvers->accepted_payload_size,
370 resolution->hostname_dn, resolution->hostname_dn_len,
371 trash.area, trash.size);
372
373 list_for_each_entry(ns, &resolvers->nameservers, list) {
374 if (len < 0) {
375 ns->counters->snd_error++;
376 continue;
377 }
378
379 if (dns_send_nameserver(ns, trash.area, len) < 0)
380 ns->counters->snd_error++;
381 else
382 resolution->nb_queries++;
383 }
384
385 /* Push the resolution at the end of the active list */
Willy Tarreau2b718102021-04-21 07:32:39 +0200386 LIST_DELETE(&resolution->list);
387 LIST_APPEND(&resolvers->resolutions.curr, &resolution->list);
Emeric Brunc9437992021-02-12 19:42:55 +0100388 return 0;
389}
390
391/* Prepares and sends a DNS resolution. It returns 1 if the query was sent, 0 if
392 * skipped and -1 if an error occurred.
393 */
394static int
395resolv_run_resolution(struct resolv_resolution *resolution)
396{
397 struct resolvers *resolvers = resolution->resolvers;
398 int query_id, i;
399
400 /* Avoid sending requests for resolutions that don't yet have an
401 * hostname, ie resolutions linked to servers that do not yet have an
402 * fqdn */
403 if (!resolution->hostname_dn)
404 return 0;
405
406 /* Check if a resolution has already been started for this server return
407 * directly to avoid resolution pill up. */
408 if (resolution->step != RSLV_STEP_NONE)
409 return 0;
410
411 /* Generates a new query id. We try at most 100 times to find a free
412 * query id */
413 for (i = 0; i < 100; ++i) {
414 query_id = resolv_rnd16();
415 if (!eb32_lookup(&resolvers->query_ids, query_id))
416 break;
417 query_id = -1;
418 }
419 if (query_id == -1) {
420 send_log(NULL, LOG_NOTICE,
421 "could not generate a query id for %s, in resolvers %s.\n",
422 resolution->hostname_dn, resolvers->id);
423 return -1;
424 }
425
426 /* Update resolution parameters */
427 resolution->query_id = query_id;
428 resolution->qid.key = query_id;
429 resolution->step = RSLV_STEP_RUNNING;
430 resolution->query_type = resolution->prefered_query_type;
431 resolution->try = resolvers->resolve_retries;
432 eb32_insert(&resolvers->query_ids, &resolution->qid);
433
434 /* Send the DNS query */
435 resolution->try -= 1;
436 resolv_send_query(resolution);
437 return 1;
438}
439
440/* Performs a name resolution for the requester <req> */
441void resolv_trigger_resolution(struct resolv_requester *req)
442{
443 struct resolvers *resolvers;
444 struct resolv_resolution *res;
445 int exp;
446
447 if (!req || !req->resolution)
448 return;
449 res = req->resolution;
450 resolvers = res->resolvers;
451
452 /* The resolution must not be triggered yet. Use the cached response, if
453 * valid */
454 exp = tick_add(res->last_resolution, resolvers->hold.valid);
455 if (resolvers->t && (res->status != RSLV_STATUS_VALID ||
456 !tick_isset(res->last_resolution) || tick_is_expired(exp, now_ms)))
457 task_wakeup(resolvers->t, TASK_WOKEN_OTHER);
458}
459
460
461/* Resets some resolution parameters to initial values and also delete the query
462 * ID from the resolver's tree.
463 */
464static void resolv_reset_resolution(struct resolv_resolution *resolution)
465{
466 /* update resolution status */
467 resolution->step = RSLV_STEP_NONE;
468 resolution->try = 0;
469 resolution->last_resolution = now_ms;
470 resolution->nb_queries = 0;
471 resolution->nb_responses = 0;
472 resolution->query_type = resolution->prefered_query_type;
473
474 /* clean up query id */
475 eb32_delete(&resolution->qid);
476 resolution->query_id = 0;
477 resolution->qid.key = 0;
478}
479
480/* Returns the query id contained in a DNS response */
481static inline unsigned short resolv_response_get_query_id(unsigned char *resp)
482{
483 return resp[0] * 256 + resp[1];
484}
485
486
487/* Analyses, re-builds and copies the name <name> from the DNS response packet
488 * <buffer>. <name> must point to the 'data_len' information or pointer 'c0'
489 * for compressed data. The result is copied into <dest>, ensuring we don't
490 * overflow using <dest_len> Returns the number of bytes the caller can move
491 * forward. If 0 it means an error occurred while parsing the name. <offset> is
492 * the number of bytes the caller could move forward.
493 */
494int resolv_read_name(unsigned char *buffer, unsigned char *bufend,
495 unsigned char *name, char *destination, int dest_len,
496 int *offset, unsigned int depth)
497{
498 int nb_bytes = 0, n = 0;
499 int label_len;
500 unsigned char *reader = name;
501 char *dest = destination;
502
503 while (1) {
504 if (reader >= bufend)
505 goto err;
506
507 /* Name compression is in use */
508 if ((*reader & 0xc0) == 0xc0) {
509 if (reader + 1 >= bufend)
510 goto err;
511
512 /* Must point BEFORE current position */
513 if ((buffer + reader[1]) > reader)
514 goto err;
515
516 if (depth++ > 100)
517 goto err;
518
519 n = resolv_read_name(buffer, bufend, buffer + (*reader & 0x3f)*256 + reader[1],
520 dest, dest_len - nb_bytes, offset, depth);
521 if (n == 0)
522 goto err;
523
524 dest += n;
525 nb_bytes += n;
526 goto out;
527 }
528
529 label_len = *reader;
530 if (label_len == 0)
531 goto out;
532
533 /* Check if:
534 * - we won't read outside the buffer
535 * - there is enough place in the destination
536 */
537 if ((reader + label_len >= bufend) || (nb_bytes + label_len >= dest_len))
538 goto err;
539
540 /* +1 to take label len + label string */
541 label_len++;
542
543 memcpy(dest, reader, label_len);
544
545 dest += label_len;
546 nb_bytes += label_len;
547 reader += label_len;
548 }
549
550 out:
551 /* offset computation:
552 * parse from <name> until finding either NULL or a pointer "c0xx"
553 */
554 reader = name;
555 *offset = 0;
556 while (reader < bufend) {
557 if ((reader[0] & 0xc0) == 0xc0) {
558 *offset += 2;
559 break;
560 }
561 else if (*reader == 0) {
562 *offset += 1;
563 break;
564 }
565 *offset += 1;
566 ++reader;
567 }
568 return nb_bytes;
569
570 err:
571 return 0;
572}
573
Christopher Faulet5f8ccff2021-06-15 16:08:48 +0200574/* Cleanup fqdn/port and address of a server attached to a SRV resolution. This
575 * happens when an SRV item is purged or when the server status is considered as
576 * obsolete.
577 *
578 * Must be called with the DNS lock held.
579 */
580static void resolv_srvrq_cleanup_srv(struct server *srv)
581{
582 resolv_unlink_resolution(srv->resolv_requester, 0);
583 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
584 srvrq_update_srv_status(srv, 1);
585 ha_free(&srv->hostname);
586 ha_free(&srv->hostname_dn);
587 srv->hostname_dn_len = 0;
588 memset(&srv->addr, 0, sizeof(srv->addr));
589 srv->svc_port = 0;
590 srv->flags |= SRV_F_NO_RESOLUTION;
Christopher Fauleta62d9742021-06-15 16:14:37 +0200591
592 ebpt_delete(&srv->host_dn);
593 ha_free(&srv->host_dn.key);
594
Christopher Faulet5f8ccff2021-06-15 16:08:48 +0200595 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
596 LIST_DELETE(&srv->srv_rec_item);
597 LIST_APPEND(&srv->srvrq->attached_servers, &srv->srv_rec_item);
Christopher Faulet2c0f5272021-06-15 16:17:17 +0200598
599 srv->srvrq_check->expire = TICK_ETERNITY;
Christopher Faulet5f8ccff2021-06-15 16:08:48 +0200600}
601
Christopher Faulet2c0f5272021-06-15 16:17:17 +0200602/* Takes care to cleanup a server resolution when it is outdated. This only
603 * happens for a server relying on a SRV record.
604 */
605static struct task *resolv_srvrq_expire_task(struct task *t, void *context, unsigned int state)
606{
607 struct server *srv = context;
608
609 if (!tick_is_expired(t->expire, now_ms))
610 goto end;
611
Christopher Faulet152b50c2021-06-18 09:05:49 +0200612 HA_SPIN_LOCK(DNS_LOCK, &srv->srvrq->resolvers->lock);
Christopher Faulet2c0f5272021-06-15 16:17:17 +0200613 resolv_srvrq_cleanup_srv(srv);
Christopher Faulet152b50c2021-06-18 09:05:49 +0200614 HA_SPIN_UNLOCK(DNS_LOCK, &srv->srvrq->resolvers->lock);
Christopher Faulet2c0f5272021-06-15 16:17:17 +0200615
616 end:
617 return t;
618}
619
Emeric Brunc9437992021-02-12 19:42:55 +0100620/* Checks for any obsolete record, also identify any SRV request, and try to
621 * find a corresponding server.
622*/
623static void resolv_check_response(struct resolv_resolution *res)
624{
625 struct resolvers *resolvers = res->resolvers;
Christopher Fauletdb31b442021-03-11 18:19:41 +0100626 struct resolv_requester *req;
Emeric Brunc9437992021-02-12 19:42:55 +0100627 struct resolv_answer_item *item, *itemback;
Emeric Brunf9ca5d82021-06-11 10:08:05 +0200628 struct server *srv, *srvback;
Emeric Brunc9437992021-02-12 19:42:55 +0100629 struct resolv_srvrq *srvrq;
630
631 list_for_each_entry_safe(item, itemback, &res->response.answer_list, list) {
632 struct resolv_answer_item *ar_item = item->ar_item;
633
634 /* clean up obsolete Additional record */
Christopher Faulet55c1c402021-03-11 09:36:05 +0100635 if (ar_item && tick_is_lt(tick_add(ar_item->last_seen, resolvers->hold.obsolete), now_ms)) {
Christopher Faulet3e0600f2021-03-10 18:38:37 +0100636 /* Cleaning up the AR item will trigger an extra DNS resolution, except if the SRV
637 * item is also obsolete.
638 */
Emeric Brunc9437992021-02-12 19:42:55 +0100639 pool_free(resolv_answer_item_pool, ar_item);
640 item->ar_item = NULL;
641 }
642
643 /* Remove obsolete items */
Christopher Faulet55c1c402021-03-11 09:36:05 +0100644 if (tick_is_lt(tick_add(item->last_seen, resolvers->hold.obsolete), now_ms)) {
Emeric Brunf9ca5d82021-06-11 10:08:05 +0200645 if (item->type == DNS_RTYPE_A || item->type == DNS_RTYPE_AAAA) {
Emeric Brunc9437992021-02-12 19:42:55 +0100646 /* Remove any associated server */
Emeric Brunf9ca5d82021-06-11 10:08:05 +0200647 list_for_each_entry_safe(srv, srvback, &item->attached_servers, ip_rec_item) {
648 LIST_DEL_INIT(&srv->ip_rec_item);
649 }
650 }
651 else if (item->type == DNS_RTYPE_SRV) {
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200652 /* Remove any associated server */
Christopher Faulet5f8ccff2021-06-15 16:08:48 +0200653 list_for_each_entry_safe(srv, srvback, &item->attached_servers, srv_rec_item)
654 resolv_srvrq_cleanup_srv(srv);
Emeric Brunc9437992021-02-12 19:42:55 +0100655 }
656
Willy Tarreau2b718102021-04-21 07:32:39 +0200657 LIST_DELETE(&item->list);
Emeric Brunc9437992021-02-12 19:42:55 +0100658 if (item->ar_item) {
659 pool_free(resolv_answer_item_pool, item->ar_item);
660 item->ar_item = NULL;
661 }
662 pool_free(resolv_answer_item_pool, item);
663 continue;
664 }
665
666 if (item->type != DNS_RTYPE_SRV)
667 continue;
668
669 /* Now process SRV records */
Christopher Fauletdb31b442021-03-11 18:19:41 +0100670 list_for_each_entry(req, &res->requesters, list) {
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200671 struct ebpt_node *node;
672 char target[DNS_MAX_NAME_SIZE+1];
673
674 int i;
Emeric Brunc9437992021-02-12 19:42:55 +0100675 if ((srvrq = objt_resolv_srvrq(req->owner)) == NULL)
676 continue;
677
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200678 /* Check if a server already uses that record */
679 srv = NULL;
680 list_for_each_entry(srv, &item->attached_servers, srv_rec_item) {
681 if (srv->srvrq == srvrq) {
682 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
683 goto srv_found;
Emeric Brunc9437992021-02-12 19:42:55 +0100684 }
Emeric Brunc9437992021-02-12 19:42:55 +0100685 }
686
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200687
688 /* If not empty we try to match a server
689 * in server state file tree with the same hostname
690 */
691 if (!eb_is_empty(&srvrq->named_servers)) {
692 srv = NULL;
693
694 /* convert the key to lookup in lower case */
695 for (i = 0 ; item->target[i] ; i++)
696 target[i] = tolower(item->target[i]);
Christopher Fauletc20d6422021-07-22 14:29:26 +0200697 target[i] = 0;
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200698
699 node = ebis_lookup(&srvrq->named_servers, target);
700 if (node) {
701 srv = ebpt_entry(node, struct server, host_dn);
Emeric Brunc9437992021-02-12 19:42:55 +0100702 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200703
704 /* an entry was found with the same hostname
705 * let check this node if the port matches
706 * and try next node if the hostname
707 * is still the same
708 */
709 while (1) {
710 if (srv->svc_port == item->port) {
711 /* server found, we remove it from tree */
712 ebpt_delete(node);
Christopher Fauleta62d9742021-06-15 16:14:37 +0200713 ha_free(&srv->host_dn.key);
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200714 goto srv_found;
715 }
716
717 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
718
719 node = ebpt_next(node);
720 if (!node)
721 break;
722
723 srv = ebpt_entry(node, struct server, host_dn);
724 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
725
726 if ((item->data_len != srv->hostname_dn_len)
727 || resolv_hostname_cmp(srv->hostname_dn, item->target, item->data_len)) {
728 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
729 break;
730 }
731 }
Emeric Brunc9437992021-02-12 19:42:55 +0100732 }
733 }
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200734
735 /* Pick the first server listed in srvrq (those ones don't
736 * have hostname and are free to use)
737 */
738 srv = NULL;
739 list_for_each_entry(srv, &srvrq->attached_servers, srv_rec_item) {
740 LIST_DEL_INIT(&srv->srv_rec_item);
741 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
742 goto srv_found;
743 }
744 srv = NULL;
Emeric Brunc9437992021-02-12 19:42:55 +0100745
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200746srv_found:
Emeric Brunc9437992021-02-12 19:42:55 +0100747 /* And update this server, if found (srv is locked here) */
748 if (srv) {
Christopher Faulet3e0600f2021-03-10 18:38:37 +0100749 /* re-enable DNS resolution for this server by default */
750 srv->flags &= ~SRV_F_NO_RESOLUTION;
Christopher Faulet2c0f5272021-06-15 16:17:17 +0200751 srv->srvrq_check->expire = TICK_ETERNITY;
Christopher Faulet3e0600f2021-03-10 18:38:37 +0100752
Emeric Brunc9437992021-02-12 19:42:55 +0100753 /* Check if an Additional Record is associated to this SRV record.
754 * Perform some sanity checks too to ensure the record can be used.
755 * If all fine, we simply pick up the IP address found and associate
Christopher Faulet3e0600f2021-03-10 18:38:37 +0100756 * it to the server. And DNS resolution is disabled for this server.
Emeric Brunc9437992021-02-12 19:42:55 +0100757 */
758 if ((item->ar_item != NULL) &&
759 (item->ar_item->type == DNS_RTYPE_A || item->ar_item->type == DNS_RTYPE_AAAA))
Christopher Faulet3e0600f2021-03-10 18:38:37 +0100760 {
Emeric Brunc9437992021-02-12 19:42:55 +0100761
762 switch (item->ar_item->type) {
763 case DNS_RTYPE_A:
Christopher Faulet69beaa92021-02-16 12:07:47 +0100764 srv_update_addr(srv, &(((struct sockaddr_in*)&item->ar_item->address)->sin_addr), AF_INET, "DNS additional record");
Emeric Brunc9437992021-02-12 19:42:55 +0100765 break;
766 case DNS_RTYPE_AAAA:
Christopher Faulet69beaa92021-02-16 12:07:47 +0100767 srv_update_addr(srv, &(((struct sockaddr_in6*)&item->ar_item->address)->sin6_addr), AF_INET6, "DNS additional record");
Emeric Brunc9437992021-02-12 19:42:55 +0100768 break;
769 }
770
771 srv->flags |= SRV_F_NO_RESOLUTION;
Christopher Faulet3e0600f2021-03-10 18:38:37 +0100772
773 /* Unlink A/AAAA resolution for this server if there is an AR item.
774 * It is usless to perform an extra resolution
775 */
Christopher Faulet0efc0992021-03-11 18:09:53 +0100776 resolv_unlink_resolution(srv->resolv_requester, 0);
Emeric Brunc9437992021-02-12 19:42:55 +0100777 }
778
779 if (!srv->hostname_dn) {
780 const char *msg = NULL;
781 char hostname[DNS_MAX_NAME_SIZE];
782
783 if (resolv_dn_label_to_str(item->target, item->data_len+1,
784 hostname, DNS_MAX_NAME_SIZE) == -1) {
785 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
786 continue;
787 }
Christopher Faulet69beaa92021-02-16 12:07:47 +0100788 msg = srv_update_fqdn(srv, hostname, "SRV record", 1);
Emeric Brunc9437992021-02-12 19:42:55 +0100789 if (msg)
790 send_log(srv->proxy, LOG_NOTICE, "%s", msg);
791 }
792
Emeric Brun0c4a8a32021-06-11 10:48:45 +0200793 if (!LIST_INLIST(&srv->srv_rec_item))
794 LIST_APPEND(&item->attached_servers, &srv->srv_rec_item);
795
Christopher Faulet3e0600f2021-03-10 18:38:37 +0100796 if (!(srv->flags & SRV_F_NO_RESOLUTION)) {
797 /* If there is no AR item responsible of the FQDN resolution,
798 * trigger a dedicated DNS resolution
799 */
800 if (!srv->resolv_requester || !srv->resolv_requester->resolution)
801 resolv_link_resolution(srv, OBJ_TYPE_SERVER, 1);
802 }
803
Christopher Fauletab177ac2021-03-10 15:34:52 +0100804 /* Update the server status */
Christopher Faulet6b117ae2021-03-11 18:06:23 +0100805 srvrq_update_srv_status(srv, (srv->addr.ss_family != AF_INET && srv->addr.ss_family != AF_INET6));
Emeric Brunc9437992021-02-12 19:42:55 +0100806
807 srv->svc_port = item->port;
808 srv->flags &= ~SRV_F_MAPPORTS;
809
810 if (!srv->resolv_opts.ignore_weight) {
811 char weight[9];
812 int ha_weight;
813
814 /* DNS weight range if from 0 to 65535
815 * HAProxy weight is from 0 to 256
816 * The rule below ensures that weight 0 is well respected
817 * while allowing a "mapping" from DNS weight into HAProxy's one.
818 */
819 ha_weight = (item->weight + 255) / 256;
820
821 snprintf(weight, sizeof(weight), "%d", ha_weight);
822 server_parse_weight_change_request(srv, weight);
823 }
824 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
825 }
826 }
827 }
828}
829
830/* Validates that the buffer DNS response provided in <resp> and finishing
831 * before <bufend> is valid from a DNS protocol point of view.
832 *
833 * The result is stored in <resolution>' response, buf_response,
834 * response_query_records and response_answer_records members.
835 *
836 * This function returns one of the RSLV_RESP_* code to indicate the type of
837 * error found.
838 */
839static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufend,
840 struct resolv_resolution *resolution, int max_answer_records)
841{
842 unsigned char *reader;
843 char *previous_dname, tmpname[DNS_MAX_NAME_SIZE];
844 int len, flags, offset;
845 int query_record_id;
846 int nb_saved_records;
847 struct resolv_query_item *query;
848 struct resolv_answer_item *answer_record, *tmp_record;
849 struct resolv_response *r_res;
850 int i, found = 0;
851 int cause = RSLV_RESP_ERROR;
852
853 reader = resp;
854 len = 0;
855 previous_dname = NULL;
856 query = NULL;
857 answer_record = NULL;
858
859 /* Initialization of response buffer and structure */
860 r_res = &resolution->response;
861
862 /* query id */
863 if (reader + 2 >= bufend)
864 goto invalid_resp;
865
866 r_res->header.id = reader[0] * 256 + reader[1];
867 reader += 2;
868
869 /* Flags and rcode are stored over 2 bytes
870 * First byte contains:
871 * - response flag (1 bit)
872 * - opcode (4 bits)
873 * - authoritative (1 bit)
874 * - truncated (1 bit)
875 * - recursion desired (1 bit)
876 */
877 if (reader + 2 >= bufend)
878 goto invalid_resp;
879
880 flags = reader[0] * 256 + reader[1];
881
882 if ((flags & DNS_FLAG_REPLYCODE) != DNS_RCODE_NO_ERROR) {
883 if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_NX_DOMAIN) {
884 cause = RSLV_RESP_NX_DOMAIN;
885 goto return_error;
886 }
887 else if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_REFUSED) {
888 cause = RSLV_RESP_REFUSED;
889 goto return_error;
890 }
891 else {
892 cause = RSLV_RESP_ERROR;
893 goto return_error;
894 }
895 }
896
897 /* Move forward 2 bytes for flags */
898 reader += 2;
899
900 /* 2 bytes for question count */
901 if (reader + 2 >= bufend)
902 goto invalid_resp;
903 r_res->header.qdcount = reader[0] * 256 + reader[1];
904 /* (for now) we send one query only, so we expect only one in the
905 * response too */
906 if (r_res->header.qdcount != 1) {
907 cause = RSLV_RESP_QUERY_COUNT_ERROR;
908 goto return_error;
909 }
910
911 if (r_res->header.qdcount > DNS_MAX_QUERY_RECORDS)
912 goto invalid_resp;
913 reader += 2;
914
915 /* 2 bytes for answer count */
916 if (reader + 2 >= bufend)
917 goto invalid_resp;
918 r_res->header.ancount = reader[0] * 256 + reader[1];
919 if (r_res->header.ancount == 0) {
920 cause = RSLV_RESP_ANCOUNT_ZERO;
921 goto return_error;
922 }
923
924 /* Check if too many records are announced */
925 if (r_res->header.ancount > max_answer_records)
926 goto invalid_resp;
927 reader += 2;
928
929 /* 2 bytes authority count */
930 if (reader + 2 >= bufend)
931 goto invalid_resp;
932 r_res->header.nscount = reader[0] * 256 + reader[1];
933 reader += 2;
934
935 /* 2 bytes additional count */
936 if (reader + 2 >= bufend)
937 goto invalid_resp;
938 r_res->header.arcount = reader[0] * 256 + reader[1];
939 reader += 2;
940
941 /* Parsing dns queries */
942 LIST_INIT(&r_res->query_list);
943 for (query_record_id = 0; query_record_id < r_res->header.qdcount; query_record_id++) {
944 /* Use next pre-allocated resolv_query_item after ensuring there is
945 * still one available.
946 * It's then added to our packet query list. */
947 if (query_record_id > DNS_MAX_QUERY_RECORDS)
948 goto invalid_resp;
949 query = &resolution->response_query_records[query_record_id];
Willy Tarreau2b718102021-04-21 07:32:39 +0200950 LIST_APPEND(&r_res->query_list, &query->list);
Emeric Brunc9437992021-02-12 19:42:55 +0100951
952 /* Name is a NULL terminated string in our case, since we have
953 * one query per response and the first one can't be compressed
954 * (using the 0x0c format) */
955 offset = 0;
956 len = resolv_read_name(resp, bufend, reader, query->name, DNS_MAX_NAME_SIZE, &offset, 0);
957
958 if (len == 0)
959 goto invalid_resp;
960
961 reader += offset;
962 previous_dname = query->name;
963
964 /* move forward 2 bytes for question type */
965 if (reader + 2 >= bufend)
966 goto invalid_resp;
967 query->type = reader[0] * 256 + reader[1];
968 reader += 2;
969
970 /* move forward 2 bytes for question class */
971 if (reader + 2 >= bufend)
972 goto invalid_resp;
973 query->class = reader[0] * 256 + reader[1];
974 reader += 2;
975 }
976
977 /* TRUNCATED flag must be checked after we could read the query type
978 * because a TRUNCATED SRV query type response can still be exploited */
979 if (query->type != DNS_RTYPE_SRV && flags & DNS_FLAG_TRUNCATED) {
980 cause = RSLV_RESP_TRUNCATED;
981 goto return_error;
982 }
983
984 /* now parsing response records */
985 nb_saved_records = 0;
986 for (i = 0; i < r_res->header.ancount; i++) {
987 if (reader >= bufend)
988 goto invalid_resp;
989
990 answer_record = pool_alloc(resolv_answer_item_pool);
991 if (answer_record == NULL)
992 goto invalid_resp;
993
994 /* initialization */
995 answer_record->ar_item = NULL;
Christopher Faulet55c1c402021-03-11 09:36:05 +0100996 answer_record->last_seen = TICK_ETERNITY;
Emeric Brunf9ca5d82021-06-11 10:08:05 +0200997 LIST_INIT(&answer_record->attached_servers);
Emeric Brunc9437992021-02-12 19:42:55 +0100998
999 offset = 0;
1000 len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
1001
1002 if (len == 0)
1003 goto invalid_resp;
1004
1005 /* Check if the current record dname is valid. previous_dname
1006 * points either to queried dname or last CNAME target */
1007 if (query->type != DNS_RTYPE_SRV && resolv_hostname_cmp(previous_dname, tmpname, len) != 0) {
1008 if (i == 0) {
1009 /* First record, means a mismatch issue between
1010 * queried dname and dname found in the first
1011 * record */
1012 goto invalid_resp;
1013 }
1014 else {
1015 /* If not the first record, this means we have a
1016 * CNAME resolution error.
1017 */
1018 cause = RSLV_RESP_CNAME_ERROR;
1019 goto return_error;
1020 }
1021
1022 }
1023
1024 memcpy(answer_record->name, tmpname, len);
1025 answer_record->name[len] = 0;
1026
1027 reader += offset;
1028 if (reader >= bufend)
1029 goto invalid_resp;
1030
1031 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
1032 if (reader + 2 > bufend)
1033 goto invalid_resp;
1034
1035 answer_record->type = reader[0] * 256 + reader[1];
1036 reader += 2;
1037
1038 /* 2 bytes for class (2) */
1039 if (reader + 2 > bufend)
1040 goto invalid_resp;
1041
1042 answer_record->class = reader[0] * 256 + reader[1];
1043 reader += 2;
1044
1045 /* 4 bytes for ttl (4) */
1046 if (reader + 4 > bufend)
1047 goto invalid_resp;
1048
1049 answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
1050 + reader[2] * 256 + reader[3];
1051 reader += 4;
1052
1053 /* Now reading data len */
1054 if (reader + 2 > bufend)
1055 goto invalid_resp;
1056
1057 answer_record->data_len = reader[0] * 256 + reader[1];
1058
1059 /* Move forward 2 bytes for data len */
1060 reader += 2;
1061
1062 if (reader + answer_record->data_len > bufend)
1063 goto invalid_resp;
1064
1065 /* Analyzing record content */
1066 switch (answer_record->type) {
1067 case DNS_RTYPE_A:
1068 /* ipv4 is stored on 4 bytes */
1069 if (answer_record->data_len != 4)
1070 goto invalid_resp;
1071
1072 answer_record->address.sa_family = AF_INET;
1073 memcpy(&(((struct sockaddr_in *)&answer_record->address)->sin_addr),
1074 reader, answer_record->data_len);
1075 break;
1076
1077 case DNS_RTYPE_CNAME:
1078 /* Check if this is the last record and update the caller about the status:
1079 * no IP could be found and last record was a CNAME. Could be triggered
1080 * by a wrong query type
1081 *
1082 * + 1 because answer_record_id starts at 0
1083 * while number of answers is an integer and
1084 * starts at 1.
1085 */
1086 if (i + 1 == r_res->header.ancount) {
1087 cause = RSLV_RESP_CNAME_ERROR;
1088 goto return_error;
1089 }
1090
1091 offset = 0;
1092 len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
1093 if (len == 0)
1094 goto invalid_resp;
1095
1096 memcpy(answer_record->target, tmpname, len);
1097 answer_record->target[len] = 0;
1098 previous_dname = answer_record->target;
1099 break;
1100
1101
1102 case DNS_RTYPE_SRV:
1103 /* Answer must contain :
1104 * - 2 bytes for the priority
1105 * - 2 bytes for the weight
1106 * - 2 bytes for the port
1107 * - the target hostname
1108 */
1109 if (answer_record->data_len <= 6)
1110 goto invalid_resp;
1111
1112 answer_record->priority = read_n16(reader);
1113 reader += sizeof(uint16_t);
1114 answer_record->weight = read_n16(reader);
1115 reader += sizeof(uint16_t);
1116 answer_record->port = read_n16(reader);
1117 reader += sizeof(uint16_t);
1118 offset = 0;
1119 len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
1120 if (len == 0)
1121 goto invalid_resp;
1122
1123 answer_record->data_len = len;
1124 memcpy(answer_record->target, tmpname, len);
1125 answer_record->target[len] = 0;
1126 if (answer_record->ar_item != NULL) {
1127 pool_free(resolv_answer_item_pool, answer_record->ar_item);
1128 answer_record->ar_item = NULL;
1129 }
1130 break;
1131
1132 case DNS_RTYPE_AAAA:
1133 /* ipv6 is stored on 16 bytes */
1134 if (answer_record->data_len != 16)
1135 goto invalid_resp;
1136
1137 answer_record->address.sa_family = AF_INET6;
1138 memcpy(&(((struct sockaddr_in6 *)&answer_record->address)->sin6_addr),
1139 reader, answer_record->data_len);
1140 break;
1141
1142 } /* switch (record type) */
1143
1144 /* Increment the counter for number of records saved into our
1145 * local response */
1146 nb_saved_records++;
1147
1148 /* Move forward answer_record->data_len for analyzing next
1149 * record in the response */
1150 reader += ((answer_record->type == DNS_RTYPE_SRV)
1151 ? offset
1152 : answer_record->data_len);
1153
1154 /* Lookup to see if we already had this entry */
1155 found = 0;
1156 list_for_each_entry(tmp_record, &r_res->answer_list, list) {
1157 if (tmp_record->type != answer_record->type)
1158 continue;
1159
1160 switch(tmp_record->type) {
1161 case DNS_RTYPE_A:
1162 if (!memcmp(&((struct sockaddr_in *)&answer_record->address)->sin_addr,
1163 &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
1164 sizeof(in_addr_t)))
1165 found = 1;
1166 break;
1167
1168 case DNS_RTYPE_AAAA:
1169 if (!memcmp(&((struct sockaddr_in6 *)&answer_record->address)->sin6_addr,
1170 &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
1171 sizeof(struct in6_addr)))
1172 found = 1;
1173 break;
1174
1175 case DNS_RTYPE_SRV:
1176 if (answer_record->data_len == tmp_record->data_len &&
1177 !resolv_hostname_cmp(answer_record->target, tmp_record->target, answer_record->data_len) &&
1178 answer_record->port == tmp_record->port) {
1179 tmp_record->weight = answer_record->weight;
1180 found = 1;
1181 }
1182 break;
1183
1184 default:
1185 break;
1186 }
1187
1188 if (found == 1)
1189 break;
1190 }
1191
1192 if (found == 1) {
Christopher Faulet55c1c402021-03-11 09:36:05 +01001193 tmp_record->last_seen = now_ms;
Emeric Brunc9437992021-02-12 19:42:55 +01001194 pool_free(resolv_answer_item_pool, answer_record);
1195 answer_record = NULL;
1196 }
1197 else {
Christopher Faulet55c1c402021-03-11 09:36:05 +01001198 answer_record->last_seen = now_ms;
Emeric Brunc9437992021-02-12 19:42:55 +01001199 answer_record->ar_item = NULL;
Willy Tarreau2b718102021-04-21 07:32:39 +02001200 LIST_APPEND(&r_res->answer_list, &answer_record->list);
Emeric Brunc9437992021-02-12 19:42:55 +01001201 answer_record = NULL;
1202 }
1203 } /* for i 0 to ancount */
1204
1205 /* Save the number of records we really own */
1206 r_res->header.ancount = nb_saved_records;
1207
1208 /* now parsing additional records for SRV queries only */
1209 if (query->type != DNS_RTYPE_SRV)
1210 goto skip_parsing_additional_records;
1211
1212 /* if we find Authority records, just skip them */
1213 for (i = 0; i < r_res->header.nscount; i++) {
1214 offset = 0;
1215 len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE,
1216 &offset, 0);
1217 if (len == 0)
1218 continue;
1219
1220 if (reader + offset + 10 >= bufend)
1221 goto invalid_resp;
1222
1223 reader += offset;
1224 /* skip 2 bytes for class */
1225 reader += 2;
1226 /* skip 2 bytes for type */
1227 reader += 2;
1228 /* skip 4 bytes for ttl */
1229 reader += 4;
1230 /* read data len */
1231 len = reader[0] * 256 + reader[1];
1232 reader += 2;
1233
1234 if (reader + len >= bufend)
1235 goto invalid_resp;
1236
1237 reader += len;
1238 }
1239
1240 nb_saved_records = 0;
1241 for (i = 0; i < r_res->header.arcount; i++) {
1242 if (reader >= bufend)
1243 goto invalid_resp;
1244
1245 answer_record = pool_alloc(resolv_answer_item_pool);
1246 if (answer_record == NULL)
1247 goto invalid_resp;
Christopher Faulet55c1c402021-03-11 09:36:05 +01001248 answer_record->last_seen = TICK_ETERNITY;
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001249 LIST_INIT(&answer_record->attached_servers);
Emeric Brunc9437992021-02-12 19:42:55 +01001250
1251 offset = 0;
1252 len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
1253
1254 if (len == 0) {
1255 pool_free(resolv_answer_item_pool, answer_record);
1256 answer_record = NULL;
1257 continue;
1258 }
1259
1260 memcpy(answer_record->name, tmpname, len);
1261 answer_record->name[len] = 0;
1262
1263 reader += offset;
1264 if (reader >= bufend)
1265 goto invalid_resp;
1266
1267 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
1268 if (reader + 2 > bufend)
1269 goto invalid_resp;
1270
1271 answer_record->type = reader[0] * 256 + reader[1];
1272 reader += 2;
1273
1274 /* 2 bytes for class (2) */
1275 if (reader + 2 > bufend)
1276 goto invalid_resp;
1277
1278 answer_record->class = reader[0] * 256 + reader[1];
1279 reader += 2;
1280
1281 /* 4 bytes for ttl (4) */
1282 if (reader + 4 > bufend)
1283 goto invalid_resp;
1284
1285 answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
1286 + reader[2] * 256 + reader[3];
1287 reader += 4;
1288
1289 /* Now reading data len */
1290 if (reader + 2 > bufend)
1291 goto invalid_resp;
1292
1293 answer_record->data_len = reader[0] * 256 + reader[1];
1294
1295 /* Move forward 2 bytes for data len */
1296 reader += 2;
1297
1298 if (reader + answer_record->data_len > bufend)
1299 goto invalid_resp;
1300
1301 /* Analyzing record content */
1302 switch (answer_record->type) {
1303 case DNS_RTYPE_A:
1304 /* ipv4 is stored on 4 bytes */
1305 if (answer_record->data_len != 4)
1306 goto invalid_resp;
1307
1308 answer_record->address.sa_family = AF_INET;
1309 memcpy(&(((struct sockaddr_in *)&answer_record->address)->sin_addr),
1310 reader, answer_record->data_len);
1311 break;
1312
1313 case DNS_RTYPE_AAAA:
1314 /* ipv6 is stored on 16 bytes */
1315 if (answer_record->data_len != 16)
1316 goto invalid_resp;
1317
1318 answer_record->address.sa_family = AF_INET6;
1319 memcpy(&(((struct sockaddr_in6 *)&answer_record->address)->sin6_addr),
1320 reader, answer_record->data_len);
1321 break;
1322
1323 default:
1324 pool_free(resolv_answer_item_pool, answer_record);
1325 answer_record = NULL;
1326 continue;
1327
1328 } /* switch (record type) */
1329
1330 /* Increment the counter for number of records saved into our
1331 * local response */
1332 nb_saved_records++;
1333
1334 /* Move forward answer_record->data_len for analyzing next
1335 * record in the response */
Christopher Faulet77f86062021-03-10 15:19:57 +01001336 reader += answer_record->data_len;
Emeric Brunc9437992021-02-12 19:42:55 +01001337
1338 /* Lookup to see if we already had this entry */
1339 found = 0;
1340 list_for_each_entry(tmp_record, &r_res->answer_list, list) {
Christopher Faulet77f86062021-03-10 15:19:57 +01001341 struct resolv_answer_item *ar_item;
1342
1343 if (tmp_record->type != DNS_RTYPE_SRV || !tmp_record->ar_item)
1344 continue;
1345
1346 ar_item = tmp_record->ar_item;
Christopher Faulete8674c72021-03-12 16:42:45 +01001347 if (ar_item->type != answer_record->type || ar_item->last_seen == now_ms ||
Christopher Faulet77f86062021-03-10 15:19:57 +01001348 len != tmp_record->data_len ||
1349 resolv_hostname_cmp(answer_record->name, tmp_record->target, tmp_record->data_len))
Emeric Brunc9437992021-02-12 19:42:55 +01001350 continue;
1351
Christopher Faulet77f86062021-03-10 15:19:57 +01001352 switch(ar_item->type) {
Emeric Brunc9437992021-02-12 19:42:55 +01001353 case DNS_RTYPE_A:
1354 if (!memcmp(&((struct sockaddr_in *)&answer_record->address)->sin_addr,
Christopher Faulet77f86062021-03-10 15:19:57 +01001355 &((struct sockaddr_in *)&ar_item->address)->sin_addr,
Emeric Brunc9437992021-02-12 19:42:55 +01001356 sizeof(in_addr_t)))
1357 found = 1;
1358 break;
1359
1360 case DNS_RTYPE_AAAA:
1361 if (!memcmp(&((struct sockaddr_in6 *)&answer_record->address)->sin6_addr,
Christopher Faulet77f86062021-03-10 15:19:57 +01001362 &((struct sockaddr_in6 *)&ar_item->address)->sin6_addr,
Emeric Brunc9437992021-02-12 19:42:55 +01001363 sizeof(struct in6_addr)))
1364 found = 1;
1365 break;
1366
1367 default:
1368 break;
1369 }
1370
1371 if (found == 1)
1372 break;
1373 }
1374
1375 if (found == 1) {
Christopher Faulet55c1c402021-03-11 09:36:05 +01001376 tmp_record->ar_item->last_seen = now_ms;
Emeric Brunc9437992021-02-12 19:42:55 +01001377 pool_free(resolv_answer_item_pool, answer_record);
1378 answer_record = NULL;
1379 }
1380 else {
Christopher Faulet55c1c402021-03-11 09:36:05 +01001381 answer_record->last_seen = now_ms;
Emeric Brunc9437992021-02-12 19:42:55 +01001382 answer_record->ar_item = NULL;
1383
1384 // looking for the SRV record in the response list linked to this additional record
1385 list_for_each_entry(tmp_record, &r_res->answer_list, list) {
1386 if (tmp_record->type == DNS_RTYPE_SRV &&
1387 tmp_record->ar_item == NULL &&
1388 !resolv_hostname_cmp(tmp_record->target, answer_record->name, tmp_record->data_len)) {
1389 /* Always use the received additional record to refresh info */
1390 if (tmp_record->ar_item)
1391 pool_free(resolv_answer_item_pool, tmp_record->ar_item);
1392 tmp_record->ar_item = answer_record;
Christopher Faulet9c246a42021-02-23 11:59:19 +01001393 answer_record = NULL;
Emeric Brunc9437992021-02-12 19:42:55 +01001394 break;
1395 }
1396 }
Christopher Faulet9c246a42021-02-23 11:59:19 +01001397 if (answer_record) {
Emeric Brunc9437992021-02-12 19:42:55 +01001398 pool_free(resolv_answer_item_pool, answer_record);
Christopher Faulet9c246a42021-02-23 11:59:19 +01001399 answer_record = NULL;
1400 }
Emeric Brunc9437992021-02-12 19:42:55 +01001401 }
1402 } /* for i 0 to arcount */
1403
1404 skip_parsing_additional_records:
1405
1406 /* Save the number of records we really own */
1407 r_res->header.arcount = nb_saved_records;
Emeric Brunc9437992021-02-12 19:42:55 +01001408 resolv_check_response(resolution);
1409 return RSLV_RESP_VALID;
1410
1411 invalid_resp:
1412 cause = RSLV_RESP_INVALID;
1413
1414 return_error:
1415 pool_free(resolv_answer_item_pool, answer_record);
1416 return cause;
1417}
1418
1419/* Searches dn_name resolution in resp.
1420 * If existing IP not found, return the first IP matching family_priority,
1421 * otherwise, first ip found
1422 * The following tasks are the responsibility of the caller:
1423 * - <r_res> contains an error free DNS response
1424 * For both cases above, resolv_validate_dns_response is required
1425 * returns one of the RSLV_UPD_* code
1426 */
1427int resolv_get_ip_from_response(struct resolv_response *r_res,
1428 struct resolv_options *resolv_opts, void *currentip,
1429 short currentip_sin_family,
1430 void **newip, short *newip_sin_family,
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001431 struct server *owner)
Emeric Brunc9437992021-02-12 19:42:55 +01001432{
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001433 struct resolv_answer_item *record, *found_record = NULL;
Emeric Brunc9437992021-02-12 19:42:55 +01001434 int family_priority;
1435 int currentip_found;
1436 unsigned char *newip4, *newip6;
1437 int currentip_sel;
1438 int j;
1439 int score, max_score;
1440 int allowed_duplicated_ip;
1441
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001442 /* srv is linked to an alive ip record */
1443 if (owner && LIST_INLIST(&owner->ip_rec_item))
1444 return RSLV_UPD_NO;
1445
Emeric Brunc9437992021-02-12 19:42:55 +01001446 family_priority = resolv_opts->family_prio;
1447 allowed_duplicated_ip = resolv_opts->accept_duplicate_ip;
1448 *newip = newip4 = newip6 = NULL;
1449 currentip_found = 0;
1450 *newip_sin_family = AF_UNSPEC;
1451 max_score = -1;
1452
1453 /* Select an IP regarding configuration preference.
1454 * Top priority is the preferred network ip version,
1455 * second priority is the preferred network.
1456 * the last priority is the currently used IP,
1457 *
1458 * For these three priorities, a score is calculated. The
1459 * weight are:
1460 * 8 - preferred ip version.
1461 * 4 - preferred network.
1462 * 2 - if the ip in the record is not affected to any other server in the same backend (duplication)
1463 * 1 - current ip.
1464 * The result with the biggest score is returned.
1465 */
1466
1467 list_for_each_entry(record, &r_res->answer_list, list) {
1468 void *ip;
1469 unsigned char ip_type;
1470
1471 if (record->type == DNS_RTYPE_A) {
1472 ip = &(((struct sockaddr_in *)&record->address)->sin_addr);
1473 ip_type = AF_INET;
1474 }
1475 else if (record->type == DNS_RTYPE_AAAA) {
1476 ip_type = AF_INET6;
1477 ip = &(((struct sockaddr_in6 *)&record->address)->sin6_addr);
1478 }
1479 else
1480 continue;
1481 score = 0;
1482
1483 /* Check for preferred ip protocol. */
1484 if (ip_type == family_priority)
1485 score += 8;
1486
1487 /* Check for preferred network. */
1488 for (j = 0; j < resolv_opts->pref_net_nb; j++) {
1489
1490 /* Compare only the same addresses class. */
1491 if (resolv_opts->pref_net[j].family != ip_type)
1492 continue;
1493
1494 if ((ip_type == AF_INET &&
1495 in_net_ipv4(ip,
1496 &resolv_opts->pref_net[j].mask.in4,
1497 &resolv_opts->pref_net[j].addr.in4)) ||
1498 (ip_type == AF_INET6 &&
1499 in_net_ipv6(ip,
1500 &resolv_opts->pref_net[j].mask.in6,
1501 &resolv_opts->pref_net[j].addr.in6))) {
1502 score += 4;
1503 break;
1504 }
1505 }
1506
1507 /* Check if the IP found in the record is already affected to a
1508 * member of a group. If not, the score should be incremented
1509 * by 2. */
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001510 if (owner) {
1511 struct server *srv;
1512 int already_used = 0;
1513
1514 list_for_each_entry(srv, &record->attached_servers, ip_rec_item) {
1515 if (srv == owner)
1516 continue;
1517 if (srv->proxy == owner->proxy) {
1518 already_used = 1;
1519 break;
1520 }
1521 }
1522 if (already_used) {
1523 if (!allowed_duplicated_ip) {
1524 continue;
1525 }
1526 }
1527 else {
1528 score += 2;
Emeric Brunc9437992021-02-12 19:42:55 +01001529 }
1530 } else {
1531 score += 2;
1532 }
1533
1534 /* Check for current ip matching. */
1535 if (ip_type == currentip_sin_family &&
1536 ((currentip_sin_family == AF_INET &&
1537 !memcmp(ip, currentip, 4)) ||
1538 (currentip_sin_family == AF_INET6 &&
1539 !memcmp(ip, currentip, 16)))) {
1540 score++;
1541 currentip_sel = 1;
1542 }
1543 else
1544 currentip_sel = 0;
1545
1546 /* Keep the address if the score is better than the previous
1547 * score. The maximum score is 15, if this value is reached, we
1548 * break the parsing. Implicitly, this score is reached the ip
1549 * selected is the current ip. */
1550 if (score > max_score) {
1551 if (ip_type == AF_INET)
1552 newip4 = ip;
1553 else
1554 newip6 = ip;
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001555 found_record = record;
Emeric Brunc9437992021-02-12 19:42:55 +01001556 currentip_found = currentip_sel;
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001557 if (score == 15) {
1558 /* this was not registered on the current record but it matches
1559 * let's fix it (it may comes from state file */
1560 if (owner)
1561 LIST_APPEND(&found_record->attached_servers, &owner->ip_rec_item);
Emeric Brunc9437992021-02-12 19:42:55 +01001562 return RSLV_UPD_NO;
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001563 }
Emeric Brunc9437992021-02-12 19:42:55 +01001564 max_score = score;
1565 }
1566 } /* list for each record entries */
1567
1568 /* No IP found in the response */
1569 if (!newip4 && !newip6)
1570 return RSLV_UPD_NO_IP_FOUND;
1571
1572 /* Case when the caller looks first for an IPv4 address */
1573 if (family_priority == AF_INET) {
1574 if (newip4) {
1575 *newip = newip4;
1576 *newip_sin_family = AF_INET;
1577 }
1578 else if (newip6) {
1579 *newip = newip6;
1580 *newip_sin_family = AF_INET6;
1581 }
Emeric Brunc9437992021-02-12 19:42:55 +01001582 }
1583 /* Case when the caller looks first for an IPv6 address */
1584 else if (family_priority == AF_INET6) {
1585 if (newip6) {
1586 *newip = newip6;
1587 *newip_sin_family = AF_INET6;
1588 }
1589 else if (newip4) {
1590 *newip = newip4;
1591 *newip_sin_family = AF_INET;
1592 }
Emeric Brunc9437992021-02-12 19:42:55 +01001593 }
1594 /* Case when the caller have no preference (we prefer IPv6) */
1595 else if (family_priority == AF_UNSPEC) {
1596 if (newip6) {
1597 *newip = newip6;
1598 *newip_sin_family = AF_INET6;
1599 }
1600 else if (newip4) {
1601 *newip = newip4;
1602 *newip_sin_family = AF_INET;
1603 }
Emeric Brunc9437992021-02-12 19:42:55 +01001604 }
1605
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001606 /* the ip of this record was chosen for the server */
1607 if (owner && found_record) {
Christopher Faulet2558d5a2021-06-24 15:16:48 +02001608 LIST_DEL_INIT(&owner->ip_rec_item);
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001609 LIST_APPEND(&found_record->attached_servers, &owner->ip_rec_item);
1610 }
1611
Emeric Brunc9437992021-02-12 19:42:55 +01001612 list_for_each_entry(record, &r_res->answer_list, list) {
1613 /* Move the first record to the end of the list, for internal
1614 * round robin */
Willy Tarreau2b718102021-04-21 07:32:39 +02001615 LIST_DELETE(&record->list);
1616 LIST_APPEND(&r_res->answer_list, &record->list);
Emeric Brunc9437992021-02-12 19:42:55 +01001617 break;
1618 }
Christopher Faulet2558d5a2021-06-24 15:16:48 +02001619
1620 return (currentip_found ? RSLV_UPD_NO : RSLV_UPD_SRVIP_NOT_FOUND);
Emeric Brunc9437992021-02-12 19:42:55 +01001621}
1622
1623/* Turns a domain name label into a string.
1624 *
1625 * <dn> must be a null-terminated string. <dn_len> must include the terminating
1626 * null byte. <str> must be allocated and its size must be passed in <str_len>.
1627 *
1628 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1629 * <str> (including the terminating null byte).
1630 */
1631int resolv_dn_label_to_str(const char *dn, int dn_len, char *str, int str_len)
1632{
1633 char *ptr;
1634 int i, sz;
1635
1636 if (str_len < dn_len - 1)
1637 return -1;
1638
1639 ptr = str;
1640 for (i = 0; i < dn_len-1; ++i) {
1641 sz = dn[i];
1642 if (i)
1643 *ptr++ = '.';
1644 memcpy(ptr, dn+i+1, sz);
1645 ptr += sz;
1646 i += sz;
1647 }
1648 *ptr++ = '\0';
1649 return (ptr - str);
1650}
1651
1652/* Turns a string into domain name label: www.haproxy.org into 3www7haproxy3org
1653 *
1654 * <str> must be a null-terminated string. <str_len> must include the
1655 * terminating null byte. <dn> buffer must be allocated and its size must be
1656 * passed in <dn_len>.
1657 *
1658 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1659 * <dn> (excluding the terminating null byte).
1660 */
1661int resolv_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len)
1662{
1663 int i, offset;
1664
1665 if (dn_len < str_len + 1)
1666 return -1;
1667
1668 /* First byte of dn will be used to store the length of the first
1669 * label */
1670 offset = 0;
1671 for (i = 0; i < str_len; ++i) {
1672 if (str[i] == '.') {
1673 /* 2 or more consecutive dots is invalid */
1674 if (i == offset)
1675 return -1;
1676
1677 /* ignore trailing dot */
1678 if (i + 2 == str_len) {
1679 i++;
1680 break;
1681 }
1682
1683 dn[offset] = (i - offset);
1684 offset = i+1;
1685 continue;
1686 }
1687 dn[i+1] = str[i];
1688 }
1689 dn[offset] = (i - offset - 1);
1690 dn[i] = '\0';
1691 return i;
1692}
1693
1694/* Validates host name:
1695 * - total size
1696 * - each label size individually
1697 * returns:
1698 * 0 in case of error. If <err> is not NULL, an error message is stored there.
1699 * 1 when no error. <err> is left unaffected.
1700 */
1701int resolv_hostname_validation(const char *string, char **err)
1702{
1703 int i;
1704
1705 if (strlen(string) > DNS_MAX_NAME_SIZE) {
1706 if (err)
1707 *err = DNS_TOO_LONG_FQDN;
1708 return 0;
1709 }
1710
1711 while (*string) {
1712 i = 0;
1713 while (*string && *string != '.' && i < DNS_MAX_LABEL_SIZE) {
1714 if (!(*string == '-' || *string == '_' ||
1715 (*string >= 'a' && *string <= 'z') ||
1716 (*string >= 'A' && *string <= 'Z') ||
1717 (*string >= '0' && *string <= '9'))) {
1718 if (err)
1719 *err = DNS_INVALID_CHARACTER;
1720 return 0;
1721 }
1722 i++;
1723 string++;
1724 }
1725
1726 if (!(*string))
1727 break;
1728
1729 if (*string != '.' && i >= DNS_MAX_LABEL_SIZE) {
1730 if (err)
1731 *err = DNS_LABEL_TOO_LONG;
1732 return 0;
1733 }
1734
1735 string++;
1736 }
1737 return 1;
1738}
1739
1740/* Picks up an available resolution from the different resolution list
1741 * associated to a resolvers section, in this order:
1742 * 1. check in resolutions.curr for the same hostname and query_type
1743 * 2. check in resolutions.wait for the same hostname and query_type
1744 * 3. Get a new resolution from resolution pool
1745 *
1746 * Returns an available resolution, NULL if none found.
1747 */
1748static struct resolv_resolution *resolv_pick_resolution(struct resolvers *resolvers,
1749 char **hostname_dn, int hostname_dn_len,
1750 int query_type)
1751{
1752 struct resolv_resolution *res;
1753
1754 if (!*hostname_dn)
1755 goto from_pool;
1756
1757 /* Search for same hostname and query type in resolutions.curr */
1758 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
1759 if (!res->hostname_dn)
1760 continue;
1761 if ((query_type == res->prefered_query_type) &&
1762 hostname_dn_len == res->hostname_dn_len &&
1763 !resolv_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
1764 return res;
1765 }
1766
1767 /* Search for same hostname and query type in resolutions.wait */
1768 list_for_each_entry(res, &resolvers->resolutions.wait, list) {
1769 if (!res->hostname_dn)
1770 continue;
1771 if ((query_type == res->prefered_query_type) &&
1772 hostname_dn_len == res->hostname_dn_len &&
1773 !resolv_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
1774 return res;
1775 }
1776
1777 from_pool:
1778 /* No resolution could be found, so let's allocate a new one */
Willy Tarreau70490eb2021-03-22 21:08:50 +01001779 res = pool_zalloc(resolv_resolution_pool);
Emeric Brunc9437992021-02-12 19:42:55 +01001780 if (res) {
Emeric Brunc9437992021-02-12 19:42:55 +01001781 res->resolvers = resolvers;
1782 res->uuid = resolution_uuid;
1783 res->status = RSLV_STATUS_NONE;
1784 res->step = RSLV_STEP_NONE;
1785 res->last_valid = now_ms;
1786
1787 LIST_INIT(&res->requesters);
1788 LIST_INIT(&res->response.answer_list);
1789
1790 res->prefered_query_type = query_type;
1791 res->query_type = query_type;
1792 res->hostname_dn = *hostname_dn;
1793 res->hostname_dn_len = hostname_dn_len;
1794
1795 ++resolution_uuid;
1796
1797 /* Move the resolution to the resolvers wait queue */
Willy Tarreau2b718102021-04-21 07:32:39 +02001798 LIST_APPEND(&resolvers->resolutions.wait, &res->list);
Emeric Brunc9437992021-02-12 19:42:55 +01001799 }
1800 return res;
1801}
1802
Christopher Faulet1dec5c72021-03-10 14:40:39 +01001803void resolv_purge_resolution_answer_records(struct resolv_resolution *resolution)
1804{
1805 struct resolv_answer_item *item, *itemback;
1806
1807 list_for_each_entry_safe(item, itemback, &resolution->response.answer_list, list) {
Willy Tarreau2b718102021-04-21 07:32:39 +02001808 LIST_DELETE(&item->list);
Christopher Faulet1dec5c72021-03-10 14:40:39 +01001809 pool_free(resolv_answer_item_pool, item->ar_item);
1810 pool_free(resolv_answer_item_pool, item);
1811 }
1812}
1813
Emeric Brunc9437992021-02-12 19:42:55 +01001814/* Releases a resolution from its requester(s) and move it back to the pool */
1815static void resolv_free_resolution(struct resolv_resolution *resolution)
1816{
1817 struct resolv_requester *req, *reqback;
Emeric Brunc9437992021-02-12 19:42:55 +01001818
1819 /* clean up configuration */
1820 resolv_reset_resolution(resolution);
1821 resolution->hostname_dn = NULL;
1822 resolution->hostname_dn_len = 0;
1823
1824 list_for_each_entry_safe(req, reqback, &resolution->requesters, list) {
Willy Tarreau2b718102021-04-21 07:32:39 +02001825 LIST_DELETE(&req->list);
Emeric Brunc9437992021-02-12 19:42:55 +01001826 req->resolution = NULL;
1827 }
Christopher Faulet1dec5c72021-03-10 14:40:39 +01001828 resolv_purge_resolution_answer_records(resolution);
Willy Tarreau2b718102021-04-21 07:32:39 +02001829 LIST_DELETE(&resolution->list);
Emeric Brunc9437992021-02-12 19:42:55 +01001830 pool_free(resolv_resolution_pool, resolution);
1831}
1832
1833/* Links a requester (a server or a resolv_srvrq) with a resolution. It returns 0
1834 * on success, -1 otherwise.
1835 */
1836int resolv_link_resolution(void *requester, int requester_type, int requester_locked)
1837{
1838 struct resolv_resolution *res = NULL;
1839 struct resolv_requester *req;
1840 struct resolvers *resolvers;
1841 struct server *srv = NULL;
1842 struct resolv_srvrq *srvrq = NULL;
1843 struct stream *stream = NULL;
1844 char **hostname_dn;
1845 int hostname_dn_len, query_type;
1846
1847 switch (requester_type) {
1848 case OBJ_TYPE_SERVER:
1849 srv = (struct server *)requester;
1850 hostname_dn = &srv->hostname_dn;
1851 hostname_dn_len = srv->hostname_dn_len;
1852 resolvers = srv->resolvers;
1853 query_type = ((srv->resolv_opts.family_prio == AF_INET)
1854 ? DNS_RTYPE_A
1855 : DNS_RTYPE_AAAA);
1856 break;
1857
1858 case OBJ_TYPE_SRVRQ:
1859 srvrq = (struct resolv_srvrq *)requester;
1860 hostname_dn = &srvrq->hostname_dn;
1861 hostname_dn_len = srvrq->hostname_dn_len;
1862 resolvers = srvrq->resolvers;
1863 query_type = DNS_RTYPE_SRV;
1864 break;
1865
1866 case OBJ_TYPE_STREAM:
1867 stream = (struct stream *)requester;
1868 hostname_dn = &stream->resolv_ctx.hostname_dn;
1869 hostname_dn_len = stream->resolv_ctx.hostname_dn_len;
1870 resolvers = stream->resolv_ctx.parent->arg.resolv.resolvers;
1871 query_type = ((stream->resolv_ctx.parent->arg.resolv.opts->family_prio == AF_INET)
1872 ? DNS_RTYPE_A
1873 : DNS_RTYPE_AAAA);
1874 break;
1875 default:
1876 goto err;
1877 }
1878
1879 /* Get a resolution from the resolvers' wait queue or pool */
1880 if ((res = resolv_pick_resolution(resolvers, hostname_dn, hostname_dn_len, query_type)) == NULL)
1881 goto err;
1882
1883 if (srv) {
1884 if (!requester_locked)
1885 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
1886 if (srv->resolv_requester == NULL) {
1887 if ((req = pool_alloc(resolv_requester_pool)) == NULL) {
1888 if (!requester_locked)
1889 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
1890 goto err;
1891 }
1892 req->owner = &srv->obj_type;
1893 srv->resolv_requester = req;
1894 }
1895 else
1896 req = srv->resolv_requester;
1897 if (!requester_locked)
1898 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
1899
1900 req->requester_cb = snr_resolution_cb;
1901 req->requester_error_cb = snr_resolution_error_cb;
1902 }
1903 else if (srvrq) {
1904 if (srvrq->requester == NULL) {
1905 if ((req = pool_alloc(resolv_requester_pool)) == NULL)
1906 goto err;
1907 req->owner = &srvrq->obj_type;
1908 srvrq->requester = req;
1909 }
1910 else
1911 req = srvrq->requester;
1912
1913 req->requester_cb = snr_resolution_cb;
Baptiste Assmannb4badf72020-11-19 22:38:33 +01001914 req->requester_error_cb = srvrq_resolution_error_cb;
Emeric Brunc9437992021-02-12 19:42:55 +01001915 }
1916 else if (stream) {
1917 if (stream->resolv_ctx.requester == NULL) {
1918 if ((req = pool_alloc(resolv_requester_pool)) == NULL)
1919 goto err;
1920 req->owner = &stream->obj_type;
1921 stream->resolv_ctx.requester = req;
1922 }
1923 else
1924 req = stream->resolv_ctx.requester;
1925
1926 req->requester_cb = act_resolution_cb;
1927 req->requester_error_cb = act_resolution_error_cb;
1928 }
1929 else
1930 goto err;
1931
1932 req->resolution = res;
1933
Willy Tarreau2b718102021-04-21 07:32:39 +02001934 LIST_APPEND(&res->requesters, &req->list);
Emeric Brunc9437992021-02-12 19:42:55 +01001935 return 0;
1936
1937 err:
1938 if (res && LIST_ISEMPTY(&res->requesters))
1939 resolv_free_resolution(res);
1940 return -1;
1941}
1942
Emeric Brun0c4a8a32021-06-11 10:48:45 +02001943/* This function removes all server/srvrq references on answer items
1944 * if <safe> is set to 1, in case of srvrq, sub server resquesters unlink
1945 * is called using safe == 1 to make it usable into callbacks
1946 */
1947void resolv_detach_from_resolution_answer_items(struct resolv_resolution *res, struct resolv_requester *req, int safe)
1948{
1949 struct resolv_answer_item *item, *itemback;
1950 struct server *srv, *srvback;
1951 struct resolv_srvrq *srvrq;
1952
1953 if ((srv = objt_server(req->owner)) != NULL) {
1954 LIST_DEL_INIT(&srv->ip_rec_item);
1955 }
1956 else if ((srvrq = objt_resolv_srvrq(req->owner)) != NULL) {
1957 list_for_each_entry_safe(item, itemback, &res->response.answer_list, list) {
1958 if (item->type == DNS_RTYPE_SRV) {
1959 list_for_each_entry_safe(srv, srvback, &item->attached_servers, srv_rec_item) {
Christopher Faulet5f8ccff2021-06-15 16:08:48 +02001960 if (srv->srvrq == srvrq)
1961 resolv_srvrq_cleanup_srv(srv);
Emeric Brun0c4a8a32021-06-11 10:48:45 +02001962 }
1963 }
1964 }
1965 }
1966}
1967
Emeric Brunc9437992021-02-12 19:42:55 +01001968/* Removes a requester from a DNS resolution. It takes takes care of all the
1969 * consequences. It also cleans up some parameters from the requester.
Christopher Faulet0efc0992021-03-11 18:09:53 +01001970 * if <safe> is set to 1, the corresponding resolution is not released.
Emeric Brunc9437992021-02-12 19:42:55 +01001971 */
Christopher Faulet0efc0992021-03-11 18:09:53 +01001972void resolv_unlink_resolution(struct resolv_requester *requester, int safe)
Emeric Brunc9437992021-02-12 19:42:55 +01001973{
1974 struct resolv_resolution *res;
1975 struct resolv_requester *req;
1976
1977 /* Nothing to do */
1978 if (!requester || !requester->resolution)
1979 return;
1980 res = requester->resolution;
1981
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001982 /* remove ref from the resolution answer item list to the requester */
Emeric Brun0c4a8a32021-06-11 10:48:45 +02001983 resolv_detach_from_resolution_answer_items(res, requester, safe);
Emeric Brunf9ca5d82021-06-11 10:08:05 +02001984
Emeric Brunc9437992021-02-12 19:42:55 +01001985 /* Clean up the requester */
Willy Tarreau2b718102021-04-21 07:32:39 +02001986 LIST_DELETE(&requester->list);
Emeric Brunc9437992021-02-12 19:42:55 +01001987 requester->resolution = NULL;
1988
1989 /* We need to find another requester linked on this resolution */
1990 if (!LIST_ISEMPTY(&res->requesters))
1991 req = LIST_NEXT(&res->requesters, struct resolv_requester *, list);
1992 else {
Christopher Faulet0efc0992021-03-11 18:09:53 +01001993 if (safe) {
1994 /* Don't release it yet. */
1995 resolv_reset_resolution(res);
1996 res->hostname_dn = NULL;
1997 res->hostname_dn_len = 0;
1998 resolv_purge_resolution_answer_records(res);
1999 return;
2000 }
2001
Emeric Brunc9437992021-02-12 19:42:55 +01002002 resolv_free_resolution(res);
2003 return;
2004 }
2005
2006 /* Move hostname_dn related pointers to the next requester */
2007 switch (obj_type(req->owner)) {
2008 case OBJ_TYPE_SERVER:
2009 res->hostname_dn = __objt_server(req->owner)->hostname_dn;
2010 res->hostname_dn_len = __objt_server(req->owner)->hostname_dn_len;
2011 break;
2012 case OBJ_TYPE_SRVRQ:
2013 res->hostname_dn = __objt_resolv_srvrq(req->owner)->hostname_dn;
2014 res->hostname_dn_len = __objt_resolv_srvrq(req->owner)->hostname_dn_len;
2015 break;
2016 case OBJ_TYPE_STREAM:
2017 res->hostname_dn = __objt_stream(req->owner)->resolv_ctx.hostname_dn;
2018 res->hostname_dn_len = __objt_stream(req->owner)->resolv_ctx.hostname_dn_len;
2019 break;
2020 default:
2021 res->hostname_dn = NULL;
2022 res->hostname_dn_len = 0;
2023 break;
2024 }
2025}
2026
2027/* Called when a network IO is generated on a name server socket for an incoming
2028 * packet. It performs the following actions:
2029 * - check if the packet requires processing (not outdated resolution)
2030 * - ensure the DNS packet received is valid and call requester's callback
2031 * - call requester's error callback if invalid response
2032 * - check the dn_name in the packet against the one sent
2033 */
2034static int resolv_process_responses(struct dns_nameserver *ns)
2035{
2036 struct dns_counters *tmpcounters;
2037 struct resolvers *resolvers;
2038 struct resolv_resolution *res;
2039 struct resolv_query_item *query;
2040 unsigned char buf[DNS_MAX_UDP_MESSAGE + 1];
2041 unsigned char *bufend;
2042 int buflen, dns_resp;
2043 int max_answer_records;
2044 unsigned short query_id;
2045 struct eb32_node *eb;
2046 struct resolv_requester *req;
Emeric Brun43839d02021-06-10 15:25:25 +02002047 int keep_answer_items;
Emeric Brunc9437992021-02-12 19:42:55 +01002048
2049 resolvers = ns->parent;
2050 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
2051
2052 /* process all pending input messages */
2053 while (1) {
2054 /* read message received */
2055 memset(buf, '\0', resolvers->accepted_payload_size + 1);
2056 if ((buflen = dns_recv_nameserver(ns, (void *)buf, sizeof(buf))) <= 0) {
2057 break;
2058 }
2059
2060 /* message too big */
2061 if (buflen > resolvers->accepted_payload_size) {
2062 ns->counters->too_big++;
2063 continue;
2064 }
2065
2066 /* initializing variables */
2067 bufend = buf + buflen; /* pointer to mark the end of the buffer */
2068
2069 /* read the query id from the packet (16 bits) */
2070 if (buf + 2 > bufend) {
2071 ns->counters->invalid++;
2072 continue;
2073 }
2074 query_id = resolv_response_get_query_id(buf);
2075
2076 /* search the query_id in the pending resolution tree */
2077 eb = eb32_lookup(&resolvers->query_ids, query_id);
2078 if (eb == NULL) {
2079 /* unknown query id means an outdated response and can be safely ignored */
2080 ns->counters->outdated++;
2081 continue;
2082 }
2083
2084 /* known query id means a resolution in progress */
2085 res = eb32_entry(eb, struct resolv_resolution, qid);
2086 /* number of responses received */
2087 res->nb_responses++;
2088
2089 max_answer_records = (resolvers->accepted_payload_size - DNS_HEADER_SIZE) / DNS_MIN_RECORD_SIZE;
2090 dns_resp = resolv_validate_dns_response(buf, bufend, res, max_answer_records);
2091
2092 switch (dns_resp) {
2093 case RSLV_RESP_VALID:
2094 break;
2095
2096 case RSLV_RESP_INVALID:
2097 case RSLV_RESP_QUERY_COUNT_ERROR:
2098 case RSLV_RESP_WRONG_NAME:
2099 res->status = RSLV_STATUS_INVALID;
2100 ns->counters->invalid++;
2101 break;
2102
2103 case RSLV_RESP_NX_DOMAIN:
2104 res->status = RSLV_STATUS_NX;
2105 ns->counters->nx++;
2106 break;
2107
2108 case RSLV_RESP_REFUSED:
2109 res->status = RSLV_STATUS_REFUSED;
2110 ns->counters->refused++;
2111 break;
2112
2113 case RSLV_RESP_ANCOUNT_ZERO:
2114 res->status = RSLV_STATUS_OTHER;
2115 ns->counters->any_err++;
2116 break;
2117
2118 case RSLV_RESP_CNAME_ERROR:
2119 res->status = RSLV_STATUS_OTHER;
2120 ns->counters->cname_error++;
2121 break;
2122
2123 case RSLV_RESP_TRUNCATED:
2124 res->status = RSLV_STATUS_OTHER;
2125 ns->counters->truncated++;
2126 break;
2127
2128 case RSLV_RESP_NO_EXPECTED_RECORD:
2129 case RSLV_RESP_ERROR:
2130 case RSLV_RESP_INTERNAL:
2131 res->status = RSLV_STATUS_OTHER;
2132 ns->counters->other++;
2133 break;
2134 }
2135
2136 /* Wait all nameservers response to handle errors */
2137 if (dns_resp != RSLV_RESP_VALID && res->nb_responses < res->nb_queries)
2138 continue;
2139
2140 /* Process error codes */
2141 if (dns_resp != RSLV_RESP_VALID) {
2142 if (res->prefered_query_type != res->query_type) {
2143 /* The fallback on the query type was already performed,
2144 * so check the try counter. If it falls to 0, we can
2145 * report an error. Else, wait the next attempt. */
2146 if (!res->try)
2147 goto report_res_error;
2148 }
2149 else {
2150 /* Fallback from A to AAAA or the opposite and re-send
2151 * the resolution immediately. try counter is not
2152 * decremented. */
2153 if (res->prefered_query_type == DNS_RTYPE_A) {
2154 res->query_type = DNS_RTYPE_AAAA;
2155 resolv_send_query(res);
2156 }
2157 else if (res->prefered_query_type == DNS_RTYPE_AAAA) {
2158 res->query_type = DNS_RTYPE_A;
2159 resolv_send_query(res);
2160 }
2161 }
2162 continue;
2163 }
2164
2165 /* Now let's check the query's dname corresponds to the one we
2166 * sent. We can check only the first query of the list. We send
2167 * one query at a time so we get one query in the response */
2168 query = LIST_NEXT(&res->response.query_list, struct resolv_query_item *, list);
2169 if (query && resolv_hostname_cmp(query->name, res->hostname_dn, res->hostname_dn_len) != 0) {
2170 dns_resp = RSLV_RESP_WRONG_NAME;
2171 ns->counters->other++;
2172 goto report_res_error;
2173 }
2174
2175 /* So the resolution succeeded */
2176 res->status = RSLV_STATUS_VALID;
2177 res->last_valid = now_ms;
2178 ns->counters->valid++;
2179 goto report_res_success;
2180
2181 report_res_error:
Emeric Brun43839d02021-06-10 15:25:25 +02002182 keep_answer_items = 0;
Emeric Brunc9437992021-02-12 19:42:55 +01002183 list_for_each_entry(req, &res->requesters, list)
Emeric Brun43839d02021-06-10 15:25:25 +02002184 keep_answer_items |= req->requester_error_cb(req, dns_resp);
2185 if (!keep_answer_items)
2186 resolv_purge_resolution_answer_records(res);
Emeric Brunc9437992021-02-12 19:42:55 +01002187 resolv_reset_resolution(res);
Willy Tarreau2b718102021-04-21 07:32:39 +02002188 LIST_DELETE(&res->list);
2189 LIST_APPEND(&resolvers->resolutions.wait, &res->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002190 continue;
2191
2192 report_res_success:
2193 /* Only the 1rst requester s managed by the server, others are
2194 * from the cache */
2195 tmpcounters = ns->counters;
2196 list_for_each_entry(req, &res->requesters, list) {
2197 struct server *s = objt_server(req->owner);
2198
2199 if (s)
2200 HA_SPIN_LOCK(SERVER_LOCK, &s->lock);
2201 req->requester_cb(req, tmpcounters);
2202 if (s)
2203 HA_SPIN_UNLOCK(SERVER_LOCK, &s->lock);
2204 tmpcounters = NULL;
2205 }
2206
2207 resolv_reset_resolution(res);
Willy Tarreau2b718102021-04-21 07:32:39 +02002208 LIST_DELETE(&res->list);
2209 LIST_APPEND(&resolvers->resolutions.wait, &res->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002210 continue;
2211 }
2212 resolv_update_resolvers_timeout(resolvers);
2213 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
2214
2215 return buflen;
2216}
2217
2218/* Processes DNS resolution. First, it checks the active list to detect expired
2219 * resolutions and retry them if possible. Else a timeout is reported. Then, it
2220 * checks the wait list to trigger new resolutions.
2221 */
Willy Tarreau144f84a2021-03-02 16:09:26 +01002222static struct task *process_resolvers(struct task *t, void *context, unsigned int state)
Emeric Brunc9437992021-02-12 19:42:55 +01002223{
2224 struct resolvers *resolvers = context;
2225 struct resolv_resolution *res, *resback;
2226 int exp;
2227
2228 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
2229
2230 /* Handle all expired resolutions from the active list */
2231 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
Christopher Faulet0efc0992021-03-11 18:09:53 +01002232 if (LIST_ISEMPTY(&res->requesters)) {
2233 resolv_free_resolution(res);
2234 continue;
2235 }
2236
Emeric Brunc9437992021-02-12 19:42:55 +01002237 /* When we find the first resolution in the future, then we can
2238 * stop here */
2239 exp = tick_add(res->last_query, resolvers->timeout.retry);
2240 if (!tick_is_expired(exp, now_ms))
2241 break;
2242
2243 /* If current resolution has been tried too many times and
2244 * finishes in timeout we update its status and remove it from
2245 * the list */
2246 if (!res->try) {
2247 struct resolv_requester *req;
Emeric Brun43839d02021-06-10 15:25:25 +02002248 int keep_answer_items = 0;
Emeric Brunc9437992021-02-12 19:42:55 +01002249
2250 /* Notify the result to the requesters */
2251 if (!res->nb_responses)
2252 res->status = RSLV_STATUS_TIMEOUT;
2253 list_for_each_entry(req, &res->requesters, list)
Emeric Brun43839d02021-06-10 15:25:25 +02002254 keep_answer_items |= req->requester_error_cb(req, res->status);
2255 if (!keep_answer_items)
2256 resolv_purge_resolution_answer_records(res);
Emeric Brunc9437992021-02-12 19:42:55 +01002257
2258 /* Clean up resolution info and remove it from the
2259 * current list */
2260 resolv_reset_resolution(res);
Willy Tarreau2b718102021-04-21 07:32:39 +02002261 LIST_DELETE(&res->list);
2262 LIST_APPEND(&resolvers->resolutions.wait, &res->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002263 }
2264 else {
2265 /* Otherwise resend the DNS query and requeue the resolution */
2266 if (!res->nb_responses || res->prefered_query_type != res->query_type) {
2267 /* No response received (a real timeout) or fallback already done */
2268 res->query_type = res->prefered_query_type;
2269 res->try--;
2270 }
2271 else {
2272 /* Fallback from A to AAAA or the opposite and re-send
2273 * the resolution immediately. try counter is not
2274 * decremented. */
2275 if (res->prefered_query_type == DNS_RTYPE_A)
2276 res->query_type = DNS_RTYPE_AAAA;
2277 else if (res->prefered_query_type == DNS_RTYPE_AAAA)
2278 res->query_type = DNS_RTYPE_A;
2279 else
2280 res->try--;
2281 }
2282 resolv_send_query(res);
2283 }
2284 }
2285
2286 /* Handle all resolutions in the wait list */
2287 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
Christopher Faulet0efc0992021-03-11 18:09:53 +01002288 if (LIST_ISEMPTY(&res->requesters)) {
2289 resolv_free_resolution(res);
2290 continue;
2291 }
2292
Emeric Brunc9437992021-02-12 19:42:55 +01002293 exp = tick_add(res->last_resolution, resolv_resolution_timeout(res));
2294 if (tick_isset(res->last_resolution) && !tick_is_expired(exp, now_ms))
2295 continue;
2296
2297 if (resolv_run_resolution(res) != 1) {
2298 res->last_resolution = now_ms;
Willy Tarreau2b718102021-04-21 07:32:39 +02002299 LIST_DELETE(&res->list);
2300 LIST_APPEND(&resolvers->resolutions.wait, &res->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002301 }
2302 }
2303
2304 resolv_update_resolvers_timeout(resolvers);
2305 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
2306 return t;
2307}
2308
2309/* Release memory allocated by DNS */
2310static void resolvers_deinit(void)
2311{
2312 struct resolvers *resolvers, *resolversback;
2313 struct dns_nameserver *ns, *nsback;
2314 struct resolv_resolution *res, *resback;
2315 struct resolv_requester *req, *reqback;
2316 struct resolv_srvrq *srvrq, *srvrqback;
2317
2318 list_for_each_entry_safe(resolvers, resolversback, &sec_resolvers, list) {
2319 list_for_each_entry_safe(ns, nsback, &resolvers->nameservers, list) {
2320 free(ns->id);
2321 free((char *)ns->conf.file);
2322 if (ns->dgram) {
2323 if (ns->dgram->conn.t.sock.fd != -1) {
2324 fd_delete(ns->dgram->conn.t.sock.fd);
2325 close(ns->dgram->conn.t.sock.fd);
2326 }
2327 if (ns->dgram->ring_req)
2328 ring_free(ns->dgram->ring_req);
2329 free(ns->dgram);
2330 }
Emeric Brun56fc5d92021-02-12 20:05:45 +01002331 if (ns->stream) {
2332 if (ns->stream->ring_req)
2333 ring_free(ns->stream->ring_req);
2334 if (ns->stream->task_req)
2335 task_destroy(ns->stream->task_req);
2336 if (ns->stream->task_rsp)
2337 task_destroy(ns->stream->task_rsp);
2338 free(ns->stream);
2339 }
Willy Tarreau2b718102021-04-21 07:32:39 +02002340 LIST_DELETE(&ns->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002341 EXTRA_COUNTERS_FREE(ns->extra_counters);
2342 free(ns);
2343 }
2344
2345 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
2346 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
Willy Tarreau2b718102021-04-21 07:32:39 +02002347 LIST_DELETE(&req->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002348 pool_free(resolv_requester_pool, req);
2349 }
2350 resolv_free_resolution(res);
2351 }
2352
2353 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
2354 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
Willy Tarreau2b718102021-04-21 07:32:39 +02002355 LIST_DELETE(&req->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002356 pool_free(resolv_requester_pool, req);
2357 }
2358 resolv_free_resolution(res);
2359 }
2360
2361 free(resolvers->id);
2362 free((char *)resolvers->conf.file);
2363 task_destroy(resolvers->t);
Willy Tarreau2b718102021-04-21 07:32:39 +02002364 LIST_DELETE(&resolvers->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002365 free(resolvers);
2366 }
2367
2368 list_for_each_entry_safe(srvrq, srvrqback, &resolv_srvrq_list, list) {
2369 free(srvrq->name);
2370 free(srvrq->hostname_dn);
Willy Tarreau2b718102021-04-21 07:32:39 +02002371 LIST_DELETE(&srvrq->list);
Emeric Brunc9437992021-02-12 19:42:55 +01002372 free(srvrq);
2373 }
2374}
2375
2376/* Finalizes the DNS configuration by allocating required resources and checking
2377 * live parameters.
2378 * Returns 0 on success, ERR_* flags otherwise.
2379 */
2380static int resolvers_finalize_config(void)
2381{
2382 struct resolvers *resolvers;
2383 struct proxy *px;
2384 int err_code = 0;
2385
2386 /* allocate pool of resolution per resolvers */
2387 list_for_each_entry(resolvers, &sec_resolvers, list) {
2388 struct dns_nameserver *ns;
2389 struct task *t;
2390
2391 /* Check if we can create the socket with nameservers info */
2392 list_for_each_entry(ns, &resolvers->nameservers, list) {
2393 int fd;
2394
2395 if (ns->dgram) {
2396 /* Check nameserver info */
2397 if ((fd = socket(ns->dgram->conn.addr.to.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
2398 ha_alert("config : resolvers '%s': can't create socket for nameserver '%s'.\n",
2399 resolvers->id, ns->id);
2400 err_code |= (ERR_ALERT|ERR_ABORT);
2401 continue;
2402 }
2403 if (connect(fd, (struct sockaddr*)&ns->dgram->conn.addr.to, get_addr_len(&ns->dgram->conn.addr.to)) == -1) {
2404 ha_alert("config : resolvers '%s': can't connect socket for nameserver '%s'.\n",
2405 resolvers->id, ns->id);
2406 close(fd);
2407 err_code |= (ERR_ALERT|ERR_ABORT);
2408 continue;
2409 }
2410 close(fd);
2411 }
2412 }
2413
2414 /* Create the task associated to the resolvers section */
2415 if ((t = task_new(MAX_THREADS_MASK)) == NULL) {
2416 ha_alert("config : resolvers '%s' : out of memory.\n", resolvers->id);
2417 err_code |= (ERR_ALERT|ERR_ABORT);
2418 goto err;
2419 }
2420
2421 /* Update task's parameters */
2422 t->process = process_resolvers;
2423 t->context = resolvers;
2424 resolvers->t = t;
2425 task_wakeup(t, TASK_WOKEN_INIT);
2426 }
2427
2428 for (px = proxies_list; px; px = px->next) {
2429 struct server *srv;
2430
2431 for (srv = px->srv; srv; srv = srv->next) {
2432 struct resolvers *resolvers;
2433
2434 if (!srv->resolvers_id)
2435 continue;
2436
2437 if ((resolvers = find_resolvers_by_id(srv->resolvers_id)) == NULL) {
2438 ha_alert("config : %s '%s', server '%s': unable to find required resolvers '%s'\n",
2439 proxy_type_str(px), px->id, srv->id, srv->resolvers_id);
2440 err_code |= (ERR_ALERT|ERR_ABORT);
2441 continue;
2442 }
2443 srv->resolvers = resolvers;
Christopher Faulet2c0f5272021-06-15 16:17:17 +02002444 srv->srvrq_check = NULL;
2445 if (srv->srvrq) {
2446 if (!srv->srvrq->resolvers) {
2447 srv->srvrq->resolvers = srv->resolvers;
2448 if (resolv_link_resolution(srv->srvrq, OBJ_TYPE_SRVRQ, 0) == -1) {
2449 ha_alert("config : %s '%s' : unable to set DNS resolution for server '%s'.\n",
2450 proxy_type_str(px), px->id, srv->id);
2451 err_code |= (ERR_ALERT|ERR_ABORT);
2452 continue;
2453 }
2454 }
Emeric Brunc9437992021-02-12 19:42:55 +01002455
Christopher Faulet2c0f5272021-06-15 16:17:17 +02002456 srv->srvrq_check = task_new(MAX_THREADS_MASK);
2457 if (!srv->srvrq_check) {
2458 ha_alert("config: %s '%s' : unable to create SRVRQ task for server '%s'.\n",
Emeric Brunc9437992021-02-12 19:42:55 +01002459 proxy_type_str(px), px->id, srv->id);
2460 err_code |= (ERR_ALERT|ERR_ABORT);
Christopher Faulet2c0f5272021-06-15 16:17:17 +02002461 goto err;
Emeric Brunc9437992021-02-12 19:42:55 +01002462 }
Christopher Faulet2c0f5272021-06-15 16:17:17 +02002463 srv->srvrq_check->process = resolv_srvrq_expire_task;
2464 srv->srvrq_check->context = srv;
2465 srv->srvrq_check->expire = TICK_ETERNITY;
Emeric Brunc9437992021-02-12 19:42:55 +01002466 }
Christopher Faulet2c0f5272021-06-15 16:17:17 +02002467 else if (resolv_link_resolution(srv, OBJ_TYPE_SERVER, 0) == -1) {
Emeric Brunc9437992021-02-12 19:42:55 +01002468 ha_alert("config : %s '%s', unable to set DNS resolution for server '%s'.\n",
2469 proxy_type_str(px), px->id, srv->id);
2470 err_code |= (ERR_ALERT|ERR_ABORT);
2471 continue;
2472 }
2473 }
2474 }
2475
2476 if (err_code & (ERR_ALERT|ERR_ABORT))
2477 goto err;
2478
2479 return err_code;
2480 err:
2481 resolvers_deinit();
2482 return err_code;
2483
2484}
2485
2486static int stats_dump_resolv_to_buffer(struct stream_interface *si,
2487 struct dns_nameserver *ns,
2488 struct field *stats, size_t stats_count,
2489 struct list *stat_modules)
2490{
2491 struct appctx *appctx = __objt_appctx(si->end);
2492 struct channel *rep = si_ic(si);
2493 struct stats_module *mod;
2494 size_t idx = 0;
2495
2496 memset(stats, 0, sizeof(struct field) * stats_count);
2497
2498 list_for_each_entry(mod, stat_modules, list) {
2499 struct counters_node *counters = EXTRA_COUNTERS_GET(ns->extra_counters, mod);
2500
2501 mod->fill_stats(counters, stats + idx);
2502 idx += mod->stats_count;
2503 }
2504
2505 if (!stats_dump_one_line(stats, idx, appctx))
2506 return 0;
2507
2508 if (!stats_putchk(rep, NULL, &trash))
2509 goto full;
2510
2511 return 1;
2512
2513 full:
2514 si_rx_room_rdy(si);
2515 return 0;
2516}
2517
2518/* Uses <appctx.ctx.stats.obj1> as a pointer to the current resolver and <obj2>
2519 * as a pointer to the current nameserver.
2520 */
2521int stats_dump_resolvers(struct stream_interface *si,
2522 struct field *stats, size_t stats_count,
2523 struct list *stat_modules)
2524{
2525 struct appctx *appctx = __objt_appctx(si->end);
2526 struct channel *rep = si_ic(si);
2527 struct resolvers *resolver = appctx->ctx.stats.obj1;
2528 struct dns_nameserver *ns = appctx->ctx.stats.obj2;
2529
2530 if (!resolver)
2531 resolver = LIST_NEXT(&sec_resolvers, struct resolvers *, list);
2532
2533 /* dump resolvers */
2534 list_for_each_entry_from(resolver, &sec_resolvers, list) {
2535 appctx->ctx.stats.obj1 = resolver;
2536
2537 ns = appctx->ctx.stats.obj2 ?
2538 appctx->ctx.stats.obj2 :
2539 LIST_NEXT(&resolver->nameservers, struct dns_nameserver *, list);
2540
2541 list_for_each_entry_from(ns, &resolver->nameservers, list) {
2542 appctx->ctx.stats.obj2 = ns;
2543
2544 if (buffer_almost_full(&rep->buf))
2545 goto full;
2546
2547 if (!stats_dump_resolv_to_buffer(si, ns,
2548 stats, stats_count,
2549 stat_modules)) {
2550 return 0;
2551 }
2552 }
2553
2554 appctx->ctx.stats.obj2 = NULL;
2555 }
2556
2557 return 1;
2558
2559 full:
2560 si_rx_room_blk(si);
2561 return 0;
2562}
2563
2564void resolv_stats_clear_counters(int clrall, struct list *stat_modules)
2565{
2566 struct resolvers *resolvers;
2567 struct dns_nameserver *ns;
2568 struct stats_module *mod;
2569 void *counters;
2570
2571 list_for_each_entry(mod, stat_modules, list) {
2572 if (!mod->clearable && !clrall)
2573 continue;
2574
2575 list_for_each_entry(resolvers, &sec_resolvers, list) {
2576 list_for_each_entry(ns, &resolvers->nameservers, list) {
2577 counters = EXTRA_COUNTERS_GET(ns->extra_counters, mod);
2578 memcpy(counters, mod->counters, mod->counters_size);
2579 }
2580 }
2581 }
2582
2583}
2584
2585int resolv_allocate_counters(struct list *stat_modules)
2586{
2587 struct stats_module *mod;
2588 struct resolvers *resolvers;
2589 struct dns_nameserver *ns;
2590
2591 list_for_each_entry(resolvers, &sec_resolvers, list) {
2592 list_for_each_entry(ns, &resolvers->nameservers, list) {
2593 EXTRA_COUNTERS_REGISTER(&ns->extra_counters, COUNTERS_DNS,
2594 alloc_failed);
2595
2596 list_for_each_entry(mod, stat_modules, list) {
2597 EXTRA_COUNTERS_ADD(mod,
2598 ns->extra_counters,
2599 mod->counters,
2600 mod->counters_size);
2601 }
2602
2603 EXTRA_COUNTERS_ALLOC(ns->extra_counters, alloc_failed);
2604
2605 list_for_each_entry(mod, stat_modules, list) {
2606 memcpy(ns->extra_counters->data + mod->counters_off[ns->extra_counters->type],
2607 mod->counters, mod->counters_size);
2608
2609 /* Store the ns counters pointer */
2610 if (strcmp(mod->name, "dns") == 0) {
2611 ns->counters = (struct dns_counters *)ns->extra_counters->data + mod->counters_off[COUNTERS_DNS];
2612 ns->counters->id = ns->id;
2613 ns->counters->pid = resolvers->id;
2614 }
2615 }
2616 }
2617 }
2618
2619 return 1;
2620
2621alloc_failed:
2622 return 0;
2623}
2624
2625/* if an arg is found, it sets the resolvers section pointer into cli.p0 */
2626static int cli_parse_stat_resolvers(char **args, char *payload, struct appctx *appctx, void *private)
2627{
2628 struct resolvers *presolvers;
2629
2630 if (*args[2]) {
2631 list_for_each_entry(presolvers, &sec_resolvers, list) {
2632 if (strcmp(presolvers->id, args[2]) == 0) {
2633 appctx->ctx.cli.p0 = presolvers;
2634 break;
2635 }
2636 }
2637 if (appctx->ctx.cli.p0 == NULL)
2638 return cli_err(appctx, "Can't find that resolvers section\n");
2639 }
2640 return 0;
2641}
2642
2643/* Dumps counters from all resolvers section and associated name servers. It
2644 * returns 0 if the output buffer is full and it needs to be called again,
2645 * otherwise non-zero. It may limit itself to the resolver pointed to by
2646 * <cli.p0> if it's not null.
2647 */
2648static int cli_io_handler_dump_resolvers_to_buffer(struct appctx *appctx)
2649{
2650 struct stream_interface *si = appctx->owner;
2651 struct resolvers *resolvers;
2652 struct dns_nameserver *ns;
2653
2654 chunk_reset(&trash);
2655
2656 switch (appctx->st2) {
2657 case STAT_ST_INIT:
2658 appctx->st2 = STAT_ST_LIST; /* let's start producing data */
2659 /* fall through */
2660
2661 case STAT_ST_LIST:
2662 if (LIST_ISEMPTY(&sec_resolvers)) {
2663 chunk_appendf(&trash, "No resolvers found\n");
2664 }
2665 else {
2666 list_for_each_entry(resolvers, &sec_resolvers, list) {
2667 if (appctx->ctx.cli.p0 != NULL && appctx->ctx.cli.p0 != resolvers)
2668 continue;
2669
2670 chunk_appendf(&trash, "Resolvers section %s\n", resolvers->id);
2671 list_for_each_entry(ns, &resolvers->nameservers, list) {
2672 chunk_appendf(&trash, " nameserver %s:\n", ns->id);
2673 chunk_appendf(&trash, " sent: %lld\n", ns->counters->sent);
2674 chunk_appendf(&trash, " snd_error: %lld\n", ns->counters->snd_error);
2675 chunk_appendf(&trash, " valid: %lld\n", ns->counters->valid);
2676 chunk_appendf(&trash, " update: %lld\n", ns->counters->update);
2677 chunk_appendf(&trash, " cname: %lld\n", ns->counters->cname);
2678 chunk_appendf(&trash, " cname_error: %lld\n", ns->counters->cname_error);
2679 chunk_appendf(&trash, " any_err: %lld\n", ns->counters->any_err);
2680 chunk_appendf(&trash, " nx: %lld\n", ns->counters->nx);
2681 chunk_appendf(&trash, " timeout: %lld\n", ns->counters->timeout);
2682 chunk_appendf(&trash, " refused: %lld\n", ns->counters->refused);
2683 chunk_appendf(&trash, " other: %lld\n", ns->counters->other);
2684 chunk_appendf(&trash, " invalid: %lld\n", ns->counters->invalid);
2685 chunk_appendf(&trash, " too_big: %lld\n", ns->counters->too_big);
2686 chunk_appendf(&trash, " truncated: %lld\n", ns->counters->truncated);
2687 chunk_appendf(&trash, " outdated: %lld\n", ns->counters->outdated);
2688 }
2689 chunk_appendf(&trash, "\n");
2690 }
2691 }
2692
2693 /* display response */
2694 if (ci_putchk(si_ic(si), &trash) == -1) {
2695 /* let's try again later from this session. We add ourselves into
2696 * this session's users so that it can remove us upon termination.
2697 */
2698 si_rx_room_blk(si);
2699 return 0;
2700 }
2701 /* fall through */
2702
2703 default:
2704 appctx->st2 = STAT_ST_FIN;
2705 return 1;
2706 }
2707}
2708
2709/* register cli keywords */
2710static struct cli_kw_list cli_kws = {{ }, {
Willy Tarreaub205bfd2021-05-07 11:38:37 +02002711 { { "show", "resolvers", NULL }, "show resolvers [id] : dumps counters from all resolvers section and associated name servers",
Emeric Brunc9437992021-02-12 19:42:55 +01002712 cli_parse_stat_resolvers, cli_io_handler_dump_resolvers_to_buffer },
2713 {{},}
2714 }
2715};
2716
2717INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
2718
2719/*
2720 * Prepare <rule> for hostname resolution.
2721 * Returns -1 in case of any allocation failure, 0 if not.
2722 * On error, a global failure counter is also incremented.
2723 */
2724static int action_prepare_for_resolution(struct stream *stream, const char *hostname)
2725{
2726 char *hostname_dn;
2727 int hostname_len, hostname_dn_len;
2728 struct buffer *tmp = get_trash_chunk();
2729
2730 if (!hostname)
2731 return 0;
2732
2733 hostname_len = strlen(hostname);
2734 hostname_dn = tmp->area;
2735 hostname_dn_len = resolv_str_to_dn_label(hostname, hostname_len + 1,
2736 hostname_dn, tmp->size);
2737 if (hostname_dn_len == -1)
2738 goto err;
2739
2740
2741 stream->resolv_ctx.hostname_dn = strdup(hostname_dn);
2742 stream->resolv_ctx.hostname_dn_len = hostname_dn_len;
2743 if (!stream->resolv_ctx.hostname_dn)
2744 goto err;
2745
2746 return 0;
2747
2748 err:
Willy Tarreau61cfdf42021-02-20 10:46:51 +01002749 ha_free(&stream->resolv_ctx.hostname_dn);
Emeric Brunc9437992021-02-12 19:42:55 +01002750 resolv_failed_resolutions += 1;
2751 return -1;
2752}
2753
2754
2755/*
2756 * Execute the "do-resolution" action. May be called from {tcp,http}request.
2757 */
2758enum act_return resolv_action_do_resolve(struct act_rule *rule, struct proxy *px,
2759 struct session *sess, struct stream *s, int flags)
2760{
2761 struct resolv_resolution *resolution;
2762 struct sample *smp;
2763 char *fqdn;
2764 struct resolv_requester *req;
2765 struct resolvers *resolvers;
2766 struct resolv_resolution *res;
2767 int exp, locked = 0;
2768 enum act_return ret = ACT_RET_CONT;
2769
2770 resolvers = rule->arg.resolv.resolvers;
2771
2772 /* we have a response to our DNS resolution */
2773 use_cache:
2774 if (s->resolv_ctx.requester && s->resolv_ctx.requester->resolution != NULL) {
2775 resolution = s->resolv_ctx.requester->resolution;
2776 if (!locked) {
2777 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
2778 locked = 1;
2779 }
2780
2781 if (resolution->step == RSLV_STEP_RUNNING)
2782 goto yield;
2783 if (resolution->step == RSLV_STEP_NONE) {
2784 /* We update the variable only if we have a valid response. */
2785 if (resolution->status == RSLV_STATUS_VALID) {
2786 struct sample smp;
2787 short ip_sin_family = 0;
2788 void *ip = NULL;
2789
2790 resolv_get_ip_from_response(&resolution->response, rule->arg.resolv.opts, NULL,
2791 0, &ip, &ip_sin_family, NULL);
2792
2793 switch (ip_sin_family) {
2794 case AF_INET:
2795 smp.data.type = SMP_T_IPV4;
2796 memcpy(&smp.data.u.ipv4, ip, 4);
2797 break;
2798 case AF_INET6:
2799 smp.data.type = SMP_T_IPV6;
2800 memcpy(&smp.data.u.ipv6, ip, 16);
2801 break;
2802 default:
2803 ip = NULL;
2804 }
2805
2806 if (ip) {
2807 smp.px = px;
2808 smp.sess = sess;
2809 smp.strm = s;
2810
2811 vars_set_by_name(rule->arg.resolv.varname, strlen(rule->arg.resolv.varname), &smp);
2812 }
2813 }
2814 }
2815
2816 goto release_requester;
2817 }
2818
2819 /* need to configure and start a new DNS resolution */
2820 smp = sample_fetch_as_type(px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.resolv.expr, SMP_T_STR);
2821 if (smp == NULL)
2822 goto end;
2823
2824 fqdn = smp->data.u.str.area;
2825 if (action_prepare_for_resolution(s, fqdn) == -1)
2826 goto end; /* on error, ignore the action */
2827
2828 s->resolv_ctx.parent = rule;
2829
2830 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
2831 locked = 1;
2832
2833 resolv_link_resolution(s, OBJ_TYPE_STREAM, 0);
2834
2835 /* Check if there is a fresh enough response in the cache of our associated resolution */
2836 req = s->resolv_ctx.requester;
2837 if (!req || !req->resolution)
2838 goto release_requester; /* on error, ignore the action */
2839 res = req->resolution;
2840
2841 exp = tick_add(res->last_resolution, resolvers->hold.valid);
2842 if (resolvers->t && res->status == RSLV_STATUS_VALID && tick_isset(res->last_resolution)
2843 && !tick_is_expired(exp, now_ms)) {
2844 goto use_cache;
2845 }
2846
2847 resolv_trigger_resolution(s->resolv_ctx.requester);
2848
2849 yield:
2850 if (flags & ACT_OPT_FINAL)
2851 goto release_requester;
2852 ret = ACT_RET_YIELD;
2853
2854 end:
2855 if (locked)
2856 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
2857 return ret;
2858
2859 release_requester:
Willy Tarreau61cfdf42021-02-20 10:46:51 +01002860 ha_free(&s->resolv_ctx.hostname_dn);
Emeric Brunc9437992021-02-12 19:42:55 +01002861 s->resolv_ctx.hostname_dn_len = 0;
2862 if (s->resolv_ctx.requester) {
Christopher Faulet0efc0992021-03-11 18:09:53 +01002863 resolv_unlink_resolution(s->resolv_ctx.requester, 0);
Emeric Brunc9437992021-02-12 19:42:55 +01002864 pool_free(resolv_requester_pool, s->resolv_ctx.requester);
2865 s->resolv_ctx.requester = NULL;
2866 }
2867 goto end;
2868}
2869
2870static void release_resolv_action(struct act_rule *rule)
2871{
2872 release_sample_expr(rule->arg.resolv.expr);
2873 free(rule->arg.resolv.varname);
2874 free(rule->arg.resolv.resolvers_id);
2875 free(rule->arg.resolv.opts);
2876}
2877
2878
2879/* parse "do-resolve" action
2880 * This action takes the following arguments:
2881 * do-resolve(<varName>,<resolversSectionName>,<resolvePrefer>) <expr>
2882 *
2883 * - <varName> is the variable name where the result of the DNS resolution will be stored
2884 * (mandatory)
2885 * - <resolversSectionName> is the name of the resolvers section to use to perform the resolution
2886 * (mandatory)
2887 * - <resolvePrefer> can be either 'ipv4' or 'ipv6' and is the IP family we would like to resolve first
2888 * (optional), defaults to ipv6
2889 * - <expr> is an HAProxy expression used to fetch the name to be resolved
2890 */
2891enum act_parse_ret resolv_parse_do_resolve(const char **args, int *orig_arg, struct proxy *px, struct act_rule *rule, char **err)
2892{
2893 int cur_arg;
2894 struct sample_expr *expr;
2895 unsigned int where;
2896 const char *beg, *end;
2897
2898 /* orig_arg points to the first argument, but we need to analyse the command itself first */
2899 cur_arg = *orig_arg - 1;
2900
2901 /* locate varName, which is mandatory */
2902 beg = strchr(args[cur_arg], '(');
2903 if (beg == NULL)
2904 goto do_resolve_parse_error;
2905 beg = beg + 1; /* beg should points to the first character after opening parenthesis '(' */
2906 end = strchr(beg, ',');
2907 if (end == NULL)
2908 goto do_resolve_parse_error;
2909 rule->arg.resolv.varname = my_strndup(beg, end - beg);
2910 if (rule->arg.resolv.varname == NULL)
2911 goto do_resolve_parse_error;
2912
2913
2914 /* locate resolversSectionName, which is mandatory.
2915 * Since next parameters are optional, the delimiter may be comma ','
2916 * or closing parenthesis ')'
2917 */
2918 beg = end + 1;
2919 end = strchr(beg, ',');
2920 if (end == NULL)
2921 end = strchr(beg, ')');
2922 if (end == NULL)
2923 goto do_resolve_parse_error;
2924 rule->arg.resolv.resolvers_id = my_strndup(beg, end - beg);
2925 if (rule->arg.resolv.resolvers_id == NULL)
2926 goto do_resolve_parse_error;
2927
2928
2929 rule->arg.resolv.opts = calloc(1, sizeof(*rule->arg.resolv.opts));
2930 if (rule->arg.resolv.opts == NULL)
2931 goto do_resolve_parse_error;
2932
2933 /* Default priority is ipv6 */
2934 rule->arg.resolv.opts->family_prio = AF_INET6;
2935
2936 /* optional arguments accepted for now:
2937 * ipv4 or ipv6
2938 */
2939 while (*end != ')') {
2940 beg = end + 1;
2941 end = strchr(beg, ',');
2942 if (end == NULL)
2943 end = strchr(beg, ')');
2944 if (end == NULL)
2945 goto do_resolve_parse_error;
2946
2947 if (strncmp(beg, "ipv4", end - beg) == 0) {
2948 rule->arg.resolv.opts->family_prio = AF_INET;
2949 }
2950 else if (strncmp(beg, "ipv6", end - beg) == 0) {
2951 rule->arg.resolv.opts->family_prio = AF_INET6;
2952 }
2953 else {
2954 goto do_resolve_parse_error;
2955 }
2956 }
2957
2958 cur_arg = cur_arg + 1;
2959
2960 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args, NULL);
2961 if (!expr)
2962 goto do_resolve_parse_error;
2963
2964
2965 where = 0;
2966 if (px->cap & PR_CAP_FE)
2967 where |= SMP_VAL_FE_HRQ_HDR;
2968 if (px->cap & PR_CAP_BE)
2969 where |= SMP_VAL_BE_HRQ_HDR;
2970
2971 if (!(expr->fetch->val & where)) {
2972 memprintf(err,
2973 "fetch method '%s' extracts information from '%s', none of which is available here",
2974 args[cur_arg-1], sample_src_names(expr->fetch->use));
2975 free(expr);
2976 return ACT_RET_PRS_ERR;
2977 }
2978 rule->arg.resolv.expr = expr;
2979 rule->action = ACT_CUSTOM;
2980 rule->action_ptr = resolv_action_do_resolve;
2981 *orig_arg = cur_arg;
2982
2983 rule->check_ptr = check_action_do_resolve;
2984 rule->release_ptr = release_resolv_action;
2985
2986 return ACT_RET_PRS_OK;
2987
2988 do_resolve_parse_error:
Willy Tarreau61cfdf42021-02-20 10:46:51 +01002989 ha_free(&rule->arg.resolv.varname);
2990 ha_free(&rule->arg.resolv.resolvers_id);
Emeric Brunc9437992021-02-12 19:42:55 +01002991 memprintf(err, "Can't parse '%s'. Expects 'do-resolve(<varname>,<resolvers>[,<options>]) <expr>'. Available options are 'ipv4' and 'ipv6'",
2992 args[cur_arg]);
2993 return ACT_RET_PRS_ERR;
2994}
2995
2996static struct action_kw_list http_req_kws = { { }, {
Amaury Denoyellee4a617c2021-05-06 15:33:09 +02002997 { "do-resolve", resolv_parse_do_resolve, KWF_MATCH_PREFIX },
Emeric Brunc9437992021-02-12 19:42:55 +01002998 { /* END */ }
2999}};
3000
3001INITCALL1(STG_REGISTER, http_req_keywords_register, &http_req_kws);
3002
3003static struct action_kw_list tcp_req_cont_actions = {ILH, {
Amaury Denoyellee4a617c2021-05-06 15:33:09 +02003004 { "do-resolve", resolv_parse_do_resolve, KWF_MATCH_PREFIX },
Emeric Brunc9437992021-02-12 19:42:55 +01003005 { /* END */ }
3006}};
3007
3008INITCALL1(STG_REGISTER, tcp_req_cont_keywords_register, &tcp_req_cont_actions);
3009
3010/* Check an "http-request do-resolve" action.
3011 *
3012 * The function returns 1 in success case, otherwise, it returns 0 and err is
3013 * filled.
3014 */
3015int check_action_do_resolve(struct act_rule *rule, struct proxy *px, char **err)
3016{
3017 struct resolvers *resolvers = NULL;
3018
3019 if (rule->arg.resolv.resolvers_id == NULL) {
3020 memprintf(err,"Proxy '%s': %s", px->id, "do-resolve action without resolvers");
3021 return 0;
3022 }
3023
3024 resolvers = find_resolvers_by_id(rule->arg.resolv.resolvers_id);
3025 if (resolvers == NULL) {
3026 memprintf(err,"Can't find resolvers section '%s' for do-resolve action", rule->arg.resolv.resolvers_id);
3027 return 0;
3028 }
3029 rule->arg.resolv.resolvers = resolvers;
3030
3031 return 1;
3032}
3033
3034void resolvers_setup_proxy(struct proxy *px)
3035{
3036 px->last_change = now.tv_sec;
3037 px->cap = PR_CAP_FE | PR_CAP_BE;
3038 px->maxconn = 0;
3039 px->conn_retries = 1;
3040 px->timeout.server = TICK_ETERNITY;
3041 px->timeout.client = TICK_ETERNITY;
3042 px->timeout.connect = TICK_ETERNITY;
3043 px->accept = NULL;
3044 px->options2 |= PR_O2_INDEPSTR | PR_O2_SMARTCON;
3045 px->bind_proc = 0; /* will be filled by users */
3046}
3047
3048/*
3049 * Parse a <resolvers> section.
3050 * Returns the error code, 0 if OK, or any combination of :
3051 * - ERR_ABORT: must abort ASAP
3052 * - ERR_FATAL: we can continue parsing but not start the service
3053 * - ERR_WARN: a warning has been emitted
3054 * - ERR_ALERT: an alert has been emitted
3055 * Only the two first ones can stop processing, the two others are just
3056 * indicators.
3057 */
3058int cfg_parse_resolvers(const char *file, int linenum, char **args, int kwm)
3059{
3060 const char *err;
3061 int err_code = 0;
3062 char *errmsg = NULL;
3063 struct proxy *p;
3064
3065 if (strcmp(args[0], "resolvers") == 0) { /* new resolvers section */
3066 if (!*args[1]) {
3067 ha_alert("parsing [%s:%d] : missing name for resolvers section.\n", file, linenum);
3068 err_code |= ERR_ALERT | ERR_ABORT;
3069 goto out;
3070 }
3071
3072 err = invalid_char(args[1]);
3073 if (err) {
3074 ha_alert("parsing [%s:%d] : character '%c' is not permitted in '%s' name '%s'.\n",
3075 file, linenum, *err, args[0], args[1]);
3076 err_code |= ERR_ALERT | ERR_ABORT;
3077 goto out;
3078 }
3079
3080 list_for_each_entry(curr_resolvers, &sec_resolvers, list) {
3081 /* Error if two resolvers owns the same name */
3082 if (strcmp(curr_resolvers->id, args[1]) == 0) {
3083 ha_alert("Parsing [%s:%d]: resolvers '%s' has same name as another resolvers (declared at %s:%d).\n",
3084 file, linenum, args[1], curr_resolvers->conf.file, curr_resolvers->conf.line);
3085 err_code |= ERR_ALERT | ERR_ABORT;
3086 }
3087 }
3088
3089 if ((curr_resolvers = calloc(1, sizeof(*curr_resolvers))) == NULL) {
3090 ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
3091 err_code |= ERR_ALERT | ERR_ABORT;
3092 goto out;
3093 }
3094
3095 /* allocate new proxy to tcp servers */
3096 p = calloc(1, sizeof *p);
3097 if (!p) {
3098 ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
3099 err_code |= ERR_ALERT | ERR_FATAL;
3100 goto out;
3101 }
3102
3103 init_new_proxy(p);
3104 resolvers_setup_proxy(p);
3105 p->parent = curr_resolvers;
3106 p->id = strdup(args[1]);
3107 p->conf.args.file = p->conf.file = strdup(file);
3108 p->conf.args.line = p->conf.line = linenum;
3109 curr_resolvers->px = p;
3110
3111 /* default values */
Willy Tarreau2b718102021-04-21 07:32:39 +02003112 LIST_APPEND(&sec_resolvers, &curr_resolvers->list);
Emeric Brunc9437992021-02-12 19:42:55 +01003113 curr_resolvers->conf.file = strdup(file);
3114 curr_resolvers->conf.line = linenum;
3115 curr_resolvers->id = strdup(args[1]);
3116 curr_resolvers->query_ids = EB_ROOT;
3117 /* default maximum response size */
3118 curr_resolvers->accepted_payload_size = 512;
3119 /* default hold period for nx, other, refuse and timeout is 30s */
3120 curr_resolvers->hold.nx = 30000;
3121 curr_resolvers->hold.other = 30000;
3122 curr_resolvers->hold.refused = 30000;
3123 curr_resolvers->hold.timeout = 30000;
3124 curr_resolvers->hold.obsolete = 0;
3125 /* default hold period for valid is 10s */
3126 curr_resolvers->hold.valid = 10000;
3127 curr_resolvers->timeout.resolve = 1000;
3128 curr_resolvers->timeout.retry = 1000;
3129 curr_resolvers->resolve_retries = 3;
3130 LIST_INIT(&curr_resolvers->nameservers);
3131 LIST_INIT(&curr_resolvers->resolutions.curr);
3132 LIST_INIT(&curr_resolvers->resolutions.wait);
3133 HA_SPIN_INIT(&curr_resolvers->lock);
3134 }
3135 else if (strcmp(args[0], "nameserver") == 0) { /* nameserver definition */
3136 struct dns_nameserver *newnameserver = NULL;
3137 struct sockaddr_storage *sk;
3138 int port1, port2;
Emeric Brunc8f3e452021-04-07 16:04:54 +02003139 struct protocol *proto;
Emeric Brunc9437992021-02-12 19:42:55 +01003140
3141 if (!*args[2]) {
3142 ha_alert("parsing [%s:%d] : '%s' expects <name> and <addr>[:<port>] as arguments.\n",
3143 file, linenum, args[0]);
3144 err_code |= ERR_ALERT | ERR_FATAL;
3145 goto out;
3146 }
3147
3148 err = invalid_char(args[1]);
3149 if (err) {
3150 ha_alert("parsing [%s:%d] : character '%c' is not permitted in server name '%s'.\n",
3151 file, linenum, *err, args[1]);
3152 err_code |= ERR_ALERT | ERR_FATAL;
3153 goto out;
3154 }
3155
3156 list_for_each_entry(newnameserver, &curr_resolvers->nameservers, list) {
3157 /* Error if two resolvers owns the same name */
3158 if (strcmp(newnameserver->id, args[1]) == 0) {
3159 ha_alert("Parsing [%s:%d]: nameserver '%s' has same name as another nameserver (declared at %s:%d).\n",
3160 file, linenum, args[1], newnameserver->conf.file, newnameserver->conf.line);
3161 err_code |= ERR_ALERT | ERR_FATAL;
3162 }
3163 }
3164
Emeric Brunc8f3e452021-04-07 16:04:54 +02003165 sk = str2sa_range(args[2], NULL, &port1, &port2, NULL, &proto,
3166 &errmsg, NULL, NULL, PA_O_RESOLVE | PA_O_PORT_OK | PA_O_PORT_MAND | PA_O_DGRAM | PA_O_STREAM | PA_O_DEFAULT_DGRAM);
Emeric Brunc9437992021-02-12 19:42:55 +01003167 if (!sk) {
3168 ha_alert("parsing [%s:%d] : '%s %s' : %s\n", file, linenum, args[0], args[1], errmsg);
3169 err_code |= ERR_ALERT | ERR_FATAL;
3170 goto out;
3171 }
3172
3173 if ((newnameserver = calloc(1, sizeof(*newnameserver))) == NULL) {
3174 ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
3175 err_code |= ERR_ALERT | ERR_ABORT;
3176 goto out;
3177 }
3178
Emeric Brunc8f3e452021-04-07 16:04:54 +02003179 if (proto && proto->ctrl_type == SOCK_STREAM) {
3180 err_code |= parse_server(file, linenum, args, curr_resolvers->px, NULL,
3181 SRV_PARSE_PARSE_ADDR|SRV_PARSE_INITIAL_RESOLVE);
3182 if (err_code & (ERR_FATAL|ERR_ABORT)) {
3183 err_code |= ERR_ABORT;
3184 goto out;
3185 }
3186
3187 if (dns_stream_init(newnameserver, curr_resolvers->px->srv) < 0) {
3188 ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
3189 err_code |= ERR_ALERT|ERR_ABORT;
3190 goto out;
3191 }
3192 }
3193 else if (dns_dgram_init(newnameserver, sk) < 0) {
Emeric Brunc9437992021-02-12 19:42:55 +01003194 ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
3195 err_code |= ERR_ALERT | ERR_ABORT;
3196 goto out;
3197 }
3198
3199 if ((newnameserver->conf.file = strdup(file)) == NULL) {
3200 ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
3201 err_code |= ERR_ALERT | ERR_ABORT;
3202 goto out;
3203 }
3204
3205 if ((newnameserver->id = strdup(args[1])) == NULL) {
3206 ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
3207 err_code |= ERR_ALERT | ERR_ABORT;
3208 goto out;
3209 }
3210
3211 newnameserver->parent = curr_resolvers;
3212 newnameserver->process_responses = resolv_process_responses;
3213 newnameserver->conf.line = linenum;
3214 /* the nameservers are linked backward first */
Willy Tarreau2b718102021-04-21 07:32:39 +02003215 LIST_APPEND(&curr_resolvers->nameservers, &newnameserver->list);
Emeric Brunc9437992021-02-12 19:42:55 +01003216 }
3217 else if (strcmp(args[0], "parse-resolv-conf") == 0) {
3218 struct dns_nameserver *newnameserver = NULL;
3219 const char *whitespace = "\r\n\t ";
3220 char *resolv_line = NULL;
3221 int resolv_linenum = 0;
3222 FILE *f = NULL;
3223 char *address = NULL;
3224 struct sockaddr_storage *sk = NULL;
3225 struct protocol *proto;
3226 int duplicate_name = 0;
3227
3228 if ((resolv_line = malloc(sizeof(*resolv_line) * LINESIZE)) == NULL) {
3229 ha_alert("parsing [%s:%d] : out of memory.\n",
3230 file, linenum);
3231 err_code |= ERR_ALERT | ERR_FATAL;
3232 goto resolv_out;
3233 }
3234
3235 if ((f = fopen("/etc/resolv.conf", "r")) == NULL) {
3236 ha_alert("parsing [%s:%d] : failed to open /etc/resolv.conf.\n",
3237 file, linenum);
3238 err_code |= ERR_ALERT | ERR_FATAL;
3239 goto resolv_out;
3240 }
3241
3242 sk = calloc(1, sizeof(*sk));
3243 if (sk == NULL) {
3244 ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n",
3245 resolv_linenum);
3246 err_code |= ERR_ALERT | ERR_FATAL;
3247 goto resolv_out;
3248 }
3249
3250 while (fgets(resolv_line, LINESIZE, f) != NULL) {
3251 resolv_linenum++;
3252 if (strncmp(resolv_line, "nameserver", 10) != 0)
3253 continue;
3254
3255 address = strtok(resolv_line + 10, whitespace);
3256 if (address == resolv_line + 10)
3257 continue;
3258
3259 if (address == NULL) {
3260 ha_warning("parsing [/etc/resolv.conf:%d] : nameserver line is missing address.\n",
3261 resolv_linenum);
3262 err_code |= ERR_WARN;
3263 continue;
3264 }
3265
3266 duplicate_name = 0;
3267 list_for_each_entry(newnameserver, &curr_resolvers->nameservers, list) {
3268 if (strcmp(newnameserver->id, address) == 0) {
3269 ha_warning("Parsing [/etc/resolv.conf:%d] : generated name for /etc/resolv.conf nameserver '%s' conflicts with another nameserver (declared at %s:%d), it appears to be a duplicate and will be excluded.\n",
3270 resolv_linenum, address, newnameserver->conf.file, newnameserver->conf.line);
3271 err_code |= ERR_WARN;
3272 duplicate_name = 1;
3273 }
3274 }
3275
3276 if (duplicate_name)
3277 continue;
3278
3279 memset(sk, 0, sizeof(*sk));
3280 if (!str2ip2(address, sk, 1)) {
3281 ha_warning("parsing [/etc/resolv.conf:%d] : address '%s' could not be recognized, nameserver will be excluded.\n",
3282 resolv_linenum, address);
3283 err_code |= ERR_WARN;
3284 continue;
3285 }
3286
3287 set_host_port(sk, 53);
3288
3289 proto = protocol_by_family(sk->ss_family);
3290 if (!proto || !proto->connect) {
3291 ha_warning("parsing [/etc/resolv.conf:%d] : '%s' : connect() not supported for this address family.\n",
3292 resolv_linenum, address);
3293 err_code |= ERR_WARN;
3294 continue;
3295 }
3296
3297 if ((newnameserver = calloc(1, sizeof(*newnameserver))) == NULL) {
3298 ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n", resolv_linenum);
3299 err_code |= ERR_ALERT | ERR_FATAL;
3300 goto resolv_out;
3301 }
3302
3303 if (dns_dgram_init(newnameserver, sk) < 0) {
3304 ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n", resolv_linenum);
3305 err_code |= ERR_ALERT | ERR_FATAL;
3306 free(newnameserver);
3307 goto resolv_out;
3308 }
3309
3310 newnameserver->conf.file = strdup("/etc/resolv.conf");
3311 if (newnameserver->conf.file == NULL) {
3312 ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n", resolv_linenum);
3313 err_code |= ERR_ALERT | ERR_FATAL;
3314 free(newnameserver);
3315 goto resolv_out;
3316 }
3317
3318 newnameserver->id = strdup(address);
3319 if (newnameserver->id == NULL) {
3320 ha_alert("parsing [/etc/resolv.conf:%d] : out of memory.\n", resolv_linenum);
3321 err_code |= ERR_ALERT | ERR_FATAL;
3322 free((char *)newnameserver->conf.file);
3323 free(newnameserver);
3324 goto resolv_out;
3325 }
3326
3327 newnameserver->parent = curr_resolvers;
3328 newnameserver->process_responses = resolv_process_responses;
3329 newnameserver->conf.line = resolv_linenum;
Willy Tarreau2b718102021-04-21 07:32:39 +02003330 LIST_APPEND(&curr_resolvers->nameservers, &newnameserver->list);
Emeric Brunc9437992021-02-12 19:42:55 +01003331 }
3332
3333resolv_out:
3334 free(sk);
3335 free(resolv_line);
3336 if (f != NULL)
3337 fclose(f);
3338 }
3339 else if (strcmp(args[0], "hold") == 0) { /* hold periods */
3340 const char *res;
3341 unsigned int time;
3342
3343 if (!*args[2]) {
3344 ha_alert("parsing [%s:%d] : '%s' expects an <event> and a <time> as arguments.\n",
3345 file, linenum, args[0]);
3346 ha_alert("<event> can be either 'valid', 'nx', 'refused', 'timeout', or 'other'\n");
3347 err_code |= ERR_ALERT | ERR_FATAL;
3348 goto out;
3349 }
3350 res = parse_time_err(args[2], &time, TIME_UNIT_MS);
3351 if (res == PARSE_TIME_OVER) {
3352 ha_alert("parsing [%s:%d]: timer overflow in argument <%s> to <%s>, maximum value is 2147483647 ms (~24.8 days).\n",
3353 file, linenum, args[1], args[0]);
3354 err_code |= ERR_ALERT | ERR_FATAL;
3355 goto out;
3356 }
3357 else if (res == PARSE_TIME_UNDER) {
3358 ha_alert("parsing [%s:%d]: timer underflow in argument <%s> to <%s>, minimum non-null value is 1 ms.\n",
3359 file, linenum, args[1], args[0]);
3360 err_code |= ERR_ALERT | ERR_FATAL;
3361 goto out;
3362 }
3363 else if (res) {
3364 ha_alert("parsing [%s:%d]: unexpected character '%c' in argument to <%s>.\n",
3365 file, linenum, *res, args[0]);
3366 err_code |= ERR_ALERT | ERR_FATAL;
3367 goto out;
3368 }
3369 if (strcmp(args[1], "nx") == 0)
3370 curr_resolvers->hold.nx = time;
3371 else if (strcmp(args[1], "other") == 0)
3372 curr_resolvers->hold.other = time;
3373 else if (strcmp(args[1], "refused") == 0)
3374 curr_resolvers->hold.refused = time;
3375 else if (strcmp(args[1], "timeout") == 0)
3376 curr_resolvers->hold.timeout = time;
3377 else if (strcmp(args[1], "valid") == 0)
3378 curr_resolvers->hold.valid = time;
3379 else if (strcmp(args[1], "obsolete") == 0)
3380 curr_resolvers->hold.obsolete = time;
3381 else {
3382 ha_alert("parsing [%s:%d] : '%s' unknown <event>: '%s', expects either 'nx', 'timeout', 'valid', 'obsolete' or 'other'.\n",
3383 file, linenum, args[0], args[1]);
3384 err_code |= ERR_ALERT | ERR_FATAL;
3385 goto out;
3386 }
3387
3388 }
3389 else if (strcmp(args[0], "accepted_payload_size") == 0) {
3390 int i = 0;
3391
3392 if (!*args[1]) {
3393 ha_alert("parsing [%s:%d] : '%s' expects <nb> as argument.\n",
3394 file, linenum, args[0]);
3395 err_code |= ERR_ALERT | ERR_FATAL;
3396 goto out;
3397 }
3398
3399 i = atoi(args[1]);
3400 if (i < DNS_HEADER_SIZE || i > DNS_MAX_UDP_MESSAGE) {
3401 ha_alert("parsing [%s:%d] : '%s' must be between %d and %d inclusive (was %s).\n",
3402 file, linenum, args[0], DNS_HEADER_SIZE, DNS_MAX_UDP_MESSAGE, args[1]);
3403 err_code |= ERR_ALERT | ERR_FATAL;
3404 goto out;
3405 }
3406
3407 curr_resolvers->accepted_payload_size = i;
3408 }
3409 else if (strcmp(args[0], "resolution_pool_size") == 0) {
3410 ha_alert("parsing [%s:%d] : '%s' directive is not supported anymore (it never appeared in a stable release).\n",
3411 file, linenum, args[0]);
3412 err_code |= ERR_ALERT | ERR_FATAL;
3413 goto out;
3414 }
3415 else if (strcmp(args[0], "resolve_retries") == 0) {
3416 if (!*args[1]) {
3417 ha_alert("parsing [%s:%d] : '%s' expects <nb> as argument.\n",
3418 file, linenum, args[0]);
3419 err_code |= ERR_ALERT | ERR_FATAL;
3420 goto out;
3421 }
3422 curr_resolvers->resolve_retries = atoi(args[1]);
3423 }
3424 else if (strcmp(args[0], "timeout") == 0) {
3425 if (!*args[1]) {
3426 ha_alert("parsing [%s:%d] : '%s' expects 'retry' or 'resolve' and <time> as arguments.\n",
3427 file, linenum, args[0]);
3428 err_code |= ERR_ALERT | ERR_FATAL;
3429 goto out;
3430 }
3431 else if (strcmp(args[1], "retry") == 0 ||
3432 strcmp(args[1], "resolve") == 0) {
3433 const char *res;
3434 unsigned int tout;
3435
3436 if (!*args[2]) {
3437 ha_alert("parsing [%s:%d] : '%s %s' expects <time> as argument.\n",
3438 file, linenum, args[0], args[1]);
3439 err_code |= ERR_ALERT | ERR_FATAL;
3440 goto out;
3441 }
3442 res = parse_time_err(args[2], &tout, TIME_UNIT_MS);
3443 if (res == PARSE_TIME_OVER) {
3444 ha_alert("parsing [%s:%d]: timer overflow in argument <%s> to <%s %s>, maximum value is 2147483647 ms (~24.8 days).\n",
3445 file, linenum, args[2], args[0], args[1]);
3446 err_code |= ERR_ALERT | ERR_FATAL;
3447 goto out;
3448 }
3449 else if (res == PARSE_TIME_UNDER) {
3450 ha_alert("parsing [%s:%d]: timer underflow in argument <%s> to <%s %s>, minimum non-null value is 1 ms.\n",
3451 file, linenum, args[2], args[0], args[1]);
3452 err_code |= ERR_ALERT | ERR_FATAL;
3453 goto out;
3454 }
3455 else if (res) {
3456 ha_alert("parsing [%s:%d]: unexpected character '%c' in argument to <%s %s>.\n",
3457 file, linenum, *res, args[0], args[1]);
3458 err_code |= ERR_ALERT | ERR_FATAL;
3459 goto out;
3460 }
3461 if (args[1][2] == 't')
3462 curr_resolvers->timeout.retry = tout;
3463 else
3464 curr_resolvers->timeout.resolve = tout;
3465 }
3466 else {
3467 ha_alert("parsing [%s:%d] : '%s' expects 'retry' or 'resolve' and <time> as arguments got '%s'.\n",
3468 file, linenum, args[0], args[1]);
3469 err_code |= ERR_ALERT | ERR_FATAL;
3470 goto out;
3471 }
3472 }
3473 else if (*args[0] != 0) {
3474 ha_alert("parsing [%s:%d] : unknown keyword '%s' in '%s' section\n", file, linenum, args[0], cursection);
3475 err_code |= ERR_ALERT | ERR_FATAL;
3476 goto out;
3477 }
3478
3479 out:
3480 free(errmsg);
3481 return err_code;
3482}
Emeric Brun56fc5d92021-02-12 20:05:45 +01003483int cfg_post_parse_resolvers()
3484{
3485 int err_code = 0;
3486 struct server *srv;
3487
3488 if (curr_resolvers) {
3489
3490 /* prepare forward server descriptors */
3491 if (curr_resolvers->px) {
3492 srv = curr_resolvers->px->srv;
3493 while (srv) {
Emeric Brun56fc5d92021-02-12 20:05:45 +01003494 /* init ssl if needed */
3495 if (srv->use_ssl == 1 && xprt_get(XPRT_SSL) && xprt_get(XPRT_SSL)->prepare_srv) {
3496 if (xprt_get(XPRT_SSL)->prepare_srv(srv)) {
3497 ha_alert("unable to prepare SSL for server '%s' in resolvers section '%s'.\n", srv->id, curr_resolvers->id);
3498 err_code |= ERR_ALERT | ERR_FATAL;
3499 break;
3500 }
3501 }
Emeric Brun56fc5d92021-02-12 20:05:45 +01003502 srv = srv->next;
3503 }
3504 }
3505 }
3506 curr_resolvers = NULL;
3507 return err_code;
3508}
Emeric Brunc9437992021-02-12 19:42:55 +01003509
Emeric Brun56fc5d92021-02-12 20:05:45 +01003510REGISTER_CONFIG_SECTION("resolvers", cfg_parse_resolvers, cfg_post_parse_resolvers);
Emeric Brunc9437992021-02-12 19:42:55 +01003511REGISTER_POST_DEINIT(resolvers_deinit);
3512REGISTER_CONFIG_POSTPARSER("dns runtime resolver", resolvers_finalize_config);