blob: 38f73c1577646ee0ef12b850b0eea478d72c310e [file] [log] [blame]
Baptiste Assmann325137d2015-04-13 23:40:55 +02001/*
2 * Name server resolution
3 *
4 * Copyright 2014 Baptiste Assmann <bedis9@gmail.com>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <errno.h>
14#include <fcntl.h>
15#include <stdio.h>
16#include <stdlib.h>
17#include <string.h>
18#include <unistd.h>
19
20#include <sys/types.h>
21
Baptiste Assmann044fd5b2018-08-10 10:56:38 +020022#include <common/cfgparse.h>
Christopher Faulet67957bd2017-09-27 11:00:59 +020023#include <common/errors.h>
Willy Tarreau0108d902018-11-25 19:14:37 +010024#include <common/initcall.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020025#include <common/time.h>
26#include <common/ticks.h>
Olivier Houchard8da5f982017-08-04 18:35:36 +020027#include <common/net_helper.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020028
Baptiste Assmann333939c2019-01-21 08:34:50 +010029#include <types/action.h>
William Lallemand69e96442016-11-19 00:58:54 +010030#include <types/applet.h>
31#include <types/cli.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020032#include <types/global.h>
33#include <types/dns.h>
William Lallemand69e96442016-11-19 00:58:54 +010034#include <types/stats.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020035
Baptiste Assmann333939c2019-01-21 08:34:50 +010036#include <proto/action.h>
William Lallemand69e96442016-11-19 00:58:54 +010037#include <proto/channel.h>
38#include <proto/cli.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020039#include <proto/checks.h>
40#include <proto/dns.h>
41#include <proto/fd.h>
Christopher Fauletfc9cfe42019-07-16 14:54:53 +020042#include <proto/http_ana.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010043#include <proto/http_rules.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020044#include <proto/log.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010045#include <proto/sample.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020046#include <proto/server.h>
47#include <proto/task.h>
48#include <proto/proto_udp.h>
Christopher Faulet67957bd2017-09-27 11:00:59 +020049#include <proto/proxy.h>
William Lallemand69e96442016-11-19 00:58:54 +010050#include <proto/stream_interface.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010051#include <proto/tcp_rules.h>
52#include <proto/vars.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020053
Christopher Faulet67957bd2017-09-27 11:00:59 +020054struct list dns_resolvers = LIST_HEAD_INIT(dns_resolvers);
55struct list dns_srvrq_list = LIST_HEAD_INIT(dns_srvrq_list);
Baptiste Assmann325137d2015-04-13 23:40:55 +020056
Tim Duesterhusfcac33d2020-01-18 02:04:12 +010057static THREAD_LOCAL uint64_t dns_query_id_seed = 0; /* random seed */
Willy Tarreau8ceae722018-11-26 11:58:30 +010058
59DECLARE_STATIC_POOL(dns_answer_item_pool, "dns_answer_item", sizeof(struct dns_answer_item));
60DECLARE_STATIC_POOL(dns_resolution_pool, "dns_resolution", sizeof(struct dns_resolution));
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +010061DECLARE_POOL(dns_requester_pool, "dns_requester", sizeof(struct dns_requester));
Willy Tarreau8ceae722018-11-26 11:58:30 +010062
Christopher Faulet67957bd2017-09-27 11:00:59 +020063static unsigned int resolution_uuid = 1;
Baptiste Assmann333939c2019-01-21 08:34:50 +010064unsigned int dns_failed_resolutions = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020065
Christopher Faulet67957bd2017-09-27 11:00:59 +020066/* Returns a pointer to the resolvers matching the id <id>. NULL is returned if
67 * no match is found.
Baptiste Assmann325137d2015-04-13 23:40:55 +020068 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020069struct dns_resolvers *find_resolvers_by_id(const char *id)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020070{
Christopher Faulet67957bd2017-09-27 11:00:59 +020071 struct dns_resolvers *res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020072
Christopher Faulet67957bd2017-09-27 11:00:59 +020073 list_for_each_entry(res, &dns_resolvers, list) {
74 if (!strcmp(res->id, id))
75 return res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020076 }
Christopher Faulet67957bd2017-09-27 11:00:59 +020077 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020078}
79
Olivier Houchardb17b8842020-04-01 18:30:27 +020080/* Compare hostnames in a case-insensitive way .
81 * Returns 0 if they are the same, non-zero otherwise
82 */
83static __inline int dns_hostname_cmp(const char *name1, const char *name2, int len)
84{
85 int i;
86
87 for (i = 0; i < len; i++)
88 if (tolower(name1[i]) != tolower(name2[i]))
89 return -1;
90 return 0;
91}
92
Christopher Faulet67957bd2017-09-27 11:00:59 +020093/* Returns a pointer on the SRV request matching the name <name> for the proxy
94 * <px>. NULL is returned if no match is found.
Baptiste Assmann201c07f2017-05-22 15:17:15 +020095 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020096struct dns_srvrq *find_srvrq_by_name(const char *name, struct proxy *px)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020097{
Christopher Faulet67957bd2017-09-27 11:00:59 +020098 struct dns_srvrq *srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020099
Christopher Faulet67957bd2017-09-27 11:00:59 +0200100 list_for_each_entry(srvrq, &dns_srvrq_list, list) {
101 if (srvrq->proxy == px && !strcmp(srvrq->name, name))
102 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200103 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200104 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200105}
106
Christopher Faulet67957bd2017-09-27 11:00:59 +0200107/* Allocates a new SRVRQ for the given server with the name <fqdn>. It returns
108 * NULL if an error occurred. */
109struct dns_srvrq *new_dns_srvrq(struct server *srv, char *fqdn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200110{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200111 struct proxy *px = srv->proxy;
112 struct dns_srvrq *srvrq = NULL;
113 int fqdn_len, hostname_dn_len;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200114
Christopher Faulet67957bd2017-09-27 11:00:59 +0200115 fqdn_len = strlen(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200116 hostname_dn_len = dns_str_to_dn_label(fqdn, fqdn_len + 1, trash.area,
117 trash.size);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200118 if (hostname_dn_len == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100119 ha_alert("config : %s '%s', server '%s': failed to parse FQDN '%s'\n",
120 proxy_type_str(px), px->id, srv->id, fqdn);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200121 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200122 }
123
Christopher Faulet67957bd2017-09-27 11:00:59 +0200124 if ((srvrq = calloc(1, sizeof(*srvrq))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100125 ha_alert("config : %s '%s', server '%s': out of memory\n",
126 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200127 goto err;
128 }
129 srvrq->obj_type = OBJ_TYPE_SRVRQ;
130 srvrq->proxy = px;
131 srvrq->name = strdup(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200132 srvrq->hostname_dn = strdup(trash.area);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200133 srvrq->hostname_dn_len = hostname_dn_len;
134 if (!srvrq->name || !srvrq->hostname_dn) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100135 ha_alert("config : %s '%s', server '%s': out of memory\n",
136 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200137 goto err;
138 }
139 LIST_ADDQ(&dns_srvrq_list, &srvrq->list);
140 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200141
Christopher Faulet67957bd2017-09-27 11:00:59 +0200142 err:
143 if (srvrq) {
144 free(srvrq->name);
145 free(srvrq->hostname_dn);
146 free(srvrq);
147 }
148 return NULL;
149}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200150
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200151
Christopher Faulet67957bd2017-09-27 11:00:59 +0200152/* 2 bytes random generator to generate DNS query ID */
153static inline uint16_t dns_rnd16(void)
154{
Christopher Fauletb2812a62017-10-04 16:17:58 +0200155 if (!dns_query_id_seed)
156 dns_query_id_seed = now_ms;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200157 dns_query_id_seed ^= dns_query_id_seed << 13;
158 dns_query_id_seed ^= dns_query_id_seed >> 7;
159 dns_query_id_seed ^= dns_query_id_seed << 17;
160 return dns_query_id_seed;
161}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200162
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200163
Christopher Faulet67957bd2017-09-27 11:00:59 +0200164static inline int dns_resolution_timeout(struct dns_resolution *res)
165{
Baptiste Assmannf50e1ac2019-11-07 11:02:18 +0100166 return res->resolvers->timeout.resolve;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200167}
168
Christopher Faulet67957bd2017-09-27 11:00:59 +0200169/* Updates a resolvers' task timeout for next wake up and queue it */
170static void dns_update_resolvers_timeout(struct dns_resolvers *resolvers)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200171{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200172 struct dns_resolution *res;
173 int next;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200174
Christopher Faulet67957bd2017-09-27 11:00:59 +0200175 next = tick_add(now_ms, resolvers->timeout.resolve);
176 if (!LIST_ISEMPTY(&resolvers->resolutions.curr)) {
177 res = LIST_NEXT(&resolvers->resolutions.curr, struct dns_resolution *, list);
178 next = MIN(next, tick_add(res->last_query, resolvers->timeout.retry));
179 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200180
Christopher Faulet67957bd2017-09-27 11:00:59 +0200181 list_for_each_entry(res, &resolvers->resolutions.wait, list)
182 next = MIN(next, tick_add(res->last_resolution, dns_resolution_timeout(res)));
Baptiste Assmann325137d2015-04-13 23:40:55 +0200183
Christopher Faulet67957bd2017-09-27 11:00:59 +0200184 resolvers->t->expire = next;
185 task_queue(resolvers->t);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200186}
187
Christopher Faulet67957bd2017-09-27 11:00:59 +0200188/* Opens an UDP socket on the namesaver's IP/Port, if required. Returns 0 on
189 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200190 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200191static int dns_connect_namesaver(struct dns_nameserver *ns)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200192{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200193 struct dgram_conn *dgram = ns->dgram;
194 int fd;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200195
Christopher Faulet67957bd2017-09-27 11:00:59 +0200196 /* Already connected */
197 if (dgram->t.sock.fd != -1)
198 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200199
Christopher Faulet67957bd2017-09-27 11:00:59 +0200200 /* Create an UDP socket and connect it on the nameserver's IP/Port */
201 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
202 send_log(NULL, LOG_WARNING,
203 "DNS : resolvers '%s': can't create socket for nameserver '%s'.\n",
204 ns->resolvers->id, ns->id);
205 return -1;
206 }
207 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
208 send_log(NULL, LOG_WARNING,
209 "DNS : resolvers '%s': can't connect socket for nameserver '%s'.\n",
210 ns->resolvers->id, ns->id);
211 close(fd);
212 return -1;
213 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200214
Christopher Faulet67957bd2017-09-27 11:00:59 +0200215 /* Make the socket non blocking */
216 fcntl(fd, F_SETFL, O_NONBLOCK);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200217
Christopher Faulet67957bd2017-09-27 11:00:59 +0200218 /* Add the fd in the fd list and update its parameters */
219 dgram->t.sock.fd = fd;
Willy Tarreaua9786b62018-01-25 07:22:13 +0100220 fd_insert(fd, dgram, dgram_fd_handler, MAX_THREADS_MASK);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200221 fd_want_recv(fd);
222 return 0;
223}
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200224
Christopher Faulet67957bd2017-09-27 11:00:59 +0200225/* Forges a DNS query. It needs the following information from the caller:
226 * - <query_id> : the DNS query id corresponding to this query
227 * - <query_type> : DNS_RTYPE_* request DNS record type (A, AAAA, ANY...)
228 * - <hostname_dn> : hostname in domain name format
229 * - <hostname_dn_len> : length of <hostname_dn>
230 *
231 * To store the query, the caller must pass a buffer <buf> and its size
232 * <bufsize>. It returns the number of written bytes in success, -1 if <buf> is
233 * too short.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200234 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200235static int dns_build_query(int query_id, int query_type, unsigned int accepted_payload_size,
236 char *hostname_dn, int hostname_dn_len, char *buf, int bufsize)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200237{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200238 struct dns_header dns_hdr;
239 struct dns_question qinfo;
240 struct dns_additional_record edns;
241 char *p = buf;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200242
Christopher Faulet67957bd2017-09-27 11:00:59 +0200243 if (sizeof(dns_hdr) + sizeof(qinfo) + sizeof(edns) + hostname_dn_len >= bufsize)
244 return -1;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200245
Christopher Faulet67957bd2017-09-27 11:00:59 +0200246 memset(buf, 0, bufsize);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200247
Christopher Faulet67957bd2017-09-27 11:00:59 +0200248 /* Set dns query headers */
249 dns_hdr.id = (unsigned short) htons(query_id);
250 dns_hdr.flags = htons(0x0100); /* qr=0, opcode=0, aa=0, tc=0, rd=1, ra=0, z=0, rcode=0 */
251 dns_hdr.qdcount = htons(1); /* 1 question */
252 dns_hdr.ancount = 0;
253 dns_hdr.nscount = 0;
254 dns_hdr.arcount = htons(1);
255 memcpy(p, &dns_hdr, sizeof(dns_hdr));
256 p += sizeof(dns_hdr);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200257
Christopher Faulet67957bd2017-09-27 11:00:59 +0200258 /* Set up query hostname */
259 memcpy(p, hostname_dn, hostname_dn_len);
260 p += hostname_dn_len;
261 *p++ = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200262
Christopher Faulet67957bd2017-09-27 11:00:59 +0200263 /* Set up query info (type and class) */
264 qinfo.qtype = htons(query_type);
265 qinfo.qclass = htons(DNS_RCLASS_IN);
266 memcpy(p, &qinfo, sizeof(qinfo));
267 p += sizeof(qinfo);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200268
Christopher Faulet67957bd2017-09-27 11:00:59 +0200269 /* Set the DNS extension */
270 edns.name = 0;
271 edns.type = htons(DNS_RTYPE_OPT);
272 edns.udp_payload_size = htons(accepted_payload_size);
273 edns.extension = 0;
274 edns.data_length = 0;
275 memcpy(p, &edns, sizeof(edns));
276 p += sizeof(edns);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200277
Christopher Faulet67957bd2017-09-27 11:00:59 +0200278 return (p - buf);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200279}
280
Christopher Faulet67957bd2017-09-27 11:00:59 +0200281/* Sends a DNS query to resolvers associated to a resolution. It returns 0 on
282 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200283 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200284static int dns_send_query(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200285{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200286 struct dns_resolvers *resolvers = resolution->resolvers;
287 struct dns_nameserver *ns;
Willy Tarreau0eae6322019-12-20 11:18:54 +0100288 int len;
289
290 /* Update resolution */
291 resolution->nb_queries = 0;
292 resolution->nb_responses = 0;
293 resolution->last_query = now_ms;
294
295 len = dns_build_query(resolution->query_id, resolution->query_type,
296 resolvers->accepted_payload_size,
297 resolution->hostname_dn, resolution->hostname_dn_len,
298 trash.area, trash.size);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200299
Christopher Faulet67957bd2017-09-27 11:00:59 +0200300 list_for_each_entry(ns, &resolvers->nameservers, list) {
301 int fd = ns->dgram->t.sock.fd;
Willy Tarreau0eae6322019-12-20 11:18:54 +0100302 int ret;
303
Christopher Faulet67957bd2017-09-27 11:00:59 +0200304 if (fd == -1) {
305 if (dns_connect_namesaver(ns) == -1)
306 continue;
307 fd = ns->dgram->t.sock.fd;
308 resolvers->nb_nameservers++;
309 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200310
Willy Tarreau0eae6322019-12-20 11:18:54 +0100311 if (len < 0)
312 goto snd_error;
313
314 ret = send(fd, trash.area, len, 0);
315 if (ret == len) {
316 ns->counters.sent++;
317 resolution->nb_queries++;
318 continue;
319 }
320
321 if (ret == -1 && errno == EAGAIN) {
322 /* retry once the socket is ready */
323 fd_cant_send(fd);
324 continue;
325 }
326
327 snd_error:
328 ns->counters.snd_error++;
329 resolution->nb_queries++;
330 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200331
Christopher Faulet67957bd2017-09-27 11:00:59 +0200332 /* Push the resolution at the end of the active list */
333 LIST_DEL(&resolution->list);
334 LIST_ADDQ(&resolvers->resolutions.curr, &resolution->list);
335 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200336}
337
Christopher Faulet67957bd2017-09-27 11:00:59 +0200338/* Prepares and sends a DNS resolution. It returns 1 if the query was sent, 0 if
339 * skipped and -1 if an error occurred.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200340 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200341static int
342dns_run_resolution(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200343{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200344 struct dns_resolvers *resolvers = resolution->resolvers;
345 int query_id, i;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200346
Christopher Faulet67957bd2017-09-27 11:00:59 +0200347 /* Avoid sending requests for resolutions that don't yet have an
348 * hostname, ie resolutions linked to servers that do not yet have an
349 * fqdn */
350 if (!resolution->hostname_dn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200351 return 0;
352
Christopher Faulet67957bd2017-09-27 11:00:59 +0200353 /* Check if a resolution has already been started for this server return
354 * directly to avoid resolution pill up. */
355 if (resolution->step != RSLV_STEP_NONE)
356 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200357
Christopher Faulet67957bd2017-09-27 11:00:59 +0200358 /* Generates a new query id. We try at most 100 times to find a free
359 * query id */
360 for (i = 0; i < 100; ++i) {
361 query_id = dns_rnd16();
362 if (!eb32_lookup(&resolvers->query_ids, query_id))
Olivier Houchard8da5f982017-08-04 18:35:36 +0200363 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200364 query_id = -1;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200365 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200366 if (query_id == -1) {
367 send_log(NULL, LOG_NOTICE,
368 "could not generate a query id for %s, in resolvers %s.\n",
369 resolution->hostname_dn, resolvers->id);
370 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200371 }
372
Christopher Faulet67957bd2017-09-27 11:00:59 +0200373 /* Update resolution parameters */
374 resolution->query_id = query_id;
375 resolution->qid.key = query_id;
376 resolution->step = RSLV_STEP_RUNNING;
377 resolution->query_type = resolution->prefered_query_type;
378 resolution->try = resolvers->resolve_retries;
379 eb32_insert(&resolvers->query_ids, &resolution->qid);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200380
Christopher Faulet67957bd2017-09-27 11:00:59 +0200381 /* Send the DNS query */
382 resolution->try -= 1;
383 dns_send_query(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200384 return 1;
385}
386
Christopher Faulet67957bd2017-09-27 11:00:59 +0200387/* Performs a name resolution for the requester <req> */
388void dns_trigger_resolution(struct dns_requester *req)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200389{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200390 struct dns_resolvers *resolvers;
391 struct dns_resolution *res;
392 int exp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200393
Christopher Faulet67957bd2017-09-27 11:00:59 +0200394 if (!req || !req->resolution)
395 return;
396 res = req->resolution;
397 resolvers = res->resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200398
Christopher Faulet67957bd2017-09-27 11:00:59 +0200399 /* The resolution must not be triggered yet. Use the cached response, if
400 * valid */
401 exp = tick_add(res->last_resolution, resolvers->hold.valid);
Olivier Houchardf3d9e602018-05-22 18:40:07 +0200402 if (resolvers->t && (res->status != RSLV_STATUS_VALID ||
403 !tick_isset(res->last_resolution) || tick_is_expired(exp, now_ms)))
404 task_wakeup(resolvers->t, TASK_WOKEN_OTHER);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200405}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200406
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200407
Christopher Faulet67957bd2017-09-27 11:00:59 +0200408/* Resets some resolution parameters to initial values and also delete the query
409 * ID from the resolver's tree.
410 */
411static void dns_reset_resolution(struct dns_resolution *resolution)
412{
413 /* update resolution status */
414 resolution->step = RSLV_STEP_NONE;
415 resolution->try = 0;
416 resolution->last_resolution = now_ms;
417 resolution->nb_queries = 0;
418 resolution->nb_responses = 0;
419 resolution->query_type = resolution->prefered_query_type;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200420
Christopher Faulet67957bd2017-09-27 11:00:59 +0200421 /* clean up query id */
422 eb32_delete(&resolution->qid);
423 resolution->query_id = 0;
424 resolution->qid.key = 0;
425}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200426
Christopher Faulet67957bd2017-09-27 11:00:59 +0200427/* Returns the query id contained in a DNS response */
428static inline unsigned short dns_response_get_query_id(unsigned char *resp)
429{
430 return resp[0] * 256 + resp[1];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200431}
432
Christopher Faulet67957bd2017-09-27 11:00:59 +0200433
434/* Analyses, re-builds and copies the name <name> from the DNS response packet
435 * <buffer>. <name> must point to the 'data_len' information or pointer 'c0'
436 * for compressed data. The result is copied into <dest>, ensuring we don't
437 * overflow using <dest_len> Returns the number of bytes the caller can move
438 * forward. If 0 it means an error occurred while parsing the name. <offset> is
439 * the number of bytes the caller could move forward.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200440 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200441int dns_read_name(unsigned char *buffer, unsigned char *bufend,
442 unsigned char *name, char *destination, int dest_len,
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100443 int *offset, unsigned int depth)
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200444{
445 int nb_bytes = 0, n = 0;
446 int label_len;
447 unsigned char *reader = name;
448 char *dest = destination;
449
450 while (1) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100451 if (reader >= bufend)
452 goto err;
453
Christopher Faulet67957bd2017-09-27 11:00:59 +0200454 /* Name compression is in use */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200455 if ((*reader & 0xc0) == 0xc0) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100456 if (reader + 1 >= bufend)
457 goto err;
458
Christopher Faulet67957bd2017-09-27 11:00:59 +0200459 /* Must point BEFORE current position */
460 if ((buffer + reader[1]) > reader)
461 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200462
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100463 if (depth++ > 100)
464 goto err;
465
Nikhil Agrawal2fa66c32018-12-20 10:50:59 +0530466 n = dns_read_name(buffer, bufend, buffer + (*reader & 0x3f)*256 + reader[1],
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100467 dest, dest_len - nb_bytes, offset, depth);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200468 if (n == 0)
Christopher Faulet67957bd2017-09-27 11:00:59 +0200469 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200470
Christopher Faulet67957bd2017-09-27 11:00:59 +0200471 dest += n;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200472 nb_bytes += n;
473 goto out;
474 }
475
476 label_len = *reader;
477 if (label_len == 0)
478 goto out;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200479
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200480 /* Check if:
481 * - we won't read outside the buffer
482 * - there is enough place in the destination
483 */
484 if ((reader + label_len >= bufend) || (nb_bytes + label_len >= dest_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +0200485 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200486
487 /* +1 to take label len + label string */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200488 label_len++;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200489
490 memcpy(dest, reader, label_len);
491
Christopher Faulet67957bd2017-09-27 11:00:59 +0200492 dest += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200493 nb_bytes += label_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200494 reader += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200495 }
496
Christopher Faulet67957bd2017-09-27 11:00:59 +0200497 out:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200498 /* offset computation:
499 * parse from <name> until finding either NULL or a pointer "c0xx"
500 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200501 reader = name;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200502 *offset = 0;
503 while (reader < bufend) {
504 if ((reader[0] & 0xc0) == 0xc0) {
505 *offset += 2;
506 break;
507 }
508 else if (*reader == 0) {
509 *offset += 1;
510 break;
511 }
512 *offset += 1;
513 ++reader;
514 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200515 return nb_bytes;
516
Christopher Faulet67957bd2017-09-27 11:00:59 +0200517 err:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200518 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200519}
520
Christopher Faulet67957bd2017-09-27 11:00:59 +0200521/* Checks for any obsolete record, also identify any SRV request, and try to
522 * find a corresponding server.
523*/
524static void dns_check_dns_response(struct dns_resolution *res)
525{
526 struct dns_resolvers *resolvers = res->resolvers;
527 struct dns_requester *req, *reqback;
528 struct dns_answer_item *item, *itemback;
529 struct server *srv;
530 struct dns_srvrq *srvrq;
531
Baptiste Assmann13a92322019-06-07 09:40:55 +0200532 /* clean up obsolete Additional records */
533 list_for_each_entry_safe(item, itemback, &res->response.ar_list, list) {
534 if ((item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
535 LIST_DEL(&item->list);
536 pool_free(dns_answer_item_pool, item);
537 }
538 }
539
Christopher Faulet67957bd2017-09-27 11:00:59 +0200540 list_for_each_entry_safe(item, itemback, &res->response.answer_list, list) {
541
542 /* Remove obsolete items */
543 if ((item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
544 if (item->type != DNS_RTYPE_SRV)
545 goto rm_obselete_item;
546
547 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
548 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
549 continue;
550
551 /* Remove any associated server */
552 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100553 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200554 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
555 item->data_len == srv->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +0200556 !dns_hostname_cmp(srv->hostname_dn, item->target, item->data_len)) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200557 snr_update_srv_status(srv, 1);
558 free(srv->hostname);
559 free(srv->hostname_dn);
560 srv->hostname = NULL;
561 srv->hostname_dn = NULL;
562 srv->hostname_dn_len = 0;
563 dns_unlink_resolution(srv->dns_requester);
564 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100565 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200566 }
567 }
568
569 rm_obselete_item:
570 LIST_DEL(&item->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +0100571 pool_free(dns_answer_item_pool, item);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200572 continue;
573 }
574
575 if (item->type != DNS_RTYPE_SRV)
576 continue;
577
578 /* Now process SRV records */
579 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
580 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
581 continue;
582
583 /* Check if a server already uses that hostname */
584 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100585 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200586 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
587 item->data_len == srv->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +0200588 !dns_hostname_cmp(srv->hostname_dn, item->target, item->data_len) &&
Daniel Corbettf8716912019-11-17 09:48:56 -0500589 !srv->dns_opts.ignore_weight) {
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100590 int ha_weight;
591
Baptiste Assmann25e6fc22019-10-21 15:13:48 +0200592 /* DNS weight range if from 0 to 65535
593 * HAProxy weight is from 0 to 256
594 * The rule below ensures that weight 0 is well respected
595 * while allowing a "mapping" from DNS weight into HAProxy's one.
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100596 */
Baptiste Assmann25e6fc22019-10-21 15:13:48 +0200597 ha_weight = (item->weight + 255) / 256;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100598 if (srv->uweight != ha_weight) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200599 char weight[9];
600
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100601 snprintf(weight, sizeof(weight), "%d", ha_weight);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200602 server_parse_weight_change_request(srv, weight);
603 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100604 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200605 break;
606 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100607 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200608 }
609 if (srv)
610 continue;
611
612 /* If not, try to find a server with undefined hostname */
613 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100614 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200615 if (srv->srvrq == srvrq && !srv->hostname_dn)
616 break;
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100617 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200618 }
619 /* And update this server, if found */
620 if (srv) {
621 const char *msg = NULL;
622 char weight[9];
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100623 int ha_weight;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200624 char hostname[DNS_MAX_NAME_SIZE];
625
626 if (dns_dn_label_to_str(item->target, item->data_len+1,
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100627 hostname, DNS_MAX_NAME_SIZE) == -1) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100628 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200629 continue;
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100630 }
Baptiste Assmann13a92322019-06-07 09:40:55 +0200631
632 /* Check if an Additional Record is associated to this SRV record.
633 * Perform some sanity checks too to ensure the record can be used.
634 * If all fine, we simply pick up the IP address found and associate
635 * it to the server.
636 */
637 if ((item->ar_item != NULL) &&
638 (item->ar_item->type == DNS_RTYPE_A || item->ar_item->type == DNS_RTYPE_AAAA))
639 {
640
641 switch (item->ar_item->type) {
642 case DNS_RTYPE_A:
643 update_server_addr(srv, &(((struct sockaddr_in*)&item->ar_item->address)->sin_addr), AF_INET, "DNS additional recrd");
644 break;
645 case DNS_RTYPE_AAAA:
646 update_server_addr(srv, &(((struct sockaddr_in6*)&item->ar_item->address)->sin6_addr), AF_INET6, "DNS additional recrd");
647 break;
648 }
649
650 srv->flags |= SRV_F_NO_RESOLUTION;
651 }
652
Olivier Houchardd16bfe62017-10-31 15:21:19 +0100653 msg = update_server_fqdn(srv, hostname, "SRV record", 1);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200654 if (msg)
655 send_log(srv->proxy, LOG_NOTICE, "%s", msg);
656
657 srv->svc_port = item->port;
658 srv->flags &= ~SRV_F_MAPPORTS;
659 if ((srv->check.state & CHK_ST_CONFIGURED) &&
660 !(srv->flags & SRV_F_CHECKPORT))
661 srv->check.port = item->port;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100662
Daniel Corbettf8716912019-11-17 09:48:56 -0500663 if (!srv->dns_opts.ignore_weight) {
664 /* DNS weight range if from 0 to 65535
665 * HAProxy weight is from 0 to 256
666 * The rule below ensures that weight 0 is well respected
667 * while allowing a "mapping" from DNS weight into HAProxy's one.
668 */
669 ha_weight = (item->weight + 255) / 256;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100670
Daniel Corbettf8716912019-11-17 09:48:56 -0500671 snprintf(weight, sizeof(weight), "%d", ha_weight);
672 server_parse_weight_change_request(srv, weight);
673 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100674 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200675 }
676 }
677 }
678}
679
680/* Validates that the buffer DNS response provided in <resp> and finishing
681 * before <bufend> is valid from a DNS protocol point of view.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200682 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200683 * The result is stored in <resolution>' response, buf_response,
684 * response_query_records and response_answer_records members.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200685 *
686 * This function returns one of the DNS_RESP_* code to indicate the type of
687 * error found.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200688 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200689static int dns_validate_dns_response(unsigned char *resp, unsigned char *bufend,
690 struct dns_resolution *resolution, int max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200691{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200692 unsigned char *reader;
693 char *previous_dname, tmpname[DNS_MAX_NAME_SIZE];
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200694 int len, flags, offset;
695 int dns_query_record_id;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200696 int nb_saved_records;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200697 struct dns_query_item *dns_query;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200698 struct dns_answer_item *dns_answer_record, *tmp_record;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200699 struct dns_response_packet *dns_p;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200700 int i, found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200701
Christopher Faulet67957bd2017-09-27 11:00:59 +0200702 reader = resp;
703 len = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200704 previous_dname = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200705 dns_query = NULL;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200706
Christopher Faulet67957bd2017-09-27 11:00:59 +0200707 /* Initialization of response buffer and structure */
Baptiste Assmann729c9012017-05-22 15:13:10 +0200708 dns_p = &resolution->response;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200709
710 /* query id */
711 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200712 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200713 dns_p->header.id = reader[0] * 256 + reader[1];
714 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200715
Christopher Faulet67957bd2017-09-27 11:00:59 +0200716 /* Flags and rcode are stored over 2 bytes
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200717 * First byte contains:
718 * - response flag (1 bit)
719 * - opcode (4 bits)
720 * - authoritative (1 bit)
721 * - truncated (1 bit)
722 * - recursion desired (1 bit)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200723 */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200724 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200725 return DNS_RESP_INVALID;
726
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200727 flags = reader[0] * 256 + reader[1];
728
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200729 if ((flags & DNS_FLAG_REPLYCODE) != DNS_RCODE_NO_ERROR) {
730 if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_NX_DOMAIN)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200731 return DNS_RESP_NX_DOMAIN;
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200732 else if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_REFUSED)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200733 return DNS_RESP_REFUSED;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200734 return DNS_RESP_ERROR;
735 }
736
Christopher Faulet67957bd2017-09-27 11:00:59 +0200737 /* Move forward 2 bytes for flags */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200738 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200739
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200740 /* 2 bytes for question count */
741 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200742 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200743 dns_p->header.qdcount = reader[0] * 256 + reader[1];
Christopher Faulet67957bd2017-09-27 11:00:59 +0200744 /* (for now) we send one query only, so we expect only one in the
745 * response too */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200746 if (dns_p->header.qdcount != 1)
747 return DNS_RESP_QUERY_COUNT_ERROR;
748 if (dns_p->header.qdcount > DNS_MAX_QUERY_RECORDS)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200749 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200750 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200751
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200752 /* 2 bytes for answer count */
753 if (reader + 2 >= bufend)
754 return DNS_RESP_INVALID;
755 dns_p->header.ancount = reader[0] * 256 + reader[1];
756 if (dns_p->header.ancount == 0)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200757 return DNS_RESP_ANCOUNT_ZERO;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200758 /* Check if too many records are announced */
Baptiste Assmann9d8dbbc2017-08-18 23:35:08 +0200759 if (dns_p->header.ancount > max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200760 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200761 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200762
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200763 /* 2 bytes authority count */
764 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200765 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200766 dns_p->header.nscount = reader[0] * 256 + reader[1];
767 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200768
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200769 /* 2 bytes additional count */
770 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200771 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200772 dns_p->header.arcount = reader[0] * 256 + reader[1];
773 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200774
Christopher Faulet67957bd2017-09-27 11:00:59 +0200775 /* Parsing dns queries */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200776 LIST_INIT(&dns_p->query_list);
777 for (dns_query_record_id = 0; dns_query_record_id < dns_p->header.qdcount; dns_query_record_id++) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200778 /* Use next pre-allocated dns_query_item after ensuring there is
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200779 * still one available.
Christopher Faulet67957bd2017-09-27 11:00:59 +0200780 * It's then added to our packet query list. */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200781 if (dns_query_record_id > DNS_MAX_QUERY_RECORDS)
782 return DNS_RESP_INVALID;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200783 dns_query = &resolution->response_query_records[dns_query_record_id];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200784 LIST_ADDQ(&dns_p->query_list, &dns_query->list);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200785
Christopher Faulet67957bd2017-09-27 11:00:59 +0200786 /* Name is a NULL terminated string in our case, since we have
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200787 * one query per response and the first one can't be compressed
Christopher Faulet67957bd2017-09-27 11:00:59 +0200788 * (using the 0x0c format) */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200789 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100790 len = dns_read_name(resp, bufend, reader, dns_query->name, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200791
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200792 if (len == 0)
793 return DNS_RESP_INVALID;
794
795 reader += offset;
796 previous_dname = dns_query->name;
797
798 /* move forward 2 bytes for question type */
799 if (reader + 2 >= bufend)
800 return DNS_RESP_INVALID;
801 dns_query->type = reader[0] * 256 + reader[1];
802 reader += 2;
803
804 /* move forward 2 bytes for question class */
805 if (reader + 2 >= bufend)
806 return DNS_RESP_INVALID;
807 dns_query->class = reader[0] * 256 + reader[1];
808 reader += 2;
809 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200810
Baptiste Assmann251abb92017-08-11 09:58:27 +0200811 /* TRUNCATED flag must be checked after we could read the query type
Christopher Faulet67957bd2017-09-27 11:00:59 +0200812 * because a TRUNCATED SRV query type response can still be exploited */
Baptiste Assmann251abb92017-08-11 09:58:27 +0200813 if (dns_query->type != DNS_RTYPE_SRV && flags & DNS_FLAG_TRUNCATED)
814 return DNS_RESP_TRUNCATED;
815
Baptiste Assmann325137d2015-04-13 23:40:55 +0200816 /* now parsing response records */
Baptiste Assmann69fce672017-05-04 08:37:45 +0200817 nb_saved_records = 0;
Olivier Houchard8da5f982017-08-04 18:35:36 +0200818 for (i = 0; i < dns_p->header.ancount; i++) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200819 if (reader >= bufend)
820 return DNS_RESP_INVALID;
821
Willy Tarreaubafbe012017-11-24 17:34:44 +0100822 dns_answer_record = pool_alloc(dns_answer_item_pool);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200823 if (dns_answer_record == NULL)
824 return (DNS_RESP_INVALID);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200825
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200826 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100827 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200828
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200829 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100830 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200831 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200832 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200833
Christopher Faulet67957bd2017-09-27 11:00:59 +0200834 /* Check if the current record dname is valid. previous_dname
835 * points either to queried dname or last CNAME target */
Olivier Houchardb17b8842020-04-01 18:30:27 +0200836 if (dns_query->type != DNS_RTYPE_SRV && dns_hostname_cmp(previous_dname, tmpname, len) != 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100837 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200838 if (i == 0) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200839 /* First record, means a mismatch issue between
840 * queried dname and dname found in the first
841 * record */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200842 return DNS_RESP_INVALID;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200843 }
844 else {
845 /* If not the first record, this means we have a
846 * CNAME resolution error */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200847 return DNS_RESP_CNAME_ERROR;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200848 }
849
Baptiste Assmann325137d2015-04-13 23:40:55 +0200850 }
851
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200852 memcpy(dns_answer_record->name, tmpname, len);
853 dns_answer_record->name[len] = 0;
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200854
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200855 reader += offset;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200856 if (reader >= bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100857 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200858 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200859 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200860
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200861 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200862 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100863 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200864 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200865 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200866 dns_answer_record->type = reader[0] * 256 + reader[1];
867 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200868
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200869 /* 2 bytes for class (2) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200870 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100871 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200872 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200873 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200874 dns_answer_record->class = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200875 reader += 2;
876
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200877 /* 4 bytes for ttl (4) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200878 if (reader + 4 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100879 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200880 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200881 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200882 dns_answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
883 + reader[2] * 256 + reader[3];
884 reader += 4;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200885
Christopher Faulet67957bd2017-09-27 11:00:59 +0200886 /* Now reading data len */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200887 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100888 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200889 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200890 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200891 dns_answer_record->data_len = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200892
Christopher Faulet67957bd2017-09-27 11:00:59 +0200893 /* Move forward 2 bytes for data len */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200894 reader += 2;
895
Jérôme Magnin8d4e7dc2018-12-20 16:47:31 +0100896 if (reader + dns_answer_record->data_len > bufend) {
Remi Gacogneefbbdf72018-12-05 17:56:29 +0100897 pool_free(dns_answer_item_pool, dns_answer_record);
898 return DNS_RESP_INVALID;
899 }
900
Christopher Faulet67957bd2017-09-27 11:00:59 +0200901 /* Analyzing record content */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200902 switch (dns_answer_record->type) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200903 case DNS_RTYPE_A:
904 /* ipv4 is stored on 4 bytes */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200905 if (dns_answer_record->data_len != 4) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100906 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200907 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200908 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200909 dns_answer_record->address.sa_family = AF_INET;
910 memcpy(&(((struct sockaddr_in *)&dns_answer_record->address)->sin_addr),
911 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200912 break;
913
914 case DNS_RTYPE_CNAME:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200915 /* Check if this is the last record and update the caller about the status:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200916 * no IP could be found and last record was a CNAME. Could be triggered
917 * by a wrong query type
918 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200919 * + 1 because dns_answer_record_id starts at 0
920 * while number of answers is an integer and
921 * starts at 1.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200922 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200923 if (i + 1 == dns_p->header.ancount) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100924 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200925 return DNS_RESP_CNAME_ERROR;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200926 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200927
928 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100929 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200930 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100931 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200932 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200933 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200934
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200935 memcpy(dns_answer_record->target, tmpname, len);
936 dns_answer_record->target[len] = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200937 previous_dname = dns_answer_record->target;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200938 break;
939
Olivier Houchard8da5f982017-08-04 18:35:36 +0200940
941 case DNS_RTYPE_SRV:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200942 /* Answer must contain :
Olivier Houchard8da5f982017-08-04 18:35:36 +0200943 * - 2 bytes for the priority
944 * - 2 bytes for the weight
945 * - 2 bytes for the port
946 * - the target hostname
947 */
948 if (dns_answer_record->data_len <= 6) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100949 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200950 return DNS_RESP_INVALID;
951 }
Willy Tarreaud5370e12017-09-19 14:59:52 +0200952 dns_answer_record->priority = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200953 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200954 dns_answer_record->weight = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200955 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200956 dns_answer_record->port = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200957 reader += sizeof(uint16_t);
958 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100959 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200960 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100961 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200962 return DNS_RESP_INVALID;
963 }
Olivier Houchard8da5f982017-08-04 18:35:36 +0200964 dns_answer_record->data_len = len;
965 memcpy(dns_answer_record->target, tmpname, len);
966 dns_answer_record->target[len] = 0;
967 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200968
Baptiste Assmann325137d2015-04-13 23:40:55 +0200969 case DNS_RTYPE_AAAA:
970 /* ipv6 is stored on 16 bytes */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200971 if (dns_answer_record->data_len != 16) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100972 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200973 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200974 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200975 dns_answer_record->address.sa_family = AF_INET6;
976 memcpy(&(((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr),
977 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200978 break;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200979
Baptiste Assmann325137d2015-04-13 23:40:55 +0200980 } /* switch (record type) */
981
Christopher Faulet67957bd2017-09-27 11:00:59 +0200982 /* Increment the counter for number of records saved into our
983 * local response */
984 nb_saved_records++;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200985
Christopher Faulet67957bd2017-09-27 11:00:59 +0200986 /* Move forward dns_answer_record->data_len for analyzing next
987 * record in the response */
988 reader += ((dns_answer_record->type == DNS_RTYPE_SRV)
989 ? offset
990 : dns_answer_record->data_len);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200991
992 /* Lookup to see if we already had this entry */
Olivier Houchard8da5f982017-08-04 18:35:36 +0200993 found = 0;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200994 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
995 if (tmp_record->type != dns_answer_record->type)
996 continue;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200997
998 switch(tmp_record->type) {
999 case DNS_RTYPE_A:
1000 if (!memcmp(&((struct sockaddr_in *)&dns_answer_record->address)->sin_addr,
1001 &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
1002 sizeof(in_addr_t)))
1003 found = 1;
1004 break;
1005
1006 case DNS_RTYPE_AAAA:
1007 if (!memcmp(&((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr,
1008 &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
1009 sizeof(struct in6_addr)))
1010 found = 1;
1011 break;
1012
Olivier Houchard8da5f982017-08-04 18:35:36 +02001013 case DNS_RTYPE_SRV:
1014 if (dns_answer_record->data_len == tmp_record->data_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001015 !dns_hostname_cmp(dns_answer_record->target, tmp_record->target, dns_answer_record->data_len) &&
Olivier Houchard8da5f982017-08-04 18:35:36 +02001016 dns_answer_record->port == tmp_record->port) {
1017 tmp_record->weight = dns_answer_record->weight;
1018 found = 1;
1019 }
1020 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001021
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001022 default:
1023 break;
1024 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001025
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001026 if (found == 1)
1027 break;
1028 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001029
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001030 if (found == 1) {
1031 tmp_record->last_seen = now.tv_sec;
Willy Tarreaubafbe012017-11-24 17:34:44 +01001032 pool_free(dns_answer_item_pool, dns_answer_record);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001033 }
1034 else {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001035 dns_answer_record->last_seen = now.tv_sec;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001036 dns_answer_record->ar_item = NULL;
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001037 LIST_ADDQ(&dns_p->answer_list, &dns_answer_record->list);
1038 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001039 } /* for i 0 to ancount */
1040
Christopher Faulet67957bd2017-09-27 11:00:59 +02001041 /* Save the number of records we really own */
Baptiste Assmann69fce672017-05-04 08:37:45 +02001042 dns_p->header.ancount = nb_saved_records;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001043
Baptiste Assmann37950c82020-02-19 01:08:51 +01001044 /* now parsing additional records for SRV queries only */
1045 if (dns_query->type != DNS_RTYPE_SRV)
1046 goto skip_parsing_additional_records;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001047 nb_saved_records = 0;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001048 for (i = 0; i < dns_p->header.arcount; i++) {
1049 if (reader >= bufend)
1050 return DNS_RESP_INVALID;
1051
1052 dns_answer_record = pool_alloc(dns_answer_item_pool);
1053 if (dns_answer_record == NULL)
1054 return (DNS_RESP_INVALID);
1055
1056 offset = 0;
1057 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
1058
1059 if (len == 0) {
1060 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann37950c82020-02-19 01:08:51 +01001061 continue;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001062 }
1063
1064 memcpy(dns_answer_record->name, tmpname, len);
1065 dns_answer_record->name[len] = 0;
1066
1067 reader += offset;
1068 if (reader >= bufend) {
1069 pool_free(dns_answer_item_pool, dns_answer_record);
1070 return DNS_RESP_INVALID;
1071 }
1072
1073 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
1074 if (reader + 2 > bufend) {
1075 pool_free(dns_answer_item_pool, dns_answer_record);
1076 return DNS_RESP_INVALID;
1077 }
1078 dns_answer_record->type = reader[0] * 256 + reader[1];
1079 reader += 2;
1080
1081 /* 2 bytes for class (2) */
1082 if (reader + 2 > bufend) {
1083 pool_free(dns_answer_item_pool, dns_answer_record);
1084 return DNS_RESP_INVALID;
1085 }
1086 dns_answer_record->class = reader[0] * 256 + reader[1];
1087 reader += 2;
1088
1089 /* 4 bytes for ttl (4) */
1090 if (reader + 4 > bufend) {
1091 pool_free(dns_answer_item_pool, dns_answer_record);
1092 return DNS_RESP_INVALID;
1093 }
1094 dns_answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
1095 + reader[2] * 256 + reader[3];
1096 reader += 4;
1097
1098 /* Now reading data len */
1099 if (reader + 2 > bufend) {
1100 pool_free(dns_answer_item_pool, dns_answer_record);
1101 return DNS_RESP_INVALID;
1102 }
1103 dns_answer_record->data_len = reader[0] * 256 + reader[1];
1104
1105 /* Move forward 2 bytes for data len */
1106 reader += 2;
1107
1108 if (reader + dns_answer_record->data_len > bufend) {
1109 pool_free(dns_answer_item_pool, dns_answer_record);
1110 return DNS_RESP_INVALID;
1111 }
1112
1113 /* Analyzing record content */
1114 switch (dns_answer_record->type) {
1115 case DNS_RTYPE_A:
1116 /* ipv4 is stored on 4 bytes */
1117 if (dns_answer_record->data_len != 4) {
1118 pool_free(dns_answer_item_pool, dns_answer_record);
1119 return DNS_RESP_INVALID;
1120 }
1121 dns_answer_record->address.sa_family = AF_INET;
1122 memcpy(&(((struct sockaddr_in *)&dns_answer_record->address)->sin_addr),
1123 reader, dns_answer_record->data_len);
1124 break;
1125
1126 case DNS_RTYPE_AAAA:
1127 /* ipv6 is stored on 16 bytes */
1128 if (dns_answer_record->data_len != 16) {
1129 pool_free(dns_answer_item_pool, dns_answer_record);
1130 return DNS_RESP_INVALID;
1131 }
1132 dns_answer_record->address.sa_family = AF_INET6;
1133 memcpy(&(((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr),
1134 reader, dns_answer_record->data_len);
1135 break;
1136
1137 default:
1138 pool_free(dns_answer_item_pool, dns_answer_record);
1139 continue;
1140
1141 } /* switch (record type) */
1142
1143 /* Increment the counter for number of records saved into our
1144 * local response */
1145 nb_saved_records++;
1146
1147 /* Move forward dns_answer_record->data_len for analyzing next
1148 * record in the response */
1149 reader += ((dns_answer_record->type == DNS_RTYPE_SRV)
1150 ? offset
1151 : dns_answer_record->data_len);
1152
1153 /* Lookup to see if we already had this entry */
1154 found = 0;
1155 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
1156 if (tmp_record->type != dns_answer_record->type)
1157 continue;
1158
1159 switch(tmp_record->type) {
1160 case DNS_RTYPE_A:
1161 if (!memcmp(&((struct sockaddr_in *)&dns_answer_record->address)->sin_addr,
1162 &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
1163 sizeof(in_addr_t)))
1164 found = 1;
1165 break;
1166
1167 case DNS_RTYPE_AAAA:
1168 if (!memcmp(&((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr,
1169 &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
1170 sizeof(struct in6_addr)))
1171 found = 1;
1172 break;
1173
1174 default:
1175 break;
1176 }
1177
1178 if (found == 1)
1179 break;
1180 }
1181
1182 if (found == 1) {
1183 tmp_record->last_seen = now.tv_sec;
1184 pool_free(dns_answer_item_pool, dns_answer_record);
1185 }
1186 else {
1187 dns_answer_record->last_seen = now.tv_sec;
1188 dns_answer_record->ar_item = NULL;
1189
1190 // looking for the SRV record in the response list linked to this additional record
1191 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
1192 if ( !(
1193 (tmp_record->type == DNS_RTYPE_SRV) &&
1194 (tmp_record->ar_item == NULL) &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001195 (dns_hostname_cmp(tmp_record->target, dns_answer_record->name, tmp_record->data_len) == 0)
Baptiste Assmann13a92322019-06-07 09:40:55 +02001196 )
1197 )
1198 continue;
1199 tmp_record->ar_item = dns_answer_record;
1200 }
Baptiste Assmann13a92322019-06-07 09:40:55 +02001201
1202 LIST_ADDQ(&dns_p->ar_list, &dns_answer_record->list);
1203 }
1204 } /* for i 0 to arcount */
1205
Baptiste Assmann37950c82020-02-19 01:08:51 +01001206 skip_parsing_additional_records:
1207
Baptiste Assmann13a92322019-06-07 09:40:55 +02001208 /* Save the number of records we really own */
1209 dns_p->header.arcount = nb_saved_records;
1210
Christopher Faulet67957bd2017-09-27 11:00:59 +02001211 dns_check_dns_response(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001212 return DNS_RESP_VALID;
1213}
1214
Christopher Faulet67957bd2017-09-27 11:00:59 +02001215/* Searches dn_name resolution in resp.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001216 * If existing IP not found, return the first IP matching family_priority,
1217 * otherwise, first ip found
1218 * The following tasks are the responsibility of the caller:
Baptiste Assmann3cf7f982016-04-17 22:43:26 +02001219 * - <dns_p> contains an error free DNS response
Baptiste Assmann325137d2015-04-13 23:40:55 +02001220 * For both cases above, dns_validate_dns_response is required
1221 * returns one of the DNS_UPD_* code
1222 */
Baptiste Assmannfb7091e2017-05-03 15:43:12 +02001223int dns_get_ip_from_response(struct dns_response_packet *dns_p,
Baptiste Assmann42746372017-05-03 12:12:02 +02001224 struct dns_options *dns_opts, void *currentip,
Thierry Fournierada34842016-02-17 21:25:09 +01001225 short currentip_sin_family,
Baptiste Assmannfb7091e2017-05-03 15:43:12 +02001226 void **newip, short *newip_sin_family,
1227 void *owner)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001228{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +02001229 struct dns_answer_item *record;
Thierry Fournierada34842016-02-17 21:25:09 +01001230 int family_priority;
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001231 int currentip_found;
Baptiste Assmann3cf7f982016-04-17 22:43:26 +02001232 unsigned char *newip4, *newip6;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001233 int currentip_sel;
1234 int j;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001235 int score, max_score;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001236 int allowed_duplicated_ip;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001237
Christopher Faulet67957bd2017-09-27 11:00:59 +02001238 family_priority = dns_opts->family_prio;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001239 allowed_duplicated_ip = dns_opts->accept_duplicate_ip;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001240 *newip = newip4 = newip6 = NULL;
1241 currentip_found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001242 *newip_sin_family = AF_UNSPEC;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001243 max_score = -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001244
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001245 /* Select an IP regarding configuration preference.
Joseph Herlant42cf6392018-11-15 10:33:28 -08001246 * Top priority is the preferred network ip version,
1247 * second priority is the preferred network.
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001248 * the last priority is the currently used IP,
1249 *
1250 * For these three priorities, a score is calculated. The
1251 * weight are:
Joseph Herlant42cf6392018-11-15 10:33:28 -08001252 * 8 - preferred ip version.
1253 * 4 - preferred network.
Baptistefc725902016-12-26 23:21:08 +01001254 * 2 - if the ip in the record is not affected to any other server in the same backend (duplication)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001255 * 1 - current ip.
1256 * The result with the biggest score is returned.
1257 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001258
1259 list_for_each_entry(record, &dns_p->answer_list, list) {
1260 void *ip;
1261 unsigned char ip_type;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001262
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001263 if (record->type == DNS_RTYPE_A) {
1264 ip = &(((struct sockaddr_in *)&record->address)->sin_addr);
1265 ip_type = AF_INET;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001266 }
1267 else if (record->type == DNS_RTYPE_AAAA) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001268 ip_type = AF_INET6;
1269 ip = &(((struct sockaddr_in6 *)&record->address)->sin6_addr);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001270 }
1271 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001272 continue;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001273 score = 0;
1274
Joseph Herlant42cf6392018-11-15 10:33:28 -08001275 /* Check for preferred ip protocol. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001276 if (ip_type == family_priority)
Baptistefc725902016-12-26 23:21:08 +01001277 score += 8;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001278
Joseph Herlant42cf6392018-11-15 10:33:28 -08001279 /* Check for preferred network. */
Baptiste Assmann42746372017-05-03 12:12:02 +02001280 for (j = 0; j < dns_opts->pref_net_nb; j++) {
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001281
1282 /* Compare only the same adresses class. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001283 if (dns_opts->pref_net[j].family != ip_type)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001284 continue;
1285
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001286 if ((ip_type == AF_INET &&
1287 in_net_ipv4(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001288 &dns_opts->pref_net[j].mask.in4,
1289 &dns_opts->pref_net[j].addr.in4)) ||
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001290 (ip_type == AF_INET6 &&
1291 in_net_ipv6(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001292 &dns_opts->pref_net[j].mask.in6,
1293 &dns_opts->pref_net[j].addr.in6))) {
Baptistefc725902016-12-26 23:21:08 +01001294 score += 4;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001295 break;
1296 }
1297 }
1298
Christopher Faulet67957bd2017-09-27 11:00:59 +02001299 /* Check if the IP found in the record is already affected to a
Baptiste Assmann84221b42018-06-22 13:03:50 +02001300 * member of a group. If not, the score should be incremented
Christopher Faulet67957bd2017-09-27 11:00:59 +02001301 * by 2. */
Baptiste Assmann84221b42018-06-22 13:03:50 +02001302 if (owner && snr_check_ip_callback(owner, ip, &ip_type)) {
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001303 if (!allowed_duplicated_ip) {
1304 continue;
1305 }
Baptiste Assmann84221b42018-06-22 13:03:50 +02001306 } else {
1307 score += 2;
1308 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001309
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001310 /* Check for current ip matching. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001311 if (ip_type == currentip_sin_family &&
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001312 ((currentip_sin_family == AF_INET &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001313 !memcmp(ip, currentip, 4)) ||
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001314 (currentip_sin_family == AF_INET6 &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001315 !memcmp(ip, currentip, 16)))) {
1316 score++;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001317 currentip_sel = 1;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001318 }
1319 else
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001320 currentip_sel = 0;
1321
1322 /* Keep the address if the score is better than the previous
Christopher Faulet67957bd2017-09-27 11:00:59 +02001323 * score. The maximum score is 15, if this value is reached, we
1324 * break the parsing. Implicitly, this score is reached the ip
1325 * selected is the current ip. */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001326 if (score > max_score) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001327 if (ip_type == AF_INET)
1328 newip4 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001329 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001330 newip6 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001331 currentip_found = currentip_sel;
Baptistefc725902016-12-26 23:21:08 +01001332 if (score == 15)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001333 return DNS_UPD_NO;
1334 max_score = score;
1335 }
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001336 } /* list for each record entries */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001337
Christopher Faulet67957bd2017-09-27 11:00:59 +02001338 /* No IP found in the response */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001339 if (!newip4 && !newip6)
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001340 return DNS_UPD_NO_IP_FOUND;
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001341
Christopher Faulet67957bd2017-09-27 11:00:59 +02001342 /* Case when the caller looks first for an IPv4 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001343 if (family_priority == AF_INET) {
1344 if (newip4) {
1345 *newip = newip4;
1346 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001347 }
1348 else if (newip6) {
1349 *newip = newip6;
1350 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001351 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001352 if (!currentip_found)
1353 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001354 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001355 /* Case when the caller looks first for an IPv6 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001356 else if (family_priority == AF_INET6) {
1357 if (newip6) {
1358 *newip = newip6;
1359 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001360 }
1361 else if (newip4) {
1362 *newip = newip4;
1363 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001364 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001365 if (!currentip_found)
1366 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001367 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001368 /* Case when the caller have no preference (we prefer IPv6) */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001369 else if (family_priority == AF_UNSPEC) {
1370 if (newip6) {
1371 *newip = newip6;
1372 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001373 }
1374 else if (newip4) {
1375 *newip = newip4;
1376 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001377 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001378 if (!currentip_found)
1379 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001380 }
1381
Christopher Faulet67957bd2017-09-27 11:00:59 +02001382 /* No reason why we should change the server's IP address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001383 return DNS_UPD_NO;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001384
Christopher Faulet67957bd2017-09-27 11:00:59 +02001385 not_found:
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001386 list_for_each_entry(record, &dns_p->answer_list, list) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001387 /* Move the first record to the end of the list, for internal
1388 * round robin */
1389 LIST_DEL(&record->list);
1390 LIST_ADDQ(&dns_p->answer_list, &record->list);
1391 break;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001392 }
1393 return DNS_UPD_SRVIP_NOT_FOUND;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001394}
1395
Christopher Faulet67957bd2017-09-27 11:00:59 +02001396/* Turns a domain name label into a string.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001397 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001398 * <dn> must be a null-terminated string. <dn_len> must include the terminating
1399 * null byte. <str> must be allocated and its size must be passed in <str_len>.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001400 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001401 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1402 * <str> (including the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001403 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001404int dns_dn_label_to_str(const char *dn, int dn_len, char *str, int str_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001405{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001406 char *ptr;
1407 int i, sz;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001408
Christopher Faulet67957bd2017-09-27 11:00:59 +02001409 if (str_len < dn_len - 1)
Baptiste Assmann2af08fe2017-08-14 00:13:01 +02001410 return -1;
1411
Christopher Faulet67957bd2017-09-27 11:00:59 +02001412 ptr = str;
1413 for (i = 0; i < dn_len-1; ++i) {
1414 sz = dn[i];
1415 if (i)
1416 *ptr++ = '.';
1417 memcpy(ptr, dn+i+1, sz);
1418 ptr += sz;
1419 i += sz;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001420 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001421 *ptr++ = '\0';
1422 return (ptr - str);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001423}
1424
Christopher Faulet67957bd2017-09-27 11:00:59 +02001425/* Turns a string into domain name label: www.haproxy.org into 3www7haproxy3org
1426 *
1427 * <str> must be a null-terminated string. <str_len> must include the
1428 * terminating null byte. <dn> buffer must be allocated and its size must be
1429 * passed in <dn_len>.
1430 *
1431 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1432 * <dn> (excluding the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001433 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001434int dns_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001435{
Baptiste Assmann325137d2015-04-13 23:40:55 +02001436 int i, offset;
1437
Christopher Faulet67957bd2017-09-27 11:00:59 +02001438 if (dn_len < str_len + 1)
1439 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001440
Christopher Faulet67957bd2017-09-27 11:00:59 +02001441 /* First byte of dn will be used to store the length of the first
1442 * label */
1443 offset = 0;
1444 for (i = 0; i < str_len; ++i) {
1445 if (str[i] == '.') {
1446 /* 2 or more consecutive dots is invalid */
1447 if (i == offset)
1448 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001449
Lukas Tribus81725b82020-02-27 15:47:24 +01001450 /* ignore trailing dot */
1451 if (i + 2 == str_len) {
1452 i++;
1453 break;
1454 }
1455
Christopher Faulet67957bd2017-09-27 11:00:59 +02001456 dn[offset] = (i - offset);
1457 offset = i+1;
1458 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001459 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001460 dn[i+1] = str[i];
Baptiste Assmann325137d2015-04-13 23:40:55 +02001461 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001462 dn[offset] = (i - offset - 1);
1463 dn[i] = '\0';
1464 return i;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001465}
1466
Christopher Faulet67957bd2017-09-27 11:00:59 +02001467/* Validates host name:
Baptiste Assmann325137d2015-04-13 23:40:55 +02001468 * - total size
1469 * - each label size individually
1470 * returns:
1471 * 0 in case of error. If <err> is not NULL, an error message is stored there.
1472 * 1 when no error. <err> is left unaffected.
1473 */
1474int dns_hostname_validation(const char *string, char **err)
1475{
Baptiste Assmann325137d2015-04-13 23:40:55 +02001476 int i;
1477
1478 if (strlen(string) > DNS_MAX_NAME_SIZE) {
1479 if (err)
1480 *err = DNS_TOO_LONG_FQDN;
1481 return 0;
1482 }
1483
William Dauchyaecd5dc2020-01-26 19:52:34 +01001484 while (*string) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001485 i = 0;
William Dauchyaecd5dc2020-01-26 19:52:34 +01001486 while (*string && *string != '.' && i < DNS_MAX_LABEL_SIZE) {
1487 if (!(*string == '-' || *string == '_' ||
1488 (*string >= 'a' && *string <= 'z') ||
1489 (*string >= 'A' && *string <= 'Z') ||
1490 (*string >= '0' && *string <= '9'))) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001491 if (err)
1492 *err = DNS_INVALID_CHARACTER;
1493 return 0;
1494 }
William Dauchyaecd5dc2020-01-26 19:52:34 +01001495 i++;
1496 string++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001497 }
1498
William Dauchyaecd5dc2020-01-26 19:52:34 +01001499 if (!(*string))
1500 break;
1501
1502 if (*string != '.' && i >= DNS_MAX_LABEL_SIZE) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001503 if (err)
1504 *err = DNS_LABEL_TOO_LONG;
1505 return 0;
1506 }
1507
William Dauchyaecd5dc2020-01-26 19:52:34 +01001508 string++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001509 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001510 return 1;
1511}
1512
Christopher Faulet67957bd2017-09-27 11:00:59 +02001513/* Picks up an available resolution from the different resolution list
1514 * associated to a resolvers section, in this order:
1515 * 1. check in resolutions.curr for the same hostname and query_type
1516 * 2. check in resolutions.wait for the same hostname and query_type
1517 * 3. Get a new resolution from resolution pool
1518 *
1519 * Returns an available resolution, NULL if none found.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001520 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001521static struct dns_resolution *dns_pick_resolution(struct dns_resolvers *resolvers,
1522 char **hostname_dn, int hostname_dn_len,
1523 int query_type)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001524{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001525 struct dns_resolution *res;
1526
1527 if (!*hostname_dn)
1528 goto from_pool;
1529
1530 /* Search for same hostname and query type in resolutions.curr */
1531 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
1532 if (!res->hostname_dn)
1533 continue;
1534 if ((query_type == res->prefered_query_type) &&
1535 hostname_dn_len == res->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001536 !dns_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +02001537 return res;
1538 }
1539
1540 /* Search for same hostname and query type in resolutions.wait */
1541 list_for_each_entry(res, &resolvers->resolutions.wait, list) {
1542 if (!res->hostname_dn)
1543 continue;
1544 if ((query_type == res->prefered_query_type) &&
1545 hostname_dn_len == res->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001546 !dns_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +02001547 return res;
1548 }
1549
1550 from_pool:
1551 /* No resolution could be found, so let's allocate a new one */
Willy Tarreaubafbe012017-11-24 17:34:44 +01001552 res = pool_alloc(dns_resolution_pool);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001553 if (res) {
1554 memset(res, 0, sizeof(*res));
1555 res->resolvers = resolvers;
1556 res->uuid = resolution_uuid;
1557 res->status = RSLV_STATUS_NONE;
1558 res->step = RSLV_STEP_NONE;
1559 res->last_valid = now_ms;
1560
1561 LIST_INIT(&res->requesters);
1562 LIST_INIT(&res->response.answer_list);
Baptiste Assmann13a92322019-06-07 09:40:55 +02001563 LIST_INIT(&res->response.ar_list);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001564
1565 res->prefered_query_type = query_type;
1566 res->query_type = query_type;
1567 res->hostname_dn = *hostname_dn;
1568 res->hostname_dn_len = hostname_dn_len;
1569
1570 ++resolution_uuid;
1571
1572 /* Move the resolution to the resolvers wait queue */
1573 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1574 }
1575 return res;
1576}
1577
1578/* Releases a resolution from its requester(s) and move it back to the pool */
1579static void dns_free_resolution(struct dns_resolution *resolution)
1580{
1581 struct dns_requester *req, *reqback;
1582
1583 /* clean up configuration */
1584 dns_reset_resolution(resolution);
1585 resolution->hostname_dn = NULL;
1586 resolution->hostname_dn_len = 0;
1587
1588 list_for_each_entry_safe(req, reqback, &resolution->requesters, list) {
1589 LIST_DEL(&req->list);
1590 req->resolution = NULL;
1591 }
1592
1593 LIST_DEL(&resolution->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +01001594 pool_free(dns_resolution_pool, resolution);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001595}
1596
1597/* Links a requester (a server or a dns_srvrq) with a resolution. It returns 0
1598 * on success, -1 otherwise.
1599 */
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001600int dns_link_resolution(void *requester, int requester_type, int requester_locked)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001601{
1602 struct dns_resolution *res = NULL;
1603 struct dns_requester *req;
1604 struct dns_resolvers *resolvers;
1605 struct server *srv = NULL;
1606 struct dns_srvrq *srvrq = NULL;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001607 struct stream *stream = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001608 char **hostname_dn;
1609 int hostname_dn_len, query_type;
1610
1611 switch (requester_type) {
1612 case OBJ_TYPE_SERVER:
1613 srv = (struct server *)requester;
1614 hostname_dn = &srv->hostname_dn;
1615 hostname_dn_len = srv->hostname_dn_len;
1616 resolvers = srv->resolvers;
1617 query_type = ((srv->dns_opts.family_prio == AF_INET)
1618 ? DNS_RTYPE_A
1619 : DNS_RTYPE_AAAA);
1620 break;
1621
1622 case OBJ_TYPE_SRVRQ:
1623 srvrq = (struct dns_srvrq *)requester;
1624 hostname_dn = &srvrq->hostname_dn;
1625 hostname_dn_len = srvrq->hostname_dn_len;
1626 resolvers = srvrq->resolvers;
1627 query_type = DNS_RTYPE_SRV;
1628 break;
1629
Baptiste Assmann333939c2019-01-21 08:34:50 +01001630 case OBJ_TYPE_STREAM:
1631 stream = (struct stream *)requester;
1632 hostname_dn = &stream->dns_ctx.hostname_dn;
1633 hostname_dn_len = stream->dns_ctx.hostname_dn_len;
1634 resolvers = stream->dns_ctx.parent->arg.dns.resolvers;
Christopher Fauleta4168432020-01-24 18:08:42 +01001635 query_type = ((stream->dns_ctx.parent->arg.dns.dns_opts->family_prio == AF_INET)
Baptiste Assmann333939c2019-01-21 08:34:50 +01001636 ? DNS_RTYPE_A
1637 : DNS_RTYPE_AAAA);
1638 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001639 default:
1640 goto err;
1641 }
1642
1643 /* Get a resolution from the resolvers' wait queue or pool */
1644 if ((res = dns_pick_resolution(resolvers, hostname_dn, hostname_dn_len, query_type)) == NULL)
1645 goto err;
1646
1647 if (srv) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001648 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001649 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001650 if (srv->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001651 if ((req = pool_alloc(dns_requester_pool)) == NULL) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001652 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001653 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001654 goto err;
Willy Tarreau5ec84572017-11-05 10:35:57 +01001655 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001656 req->owner = &srv->obj_type;
1657 srv->dns_requester = req;
1658 }
1659 else
1660 req = srv->dns_requester;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001661 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001662 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001663
1664 req->requester_cb = snr_resolution_cb;
1665 req->requester_error_cb = snr_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001666 }
1667 else if (srvrq) {
1668 if (srvrq->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001669 if ((req = pool_alloc(dns_requester_pool)) == NULL)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001670 goto err;
1671 req->owner = &srvrq->obj_type;
1672 srvrq->dns_requester = req;
1673 }
1674 else
1675 req = srvrq->dns_requester;
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001676
1677 req->requester_cb = snr_resolution_cb;
1678 req->requester_error_cb = snr_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001679 }
Baptiste Assmann333939c2019-01-21 08:34:50 +01001680 else if (stream) {
1681 if (stream->dns_ctx.dns_requester == NULL) {
1682 if ((req = pool_alloc(dns_requester_pool)) == NULL)
1683 goto err;
1684 req->owner = &stream->obj_type;
1685 stream->dns_ctx.dns_requester = req;
1686 }
1687 else
1688 req = stream->dns_ctx.dns_requester;
1689
1690 req->requester_cb = act_resolution_cb;
1691 req->requester_error_cb = act_resolution_error_cb;
1692 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001693 else
1694 goto err;
1695
1696 req->resolution = res;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001697
1698 LIST_ADDQ(&res->requesters, &req->list);
1699 return 0;
1700
1701 err:
1702 if (res && LIST_ISEMPTY(&res->requesters))
1703 dns_free_resolution(res);
1704 return -1;
1705}
1706
1707/* Removes a requester from a DNS resoltion. It takes takes care of all the
1708 * consequences. It also cleans up some parameters from the requester.
1709 */
1710void dns_unlink_resolution(struct dns_requester *requester)
1711{
1712 struct dns_resolution *res;
1713 struct dns_requester *req;
1714
1715 /* Nothing to do */
1716 if (!requester || !requester->resolution)
1717 return;
1718 res = requester->resolution;
1719
1720 /* Clean up the requester */
1721 LIST_DEL(&requester->list);
1722 requester->resolution = NULL;
1723
1724 /* We need to find another requester linked on this resolution */
1725 if (!LIST_ISEMPTY(&res->requesters))
1726 req = LIST_NEXT(&res->requesters, struct dns_requester *, list);
1727 else {
1728 dns_free_resolution(res);
1729 return;
1730 }
1731
1732 /* Move hostname_dn related pointers to the next requester */
1733 switch (obj_type(req->owner)) {
1734 case OBJ_TYPE_SERVER:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001735 res->hostname_dn = __objt_server(req->owner)->hostname_dn;
1736 res->hostname_dn_len = __objt_server(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001737 break;
1738 case OBJ_TYPE_SRVRQ:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001739 res->hostname_dn = __objt_dns_srvrq(req->owner)->hostname_dn;
1740 res->hostname_dn_len = __objt_dns_srvrq(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001741 break;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001742 case OBJ_TYPE_STREAM:
1743 res->hostname_dn = __objt_stream(req->owner)->dns_ctx.hostname_dn;
1744 res->hostname_dn_len = __objt_stream(req->owner)->dns_ctx.hostname_dn_len;
1745 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001746 default:
1747 res->hostname_dn = NULL;
1748 res->hostname_dn_len = 0;
1749 break;
1750 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001751}
1752
Christopher Faulet67957bd2017-09-27 11:00:59 +02001753/* Called when a network IO is generated on a name server socket for an incoming
1754 * packet. It performs the following actions:
1755 * - check if the packet requires processing (not outdated resolution)
1756 * - ensure the DNS packet received is valid and call requester's callback
1757 * - call requester's error callback if invalid response
1758 * - check the dn_name in the packet against the one sent
1759 */
1760static void dns_resolve_recv(struct dgram_conn *dgram)
1761{
1762 struct dns_nameserver *ns, *tmpns;
1763 struct dns_resolvers *resolvers;
1764 struct dns_resolution *res;
1765 struct dns_query_item *query;
1766 unsigned char buf[DNS_MAX_UDP_MESSAGE + 1];
1767 unsigned char *bufend;
1768 int fd, buflen, dns_resp;
1769 int max_answer_records;
1770 unsigned short query_id;
1771 struct eb32_node *eb;
1772 struct dns_requester *req;
1773
1774 fd = dgram->t.sock.fd;
1775
1776 /* check if ready for reading */
1777 if (!fd_recv_ready(fd))
1778 return;
1779
1780 /* no need to go further if we can't retrieve the nameserver */
Willy Tarreau1c759952019-12-10 18:38:09 +01001781 if ((ns = dgram->owner) == NULL) {
1782 _HA_ATOMIC_AND(&fdtab[fd].ev, ~(FD_POLL_HUP|FD_POLL_ERR));
1783 fd_stop_recv(fd);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001784 return;
Willy Tarreau1c759952019-12-10 18:38:09 +01001785 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001786
1787 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001788 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001789
1790 /* process all pending input messages */
Willy Tarreau1c759952019-12-10 18:38:09 +01001791 while (fd_recv_ready(fd)) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001792 /* read message received */
1793 memset(buf, '\0', resolvers->accepted_payload_size + 1);
1794 if ((buflen = recv(fd, (char*)buf , resolvers->accepted_payload_size + 1, 0)) < 0) {
Willy Tarreau1c759952019-12-10 18:38:09 +01001795 /* FIXME : for now we consider EAGAIN only, but at
1796 * least we purge sticky errors that would cause us to
1797 * be called in loops.
1798 */
1799 _HA_ATOMIC_AND(&fdtab[fd].ev, ~(FD_POLL_HUP|FD_POLL_ERR));
Christopher Faulet67957bd2017-09-27 11:00:59 +02001800 fd_cant_recv(fd);
1801 break;
1802 }
1803
1804 /* message too big */
1805 if (buflen > resolvers->accepted_payload_size) {
1806 ns->counters.too_big++;
1807 continue;
1808 }
1809
1810 /* initializing variables */
1811 bufend = buf + buflen; /* pointer to mark the end of the buffer */
1812
1813 /* read the query id from the packet (16 bits) */
1814 if (buf + 2 > bufend) {
1815 ns->counters.invalid++;
1816 continue;
1817 }
1818 query_id = dns_response_get_query_id(buf);
1819
1820 /* search the query_id in the pending resolution tree */
1821 eb = eb32_lookup(&resolvers->query_ids, query_id);
1822 if (eb == NULL) {
1823 /* unknown query id means an outdated response and can be safely ignored */
1824 ns->counters.outdated++;
1825 continue;
1826 }
1827
William Dauchybe8a3872019-11-27 23:32:41 +01001828 /* known query id means a resolution in progress */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001829 res = eb32_entry(eb, struct dns_resolution, qid);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001830 /* number of responses received */
1831 res->nb_responses++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001832
Christopher Faulet67957bd2017-09-27 11:00:59 +02001833 max_answer_records = (resolvers->accepted_payload_size - DNS_HEADER_SIZE) / DNS_MIN_RECORD_SIZE;
1834 dns_resp = dns_validate_dns_response(buf, bufend, res, max_answer_records);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001835
Christopher Faulet67957bd2017-09-27 11:00:59 +02001836 switch (dns_resp) {
1837 case DNS_RESP_VALID:
1838 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001839
Christopher Faulet67957bd2017-09-27 11:00:59 +02001840 case DNS_RESP_INVALID:
1841 case DNS_RESP_QUERY_COUNT_ERROR:
1842 case DNS_RESP_WRONG_NAME:
1843 res->status = RSLV_STATUS_INVALID;
1844 ns->counters.invalid++;
1845 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001846
Christopher Faulet67957bd2017-09-27 11:00:59 +02001847 case DNS_RESP_NX_DOMAIN:
1848 res->status = RSLV_STATUS_NX;
1849 ns->counters.nx++;
1850 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001851
Christopher Faulet67957bd2017-09-27 11:00:59 +02001852 case DNS_RESP_REFUSED:
1853 res->status = RSLV_STATUS_REFUSED;
1854 ns->counters.refused++;
1855 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001856
Christopher Faulet67957bd2017-09-27 11:00:59 +02001857 case DNS_RESP_ANCOUNT_ZERO:
1858 res->status = RSLV_STATUS_OTHER;
1859 ns->counters.any_err++;
1860 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001861
Christopher Faulet67957bd2017-09-27 11:00:59 +02001862 case DNS_RESP_CNAME_ERROR:
1863 res->status = RSLV_STATUS_OTHER;
1864 ns->counters.cname_error++;
1865 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001866
Christopher Faulet67957bd2017-09-27 11:00:59 +02001867 case DNS_RESP_TRUNCATED:
1868 res->status = RSLV_STATUS_OTHER;
1869 ns->counters.truncated++;
1870 break;
Baptiste Assmanne70bc052017-08-21 16:51:09 +02001871
Christopher Faulet67957bd2017-09-27 11:00:59 +02001872 case DNS_RESP_NO_EXPECTED_RECORD:
1873 case DNS_RESP_ERROR:
1874 case DNS_RESP_INTERNAL:
1875 res->status = RSLV_STATUS_OTHER;
1876 ns->counters.other++;
1877 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001878 }
1879
Christopher Faulet67957bd2017-09-27 11:00:59 +02001880 /* Wait all nameservers response to handle errors */
1881 if (dns_resp != DNS_RESP_VALID && res->nb_responses < resolvers->nb_nameservers)
1882 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001883
Christopher Faulet67957bd2017-09-27 11:00:59 +02001884 /* Process error codes */
1885 if (dns_resp != DNS_RESP_VALID) {
1886 if (res->prefered_query_type != res->query_type) {
1887 /* The fallback on the query type was already performed,
1888 * so check the try counter. If it falls to 0, we can
1889 * report an error. Else, wait the next attempt. */
1890 if (!res->try)
1891 goto report_res_error;
1892 }
1893 else {
1894 /* Fallback from A to AAAA or the opposite and re-send
1895 * the resolution immediately. try counter is not
1896 * decremented. */
1897 if (res->prefered_query_type == DNS_RTYPE_A) {
1898 res->query_type = DNS_RTYPE_AAAA;
1899 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001900 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001901 else if (res->prefered_query_type == DNS_RTYPE_AAAA) {
1902 res->query_type = DNS_RTYPE_A;
1903 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001904 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001905 }
1906 continue;
1907 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001908
Christopher Faulet67957bd2017-09-27 11:00:59 +02001909 /* Now let's check the query's dname corresponds to the one we
1910 * sent. We can check only the first query of the list. We send
1911 * one query at a time so we get one query in the response */
1912 query = LIST_NEXT(&res->response.query_list, struct dns_query_item *, list);
Olivier Houchardb17b8842020-04-01 18:30:27 +02001913 if (query && dns_hostname_cmp(query->name, res->hostname_dn, res->hostname_dn_len) != 0) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001914 dns_resp = DNS_RESP_WRONG_NAME;
1915 ns->counters.other++;
1916 goto report_res_error;
1917 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001918
Christopher Faulet67957bd2017-09-27 11:00:59 +02001919 /* So the resolution succeeded */
1920 res->status = RSLV_STATUS_VALID;
1921 res->last_valid = now_ms;
1922 ns->counters.valid++;
1923 goto report_res_success;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001924
Christopher Faulet67957bd2017-09-27 11:00:59 +02001925 report_res_error:
1926 list_for_each_entry(req, &res->requesters, list)
1927 req->requester_error_cb(req, dns_resp);
1928 dns_reset_resolution(res);
1929 LIST_DEL(&res->list);
1930 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1931 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001932
Christopher Faulet67957bd2017-09-27 11:00:59 +02001933 report_res_success:
1934 /* Only the 1rst requester s managed by the server, others are
1935 * from the cache */
1936 tmpns = ns;
1937 list_for_each_entry(req, &res->requesters, list) {
Olivier Houchard28381072017-11-06 17:30:28 +01001938 struct server *s = objt_server(req->owner);
1939
1940 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001941 HA_SPIN_LOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001942 req->requester_cb(req, tmpns);
Olivier Houchard28381072017-11-06 17:30:28 +01001943 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001944 HA_SPIN_UNLOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001945 tmpns = NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001946 }
Baptiste Assmann42746372017-05-03 12:12:02 +02001947
Christopher Faulet67957bd2017-09-27 11:00:59 +02001948 dns_reset_resolution(res);
1949 LIST_DEL(&res->list);
1950 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1951 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001952 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001953 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001954 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001955}
William Lallemand69e96442016-11-19 00:58:54 +01001956
Christopher Faulet67957bd2017-09-27 11:00:59 +02001957/* Called when a resolvers network socket is ready to send data */
1958static void dns_resolve_send(struct dgram_conn *dgram)
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001959{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001960 struct dns_resolvers *resolvers;
1961 struct dns_nameserver *ns;
1962 struct dns_resolution *res;
1963 int fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001964
Christopher Faulet67957bd2017-09-27 11:00:59 +02001965 fd = dgram->t.sock.fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001966
Christopher Faulet67957bd2017-09-27 11:00:59 +02001967 /* check if ready for sending */
1968 if (!fd_send_ready(fd))
1969 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001970
Christopher Faulet67957bd2017-09-27 11:00:59 +02001971 /* we don't want/need to be waked up any more for sending */
1972 fd_stop_send(fd);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001973
Christopher Faulet67957bd2017-09-27 11:00:59 +02001974 /* no need to go further if we can't retrieve the nameserver */
1975 if ((ns = dgram->owner) == NULL)
1976 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001977
Christopher Faulet67957bd2017-09-27 11:00:59 +02001978 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001979 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02001980
Christopher Faulet67957bd2017-09-27 11:00:59 +02001981 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001982 int ret, len;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001983
Christopher Faulet67957bd2017-09-27 11:00:59 +02001984 if (res->nb_queries == resolvers->nb_nameservers)
1985 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001986
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001987 len = dns_build_query(res->query_id, res->query_type,
1988 resolvers->accepted_payload_size,
1989 res->hostname_dn, res->hostname_dn_len,
1990 trash.area, trash.size);
1991 if (len == -1)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001992 goto snd_error;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001993
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001994 ret = send(fd, trash.area, len, 0);
Willy Tarreau0eae6322019-12-20 11:18:54 +01001995 if (ret != len) {
1996 if (ret == -1 && errno == EAGAIN) {
1997 /* retry once the socket is ready */
1998 fd_cant_send(fd);
1999 continue;
2000 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002001 goto snd_error;
Willy Tarreau0eae6322019-12-20 11:18:54 +01002002 }
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002003
Christopher Faulet67957bd2017-09-27 11:00:59 +02002004 ns->counters.sent++;
2005 res->nb_queries++;
2006 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002007
Christopher Faulet67957bd2017-09-27 11:00:59 +02002008 snd_error:
2009 ns->counters.snd_error++;
2010 res->nb_queries++;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002011 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002012 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002013}
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002014
Christopher Faulet67957bd2017-09-27 11:00:59 +02002015/* Processes DNS resolution. First, it checks the active list to detect expired
2016 * resolutions and retry them if possible. Else a timeout is reported. Then, it
2017 * checks the wait list to trigger new resolutions.
2018 */
Olivier Houchard9f6af332018-05-25 14:04:04 +02002019static struct task *dns_process_resolvers(struct task *t, void *context, unsigned short state)
Christopher Faulet67957bd2017-09-27 11:00:59 +02002020{
Olivier Houchard9f6af332018-05-25 14:04:04 +02002021 struct dns_resolvers *resolvers = context;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002022 struct dns_resolution *res, *resback;
2023 int exp;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002024
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002025 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02002026
Christopher Faulet67957bd2017-09-27 11:00:59 +02002027 /* Handle all expired resolutions from the active list */
2028 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
2029 /* When we find the first resolution in the future, then we can
2030 * stop here */
2031 exp = tick_add(res->last_query, resolvers->timeout.retry);
2032 if (!tick_is_expired(exp, now_ms))
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002033 break;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002034
Christopher Faulet67957bd2017-09-27 11:00:59 +02002035 /* If current resolution has been tried too many times and
2036 * finishes in timeout we update its status and remove it from
2037 * the list */
2038 if (!res->try) {
2039 struct dns_requester *req;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002040
Christopher Faulet67957bd2017-09-27 11:00:59 +02002041 /* Notify the result to the requesters */
2042 if (!res->nb_responses)
2043 res->status = RSLV_STATUS_TIMEOUT;
2044 list_for_each_entry(req, &res->requesters, list)
2045 req->requester_error_cb(req, res->status);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002046
Christopher Faulet67957bd2017-09-27 11:00:59 +02002047 /* Clean up resolution info and remove it from the
2048 * current list */
2049 dns_reset_resolution(res);
2050 LIST_DEL(&res->list);
2051 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
William Lallemand69e96442016-11-19 00:58:54 +01002052 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002053 else {
2054 /* Otherwise resend the DNS query and requeue the resolution */
2055 if (!res->nb_responses || res->prefered_query_type != res->query_type) {
2056 /* No response received (a real timeout) or fallback already done */
2057 res->query_type = res->prefered_query_type;
2058 res->try--;
2059 }
2060 else {
2061 /* Fallback from A to AAAA or the opposite and re-send
2062 * the resolution immediately. try counter is not
2063 * decremented. */
2064 if (res->prefered_query_type == DNS_RTYPE_A)
2065 res->query_type = DNS_RTYPE_AAAA;
2066 else if (res->prefered_query_type == DNS_RTYPE_AAAA)
2067 res->query_type = DNS_RTYPE_A;
2068 else
2069 res->try--;
2070 }
2071 dns_send_query(res);
William Lallemand69e96442016-11-19 00:58:54 +01002072 }
2073 }
William Lallemand69e96442016-11-19 00:58:54 +01002074
Christopher Faulet67957bd2017-09-27 11:00:59 +02002075 /* Handle all resolutions in the wait list */
2076 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
2077 exp = tick_add(res->last_resolution, dns_resolution_timeout(res));
2078 if (tick_isset(res->last_resolution) && !tick_is_expired(exp, now_ms))
2079 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002080
Christopher Faulet67957bd2017-09-27 11:00:59 +02002081 if (dns_run_resolution(res) != 1) {
2082 res->last_resolution = now_ms;
2083 LIST_DEL(&res->list);
2084 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002085 }
2086 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002087
Christopher Faulet67957bd2017-09-27 11:00:59 +02002088 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002089 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002090 return t;
2091}
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002092
Christopher Faulet67957bd2017-09-27 11:00:59 +02002093/* proto_udp callback functions for a DNS resolution */
2094struct dgram_data_cb resolve_dgram_cb = {
2095 .recv = dns_resolve_recv,
2096 .send = dns_resolve_send,
2097};
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002098
Christopher Faulet67957bd2017-09-27 11:00:59 +02002099/* Release memory allocated by DNS */
2100static void dns_deinit(void)
2101{
2102 struct dns_resolvers *resolvers, *resolversback;
2103 struct dns_nameserver *ns, *nsback;
2104 struct dns_resolution *res, *resback;
2105 struct dns_requester *req, *reqback;
2106 struct dns_srvrq *srvrq, *srvrqback;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002107
Christopher Faulet67957bd2017-09-27 11:00:59 +02002108 list_for_each_entry_safe(resolvers, resolversback, &dns_resolvers, list) {
2109 list_for_each_entry_safe(ns, nsback, &resolvers->nameservers, list) {
2110 free(ns->id);
2111 free((char *)ns->conf.file);
2112 if (ns->dgram && ns->dgram->t.sock.fd != -1)
2113 fd_delete(ns->dgram->t.sock.fd);
2114 free(ns->dgram);
2115 LIST_DEL(&ns->list);
2116 free(ns);
2117 }
2118
2119 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
2120 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
2121 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01002122 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002123 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002124 dns_free_resolution(res);
2125 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02002126
Christopher Faulet67957bd2017-09-27 11:00:59 +02002127 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
2128 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
2129 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01002130 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002131 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002132 dns_free_resolution(res);
2133 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02002134
Christopher Faulet67957bd2017-09-27 11:00:59 +02002135 free(resolvers->id);
2136 free((char *)resolvers->conf.file);
Olivier Houchard3f795f72019-04-17 22:51:06 +02002137 task_destroy(resolvers->t);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002138 LIST_DEL(&resolvers->list);
2139 free(resolvers);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002140 }
2141
Christopher Faulet67957bd2017-09-27 11:00:59 +02002142 list_for_each_entry_safe(srvrq, srvrqback, &dns_srvrq_list, list) {
2143 free(srvrq->name);
2144 free(srvrq->hostname_dn);
2145 LIST_DEL(&srvrq->list);
2146 free(srvrq);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002147 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002148}
2149
Christopher Faulet67957bd2017-09-27 11:00:59 +02002150/* Finalizes the DNS configuration by allocating required resources and checking
2151 * live parameters.
2152 * Returns 0 on success, ERR_* flags otherwise.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002153 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02002154static int dns_finalize_config(void)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002155{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002156 struct dns_resolvers *resolvers;
2157 struct proxy *px;
2158 int err_code = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002159
Christopher Faulet67957bd2017-09-27 11:00:59 +02002160 /* allocate pool of resolution per resolvers */
2161 list_for_each_entry(resolvers, &dns_resolvers, list) {
2162 struct dns_nameserver *ns;
2163 struct task *t;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002164
Christopher Faulet67957bd2017-09-27 11:00:59 +02002165 /* Check if we can create the socket with nameservers info */
2166 list_for_each_entry(ns, &resolvers->nameservers, list) {
2167 struct dgram_conn *dgram = NULL;
2168 int fd;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002169
Christopher Faulet67957bd2017-09-27 11:00:59 +02002170 /* Check nameserver info */
2171 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002172 ha_alert("config : resolvers '%s': can't create socket for nameserver '%s'.\n",
2173 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002174 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002175 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02002176 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002177 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002178 ha_alert("config : resolvers '%s': can't connect socket for nameserver '%s'.\n",
2179 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002180 close(fd);
2181 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002182 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02002183 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002184 close(fd);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002185
Christopher Faulet67957bd2017-09-27 11:00:59 +02002186 /* Create dgram structure that will hold the UPD socket
2187 * and attach it on the current nameserver */
2188 if ((dgram = calloc(1, sizeof(*dgram))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002189 ha_alert("config: resolvers '%s' : out of memory.\n",
2190 resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002191 err_code |= (ERR_ALERT|ERR_ABORT);
2192 goto err;
2193 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002194
Christopher Faulet67957bd2017-09-27 11:00:59 +02002195 /* Leave dgram partially initialized, no FD attached for
2196 * now. */
2197 dgram->owner = ns;
2198 dgram->data = &resolve_dgram_cb;
2199 dgram->t.sock.fd = -1;
2200 ns->dgram = dgram;
2201 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002202
Christopher Faulet67957bd2017-09-27 11:00:59 +02002203 /* Create the task associated to the resolvers section */
Emeric Brunc60def82017-09-27 14:59:38 +02002204 if ((t = task_new(MAX_THREADS_MASK)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002205 ha_alert("config : resolvers '%s' : out of memory.\n", resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002206 err_code |= (ERR_ALERT|ERR_ABORT);
2207 goto err;
2208 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002209
Christopher Faulet67957bd2017-09-27 11:00:59 +02002210 /* Update task's parameters */
2211 t->process = dns_process_resolvers;
2212 t->context = resolvers;
2213 resolvers->t = t;
2214 task_wakeup(t, TASK_WOKEN_INIT);
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002215 }
2216
Olivier Houchardfbc74e82017-11-24 16:54:05 +01002217 for (px = proxies_list; px; px = px->next) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002218 struct server *srv;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002219
Christopher Faulet67957bd2017-09-27 11:00:59 +02002220 for (srv = px->srv; srv; srv = srv->next) {
2221 struct dns_resolvers *resolvers;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002222
Christopher Faulet67957bd2017-09-27 11:00:59 +02002223 if (!srv->resolvers_id)
2224 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002225
Christopher Faulet67957bd2017-09-27 11:00:59 +02002226 if ((resolvers = find_resolvers_by_id(srv->resolvers_id)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002227 ha_alert("config : %s '%s', server '%s': unable to find required resolvers '%s'\n",
2228 proxy_type_str(px), px->id, srv->id, srv->resolvers_id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002229 err_code |= (ERR_ALERT|ERR_ABORT);
2230 continue;
2231 }
2232 srv->resolvers = resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002233
Christopher Faulet67957bd2017-09-27 11:00:59 +02002234 if (srv->srvrq && !srv->srvrq->resolvers) {
2235 srv->srvrq->resolvers = srv->resolvers;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01002236 if (dns_link_resolution(srv->srvrq, OBJ_TYPE_SRVRQ, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002237 ha_alert("config : %s '%s' : unable to set DNS resolution for server '%s'.\n",
2238 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002239 err_code |= (ERR_ALERT|ERR_ABORT);
2240 continue;
2241 }
2242 }
Olivier Houchard55dcdf42017-11-06 15:15:04 +01002243 if (dns_link_resolution(srv, OBJ_TYPE_SERVER, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002244 ha_alert("config : %s '%s', unable to set DNS resolution for server '%s'.\n",
2245 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002246 err_code |= (ERR_ALERT|ERR_ABORT);
2247 continue;
2248 }
2249 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002250 }
2251
Christopher Faulet67957bd2017-09-27 11:00:59 +02002252 if (err_code & (ERR_ALERT|ERR_ABORT))
2253 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002254
Christopher Faulet67957bd2017-09-27 11:00:59 +02002255 return err_code;
2256 err:
2257 dns_deinit();
2258 return err_code;
2259
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002260}
2261
Christopher Faulet67957bd2017-09-27 11:00:59 +02002262/* if an arg is found, it sets the resolvers section pointer into cli.p0 */
Aurélien Nephtaliabbf6072018-04-18 13:26:46 +02002263static int cli_parse_stat_resolvers(char **args, char *payload, struct appctx *appctx, void *private)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002264{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002265 struct dns_resolvers *presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002266
Christopher Faulet67957bd2017-09-27 11:00:59 +02002267 if (*args[2]) {
2268 list_for_each_entry(presolvers, &dns_resolvers, list) {
2269 if (strcmp(presolvers->id, args[2]) == 0) {
2270 appctx->ctx.cli.p0 = presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002271 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002272 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002273 }
Willy Tarreau9d008692019-08-09 11:21:01 +02002274 if (appctx->ctx.cli.p0 == NULL)
2275 return cli_err(appctx, "Can't find that resolvers section\n");
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002276 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002277 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002278}
2279
Christopher Faulet67957bd2017-09-27 11:00:59 +02002280/* Dumps counters from all resolvers section and associated name servers. It
2281 * returns 0 if the output buffer is full and it needs to be called again,
2282 * otherwise non-zero. It may limit itself to the resolver pointed to by
Willy Tarreau777b5602016-12-16 18:06:26 +01002283 * <cli.p0> if it's not null.
William Lallemand69e96442016-11-19 00:58:54 +01002284 */
2285static int cli_io_handler_dump_resolvers_to_buffer(struct appctx *appctx)
2286{
2287 struct stream_interface *si = appctx->owner;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002288 struct dns_resolvers *resolvers;
2289 struct dns_nameserver *ns;
William Lallemand69e96442016-11-19 00:58:54 +01002290
2291 chunk_reset(&trash);
2292
2293 switch (appctx->st2) {
2294 case STAT_ST_INIT:
2295 appctx->st2 = STAT_ST_LIST; /* let's start producing data */
2296 /* fall through */
2297
2298 case STAT_ST_LIST:
2299 if (LIST_ISEMPTY(&dns_resolvers)) {
2300 chunk_appendf(&trash, "No resolvers found\n");
2301 }
2302 else {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002303 list_for_each_entry(resolvers, &dns_resolvers, list) {
2304 if (appctx->ctx.cli.p0 != NULL && appctx->ctx.cli.p0 != resolvers)
William Lallemand69e96442016-11-19 00:58:54 +01002305 continue;
2306
Christopher Faulet67957bd2017-09-27 11:00:59 +02002307 chunk_appendf(&trash, "Resolvers section %s\n", resolvers->id);
2308 list_for_each_entry(ns, &resolvers->nameservers, list) {
2309 chunk_appendf(&trash, " nameserver %s:\n", ns->id);
2310 chunk_appendf(&trash, " sent: %lld\n", ns->counters.sent);
2311 chunk_appendf(&trash, " snd_error: %lld\n", ns->counters.snd_error);
2312 chunk_appendf(&trash, " valid: %lld\n", ns->counters.valid);
2313 chunk_appendf(&trash, " update: %lld\n", ns->counters.update);
2314 chunk_appendf(&trash, " cname: %lld\n", ns->counters.cname);
2315 chunk_appendf(&trash, " cname_error: %lld\n", ns->counters.cname_error);
2316 chunk_appendf(&trash, " any_err: %lld\n", ns->counters.any_err);
2317 chunk_appendf(&trash, " nx: %lld\n", ns->counters.nx);
2318 chunk_appendf(&trash, " timeout: %lld\n", ns->counters.timeout);
2319 chunk_appendf(&trash, " refused: %lld\n", ns->counters.refused);
2320 chunk_appendf(&trash, " other: %lld\n", ns->counters.other);
2321 chunk_appendf(&trash, " invalid: %lld\n", ns->counters.invalid);
2322 chunk_appendf(&trash, " too_big: %lld\n", ns->counters.too_big);
2323 chunk_appendf(&trash, " truncated: %lld\n", ns->counters.truncated);
2324 chunk_appendf(&trash, " outdated: %lld\n", ns->counters.outdated);
William Lallemand69e96442016-11-19 00:58:54 +01002325 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002326 chunk_appendf(&trash, "\n");
William Lallemand69e96442016-11-19 00:58:54 +01002327 }
2328 }
2329
2330 /* display response */
Willy Tarreau06d80a92017-10-19 14:32:15 +02002331 if (ci_putchk(si_ic(si), &trash) == -1) {
William Lallemand69e96442016-11-19 00:58:54 +01002332 /* let's try again later from this session. We add ourselves into
2333 * this session's users so that it can remove us upon termination.
2334 */
Willy Tarreaudb398432018-11-15 11:08:52 +01002335 si_rx_room_blk(si);
William Lallemand69e96442016-11-19 00:58:54 +01002336 return 0;
2337 }
William Lallemand69e96442016-11-19 00:58:54 +01002338 /* fall through */
2339
2340 default:
2341 appctx->st2 = STAT_ST_FIN;
2342 return 1;
2343 }
2344}
2345
2346/* register cli keywords */
Christopher Fauletff88efb2017-10-03 16:00:57 +02002347static struct cli_kw_list cli_kws = {{ }, {
2348 { { "show", "resolvers", NULL }, "show resolvers [id]: dumps counters from all resolvers section and\n"
2349 " associated name servers",
2350 cli_parse_stat_resolvers, cli_io_handler_dump_resolvers_to_buffer },
2351 {{},}
2352 }
2353};
William Lallemand69e96442016-11-19 00:58:54 +01002354
Willy Tarreau0108d902018-11-25 19:14:37 +01002355INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
William Lallemand69e96442016-11-19 00:58:54 +01002356
Baptiste Assmann333939c2019-01-21 08:34:50 +01002357/*
2358 * Prepare <rule> for hostname resolution.
2359 * Returns -1 in case of any allocation failure, 0 if not.
2360 * On error, a global failure counter is also incremented.
2361 */
2362static int action_prepare_for_resolution(struct stream *stream, const char *hostname)
2363{
2364 char *hostname_dn;
2365 int hostname_len, hostname_dn_len;
2366 struct buffer *tmp = get_trash_chunk();
2367
2368 if (!hostname)
2369 return 0;
2370
2371 hostname_len = strlen(hostname);
2372 hostname_dn = tmp->area;
2373 hostname_dn_len = dns_str_to_dn_label(hostname, hostname_len + 1,
2374 hostname_dn, tmp->size);
2375 if (hostname_dn_len == -1)
2376 goto err;
2377
2378
2379 stream->dns_ctx.hostname_dn = strdup(hostname_dn);
2380 stream->dns_ctx.hostname_dn_len = hostname_dn_len;
2381 if (!stream->dns_ctx.hostname_dn)
2382 goto err;
2383
2384 return 0;
2385
2386 err:
2387 free(stream->dns_ctx.hostname_dn); stream->dns_ctx.hostname_dn = NULL;
2388 dns_failed_resolutions += 1;
2389 return -1;
2390}
2391
2392
2393/*
2394 * Execute the "do-resolution" action. May be called from {tcp,http}request.
2395 */
2396enum act_return dns_action_do_resolve(struct act_rule *rule, struct proxy *px,
2397 struct session *sess, struct stream *s, int flags)
2398{
Baptiste Assmann333939c2019-01-21 08:34:50 +01002399 struct dns_resolution *resolution;
Willy Tarreau45726fd2019-07-17 10:38:45 +02002400 struct sample *smp;
2401 char *fqdn;
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002402 struct dns_requester *req;
2403 struct dns_resolvers *resolvers;
2404 struct dns_resolution *res;
2405 int exp;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002406
2407 /* we have a response to our DNS resolution */
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002408 use_cache:
Baptiste Assmann333939c2019-01-21 08:34:50 +01002409 if (s->dns_ctx.dns_requester && s->dns_ctx.dns_requester->resolution != NULL) {
2410 resolution = s->dns_ctx.dns_requester->resolution;
Baptiste Assmann4c52e4b2019-10-01 15:32:40 +02002411 if (resolution->step == RSLV_STEP_RUNNING) {
2412 return ACT_RET_YIELD;
2413 }
Baptiste Assmann333939c2019-01-21 08:34:50 +01002414 if (resolution->step == RSLV_STEP_NONE) {
2415 /* We update the variable only if we have a valid response. */
2416 if (resolution->status == RSLV_STATUS_VALID) {
2417 struct sample smp;
2418 short ip_sin_family = 0;
2419 void *ip = NULL;
2420
Christopher Fauleta4168432020-01-24 18:08:42 +01002421 dns_get_ip_from_response(&resolution->response, rule->arg.dns.dns_opts, NULL,
Baptiste Assmann333939c2019-01-21 08:34:50 +01002422 0, &ip, &ip_sin_family, NULL);
2423
2424 switch (ip_sin_family) {
2425 case AF_INET:
2426 smp.data.type = SMP_T_IPV4;
2427 memcpy(&smp.data.u.ipv4, ip, 4);
2428 break;
2429 case AF_INET6:
2430 smp.data.type = SMP_T_IPV6;
2431 memcpy(&smp.data.u.ipv6, ip, 16);
2432 break;
2433 default:
2434 ip = NULL;
2435 }
2436
2437 if (ip) {
2438 smp.px = px;
2439 smp.sess = sess;
2440 smp.strm = s;
2441
2442 vars_set_by_name(rule->arg.dns.varname, strlen(rule->arg.dns.varname), &smp);
2443 }
2444 }
2445 }
2446
2447 free(s->dns_ctx.hostname_dn); s->dns_ctx.hostname_dn = NULL;
2448 s->dns_ctx.hostname_dn_len = 0;
2449 dns_unlink_resolution(s->dns_ctx.dns_requester);
2450
2451 pool_free(dns_requester_pool, s->dns_ctx.dns_requester);
2452 s->dns_ctx.dns_requester = NULL;
2453
2454 return ACT_RET_CONT;
2455 }
2456
2457 /* need to configure and start a new DNS resolution */
Willy Tarreau45726fd2019-07-17 10:38:45 +02002458 smp = sample_fetch_as_type(px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.dns.expr, SMP_T_STR);
2459 if (smp == NULL)
2460 return ACT_RET_CONT;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002461
Willy Tarreau45726fd2019-07-17 10:38:45 +02002462 fqdn = smp->data.u.str.area;
2463 if (action_prepare_for_resolution(s, fqdn) == -1)
Christopher Faulet13403762019-12-13 09:01:57 +01002464 return ACT_RET_CONT; /* on error, ignore the action */
Baptiste Assmann333939c2019-01-21 08:34:50 +01002465
Willy Tarreau45726fd2019-07-17 10:38:45 +02002466 s->dns_ctx.parent = rule;
2467 dns_link_resolution(s, OBJ_TYPE_STREAM, 0);
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002468
2469 /* Check if there is a fresh enough response in the cache of our associated resolution */
2470 req = s->dns_ctx.dns_requester;
2471 if (!req || !req->resolution) {
2472 dns_trigger_resolution(s->dns_ctx.dns_requester);
2473 return ACT_RET_YIELD;
2474 }
2475 res = req->resolution;
2476 resolvers = res->resolvers;
2477
2478 exp = tick_add(res->last_resolution, resolvers->hold.valid);
2479 if (resolvers->t && res->status == RSLV_STATUS_VALID && tick_isset(res->last_resolution)
2480 && !tick_is_expired(exp, now_ms)) {
2481 goto use_cache;
2482 }
2483
Willy Tarreau45726fd2019-07-17 10:38:45 +02002484 dns_trigger_resolution(s->dns_ctx.dns_requester);
Baptiste Assmann333939c2019-01-21 08:34:50 +01002485 return ACT_RET_YIELD;
2486}
2487
Christopher Faulet3b2bb632020-01-24 18:12:58 +01002488static void release_dns_action(struct act_rule *rule)
2489{
2490 release_sample_expr(rule->arg.dns.expr);
2491 free(rule->arg.dns.varname);
2492 free(rule->arg.dns.resolvers_id);
2493 free(rule->arg.dns.dns_opts);
2494}
2495
Baptiste Assmann333939c2019-01-21 08:34:50 +01002496
2497/* parse "do-resolve" action
2498 * This action takes the following arguments:
2499 * do-resolve(<varName>,<resolversSectionName>,<resolvePrefer>) <expr>
2500 *
2501 * - <varName> is the variable name where the result of the DNS resolution will be stored
2502 * (mandatory)
2503 * - <resolversSectionName> is the name of the resolvers section to use to perform the resolution
2504 * (mandatory)
2505 * - <resolvePrefer> can be either 'ipv4' or 'ipv6' and is the IP family we would like to resolve first
2506 * (optional), defaults to ipv6
2507 * - <expr> is an HAProxy expression used to fetch the name to be resolved
2508 */
2509enum act_parse_ret dns_parse_do_resolve(const char **args, int *orig_arg, struct proxy *px, struct act_rule *rule, char **err)
2510{
2511 int cur_arg;
2512 struct sample_expr *expr;
2513 unsigned int where;
2514 const char *beg, *end;
2515
2516 /* orig_arg points to the first argument, but we need to analyse the command itself first */
2517 cur_arg = *orig_arg - 1;
2518
2519 /* locate varName, which is mandatory */
2520 beg = strchr(args[cur_arg], '(');
2521 if (beg == NULL)
2522 goto do_resolve_parse_error;
2523 beg = beg + 1; /* beg should points to the first character after opening parenthesis '(' */
2524 end = strchr(beg, ',');
2525 if (end == NULL)
2526 goto do_resolve_parse_error;
2527 rule->arg.dns.varname = my_strndup(beg, end - beg);
2528 if (rule->arg.dns.varname == NULL)
2529 goto do_resolve_parse_error;
2530
2531
2532 /* locate resolversSectionName, which is mandatory.
2533 * Since next parameters are optional, the delimiter may be comma ','
2534 * or closing parenthesis ')'
2535 */
2536 beg = end + 1;
2537 end = strchr(beg, ',');
2538 if (end == NULL)
2539 end = strchr(beg, ')');
2540 if (end == NULL)
2541 goto do_resolve_parse_error;
2542 rule->arg.dns.resolvers_id = my_strndup(beg, end - beg);
2543 if (rule->arg.dns.resolvers_id == NULL)
2544 goto do_resolve_parse_error;
2545
2546
Christopher Fauleta4168432020-01-24 18:08:42 +01002547 rule->arg.dns.dns_opts = calloc(1, sizeof(*rule->arg.dns.dns_opts));
2548 if (rule->arg.dns.dns_opts == NULL)
2549 goto do_resolve_parse_error;
2550
Baptiste Assmann333939c2019-01-21 08:34:50 +01002551 /* Default priority is ipv6 */
Christopher Fauleta4168432020-01-24 18:08:42 +01002552 rule->arg.dns.dns_opts->family_prio = AF_INET6;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002553
2554 /* optional arguments accepted for now:
2555 * ipv4 or ipv6
2556 */
2557 while (*end != ')') {
2558 beg = end + 1;
2559 end = strchr(beg, ',');
2560 if (end == NULL)
2561 end = strchr(beg, ')');
2562 if (end == NULL)
2563 goto do_resolve_parse_error;
2564
2565 if (strncmp(beg, "ipv4", end - beg) == 0) {
Christopher Fauleta4168432020-01-24 18:08:42 +01002566 rule->arg.dns.dns_opts->family_prio = AF_INET;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002567 }
2568 else if (strncmp(beg, "ipv6", end - beg) == 0) {
Christopher Fauleta4168432020-01-24 18:08:42 +01002569 rule->arg.dns.dns_opts->family_prio = AF_INET6;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002570 }
2571 else {
2572 goto do_resolve_parse_error;
2573 }
2574 }
2575
2576 cur_arg = cur_arg + 1;
2577
Willy Tarreaue3b57bf2020-02-14 16:50:14 +01002578 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args, NULL);
Baptiste Assmann333939c2019-01-21 08:34:50 +01002579 if (!expr)
2580 goto do_resolve_parse_error;
2581
2582
2583 where = 0;
2584 if (px->cap & PR_CAP_FE)
2585 where |= SMP_VAL_FE_HRQ_HDR;
2586 if (px->cap & PR_CAP_BE)
2587 where |= SMP_VAL_BE_HRQ_HDR;
2588
2589 if (!(expr->fetch->val & where)) {
2590 memprintf(err,
2591 "fetch method '%s' extracts information from '%s', none of which is available here",
2592 args[cur_arg-1], sample_src_names(expr->fetch->use));
2593 free(expr);
2594 return ACT_RET_PRS_ERR;
2595 }
2596 rule->arg.dns.expr = expr;
2597 rule->action = ACT_CUSTOM;
2598 rule->action_ptr = dns_action_do_resolve;
2599 *orig_arg = cur_arg;
2600
2601 rule->check_ptr = check_action_do_resolve;
Christopher Faulet3b2bb632020-01-24 18:12:58 +01002602 rule->release_ptr = release_dns_action;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002603
2604 return ACT_RET_PRS_OK;
2605
2606 do_resolve_parse_error:
2607 free(rule->arg.dns.varname); rule->arg.dns.varname = NULL;
2608 free(rule->arg.dns.resolvers_id); rule->arg.dns.resolvers_id = NULL;
2609 memprintf(err, "Can't parse '%s'. Expects 'do-resolve(<varname>,<resolvers>[,<options>]) <expr>'. Available options are 'ipv4' and 'ipv6'",
2610 args[cur_arg]);
2611 return ACT_RET_PRS_ERR;
2612}
2613
2614static struct action_kw_list http_req_kws = { { }, {
2615 { "do-resolve", dns_parse_do_resolve, 1 },
2616 { /* END */ }
2617}};
2618
2619INITCALL1(STG_REGISTER, http_req_keywords_register, &http_req_kws);
2620
2621static struct action_kw_list tcp_req_cont_actions = {ILH, {
2622 { "do-resolve", dns_parse_do_resolve, 1 },
2623 { /* END */ }
2624}};
2625
2626INITCALL1(STG_REGISTER, tcp_req_cont_keywords_register, &tcp_req_cont_actions);
2627
2628/* Check an "http-request do-resolve" action.
2629 *
2630 * The function returns 1 in success case, otherwise, it returns 0 and err is
2631 * filled.
2632 */
2633int check_action_do_resolve(struct act_rule *rule, struct proxy *px, char **err)
2634{
2635 struct dns_resolvers *resolvers = NULL;
2636
2637 if (rule->arg.dns.resolvers_id == NULL) {
2638 memprintf(err,"Proxy '%s': %s", px->id, "do-resolve action without resolvers");
2639 return 0;
2640 }
2641
2642 resolvers = find_resolvers_by_id(rule->arg.dns.resolvers_id);
2643 if (resolvers == NULL) {
2644 memprintf(err,"Can't find resolvers section '%s' for do-resolve action", rule->arg.dns.resolvers_id);
2645 return 0;
2646 }
2647 rule->arg.dns.resolvers = resolvers;
2648
2649 return 1;
2650}
2651
Willy Tarreau172f5ce2018-11-26 11:21:50 +01002652REGISTER_POST_DEINIT(dns_deinit);
Willy Tarreaue6552512018-11-26 11:33:13 +01002653REGISTER_CONFIG_POSTPARSER("dns runtime resolver", dns_finalize_config);