blob: 86147a4170dfd259ffc004deffa5261d96630a7a [file] [log] [blame]
Baptiste Assmann325137d2015-04-13 23:40:55 +02001/*
2 * Name server resolution
3 *
4 * Copyright 2014 Baptiste Assmann <bedis9@gmail.com>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <errno.h>
14#include <fcntl.h>
15#include <stdio.h>
16#include <stdlib.h>
17#include <string.h>
18#include <unistd.h>
19
20#include <sys/types.h>
21
Baptiste Assmann044fd5b2018-08-10 10:56:38 +020022#include <common/cfgparse.h>
Christopher Faulet67957bd2017-09-27 11:00:59 +020023#include <common/errors.h>
Willy Tarreau0108d902018-11-25 19:14:37 +010024#include <common/initcall.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020025#include <common/time.h>
26#include <common/ticks.h>
Olivier Houchard8da5f982017-08-04 18:35:36 +020027#include <common/net_helper.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020028
Baptiste Assmann333939c2019-01-21 08:34:50 +010029#include <types/action.h>
William Lallemand69e96442016-11-19 00:58:54 +010030#include <types/applet.h>
31#include <types/cli.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020032#include <types/global.h>
33#include <types/dns.h>
William Lallemand69e96442016-11-19 00:58:54 +010034#include <types/stats.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020035
Baptiste Assmann333939c2019-01-21 08:34:50 +010036#include <proto/action.h>
William Lallemand69e96442016-11-19 00:58:54 +010037#include <proto/channel.h>
38#include <proto/cli.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020039#include <proto/checks.h>
40#include <proto/dns.h>
41#include <proto/fd.h>
Christopher Fauletfc9cfe42019-07-16 14:54:53 +020042#include <proto/http_ana.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010043#include <proto/http_rules.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020044#include <proto/log.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010045#include <proto/sample.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020046#include <proto/server.h>
47#include <proto/task.h>
48#include <proto/proto_udp.h>
Christopher Faulet67957bd2017-09-27 11:00:59 +020049#include <proto/proxy.h>
William Lallemand69e96442016-11-19 00:58:54 +010050#include <proto/stream_interface.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010051#include <proto/tcp_rules.h>
52#include <proto/vars.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020053
Christopher Faulet67957bd2017-09-27 11:00:59 +020054struct list dns_resolvers = LIST_HEAD_INIT(dns_resolvers);
55struct list dns_srvrq_list = LIST_HEAD_INIT(dns_srvrq_list);
Baptiste Assmann325137d2015-04-13 23:40:55 +020056
Tim Duesterhusfcac33d2020-01-18 02:04:12 +010057static THREAD_LOCAL uint64_t dns_query_id_seed = 0; /* random seed */
Willy Tarreau8ceae722018-11-26 11:58:30 +010058
59DECLARE_STATIC_POOL(dns_answer_item_pool, "dns_answer_item", sizeof(struct dns_answer_item));
60DECLARE_STATIC_POOL(dns_resolution_pool, "dns_resolution", sizeof(struct dns_resolution));
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +010061DECLARE_POOL(dns_requester_pool, "dns_requester", sizeof(struct dns_requester));
Willy Tarreau8ceae722018-11-26 11:58:30 +010062
Christopher Faulet67957bd2017-09-27 11:00:59 +020063static unsigned int resolution_uuid = 1;
Baptiste Assmann333939c2019-01-21 08:34:50 +010064unsigned int dns_failed_resolutions = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020065
Christopher Faulet67957bd2017-09-27 11:00:59 +020066/* Returns a pointer to the resolvers matching the id <id>. NULL is returned if
67 * no match is found.
Baptiste Assmann325137d2015-04-13 23:40:55 +020068 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020069struct dns_resolvers *find_resolvers_by_id(const char *id)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020070{
Christopher Faulet67957bd2017-09-27 11:00:59 +020071 struct dns_resolvers *res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020072
Christopher Faulet67957bd2017-09-27 11:00:59 +020073 list_for_each_entry(res, &dns_resolvers, list) {
74 if (!strcmp(res->id, id))
75 return res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020076 }
Christopher Faulet67957bd2017-09-27 11:00:59 +020077 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020078}
79
Christopher Faulet67957bd2017-09-27 11:00:59 +020080/* Returns a pointer on the SRV request matching the name <name> for the proxy
81 * <px>. NULL is returned if no match is found.
Baptiste Assmann201c07f2017-05-22 15:17:15 +020082 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020083struct dns_srvrq *find_srvrq_by_name(const char *name, struct proxy *px)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020084{
Christopher Faulet67957bd2017-09-27 11:00:59 +020085 struct dns_srvrq *srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020086
Christopher Faulet67957bd2017-09-27 11:00:59 +020087 list_for_each_entry(srvrq, &dns_srvrq_list, list) {
88 if (srvrq->proxy == px && !strcmp(srvrq->name, name))
89 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020090 }
Christopher Faulet67957bd2017-09-27 11:00:59 +020091 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020092}
93
Christopher Faulet67957bd2017-09-27 11:00:59 +020094/* Allocates a new SRVRQ for the given server with the name <fqdn>. It returns
95 * NULL if an error occurred. */
96struct dns_srvrq *new_dns_srvrq(struct server *srv, char *fqdn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020097{
Christopher Faulet67957bd2017-09-27 11:00:59 +020098 struct proxy *px = srv->proxy;
99 struct dns_srvrq *srvrq = NULL;
100 int fqdn_len, hostname_dn_len;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200101
Christopher Faulet67957bd2017-09-27 11:00:59 +0200102 fqdn_len = strlen(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200103 hostname_dn_len = dns_str_to_dn_label(fqdn, fqdn_len + 1, trash.area,
104 trash.size);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200105 if (hostname_dn_len == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100106 ha_alert("config : %s '%s', server '%s': failed to parse FQDN '%s'\n",
107 proxy_type_str(px), px->id, srv->id, fqdn);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200108 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200109 }
110
Christopher Faulet67957bd2017-09-27 11:00:59 +0200111 if ((srvrq = calloc(1, sizeof(*srvrq))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100112 ha_alert("config : %s '%s', server '%s': out of memory\n",
113 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200114 goto err;
115 }
116 srvrq->obj_type = OBJ_TYPE_SRVRQ;
117 srvrq->proxy = px;
118 srvrq->name = strdup(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200119 srvrq->hostname_dn = strdup(trash.area);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200120 srvrq->hostname_dn_len = hostname_dn_len;
121 if (!srvrq->name || !srvrq->hostname_dn) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100122 ha_alert("config : %s '%s', server '%s': out of memory\n",
123 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200124 goto err;
125 }
126 LIST_ADDQ(&dns_srvrq_list, &srvrq->list);
127 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200128
Christopher Faulet67957bd2017-09-27 11:00:59 +0200129 err:
130 if (srvrq) {
131 free(srvrq->name);
132 free(srvrq->hostname_dn);
133 free(srvrq);
134 }
135 return NULL;
136}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200137
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200138
Christopher Faulet67957bd2017-09-27 11:00:59 +0200139/* 2 bytes random generator to generate DNS query ID */
140static inline uint16_t dns_rnd16(void)
141{
Christopher Fauletb2812a62017-10-04 16:17:58 +0200142 if (!dns_query_id_seed)
143 dns_query_id_seed = now_ms;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200144 dns_query_id_seed ^= dns_query_id_seed << 13;
145 dns_query_id_seed ^= dns_query_id_seed >> 7;
146 dns_query_id_seed ^= dns_query_id_seed << 17;
147 return dns_query_id_seed;
148}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200149
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200150
Christopher Faulet67957bd2017-09-27 11:00:59 +0200151static inline int dns_resolution_timeout(struct dns_resolution *res)
152{
Baptiste Assmannf50e1ac2019-11-07 11:02:18 +0100153 return res->resolvers->timeout.resolve;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200154}
155
Christopher Faulet67957bd2017-09-27 11:00:59 +0200156/* Updates a resolvers' task timeout for next wake up and queue it */
157static void dns_update_resolvers_timeout(struct dns_resolvers *resolvers)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200158{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200159 struct dns_resolution *res;
160 int next;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200161
Christopher Faulet67957bd2017-09-27 11:00:59 +0200162 next = tick_add(now_ms, resolvers->timeout.resolve);
163 if (!LIST_ISEMPTY(&resolvers->resolutions.curr)) {
164 res = LIST_NEXT(&resolvers->resolutions.curr, struct dns_resolution *, list);
165 next = MIN(next, tick_add(res->last_query, resolvers->timeout.retry));
166 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200167
Christopher Faulet67957bd2017-09-27 11:00:59 +0200168 list_for_each_entry(res, &resolvers->resolutions.wait, list)
169 next = MIN(next, tick_add(res->last_resolution, dns_resolution_timeout(res)));
Baptiste Assmann325137d2015-04-13 23:40:55 +0200170
Christopher Faulet67957bd2017-09-27 11:00:59 +0200171 resolvers->t->expire = next;
172 task_queue(resolvers->t);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200173}
174
Christopher Faulet67957bd2017-09-27 11:00:59 +0200175/* Opens an UDP socket on the namesaver's IP/Port, if required. Returns 0 on
176 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200177 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200178static int dns_connect_namesaver(struct dns_nameserver *ns)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200179{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200180 struct dgram_conn *dgram = ns->dgram;
181 int fd;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200182
Christopher Faulet67957bd2017-09-27 11:00:59 +0200183 /* Already connected */
184 if (dgram->t.sock.fd != -1)
185 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200186
Christopher Faulet67957bd2017-09-27 11:00:59 +0200187 /* Create an UDP socket and connect it on the nameserver's IP/Port */
188 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
189 send_log(NULL, LOG_WARNING,
190 "DNS : resolvers '%s': can't create socket for nameserver '%s'.\n",
191 ns->resolvers->id, ns->id);
192 return -1;
193 }
194 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
195 send_log(NULL, LOG_WARNING,
196 "DNS : resolvers '%s': can't connect socket for nameserver '%s'.\n",
197 ns->resolvers->id, ns->id);
198 close(fd);
199 return -1;
200 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200201
Christopher Faulet67957bd2017-09-27 11:00:59 +0200202 /* Make the socket non blocking */
203 fcntl(fd, F_SETFL, O_NONBLOCK);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200204
Christopher Faulet67957bd2017-09-27 11:00:59 +0200205 /* Add the fd in the fd list and update its parameters */
206 dgram->t.sock.fd = fd;
Willy Tarreaua9786b62018-01-25 07:22:13 +0100207 fd_insert(fd, dgram, dgram_fd_handler, MAX_THREADS_MASK);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200208 fd_want_recv(fd);
209 return 0;
210}
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200211
Christopher Faulet67957bd2017-09-27 11:00:59 +0200212/* Forges a DNS query. It needs the following information from the caller:
213 * - <query_id> : the DNS query id corresponding to this query
214 * - <query_type> : DNS_RTYPE_* request DNS record type (A, AAAA, ANY...)
215 * - <hostname_dn> : hostname in domain name format
216 * - <hostname_dn_len> : length of <hostname_dn>
217 *
218 * To store the query, the caller must pass a buffer <buf> and its size
219 * <bufsize>. It returns the number of written bytes in success, -1 if <buf> is
220 * too short.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200221 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200222static int dns_build_query(int query_id, int query_type, unsigned int accepted_payload_size,
223 char *hostname_dn, int hostname_dn_len, char *buf, int bufsize)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200224{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200225 struct dns_header dns_hdr;
226 struct dns_question qinfo;
227 struct dns_additional_record edns;
228 char *p = buf;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200229
Christopher Faulet67957bd2017-09-27 11:00:59 +0200230 if (sizeof(dns_hdr) + sizeof(qinfo) + sizeof(edns) + hostname_dn_len >= bufsize)
231 return -1;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200232
Christopher Faulet67957bd2017-09-27 11:00:59 +0200233 memset(buf, 0, bufsize);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200234
Christopher Faulet67957bd2017-09-27 11:00:59 +0200235 /* Set dns query headers */
236 dns_hdr.id = (unsigned short) htons(query_id);
237 dns_hdr.flags = htons(0x0100); /* qr=0, opcode=0, aa=0, tc=0, rd=1, ra=0, z=0, rcode=0 */
238 dns_hdr.qdcount = htons(1); /* 1 question */
239 dns_hdr.ancount = 0;
240 dns_hdr.nscount = 0;
241 dns_hdr.arcount = htons(1);
242 memcpy(p, &dns_hdr, sizeof(dns_hdr));
243 p += sizeof(dns_hdr);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200244
Christopher Faulet67957bd2017-09-27 11:00:59 +0200245 /* Set up query hostname */
246 memcpy(p, hostname_dn, hostname_dn_len);
247 p += hostname_dn_len;
248 *p++ = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200249
Christopher Faulet67957bd2017-09-27 11:00:59 +0200250 /* Set up query info (type and class) */
251 qinfo.qtype = htons(query_type);
252 qinfo.qclass = htons(DNS_RCLASS_IN);
253 memcpy(p, &qinfo, sizeof(qinfo));
254 p += sizeof(qinfo);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200255
Christopher Faulet67957bd2017-09-27 11:00:59 +0200256 /* Set the DNS extension */
257 edns.name = 0;
258 edns.type = htons(DNS_RTYPE_OPT);
259 edns.udp_payload_size = htons(accepted_payload_size);
260 edns.extension = 0;
261 edns.data_length = 0;
262 memcpy(p, &edns, sizeof(edns));
263 p += sizeof(edns);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200264
Christopher Faulet67957bd2017-09-27 11:00:59 +0200265 return (p - buf);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200266}
267
Christopher Faulet67957bd2017-09-27 11:00:59 +0200268/* Sends a DNS query to resolvers associated to a resolution. It returns 0 on
269 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200270 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200271static int dns_send_query(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200272{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200273 struct dns_resolvers *resolvers = resolution->resolvers;
274 struct dns_nameserver *ns;
Willy Tarreau0eae6322019-12-20 11:18:54 +0100275 int len;
276
277 /* Update resolution */
278 resolution->nb_queries = 0;
279 resolution->nb_responses = 0;
280 resolution->last_query = now_ms;
281
282 len = dns_build_query(resolution->query_id, resolution->query_type,
283 resolvers->accepted_payload_size,
284 resolution->hostname_dn, resolution->hostname_dn_len,
285 trash.area, trash.size);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200286
Christopher Faulet67957bd2017-09-27 11:00:59 +0200287 list_for_each_entry(ns, &resolvers->nameservers, list) {
288 int fd = ns->dgram->t.sock.fd;
Willy Tarreau0eae6322019-12-20 11:18:54 +0100289 int ret;
290
Christopher Faulet67957bd2017-09-27 11:00:59 +0200291 if (fd == -1) {
292 if (dns_connect_namesaver(ns) == -1)
293 continue;
294 fd = ns->dgram->t.sock.fd;
295 resolvers->nb_nameservers++;
296 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200297
Willy Tarreau0eae6322019-12-20 11:18:54 +0100298 if (len < 0)
299 goto snd_error;
300
301 ret = send(fd, trash.area, len, 0);
302 if (ret == len) {
303 ns->counters.sent++;
304 resolution->nb_queries++;
305 continue;
306 }
307
308 if (ret == -1 && errno == EAGAIN) {
309 /* retry once the socket is ready */
310 fd_cant_send(fd);
311 continue;
312 }
313
314 snd_error:
315 ns->counters.snd_error++;
316 resolution->nb_queries++;
317 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200318
Christopher Faulet67957bd2017-09-27 11:00:59 +0200319 /* Push the resolution at the end of the active list */
320 LIST_DEL(&resolution->list);
321 LIST_ADDQ(&resolvers->resolutions.curr, &resolution->list);
322 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200323}
324
Christopher Faulet67957bd2017-09-27 11:00:59 +0200325/* Prepares and sends a DNS resolution. It returns 1 if the query was sent, 0 if
326 * skipped and -1 if an error occurred.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200327 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200328static int
329dns_run_resolution(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200330{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200331 struct dns_resolvers *resolvers = resolution->resolvers;
332 int query_id, i;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200333
Christopher Faulet67957bd2017-09-27 11:00:59 +0200334 /* Avoid sending requests for resolutions that don't yet have an
335 * hostname, ie resolutions linked to servers that do not yet have an
336 * fqdn */
337 if (!resolution->hostname_dn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200338 return 0;
339
Christopher Faulet67957bd2017-09-27 11:00:59 +0200340 /* Check if a resolution has already been started for this server return
341 * directly to avoid resolution pill up. */
342 if (resolution->step != RSLV_STEP_NONE)
343 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200344
Christopher Faulet67957bd2017-09-27 11:00:59 +0200345 /* Generates a new query id. We try at most 100 times to find a free
346 * query id */
347 for (i = 0; i < 100; ++i) {
348 query_id = dns_rnd16();
349 if (!eb32_lookup(&resolvers->query_ids, query_id))
Olivier Houchard8da5f982017-08-04 18:35:36 +0200350 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200351 query_id = -1;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200352 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200353 if (query_id == -1) {
354 send_log(NULL, LOG_NOTICE,
355 "could not generate a query id for %s, in resolvers %s.\n",
356 resolution->hostname_dn, resolvers->id);
357 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200358 }
359
Christopher Faulet67957bd2017-09-27 11:00:59 +0200360 /* Update resolution parameters */
361 resolution->query_id = query_id;
362 resolution->qid.key = query_id;
363 resolution->step = RSLV_STEP_RUNNING;
364 resolution->query_type = resolution->prefered_query_type;
365 resolution->try = resolvers->resolve_retries;
366 eb32_insert(&resolvers->query_ids, &resolution->qid);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200367
Christopher Faulet67957bd2017-09-27 11:00:59 +0200368 /* Send the DNS query */
369 resolution->try -= 1;
370 dns_send_query(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200371 return 1;
372}
373
Christopher Faulet67957bd2017-09-27 11:00:59 +0200374/* Performs a name resolution for the requester <req> */
375void dns_trigger_resolution(struct dns_requester *req)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200376{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200377 struct dns_resolvers *resolvers;
378 struct dns_resolution *res;
379 int exp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200380
Christopher Faulet67957bd2017-09-27 11:00:59 +0200381 if (!req || !req->resolution)
382 return;
383 res = req->resolution;
384 resolvers = res->resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200385
Christopher Faulet67957bd2017-09-27 11:00:59 +0200386 /* The resolution must not be triggered yet. Use the cached response, if
387 * valid */
388 exp = tick_add(res->last_resolution, resolvers->hold.valid);
Olivier Houchardf3d9e602018-05-22 18:40:07 +0200389 if (resolvers->t && (res->status != RSLV_STATUS_VALID ||
390 !tick_isset(res->last_resolution) || tick_is_expired(exp, now_ms)))
391 task_wakeup(resolvers->t, TASK_WOKEN_OTHER);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200392}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200393
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200394
Christopher Faulet67957bd2017-09-27 11:00:59 +0200395/* Resets some resolution parameters to initial values and also delete the query
396 * ID from the resolver's tree.
397 */
398static void dns_reset_resolution(struct dns_resolution *resolution)
399{
400 /* update resolution status */
401 resolution->step = RSLV_STEP_NONE;
402 resolution->try = 0;
403 resolution->last_resolution = now_ms;
404 resolution->nb_queries = 0;
405 resolution->nb_responses = 0;
406 resolution->query_type = resolution->prefered_query_type;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200407
Christopher Faulet67957bd2017-09-27 11:00:59 +0200408 /* clean up query id */
409 eb32_delete(&resolution->qid);
410 resolution->query_id = 0;
411 resolution->qid.key = 0;
412}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200413
Christopher Faulet67957bd2017-09-27 11:00:59 +0200414/* Returns the query id contained in a DNS response */
415static inline unsigned short dns_response_get_query_id(unsigned char *resp)
416{
417 return resp[0] * 256 + resp[1];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200418}
419
Christopher Faulet67957bd2017-09-27 11:00:59 +0200420
421/* Analyses, re-builds and copies the name <name> from the DNS response packet
422 * <buffer>. <name> must point to the 'data_len' information or pointer 'c0'
423 * for compressed data. The result is copied into <dest>, ensuring we don't
424 * overflow using <dest_len> Returns the number of bytes the caller can move
425 * forward. If 0 it means an error occurred while parsing the name. <offset> is
426 * the number of bytes the caller could move forward.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200427 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200428int dns_read_name(unsigned char *buffer, unsigned char *bufend,
429 unsigned char *name, char *destination, int dest_len,
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100430 int *offset, unsigned int depth)
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200431{
432 int nb_bytes = 0, n = 0;
433 int label_len;
434 unsigned char *reader = name;
435 char *dest = destination;
436
437 while (1) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100438 if (reader >= bufend)
439 goto err;
440
Christopher Faulet67957bd2017-09-27 11:00:59 +0200441 /* Name compression is in use */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200442 if ((*reader & 0xc0) == 0xc0) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100443 if (reader + 1 >= bufend)
444 goto err;
445
Christopher Faulet67957bd2017-09-27 11:00:59 +0200446 /* Must point BEFORE current position */
447 if ((buffer + reader[1]) > reader)
448 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200449
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100450 if (depth++ > 100)
451 goto err;
452
Nikhil Agrawal2fa66c32018-12-20 10:50:59 +0530453 n = dns_read_name(buffer, bufend, buffer + (*reader & 0x3f)*256 + reader[1],
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100454 dest, dest_len - nb_bytes, offset, depth);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200455 if (n == 0)
Christopher Faulet67957bd2017-09-27 11:00:59 +0200456 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200457
Christopher Faulet67957bd2017-09-27 11:00:59 +0200458 dest += n;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200459 nb_bytes += n;
460 goto out;
461 }
462
463 label_len = *reader;
464 if (label_len == 0)
465 goto out;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200466
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200467 /* Check if:
468 * - we won't read outside the buffer
469 * - there is enough place in the destination
470 */
471 if ((reader + label_len >= bufend) || (nb_bytes + label_len >= dest_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +0200472 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200473
474 /* +1 to take label len + label string */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200475 label_len++;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200476
477 memcpy(dest, reader, label_len);
478
Christopher Faulet67957bd2017-09-27 11:00:59 +0200479 dest += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200480 nb_bytes += label_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200481 reader += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200482 }
483
Christopher Faulet67957bd2017-09-27 11:00:59 +0200484 out:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200485 /* offset computation:
486 * parse from <name> until finding either NULL or a pointer "c0xx"
487 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200488 reader = name;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200489 *offset = 0;
490 while (reader < bufend) {
491 if ((reader[0] & 0xc0) == 0xc0) {
492 *offset += 2;
493 break;
494 }
495 else if (*reader == 0) {
496 *offset += 1;
497 break;
498 }
499 *offset += 1;
500 ++reader;
501 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200502 return nb_bytes;
503
Christopher Faulet67957bd2017-09-27 11:00:59 +0200504 err:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200505 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200506}
507
Christopher Faulet67957bd2017-09-27 11:00:59 +0200508/* Checks for any obsolete record, also identify any SRV request, and try to
509 * find a corresponding server.
510*/
511static void dns_check_dns_response(struct dns_resolution *res)
512{
513 struct dns_resolvers *resolvers = res->resolvers;
514 struct dns_requester *req, *reqback;
515 struct dns_answer_item *item, *itemback;
516 struct server *srv;
517 struct dns_srvrq *srvrq;
518
Baptiste Assmann13a92322019-06-07 09:40:55 +0200519 /* clean up obsolete Additional records */
520 list_for_each_entry_safe(item, itemback, &res->response.ar_list, list) {
521 if ((item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
522 LIST_DEL(&item->list);
523 pool_free(dns_answer_item_pool, item);
524 }
525 }
526
Christopher Faulet67957bd2017-09-27 11:00:59 +0200527 list_for_each_entry_safe(item, itemback, &res->response.answer_list, list) {
528
529 /* Remove obsolete items */
530 if ((item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
531 if (item->type != DNS_RTYPE_SRV)
532 goto rm_obselete_item;
533
534 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
535 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
536 continue;
537
538 /* Remove any associated server */
539 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100540 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200541 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
542 item->data_len == srv->hostname_dn_len &&
543 !memcmp(srv->hostname_dn, item->target, item->data_len)) {
544 snr_update_srv_status(srv, 1);
545 free(srv->hostname);
546 free(srv->hostname_dn);
547 srv->hostname = NULL;
548 srv->hostname_dn = NULL;
549 srv->hostname_dn_len = 0;
550 dns_unlink_resolution(srv->dns_requester);
551 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100552 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200553 }
554 }
555
556 rm_obselete_item:
557 LIST_DEL(&item->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +0100558 pool_free(dns_answer_item_pool, item);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200559 continue;
560 }
561
562 if (item->type != DNS_RTYPE_SRV)
563 continue;
564
565 /* Now process SRV records */
566 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
567 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
568 continue;
569
570 /* Check if a server already uses that hostname */
571 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100572 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200573 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
574 item->data_len == srv->hostname_dn_len &&
Daniel Corbettf8716912019-11-17 09:48:56 -0500575 !memcmp(srv->hostname_dn, item->target, item->data_len) &&
576 !srv->dns_opts.ignore_weight) {
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100577 int ha_weight;
578
Baptiste Assmann25e6fc22019-10-21 15:13:48 +0200579 /* DNS weight range if from 0 to 65535
580 * HAProxy weight is from 0 to 256
581 * The rule below ensures that weight 0 is well respected
582 * while allowing a "mapping" from DNS weight into HAProxy's one.
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100583 */
Baptiste Assmann25e6fc22019-10-21 15:13:48 +0200584 ha_weight = (item->weight + 255) / 256;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100585 if (srv->uweight != ha_weight) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200586 char weight[9];
587
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100588 snprintf(weight, sizeof(weight), "%d", ha_weight);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200589 server_parse_weight_change_request(srv, weight);
590 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100591 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200592 break;
593 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100594 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200595 }
596 if (srv)
597 continue;
598
599 /* If not, try to find a server with undefined hostname */
600 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100601 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200602 if (srv->srvrq == srvrq && !srv->hostname_dn)
603 break;
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100604 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200605 }
606 /* And update this server, if found */
607 if (srv) {
608 const char *msg = NULL;
609 char weight[9];
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100610 int ha_weight;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200611 char hostname[DNS_MAX_NAME_SIZE];
612
613 if (dns_dn_label_to_str(item->target, item->data_len+1,
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100614 hostname, DNS_MAX_NAME_SIZE) == -1) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100615 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200616 continue;
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100617 }
Baptiste Assmann13a92322019-06-07 09:40:55 +0200618
619 /* Check if an Additional Record is associated to this SRV record.
620 * Perform some sanity checks too to ensure the record can be used.
621 * If all fine, we simply pick up the IP address found and associate
622 * it to the server.
623 */
624 if ((item->ar_item != NULL) &&
625 (item->ar_item->type == DNS_RTYPE_A || item->ar_item->type == DNS_RTYPE_AAAA))
626 {
627
628 switch (item->ar_item->type) {
629 case DNS_RTYPE_A:
630 update_server_addr(srv, &(((struct sockaddr_in*)&item->ar_item->address)->sin_addr), AF_INET, "DNS additional recrd");
631 break;
632 case DNS_RTYPE_AAAA:
633 update_server_addr(srv, &(((struct sockaddr_in6*)&item->ar_item->address)->sin6_addr), AF_INET6, "DNS additional recrd");
634 break;
635 }
636
637 srv->flags |= SRV_F_NO_RESOLUTION;
638 }
639
Olivier Houchardd16bfe62017-10-31 15:21:19 +0100640 msg = update_server_fqdn(srv, hostname, "SRV record", 1);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200641 if (msg)
642 send_log(srv->proxy, LOG_NOTICE, "%s", msg);
643
644 srv->svc_port = item->port;
645 srv->flags &= ~SRV_F_MAPPORTS;
646 if ((srv->check.state & CHK_ST_CONFIGURED) &&
647 !(srv->flags & SRV_F_CHECKPORT))
648 srv->check.port = item->port;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100649
Daniel Corbettf8716912019-11-17 09:48:56 -0500650 if (!srv->dns_opts.ignore_weight) {
651 /* DNS weight range if from 0 to 65535
652 * HAProxy weight is from 0 to 256
653 * The rule below ensures that weight 0 is well respected
654 * while allowing a "mapping" from DNS weight into HAProxy's one.
655 */
656 ha_weight = (item->weight + 255) / 256;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100657
Daniel Corbettf8716912019-11-17 09:48:56 -0500658 snprintf(weight, sizeof(weight), "%d", ha_weight);
659 server_parse_weight_change_request(srv, weight);
660 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100661 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200662 }
663 }
664 }
665}
666
667/* Validates that the buffer DNS response provided in <resp> and finishing
668 * before <bufend> is valid from a DNS protocol point of view.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200669 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200670 * The result is stored in <resolution>' response, buf_response,
671 * response_query_records and response_answer_records members.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200672 *
673 * This function returns one of the DNS_RESP_* code to indicate the type of
674 * error found.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200675 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200676static int dns_validate_dns_response(unsigned char *resp, unsigned char *bufend,
677 struct dns_resolution *resolution, int max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200678{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200679 unsigned char *reader;
680 char *previous_dname, tmpname[DNS_MAX_NAME_SIZE];
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200681 int len, flags, offset;
682 int dns_query_record_id;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200683 int nb_saved_records;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200684 struct dns_query_item *dns_query;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200685 struct dns_answer_item *dns_answer_record, *tmp_record;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200686 struct dns_response_packet *dns_p;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200687 int i, found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200688
Christopher Faulet67957bd2017-09-27 11:00:59 +0200689 reader = resp;
690 len = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200691 previous_dname = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200692 dns_query = NULL;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200693
Christopher Faulet67957bd2017-09-27 11:00:59 +0200694 /* Initialization of response buffer and structure */
Baptiste Assmann729c9012017-05-22 15:13:10 +0200695 dns_p = &resolution->response;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200696
697 /* query id */
698 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200699 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200700 dns_p->header.id = reader[0] * 256 + reader[1];
701 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200702
Christopher Faulet67957bd2017-09-27 11:00:59 +0200703 /* Flags and rcode are stored over 2 bytes
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200704 * First byte contains:
705 * - response flag (1 bit)
706 * - opcode (4 bits)
707 * - authoritative (1 bit)
708 * - truncated (1 bit)
709 * - recursion desired (1 bit)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200710 */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200711 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200712 return DNS_RESP_INVALID;
713
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200714 flags = reader[0] * 256 + reader[1];
715
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200716 if ((flags & DNS_FLAG_REPLYCODE) != DNS_RCODE_NO_ERROR) {
717 if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_NX_DOMAIN)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200718 return DNS_RESP_NX_DOMAIN;
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200719 else if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_REFUSED)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200720 return DNS_RESP_REFUSED;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200721 return DNS_RESP_ERROR;
722 }
723
Christopher Faulet67957bd2017-09-27 11:00:59 +0200724 /* Move forward 2 bytes for flags */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200725 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200726
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200727 /* 2 bytes for question count */
728 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200729 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200730 dns_p->header.qdcount = reader[0] * 256 + reader[1];
Christopher Faulet67957bd2017-09-27 11:00:59 +0200731 /* (for now) we send one query only, so we expect only one in the
732 * response too */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200733 if (dns_p->header.qdcount != 1)
734 return DNS_RESP_QUERY_COUNT_ERROR;
735 if (dns_p->header.qdcount > DNS_MAX_QUERY_RECORDS)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200736 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200737 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200738
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200739 /* 2 bytes for answer count */
740 if (reader + 2 >= bufend)
741 return DNS_RESP_INVALID;
742 dns_p->header.ancount = reader[0] * 256 + reader[1];
743 if (dns_p->header.ancount == 0)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200744 return DNS_RESP_ANCOUNT_ZERO;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200745 /* Check if too many records are announced */
Baptiste Assmann9d8dbbc2017-08-18 23:35:08 +0200746 if (dns_p->header.ancount > max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200747 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200748 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200749
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200750 /* 2 bytes authority count */
751 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200752 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200753 dns_p->header.nscount = reader[0] * 256 + reader[1];
754 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200755
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200756 /* 2 bytes additional count */
757 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200758 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200759 dns_p->header.arcount = reader[0] * 256 + reader[1];
760 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200761
Christopher Faulet67957bd2017-09-27 11:00:59 +0200762 /* Parsing dns queries */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200763 LIST_INIT(&dns_p->query_list);
764 for (dns_query_record_id = 0; dns_query_record_id < dns_p->header.qdcount; dns_query_record_id++) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200765 /* Use next pre-allocated dns_query_item after ensuring there is
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200766 * still one available.
Christopher Faulet67957bd2017-09-27 11:00:59 +0200767 * It's then added to our packet query list. */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200768 if (dns_query_record_id > DNS_MAX_QUERY_RECORDS)
769 return DNS_RESP_INVALID;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200770 dns_query = &resolution->response_query_records[dns_query_record_id];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200771 LIST_ADDQ(&dns_p->query_list, &dns_query->list);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200772
Christopher Faulet67957bd2017-09-27 11:00:59 +0200773 /* Name is a NULL terminated string in our case, since we have
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200774 * one query per response and the first one can't be compressed
Christopher Faulet67957bd2017-09-27 11:00:59 +0200775 * (using the 0x0c format) */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200776 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100777 len = dns_read_name(resp, bufend, reader, dns_query->name, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200778
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200779 if (len == 0)
780 return DNS_RESP_INVALID;
781
782 reader += offset;
783 previous_dname = dns_query->name;
784
785 /* move forward 2 bytes for question type */
786 if (reader + 2 >= bufend)
787 return DNS_RESP_INVALID;
788 dns_query->type = reader[0] * 256 + reader[1];
789 reader += 2;
790
791 /* move forward 2 bytes for question class */
792 if (reader + 2 >= bufend)
793 return DNS_RESP_INVALID;
794 dns_query->class = reader[0] * 256 + reader[1];
795 reader += 2;
796 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200797
Baptiste Assmann251abb92017-08-11 09:58:27 +0200798 /* TRUNCATED flag must be checked after we could read the query type
Christopher Faulet67957bd2017-09-27 11:00:59 +0200799 * because a TRUNCATED SRV query type response can still be exploited */
Baptiste Assmann251abb92017-08-11 09:58:27 +0200800 if (dns_query->type != DNS_RTYPE_SRV && flags & DNS_FLAG_TRUNCATED)
801 return DNS_RESP_TRUNCATED;
802
Baptiste Assmann325137d2015-04-13 23:40:55 +0200803 /* now parsing response records */
Baptiste Assmann69fce672017-05-04 08:37:45 +0200804 nb_saved_records = 0;
Olivier Houchard8da5f982017-08-04 18:35:36 +0200805 for (i = 0; i < dns_p->header.ancount; i++) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200806 if (reader >= bufend)
807 return DNS_RESP_INVALID;
808
Willy Tarreaubafbe012017-11-24 17:34:44 +0100809 dns_answer_record = pool_alloc(dns_answer_item_pool);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200810 if (dns_answer_record == NULL)
811 return (DNS_RESP_INVALID);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200812
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200813 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100814 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200815
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200816 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100817 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200818 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200819 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200820
Christopher Faulet67957bd2017-09-27 11:00:59 +0200821 /* Check if the current record dname is valid. previous_dname
822 * points either to queried dname or last CNAME target */
Baptiste Assmannddc8ce62017-08-11 10:31:22 +0200823 if (dns_query->type != DNS_RTYPE_SRV && memcmp(previous_dname, tmpname, len) != 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100824 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200825 if (i == 0) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200826 /* First record, means a mismatch issue between
827 * queried dname and dname found in the first
828 * record */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200829 return DNS_RESP_INVALID;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200830 }
831 else {
832 /* If not the first record, this means we have a
833 * CNAME resolution error */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200834 return DNS_RESP_CNAME_ERROR;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200835 }
836
Baptiste Assmann325137d2015-04-13 23:40:55 +0200837 }
838
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200839 memcpy(dns_answer_record->name, tmpname, len);
840 dns_answer_record->name[len] = 0;
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200841
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200842 reader += offset;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200843 if (reader >= bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100844 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200845 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200846 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200847
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200848 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200849 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100850 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200851 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200852 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200853 dns_answer_record->type = reader[0] * 256 + reader[1];
854 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200855
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200856 /* 2 bytes for class (2) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200857 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100858 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200859 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200860 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200861 dns_answer_record->class = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200862 reader += 2;
863
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200864 /* 4 bytes for ttl (4) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200865 if (reader + 4 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100866 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200867 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200868 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200869 dns_answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
870 + reader[2] * 256 + reader[3];
871 reader += 4;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200872
Christopher Faulet67957bd2017-09-27 11:00:59 +0200873 /* Now reading data len */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200874 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100875 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200876 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200877 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200878 dns_answer_record->data_len = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200879
Christopher Faulet67957bd2017-09-27 11:00:59 +0200880 /* Move forward 2 bytes for data len */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200881 reader += 2;
882
Jérôme Magnin8d4e7dc2018-12-20 16:47:31 +0100883 if (reader + dns_answer_record->data_len > bufend) {
Remi Gacogneefbbdf72018-12-05 17:56:29 +0100884 pool_free(dns_answer_item_pool, dns_answer_record);
885 return DNS_RESP_INVALID;
886 }
887
Christopher Faulet67957bd2017-09-27 11:00:59 +0200888 /* Analyzing record content */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200889 switch (dns_answer_record->type) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200890 case DNS_RTYPE_A:
891 /* ipv4 is stored on 4 bytes */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200892 if (dns_answer_record->data_len != 4) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100893 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200894 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200895 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200896 dns_answer_record->address.sa_family = AF_INET;
897 memcpy(&(((struct sockaddr_in *)&dns_answer_record->address)->sin_addr),
898 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200899 break;
900
901 case DNS_RTYPE_CNAME:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200902 /* Check if this is the last record and update the caller about the status:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200903 * no IP could be found and last record was a CNAME. Could be triggered
904 * by a wrong query type
905 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200906 * + 1 because dns_answer_record_id starts at 0
907 * while number of answers is an integer and
908 * starts at 1.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200909 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200910 if (i + 1 == dns_p->header.ancount) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100911 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200912 return DNS_RESP_CNAME_ERROR;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200913 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200914
915 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100916 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200917 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100918 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200919 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200920 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200921
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200922 memcpy(dns_answer_record->target, tmpname, len);
923 dns_answer_record->target[len] = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200924 previous_dname = dns_answer_record->target;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200925 break;
926
Olivier Houchard8da5f982017-08-04 18:35:36 +0200927
928 case DNS_RTYPE_SRV:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200929 /* Answer must contain :
Olivier Houchard8da5f982017-08-04 18:35:36 +0200930 * - 2 bytes for the priority
931 * - 2 bytes for the weight
932 * - 2 bytes for the port
933 * - the target hostname
934 */
935 if (dns_answer_record->data_len <= 6) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100936 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200937 return DNS_RESP_INVALID;
938 }
Willy Tarreaud5370e12017-09-19 14:59:52 +0200939 dns_answer_record->priority = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200940 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200941 dns_answer_record->weight = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200942 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200943 dns_answer_record->port = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200944 reader += sizeof(uint16_t);
945 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100946 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200947 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100948 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200949 return DNS_RESP_INVALID;
950 }
Olivier Houchard8da5f982017-08-04 18:35:36 +0200951 dns_answer_record->data_len = len;
952 memcpy(dns_answer_record->target, tmpname, len);
953 dns_answer_record->target[len] = 0;
954 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200955
Baptiste Assmann325137d2015-04-13 23:40:55 +0200956 case DNS_RTYPE_AAAA:
957 /* ipv6 is stored on 16 bytes */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200958 if (dns_answer_record->data_len != 16) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100959 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200960 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200961 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200962 dns_answer_record->address.sa_family = AF_INET6;
963 memcpy(&(((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr),
964 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200965 break;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200966
Baptiste Assmann325137d2015-04-13 23:40:55 +0200967 } /* switch (record type) */
968
Christopher Faulet67957bd2017-09-27 11:00:59 +0200969 /* Increment the counter for number of records saved into our
970 * local response */
971 nb_saved_records++;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200972
Christopher Faulet67957bd2017-09-27 11:00:59 +0200973 /* Move forward dns_answer_record->data_len for analyzing next
974 * record in the response */
975 reader += ((dns_answer_record->type == DNS_RTYPE_SRV)
976 ? offset
977 : dns_answer_record->data_len);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200978
979 /* Lookup to see if we already had this entry */
Olivier Houchard8da5f982017-08-04 18:35:36 +0200980 found = 0;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200981 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
982 if (tmp_record->type != dns_answer_record->type)
983 continue;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200984
985 switch(tmp_record->type) {
986 case DNS_RTYPE_A:
987 if (!memcmp(&((struct sockaddr_in *)&dns_answer_record->address)->sin_addr,
988 &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
989 sizeof(in_addr_t)))
990 found = 1;
991 break;
992
993 case DNS_RTYPE_AAAA:
994 if (!memcmp(&((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr,
995 &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
996 sizeof(struct in6_addr)))
997 found = 1;
998 break;
999
Olivier Houchard8da5f982017-08-04 18:35:36 +02001000 case DNS_RTYPE_SRV:
1001 if (dns_answer_record->data_len == tmp_record->data_len &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001002 !memcmp(dns_answer_record->target, tmp_record->target, dns_answer_record->data_len) &&
Olivier Houchard8da5f982017-08-04 18:35:36 +02001003 dns_answer_record->port == tmp_record->port) {
1004 tmp_record->weight = dns_answer_record->weight;
1005 found = 1;
1006 }
1007 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001008
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001009 default:
1010 break;
1011 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001012
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001013 if (found == 1)
1014 break;
1015 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001016
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001017 if (found == 1) {
1018 tmp_record->last_seen = now.tv_sec;
Willy Tarreaubafbe012017-11-24 17:34:44 +01001019 pool_free(dns_answer_item_pool, dns_answer_record);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001020 }
1021 else {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001022 dns_answer_record->last_seen = now.tv_sec;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001023 dns_answer_record->ar_item = NULL;
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001024 LIST_ADDQ(&dns_p->answer_list, &dns_answer_record->list);
1025 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001026 } /* for i 0 to ancount */
1027
Christopher Faulet67957bd2017-09-27 11:00:59 +02001028 /* Save the number of records we really own */
Baptiste Assmann69fce672017-05-04 08:37:45 +02001029 dns_p->header.ancount = nb_saved_records;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001030
1031 /* now parsing additional records */
1032 nb_saved_records = 0;
1033 //TODO: check with Dinko for DNS poisoning
1034 for (i = 0; i < dns_p->header.arcount; i++) {
1035 if (reader >= bufend)
1036 return DNS_RESP_INVALID;
1037
1038 dns_answer_record = pool_alloc(dns_answer_item_pool);
1039 if (dns_answer_record == NULL)
1040 return (DNS_RESP_INVALID);
1041
1042 offset = 0;
1043 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
1044
1045 if (len == 0) {
1046 pool_free(dns_answer_item_pool, dns_answer_record);
1047 return DNS_RESP_INVALID;
1048 }
1049
1050 /* Check if the current record dname is valid. previous_dname
1051 * points either to queried dname or last CNAME target */
1052 if (dns_query->type != DNS_RTYPE_SRV && memcmp(previous_dname, tmpname, len) != 0) {
1053 pool_free(dns_answer_item_pool, dns_answer_record);
1054 if (i == 0) {
1055 /* First record, means a mismatch issue between
1056 * queried dname and dname found in the first
1057 * record */
1058 return DNS_RESP_INVALID;
1059 }
1060 else {
1061 /* If not the first record, this means we have a
1062 * CNAME resolution error */
1063 return DNS_RESP_CNAME_ERROR;
1064 }
1065
1066 }
1067
1068 memcpy(dns_answer_record->name, tmpname, len);
1069 dns_answer_record->name[len] = 0;
1070
1071 reader += offset;
1072 if (reader >= bufend) {
1073 pool_free(dns_answer_item_pool, dns_answer_record);
1074 return DNS_RESP_INVALID;
1075 }
1076
1077 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
1078 if (reader + 2 > bufend) {
1079 pool_free(dns_answer_item_pool, dns_answer_record);
1080 return DNS_RESP_INVALID;
1081 }
1082 dns_answer_record->type = reader[0] * 256 + reader[1];
1083 reader += 2;
1084
1085 /* 2 bytes for class (2) */
1086 if (reader + 2 > bufend) {
1087 pool_free(dns_answer_item_pool, dns_answer_record);
1088 return DNS_RESP_INVALID;
1089 }
1090 dns_answer_record->class = reader[0] * 256 + reader[1];
1091 reader += 2;
1092
1093 /* 4 bytes for ttl (4) */
1094 if (reader + 4 > bufend) {
1095 pool_free(dns_answer_item_pool, dns_answer_record);
1096 return DNS_RESP_INVALID;
1097 }
1098 dns_answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
1099 + reader[2] * 256 + reader[3];
1100 reader += 4;
1101
1102 /* Now reading data len */
1103 if (reader + 2 > bufend) {
1104 pool_free(dns_answer_item_pool, dns_answer_record);
1105 return DNS_RESP_INVALID;
1106 }
1107 dns_answer_record->data_len = reader[0] * 256 + reader[1];
1108
1109 /* Move forward 2 bytes for data len */
1110 reader += 2;
1111
1112 if (reader + dns_answer_record->data_len > bufend) {
1113 pool_free(dns_answer_item_pool, dns_answer_record);
1114 return DNS_RESP_INVALID;
1115 }
1116
1117 /* Analyzing record content */
1118 switch (dns_answer_record->type) {
1119 case DNS_RTYPE_A:
1120 /* ipv4 is stored on 4 bytes */
1121 if (dns_answer_record->data_len != 4) {
1122 pool_free(dns_answer_item_pool, dns_answer_record);
1123 return DNS_RESP_INVALID;
1124 }
1125 dns_answer_record->address.sa_family = AF_INET;
1126 memcpy(&(((struct sockaddr_in *)&dns_answer_record->address)->sin_addr),
1127 reader, dns_answer_record->data_len);
1128 break;
1129
1130 case DNS_RTYPE_AAAA:
1131 /* ipv6 is stored on 16 bytes */
1132 if (dns_answer_record->data_len != 16) {
1133 pool_free(dns_answer_item_pool, dns_answer_record);
1134 return DNS_RESP_INVALID;
1135 }
1136 dns_answer_record->address.sa_family = AF_INET6;
1137 memcpy(&(((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr),
1138 reader, dns_answer_record->data_len);
1139 break;
1140
1141 default:
1142 pool_free(dns_answer_item_pool, dns_answer_record);
1143 continue;
1144
1145 } /* switch (record type) */
1146
1147 /* Increment the counter for number of records saved into our
1148 * local response */
1149 nb_saved_records++;
1150
1151 /* Move forward dns_answer_record->data_len for analyzing next
1152 * record in the response */
1153 reader += ((dns_answer_record->type == DNS_RTYPE_SRV)
1154 ? offset
1155 : dns_answer_record->data_len);
1156
1157 /* Lookup to see if we already had this entry */
1158 found = 0;
1159 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
1160 if (tmp_record->type != dns_answer_record->type)
1161 continue;
1162
1163 switch(tmp_record->type) {
1164 case DNS_RTYPE_A:
1165 if (!memcmp(&((struct sockaddr_in *)&dns_answer_record->address)->sin_addr,
1166 &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
1167 sizeof(in_addr_t)))
1168 found = 1;
1169 break;
1170
1171 case DNS_RTYPE_AAAA:
1172 if (!memcmp(&((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr,
1173 &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
1174 sizeof(struct in6_addr)))
1175 found = 1;
1176 break;
1177
1178 default:
1179 break;
1180 }
1181
1182 if (found == 1)
1183 break;
1184 }
1185
1186 if (found == 1) {
1187 tmp_record->last_seen = now.tv_sec;
1188 pool_free(dns_answer_item_pool, dns_answer_record);
1189 }
1190 else {
1191 dns_answer_record->last_seen = now.tv_sec;
1192 dns_answer_record->ar_item = NULL;
1193
1194 // looking for the SRV record in the response list linked to this additional record
1195 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
1196 if ( !(
1197 (tmp_record->type == DNS_RTYPE_SRV) &&
1198 (tmp_record->ar_item == NULL) &&
1199 (memcmp(tmp_record->target, dns_answer_record->name, tmp_record->data_len) == 0)
1200 )
1201 )
1202 continue;
1203 tmp_record->ar_item = dns_answer_record;
1204 }
1205 //TODO: there is a leak for now, since we don't clean up AR records
1206
1207 LIST_ADDQ(&dns_p->ar_list, &dns_answer_record->list);
1208 }
1209 } /* for i 0 to arcount */
1210
1211 /* Save the number of records we really own */
1212 dns_p->header.arcount = nb_saved_records;
1213
Christopher Faulet67957bd2017-09-27 11:00:59 +02001214 dns_check_dns_response(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001215 return DNS_RESP_VALID;
1216}
1217
Christopher Faulet67957bd2017-09-27 11:00:59 +02001218/* Searches dn_name resolution in resp.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001219 * If existing IP not found, return the first IP matching family_priority,
1220 * otherwise, first ip found
1221 * The following tasks are the responsibility of the caller:
Baptiste Assmann3cf7f982016-04-17 22:43:26 +02001222 * - <dns_p> contains an error free DNS response
Baptiste Assmann325137d2015-04-13 23:40:55 +02001223 * For both cases above, dns_validate_dns_response is required
1224 * returns one of the DNS_UPD_* code
1225 */
Baptiste Assmannfb7091e2017-05-03 15:43:12 +02001226int dns_get_ip_from_response(struct dns_response_packet *dns_p,
Baptiste Assmann42746372017-05-03 12:12:02 +02001227 struct dns_options *dns_opts, void *currentip,
Thierry Fournierada34842016-02-17 21:25:09 +01001228 short currentip_sin_family,
Baptiste Assmannfb7091e2017-05-03 15:43:12 +02001229 void **newip, short *newip_sin_family,
1230 void *owner)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001231{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +02001232 struct dns_answer_item *record;
Thierry Fournierada34842016-02-17 21:25:09 +01001233 int family_priority;
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001234 int currentip_found;
Baptiste Assmann3cf7f982016-04-17 22:43:26 +02001235 unsigned char *newip4, *newip6;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001236 int currentip_sel;
1237 int j;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001238 int score, max_score;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001239 int allowed_duplicated_ip;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001240
Christopher Faulet67957bd2017-09-27 11:00:59 +02001241 family_priority = dns_opts->family_prio;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001242 allowed_duplicated_ip = dns_opts->accept_duplicate_ip;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001243 *newip = newip4 = newip6 = NULL;
1244 currentip_found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001245 *newip_sin_family = AF_UNSPEC;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001246 max_score = -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001247
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001248 /* Select an IP regarding configuration preference.
Joseph Herlant42cf6392018-11-15 10:33:28 -08001249 * Top priority is the preferred network ip version,
1250 * second priority is the preferred network.
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001251 * the last priority is the currently used IP,
1252 *
1253 * For these three priorities, a score is calculated. The
1254 * weight are:
Joseph Herlant42cf6392018-11-15 10:33:28 -08001255 * 8 - preferred ip version.
1256 * 4 - preferred network.
Baptistefc725902016-12-26 23:21:08 +01001257 * 2 - if the ip in the record is not affected to any other server in the same backend (duplication)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001258 * 1 - current ip.
1259 * The result with the biggest score is returned.
1260 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001261
1262 list_for_each_entry(record, &dns_p->answer_list, list) {
1263 void *ip;
1264 unsigned char ip_type;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001265
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001266 if (record->type == DNS_RTYPE_A) {
1267 ip = &(((struct sockaddr_in *)&record->address)->sin_addr);
1268 ip_type = AF_INET;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001269 }
1270 else if (record->type == DNS_RTYPE_AAAA) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001271 ip_type = AF_INET6;
1272 ip = &(((struct sockaddr_in6 *)&record->address)->sin6_addr);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001273 }
1274 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001275 continue;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001276 score = 0;
1277
Joseph Herlant42cf6392018-11-15 10:33:28 -08001278 /* Check for preferred ip protocol. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001279 if (ip_type == family_priority)
Baptistefc725902016-12-26 23:21:08 +01001280 score += 8;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001281
Joseph Herlant42cf6392018-11-15 10:33:28 -08001282 /* Check for preferred network. */
Baptiste Assmann42746372017-05-03 12:12:02 +02001283 for (j = 0; j < dns_opts->pref_net_nb; j++) {
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001284
1285 /* Compare only the same adresses class. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001286 if (dns_opts->pref_net[j].family != ip_type)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001287 continue;
1288
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001289 if ((ip_type == AF_INET &&
1290 in_net_ipv4(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001291 &dns_opts->pref_net[j].mask.in4,
1292 &dns_opts->pref_net[j].addr.in4)) ||
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001293 (ip_type == AF_INET6 &&
1294 in_net_ipv6(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001295 &dns_opts->pref_net[j].mask.in6,
1296 &dns_opts->pref_net[j].addr.in6))) {
Baptistefc725902016-12-26 23:21:08 +01001297 score += 4;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001298 break;
1299 }
1300 }
1301
Christopher Faulet67957bd2017-09-27 11:00:59 +02001302 /* Check if the IP found in the record is already affected to a
Baptiste Assmann84221b42018-06-22 13:03:50 +02001303 * member of a group. If not, the score should be incremented
Christopher Faulet67957bd2017-09-27 11:00:59 +02001304 * by 2. */
Baptiste Assmann84221b42018-06-22 13:03:50 +02001305 if (owner && snr_check_ip_callback(owner, ip, &ip_type)) {
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001306 if (!allowed_duplicated_ip) {
1307 continue;
1308 }
Baptiste Assmann84221b42018-06-22 13:03:50 +02001309 } else {
1310 score += 2;
1311 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001312
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001313 /* Check for current ip matching. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001314 if (ip_type == currentip_sin_family &&
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001315 ((currentip_sin_family == AF_INET &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001316 !memcmp(ip, currentip, 4)) ||
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001317 (currentip_sin_family == AF_INET6 &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001318 !memcmp(ip, currentip, 16)))) {
1319 score++;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001320 currentip_sel = 1;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001321 }
1322 else
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001323 currentip_sel = 0;
1324
1325 /* Keep the address if the score is better than the previous
Christopher Faulet67957bd2017-09-27 11:00:59 +02001326 * score. The maximum score is 15, if this value is reached, we
1327 * break the parsing. Implicitly, this score is reached the ip
1328 * selected is the current ip. */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001329 if (score > max_score) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001330 if (ip_type == AF_INET)
1331 newip4 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001332 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001333 newip6 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001334 currentip_found = currentip_sel;
Baptistefc725902016-12-26 23:21:08 +01001335 if (score == 15)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001336 return DNS_UPD_NO;
1337 max_score = score;
1338 }
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001339 } /* list for each record entries */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001340
Christopher Faulet67957bd2017-09-27 11:00:59 +02001341 /* No IP found in the response */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001342 if (!newip4 && !newip6)
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001343 return DNS_UPD_NO_IP_FOUND;
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001344
Christopher Faulet67957bd2017-09-27 11:00:59 +02001345 /* Case when the caller looks first for an IPv4 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001346 if (family_priority == AF_INET) {
1347 if (newip4) {
1348 *newip = newip4;
1349 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001350 }
1351 else if (newip6) {
1352 *newip = newip6;
1353 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001354 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001355 if (!currentip_found)
1356 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001357 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001358 /* Case when the caller looks first for an IPv6 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001359 else if (family_priority == AF_INET6) {
1360 if (newip6) {
1361 *newip = newip6;
1362 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001363 }
1364 else if (newip4) {
1365 *newip = newip4;
1366 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001367 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001368 if (!currentip_found)
1369 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001370 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001371 /* Case when the caller have no preference (we prefer IPv6) */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001372 else if (family_priority == AF_UNSPEC) {
1373 if (newip6) {
1374 *newip = newip6;
1375 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001376 }
1377 else if (newip4) {
1378 *newip = newip4;
1379 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001380 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001381 if (!currentip_found)
1382 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001383 }
1384
Christopher Faulet67957bd2017-09-27 11:00:59 +02001385 /* No reason why we should change the server's IP address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001386 return DNS_UPD_NO;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001387
Christopher Faulet67957bd2017-09-27 11:00:59 +02001388 not_found:
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001389 list_for_each_entry(record, &dns_p->answer_list, list) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001390 /* Move the first record to the end of the list, for internal
1391 * round robin */
1392 LIST_DEL(&record->list);
1393 LIST_ADDQ(&dns_p->answer_list, &record->list);
1394 break;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001395 }
1396 return DNS_UPD_SRVIP_NOT_FOUND;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001397}
1398
Christopher Faulet67957bd2017-09-27 11:00:59 +02001399/* Turns a domain name label into a string.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001400 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001401 * <dn> must be a null-terminated string. <dn_len> must include the terminating
1402 * null byte. <str> must be allocated and its size must be passed in <str_len>.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001403 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001404 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1405 * <str> (including the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001406 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001407int dns_dn_label_to_str(const char *dn, int dn_len, char *str, int str_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001408{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001409 char *ptr;
1410 int i, sz;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001411
Christopher Faulet67957bd2017-09-27 11:00:59 +02001412 if (str_len < dn_len - 1)
Baptiste Assmann2af08fe2017-08-14 00:13:01 +02001413 return -1;
1414
Christopher Faulet67957bd2017-09-27 11:00:59 +02001415 ptr = str;
1416 for (i = 0; i < dn_len-1; ++i) {
1417 sz = dn[i];
1418 if (i)
1419 *ptr++ = '.';
1420 memcpy(ptr, dn+i+1, sz);
1421 ptr += sz;
1422 i += sz;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001423 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001424 *ptr++ = '\0';
1425 return (ptr - str);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001426}
1427
Christopher Faulet67957bd2017-09-27 11:00:59 +02001428/* Turns a string into domain name label: www.haproxy.org into 3www7haproxy3org
1429 *
1430 * <str> must be a null-terminated string. <str_len> must include the
1431 * terminating null byte. <dn> buffer must be allocated and its size must be
1432 * passed in <dn_len>.
1433 *
1434 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1435 * <dn> (excluding the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001436 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001437int dns_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001438{
Baptiste Assmann325137d2015-04-13 23:40:55 +02001439 int i, offset;
1440
Christopher Faulet67957bd2017-09-27 11:00:59 +02001441 if (dn_len < str_len + 1)
1442 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001443
Christopher Faulet67957bd2017-09-27 11:00:59 +02001444 /* First byte of dn will be used to store the length of the first
1445 * label */
1446 offset = 0;
1447 for (i = 0; i < str_len; ++i) {
1448 if (str[i] == '.') {
1449 /* 2 or more consecutive dots is invalid */
1450 if (i == offset)
1451 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001452
Christopher Faulet67957bd2017-09-27 11:00:59 +02001453 dn[offset] = (i - offset);
1454 offset = i+1;
1455 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001456 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001457 dn[i+1] = str[i];
Baptiste Assmann325137d2015-04-13 23:40:55 +02001458 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001459 dn[offset] = (i - offset - 1);
1460 dn[i] = '\0';
1461 return i;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001462}
1463
Christopher Faulet67957bd2017-09-27 11:00:59 +02001464/* Validates host name:
Baptiste Assmann325137d2015-04-13 23:40:55 +02001465 * - total size
1466 * - each label size individually
1467 * returns:
1468 * 0 in case of error. If <err> is not NULL, an error message is stored there.
1469 * 1 when no error. <err> is left unaffected.
1470 */
1471int dns_hostname_validation(const char *string, char **err)
1472{
Baptiste Assmann325137d2015-04-13 23:40:55 +02001473 int i;
1474
1475 if (strlen(string) > DNS_MAX_NAME_SIZE) {
1476 if (err)
1477 *err = DNS_TOO_LONG_FQDN;
1478 return 0;
1479 }
1480
William Dauchyaecd5dc2020-01-26 19:52:34 +01001481 while (*string) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001482 i = 0;
William Dauchyaecd5dc2020-01-26 19:52:34 +01001483 while (*string && *string != '.' && i < DNS_MAX_LABEL_SIZE) {
1484 if (!(*string == '-' || *string == '_' ||
1485 (*string >= 'a' && *string <= 'z') ||
1486 (*string >= 'A' && *string <= 'Z') ||
1487 (*string >= '0' && *string <= '9'))) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001488 if (err)
1489 *err = DNS_INVALID_CHARACTER;
1490 return 0;
1491 }
William Dauchyaecd5dc2020-01-26 19:52:34 +01001492 i++;
1493 string++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001494 }
1495
William Dauchyaecd5dc2020-01-26 19:52:34 +01001496 if (!(*string))
1497 break;
1498
1499 if (*string != '.' && i >= DNS_MAX_LABEL_SIZE) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001500 if (err)
1501 *err = DNS_LABEL_TOO_LONG;
1502 return 0;
1503 }
1504
William Dauchyaecd5dc2020-01-26 19:52:34 +01001505 string++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001506 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001507 return 1;
1508}
1509
Christopher Faulet67957bd2017-09-27 11:00:59 +02001510/* Picks up an available resolution from the different resolution list
1511 * associated to a resolvers section, in this order:
1512 * 1. check in resolutions.curr for the same hostname and query_type
1513 * 2. check in resolutions.wait for the same hostname and query_type
1514 * 3. Get a new resolution from resolution pool
1515 *
1516 * Returns an available resolution, NULL if none found.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001517 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001518static struct dns_resolution *dns_pick_resolution(struct dns_resolvers *resolvers,
1519 char **hostname_dn, int hostname_dn_len,
1520 int query_type)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001521{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001522 struct dns_resolution *res;
1523
1524 if (!*hostname_dn)
1525 goto from_pool;
1526
1527 /* Search for same hostname and query type in resolutions.curr */
1528 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
1529 if (!res->hostname_dn)
1530 continue;
1531 if ((query_type == res->prefered_query_type) &&
1532 hostname_dn_len == res->hostname_dn_len &&
1533 !memcmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
1534 return res;
1535 }
1536
1537 /* Search for same hostname and query type in resolutions.wait */
1538 list_for_each_entry(res, &resolvers->resolutions.wait, list) {
1539 if (!res->hostname_dn)
1540 continue;
1541 if ((query_type == res->prefered_query_type) &&
1542 hostname_dn_len == res->hostname_dn_len &&
1543 !memcmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
1544 return res;
1545 }
1546
1547 from_pool:
1548 /* No resolution could be found, so let's allocate a new one */
Willy Tarreaubafbe012017-11-24 17:34:44 +01001549 res = pool_alloc(dns_resolution_pool);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001550 if (res) {
1551 memset(res, 0, sizeof(*res));
1552 res->resolvers = resolvers;
1553 res->uuid = resolution_uuid;
1554 res->status = RSLV_STATUS_NONE;
1555 res->step = RSLV_STEP_NONE;
1556 res->last_valid = now_ms;
1557
1558 LIST_INIT(&res->requesters);
1559 LIST_INIT(&res->response.answer_list);
Baptiste Assmann13a92322019-06-07 09:40:55 +02001560 LIST_INIT(&res->response.ar_list);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001561
1562 res->prefered_query_type = query_type;
1563 res->query_type = query_type;
1564 res->hostname_dn = *hostname_dn;
1565 res->hostname_dn_len = hostname_dn_len;
1566
1567 ++resolution_uuid;
1568
1569 /* Move the resolution to the resolvers wait queue */
1570 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1571 }
1572 return res;
1573}
1574
1575/* Releases a resolution from its requester(s) and move it back to the pool */
1576static void dns_free_resolution(struct dns_resolution *resolution)
1577{
1578 struct dns_requester *req, *reqback;
1579
1580 /* clean up configuration */
1581 dns_reset_resolution(resolution);
1582 resolution->hostname_dn = NULL;
1583 resolution->hostname_dn_len = 0;
1584
1585 list_for_each_entry_safe(req, reqback, &resolution->requesters, list) {
1586 LIST_DEL(&req->list);
1587 req->resolution = NULL;
1588 }
1589
1590 LIST_DEL(&resolution->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +01001591 pool_free(dns_resolution_pool, resolution);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001592}
1593
1594/* Links a requester (a server or a dns_srvrq) with a resolution. It returns 0
1595 * on success, -1 otherwise.
1596 */
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001597int dns_link_resolution(void *requester, int requester_type, int requester_locked)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001598{
1599 struct dns_resolution *res = NULL;
1600 struct dns_requester *req;
1601 struct dns_resolvers *resolvers;
1602 struct server *srv = NULL;
1603 struct dns_srvrq *srvrq = NULL;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001604 struct stream *stream = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001605 char **hostname_dn;
1606 int hostname_dn_len, query_type;
1607
1608 switch (requester_type) {
1609 case OBJ_TYPE_SERVER:
1610 srv = (struct server *)requester;
1611 hostname_dn = &srv->hostname_dn;
1612 hostname_dn_len = srv->hostname_dn_len;
1613 resolvers = srv->resolvers;
1614 query_type = ((srv->dns_opts.family_prio == AF_INET)
1615 ? DNS_RTYPE_A
1616 : DNS_RTYPE_AAAA);
1617 break;
1618
1619 case OBJ_TYPE_SRVRQ:
1620 srvrq = (struct dns_srvrq *)requester;
1621 hostname_dn = &srvrq->hostname_dn;
1622 hostname_dn_len = srvrq->hostname_dn_len;
1623 resolvers = srvrq->resolvers;
1624 query_type = DNS_RTYPE_SRV;
1625 break;
1626
Baptiste Assmann333939c2019-01-21 08:34:50 +01001627 case OBJ_TYPE_STREAM:
1628 stream = (struct stream *)requester;
1629 hostname_dn = &stream->dns_ctx.hostname_dn;
1630 hostname_dn_len = stream->dns_ctx.hostname_dn_len;
1631 resolvers = stream->dns_ctx.parent->arg.dns.resolvers;
Christopher Fauleta4168432020-01-24 18:08:42 +01001632 query_type = ((stream->dns_ctx.parent->arg.dns.dns_opts->family_prio == AF_INET)
Baptiste Assmann333939c2019-01-21 08:34:50 +01001633 ? DNS_RTYPE_A
1634 : DNS_RTYPE_AAAA);
1635 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001636 default:
1637 goto err;
1638 }
1639
1640 /* Get a resolution from the resolvers' wait queue or pool */
1641 if ((res = dns_pick_resolution(resolvers, hostname_dn, hostname_dn_len, query_type)) == NULL)
1642 goto err;
1643
1644 if (srv) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001645 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001646 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001647 if (srv->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001648 if ((req = pool_alloc(dns_requester_pool)) == NULL) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001649 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001650 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001651 goto err;
Willy Tarreau5ec84572017-11-05 10:35:57 +01001652 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001653 req->owner = &srv->obj_type;
1654 srv->dns_requester = req;
1655 }
1656 else
1657 req = srv->dns_requester;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001658 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001659 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001660
1661 req->requester_cb = snr_resolution_cb;
1662 req->requester_error_cb = snr_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001663 }
1664 else if (srvrq) {
1665 if (srvrq->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001666 if ((req = pool_alloc(dns_requester_pool)) == NULL)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001667 goto err;
1668 req->owner = &srvrq->obj_type;
1669 srvrq->dns_requester = req;
1670 }
1671 else
1672 req = srvrq->dns_requester;
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001673
1674 req->requester_cb = snr_resolution_cb;
1675 req->requester_error_cb = snr_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001676 }
Baptiste Assmann333939c2019-01-21 08:34:50 +01001677 else if (stream) {
1678 if (stream->dns_ctx.dns_requester == NULL) {
1679 if ((req = pool_alloc(dns_requester_pool)) == NULL)
1680 goto err;
1681 req->owner = &stream->obj_type;
1682 stream->dns_ctx.dns_requester = req;
1683 }
1684 else
1685 req = stream->dns_ctx.dns_requester;
1686
1687 req->requester_cb = act_resolution_cb;
1688 req->requester_error_cb = act_resolution_error_cb;
1689 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001690 else
1691 goto err;
1692
1693 req->resolution = res;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001694
1695 LIST_ADDQ(&res->requesters, &req->list);
1696 return 0;
1697
1698 err:
1699 if (res && LIST_ISEMPTY(&res->requesters))
1700 dns_free_resolution(res);
1701 return -1;
1702}
1703
1704/* Removes a requester from a DNS resoltion. It takes takes care of all the
1705 * consequences. It also cleans up some parameters from the requester.
1706 */
1707void dns_unlink_resolution(struct dns_requester *requester)
1708{
1709 struct dns_resolution *res;
1710 struct dns_requester *req;
1711
1712 /* Nothing to do */
1713 if (!requester || !requester->resolution)
1714 return;
1715 res = requester->resolution;
1716
1717 /* Clean up the requester */
1718 LIST_DEL(&requester->list);
1719 requester->resolution = NULL;
1720
1721 /* We need to find another requester linked on this resolution */
1722 if (!LIST_ISEMPTY(&res->requesters))
1723 req = LIST_NEXT(&res->requesters, struct dns_requester *, list);
1724 else {
1725 dns_free_resolution(res);
1726 return;
1727 }
1728
1729 /* Move hostname_dn related pointers to the next requester */
1730 switch (obj_type(req->owner)) {
1731 case OBJ_TYPE_SERVER:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001732 res->hostname_dn = __objt_server(req->owner)->hostname_dn;
1733 res->hostname_dn_len = __objt_server(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001734 break;
1735 case OBJ_TYPE_SRVRQ:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001736 res->hostname_dn = __objt_dns_srvrq(req->owner)->hostname_dn;
1737 res->hostname_dn_len = __objt_dns_srvrq(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001738 break;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001739 case OBJ_TYPE_STREAM:
1740 res->hostname_dn = __objt_stream(req->owner)->dns_ctx.hostname_dn;
1741 res->hostname_dn_len = __objt_stream(req->owner)->dns_ctx.hostname_dn_len;
1742 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001743 default:
1744 res->hostname_dn = NULL;
1745 res->hostname_dn_len = 0;
1746 break;
1747 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001748}
1749
Christopher Faulet67957bd2017-09-27 11:00:59 +02001750/* Called when a network IO is generated on a name server socket for an incoming
1751 * packet. It performs the following actions:
1752 * - check if the packet requires processing (not outdated resolution)
1753 * - ensure the DNS packet received is valid and call requester's callback
1754 * - call requester's error callback if invalid response
1755 * - check the dn_name in the packet against the one sent
1756 */
1757static void dns_resolve_recv(struct dgram_conn *dgram)
1758{
1759 struct dns_nameserver *ns, *tmpns;
1760 struct dns_resolvers *resolvers;
1761 struct dns_resolution *res;
1762 struct dns_query_item *query;
1763 unsigned char buf[DNS_MAX_UDP_MESSAGE + 1];
1764 unsigned char *bufend;
1765 int fd, buflen, dns_resp;
1766 int max_answer_records;
1767 unsigned short query_id;
1768 struct eb32_node *eb;
1769 struct dns_requester *req;
1770
1771 fd = dgram->t.sock.fd;
1772
1773 /* check if ready for reading */
1774 if (!fd_recv_ready(fd))
1775 return;
1776
1777 /* no need to go further if we can't retrieve the nameserver */
Willy Tarreau1c759952019-12-10 18:38:09 +01001778 if ((ns = dgram->owner) == NULL) {
1779 _HA_ATOMIC_AND(&fdtab[fd].ev, ~(FD_POLL_HUP|FD_POLL_ERR));
1780 fd_stop_recv(fd);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001781 return;
Willy Tarreau1c759952019-12-10 18:38:09 +01001782 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001783
1784 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001785 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001786
1787 /* process all pending input messages */
Willy Tarreau1c759952019-12-10 18:38:09 +01001788 while (fd_recv_ready(fd)) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001789 /* read message received */
1790 memset(buf, '\0', resolvers->accepted_payload_size + 1);
1791 if ((buflen = recv(fd, (char*)buf , resolvers->accepted_payload_size + 1, 0)) < 0) {
Willy Tarreau1c759952019-12-10 18:38:09 +01001792 /* FIXME : for now we consider EAGAIN only, but at
1793 * least we purge sticky errors that would cause us to
1794 * be called in loops.
1795 */
1796 _HA_ATOMIC_AND(&fdtab[fd].ev, ~(FD_POLL_HUP|FD_POLL_ERR));
Christopher Faulet67957bd2017-09-27 11:00:59 +02001797 fd_cant_recv(fd);
1798 break;
1799 }
1800
1801 /* message too big */
1802 if (buflen > resolvers->accepted_payload_size) {
1803 ns->counters.too_big++;
1804 continue;
1805 }
1806
1807 /* initializing variables */
1808 bufend = buf + buflen; /* pointer to mark the end of the buffer */
1809
1810 /* read the query id from the packet (16 bits) */
1811 if (buf + 2 > bufend) {
1812 ns->counters.invalid++;
1813 continue;
1814 }
1815 query_id = dns_response_get_query_id(buf);
1816
1817 /* search the query_id in the pending resolution tree */
1818 eb = eb32_lookup(&resolvers->query_ids, query_id);
1819 if (eb == NULL) {
1820 /* unknown query id means an outdated response and can be safely ignored */
1821 ns->counters.outdated++;
1822 continue;
1823 }
1824
William Dauchybe8a3872019-11-27 23:32:41 +01001825 /* known query id means a resolution in progress */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001826 res = eb32_entry(eb, struct dns_resolution, qid);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001827 /* number of responses received */
1828 res->nb_responses++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001829
Christopher Faulet67957bd2017-09-27 11:00:59 +02001830 max_answer_records = (resolvers->accepted_payload_size - DNS_HEADER_SIZE) / DNS_MIN_RECORD_SIZE;
1831 dns_resp = dns_validate_dns_response(buf, bufend, res, max_answer_records);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001832
Christopher Faulet67957bd2017-09-27 11:00:59 +02001833 switch (dns_resp) {
1834 case DNS_RESP_VALID:
1835 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001836
Christopher Faulet67957bd2017-09-27 11:00:59 +02001837 case DNS_RESP_INVALID:
1838 case DNS_RESP_QUERY_COUNT_ERROR:
1839 case DNS_RESP_WRONG_NAME:
1840 res->status = RSLV_STATUS_INVALID;
1841 ns->counters.invalid++;
1842 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001843
Christopher Faulet67957bd2017-09-27 11:00:59 +02001844 case DNS_RESP_NX_DOMAIN:
1845 res->status = RSLV_STATUS_NX;
1846 ns->counters.nx++;
1847 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001848
Christopher Faulet67957bd2017-09-27 11:00:59 +02001849 case DNS_RESP_REFUSED:
1850 res->status = RSLV_STATUS_REFUSED;
1851 ns->counters.refused++;
1852 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001853
Christopher Faulet67957bd2017-09-27 11:00:59 +02001854 case DNS_RESP_ANCOUNT_ZERO:
1855 res->status = RSLV_STATUS_OTHER;
1856 ns->counters.any_err++;
1857 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001858
Christopher Faulet67957bd2017-09-27 11:00:59 +02001859 case DNS_RESP_CNAME_ERROR:
1860 res->status = RSLV_STATUS_OTHER;
1861 ns->counters.cname_error++;
1862 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001863
Christopher Faulet67957bd2017-09-27 11:00:59 +02001864 case DNS_RESP_TRUNCATED:
1865 res->status = RSLV_STATUS_OTHER;
1866 ns->counters.truncated++;
1867 break;
Baptiste Assmanne70bc052017-08-21 16:51:09 +02001868
Christopher Faulet67957bd2017-09-27 11:00:59 +02001869 case DNS_RESP_NO_EXPECTED_RECORD:
1870 case DNS_RESP_ERROR:
1871 case DNS_RESP_INTERNAL:
1872 res->status = RSLV_STATUS_OTHER;
1873 ns->counters.other++;
1874 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001875 }
1876
Christopher Faulet67957bd2017-09-27 11:00:59 +02001877 /* Wait all nameservers response to handle errors */
1878 if (dns_resp != DNS_RESP_VALID && res->nb_responses < resolvers->nb_nameservers)
1879 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001880
Christopher Faulet67957bd2017-09-27 11:00:59 +02001881 /* Process error codes */
1882 if (dns_resp != DNS_RESP_VALID) {
1883 if (res->prefered_query_type != res->query_type) {
1884 /* The fallback on the query type was already performed,
1885 * so check the try counter. If it falls to 0, we can
1886 * report an error. Else, wait the next attempt. */
1887 if (!res->try)
1888 goto report_res_error;
1889 }
1890 else {
1891 /* Fallback from A to AAAA or the opposite and re-send
1892 * the resolution immediately. try counter is not
1893 * decremented. */
1894 if (res->prefered_query_type == DNS_RTYPE_A) {
1895 res->query_type = DNS_RTYPE_AAAA;
1896 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001897 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001898 else if (res->prefered_query_type == DNS_RTYPE_AAAA) {
1899 res->query_type = DNS_RTYPE_A;
1900 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001901 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001902 }
1903 continue;
1904 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001905
Christopher Faulet67957bd2017-09-27 11:00:59 +02001906 /* Now let's check the query's dname corresponds to the one we
1907 * sent. We can check only the first query of the list. We send
1908 * one query at a time so we get one query in the response */
1909 query = LIST_NEXT(&res->response.query_list, struct dns_query_item *, list);
1910 if (query && memcmp(query->name, res->hostname_dn, res->hostname_dn_len) != 0) {
1911 dns_resp = DNS_RESP_WRONG_NAME;
1912 ns->counters.other++;
1913 goto report_res_error;
1914 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001915
Christopher Faulet67957bd2017-09-27 11:00:59 +02001916 /* So the resolution succeeded */
1917 res->status = RSLV_STATUS_VALID;
1918 res->last_valid = now_ms;
1919 ns->counters.valid++;
1920 goto report_res_success;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001921
Christopher Faulet67957bd2017-09-27 11:00:59 +02001922 report_res_error:
1923 list_for_each_entry(req, &res->requesters, list)
1924 req->requester_error_cb(req, dns_resp);
1925 dns_reset_resolution(res);
1926 LIST_DEL(&res->list);
1927 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1928 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001929
Christopher Faulet67957bd2017-09-27 11:00:59 +02001930 report_res_success:
1931 /* Only the 1rst requester s managed by the server, others are
1932 * from the cache */
1933 tmpns = ns;
1934 list_for_each_entry(req, &res->requesters, list) {
Olivier Houchard28381072017-11-06 17:30:28 +01001935 struct server *s = objt_server(req->owner);
1936
1937 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001938 HA_SPIN_LOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001939 req->requester_cb(req, tmpns);
Olivier Houchard28381072017-11-06 17:30:28 +01001940 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001941 HA_SPIN_UNLOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001942 tmpns = NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001943 }
Baptiste Assmann42746372017-05-03 12:12:02 +02001944
Christopher Faulet67957bd2017-09-27 11:00:59 +02001945 dns_reset_resolution(res);
1946 LIST_DEL(&res->list);
1947 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1948 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001949 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001950 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001951 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001952}
William Lallemand69e96442016-11-19 00:58:54 +01001953
Christopher Faulet67957bd2017-09-27 11:00:59 +02001954/* Called when a resolvers network socket is ready to send data */
1955static void dns_resolve_send(struct dgram_conn *dgram)
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001956{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001957 struct dns_resolvers *resolvers;
1958 struct dns_nameserver *ns;
1959 struct dns_resolution *res;
1960 int fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001961
Christopher Faulet67957bd2017-09-27 11:00:59 +02001962 fd = dgram->t.sock.fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001963
Christopher Faulet67957bd2017-09-27 11:00:59 +02001964 /* check if ready for sending */
1965 if (!fd_send_ready(fd))
1966 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001967
Christopher Faulet67957bd2017-09-27 11:00:59 +02001968 /* we don't want/need to be waked up any more for sending */
1969 fd_stop_send(fd);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001970
Christopher Faulet67957bd2017-09-27 11:00:59 +02001971 /* no need to go further if we can't retrieve the nameserver */
1972 if ((ns = dgram->owner) == NULL)
1973 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001974
Christopher Faulet67957bd2017-09-27 11:00:59 +02001975 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001976 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02001977
Christopher Faulet67957bd2017-09-27 11:00:59 +02001978 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001979 int ret, len;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001980
Christopher Faulet67957bd2017-09-27 11:00:59 +02001981 if (res->nb_queries == resolvers->nb_nameservers)
1982 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001983
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001984 len = dns_build_query(res->query_id, res->query_type,
1985 resolvers->accepted_payload_size,
1986 res->hostname_dn, res->hostname_dn_len,
1987 trash.area, trash.size);
1988 if (len == -1)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001989 goto snd_error;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001990
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001991 ret = send(fd, trash.area, len, 0);
Willy Tarreau0eae6322019-12-20 11:18:54 +01001992 if (ret != len) {
1993 if (ret == -1 && errno == EAGAIN) {
1994 /* retry once the socket is ready */
1995 fd_cant_send(fd);
1996 continue;
1997 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001998 goto snd_error;
Willy Tarreau0eae6322019-12-20 11:18:54 +01001999 }
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002000
Christopher Faulet67957bd2017-09-27 11:00:59 +02002001 ns->counters.sent++;
2002 res->nb_queries++;
2003 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002004
Christopher Faulet67957bd2017-09-27 11:00:59 +02002005 snd_error:
2006 ns->counters.snd_error++;
2007 res->nb_queries++;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002008 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002009 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002010}
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002011
Christopher Faulet67957bd2017-09-27 11:00:59 +02002012/* Processes DNS resolution. First, it checks the active list to detect expired
2013 * resolutions and retry them if possible. Else a timeout is reported. Then, it
2014 * checks the wait list to trigger new resolutions.
2015 */
Olivier Houchard9f6af332018-05-25 14:04:04 +02002016static struct task *dns_process_resolvers(struct task *t, void *context, unsigned short state)
Christopher Faulet67957bd2017-09-27 11:00:59 +02002017{
Olivier Houchard9f6af332018-05-25 14:04:04 +02002018 struct dns_resolvers *resolvers = context;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002019 struct dns_resolution *res, *resback;
2020 int exp;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002021
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002022 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02002023
Christopher Faulet67957bd2017-09-27 11:00:59 +02002024 /* Handle all expired resolutions from the active list */
2025 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
2026 /* When we find the first resolution in the future, then we can
2027 * stop here */
2028 exp = tick_add(res->last_query, resolvers->timeout.retry);
2029 if (!tick_is_expired(exp, now_ms))
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002030 break;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002031
Christopher Faulet67957bd2017-09-27 11:00:59 +02002032 /* If current resolution has been tried too many times and
2033 * finishes in timeout we update its status and remove it from
2034 * the list */
2035 if (!res->try) {
2036 struct dns_requester *req;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002037
Christopher Faulet67957bd2017-09-27 11:00:59 +02002038 /* Notify the result to the requesters */
2039 if (!res->nb_responses)
2040 res->status = RSLV_STATUS_TIMEOUT;
2041 list_for_each_entry(req, &res->requesters, list)
2042 req->requester_error_cb(req, res->status);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002043
Christopher Faulet67957bd2017-09-27 11:00:59 +02002044 /* Clean up resolution info and remove it from the
2045 * current list */
2046 dns_reset_resolution(res);
2047 LIST_DEL(&res->list);
2048 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
William Lallemand69e96442016-11-19 00:58:54 +01002049 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002050 else {
2051 /* Otherwise resend the DNS query and requeue the resolution */
2052 if (!res->nb_responses || res->prefered_query_type != res->query_type) {
2053 /* No response received (a real timeout) or fallback already done */
2054 res->query_type = res->prefered_query_type;
2055 res->try--;
2056 }
2057 else {
2058 /* Fallback from A to AAAA or the opposite and re-send
2059 * the resolution immediately. try counter is not
2060 * decremented. */
2061 if (res->prefered_query_type == DNS_RTYPE_A)
2062 res->query_type = DNS_RTYPE_AAAA;
2063 else if (res->prefered_query_type == DNS_RTYPE_AAAA)
2064 res->query_type = DNS_RTYPE_A;
2065 else
2066 res->try--;
2067 }
2068 dns_send_query(res);
William Lallemand69e96442016-11-19 00:58:54 +01002069 }
2070 }
William Lallemand69e96442016-11-19 00:58:54 +01002071
Christopher Faulet67957bd2017-09-27 11:00:59 +02002072 /* Handle all resolutions in the wait list */
2073 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
2074 exp = tick_add(res->last_resolution, dns_resolution_timeout(res));
2075 if (tick_isset(res->last_resolution) && !tick_is_expired(exp, now_ms))
2076 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002077
Christopher Faulet67957bd2017-09-27 11:00:59 +02002078 if (dns_run_resolution(res) != 1) {
2079 res->last_resolution = now_ms;
2080 LIST_DEL(&res->list);
2081 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002082 }
2083 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002084
Christopher Faulet67957bd2017-09-27 11:00:59 +02002085 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002086 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002087 return t;
2088}
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002089
Christopher Faulet67957bd2017-09-27 11:00:59 +02002090/* proto_udp callback functions for a DNS resolution */
2091struct dgram_data_cb resolve_dgram_cb = {
2092 .recv = dns_resolve_recv,
2093 .send = dns_resolve_send,
2094};
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002095
Christopher Faulet67957bd2017-09-27 11:00:59 +02002096/* Release memory allocated by DNS */
2097static void dns_deinit(void)
2098{
2099 struct dns_resolvers *resolvers, *resolversback;
2100 struct dns_nameserver *ns, *nsback;
2101 struct dns_resolution *res, *resback;
2102 struct dns_requester *req, *reqback;
2103 struct dns_srvrq *srvrq, *srvrqback;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002104
Christopher Faulet67957bd2017-09-27 11:00:59 +02002105 list_for_each_entry_safe(resolvers, resolversback, &dns_resolvers, list) {
2106 list_for_each_entry_safe(ns, nsback, &resolvers->nameservers, list) {
2107 free(ns->id);
2108 free((char *)ns->conf.file);
2109 if (ns->dgram && ns->dgram->t.sock.fd != -1)
2110 fd_delete(ns->dgram->t.sock.fd);
2111 free(ns->dgram);
2112 LIST_DEL(&ns->list);
2113 free(ns);
2114 }
2115
2116 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
2117 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
2118 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01002119 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002120 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002121 dns_free_resolution(res);
2122 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02002123
Christopher Faulet67957bd2017-09-27 11:00:59 +02002124 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
2125 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
2126 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01002127 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002128 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002129 dns_free_resolution(res);
2130 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02002131
Christopher Faulet67957bd2017-09-27 11:00:59 +02002132 free(resolvers->id);
2133 free((char *)resolvers->conf.file);
Olivier Houchard3f795f72019-04-17 22:51:06 +02002134 task_destroy(resolvers->t);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002135 LIST_DEL(&resolvers->list);
2136 free(resolvers);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002137 }
2138
Christopher Faulet67957bd2017-09-27 11:00:59 +02002139 list_for_each_entry_safe(srvrq, srvrqback, &dns_srvrq_list, list) {
2140 free(srvrq->name);
2141 free(srvrq->hostname_dn);
2142 LIST_DEL(&srvrq->list);
2143 free(srvrq);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002144 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002145}
2146
Christopher Faulet67957bd2017-09-27 11:00:59 +02002147/* Finalizes the DNS configuration by allocating required resources and checking
2148 * live parameters.
2149 * Returns 0 on success, ERR_* flags otherwise.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002150 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02002151static int dns_finalize_config(void)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002152{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002153 struct dns_resolvers *resolvers;
2154 struct proxy *px;
2155 int err_code = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002156
Christopher Faulet67957bd2017-09-27 11:00:59 +02002157 /* allocate pool of resolution per resolvers */
2158 list_for_each_entry(resolvers, &dns_resolvers, list) {
2159 struct dns_nameserver *ns;
2160 struct task *t;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002161
Christopher Faulet67957bd2017-09-27 11:00:59 +02002162 /* Check if we can create the socket with nameservers info */
2163 list_for_each_entry(ns, &resolvers->nameservers, list) {
2164 struct dgram_conn *dgram = NULL;
2165 int fd;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002166
Christopher Faulet67957bd2017-09-27 11:00:59 +02002167 /* Check nameserver info */
2168 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002169 ha_alert("config : resolvers '%s': can't create socket for nameserver '%s'.\n",
2170 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002171 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002172 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02002173 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002174 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002175 ha_alert("config : resolvers '%s': can't connect socket for nameserver '%s'.\n",
2176 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002177 close(fd);
2178 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002179 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02002180 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002181 close(fd);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002182
Christopher Faulet67957bd2017-09-27 11:00:59 +02002183 /* Create dgram structure that will hold the UPD socket
2184 * and attach it on the current nameserver */
2185 if ((dgram = calloc(1, sizeof(*dgram))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002186 ha_alert("config: resolvers '%s' : out of memory.\n",
2187 resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002188 err_code |= (ERR_ALERT|ERR_ABORT);
2189 goto err;
2190 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002191
Christopher Faulet67957bd2017-09-27 11:00:59 +02002192 /* Leave dgram partially initialized, no FD attached for
2193 * now. */
2194 dgram->owner = ns;
2195 dgram->data = &resolve_dgram_cb;
2196 dgram->t.sock.fd = -1;
2197 ns->dgram = dgram;
2198 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002199
Christopher Faulet67957bd2017-09-27 11:00:59 +02002200 /* Create the task associated to the resolvers section */
Emeric Brunc60def82017-09-27 14:59:38 +02002201 if ((t = task_new(MAX_THREADS_MASK)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002202 ha_alert("config : resolvers '%s' : out of memory.\n", resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002203 err_code |= (ERR_ALERT|ERR_ABORT);
2204 goto err;
2205 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002206
Christopher Faulet67957bd2017-09-27 11:00:59 +02002207 /* Update task's parameters */
2208 t->process = dns_process_resolvers;
2209 t->context = resolvers;
2210 resolvers->t = t;
2211 task_wakeup(t, TASK_WOKEN_INIT);
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002212 }
2213
Olivier Houchardfbc74e82017-11-24 16:54:05 +01002214 for (px = proxies_list; px; px = px->next) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002215 struct server *srv;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002216
Christopher Faulet67957bd2017-09-27 11:00:59 +02002217 for (srv = px->srv; srv; srv = srv->next) {
2218 struct dns_resolvers *resolvers;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002219
Christopher Faulet67957bd2017-09-27 11:00:59 +02002220 if (!srv->resolvers_id)
2221 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002222
Christopher Faulet67957bd2017-09-27 11:00:59 +02002223 if ((resolvers = find_resolvers_by_id(srv->resolvers_id)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002224 ha_alert("config : %s '%s', server '%s': unable to find required resolvers '%s'\n",
2225 proxy_type_str(px), px->id, srv->id, srv->resolvers_id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002226 err_code |= (ERR_ALERT|ERR_ABORT);
2227 continue;
2228 }
2229 srv->resolvers = resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002230
Christopher Faulet67957bd2017-09-27 11:00:59 +02002231 if (srv->srvrq && !srv->srvrq->resolvers) {
2232 srv->srvrq->resolvers = srv->resolvers;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01002233 if (dns_link_resolution(srv->srvrq, OBJ_TYPE_SRVRQ, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002234 ha_alert("config : %s '%s' : unable to set DNS resolution for server '%s'.\n",
2235 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002236 err_code |= (ERR_ALERT|ERR_ABORT);
2237 continue;
2238 }
2239 }
Olivier Houchard55dcdf42017-11-06 15:15:04 +01002240 if (dns_link_resolution(srv, OBJ_TYPE_SERVER, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002241 ha_alert("config : %s '%s', unable to set DNS resolution for server '%s'.\n",
2242 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002243 err_code |= (ERR_ALERT|ERR_ABORT);
2244 continue;
2245 }
2246 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002247 }
2248
Christopher Faulet67957bd2017-09-27 11:00:59 +02002249 if (err_code & (ERR_ALERT|ERR_ABORT))
2250 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002251
Christopher Faulet67957bd2017-09-27 11:00:59 +02002252 return err_code;
2253 err:
2254 dns_deinit();
2255 return err_code;
2256
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002257}
2258
Christopher Faulet67957bd2017-09-27 11:00:59 +02002259/* if an arg is found, it sets the resolvers section pointer into cli.p0 */
Aurélien Nephtaliabbf6072018-04-18 13:26:46 +02002260static int cli_parse_stat_resolvers(char **args, char *payload, struct appctx *appctx, void *private)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002261{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002262 struct dns_resolvers *presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002263
Christopher Faulet67957bd2017-09-27 11:00:59 +02002264 if (*args[2]) {
2265 list_for_each_entry(presolvers, &dns_resolvers, list) {
2266 if (strcmp(presolvers->id, args[2]) == 0) {
2267 appctx->ctx.cli.p0 = presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002268 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002269 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002270 }
Willy Tarreau9d008692019-08-09 11:21:01 +02002271 if (appctx->ctx.cli.p0 == NULL)
2272 return cli_err(appctx, "Can't find that resolvers section\n");
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002273 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002274 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002275}
2276
Christopher Faulet67957bd2017-09-27 11:00:59 +02002277/* Dumps counters from all resolvers section and associated name servers. It
2278 * returns 0 if the output buffer is full and it needs to be called again,
2279 * otherwise non-zero. It may limit itself to the resolver pointed to by
Willy Tarreau777b5602016-12-16 18:06:26 +01002280 * <cli.p0> if it's not null.
William Lallemand69e96442016-11-19 00:58:54 +01002281 */
2282static int cli_io_handler_dump_resolvers_to_buffer(struct appctx *appctx)
2283{
2284 struct stream_interface *si = appctx->owner;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002285 struct dns_resolvers *resolvers;
2286 struct dns_nameserver *ns;
William Lallemand69e96442016-11-19 00:58:54 +01002287
2288 chunk_reset(&trash);
2289
2290 switch (appctx->st2) {
2291 case STAT_ST_INIT:
2292 appctx->st2 = STAT_ST_LIST; /* let's start producing data */
2293 /* fall through */
2294
2295 case STAT_ST_LIST:
2296 if (LIST_ISEMPTY(&dns_resolvers)) {
2297 chunk_appendf(&trash, "No resolvers found\n");
2298 }
2299 else {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002300 list_for_each_entry(resolvers, &dns_resolvers, list) {
2301 if (appctx->ctx.cli.p0 != NULL && appctx->ctx.cli.p0 != resolvers)
William Lallemand69e96442016-11-19 00:58:54 +01002302 continue;
2303
Christopher Faulet67957bd2017-09-27 11:00:59 +02002304 chunk_appendf(&trash, "Resolvers section %s\n", resolvers->id);
2305 list_for_each_entry(ns, &resolvers->nameservers, list) {
2306 chunk_appendf(&trash, " nameserver %s:\n", ns->id);
2307 chunk_appendf(&trash, " sent: %lld\n", ns->counters.sent);
2308 chunk_appendf(&trash, " snd_error: %lld\n", ns->counters.snd_error);
2309 chunk_appendf(&trash, " valid: %lld\n", ns->counters.valid);
2310 chunk_appendf(&trash, " update: %lld\n", ns->counters.update);
2311 chunk_appendf(&trash, " cname: %lld\n", ns->counters.cname);
2312 chunk_appendf(&trash, " cname_error: %lld\n", ns->counters.cname_error);
2313 chunk_appendf(&trash, " any_err: %lld\n", ns->counters.any_err);
2314 chunk_appendf(&trash, " nx: %lld\n", ns->counters.nx);
2315 chunk_appendf(&trash, " timeout: %lld\n", ns->counters.timeout);
2316 chunk_appendf(&trash, " refused: %lld\n", ns->counters.refused);
2317 chunk_appendf(&trash, " other: %lld\n", ns->counters.other);
2318 chunk_appendf(&trash, " invalid: %lld\n", ns->counters.invalid);
2319 chunk_appendf(&trash, " too_big: %lld\n", ns->counters.too_big);
2320 chunk_appendf(&trash, " truncated: %lld\n", ns->counters.truncated);
2321 chunk_appendf(&trash, " outdated: %lld\n", ns->counters.outdated);
William Lallemand69e96442016-11-19 00:58:54 +01002322 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002323 chunk_appendf(&trash, "\n");
William Lallemand69e96442016-11-19 00:58:54 +01002324 }
2325 }
2326
2327 /* display response */
Willy Tarreau06d80a92017-10-19 14:32:15 +02002328 if (ci_putchk(si_ic(si), &trash) == -1) {
William Lallemand69e96442016-11-19 00:58:54 +01002329 /* let's try again later from this session. We add ourselves into
2330 * this session's users so that it can remove us upon termination.
2331 */
Willy Tarreaudb398432018-11-15 11:08:52 +01002332 si_rx_room_blk(si);
William Lallemand69e96442016-11-19 00:58:54 +01002333 return 0;
2334 }
William Lallemand69e96442016-11-19 00:58:54 +01002335 /* fall through */
2336
2337 default:
2338 appctx->st2 = STAT_ST_FIN;
2339 return 1;
2340 }
2341}
2342
2343/* register cli keywords */
Christopher Fauletff88efb2017-10-03 16:00:57 +02002344static struct cli_kw_list cli_kws = {{ }, {
2345 { { "show", "resolvers", NULL }, "show resolvers [id]: dumps counters from all resolvers section and\n"
2346 " associated name servers",
2347 cli_parse_stat_resolvers, cli_io_handler_dump_resolvers_to_buffer },
2348 {{},}
2349 }
2350};
William Lallemand69e96442016-11-19 00:58:54 +01002351
Willy Tarreau0108d902018-11-25 19:14:37 +01002352INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
William Lallemand69e96442016-11-19 00:58:54 +01002353
Baptiste Assmann333939c2019-01-21 08:34:50 +01002354/*
2355 * Prepare <rule> for hostname resolution.
2356 * Returns -1 in case of any allocation failure, 0 if not.
2357 * On error, a global failure counter is also incremented.
2358 */
2359static int action_prepare_for_resolution(struct stream *stream, const char *hostname)
2360{
2361 char *hostname_dn;
2362 int hostname_len, hostname_dn_len;
2363 struct buffer *tmp = get_trash_chunk();
2364
2365 if (!hostname)
2366 return 0;
2367
2368 hostname_len = strlen(hostname);
2369 hostname_dn = tmp->area;
2370 hostname_dn_len = dns_str_to_dn_label(hostname, hostname_len + 1,
2371 hostname_dn, tmp->size);
2372 if (hostname_dn_len == -1)
2373 goto err;
2374
2375
2376 stream->dns_ctx.hostname_dn = strdup(hostname_dn);
2377 stream->dns_ctx.hostname_dn_len = hostname_dn_len;
2378 if (!stream->dns_ctx.hostname_dn)
2379 goto err;
2380
2381 return 0;
2382
2383 err:
2384 free(stream->dns_ctx.hostname_dn); stream->dns_ctx.hostname_dn = NULL;
2385 dns_failed_resolutions += 1;
2386 return -1;
2387}
2388
2389
2390/*
2391 * Execute the "do-resolution" action. May be called from {tcp,http}request.
2392 */
2393enum act_return dns_action_do_resolve(struct act_rule *rule, struct proxy *px,
2394 struct session *sess, struct stream *s, int flags)
2395{
Baptiste Assmann333939c2019-01-21 08:34:50 +01002396 struct dns_resolution *resolution;
Willy Tarreau45726fd2019-07-17 10:38:45 +02002397 struct sample *smp;
2398 char *fqdn;
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002399 struct dns_requester *req;
2400 struct dns_resolvers *resolvers;
2401 struct dns_resolution *res;
2402 int exp;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002403
2404 /* we have a response to our DNS resolution */
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002405 use_cache:
Baptiste Assmann333939c2019-01-21 08:34:50 +01002406 if (s->dns_ctx.dns_requester && s->dns_ctx.dns_requester->resolution != NULL) {
2407 resolution = s->dns_ctx.dns_requester->resolution;
Baptiste Assmann4c52e4b2019-10-01 15:32:40 +02002408 if (resolution->step == RSLV_STEP_RUNNING) {
2409 return ACT_RET_YIELD;
2410 }
Baptiste Assmann333939c2019-01-21 08:34:50 +01002411 if (resolution->step == RSLV_STEP_NONE) {
2412 /* We update the variable only if we have a valid response. */
2413 if (resolution->status == RSLV_STATUS_VALID) {
2414 struct sample smp;
2415 short ip_sin_family = 0;
2416 void *ip = NULL;
2417
Christopher Fauleta4168432020-01-24 18:08:42 +01002418 dns_get_ip_from_response(&resolution->response, rule->arg.dns.dns_opts, NULL,
Baptiste Assmann333939c2019-01-21 08:34:50 +01002419 0, &ip, &ip_sin_family, NULL);
2420
2421 switch (ip_sin_family) {
2422 case AF_INET:
2423 smp.data.type = SMP_T_IPV4;
2424 memcpy(&smp.data.u.ipv4, ip, 4);
2425 break;
2426 case AF_INET6:
2427 smp.data.type = SMP_T_IPV6;
2428 memcpy(&smp.data.u.ipv6, ip, 16);
2429 break;
2430 default:
2431 ip = NULL;
2432 }
2433
2434 if (ip) {
2435 smp.px = px;
2436 smp.sess = sess;
2437 smp.strm = s;
2438
2439 vars_set_by_name(rule->arg.dns.varname, strlen(rule->arg.dns.varname), &smp);
2440 }
2441 }
2442 }
2443
2444 free(s->dns_ctx.hostname_dn); s->dns_ctx.hostname_dn = NULL;
2445 s->dns_ctx.hostname_dn_len = 0;
2446 dns_unlink_resolution(s->dns_ctx.dns_requester);
2447
2448 pool_free(dns_requester_pool, s->dns_ctx.dns_requester);
2449 s->dns_ctx.dns_requester = NULL;
2450
2451 return ACT_RET_CONT;
2452 }
2453
2454 /* need to configure and start a new DNS resolution */
Willy Tarreau45726fd2019-07-17 10:38:45 +02002455 smp = sample_fetch_as_type(px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.dns.expr, SMP_T_STR);
2456 if (smp == NULL)
2457 return ACT_RET_CONT;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002458
Willy Tarreau45726fd2019-07-17 10:38:45 +02002459 fqdn = smp->data.u.str.area;
2460 if (action_prepare_for_resolution(s, fqdn) == -1)
Christopher Faulet13403762019-12-13 09:01:57 +01002461 return ACT_RET_CONT; /* on error, ignore the action */
Baptiste Assmann333939c2019-01-21 08:34:50 +01002462
Willy Tarreau45726fd2019-07-17 10:38:45 +02002463 s->dns_ctx.parent = rule;
2464 dns_link_resolution(s, OBJ_TYPE_STREAM, 0);
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002465
2466 /* Check if there is a fresh enough response in the cache of our associated resolution */
2467 req = s->dns_ctx.dns_requester;
2468 if (!req || !req->resolution) {
2469 dns_trigger_resolution(s->dns_ctx.dns_requester);
2470 return ACT_RET_YIELD;
2471 }
2472 res = req->resolution;
2473 resolvers = res->resolvers;
2474
2475 exp = tick_add(res->last_resolution, resolvers->hold.valid);
2476 if (resolvers->t && res->status == RSLV_STATUS_VALID && tick_isset(res->last_resolution)
2477 && !tick_is_expired(exp, now_ms)) {
2478 goto use_cache;
2479 }
2480
Willy Tarreau45726fd2019-07-17 10:38:45 +02002481 dns_trigger_resolution(s->dns_ctx.dns_requester);
Baptiste Assmann333939c2019-01-21 08:34:50 +01002482 return ACT_RET_YIELD;
2483}
2484
Christopher Faulet3b2bb632020-01-24 18:12:58 +01002485static void release_dns_action(struct act_rule *rule)
2486{
2487 release_sample_expr(rule->arg.dns.expr);
2488 free(rule->arg.dns.varname);
2489 free(rule->arg.dns.resolvers_id);
2490 free(rule->arg.dns.dns_opts);
2491}
2492
Baptiste Assmann333939c2019-01-21 08:34:50 +01002493
2494/* parse "do-resolve" action
2495 * This action takes the following arguments:
2496 * do-resolve(<varName>,<resolversSectionName>,<resolvePrefer>) <expr>
2497 *
2498 * - <varName> is the variable name where the result of the DNS resolution will be stored
2499 * (mandatory)
2500 * - <resolversSectionName> is the name of the resolvers section to use to perform the resolution
2501 * (mandatory)
2502 * - <resolvePrefer> can be either 'ipv4' or 'ipv6' and is the IP family we would like to resolve first
2503 * (optional), defaults to ipv6
2504 * - <expr> is an HAProxy expression used to fetch the name to be resolved
2505 */
2506enum act_parse_ret dns_parse_do_resolve(const char **args, int *orig_arg, struct proxy *px, struct act_rule *rule, char **err)
2507{
2508 int cur_arg;
2509 struct sample_expr *expr;
2510 unsigned int where;
2511 const char *beg, *end;
2512
2513 /* orig_arg points to the first argument, but we need to analyse the command itself first */
2514 cur_arg = *orig_arg - 1;
2515
2516 /* locate varName, which is mandatory */
2517 beg = strchr(args[cur_arg], '(');
2518 if (beg == NULL)
2519 goto do_resolve_parse_error;
2520 beg = beg + 1; /* beg should points to the first character after opening parenthesis '(' */
2521 end = strchr(beg, ',');
2522 if (end == NULL)
2523 goto do_resolve_parse_error;
2524 rule->arg.dns.varname = my_strndup(beg, end - beg);
2525 if (rule->arg.dns.varname == NULL)
2526 goto do_resolve_parse_error;
2527
2528
2529 /* locate resolversSectionName, which is mandatory.
2530 * Since next parameters are optional, the delimiter may be comma ','
2531 * or closing parenthesis ')'
2532 */
2533 beg = end + 1;
2534 end = strchr(beg, ',');
2535 if (end == NULL)
2536 end = strchr(beg, ')');
2537 if (end == NULL)
2538 goto do_resolve_parse_error;
2539 rule->arg.dns.resolvers_id = my_strndup(beg, end - beg);
2540 if (rule->arg.dns.resolvers_id == NULL)
2541 goto do_resolve_parse_error;
2542
2543
Christopher Fauleta4168432020-01-24 18:08:42 +01002544 rule->arg.dns.dns_opts = calloc(1, sizeof(*rule->arg.dns.dns_opts));
2545 if (rule->arg.dns.dns_opts == NULL)
2546 goto do_resolve_parse_error;
2547
Baptiste Assmann333939c2019-01-21 08:34:50 +01002548 /* Default priority is ipv6 */
Christopher Fauleta4168432020-01-24 18:08:42 +01002549 rule->arg.dns.dns_opts->family_prio = AF_INET6;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002550
2551 /* optional arguments accepted for now:
2552 * ipv4 or ipv6
2553 */
2554 while (*end != ')') {
2555 beg = end + 1;
2556 end = strchr(beg, ',');
2557 if (end == NULL)
2558 end = strchr(beg, ')');
2559 if (end == NULL)
2560 goto do_resolve_parse_error;
2561
2562 if (strncmp(beg, "ipv4", end - beg) == 0) {
Christopher Fauleta4168432020-01-24 18:08:42 +01002563 rule->arg.dns.dns_opts->family_prio = AF_INET;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002564 }
2565 else if (strncmp(beg, "ipv6", end - beg) == 0) {
Christopher Fauleta4168432020-01-24 18:08:42 +01002566 rule->arg.dns.dns_opts->family_prio = AF_INET6;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002567 }
2568 else {
2569 goto do_resolve_parse_error;
2570 }
2571 }
2572
2573 cur_arg = cur_arg + 1;
2574
Willy Tarreaue3b57bf2020-02-14 16:50:14 +01002575 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args, NULL);
Baptiste Assmann333939c2019-01-21 08:34:50 +01002576 if (!expr)
2577 goto do_resolve_parse_error;
2578
2579
2580 where = 0;
2581 if (px->cap & PR_CAP_FE)
2582 where |= SMP_VAL_FE_HRQ_HDR;
2583 if (px->cap & PR_CAP_BE)
2584 where |= SMP_VAL_BE_HRQ_HDR;
2585
2586 if (!(expr->fetch->val & where)) {
2587 memprintf(err,
2588 "fetch method '%s' extracts information from '%s', none of which is available here",
2589 args[cur_arg-1], sample_src_names(expr->fetch->use));
2590 free(expr);
2591 return ACT_RET_PRS_ERR;
2592 }
2593 rule->arg.dns.expr = expr;
2594 rule->action = ACT_CUSTOM;
2595 rule->action_ptr = dns_action_do_resolve;
2596 *orig_arg = cur_arg;
2597
2598 rule->check_ptr = check_action_do_resolve;
Christopher Faulet3b2bb632020-01-24 18:12:58 +01002599 rule->release_ptr = release_dns_action;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002600
2601 return ACT_RET_PRS_OK;
2602
2603 do_resolve_parse_error:
2604 free(rule->arg.dns.varname); rule->arg.dns.varname = NULL;
2605 free(rule->arg.dns.resolvers_id); rule->arg.dns.resolvers_id = NULL;
2606 memprintf(err, "Can't parse '%s'. Expects 'do-resolve(<varname>,<resolvers>[,<options>]) <expr>'. Available options are 'ipv4' and 'ipv6'",
2607 args[cur_arg]);
2608 return ACT_RET_PRS_ERR;
2609}
2610
2611static struct action_kw_list http_req_kws = { { }, {
2612 { "do-resolve", dns_parse_do_resolve, 1 },
2613 { /* END */ }
2614}};
2615
2616INITCALL1(STG_REGISTER, http_req_keywords_register, &http_req_kws);
2617
2618static struct action_kw_list tcp_req_cont_actions = {ILH, {
2619 { "do-resolve", dns_parse_do_resolve, 1 },
2620 { /* END */ }
2621}};
2622
2623INITCALL1(STG_REGISTER, tcp_req_cont_keywords_register, &tcp_req_cont_actions);
2624
2625/* Check an "http-request do-resolve" action.
2626 *
2627 * The function returns 1 in success case, otherwise, it returns 0 and err is
2628 * filled.
2629 */
2630int check_action_do_resolve(struct act_rule *rule, struct proxy *px, char **err)
2631{
2632 struct dns_resolvers *resolvers = NULL;
2633
2634 if (rule->arg.dns.resolvers_id == NULL) {
2635 memprintf(err,"Proxy '%s': %s", px->id, "do-resolve action without resolvers");
2636 return 0;
2637 }
2638
2639 resolvers = find_resolvers_by_id(rule->arg.dns.resolvers_id);
2640 if (resolvers == NULL) {
2641 memprintf(err,"Can't find resolvers section '%s' for do-resolve action", rule->arg.dns.resolvers_id);
2642 return 0;
2643 }
2644 rule->arg.dns.resolvers = resolvers;
2645
2646 return 1;
2647}
2648
Willy Tarreau172f5ce2018-11-26 11:21:50 +01002649REGISTER_POST_DEINIT(dns_deinit);
Willy Tarreaue6552512018-11-26 11:33:13 +01002650REGISTER_CONFIG_POSTPARSER("dns runtime resolver", dns_finalize_config);