blob: 90efdad340e860c1919f7106c0a14d4004aa5d45 [file] [log] [blame]
Baptiste Assmann325137d2015-04-13 23:40:55 +02001/*
2 * Name server resolution
3 *
4 * Copyright 2014 Baptiste Assmann <bedis9@gmail.com>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <errno.h>
14#include <fcntl.h>
15#include <stdio.h>
16#include <stdlib.h>
17#include <string.h>
18#include <unistd.h>
19
20#include <sys/types.h>
21
Willy Tarreau122eba92020-06-04 10:15:32 +020022#include <haproxy/action.h>
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020023#include <haproxy/api.h>
Willy Tarreau6be78492020-06-05 00:00:29 +020024#include <haproxy/cfgparse.h>
Willy Tarreauf1d32c42020-06-04 21:07:02 +020025#include <haproxy/channel.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020026#include <haproxy/check.h>
Willy Tarreau83487a82020-06-04 20:19:54 +020027#include <haproxy/cli.h>
Willy Tarreau7c18b542020-06-11 09:23:02 +020028#include <haproxy/dgram.h>
Willy Tarreaueb92deb2020-06-04 10:53:16 +020029#include <haproxy/dns.h>
Willy Tarreau8d366972020-05-27 16:10:29 +020030#include <haproxy/errors.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020031#include <haproxy/fd.h>
32#include <haproxy/global.h>
Willy Tarreauc761f842020-06-04 11:40:28 +020033#include <haproxy/http_rules.h>
Willy Tarreauaeed4a82020-06-04 22:01:04 +020034#include <haproxy/log.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020035#include <haproxy/net_helper.h>
Willy Tarreaua264d962020-06-04 22:29:18 +020036#include <haproxy/proxy.h>
Willy Tarreaue6ce10b2020-06-04 15:33:47 +020037#include <haproxy/sample.h>
Willy Tarreau1e56f922020-06-04 23:20:13 +020038#include <haproxy/server.h>
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +020039#include <haproxy/stats.h>
Willy Tarreau5e539c92020-06-04 20:45:39 +020040#include <haproxy/stream_interface.h>
Willy Tarreaucea0e1b2020-06-04 17:25:40 +020041#include <haproxy/task.h>
Willy Tarreau8b550af2020-06-04 17:42:48 +020042#include <haproxy/tcp_rules.h>
Willy Tarreauc2f7c582020-06-02 18:15:32 +020043#include <haproxy/ticks.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020044#include <haproxy/time.h>
Willy Tarreaua1718922020-06-04 16:25:31 +020045#include <haproxy/vars.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020046
Baptiste Assmann325137d2015-04-13 23:40:55 +020047
Christopher Faulet67957bd2017-09-27 11:00:59 +020048struct list dns_resolvers = LIST_HEAD_INIT(dns_resolvers);
49struct list dns_srvrq_list = LIST_HEAD_INIT(dns_srvrq_list);
Baptiste Assmann325137d2015-04-13 23:40:55 +020050
Tim Duesterhusfcac33d2020-01-18 02:04:12 +010051static THREAD_LOCAL uint64_t dns_query_id_seed = 0; /* random seed */
Willy Tarreau8ceae722018-11-26 11:58:30 +010052
53DECLARE_STATIC_POOL(dns_answer_item_pool, "dns_answer_item", sizeof(struct dns_answer_item));
54DECLARE_STATIC_POOL(dns_resolution_pool, "dns_resolution", sizeof(struct dns_resolution));
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +010055DECLARE_POOL(dns_requester_pool, "dns_requester", sizeof(struct dns_requester));
Willy Tarreau8ceae722018-11-26 11:58:30 +010056
Christopher Faulet67957bd2017-09-27 11:00:59 +020057static unsigned int resolution_uuid = 1;
Baptiste Assmann333939c2019-01-21 08:34:50 +010058unsigned int dns_failed_resolutions = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020059
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +020060enum {
61 DNS_STAT_ID,
62 DNS_STAT_SND_ERROR,
63 DNS_STAT_VALID,
64 DNS_STAT_UPDATE,
65 DNS_STAT_CNAME,
66 DNS_STAT_CNAME_ERROR,
67 DNS_STAT_ANY_ERR,
68 DNS_STAT_NX,
69 DNS_STAT_TIMEOUT,
70 DNS_STAT_REFUSED,
71 DNS_STAT_OTHER,
72 DNS_STAT_INVALID,
73 DNS_STAT_TOO_BIG,
74 DNS_STAT_TRUNCATED,
75 DNS_STAT_OUTDATED,
76 DNS_STAT_END,
77};
78
79static struct name_desc dns_stats[] = {
80 [DNS_STAT_ID] = { .name = "id", .desc = "ID" },
81 [DNS_STAT_SND_ERROR] = { .name = "send_error", .desc = "Send error" },
82 [DNS_STAT_VALID] = { .name = "valid", .desc = "Valid" },
83 [DNS_STAT_UPDATE] = { .name = "update", .desc = "Update" },
84 [DNS_STAT_CNAME] = { .name = "cname", .desc = "CNAME" },
85 [DNS_STAT_CNAME_ERROR] = { .name = "cname_error", .desc = "CNAME error" },
86 [DNS_STAT_ANY_ERR] = { .name = "any_err", .desc = "Any errors" },
87 [DNS_STAT_NX] = { .name = "nx", .desc = "NX" },
88 [DNS_STAT_TIMEOUT] = { .name = "timeout", .desc = "Timeout" },
89 [DNS_STAT_REFUSED] = { .name = "refused", .desc = "Refused" },
90 [DNS_STAT_OTHER] = { .name = "other", .desc = "Other" },
91 [DNS_STAT_INVALID] = { .name = "invalid", .desc = "Invalid" },
92 [DNS_STAT_TOO_BIG] = { .name = "too_big", .desc = "Too big" },
93 [DNS_STAT_TRUNCATED] = { .name = "truncated", .desc = "Truncated" },
94 [DNS_STAT_OUTDATED] = { .name = "outdated", .desc = "Outdated" },
95};
96
97static struct dns_counters dns_counters;
98
99static void dns_fill_stats(void *d, struct field *stats)
100{
101 struct dns_counters *counters = d;
102 stats[DNS_STAT_ID] = mkf_str(FO_CONFIG, counters->id);
103 stats[DNS_STAT_SND_ERROR] = mkf_u64(FN_GAUGE, counters->snd_error);
104 stats[DNS_STAT_VALID] = mkf_u64(FN_GAUGE, counters->valid);
105 stats[DNS_STAT_UPDATE] = mkf_u64(FN_GAUGE, counters->update);
106 stats[DNS_STAT_CNAME] = mkf_u64(FN_GAUGE, counters->cname);
107 stats[DNS_STAT_CNAME_ERROR] = mkf_u64(FN_GAUGE, counters->cname_error);
108 stats[DNS_STAT_ANY_ERR] = mkf_u64(FN_GAUGE, counters->any_err);
109 stats[DNS_STAT_NX] = mkf_u64(FN_GAUGE, counters->nx);
110 stats[DNS_STAT_TIMEOUT] = mkf_u64(FN_GAUGE, counters->timeout);
111 stats[DNS_STAT_REFUSED] = mkf_u64(FN_GAUGE, counters->refused);
112 stats[DNS_STAT_OTHER] = mkf_u64(FN_GAUGE, counters->other);
113 stats[DNS_STAT_INVALID] = mkf_u64(FN_GAUGE, counters->invalid);
114 stats[DNS_STAT_TOO_BIG] = mkf_u64(FN_GAUGE, counters->too_big);
115 stats[DNS_STAT_TRUNCATED] = mkf_u64(FN_GAUGE, counters->truncated);
116 stats[DNS_STAT_OUTDATED] = mkf_u64(FN_GAUGE, counters->outdated);
117}
118
119static struct stats_module dns_stats_module = {
120 .name = "dns",
121 .domain_flags = STATS_DOMAIN_DNS << STATS_DOMAIN,
122 .fill_stats = dns_fill_stats,
123 .stats = dns_stats,
124 .stats_count = DNS_STAT_END,
125 .counters = &dns_counters,
126 .counters_size = sizeof(dns_counters),
127 .clearable = 0,
128};
129
130INITCALL1(STG_REGISTER, stats_register_module, &dns_stats_module);
131
Christopher Faulet67957bd2017-09-27 11:00:59 +0200132/* Returns a pointer to the resolvers matching the id <id>. NULL is returned if
133 * no match is found.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200134 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200135struct dns_resolvers *find_resolvers_by_id(const char *id)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200136{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200137 struct dns_resolvers *res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200138
Christopher Faulet67957bd2017-09-27 11:00:59 +0200139 list_for_each_entry(res, &dns_resolvers, list) {
140 if (!strcmp(res->id, id))
141 return res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200142 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200143 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200144}
145
Olivier Houchardb17b8842020-04-01 18:30:27 +0200146/* Compare hostnames in a case-insensitive way .
147 * Returns 0 if they are the same, non-zero otherwise
148 */
149static __inline int dns_hostname_cmp(const char *name1, const char *name2, int len)
150{
151 int i;
152
153 for (i = 0; i < len; i++)
Willy Tarreauf278eec2020-07-05 21:46:32 +0200154 if (tolower((unsigned char)name1[i]) != tolower((unsigned char)name2[i]))
Olivier Houchardb17b8842020-04-01 18:30:27 +0200155 return -1;
156 return 0;
157}
158
Christopher Faulet67957bd2017-09-27 11:00:59 +0200159/* Returns a pointer on the SRV request matching the name <name> for the proxy
160 * <px>. NULL is returned if no match is found.
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200161 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200162struct dns_srvrq *find_srvrq_by_name(const char *name, struct proxy *px)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200163{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200164 struct dns_srvrq *srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200165
Christopher Faulet67957bd2017-09-27 11:00:59 +0200166 list_for_each_entry(srvrq, &dns_srvrq_list, list) {
167 if (srvrq->proxy == px && !strcmp(srvrq->name, name))
168 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200169 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200170 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200171}
172
Christopher Faulet67957bd2017-09-27 11:00:59 +0200173/* Allocates a new SRVRQ for the given server with the name <fqdn>. It returns
174 * NULL if an error occurred. */
175struct dns_srvrq *new_dns_srvrq(struct server *srv, char *fqdn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200176{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200177 struct proxy *px = srv->proxy;
178 struct dns_srvrq *srvrq = NULL;
179 int fqdn_len, hostname_dn_len;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200180
Christopher Faulet67957bd2017-09-27 11:00:59 +0200181 fqdn_len = strlen(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200182 hostname_dn_len = dns_str_to_dn_label(fqdn, fqdn_len + 1, trash.area,
183 trash.size);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200184 if (hostname_dn_len == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100185 ha_alert("config : %s '%s', server '%s': failed to parse FQDN '%s'\n",
186 proxy_type_str(px), px->id, srv->id, fqdn);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200187 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200188 }
189
Christopher Faulet67957bd2017-09-27 11:00:59 +0200190 if ((srvrq = calloc(1, sizeof(*srvrq))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100191 ha_alert("config : %s '%s', server '%s': out of memory\n",
192 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200193 goto err;
194 }
195 srvrq->obj_type = OBJ_TYPE_SRVRQ;
196 srvrq->proxy = px;
197 srvrq->name = strdup(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200198 srvrq->hostname_dn = strdup(trash.area);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200199 srvrq->hostname_dn_len = hostname_dn_len;
200 if (!srvrq->name || !srvrq->hostname_dn) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100201 ha_alert("config : %s '%s', server '%s': out of memory\n",
202 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200203 goto err;
204 }
205 LIST_ADDQ(&dns_srvrq_list, &srvrq->list);
206 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200207
Christopher Faulet67957bd2017-09-27 11:00:59 +0200208 err:
209 if (srvrq) {
210 free(srvrq->name);
211 free(srvrq->hostname_dn);
212 free(srvrq);
213 }
214 return NULL;
215}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200216
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200217
Christopher Faulet67957bd2017-09-27 11:00:59 +0200218/* 2 bytes random generator to generate DNS query ID */
219static inline uint16_t dns_rnd16(void)
220{
Christopher Fauletb2812a62017-10-04 16:17:58 +0200221 if (!dns_query_id_seed)
222 dns_query_id_seed = now_ms;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200223 dns_query_id_seed ^= dns_query_id_seed << 13;
224 dns_query_id_seed ^= dns_query_id_seed >> 7;
225 dns_query_id_seed ^= dns_query_id_seed << 17;
226 return dns_query_id_seed;
227}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200228
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200229
Christopher Faulet67957bd2017-09-27 11:00:59 +0200230static inline int dns_resolution_timeout(struct dns_resolution *res)
231{
Baptiste Assmannf50e1ac2019-11-07 11:02:18 +0100232 return res->resolvers->timeout.resolve;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200233}
234
Christopher Faulet67957bd2017-09-27 11:00:59 +0200235/* Updates a resolvers' task timeout for next wake up and queue it */
236static void dns_update_resolvers_timeout(struct dns_resolvers *resolvers)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200237{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200238 struct dns_resolution *res;
239 int next;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200240
Christopher Faulet67957bd2017-09-27 11:00:59 +0200241 next = tick_add(now_ms, resolvers->timeout.resolve);
242 if (!LIST_ISEMPTY(&resolvers->resolutions.curr)) {
243 res = LIST_NEXT(&resolvers->resolutions.curr, struct dns_resolution *, list);
244 next = MIN(next, tick_add(res->last_query, resolvers->timeout.retry));
245 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200246
Christopher Faulet67957bd2017-09-27 11:00:59 +0200247 list_for_each_entry(res, &resolvers->resolutions.wait, list)
248 next = MIN(next, tick_add(res->last_resolution, dns_resolution_timeout(res)));
Baptiste Assmann325137d2015-04-13 23:40:55 +0200249
Christopher Faulet67957bd2017-09-27 11:00:59 +0200250 resolvers->t->expire = next;
251 task_queue(resolvers->t);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200252}
253
Christopher Faulet67957bd2017-09-27 11:00:59 +0200254/* Opens an UDP socket on the namesaver's IP/Port, if required. Returns 0 on
255 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200256 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200257static int dns_connect_namesaver(struct dns_nameserver *ns)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200258{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200259 struct dgram_conn *dgram = ns->dgram;
260 int fd;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200261
Christopher Faulet67957bd2017-09-27 11:00:59 +0200262 /* Already connected */
263 if (dgram->t.sock.fd != -1)
264 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200265
Christopher Faulet67957bd2017-09-27 11:00:59 +0200266 /* Create an UDP socket and connect it on the nameserver's IP/Port */
267 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
268 send_log(NULL, LOG_WARNING,
269 "DNS : resolvers '%s': can't create socket for nameserver '%s'.\n",
270 ns->resolvers->id, ns->id);
271 return -1;
272 }
273 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
274 send_log(NULL, LOG_WARNING,
275 "DNS : resolvers '%s': can't connect socket for nameserver '%s'.\n",
276 ns->resolvers->id, ns->id);
277 close(fd);
278 return -1;
279 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200280
Christopher Faulet67957bd2017-09-27 11:00:59 +0200281 /* Make the socket non blocking */
282 fcntl(fd, F_SETFL, O_NONBLOCK);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200283
Christopher Faulet67957bd2017-09-27 11:00:59 +0200284 /* Add the fd in the fd list and update its parameters */
285 dgram->t.sock.fd = fd;
Willy Tarreaua9786b62018-01-25 07:22:13 +0100286 fd_insert(fd, dgram, dgram_fd_handler, MAX_THREADS_MASK);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200287 fd_want_recv(fd);
288 return 0;
289}
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200290
Christopher Faulet67957bd2017-09-27 11:00:59 +0200291/* Forges a DNS query. It needs the following information from the caller:
292 * - <query_id> : the DNS query id corresponding to this query
293 * - <query_type> : DNS_RTYPE_* request DNS record type (A, AAAA, ANY...)
294 * - <hostname_dn> : hostname in domain name format
295 * - <hostname_dn_len> : length of <hostname_dn>
296 *
297 * To store the query, the caller must pass a buffer <buf> and its size
298 * <bufsize>. It returns the number of written bytes in success, -1 if <buf> is
299 * too short.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200300 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200301static int dns_build_query(int query_id, int query_type, unsigned int accepted_payload_size,
302 char *hostname_dn, int hostname_dn_len, char *buf, int bufsize)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200303{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200304 struct dns_header dns_hdr;
305 struct dns_question qinfo;
306 struct dns_additional_record edns;
307 char *p = buf;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200308
Christopher Faulet67957bd2017-09-27 11:00:59 +0200309 if (sizeof(dns_hdr) + sizeof(qinfo) + sizeof(edns) + hostname_dn_len >= bufsize)
310 return -1;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200311
Christopher Faulet67957bd2017-09-27 11:00:59 +0200312 memset(buf, 0, bufsize);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200313
Christopher Faulet67957bd2017-09-27 11:00:59 +0200314 /* Set dns query headers */
315 dns_hdr.id = (unsigned short) htons(query_id);
316 dns_hdr.flags = htons(0x0100); /* qr=0, opcode=0, aa=0, tc=0, rd=1, ra=0, z=0, rcode=0 */
317 dns_hdr.qdcount = htons(1); /* 1 question */
318 dns_hdr.ancount = 0;
319 dns_hdr.nscount = 0;
320 dns_hdr.arcount = htons(1);
321 memcpy(p, &dns_hdr, sizeof(dns_hdr));
322 p += sizeof(dns_hdr);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200323
Christopher Faulet67957bd2017-09-27 11:00:59 +0200324 /* Set up query hostname */
325 memcpy(p, hostname_dn, hostname_dn_len);
326 p += hostname_dn_len;
327 *p++ = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200328
Christopher Faulet67957bd2017-09-27 11:00:59 +0200329 /* Set up query info (type and class) */
330 qinfo.qtype = htons(query_type);
331 qinfo.qclass = htons(DNS_RCLASS_IN);
332 memcpy(p, &qinfo, sizeof(qinfo));
333 p += sizeof(qinfo);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200334
Christopher Faulet67957bd2017-09-27 11:00:59 +0200335 /* Set the DNS extension */
336 edns.name = 0;
337 edns.type = htons(DNS_RTYPE_OPT);
338 edns.udp_payload_size = htons(accepted_payload_size);
339 edns.extension = 0;
340 edns.data_length = 0;
341 memcpy(p, &edns, sizeof(edns));
342 p += sizeof(edns);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200343
Christopher Faulet67957bd2017-09-27 11:00:59 +0200344 return (p - buf);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200345}
346
Christopher Faulet67957bd2017-09-27 11:00:59 +0200347/* Sends a DNS query to resolvers associated to a resolution. It returns 0 on
348 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200349 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200350static int dns_send_query(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200351{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200352 struct dns_resolvers *resolvers = resolution->resolvers;
353 struct dns_nameserver *ns;
Willy Tarreau0eae6322019-12-20 11:18:54 +0100354 int len;
355
356 /* Update resolution */
357 resolution->nb_queries = 0;
358 resolution->nb_responses = 0;
359 resolution->last_query = now_ms;
360
361 len = dns_build_query(resolution->query_id, resolution->query_type,
362 resolvers->accepted_payload_size,
363 resolution->hostname_dn, resolution->hostname_dn_len,
364 trash.area, trash.size);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200365
Christopher Faulet67957bd2017-09-27 11:00:59 +0200366 list_for_each_entry(ns, &resolvers->nameservers, list) {
367 int fd = ns->dgram->t.sock.fd;
Willy Tarreau0eae6322019-12-20 11:18:54 +0100368 int ret;
369
Christopher Faulet67957bd2017-09-27 11:00:59 +0200370 if (fd == -1) {
371 if (dns_connect_namesaver(ns) == -1)
372 continue;
373 fd = ns->dgram->t.sock.fd;
374 resolvers->nb_nameservers++;
375 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200376
Willy Tarreau0eae6322019-12-20 11:18:54 +0100377 if (len < 0)
378 goto snd_error;
379
380 ret = send(fd, trash.area, len, 0);
381 if (ret == len) {
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +0200382 ns->counters->sent++;
Willy Tarreau0eae6322019-12-20 11:18:54 +0100383 resolution->nb_queries++;
384 continue;
385 }
386
387 if (ret == -1 && errno == EAGAIN) {
388 /* retry once the socket is ready */
389 fd_cant_send(fd);
390 continue;
391 }
392
393 snd_error:
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +0200394 ns->counters->snd_error++;
Willy Tarreau0eae6322019-12-20 11:18:54 +0100395 resolution->nb_queries++;
396 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200397
Christopher Faulet67957bd2017-09-27 11:00:59 +0200398 /* Push the resolution at the end of the active list */
399 LIST_DEL(&resolution->list);
400 LIST_ADDQ(&resolvers->resolutions.curr, &resolution->list);
401 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200402}
403
Christopher Faulet67957bd2017-09-27 11:00:59 +0200404/* Prepares and sends a DNS resolution. It returns 1 if the query was sent, 0 if
405 * skipped and -1 if an error occurred.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200406 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200407static int
408dns_run_resolution(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200409{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200410 struct dns_resolvers *resolvers = resolution->resolvers;
411 int query_id, i;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200412
Christopher Faulet67957bd2017-09-27 11:00:59 +0200413 /* Avoid sending requests for resolutions that don't yet have an
414 * hostname, ie resolutions linked to servers that do not yet have an
415 * fqdn */
416 if (!resolution->hostname_dn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200417 return 0;
418
Christopher Faulet67957bd2017-09-27 11:00:59 +0200419 /* Check if a resolution has already been started for this server return
420 * directly to avoid resolution pill up. */
421 if (resolution->step != RSLV_STEP_NONE)
422 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200423
Christopher Faulet67957bd2017-09-27 11:00:59 +0200424 /* Generates a new query id. We try at most 100 times to find a free
425 * query id */
426 for (i = 0; i < 100; ++i) {
427 query_id = dns_rnd16();
428 if (!eb32_lookup(&resolvers->query_ids, query_id))
Olivier Houchard8da5f982017-08-04 18:35:36 +0200429 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200430 query_id = -1;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200431 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200432 if (query_id == -1) {
433 send_log(NULL, LOG_NOTICE,
434 "could not generate a query id for %s, in resolvers %s.\n",
435 resolution->hostname_dn, resolvers->id);
436 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200437 }
438
Christopher Faulet67957bd2017-09-27 11:00:59 +0200439 /* Update resolution parameters */
440 resolution->query_id = query_id;
441 resolution->qid.key = query_id;
442 resolution->step = RSLV_STEP_RUNNING;
443 resolution->query_type = resolution->prefered_query_type;
444 resolution->try = resolvers->resolve_retries;
445 eb32_insert(&resolvers->query_ids, &resolution->qid);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200446
Christopher Faulet67957bd2017-09-27 11:00:59 +0200447 /* Send the DNS query */
448 resolution->try -= 1;
449 dns_send_query(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200450 return 1;
451}
452
Christopher Faulet67957bd2017-09-27 11:00:59 +0200453/* Performs a name resolution for the requester <req> */
454void dns_trigger_resolution(struct dns_requester *req)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200455{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200456 struct dns_resolvers *resolvers;
457 struct dns_resolution *res;
458 int exp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200459
Christopher Faulet67957bd2017-09-27 11:00:59 +0200460 if (!req || !req->resolution)
461 return;
462 res = req->resolution;
463 resolvers = res->resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200464
Christopher Faulet67957bd2017-09-27 11:00:59 +0200465 /* The resolution must not be triggered yet. Use the cached response, if
466 * valid */
467 exp = tick_add(res->last_resolution, resolvers->hold.valid);
Olivier Houchardf3d9e602018-05-22 18:40:07 +0200468 if (resolvers->t && (res->status != RSLV_STATUS_VALID ||
469 !tick_isset(res->last_resolution) || tick_is_expired(exp, now_ms)))
470 task_wakeup(resolvers->t, TASK_WOKEN_OTHER);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200471}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200472
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200473
Christopher Faulet67957bd2017-09-27 11:00:59 +0200474/* Resets some resolution parameters to initial values and also delete the query
475 * ID from the resolver's tree.
476 */
477static void dns_reset_resolution(struct dns_resolution *resolution)
478{
479 /* update resolution status */
480 resolution->step = RSLV_STEP_NONE;
481 resolution->try = 0;
482 resolution->last_resolution = now_ms;
483 resolution->nb_queries = 0;
484 resolution->nb_responses = 0;
485 resolution->query_type = resolution->prefered_query_type;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200486
Christopher Faulet67957bd2017-09-27 11:00:59 +0200487 /* clean up query id */
488 eb32_delete(&resolution->qid);
489 resolution->query_id = 0;
490 resolution->qid.key = 0;
491}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200492
Christopher Faulet67957bd2017-09-27 11:00:59 +0200493/* Returns the query id contained in a DNS response */
494static inline unsigned short dns_response_get_query_id(unsigned char *resp)
495{
496 return resp[0] * 256 + resp[1];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200497}
498
Christopher Faulet67957bd2017-09-27 11:00:59 +0200499
500/* Analyses, re-builds and copies the name <name> from the DNS response packet
501 * <buffer>. <name> must point to the 'data_len' information or pointer 'c0'
502 * for compressed data. The result is copied into <dest>, ensuring we don't
503 * overflow using <dest_len> Returns the number of bytes the caller can move
504 * forward. If 0 it means an error occurred while parsing the name. <offset> is
505 * the number of bytes the caller could move forward.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200506 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200507int dns_read_name(unsigned char *buffer, unsigned char *bufend,
508 unsigned char *name, char *destination, int dest_len,
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100509 int *offset, unsigned int depth)
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200510{
511 int nb_bytes = 0, n = 0;
512 int label_len;
513 unsigned char *reader = name;
514 char *dest = destination;
515
516 while (1) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100517 if (reader >= bufend)
518 goto err;
519
Christopher Faulet67957bd2017-09-27 11:00:59 +0200520 /* Name compression is in use */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200521 if ((*reader & 0xc0) == 0xc0) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100522 if (reader + 1 >= bufend)
523 goto err;
524
Christopher Faulet67957bd2017-09-27 11:00:59 +0200525 /* Must point BEFORE current position */
526 if ((buffer + reader[1]) > reader)
527 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200528
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100529 if (depth++ > 100)
530 goto err;
531
Nikhil Agrawal2fa66c32018-12-20 10:50:59 +0530532 n = dns_read_name(buffer, bufend, buffer + (*reader & 0x3f)*256 + reader[1],
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100533 dest, dest_len - nb_bytes, offset, depth);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200534 if (n == 0)
Christopher Faulet67957bd2017-09-27 11:00:59 +0200535 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200536
Christopher Faulet67957bd2017-09-27 11:00:59 +0200537 dest += n;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200538 nb_bytes += n;
539 goto out;
540 }
541
542 label_len = *reader;
543 if (label_len == 0)
544 goto out;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200545
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200546 /* Check if:
547 * - we won't read outside the buffer
548 * - there is enough place in the destination
549 */
550 if ((reader + label_len >= bufend) || (nb_bytes + label_len >= dest_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +0200551 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200552
553 /* +1 to take label len + label string */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200554 label_len++;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200555
556 memcpy(dest, reader, label_len);
557
Christopher Faulet67957bd2017-09-27 11:00:59 +0200558 dest += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200559 nb_bytes += label_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200560 reader += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200561 }
562
Christopher Faulet67957bd2017-09-27 11:00:59 +0200563 out:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200564 /* offset computation:
565 * parse from <name> until finding either NULL or a pointer "c0xx"
566 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200567 reader = name;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200568 *offset = 0;
569 while (reader < bufend) {
570 if ((reader[0] & 0xc0) == 0xc0) {
571 *offset += 2;
572 break;
573 }
574 else if (*reader == 0) {
575 *offset += 1;
576 break;
577 }
578 *offset += 1;
579 ++reader;
580 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200581 return nb_bytes;
582
Christopher Faulet67957bd2017-09-27 11:00:59 +0200583 err:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200584 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200585}
586
Christopher Faulet67957bd2017-09-27 11:00:59 +0200587/* Checks for any obsolete record, also identify any SRV request, and try to
588 * find a corresponding server.
589*/
590static void dns_check_dns_response(struct dns_resolution *res)
591{
592 struct dns_resolvers *resolvers = res->resolvers;
593 struct dns_requester *req, *reqback;
594 struct dns_answer_item *item, *itemback;
595 struct server *srv;
596 struct dns_srvrq *srvrq;
597
598 list_for_each_entry_safe(item, itemback, &res->response.answer_list, list) {
Christopher Faulet5a891752020-09-08 10:06:01 +0200599 struct dns_answer_item *ar_item = item->ar_item;
600
601 /* clean up obsolete Additional record */
602 if (ar_item && (ar_item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
603 pool_free(dns_answer_item_pool, ar_item);
604 item->ar_item = NULL;
605 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200606
607 /* Remove obsolete items */
608 if ((item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
609 if (item->type != DNS_RTYPE_SRV)
610 goto rm_obselete_item;
611
612 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
613 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
614 continue;
615
616 /* Remove any associated server */
617 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100618 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200619 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
620 item->data_len == srv->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +0200621 !dns_hostname_cmp(srv->hostname_dn, item->target, item->data_len)) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200622 snr_update_srv_status(srv, 1);
623 free(srv->hostname);
624 free(srv->hostname_dn);
625 srv->hostname = NULL;
626 srv->hostname_dn = NULL;
627 srv->hostname_dn_len = 0;
628 dns_unlink_resolution(srv->dns_requester);
629 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100630 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200631 }
632 }
633
634 rm_obselete_item:
635 LIST_DEL(&item->list);
Christopher Faulet5a891752020-09-08 10:06:01 +0200636 if (item->ar_item) {
637 pool_free(dns_answer_item_pool, item->ar_item);
638 item->ar_item = NULL;
639 }
Willy Tarreaubafbe012017-11-24 17:34:44 +0100640 pool_free(dns_answer_item_pool, item);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200641 continue;
642 }
643
644 if (item->type != DNS_RTYPE_SRV)
645 continue;
646
647 /* Now process SRV records */
648 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
649 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
650 continue;
651
652 /* Check if a server already uses that hostname */
653 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100654 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200655 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
656 item->data_len == srv->hostname_dn_len &&
Christopher Fauletd6c6b5f2020-09-08 10:27:24 +0200657 !dns_hostname_cmp(srv->hostname_dn, item->target, item->data_len)) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200658 break;
659 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100660 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200661 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200662
663 /* If not, try to find a server with undefined hostname */
Christopher Fauletd6c6b5f2020-09-08 10:27:24 +0200664 if (!srv) {
665 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
666 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
667 if (srv->srvrq == srvrq && !srv->hostname_dn)
668 break;
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100669 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100670 }
Christopher Fauletd6c6b5f2020-09-08 10:27:24 +0200671 }
Baptiste Assmann13a92322019-06-07 09:40:55 +0200672
Christopher Fauletd6c6b5f2020-09-08 10:27:24 +0200673 /* And update this server, if found (srv is locked here) */
674 if (srv) {
Baptiste Assmann13a92322019-06-07 09:40:55 +0200675 /* Check if an Additional Record is associated to this SRV record.
676 * Perform some sanity checks too to ensure the record can be used.
677 * If all fine, we simply pick up the IP address found and associate
678 * it to the server.
679 */
680 if ((item->ar_item != NULL) &&
681 (item->ar_item->type == DNS_RTYPE_A || item->ar_item->type == DNS_RTYPE_AAAA))
682 {
683
684 switch (item->ar_item->type) {
685 case DNS_RTYPE_A:
Baptiste Assmanncde83032020-08-04 10:54:14 +0200686 update_server_addr(srv, &(((struct sockaddr_in*)&item->ar_item->address)->sin_addr), AF_INET, "DNS additional record");
Baptiste Assmann13a92322019-06-07 09:40:55 +0200687 break;
688 case DNS_RTYPE_AAAA:
Baptiste Assmanncde83032020-08-04 10:54:14 +0200689 update_server_addr(srv, &(((struct sockaddr_in6*)&item->ar_item->address)->sin6_addr), AF_INET6, "DNS additional record");
Baptiste Assmann13a92322019-06-07 09:40:55 +0200690 break;
691 }
692
693 srv->flags |= SRV_F_NO_RESOLUTION;
694 }
695
Christopher Fauletd6c6b5f2020-09-08 10:27:24 +0200696 if (!srv->hostname_dn) {
697 const char *msg = NULL;
698 char hostname[DNS_MAX_NAME_SIZE];
699
700 if (dns_dn_label_to_str(item->target, item->data_len+1,
701 hostname, DNS_MAX_NAME_SIZE) == -1) {
702 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
703 continue;
704 }
705 msg = update_server_fqdn(srv, hostname, "SRV record", 1);
706 if (msg)
707 send_log(srv->proxy, LOG_NOTICE, "%s", msg);
708 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200709
Baptiste Assmann87138c32020-08-04 10:57:21 +0200710 /* now we have an IP address associated to this server, we can update its status */
711 snr_update_srv_status(srv, 0);
712
Christopher Faulet67957bd2017-09-27 11:00:59 +0200713 srv->svc_port = item->port;
714 srv->flags &= ~SRV_F_MAPPORTS;
715 if ((srv->check.state & CHK_ST_CONFIGURED) &&
716 !(srv->flags & SRV_F_CHECKPORT))
717 srv->check.port = item->port;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100718
Daniel Corbettf8716912019-11-17 09:48:56 -0500719 if (!srv->dns_opts.ignore_weight) {
Christopher Fauletd6c6b5f2020-09-08 10:27:24 +0200720 char weight[9];
721 int ha_weight;
722
Daniel Corbettf8716912019-11-17 09:48:56 -0500723 /* DNS weight range if from 0 to 65535
724 * HAProxy weight is from 0 to 256
725 * The rule below ensures that weight 0 is well respected
726 * while allowing a "mapping" from DNS weight into HAProxy's one.
727 */
728 ha_weight = (item->weight + 255) / 256;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100729
Daniel Corbettf8716912019-11-17 09:48:56 -0500730 snprintf(weight, sizeof(weight), "%d", ha_weight);
731 server_parse_weight_change_request(srv, weight);
732 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100733 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200734 }
735 }
736 }
737}
738
739/* Validates that the buffer DNS response provided in <resp> and finishing
740 * before <bufend> is valid from a DNS protocol point of view.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200741 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200742 * The result is stored in <resolution>' response, buf_response,
743 * response_query_records and response_answer_records members.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200744 *
745 * This function returns one of the DNS_RESP_* code to indicate the type of
746 * error found.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200747 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200748static int dns_validate_dns_response(unsigned char *resp, unsigned char *bufend,
749 struct dns_resolution *resolution, int max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200750{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200751 unsigned char *reader;
752 char *previous_dname, tmpname[DNS_MAX_NAME_SIZE];
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200753 int len, flags, offset;
754 int dns_query_record_id;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200755 int nb_saved_records;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200756 struct dns_query_item *dns_query;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200757 struct dns_answer_item *dns_answer_record, *tmp_record;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200758 struct dns_response_packet *dns_p;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200759 int i, found = 0;
Willy Tarreau963f7012020-07-22 17:00:45 +0200760 int cause = DNS_RESP_ERROR;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200761
Christopher Faulet67957bd2017-09-27 11:00:59 +0200762 reader = resp;
763 len = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200764 previous_dname = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200765 dns_query = NULL;
Willy Tarreau963f7012020-07-22 17:00:45 +0200766 dns_answer_record = NULL;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200767
Christopher Faulet67957bd2017-09-27 11:00:59 +0200768 /* Initialization of response buffer and structure */
Baptiste Assmann729c9012017-05-22 15:13:10 +0200769 dns_p = &resolution->response;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200770
771 /* query id */
772 if (reader + 2 >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200773 goto invalid_resp;
774
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200775 dns_p->header.id = reader[0] * 256 + reader[1];
776 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200777
Christopher Faulet67957bd2017-09-27 11:00:59 +0200778 /* Flags and rcode are stored over 2 bytes
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200779 * First byte contains:
780 * - response flag (1 bit)
781 * - opcode (4 bits)
782 * - authoritative (1 bit)
783 * - truncated (1 bit)
784 * - recursion desired (1 bit)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200785 */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200786 if (reader + 2 >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200787 goto invalid_resp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200788
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200789 flags = reader[0] * 256 + reader[1];
790
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200791 if ((flags & DNS_FLAG_REPLYCODE) != DNS_RCODE_NO_ERROR) {
Willy Tarreau963f7012020-07-22 17:00:45 +0200792 if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_NX_DOMAIN) {
793 cause = DNS_RESP_NX_DOMAIN;
794 goto return_error;
795 }
796 else if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_REFUSED) {
797 cause = DNS_RESP_REFUSED;
798 goto return_error;
799 }
800 else {
801 cause = DNS_RESP_ERROR;
802 goto return_error;
803 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200804 }
805
Christopher Faulet67957bd2017-09-27 11:00:59 +0200806 /* Move forward 2 bytes for flags */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200807 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200808
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200809 /* 2 bytes for question count */
810 if (reader + 2 >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200811 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200812 dns_p->header.qdcount = reader[0] * 256 + reader[1];
Christopher Faulet67957bd2017-09-27 11:00:59 +0200813 /* (for now) we send one query only, so we expect only one in the
814 * response too */
Willy Tarreau963f7012020-07-22 17:00:45 +0200815 if (dns_p->header.qdcount != 1) {
816 cause = DNS_RESP_QUERY_COUNT_ERROR;
817 goto return_error;
818 }
819
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200820 if (dns_p->header.qdcount > DNS_MAX_QUERY_RECORDS)
Willy Tarreau963f7012020-07-22 17:00:45 +0200821 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200822 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200823
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200824 /* 2 bytes for answer count */
825 if (reader + 2 >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200826 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200827 dns_p->header.ancount = reader[0] * 256 + reader[1];
Willy Tarreau963f7012020-07-22 17:00:45 +0200828 if (dns_p->header.ancount == 0) {
829 cause = DNS_RESP_ANCOUNT_ZERO;
830 goto return_error;
831 }
832
Christopher Faulet67957bd2017-09-27 11:00:59 +0200833 /* Check if too many records are announced */
Baptiste Assmann9d8dbbc2017-08-18 23:35:08 +0200834 if (dns_p->header.ancount > max_answer_records)
Willy Tarreau963f7012020-07-22 17:00:45 +0200835 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200836 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200837
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200838 /* 2 bytes authority count */
839 if (reader + 2 >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200840 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200841 dns_p->header.nscount = reader[0] * 256 + reader[1];
842 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200843
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200844 /* 2 bytes additional count */
845 if (reader + 2 >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200846 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200847 dns_p->header.arcount = reader[0] * 256 + reader[1];
848 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200849
Christopher Faulet67957bd2017-09-27 11:00:59 +0200850 /* Parsing dns queries */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200851 LIST_INIT(&dns_p->query_list);
852 for (dns_query_record_id = 0; dns_query_record_id < dns_p->header.qdcount; dns_query_record_id++) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200853 /* Use next pre-allocated dns_query_item after ensuring there is
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200854 * still one available.
Christopher Faulet67957bd2017-09-27 11:00:59 +0200855 * It's then added to our packet query list. */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200856 if (dns_query_record_id > DNS_MAX_QUERY_RECORDS)
Willy Tarreau963f7012020-07-22 17:00:45 +0200857 goto invalid_resp;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200858 dns_query = &resolution->response_query_records[dns_query_record_id];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200859 LIST_ADDQ(&dns_p->query_list, &dns_query->list);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200860
Christopher Faulet67957bd2017-09-27 11:00:59 +0200861 /* Name is a NULL terminated string in our case, since we have
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200862 * one query per response and the first one can't be compressed
Christopher Faulet67957bd2017-09-27 11:00:59 +0200863 * (using the 0x0c format) */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200864 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100865 len = dns_read_name(resp, bufend, reader, dns_query->name, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200866
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200867 if (len == 0)
Willy Tarreau963f7012020-07-22 17:00:45 +0200868 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200869
870 reader += offset;
871 previous_dname = dns_query->name;
872
873 /* move forward 2 bytes for question type */
874 if (reader + 2 >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200875 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200876 dns_query->type = reader[0] * 256 + reader[1];
877 reader += 2;
878
879 /* move forward 2 bytes for question class */
880 if (reader + 2 >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200881 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200882 dns_query->class = reader[0] * 256 + reader[1];
883 reader += 2;
884 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200885
Baptiste Assmann251abb92017-08-11 09:58:27 +0200886 /* TRUNCATED flag must be checked after we could read the query type
Christopher Faulet67957bd2017-09-27 11:00:59 +0200887 * because a TRUNCATED SRV query type response can still be exploited */
Willy Tarreau963f7012020-07-22 17:00:45 +0200888 if (dns_query->type != DNS_RTYPE_SRV && flags & DNS_FLAG_TRUNCATED) {
889 cause = DNS_RESP_TRUNCATED;
890 goto return_error;
891 }
Baptiste Assmann251abb92017-08-11 09:58:27 +0200892
Baptiste Assmann325137d2015-04-13 23:40:55 +0200893 /* now parsing response records */
Baptiste Assmann69fce672017-05-04 08:37:45 +0200894 nb_saved_records = 0;
Olivier Houchard8da5f982017-08-04 18:35:36 +0200895 for (i = 0; i < dns_p->header.ancount; i++) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200896 if (reader >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200897 goto invalid_resp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200898
Willy Tarreaubafbe012017-11-24 17:34:44 +0100899 dns_answer_record = pool_alloc(dns_answer_item_pool);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200900 if (dns_answer_record == NULL)
Willy Tarreau963f7012020-07-22 17:00:45 +0200901 goto invalid_resp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200902
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200903 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100904 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200905
Willy Tarreau963f7012020-07-22 17:00:45 +0200906 if (len == 0)
907 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200908
Christopher Faulet67957bd2017-09-27 11:00:59 +0200909 /* Check if the current record dname is valid. previous_dname
910 * points either to queried dname or last CNAME target */
Olivier Houchardb17b8842020-04-01 18:30:27 +0200911 if (dns_query->type != DNS_RTYPE_SRV && dns_hostname_cmp(previous_dname, tmpname, len) != 0) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200912 if (i == 0) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200913 /* First record, means a mismatch issue between
914 * queried dname and dname found in the first
915 * record */
Willy Tarreau963f7012020-07-22 17:00:45 +0200916 goto invalid_resp;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200917 }
918 else {
919 /* If not the first record, this means we have a
Willy Tarreau963f7012020-07-22 17:00:45 +0200920 * CNAME resolution error.
921 */
922 cause = DNS_RESP_CNAME_ERROR;
923 goto return_error;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200924 }
925
Baptiste Assmann325137d2015-04-13 23:40:55 +0200926 }
927
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200928 memcpy(dns_answer_record->name, tmpname, len);
929 dns_answer_record->name[len] = 0;
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200930
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200931 reader += offset;
Willy Tarreau963f7012020-07-22 17:00:45 +0200932 if (reader >= bufend)
933 goto invalid_resp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200934
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200935 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
Willy Tarreau963f7012020-07-22 17:00:45 +0200936 if (reader + 2 > bufend)
937 goto invalid_resp;
938
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200939 dns_answer_record->type = reader[0] * 256 + reader[1];
940 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200941
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200942 /* 2 bytes for class (2) */
Willy Tarreau963f7012020-07-22 17:00:45 +0200943 if (reader + 2 > bufend)
944 goto invalid_resp;
945
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200946 dns_answer_record->class = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200947 reader += 2;
948
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200949 /* 4 bytes for ttl (4) */
Willy Tarreau963f7012020-07-22 17:00:45 +0200950 if (reader + 4 > bufend)
951 goto invalid_resp;
952
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200953 dns_answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
954 + reader[2] * 256 + reader[3];
955 reader += 4;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200956
Christopher Faulet67957bd2017-09-27 11:00:59 +0200957 /* Now reading data len */
Willy Tarreau963f7012020-07-22 17:00:45 +0200958 if (reader + 2 > bufend)
959 goto invalid_resp;
960
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200961 dns_answer_record->data_len = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200962
Christopher Faulet67957bd2017-09-27 11:00:59 +0200963 /* Move forward 2 bytes for data len */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200964 reader += 2;
965
Willy Tarreau963f7012020-07-22 17:00:45 +0200966 if (reader + dns_answer_record->data_len > bufend)
967 goto invalid_resp;
Remi Gacogneefbbdf72018-12-05 17:56:29 +0100968
Christopher Faulet67957bd2017-09-27 11:00:59 +0200969 /* Analyzing record content */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200970 switch (dns_answer_record->type) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200971 case DNS_RTYPE_A:
972 /* ipv4 is stored on 4 bytes */
Willy Tarreau963f7012020-07-22 17:00:45 +0200973 if (dns_answer_record->data_len != 4)
974 goto invalid_resp;
975
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200976 dns_answer_record->address.sa_family = AF_INET;
977 memcpy(&(((struct sockaddr_in *)&dns_answer_record->address)->sin_addr),
978 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200979 break;
980
981 case DNS_RTYPE_CNAME:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200982 /* Check if this is the last record and update the caller about the status:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200983 * no IP could be found and last record was a CNAME. Could be triggered
984 * by a wrong query type
985 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200986 * + 1 because dns_answer_record_id starts at 0
987 * while number of answers is an integer and
988 * starts at 1.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200989 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200990 if (i + 1 == dns_p->header.ancount) {
Willy Tarreau963f7012020-07-22 17:00:45 +0200991 cause = DNS_RESP_CNAME_ERROR;
992 goto return_error;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200993 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200994
995 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100996 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Willy Tarreau963f7012020-07-22 17:00:45 +0200997 if (len == 0)
998 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200999
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001000 memcpy(dns_answer_record->target, tmpname, len);
1001 dns_answer_record->target[len] = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +02001002 previous_dname = dns_answer_record->target;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001003 break;
1004
Olivier Houchard8da5f982017-08-04 18:35:36 +02001005
1006 case DNS_RTYPE_SRV:
Christopher Faulet67957bd2017-09-27 11:00:59 +02001007 /* Answer must contain :
Olivier Houchard8da5f982017-08-04 18:35:36 +02001008 * - 2 bytes for the priority
1009 * - 2 bytes for the weight
1010 * - 2 bytes for the port
1011 * - the target hostname
1012 */
Willy Tarreau963f7012020-07-22 17:00:45 +02001013 if (dns_answer_record->data_len <= 6)
1014 goto invalid_resp;
1015
Willy Tarreaud5370e12017-09-19 14:59:52 +02001016 dns_answer_record->priority = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001017 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +02001018 dns_answer_record->weight = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001019 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +02001020 dns_answer_record->port = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001021 reader += sizeof(uint16_t);
1022 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +01001023 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Willy Tarreau963f7012020-07-22 17:00:45 +02001024 if (len == 0)
1025 goto invalid_resp;
1026
Olivier Houchard8da5f982017-08-04 18:35:36 +02001027 dns_answer_record->data_len = len;
1028 memcpy(dns_answer_record->target, tmpname, len);
1029 dns_answer_record->target[len] = 0;
Baptiste Assmann949a7f62020-11-25 08:17:59 +01001030 if (dns_answer_record->ar_item != NULL) {
1031 pool_free(dns_answer_item_pool, dns_answer_record->ar_item);
1032 dns_answer_record->ar_item = NULL;
1033 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001034 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001035
Baptiste Assmann325137d2015-04-13 23:40:55 +02001036 case DNS_RTYPE_AAAA:
1037 /* ipv6 is stored on 16 bytes */
Willy Tarreau963f7012020-07-22 17:00:45 +02001038 if (dns_answer_record->data_len != 16)
1039 goto invalid_resp;
1040
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +02001041 dns_answer_record->address.sa_family = AF_INET6;
1042 memcpy(&(((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr),
1043 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001044 break;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +02001045
Baptiste Assmann325137d2015-04-13 23:40:55 +02001046 } /* switch (record type) */
1047
Christopher Faulet67957bd2017-09-27 11:00:59 +02001048 /* Increment the counter for number of records saved into our
1049 * local response */
1050 nb_saved_records++;
Baptiste Assmann69fce672017-05-04 08:37:45 +02001051
Christopher Faulet67957bd2017-09-27 11:00:59 +02001052 /* Move forward dns_answer_record->data_len for analyzing next
1053 * record in the response */
1054 reader += ((dns_answer_record->type == DNS_RTYPE_SRV)
1055 ? offset
1056 : dns_answer_record->data_len);
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001057
1058 /* Lookup to see if we already had this entry */
Olivier Houchard8da5f982017-08-04 18:35:36 +02001059 found = 0;
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001060 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
1061 if (tmp_record->type != dns_answer_record->type)
1062 continue;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001063
1064 switch(tmp_record->type) {
1065 case DNS_RTYPE_A:
1066 if (!memcmp(&((struct sockaddr_in *)&dns_answer_record->address)->sin_addr,
1067 &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
1068 sizeof(in_addr_t)))
1069 found = 1;
1070 break;
1071
1072 case DNS_RTYPE_AAAA:
1073 if (!memcmp(&((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr,
1074 &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
1075 sizeof(struct in6_addr)))
1076 found = 1;
1077 break;
1078
Olivier Houchard8da5f982017-08-04 18:35:36 +02001079 case DNS_RTYPE_SRV:
1080 if (dns_answer_record->data_len == tmp_record->data_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001081 !dns_hostname_cmp(dns_answer_record->target, tmp_record->target, dns_answer_record->data_len) &&
Olivier Houchard8da5f982017-08-04 18:35:36 +02001082 dns_answer_record->port == tmp_record->port) {
1083 tmp_record->weight = dns_answer_record->weight;
1084 found = 1;
1085 }
1086 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001087
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001088 default:
1089 break;
1090 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001091
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001092 if (found == 1)
1093 break;
1094 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001095
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001096 if (found == 1) {
1097 tmp_record->last_seen = now.tv_sec;
Willy Tarreaubafbe012017-11-24 17:34:44 +01001098 pool_free(dns_answer_item_pool, dns_answer_record);
Willy Tarreau963f7012020-07-22 17:00:45 +02001099 dns_answer_record = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001100 }
1101 else {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001102 dns_answer_record->last_seen = now.tv_sec;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001103 dns_answer_record->ar_item = NULL;
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001104 LIST_ADDQ(&dns_p->answer_list, &dns_answer_record->list);
Willy Tarreau963f7012020-07-22 17:00:45 +02001105 dns_answer_record = NULL;
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001106 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001107 } /* for i 0 to ancount */
1108
Christopher Faulet67957bd2017-09-27 11:00:59 +02001109 /* Save the number of records we really own */
Baptiste Assmann69fce672017-05-04 08:37:45 +02001110 dns_p->header.ancount = nb_saved_records;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001111
Baptiste Assmann37950c82020-02-19 01:08:51 +01001112 /* now parsing additional records for SRV queries only */
1113 if (dns_query->type != DNS_RTYPE_SRV)
1114 goto skip_parsing_additional_records;
Willy Tarreau963f7012020-07-22 17:00:45 +02001115
Jerome Magnin4002f8d2020-07-26 12:13:12 +02001116 /* if we find Authority records, just skip them */
1117 for (i = 0; i < dns_p->header.nscount; i++) {
1118 offset = 0;
1119 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE,
1120 &offset, 0);
1121 if (len == 0)
1122 continue;
1123
1124 if (reader + offset + 10 >= bufend)
1125 goto invalid_resp;
1126
1127 reader += offset;
1128 /* skip 2 bytes for class */
1129 reader += 2;
1130 /* skip 2 bytes for type */
1131 reader += 2;
1132 /* skip 4 bytes for ttl */
1133 reader += 4;
1134 /* read data len */
1135 len = reader[0] * 256 + reader[1];
1136 reader += 2;
1137
1138 if (reader + len >= bufend)
1139 goto invalid_resp;
1140
1141 reader += len;
1142 }
1143
Baptiste Assmann13a92322019-06-07 09:40:55 +02001144 nb_saved_records = 0;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001145 for (i = 0; i < dns_p->header.arcount; i++) {
1146 if (reader >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +02001147 goto invalid_resp;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001148
1149 dns_answer_record = pool_alloc(dns_answer_item_pool);
1150 if (dns_answer_record == NULL)
Willy Tarreau963f7012020-07-22 17:00:45 +02001151 goto invalid_resp;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001152
1153 offset = 0;
1154 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
1155
1156 if (len == 0) {
1157 pool_free(dns_answer_item_pool, dns_answer_record);
Willy Tarreau963f7012020-07-22 17:00:45 +02001158 dns_answer_record = NULL;
Baptiste Assmann37950c82020-02-19 01:08:51 +01001159 continue;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001160 }
1161
1162 memcpy(dns_answer_record->name, tmpname, len);
1163 dns_answer_record->name[len] = 0;
1164
1165 reader += offset;
Willy Tarreau963f7012020-07-22 17:00:45 +02001166 if (reader >= bufend)
1167 goto invalid_resp;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001168
1169 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
Willy Tarreau963f7012020-07-22 17:00:45 +02001170 if (reader + 2 > bufend)
1171 goto invalid_resp;
1172
Baptiste Assmann13a92322019-06-07 09:40:55 +02001173 dns_answer_record->type = reader[0] * 256 + reader[1];
1174 reader += 2;
1175
1176 /* 2 bytes for class (2) */
Willy Tarreau963f7012020-07-22 17:00:45 +02001177 if (reader + 2 > bufend)
1178 goto invalid_resp;
1179
Baptiste Assmann13a92322019-06-07 09:40:55 +02001180 dns_answer_record->class = reader[0] * 256 + reader[1];
1181 reader += 2;
1182
1183 /* 4 bytes for ttl (4) */
Willy Tarreau963f7012020-07-22 17:00:45 +02001184 if (reader + 4 > bufend)
1185 goto invalid_resp;
1186
Baptiste Assmann13a92322019-06-07 09:40:55 +02001187 dns_answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
1188 + reader[2] * 256 + reader[3];
1189 reader += 4;
1190
1191 /* Now reading data len */
Willy Tarreau963f7012020-07-22 17:00:45 +02001192 if (reader + 2 > bufend)
1193 goto invalid_resp;
1194
Baptiste Assmann13a92322019-06-07 09:40:55 +02001195 dns_answer_record->data_len = reader[0] * 256 + reader[1];
1196
1197 /* Move forward 2 bytes for data len */
1198 reader += 2;
1199
Willy Tarreau963f7012020-07-22 17:00:45 +02001200 if (reader + dns_answer_record->data_len > bufend)
1201 goto invalid_resp;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001202
1203 /* Analyzing record content */
1204 switch (dns_answer_record->type) {
1205 case DNS_RTYPE_A:
1206 /* ipv4 is stored on 4 bytes */
Willy Tarreau963f7012020-07-22 17:00:45 +02001207 if (dns_answer_record->data_len != 4)
1208 goto invalid_resp;
1209
Baptiste Assmann13a92322019-06-07 09:40:55 +02001210 dns_answer_record->address.sa_family = AF_INET;
1211 memcpy(&(((struct sockaddr_in *)&dns_answer_record->address)->sin_addr),
1212 reader, dns_answer_record->data_len);
1213 break;
1214
1215 case DNS_RTYPE_AAAA:
1216 /* ipv6 is stored on 16 bytes */
Willy Tarreau963f7012020-07-22 17:00:45 +02001217 if (dns_answer_record->data_len != 16)
1218 goto invalid_resp;
1219
Baptiste Assmann13a92322019-06-07 09:40:55 +02001220 dns_answer_record->address.sa_family = AF_INET6;
1221 memcpy(&(((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr),
1222 reader, dns_answer_record->data_len);
1223 break;
1224
1225 default:
1226 pool_free(dns_answer_item_pool, dns_answer_record);
Willy Tarreau963f7012020-07-22 17:00:45 +02001227 dns_answer_record = NULL;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001228 continue;
1229
1230 } /* switch (record type) */
1231
1232 /* Increment the counter for number of records saved into our
1233 * local response */
1234 nb_saved_records++;
1235
1236 /* Move forward dns_answer_record->data_len for analyzing next
1237 * record in the response */
1238 reader += ((dns_answer_record->type == DNS_RTYPE_SRV)
1239 ? offset
1240 : dns_answer_record->data_len);
1241
1242 /* Lookup to see if we already had this entry */
1243 found = 0;
1244 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
1245 if (tmp_record->type != dns_answer_record->type)
1246 continue;
1247
1248 switch(tmp_record->type) {
1249 case DNS_RTYPE_A:
1250 if (!memcmp(&((struct sockaddr_in *)&dns_answer_record->address)->sin_addr,
1251 &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
1252 sizeof(in_addr_t)))
1253 found = 1;
1254 break;
1255
1256 case DNS_RTYPE_AAAA:
1257 if (!memcmp(&((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr,
1258 &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
1259 sizeof(struct in6_addr)))
1260 found = 1;
1261 break;
1262
1263 default:
1264 break;
1265 }
1266
1267 if (found == 1)
1268 break;
1269 }
1270
1271 if (found == 1) {
1272 tmp_record->last_seen = now.tv_sec;
1273 pool_free(dns_answer_item_pool, dns_answer_record);
Willy Tarreau963f7012020-07-22 17:00:45 +02001274 dns_answer_record = NULL;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001275 }
1276 else {
1277 dns_answer_record->last_seen = now.tv_sec;
1278 dns_answer_record->ar_item = NULL;
1279
1280 // looking for the SRV record in the response list linked to this additional record
1281 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
Christopher Faulet5a891752020-09-08 10:06:01 +02001282 if (tmp_record->type == DNS_RTYPE_SRV &&
Baptiste Assmann949a7f62020-11-25 08:17:59 +01001283 tmp_record->ar_item == NULL &&
Christopher Faulet5a891752020-09-08 10:06:01 +02001284 !dns_hostname_cmp(tmp_record->target, dns_answer_record->name, tmp_record->data_len)) {
1285 /* Always use the received additional record to refresh info */
1286 if (tmp_record->ar_item)
1287 pool_free(dns_answer_item_pool, tmp_record->ar_item);
1288 tmp_record->ar_item = dns_answer_record;
1289 break;
1290 }
Baptiste Assmann13a92322019-06-07 09:40:55 +02001291 }
Christopher Faulet5a891752020-09-08 10:06:01 +02001292 if (tmp_record->ar_item != dns_answer_record)
1293 pool_free(dns_answer_item_pool, dns_answer_record);
Willy Tarreau963f7012020-07-22 17:00:45 +02001294 dns_answer_record = NULL;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001295 }
1296 } /* for i 0 to arcount */
1297
Baptiste Assmann37950c82020-02-19 01:08:51 +01001298 skip_parsing_additional_records:
1299
Baptiste Assmann13a92322019-06-07 09:40:55 +02001300 /* Save the number of records we really own */
1301 dns_p->header.arcount = nb_saved_records;
1302
Christopher Faulet67957bd2017-09-27 11:00:59 +02001303 dns_check_dns_response(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001304 return DNS_RESP_VALID;
Willy Tarreau963f7012020-07-22 17:00:45 +02001305
1306 invalid_resp:
1307 cause = DNS_RESP_INVALID;
1308
1309 return_error:
1310 pool_free(dns_answer_item_pool, dns_answer_record);
1311 return cause;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001312}
1313
Christopher Faulet67957bd2017-09-27 11:00:59 +02001314/* Searches dn_name resolution in resp.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001315 * If existing IP not found, return the first IP matching family_priority,
1316 * otherwise, first ip found
1317 * The following tasks are the responsibility of the caller:
Baptiste Assmann3cf7f982016-04-17 22:43:26 +02001318 * - <dns_p> contains an error free DNS response
Baptiste Assmann325137d2015-04-13 23:40:55 +02001319 * For both cases above, dns_validate_dns_response is required
1320 * returns one of the DNS_UPD_* code
1321 */
Baptiste Assmannfb7091e2017-05-03 15:43:12 +02001322int dns_get_ip_from_response(struct dns_response_packet *dns_p,
Baptiste Assmann42746372017-05-03 12:12:02 +02001323 struct dns_options *dns_opts, void *currentip,
Thierry Fournierada34842016-02-17 21:25:09 +01001324 short currentip_sin_family,
Baptiste Assmannfb7091e2017-05-03 15:43:12 +02001325 void **newip, short *newip_sin_family,
1326 void *owner)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001327{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +02001328 struct dns_answer_item *record;
Thierry Fournierada34842016-02-17 21:25:09 +01001329 int family_priority;
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001330 int currentip_found;
Baptiste Assmann3cf7f982016-04-17 22:43:26 +02001331 unsigned char *newip4, *newip6;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001332 int currentip_sel;
1333 int j;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001334 int score, max_score;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001335 int allowed_duplicated_ip;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001336
Christopher Faulet67957bd2017-09-27 11:00:59 +02001337 family_priority = dns_opts->family_prio;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001338 allowed_duplicated_ip = dns_opts->accept_duplicate_ip;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001339 *newip = newip4 = newip6 = NULL;
1340 currentip_found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001341 *newip_sin_family = AF_UNSPEC;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001342 max_score = -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001343
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001344 /* Select an IP regarding configuration preference.
Joseph Herlant42cf6392018-11-15 10:33:28 -08001345 * Top priority is the preferred network ip version,
1346 * second priority is the preferred network.
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001347 * the last priority is the currently used IP,
1348 *
1349 * For these three priorities, a score is calculated. The
1350 * weight are:
Joseph Herlant42cf6392018-11-15 10:33:28 -08001351 * 8 - preferred ip version.
1352 * 4 - preferred network.
Baptistefc725902016-12-26 23:21:08 +01001353 * 2 - if the ip in the record is not affected to any other server in the same backend (duplication)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001354 * 1 - current ip.
1355 * The result with the biggest score is returned.
1356 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001357
1358 list_for_each_entry(record, &dns_p->answer_list, list) {
1359 void *ip;
1360 unsigned char ip_type;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001361
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001362 if (record->type == DNS_RTYPE_A) {
1363 ip = &(((struct sockaddr_in *)&record->address)->sin_addr);
1364 ip_type = AF_INET;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001365 }
1366 else if (record->type == DNS_RTYPE_AAAA) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001367 ip_type = AF_INET6;
1368 ip = &(((struct sockaddr_in6 *)&record->address)->sin6_addr);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001369 }
1370 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001371 continue;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001372 score = 0;
1373
Joseph Herlant42cf6392018-11-15 10:33:28 -08001374 /* Check for preferred ip protocol. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001375 if (ip_type == family_priority)
Baptistefc725902016-12-26 23:21:08 +01001376 score += 8;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001377
Joseph Herlant42cf6392018-11-15 10:33:28 -08001378 /* Check for preferred network. */
Baptiste Assmann42746372017-05-03 12:12:02 +02001379 for (j = 0; j < dns_opts->pref_net_nb; j++) {
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001380
Ilya Shipitsin46a030c2020-07-05 16:36:08 +05001381 /* Compare only the same addresses class. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001382 if (dns_opts->pref_net[j].family != ip_type)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001383 continue;
1384
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001385 if ((ip_type == AF_INET &&
1386 in_net_ipv4(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001387 &dns_opts->pref_net[j].mask.in4,
1388 &dns_opts->pref_net[j].addr.in4)) ||
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001389 (ip_type == AF_INET6 &&
1390 in_net_ipv6(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001391 &dns_opts->pref_net[j].mask.in6,
1392 &dns_opts->pref_net[j].addr.in6))) {
Baptistefc725902016-12-26 23:21:08 +01001393 score += 4;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001394 break;
1395 }
1396 }
1397
Christopher Faulet67957bd2017-09-27 11:00:59 +02001398 /* Check if the IP found in the record is already affected to a
Baptiste Assmann84221b42018-06-22 13:03:50 +02001399 * member of a group. If not, the score should be incremented
Christopher Faulet67957bd2017-09-27 11:00:59 +02001400 * by 2. */
Baptiste Assmann84221b42018-06-22 13:03:50 +02001401 if (owner && snr_check_ip_callback(owner, ip, &ip_type)) {
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001402 if (!allowed_duplicated_ip) {
1403 continue;
1404 }
Baptiste Assmann84221b42018-06-22 13:03:50 +02001405 } else {
1406 score += 2;
1407 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001408
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001409 /* Check for current ip matching. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001410 if (ip_type == currentip_sin_family &&
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001411 ((currentip_sin_family == AF_INET &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001412 !memcmp(ip, currentip, 4)) ||
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001413 (currentip_sin_family == AF_INET6 &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001414 !memcmp(ip, currentip, 16)))) {
1415 score++;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001416 currentip_sel = 1;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001417 }
1418 else
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001419 currentip_sel = 0;
1420
1421 /* Keep the address if the score is better than the previous
Christopher Faulet67957bd2017-09-27 11:00:59 +02001422 * score. The maximum score is 15, if this value is reached, we
1423 * break the parsing. Implicitly, this score is reached the ip
1424 * selected is the current ip. */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001425 if (score > max_score) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001426 if (ip_type == AF_INET)
1427 newip4 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001428 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001429 newip6 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001430 currentip_found = currentip_sel;
Baptistefc725902016-12-26 23:21:08 +01001431 if (score == 15)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001432 return DNS_UPD_NO;
1433 max_score = score;
1434 }
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001435 } /* list for each record entries */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001436
Christopher Faulet67957bd2017-09-27 11:00:59 +02001437 /* No IP found in the response */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001438 if (!newip4 && !newip6)
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001439 return DNS_UPD_NO_IP_FOUND;
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001440
Christopher Faulet67957bd2017-09-27 11:00:59 +02001441 /* Case when the caller looks first for an IPv4 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001442 if (family_priority == AF_INET) {
1443 if (newip4) {
1444 *newip = newip4;
1445 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001446 }
1447 else if (newip6) {
1448 *newip = newip6;
1449 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001450 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001451 if (!currentip_found)
1452 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001453 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001454 /* Case when the caller looks first for an IPv6 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001455 else if (family_priority == AF_INET6) {
1456 if (newip6) {
1457 *newip = newip6;
1458 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001459 }
1460 else if (newip4) {
1461 *newip = newip4;
1462 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001463 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001464 if (!currentip_found)
1465 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001466 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001467 /* Case when the caller have no preference (we prefer IPv6) */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001468 else if (family_priority == AF_UNSPEC) {
1469 if (newip6) {
1470 *newip = newip6;
1471 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001472 }
1473 else if (newip4) {
1474 *newip = newip4;
1475 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001476 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001477 if (!currentip_found)
1478 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001479 }
1480
Christopher Faulet67957bd2017-09-27 11:00:59 +02001481 /* No reason why we should change the server's IP address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001482 return DNS_UPD_NO;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001483
Christopher Faulet67957bd2017-09-27 11:00:59 +02001484 not_found:
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001485 list_for_each_entry(record, &dns_p->answer_list, list) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001486 /* Move the first record to the end of the list, for internal
1487 * round robin */
1488 LIST_DEL(&record->list);
1489 LIST_ADDQ(&dns_p->answer_list, &record->list);
1490 break;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001491 }
1492 return DNS_UPD_SRVIP_NOT_FOUND;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001493}
1494
Christopher Faulet67957bd2017-09-27 11:00:59 +02001495/* Turns a domain name label into a string.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001496 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001497 * <dn> must be a null-terminated string. <dn_len> must include the terminating
1498 * null byte. <str> must be allocated and its size must be passed in <str_len>.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001499 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001500 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1501 * <str> (including the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001502 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001503int dns_dn_label_to_str(const char *dn, int dn_len, char *str, int str_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001504{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001505 char *ptr;
1506 int i, sz;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001507
Christopher Faulet67957bd2017-09-27 11:00:59 +02001508 if (str_len < dn_len - 1)
Baptiste Assmann2af08fe2017-08-14 00:13:01 +02001509 return -1;
1510
Christopher Faulet67957bd2017-09-27 11:00:59 +02001511 ptr = str;
1512 for (i = 0; i < dn_len-1; ++i) {
1513 sz = dn[i];
1514 if (i)
1515 *ptr++ = '.';
1516 memcpy(ptr, dn+i+1, sz);
1517 ptr += sz;
1518 i += sz;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001519 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001520 *ptr++ = '\0';
1521 return (ptr - str);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001522}
1523
Christopher Faulet67957bd2017-09-27 11:00:59 +02001524/* Turns a string into domain name label: www.haproxy.org into 3www7haproxy3org
1525 *
1526 * <str> must be a null-terminated string. <str_len> must include the
1527 * terminating null byte. <dn> buffer must be allocated and its size must be
1528 * passed in <dn_len>.
1529 *
1530 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1531 * <dn> (excluding the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001532 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001533int dns_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001534{
Baptiste Assmann325137d2015-04-13 23:40:55 +02001535 int i, offset;
1536
Christopher Faulet67957bd2017-09-27 11:00:59 +02001537 if (dn_len < str_len + 1)
1538 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001539
Christopher Faulet67957bd2017-09-27 11:00:59 +02001540 /* First byte of dn will be used to store the length of the first
1541 * label */
1542 offset = 0;
1543 for (i = 0; i < str_len; ++i) {
1544 if (str[i] == '.') {
1545 /* 2 or more consecutive dots is invalid */
1546 if (i == offset)
1547 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001548
Lukas Tribus81725b82020-02-27 15:47:24 +01001549 /* ignore trailing dot */
1550 if (i + 2 == str_len) {
1551 i++;
1552 break;
1553 }
1554
Christopher Faulet67957bd2017-09-27 11:00:59 +02001555 dn[offset] = (i - offset);
1556 offset = i+1;
1557 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001558 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001559 dn[i+1] = str[i];
Baptiste Assmann325137d2015-04-13 23:40:55 +02001560 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001561 dn[offset] = (i - offset - 1);
1562 dn[i] = '\0';
1563 return i;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001564}
1565
Christopher Faulet67957bd2017-09-27 11:00:59 +02001566/* Validates host name:
Baptiste Assmann325137d2015-04-13 23:40:55 +02001567 * - total size
1568 * - each label size individually
1569 * returns:
1570 * 0 in case of error. If <err> is not NULL, an error message is stored there.
1571 * 1 when no error. <err> is left unaffected.
1572 */
1573int dns_hostname_validation(const char *string, char **err)
1574{
Baptiste Assmann325137d2015-04-13 23:40:55 +02001575 int i;
1576
1577 if (strlen(string) > DNS_MAX_NAME_SIZE) {
1578 if (err)
1579 *err = DNS_TOO_LONG_FQDN;
1580 return 0;
1581 }
1582
William Dauchyaecd5dc2020-01-26 19:52:34 +01001583 while (*string) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001584 i = 0;
William Dauchyaecd5dc2020-01-26 19:52:34 +01001585 while (*string && *string != '.' && i < DNS_MAX_LABEL_SIZE) {
1586 if (!(*string == '-' || *string == '_' ||
1587 (*string >= 'a' && *string <= 'z') ||
1588 (*string >= 'A' && *string <= 'Z') ||
1589 (*string >= '0' && *string <= '9'))) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001590 if (err)
1591 *err = DNS_INVALID_CHARACTER;
1592 return 0;
1593 }
William Dauchyaecd5dc2020-01-26 19:52:34 +01001594 i++;
1595 string++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001596 }
1597
William Dauchyaecd5dc2020-01-26 19:52:34 +01001598 if (!(*string))
1599 break;
1600
1601 if (*string != '.' && i >= DNS_MAX_LABEL_SIZE) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001602 if (err)
1603 *err = DNS_LABEL_TOO_LONG;
1604 return 0;
1605 }
1606
William Dauchyaecd5dc2020-01-26 19:52:34 +01001607 string++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001608 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001609 return 1;
1610}
1611
Christopher Faulet67957bd2017-09-27 11:00:59 +02001612/* Picks up an available resolution from the different resolution list
1613 * associated to a resolvers section, in this order:
1614 * 1. check in resolutions.curr for the same hostname and query_type
1615 * 2. check in resolutions.wait for the same hostname and query_type
1616 * 3. Get a new resolution from resolution pool
1617 *
1618 * Returns an available resolution, NULL if none found.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001619 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001620static struct dns_resolution *dns_pick_resolution(struct dns_resolvers *resolvers,
1621 char **hostname_dn, int hostname_dn_len,
1622 int query_type)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001623{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001624 struct dns_resolution *res;
1625
1626 if (!*hostname_dn)
1627 goto from_pool;
1628
1629 /* Search for same hostname and query type in resolutions.curr */
1630 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
1631 if (!res->hostname_dn)
1632 continue;
1633 if ((query_type == res->prefered_query_type) &&
1634 hostname_dn_len == res->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001635 !dns_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +02001636 return res;
1637 }
1638
1639 /* Search for same hostname and query type in resolutions.wait */
1640 list_for_each_entry(res, &resolvers->resolutions.wait, list) {
1641 if (!res->hostname_dn)
1642 continue;
1643 if ((query_type == res->prefered_query_type) &&
1644 hostname_dn_len == res->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001645 !dns_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +02001646 return res;
1647 }
1648
1649 from_pool:
1650 /* No resolution could be found, so let's allocate a new one */
Willy Tarreaubafbe012017-11-24 17:34:44 +01001651 res = pool_alloc(dns_resolution_pool);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001652 if (res) {
1653 memset(res, 0, sizeof(*res));
1654 res->resolvers = resolvers;
1655 res->uuid = resolution_uuid;
1656 res->status = RSLV_STATUS_NONE;
1657 res->step = RSLV_STEP_NONE;
1658 res->last_valid = now_ms;
1659
1660 LIST_INIT(&res->requesters);
1661 LIST_INIT(&res->response.answer_list);
1662
1663 res->prefered_query_type = query_type;
1664 res->query_type = query_type;
1665 res->hostname_dn = *hostname_dn;
1666 res->hostname_dn_len = hostname_dn_len;
1667
1668 ++resolution_uuid;
1669
1670 /* Move the resolution to the resolvers wait queue */
1671 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1672 }
1673 return res;
1674}
1675
1676/* Releases a resolution from its requester(s) and move it back to the pool */
1677static void dns_free_resolution(struct dns_resolution *resolution)
1678{
1679 struct dns_requester *req, *reqback;
Christopher Faulet010ab352020-07-22 15:55:49 +02001680 struct dns_answer_item *item, *itemback;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001681
1682 /* clean up configuration */
1683 dns_reset_resolution(resolution);
1684 resolution->hostname_dn = NULL;
1685 resolution->hostname_dn_len = 0;
1686
1687 list_for_each_entry_safe(req, reqback, &resolution->requesters, list) {
1688 LIST_DEL(&req->list);
1689 req->resolution = NULL;
1690 }
1691
Christopher Faulet010ab352020-07-22 15:55:49 +02001692 list_for_each_entry_safe(item, itemback, &resolution->response.answer_list, list) {
1693 LIST_DEL(&item->list);
Christopher Faulet5a891752020-09-08 10:06:01 +02001694 if (item->ar_item) {
1695 pool_free(dns_answer_item_pool, item->ar_item);
1696 item->ar_item = NULL;
1697 }
Christopher Faulet010ab352020-07-22 15:55:49 +02001698 pool_free(dns_answer_item_pool, item);
1699 }
1700
Christopher Faulet67957bd2017-09-27 11:00:59 +02001701 LIST_DEL(&resolution->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +01001702 pool_free(dns_resolution_pool, resolution);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001703}
1704
1705/* Links a requester (a server or a dns_srvrq) with a resolution. It returns 0
1706 * on success, -1 otherwise.
1707 */
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001708int dns_link_resolution(void *requester, int requester_type, int requester_locked)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001709{
1710 struct dns_resolution *res = NULL;
1711 struct dns_requester *req;
1712 struct dns_resolvers *resolvers;
1713 struct server *srv = NULL;
1714 struct dns_srvrq *srvrq = NULL;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001715 struct stream *stream = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001716 char **hostname_dn;
1717 int hostname_dn_len, query_type;
1718
1719 switch (requester_type) {
1720 case OBJ_TYPE_SERVER:
1721 srv = (struct server *)requester;
1722 hostname_dn = &srv->hostname_dn;
1723 hostname_dn_len = srv->hostname_dn_len;
1724 resolvers = srv->resolvers;
1725 query_type = ((srv->dns_opts.family_prio == AF_INET)
1726 ? DNS_RTYPE_A
1727 : DNS_RTYPE_AAAA);
1728 break;
1729
1730 case OBJ_TYPE_SRVRQ:
1731 srvrq = (struct dns_srvrq *)requester;
1732 hostname_dn = &srvrq->hostname_dn;
1733 hostname_dn_len = srvrq->hostname_dn_len;
1734 resolvers = srvrq->resolvers;
1735 query_type = DNS_RTYPE_SRV;
1736 break;
1737
Baptiste Assmann333939c2019-01-21 08:34:50 +01001738 case OBJ_TYPE_STREAM:
1739 stream = (struct stream *)requester;
1740 hostname_dn = &stream->dns_ctx.hostname_dn;
1741 hostname_dn_len = stream->dns_ctx.hostname_dn_len;
1742 resolvers = stream->dns_ctx.parent->arg.dns.resolvers;
Christopher Fauleta4168432020-01-24 18:08:42 +01001743 query_type = ((stream->dns_ctx.parent->arg.dns.dns_opts->family_prio == AF_INET)
Baptiste Assmann333939c2019-01-21 08:34:50 +01001744 ? DNS_RTYPE_A
1745 : DNS_RTYPE_AAAA);
1746 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001747 default:
1748 goto err;
1749 }
1750
1751 /* Get a resolution from the resolvers' wait queue or pool */
1752 if ((res = dns_pick_resolution(resolvers, hostname_dn, hostname_dn_len, query_type)) == NULL)
1753 goto err;
1754
1755 if (srv) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001756 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001757 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001758 if (srv->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001759 if ((req = pool_alloc(dns_requester_pool)) == NULL) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001760 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001761 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001762 goto err;
Willy Tarreau5ec84572017-11-05 10:35:57 +01001763 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001764 req->owner = &srv->obj_type;
1765 srv->dns_requester = req;
1766 }
1767 else
1768 req = srv->dns_requester;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001769 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001770 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001771
1772 req->requester_cb = snr_resolution_cb;
1773 req->requester_error_cb = snr_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001774 }
1775 else if (srvrq) {
1776 if (srvrq->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001777 if ((req = pool_alloc(dns_requester_pool)) == NULL)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001778 goto err;
1779 req->owner = &srvrq->obj_type;
1780 srvrq->dns_requester = req;
1781 }
1782 else
1783 req = srvrq->dns_requester;
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001784
1785 req->requester_cb = snr_resolution_cb;
1786 req->requester_error_cb = snr_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001787 }
Baptiste Assmann333939c2019-01-21 08:34:50 +01001788 else if (stream) {
1789 if (stream->dns_ctx.dns_requester == NULL) {
1790 if ((req = pool_alloc(dns_requester_pool)) == NULL)
1791 goto err;
1792 req->owner = &stream->obj_type;
1793 stream->dns_ctx.dns_requester = req;
1794 }
1795 else
1796 req = stream->dns_ctx.dns_requester;
1797
1798 req->requester_cb = act_resolution_cb;
1799 req->requester_error_cb = act_resolution_error_cb;
1800 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001801 else
1802 goto err;
1803
1804 req->resolution = res;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001805
1806 LIST_ADDQ(&res->requesters, &req->list);
1807 return 0;
1808
1809 err:
1810 if (res && LIST_ISEMPTY(&res->requesters))
1811 dns_free_resolution(res);
1812 return -1;
1813}
1814
Ilya Shipitsin46a030c2020-07-05 16:36:08 +05001815/* Removes a requester from a DNS resolution. It takes takes care of all the
Christopher Faulet67957bd2017-09-27 11:00:59 +02001816 * consequences. It also cleans up some parameters from the requester.
1817 */
1818void dns_unlink_resolution(struct dns_requester *requester)
1819{
1820 struct dns_resolution *res;
1821 struct dns_requester *req;
1822
1823 /* Nothing to do */
1824 if (!requester || !requester->resolution)
1825 return;
1826 res = requester->resolution;
1827
1828 /* Clean up the requester */
1829 LIST_DEL(&requester->list);
1830 requester->resolution = NULL;
1831
1832 /* We need to find another requester linked on this resolution */
1833 if (!LIST_ISEMPTY(&res->requesters))
1834 req = LIST_NEXT(&res->requesters, struct dns_requester *, list);
1835 else {
1836 dns_free_resolution(res);
1837 return;
1838 }
1839
1840 /* Move hostname_dn related pointers to the next requester */
1841 switch (obj_type(req->owner)) {
1842 case OBJ_TYPE_SERVER:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001843 res->hostname_dn = __objt_server(req->owner)->hostname_dn;
1844 res->hostname_dn_len = __objt_server(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001845 break;
1846 case OBJ_TYPE_SRVRQ:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001847 res->hostname_dn = __objt_dns_srvrq(req->owner)->hostname_dn;
1848 res->hostname_dn_len = __objt_dns_srvrq(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001849 break;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001850 case OBJ_TYPE_STREAM:
1851 res->hostname_dn = __objt_stream(req->owner)->dns_ctx.hostname_dn;
1852 res->hostname_dn_len = __objt_stream(req->owner)->dns_ctx.hostname_dn_len;
1853 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001854 default:
1855 res->hostname_dn = NULL;
1856 res->hostname_dn_len = 0;
1857 break;
1858 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001859}
1860
Christopher Faulet67957bd2017-09-27 11:00:59 +02001861/* Called when a network IO is generated on a name server socket for an incoming
1862 * packet. It performs the following actions:
1863 * - check if the packet requires processing (not outdated resolution)
1864 * - ensure the DNS packet received is valid and call requester's callback
1865 * - call requester's error callback if invalid response
1866 * - check the dn_name in the packet against the one sent
1867 */
1868static void dns_resolve_recv(struct dgram_conn *dgram)
1869{
1870 struct dns_nameserver *ns, *tmpns;
1871 struct dns_resolvers *resolvers;
1872 struct dns_resolution *res;
1873 struct dns_query_item *query;
1874 unsigned char buf[DNS_MAX_UDP_MESSAGE + 1];
1875 unsigned char *bufend;
1876 int fd, buflen, dns_resp;
1877 int max_answer_records;
1878 unsigned short query_id;
1879 struct eb32_node *eb;
1880 struct dns_requester *req;
1881
1882 fd = dgram->t.sock.fd;
1883
1884 /* check if ready for reading */
1885 if (!fd_recv_ready(fd))
1886 return;
1887
1888 /* no need to go further if we can't retrieve the nameserver */
Willy Tarreau1c759952019-12-10 18:38:09 +01001889 if ((ns = dgram->owner) == NULL) {
1890 _HA_ATOMIC_AND(&fdtab[fd].ev, ~(FD_POLL_HUP|FD_POLL_ERR));
1891 fd_stop_recv(fd);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001892 return;
Willy Tarreau1c759952019-12-10 18:38:09 +01001893 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001894
1895 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001896 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001897
1898 /* process all pending input messages */
Willy Tarreau1c759952019-12-10 18:38:09 +01001899 while (fd_recv_ready(fd)) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001900 /* read message received */
1901 memset(buf, '\0', resolvers->accepted_payload_size + 1);
1902 if ((buflen = recv(fd, (char*)buf , resolvers->accepted_payload_size + 1, 0)) < 0) {
Willy Tarreau1c759952019-12-10 18:38:09 +01001903 /* FIXME : for now we consider EAGAIN only, but at
1904 * least we purge sticky errors that would cause us to
1905 * be called in loops.
1906 */
1907 _HA_ATOMIC_AND(&fdtab[fd].ev, ~(FD_POLL_HUP|FD_POLL_ERR));
Christopher Faulet67957bd2017-09-27 11:00:59 +02001908 fd_cant_recv(fd);
1909 break;
1910 }
1911
1912 /* message too big */
1913 if (buflen > resolvers->accepted_payload_size) {
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02001914 ns->counters->too_big++;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001915 continue;
1916 }
1917
1918 /* initializing variables */
1919 bufend = buf + buflen; /* pointer to mark the end of the buffer */
1920
1921 /* read the query id from the packet (16 bits) */
1922 if (buf + 2 > bufend) {
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02001923 ns->counters->invalid++;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001924 continue;
1925 }
1926 query_id = dns_response_get_query_id(buf);
1927
1928 /* search the query_id in the pending resolution tree */
1929 eb = eb32_lookup(&resolvers->query_ids, query_id);
1930 if (eb == NULL) {
1931 /* unknown query id means an outdated response and can be safely ignored */
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02001932 ns->counters->outdated++;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001933 continue;
1934 }
1935
William Dauchybe8a3872019-11-27 23:32:41 +01001936 /* known query id means a resolution in progress */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001937 res = eb32_entry(eb, struct dns_resolution, qid);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001938 /* number of responses received */
1939 res->nb_responses++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001940
Christopher Faulet67957bd2017-09-27 11:00:59 +02001941 max_answer_records = (resolvers->accepted_payload_size - DNS_HEADER_SIZE) / DNS_MIN_RECORD_SIZE;
1942 dns_resp = dns_validate_dns_response(buf, bufend, res, max_answer_records);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001943
Christopher Faulet67957bd2017-09-27 11:00:59 +02001944 switch (dns_resp) {
1945 case DNS_RESP_VALID:
1946 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001947
Christopher Faulet67957bd2017-09-27 11:00:59 +02001948 case DNS_RESP_INVALID:
1949 case DNS_RESP_QUERY_COUNT_ERROR:
1950 case DNS_RESP_WRONG_NAME:
1951 res->status = RSLV_STATUS_INVALID;
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02001952 ns->counters->invalid++;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001953 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001954
Christopher Faulet67957bd2017-09-27 11:00:59 +02001955 case DNS_RESP_NX_DOMAIN:
1956 res->status = RSLV_STATUS_NX;
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02001957 ns->counters->nx++;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001958 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001959
Christopher Faulet67957bd2017-09-27 11:00:59 +02001960 case DNS_RESP_REFUSED:
1961 res->status = RSLV_STATUS_REFUSED;
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02001962 ns->counters->refused++;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001963 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001964
Christopher Faulet67957bd2017-09-27 11:00:59 +02001965 case DNS_RESP_ANCOUNT_ZERO:
1966 res->status = RSLV_STATUS_OTHER;
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02001967 ns->counters->any_err++;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001968 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001969
Christopher Faulet67957bd2017-09-27 11:00:59 +02001970 case DNS_RESP_CNAME_ERROR:
1971 res->status = RSLV_STATUS_OTHER;
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02001972 ns->counters->cname_error++;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001973 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001974
Christopher Faulet67957bd2017-09-27 11:00:59 +02001975 case DNS_RESP_TRUNCATED:
1976 res->status = RSLV_STATUS_OTHER;
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02001977 ns->counters->truncated++;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001978 break;
Baptiste Assmanne70bc052017-08-21 16:51:09 +02001979
Christopher Faulet67957bd2017-09-27 11:00:59 +02001980 case DNS_RESP_NO_EXPECTED_RECORD:
1981 case DNS_RESP_ERROR:
1982 case DNS_RESP_INTERNAL:
1983 res->status = RSLV_STATUS_OTHER;
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02001984 ns->counters->other++;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001985 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001986 }
1987
Christopher Faulet67957bd2017-09-27 11:00:59 +02001988 /* Wait all nameservers response to handle errors */
1989 if (dns_resp != DNS_RESP_VALID && res->nb_responses < resolvers->nb_nameservers)
1990 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001991
Christopher Faulet67957bd2017-09-27 11:00:59 +02001992 /* Process error codes */
1993 if (dns_resp != DNS_RESP_VALID) {
1994 if (res->prefered_query_type != res->query_type) {
1995 /* The fallback on the query type was already performed,
1996 * so check the try counter. If it falls to 0, we can
1997 * report an error. Else, wait the next attempt. */
1998 if (!res->try)
1999 goto report_res_error;
2000 }
2001 else {
2002 /* Fallback from A to AAAA or the opposite and re-send
2003 * the resolution immediately. try counter is not
2004 * decremented. */
2005 if (res->prefered_query_type == DNS_RTYPE_A) {
2006 res->query_type = DNS_RTYPE_AAAA;
2007 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002008 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002009 else if (res->prefered_query_type == DNS_RTYPE_AAAA) {
2010 res->query_type = DNS_RTYPE_A;
2011 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002012 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002013 }
2014 continue;
2015 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02002016
Christopher Faulet67957bd2017-09-27 11:00:59 +02002017 /* Now let's check the query's dname corresponds to the one we
2018 * sent. We can check only the first query of the list. We send
2019 * one query at a time so we get one query in the response */
2020 query = LIST_NEXT(&res->response.query_list, struct dns_query_item *, list);
Olivier Houchardb17b8842020-04-01 18:30:27 +02002021 if (query && dns_hostname_cmp(query->name, res->hostname_dn, res->hostname_dn_len) != 0) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002022 dns_resp = DNS_RESP_WRONG_NAME;
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02002023 ns->counters->other++;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002024 goto report_res_error;
2025 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002026
Christopher Faulet67957bd2017-09-27 11:00:59 +02002027 /* So the resolution succeeded */
2028 res->status = RSLV_STATUS_VALID;
2029 res->last_valid = now_ms;
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02002030 ns->counters->valid++;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002031 goto report_res_success;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002032
Christopher Faulet67957bd2017-09-27 11:00:59 +02002033 report_res_error:
2034 list_for_each_entry(req, &res->requesters, list)
2035 req->requester_error_cb(req, dns_resp);
2036 dns_reset_resolution(res);
2037 LIST_DEL(&res->list);
2038 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
2039 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002040
Christopher Faulet67957bd2017-09-27 11:00:59 +02002041 report_res_success:
2042 /* Only the 1rst requester s managed by the server, others are
2043 * from the cache */
2044 tmpns = ns;
2045 list_for_each_entry(req, &res->requesters, list) {
Olivier Houchard28381072017-11-06 17:30:28 +01002046 struct server *s = objt_server(req->owner);
2047
2048 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002049 HA_SPIN_LOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002050 req->requester_cb(req, tmpns);
Olivier Houchard28381072017-11-06 17:30:28 +01002051 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002052 HA_SPIN_UNLOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002053 tmpns = NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002054 }
Baptiste Assmann42746372017-05-03 12:12:02 +02002055
Christopher Faulet67957bd2017-09-27 11:00:59 +02002056 dns_reset_resolution(res);
2057 LIST_DEL(&res->list);
2058 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
2059 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02002060 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02002061 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002062 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Baptiste Assmann325137d2015-04-13 23:40:55 +02002063}
William Lallemand69e96442016-11-19 00:58:54 +01002064
Christopher Faulet67957bd2017-09-27 11:00:59 +02002065/* Called when a resolvers network socket is ready to send data */
2066static void dns_resolve_send(struct dgram_conn *dgram)
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002067{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002068 struct dns_resolvers *resolvers;
2069 struct dns_nameserver *ns;
2070 struct dns_resolution *res;
2071 int fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002072
Christopher Faulet67957bd2017-09-27 11:00:59 +02002073 fd = dgram->t.sock.fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002074
Christopher Faulet67957bd2017-09-27 11:00:59 +02002075 /* check if ready for sending */
2076 if (!fd_send_ready(fd))
2077 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002078
Christopher Faulet67957bd2017-09-27 11:00:59 +02002079 /* we don't want/need to be waked up any more for sending */
2080 fd_stop_send(fd);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002081
Christopher Faulet67957bd2017-09-27 11:00:59 +02002082 /* no need to go further if we can't retrieve the nameserver */
2083 if ((ns = dgram->owner) == NULL)
2084 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002085
Christopher Faulet67957bd2017-09-27 11:00:59 +02002086 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002087 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02002088
Christopher Faulet67957bd2017-09-27 11:00:59 +02002089 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02002090 int ret, len;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002091
Christopher Faulet67957bd2017-09-27 11:00:59 +02002092 if (res->nb_queries == resolvers->nb_nameservers)
2093 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002094
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02002095 len = dns_build_query(res->query_id, res->query_type,
2096 resolvers->accepted_payload_size,
2097 res->hostname_dn, res->hostname_dn_len,
2098 trash.area, trash.size);
2099 if (len == -1)
Christopher Faulet67957bd2017-09-27 11:00:59 +02002100 goto snd_error;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002101
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02002102 ret = send(fd, trash.area, len, 0);
Willy Tarreau0eae6322019-12-20 11:18:54 +01002103 if (ret != len) {
2104 if (ret == -1 && errno == EAGAIN) {
2105 /* retry once the socket is ready */
2106 fd_cant_send(fd);
2107 continue;
2108 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002109 goto snd_error;
Willy Tarreau0eae6322019-12-20 11:18:54 +01002110 }
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002111
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02002112 ns->counters->sent++;
2113
Christopher Faulet67957bd2017-09-27 11:00:59 +02002114 res->nb_queries++;
2115 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002116
Christopher Faulet67957bd2017-09-27 11:00:59 +02002117 snd_error:
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02002118 ns->counters->snd_error++;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002119 res->nb_queries++;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002120 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002121 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002122}
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002123
Christopher Faulet67957bd2017-09-27 11:00:59 +02002124/* Processes DNS resolution. First, it checks the active list to detect expired
2125 * resolutions and retry them if possible. Else a timeout is reported. Then, it
2126 * checks the wait list to trigger new resolutions.
2127 */
Olivier Houchard9f6af332018-05-25 14:04:04 +02002128static struct task *dns_process_resolvers(struct task *t, void *context, unsigned short state)
Christopher Faulet67957bd2017-09-27 11:00:59 +02002129{
Olivier Houchard9f6af332018-05-25 14:04:04 +02002130 struct dns_resolvers *resolvers = context;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002131 struct dns_resolution *res, *resback;
2132 int exp;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002133
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002134 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02002135
Christopher Faulet67957bd2017-09-27 11:00:59 +02002136 /* Handle all expired resolutions from the active list */
2137 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
2138 /* When we find the first resolution in the future, then we can
2139 * stop here */
2140 exp = tick_add(res->last_query, resolvers->timeout.retry);
2141 if (!tick_is_expired(exp, now_ms))
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002142 break;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002143
Christopher Faulet67957bd2017-09-27 11:00:59 +02002144 /* If current resolution has been tried too many times and
2145 * finishes in timeout we update its status and remove it from
2146 * the list */
2147 if (!res->try) {
2148 struct dns_requester *req;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002149
Christopher Faulet67957bd2017-09-27 11:00:59 +02002150 /* Notify the result to the requesters */
2151 if (!res->nb_responses)
2152 res->status = RSLV_STATUS_TIMEOUT;
2153 list_for_each_entry(req, &res->requesters, list)
2154 req->requester_error_cb(req, res->status);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002155
Christopher Faulet67957bd2017-09-27 11:00:59 +02002156 /* Clean up resolution info and remove it from the
2157 * current list */
2158 dns_reset_resolution(res);
2159 LIST_DEL(&res->list);
2160 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
William Lallemand69e96442016-11-19 00:58:54 +01002161 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002162 else {
2163 /* Otherwise resend the DNS query and requeue the resolution */
2164 if (!res->nb_responses || res->prefered_query_type != res->query_type) {
2165 /* No response received (a real timeout) or fallback already done */
2166 res->query_type = res->prefered_query_type;
2167 res->try--;
2168 }
2169 else {
2170 /* Fallback from A to AAAA or the opposite and re-send
2171 * the resolution immediately. try counter is not
2172 * decremented. */
2173 if (res->prefered_query_type == DNS_RTYPE_A)
2174 res->query_type = DNS_RTYPE_AAAA;
2175 else if (res->prefered_query_type == DNS_RTYPE_AAAA)
2176 res->query_type = DNS_RTYPE_A;
2177 else
2178 res->try--;
2179 }
2180 dns_send_query(res);
William Lallemand69e96442016-11-19 00:58:54 +01002181 }
2182 }
William Lallemand69e96442016-11-19 00:58:54 +01002183
Christopher Faulet67957bd2017-09-27 11:00:59 +02002184 /* Handle all resolutions in the wait list */
2185 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
2186 exp = tick_add(res->last_resolution, dns_resolution_timeout(res));
2187 if (tick_isset(res->last_resolution) && !tick_is_expired(exp, now_ms))
2188 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002189
Christopher Faulet67957bd2017-09-27 11:00:59 +02002190 if (dns_run_resolution(res) != 1) {
2191 res->last_resolution = now_ms;
2192 LIST_DEL(&res->list);
2193 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002194 }
2195 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002196
Christopher Faulet67957bd2017-09-27 11:00:59 +02002197 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002198 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002199 return t;
2200}
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002201
Christopher Faulet67957bd2017-09-27 11:00:59 +02002202/* proto_udp callback functions for a DNS resolution */
2203struct dgram_data_cb resolve_dgram_cb = {
2204 .recv = dns_resolve_recv,
2205 .send = dns_resolve_send,
2206};
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002207
Christopher Faulet67957bd2017-09-27 11:00:59 +02002208/* Release memory allocated by DNS */
2209static void dns_deinit(void)
2210{
2211 struct dns_resolvers *resolvers, *resolversback;
2212 struct dns_nameserver *ns, *nsback;
2213 struct dns_resolution *res, *resback;
2214 struct dns_requester *req, *reqback;
2215 struct dns_srvrq *srvrq, *srvrqback;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002216
Christopher Faulet67957bd2017-09-27 11:00:59 +02002217 list_for_each_entry_safe(resolvers, resolversback, &dns_resolvers, list) {
2218 list_for_each_entry_safe(ns, nsback, &resolvers->nameservers, list) {
2219 free(ns->id);
2220 free((char *)ns->conf.file);
2221 if (ns->dgram && ns->dgram->t.sock.fd != -1)
2222 fd_delete(ns->dgram->t.sock.fd);
2223 free(ns->dgram);
2224 LIST_DEL(&ns->list);
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02002225 EXTRA_COUNTERS_FREE(ns->extra_counters);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002226 free(ns);
2227 }
2228
2229 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
2230 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
2231 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01002232 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002233 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002234 dns_free_resolution(res);
2235 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02002236
Christopher Faulet67957bd2017-09-27 11:00:59 +02002237 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
2238 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
2239 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01002240 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002241 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002242 dns_free_resolution(res);
2243 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02002244
Christopher Faulet67957bd2017-09-27 11:00:59 +02002245 free(resolvers->id);
2246 free((char *)resolvers->conf.file);
Olivier Houchard3f795f72019-04-17 22:51:06 +02002247 task_destroy(resolvers->t);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002248 LIST_DEL(&resolvers->list);
2249 free(resolvers);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002250 }
2251
Christopher Faulet67957bd2017-09-27 11:00:59 +02002252 list_for_each_entry_safe(srvrq, srvrqback, &dns_srvrq_list, list) {
2253 free(srvrq->name);
2254 free(srvrq->hostname_dn);
2255 LIST_DEL(&srvrq->list);
2256 free(srvrq);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002257 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002258}
2259
Christopher Faulet67957bd2017-09-27 11:00:59 +02002260/* Finalizes the DNS configuration by allocating required resources and checking
2261 * live parameters.
2262 * Returns 0 on success, ERR_* flags otherwise.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002263 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02002264static int dns_finalize_config(void)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002265{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002266 struct dns_resolvers *resolvers;
2267 struct proxy *px;
2268 int err_code = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002269
Christopher Faulet67957bd2017-09-27 11:00:59 +02002270 /* allocate pool of resolution per resolvers */
2271 list_for_each_entry(resolvers, &dns_resolvers, list) {
2272 struct dns_nameserver *ns;
2273 struct task *t;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002274
Christopher Faulet67957bd2017-09-27 11:00:59 +02002275 /* Check if we can create the socket with nameservers info */
2276 list_for_each_entry(ns, &resolvers->nameservers, list) {
2277 struct dgram_conn *dgram = NULL;
2278 int fd;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002279
Christopher Faulet67957bd2017-09-27 11:00:59 +02002280 /* Check nameserver info */
2281 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002282 ha_alert("config : resolvers '%s': can't create socket for nameserver '%s'.\n",
2283 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002284 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002285 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02002286 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002287 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002288 ha_alert("config : resolvers '%s': can't connect socket for nameserver '%s'.\n",
2289 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002290 close(fd);
2291 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002292 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02002293 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002294 close(fd);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002295
Christopher Faulet67957bd2017-09-27 11:00:59 +02002296 /* Create dgram structure that will hold the UPD socket
2297 * and attach it on the current nameserver */
2298 if ((dgram = calloc(1, sizeof(*dgram))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002299 ha_alert("config: resolvers '%s' : out of memory.\n",
2300 resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002301 err_code |= (ERR_ALERT|ERR_ABORT);
2302 goto err;
2303 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002304
Christopher Faulet67957bd2017-09-27 11:00:59 +02002305 /* Leave dgram partially initialized, no FD attached for
2306 * now. */
2307 dgram->owner = ns;
2308 dgram->data = &resolve_dgram_cb;
2309 dgram->t.sock.fd = -1;
2310 ns->dgram = dgram;
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02002311
2312 /* Store the ns counters pointer */
2313 if (ns->extra_counters) {
2314 ns->counters = EXTRA_COUNTERS_GET(ns->extra_counters, &dns_stats_module);
2315 ns->counters->id = ns->id;
2316 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002317 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002318
Christopher Faulet67957bd2017-09-27 11:00:59 +02002319 /* Create the task associated to the resolvers section */
Emeric Brunc60def82017-09-27 14:59:38 +02002320 if ((t = task_new(MAX_THREADS_MASK)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002321 ha_alert("config : resolvers '%s' : out of memory.\n", resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002322 err_code |= (ERR_ALERT|ERR_ABORT);
2323 goto err;
2324 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002325
Christopher Faulet67957bd2017-09-27 11:00:59 +02002326 /* Update task's parameters */
2327 t->process = dns_process_resolvers;
2328 t->context = resolvers;
2329 resolvers->t = t;
2330 task_wakeup(t, TASK_WOKEN_INIT);
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002331 }
2332
Olivier Houchardfbc74e82017-11-24 16:54:05 +01002333 for (px = proxies_list; px; px = px->next) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002334 struct server *srv;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002335
Christopher Faulet67957bd2017-09-27 11:00:59 +02002336 for (srv = px->srv; srv; srv = srv->next) {
2337 struct dns_resolvers *resolvers;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002338
Christopher Faulet67957bd2017-09-27 11:00:59 +02002339 if (!srv->resolvers_id)
2340 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002341
Christopher Faulet67957bd2017-09-27 11:00:59 +02002342 if ((resolvers = find_resolvers_by_id(srv->resolvers_id)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002343 ha_alert("config : %s '%s', server '%s': unable to find required resolvers '%s'\n",
2344 proxy_type_str(px), px->id, srv->id, srv->resolvers_id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002345 err_code |= (ERR_ALERT|ERR_ABORT);
2346 continue;
2347 }
2348 srv->resolvers = resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002349
Christopher Faulet67957bd2017-09-27 11:00:59 +02002350 if (srv->srvrq && !srv->srvrq->resolvers) {
2351 srv->srvrq->resolvers = srv->resolvers;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01002352 if (dns_link_resolution(srv->srvrq, OBJ_TYPE_SRVRQ, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002353 ha_alert("config : %s '%s' : unable to set DNS resolution for server '%s'.\n",
2354 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002355 err_code |= (ERR_ALERT|ERR_ABORT);
2356 continue;
2357 }
2358 }
Olivier Houchard55dcdf42017-11-06 15:15:04 +01002359 if (dns_link_resolution(srv, OBJ_TYPE_SERVER, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002360 ha_alert("config : %s '%s', unable to set DNS resolution for server '%s'.\n",
2361 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002362 err_code |= (ERR_ALERT|ERR_ABORT);
2363 continue;
2364 }
2365 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002366 }
2367
Christopher Faulet67957bd2017-09-27 11:00:59 +02002368 if (err_code & (ERR_ALERT|ERR_ABORT))
2369 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002370
Christopher Faulet67957bd2017-09-27 11:00:59 +02002371 return err_code;
2372 err:
2373 dns_deinit();
2374 return err_code;
2375
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02002376}
2377
2378static int stats_dump_dns_to_buffer(struct stream_interface *si,
2379 struct dns_nameserver *ns,
2380 struct field *stats, size_t stats_count,
2381 struct list *stat_modules)
2382{
2383 struct appctx *appctx = __objt_appctx(si->end);
2384 struct channel *rep = si_ic(si);
2385 struct stats_module *mod;
2386 size_t idx = 0;
2387
2388 memset(stats, 0, sizeof(struct field) * stats_count);
2389
2390 list_for_each_entry(mod, stat_modules, list) {
2391 struct counters_node *counters = EXTRA_COUNTERS_GET(ns->extra_counters, mod);
2392
2393 mod->fill_stats(counters, stats + idx);
2394 idx += mod->stats_count;
2395 }
2396
2397 if (!stats_dump_one_line(stats, idx, appctx))
2398 return 0;
2399
2400 if (!stats_putchk(rep, NULL, &trash))
2401 goto full;
2402
2403 return 1;
2404
2405 full:
2406 si_rx_room_rdy(si);
2407 return 0;
2408}
2409
2410/* Uses <appctx.ctx.stats.obj1> as a pointer to the current resolver and <obj2>
2411 * as a pointer to the current nameserver.
2412 */
2413int stats_dump_dns(struct stream_interface *si,
2414 struct field *stats, size_t stats_count,
2415 struct list *stat_modules)
2416{
2417 struct appctx *appctx = __objt_appctx(si->end);
2418 struct channel *rep = si_ic(si);
2419 struct dns_resolvers *resolver = appctx->ctx.stats.obj1;
2420 struct dns_nameserver *ns = appctx->ctx.stats.obj2;
2421
2422 if (!resolver)
2423 resolver = LIST_NEXT(&dns_resolvers, struct dns_resolvers *, list);
2424
2425 /* dump resolvers */
2426 list_for_each_entry_from(resolver, &dns_resolvers, list) {
2427 appctx->ctx.stats.obj1 = resolver;
2428
2429 ns = appctx->ctx.stats.obj2 ?
2430 appctx->ctx.stats.obj2 :
2431 LIST_NEXT(&resolver->nameservers, struct dns_nameserver *, list);
2432
2433 list_for_each_entry_from(ns, &resolver->nameservers, list) {
2434 appctx->ctx.stats.obj2 = ns;
2435
2436 if (buffer_almost_full(&rep->buf))
2437 goto full;
2438
2439 if (!stats_dump_dns_to_buffer(si, ns,
2440 stats, stats_count,
2441 stat_modules)) {
2442 return 0;
2443 }
2444 }
2445
2446 appctx->ctx.stats.obj2 = NULL;
2447 }
2448
2449 return 1;
2450
2451 full:
2452 si_rx_room_blk(si);
2453 return 0;
2454}
2455
2456void dns_stats_clear_counters(int clrall, struct list *stat_modules)
2457{
2458 struct dns_resolvers *resolvers;
2459 struct dns_nameserver *ns;
2460 struct stats_module *mod;
2461 void *counters;
2462
2463 list_for_each_entry(mod, stat_modules, list) {
2464 if (!mod->clearable && !clrall)
2465 continue;
2466
2467 list_for_each_entry(resolvers, &dns_resolvers, list) {
2468 list_for_each_entry(ns, &resolvers->nameservers, list) {
2469 counters = EXTRA_COUNTERS_GET(ns->extra_counters, mod);
2470 memcpy(counters, mod->counters, mod->counters_size);
2471 }
2472 }
2473 }
2474
2475}
2476
2477int dns_allocate_counters(struct list *stat_modules)
2478{
2479 struct stats_module *mod;
2480 struct dns_resolvers *resolvers;
2481 struct dns_nameserver *ns;
2482
2483 list_for_each_entry(resolvers, &dns_resolvers, list) {
2484 list_for_each_entry(ns, &resolvers->nameservers, list) {
2485 EXTRA_COUNTERS_REGISTER(&ns->extra_counters, COUNTERS_DNS,
2486 alloc_failed);
2487
2488 list_for_each_entry(mod, stat_modules, list) {
2489 EXTRA_COUNTERS_ADD(mod,
2490 ns->extra_counters,
2491 mod->counters,
2492 mod->counters_size);
2493 }
2494
2495 EXTRA_COUNTERS_ALLOC(ns->extra_counters, alloc_failed);
2496
2497 list_for_each_entry(mod, stat_modules, list) {
2498 memcpy(ns->extra_counters->data + mod->counters_off[ns->extra_counters->type],
2499 mod->counters, mod->counters_size);
2500
2501 /* Store the ns counters pointer */
2502 if (!strcmp(mod->name, "dns")) {
2503 ns->counters = (struct dns_counters *)ns->extra_counters->data + mod->counters_off[COUNTERS_DNS];
2504 ns->counters->id = ns->id;
2505 }
2506 }
2507 }
2508 }
2509
2510 return 1;
2511
2512alloc_failed:
2513 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002514}
2515
Christopher Faulet67957bd2017-09-27 11:00:59 +02002516/* if an arg is found, it sets the resolvers section pointer into cli.p0 */
Aurélien Nephtaliabbf6072018-04-18 13:26:46 +02002517static int cli_parse_stat_resolvers(char **args, char *payload, struct appctx *appctx, void *private)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002518{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002519 struct dns_resolvers *presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002520
Christopher Faulet67957bd2017-09-27 11:00:59 +02002521 if (*args[2]) {
2522 list_for_each_entry(presolvers, &dns_resolvers, list) {
2523 if (strcmp(presolvers->id, args[2]) == 0) {
2524 appctx->ctx.cli.p0 = presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002525 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002526 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002527 }
Willy Tarreau9d008692019-08-09 11:21:01 +02002528 if (appctx->ctx.cli.p0 == NULL)
2529 return cli_err(appctx, "Can't find that resolvers section\n");
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002530 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002531 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002532}
2533
Christopher Faulet67957bd2017-09-27 11:00:59 +02002534/* Dumps counters from all resolvers section and associated name servers. It
2535 * returns 0 if the output buffer is full and it needs to be called again,
2536 * otherwise non-zero. It may limit itself to the resolver pointed to by
Willy Tarreau777b5602016-12-16 18:06:26 +01002537 * <cli.p0> if it's not null.
William Lallemand69e96442016-11-19 00:58:54 +01002538 */
2539static int cli_io_handler_dump_resolvers_to_buffer(struct appctx *appctx)
2540{
2541 struct stream_interface *si = appctx->owner;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002542 struct dns_resolvers *resolvers;
2543 struct dns_nameserver *ns;
William Lallemand69e96442016-11-19 00:58:54 +01002544
2545 chunk_reset(&trash);
2546
2547 switch (appctx->st2) {
2548 case STAT_ST_INIT:
2549 appctx->st2 = STAT_ST_LIST; /* let's start producing data */
2550 /* fall through */
2551
2552 case STAT_ST_LIST:
2553 if (LIST_ISEMPTY(&dns_resolvers)) {
2554 chunk_appendf(&trash, "No resolvers found\n");
2555 }
2556 else {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002557 list_for_each_entry(resolvers, &dns_resolvers, list) {
2558 if (appctx->ctx.cli.p0 != NULL && appctx->ctx.cli.p0 != resolvers)
William Lallemand69e96442016-11-19 00:58:54 +01002559 continue;
2560
Christopher Faulet67957bd2017-09-27 11:00:59 +02002561 chunk_appendf(&trash, "Resolvers section %s\n", resolvers->id);
2562 list_for_each_entry(ns, &resolvers->nameservers, list) {
2563 chunk_appendf(&trash, " nameserver %s:\n", ns->id);
Amaury Denoyellefbd0bc92020-10-05 11:49:46 +02002564 chunk_appendf(&trash, " sent: %lld\n", ns->counters->sent);
2565 chunk_appendf(&trash, " snd_error: %lld\n", ns->counters->snd_error);
2566 chunk_appendf(&trash, " valid: %lld\n", ns->counters->valid);
2567 chunk_appendf(&trash, " update: %lld\n", ns->counters->update);
2568 chunk_appendf(&trash, " cname: %lld\n", ns->counters->cname);
2569 chunk_appendf(&trash, " cname_error: %lld\n", ns->counters->cname_error);
2570 chunk_appendf(&trash, " any_err: %lld\n", ns->counters->any_err);
2571 chunk_appendf(&trash, " nx: %lld\n", ns->counters->nx);
2572 chunk_appendf(&trash, " timeout: %lld\n", ns->counters->timeout);
2573 chunk_appendf(&trash, " refused: %lld\n", ns->counters->refused);
2574 chunk_appendf(&trash, " other: %lld\n", ns->counters->other);
2575 chunk_appendf(&trash, " invalid: %lld\n", ns->counters->invalid);
2576 chunk_appendf(&trash, " too_big: %lld\n", ns->counters->too_big);
2577 chunk_appendf(&trash, " truncated: %lld\n", ns->counters->truncated);
2578 chunk_appendf(&trash, " outdated: %lld\n", ns->counters->outdated);
William Lallemand69e96442016-11-19 00:58:54 +01002579 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002580 chunk_appendf(&trash, "\n");
William Lallemand69e96442016-11-19 00:58:54 +01002581 }
2582 }
2583
2584 /* display response */
Willy Tarreau06d80a92017-10-19 14:32:15 +02002585 if (ci_putchk(si_ic(si), &trash) == -1) {
William Lallemand69e96442016-11-19 00:58:54 +01002586 /* let's try again later from this session. We add ourselves into
2587 * this session's users so that it can remove us upon termination.
2588 */
Willy Tarreaudb398432018-11-15 11:08:52 +01002589 si_rx_room_blk(si);
William Lallemand69e96442016-11-19 00:58:54 +01002590 return 0;
2591 }
William Lallemand69e96442016-11-19 00:58:54 +01002592 /* fall through */
2593
2594 default:
2595 appctx->st2 = STAT_ST_FIN;
2596 return 1;
2597 }
2598}
2599
2600/* register cli keywords */
Christopher Fauletff88efb2017-10-03 16:00:57 +02002601static struct cli_kw_list cli_kws = {{ }, {
2602 { { "show", "resolvers", NULL }, "show resolvers [id]: dumps counters from all resolvers section and\n"
2603 " associated name servers",
2604 cli_parse_stat_resolvers, cli_io_handler_dump_resolvers_to_buffer },
2605 {{},}
2606 }
2607};
William Lallemand69e96442016-11-19 00:58:54 +01002608
Willy Tarreau0108d902018-11-25 19:14:37 +01002609INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
William Lallemand69e96442016-11-19 00:58:54 +01002610
Baptiste Assmann333939c2019-01-21 08:34:50 +01002611/*
2612 * Prepare <rule> for hostname resolution.
2613 * Returns -1 in case of any allocation failure, 0 if not.
2614 * On error, a global failure counter is also incremented.
2615 */
2616static int action_prepare_for_resolution(struct stream *stream, const char *hostname)
2617{
2618 char *hostname_dn;
2619 int hostname_len, hostname_dn_len;
2620 struct buffer *tmp = get_trash_chunk();
2621
2622 if (!hostname)
2623 return 0;
2624
2625 hostname_len = strlen(hostname);
2626 hostname_dn = tmp->area;
2627 hostname_dn_len = dns_str_to_dn_label(hostname, hostname_len + 1,
2628 hostname_dn, tmp->size);
2629 if (hostname_dn_len == -1)
2630 goto err;
2631
2632
2633 stream->dns_ctx.hostname_dn = strdup(hostname_dn);
2634 stream->dns_ctx.hostname_dn_len = hostname_dn_len;
2635 if (!stream->dns_ctx.hostname_dn)
2636 goto err;
2637
2638 return 0;
2639
2640 err:
2641 free(stream->dns_ctx.hostname_dn); stream->dns_ctx.hostname_dn = NULL;
2642 dns_failed_resolutions += 1;
2643 return -1;
2644}
2645
2646
2647/*
2648 * Execute the "do-resolution" action. May be called from {tcp,http}request.
2649 */
2650enum act_return dns_action_do_resolve(struct act_rule *rule, struct proxy *px,
2651 struct session *sess, struct stream *s, int flags)
2652{
Baptiste Assmann333939c2019-01-21 08:34:50 +01002653 struct dns_resolution *resolution;
Willy Tarreau45726fd2019-07-17 10:38:45 +02002654 struct sample *smp;
2655 char *fqdn;
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002656 struct dns_requester *req;
2657 struct dns_resolvers *resolvers;
2658 struct dns_resolution *res;
Christopher Faulet5098a082020-07-22 11:46:32 +02002659 int exp, locked = 0;
2660 enum act_return ret = ACT_RET_CONT;
2661
2662 resolvers = rule->arg.dns.resolvers;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002663
2664 /* we have a response to our DNS resolution */
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002665 use_cache:
Baptiste Assmann333939c2019-01-21 08:34:50 +01002666 if (s->dns_ctx.dns_requester && s->dns_ctx.dns_requester->resolution != NULL) {
2667 resolution = s->dns_ctx.dns_requester->resolution;
Christopher Faulet5098a082020-07-22 11:46:32 +02002668 if (!locked) {
2669 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
2670 locked = 1;
2671 }
2672
Christopher Faulet385101e2020-07-28 10:21:54 +02002673 if (resolution->step == RSLV_STEP_RUNNING)
2674 goto yield;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002675 if (resolution->step == RSLV_STEP_NONE) {
2676 /* We update the variable only if we have a valid response. */
2677 if (resolution->status == RSLV_STATUS_VALID) {
2678 struct sample smp;
2679 short ip_sin_family = 0;
2680 void *ip = NULL;
2681
Christopher Fauleta4168432020-01-24 18:08:42 +01002682 dns_get_ip_from_response(&resolution->response, rule->arg.dns.dns_opts, NULL,
Baptiste Assmann333939c2019-01-21 08:34:50 +01002683 0, &ip, &ip_sin_family, NULL);
2684
2685 switch (ip_sin_family) {
2686 case AF_INET:
2687 smp.data.type = SMP_T_IPV4;
2688 memcpy(&smp.data.u.ipv4, ip, 4);
2689 break;
2690 case AF_INET6:
2691 smp.data.type = SMP_T_IPV6;
2692 memcpy(&smp.data.u.ipv6, ip, 16);
2693 break;
2694 default:
2695 ip = NULL;
2696 }
2697
2698 if (ip) {
2699 smp.px = px;
2700 smp.sess = sess;
2701 smp.strm = s;
2702
2703 vars_set_by_name(rule->arg.dns.varname, strlen(rule->arg.dns.varname), &smp);
2704 }
2705 }
2706 }
2707
Christopher Faulet385101e2020-07-28 10:21:54 +02002708 goto release_requester;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002709 }
2710
2711 /* need to configure and start a new DNS resolution */
Willy Tarreau45726fd2019-07-17 10:38:45 +02002712 smp = sample_fetch_as_type(px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.dns.expr, SMP_T_STR);
2713 if (smp == NULL)
Christopher Faulet5098a082020-07-22 11:46:32 +02002714 goto end;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002715
Willy Tarreau45726fd2019-07-17 10:38:45 +02002716 fqdn = smp->data.u.str.area;
2717 if (action_prepare_for_resolution(s, fqdn) == -1)
Christopher Faulet5098a082020-07-22 11:46:32 +02002718 goto end; /* on error, ignore the action */
Baptiste Assmann333939c2019-01-21 08:34:50 +01002719
Willy Tarreau45726fd2019-07-17 10:38:45 +02002720 s->dns_ctx.parent = rule;
Christopher Faulet5098a082020-07-22 11:46:32 +02002721
2722 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
2723 locked = 1;
2724
Willy Tarreau45726fd2019-07-17 10:38:45 +02002725 dns_link_resolution(s, OBJ_TYPE_STREAM, 0);
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002726
2727 /* Check if there is a fresh enough response in the cache of our associated resolution */
2728 req = s->dns_ctx.dns_requester;
Christopher Faulet385101e2020-07-28 10:21:54 +02002729 if (!req || !req->resolution)
2730 goto release_requester; /* on error, ignore the action */
Christopher Faulet5098a082020-07-22 11:46:32 +02002731 res = req->resolution;
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002732
2733 exp = tick_add(res->last_resolution, resolvers->hold.valid);
2734 if (resolvers->t && res->status == RSLV_STATUS_VALID && tick_isset(res->last_resolution)
Christopher Faulet385101e2020-07-28 10:21:54 +02002735 && !tick_is_expired(exp, now_ms)) {
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002736 goto use_cache;
2737 }
2738
Willy Tarreau45726fd2019-07-17 10:38:45 +02002739 dns_trigger_resolution(s->dns_ctx.dns_requester);
Christopher Faulet385101e2020-07-28 10:21:54 +02002740
2741 yield:
2742 if (flags & ACT_OPT_FINAL)
2743 goto release_requester;
Christopher Faulet5098a082020-07-22 11:46:32 +02002744 ret = ACT_RET_YIELD;
2745
2746 end:
2747 if (locked)
2748 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
2749 return ret;
Christopher Faulet385101e2020-07-28 10:21:54 +02002750
2751 release_requester:
2752 free(s->dns_ctx.hostname_dn);
2753 s->dns_ctx.hostname_dn = NULL;
2754 s->dns_ctx.hostname_dn_len = 0;
2755 if (s->dns_ctx.dns_requester) {
2756 dns_unlink_resolution(s->dns_ctx.dns_requester);
2757 pool_free(dns_requester_pool, s->dns_ctx.dns_requester);
2758 s->dns_ctx.dns_requester = NULL;
2759 }
2760 goto end;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002761}
2762
Christopher Faulet3b2bb632020-01-24 18:12:58 +01002763static void release_dns_action(struct act_rule *rule)
2764{
2765 release_sample_expr(rule->arg.dns.expr);
2766 free(rule->arg.dns.varname);
2767 free(rule->arg.dns.resolvers_id);
2768 free(rule->arg.dns.dns_opts);
2769}
2770
Baptiste Assmann333939c2019-01-21 08:34:50 +01002771
2772/* parse "do-resolve" action
2773 * This action takes the following arguments:
2774 * do-resolve(<varName>,<resolversSectionName>,<resolvePrefer>) <expr>
2775 *
2776 * - <varName> is the variable name where the result of the DNS resolution will be stored
2777 * (mandatory)
2778 * - <resolversSectionName> is the name of the resolvers section to use to perform the resolution
2779 * (mandatory)
2780 * - <resolvePrefer> can be either 'ipv4' or 'ipv6' and is the IP family we would like to resolve first
2781 * (optional), defaults to ipv6
2782 * - <expr> is an HAProxy expression used to fetch the name to be resolved
2783 */
2784enum act_parse_ret dns_parse_do_resolve(const char **args, int *orig_arg, struct proxy *px, struct act_rule *rule, char **err)
2785{
2786 int cur_arg;
2787 struct sample_expr *expr;
2788 unsigned int where;
2789 const char *beg, *end;
2790
2791 /* orig_arg points to the first argument, but we need to analyse the command itself first */
2792 cur_arg = *orig_arg - 1;
2793
2794 /* locate varName, which is mandatory */
2795 beg = strchr(args[cur_arg], '(');
2796 if (beg == NULL)
2797 goto do_resolve_parse_error;
2798 beg = beg + 1; /* beg should points to the first character after opening parenthesis '(' */
2799 end = strchr(beg, ',');
2800 if (end == NULL)
2801 goto do_resolve_parse_error;
2802 rule->arg.dns.varname = my_strndup(beg, end - beg);
2803 if (rule->arg.dns.varname == NULL)
2804 goto do_resolve_parse_error;
2805
2806
2807 /* locate resolversSectionName, which is mandatory.
2808 * Since next parameters are optional, the delimiter may be comma ','
2809 * or closing parenthesis ')'
2810 */
2811 beg = end + 1;
2812 end = strchr(beg, ',');
2813 if (end == NULL)
2814 end = strchr(beg, ')');
2815 if (end == NULL)
2816 goto do_resolve_parse_error;
2817 rule->arg.dns.resolvers_id = my_strndup(beg, end - beg);
2818 if (rule->arg.dns.resolvers_id == NULL)
2819 goto do_resolve_parse_error;
2820
2821
Christopher Fauleta4168432020-01-24 18:08:42 +01002822 rule->arg.dns.dns_opts = calloc(1, sizeof(*rule->arg.dns.dns_opts));
2823 if (rule->arg.dns.dns_opts == NULL)
2824 goto do_resolve_parse_error;
2825
Baptiste Assmann333939c2019-01-21 08:34:50 +01002826 /* Default priority is ipv6 */
Christopher Fauleta4168432020-01-24 18:08:42 +01002827 rule->arg.dns.dns_opts->family_prio = AF_INET6;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002828
2829 /* optional arguments accepted for now:
2830 * ipv4 or ipv6
2831 */
2832 while (*end != ')') {
2833 beg = end + 1;
2834 end = strchr(beg, ',');
2835 if (end == NULL)
2836 end = strchr(beg, ')');
2837 if (end == NULL)
2838 goto do_resolve_parse_error;
2839
2840 if (strncmp(beg, "ipv4", end - beg) == 0) {
Christopher Fauleta4168432020-01-24 18:08:42 +01002841 rule->arg.dns.dns_opts->family_prio = AF_INET;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002842 }
2843 else if (strncmp(beg, "ipv6", end - beg) == 0) {
Christopher Fauleta4168432020-01-24 18:08:42 +01002844 rule->arg.dns.dns_opts->family_prio = AF_INET6;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002845 }
2846 else {
2847 goto do_resolve_parse_error;
2848 }
2849 }
2850
2851 cur_arg = cur_arg + 1;
2852
Willy Tarreaue3b57bf2020-02-14 16:50:14 +01002853 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args, NULL);
Baptiste Assmann333939c2019-01-21 08:34:50 +01002854 if (!expr)
2855 goto do_resolve_parse_error;
2856
2857
2858 where = 0;
2859 if (px->cap & PR_CAP_FE)
2860 where |= SMP_VAL_FE_HRQ_HDR;
2861 if (px->cap & PR_CAP_BE)
2862 where |= SMP_VAL_BE_HRQ_HDR;
2863
2864 if (!(expr->fetch->val & where)) {
2865 memprintf(err,
2866 "fetch method '%s' extracts information from '%s', none of which is available here",
2867 args[cur_arg-1], sample_src_names(expr->fetch->use));
2868 free(expr);
2869 return ACT_RET_PRS_ERR;
2870 }
2871 rule->arg.dns.expr = expr;
2872 rule->action = ACT_CUSTOM;
2873 rule->action_ptr = dns_action_do_resolve;
2874 *orig_arg = cur_arg;
2875
2876 rule->check_ptr = check_action_do_resolve;
Christopher Faulet3b2bb632020-01-24 18:12:58 +01002877 rule->release_ptr = release_dns_action;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002878
2879 return ACT_RET_PRS_OK;
2880
2881 do_resolve_parse_error:
2882 free(rule->arg.dns.varname); rule->arg.dns.varname = NULL;
2883 free(rule->arg.dns.resolvers_id); rule->arg.dns.resolvers_id = NULL;
2884 memprintf(err, "Can't parse '%s'. Expects 'do-resolve(<varname>,<resolvers>[,<options>]) <expr>'. Available options are 'ipv4' and 'ipv6'",
2885 args[cur_arg]);
2886 return ACT_RET_PRS_ERR;
2887}
2888
2889static struct action_kw_list http_req_kws = { { }, {
2890 { "do-resolve", dns_parse_do_resolve, 1 },
2891 { /* END */ }
2892}};
2893
2894INITCALL1(STG_REGISTER, http_req_keywords_register, &http_req_kws);
2895
2896static struct action_kw_list tcp_req_cont_actions = {ILH, {
2897 { "do-resolve", dns_parse_do_resolve, 1 },
2898 { /* END */ }
2899}};
2900
2901INITCALL1(STG_REGISTER, tcp_req_cont_keywords_register, &tcp_req_cont_actions);
2902
2903/* Check an "http-request do-resolve" action.
2904 *
2905 * The function returns 1 in success case, otherwise, it returns 0 and err is
2906 * filled.
2907 */
2908int check_action_do_resolve(struct act_rule *rule, struct proxy *px, char **err)
2909{
2910 struct dns_resolvers *resolvers = NULL;
2911
2912 if (rule->arg.dns.resolvers_id == NULL) {
2913 memprintf(err,"Proxy '%s': %s", px->id, "do-resolve action without resolvers");
2914 return 0;
2915 }
2916
2917 resolvers = find_resolvers_by_id(rule->arg.dns.resolvers_id);
2918 if (resolvers == NULL) {
2919 memprintf(err,"Can't find resolvers section '%s' for do-resolve action", rule->arg.dns.resolvers_id);
2920 return 0;
2921 }
2922 rule->arg.dns.resolvers = resolvers;
2923
2924 return 1;
2925}
2926
Willy Tarreau172f5ce2018-11-26 11:21:50 +01002927REGISTER_POST_DEINIT(dns_deinit);
Willy Tarreaue6552512018-11-26 11:33:13 +01002928REGISTER_CONFIG_POSTPARSER("dns runtime resolver", dns_finalize_config);