blob: c1fe1e29b6c1115732338f9b7c356367d737962a [file] [log] [blame]
Baptiste Assmann325137d2015-04-13 23:40:55 +02001/*
2 * Name server resolution
3 *
4 * Copyright 2014 Baptiste Assmann <bedis9@gmail.com>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <errno.h>
14#include <fcntl.h>
15#include <stdio.h>
16#include <stdlib.h>
17#include <string.h>
18#include <unistd.h>
19
20#include <sys/types.h>
21
Willy Tarreau122eba92020-06-04 10:15:32 +020022#include <haproxy/action.h>
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020023#include <haproxy/api.h>
Baptiste Assmann044fd5b2018-08-10 10:56:38 +020024#include <common/cfgparse.h>
Willy Tarreaueb92deb2020-06-04 10:53:16 +020025#include <haproxy/dns.h>
Willy Tarreau8d366972020-05-27 16:10:29 +020026#include <haproxy/errors.h>
Willy Tarreau92b4f132020-06-01 11:05:15 +020027#include <haproxy/time.h>
Willy Tarreauc2f7c582020-06-02 18:15:32 +020028#include <haproxy/ticks.h>
Willy Tarreau6131d6a2020-06-02 16:48:09 +020029#include <haproxy/net_helper.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020030
William Lallemand69e96442016-11-19 00:58:54 +010031#include <types/applet.h>
32#include <types/cli.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020033#include <types/global.h>
William Lallemand69e96442016-11-19 00:58:54 +010034#include <types/stats.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020035
William Lallemand69e96442016-11-19 00:58:54 +010036#include <proto/channel.h>
37#include <proto/cli.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020038#include <proto/checks.h>
Willy Tarreau0f6ffd62020-06-03 19:33:00 +020039#include <haproxy/fd.h>
Christopher Fauletfc9cfe42019-07-16 14:54:53 +020040#include <proto/http_ana.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010041#include <proto/http_rules.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020042#include <proto/log.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010043#include <proto/sample.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020044#include <proto/server.h>
45#include <proto/task.h>
Willy Tarreau832ce652020-06-04 08:36:05 +020046#include <haproxy/proto_udp.h>
Christopher Faulet67957bd2017-09-27 11:00:59 +020047#include <proto/proxy.h>
William Lallemand69e96442016-11-19 00:58:54 +010048#include <proto/stream_interface.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010049#include <proto/tcp_rules.h>
50#include <proto/vars.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020051
Christopher Faulet67957bd2017-09-27 11:00:59 +020052struct list dns_resolvers = LIST_HEAD_INIT(dns_resolvers);
53struct list dns_srvrq_list = LIST_HEAD_INIT(dns_srvrq_list);
Baptiste Assmann325137d2015-04-13 23:40:55 +020054
Tim Duesterhusfcac33d2020-01-18 02:04:12 +010055static THREAD_LOCAL uint64_t dns_query_id_seed = 0; /* random seed */
Willy Tarreau8ceae722018-11-26 11:58:30 +010056
57DECLARE_STATIC_POOL(dns_answer_item_pool, "dns_answer_item", sizeof(struct dns_answer_item));
58DECLARE_STATIC_POOL(dns_resolution_pool, "dns_resolution", sizeof(struct dns_resolution));
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +010059DECLARE_POOL(dns_requester_pool, "dns_requester", sizeof(struct dns_requester));
Willy Tarreau8ceae722018-11-26 11:58:30 +010060
Christopher Faulet67957bd2017-09-27 11:00:59 +020061static unsigned int resolution_uuid = 1;
Baptiste Assmann333939c2019-01-21 08:34:50 +010062unsigned int dns_failed_resolutions = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020063
Christopher Faulet67957bd2017-09-27 11:00:59 +020064/* Returns a pointer to the resolvers matching the id <id>. NULL is returned if
65 * no match is found.
Baptiste Assmann325137d2015-04-13 23:40:55 +020066 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020067struct dns_resolvers *find_resolvers_by_id(const char *id)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020068{
Christopher Faulet67957bd2017-09-27 11:00:59 +020069 struct dns_resolvers *res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020070
Christopher Faulet67957bd2017-09-27 11:00:59 +020071 list_for_each_entry(res, &dns_resolvers, list) {
72 if (!strcmp(res->id, id))
73 return res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020074 }
Christopher Faulet67957bd2017-09-27 11:00:59 +020075 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020076}
77
Olivier Houchardb17b8842020-04-01 18:30:27 +020078/* Compare hostnames in a case-insensitive way .
79 * Returns 0 if they are the same, non-zero otherwise
80 */
81static __inline int dns_hostname_cmp(const char *name1, const char *name2, int len)
82{
83 int i;
84
85 for (i = 0; i < len; i++)
86 if (tolower(name1[i]) != tolower(name2[i]))
87 return -1;
88 return 0;
89}
90
Christopher Faulet67957bd2017-09-27 11:00:59 +020091/* Returns a pointer on the SRV request matching the name <name> for the proxy
92 * <px>. NULL is returned if no match is found.
Baptiste Assmann201c07f2017-05-22 15:17:15 +020093 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020094struct dns_srvrq *find_srvrq_by_name(const char *name, struct proxy *px)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020095{
Christopher Faulet67957bd2017-09-27 11:00:59 +020096 struct dns_srvrq *srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020097
Christopher Faulet67957bd2017-09-27 11:00:59 +020098 list_for_each_entry(srvrq, &dns_srvrq_list, list) {
99 if (srvrq->proxy == px && !strcmp(srvrq->name, name))
100 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200101 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200102 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200103}
104
Christopher Faulet67957bd2017-09-27 11:00:59 +0200105/* Allocates a new SRVRQ for the given server with the name <fqdn>. It returns
106 * NULL if an error occurred. */
107struct dns_srvrq *new_dns_srvrq(struct server *srv, char *fqdn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200108{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200109 struct proxy *px = srv->proxy;
110 struct dns_srvrq *srvrq = NULL;
111 int fqdn_len, hostname_dn_len;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200112
Christopher Faulet67957bd2017-09-27 11:00:59 +0200113 fqdn_len = strlen(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200114 hostname_dn_len = dns_str_to_dn_label(fqdn, fqdn_len + 1, trash.area,
115 trash.size);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200116 if (hostname_dn_len == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100117 ha_alert("config : %s '%s', server '%s': failed to parse FQDN '%s'\n",
118 proxy_type_str(px), px->id, srv->id, fqdn);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200119 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200120 }
121
Christopher Faulet67957bd2017-09-27 11:00:59 +0200122 if ((srvrq = calloc(1, sizeof(*srvrq))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100123 ha_alert("config : %s '%s', server '%s': out of memory\n",
124 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200125 goto err;
126 }
127 srvrq->obj_type = OBJ_TYPE_SRVRQ;
128 srvrq->proxy = px;
129 srvrq->name = strdup(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200130 srvrq->hostname_dn = strdup(trash.area);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200131 srvrq->hostname_dn_len = hostname_dn_len;
132 if (!srvrq->name || !srvrq->hostname_dn) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100133 ha_alert("config : %s '%s', server '%s': out of memory\n",
134 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200135 goto err;
136 }
137 LIST_ADDQ(&dns_srvrq_list, &srvrq->list);
138 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200139
Christopher Faulet67957bd2017-09-27 11:00:59 +0200140 err:
141 if (srvrq) {
142 free(srvrq->name);
143 free(srvrq->hostname_dn);
144 free(srvrq);
145 }
146 return NULL;
147}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200148
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200149
Christopher Faulet67957bd2017-09-27 11:00:59 +0200150/* 2 bytes random generator to generate DNS query ID */
151static inline uint16_t dns_rnd16(void)
152{
Christopher Fauletb2812a62017-10-04 16:17:58 +0200153 if (!dns_query_id_seed)
154 dns_query_id_seed = now_ms;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200155 dns_query_id_seed ^= dns_query_id_seed << 13;
156 dns_query_id_seed ^= dns_query_id_seed >> 7;
157 dns_query_id_seed ^= dns_query_id_seed << 17;
158 return dns_query_id_seed;
159}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200160
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200161
Christopher Faulet67957bd2017-09-27 11:00:59 +0200162static inline int dns_resolution_timeout(struct dns_resolution *res)
163{
Baptiste Assmannf50e1ac2019-11-07 11:02:18 +0100164 return res->resolvers->timeout.resolve;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200165}
166
Christopher Faulet67957bd2017-09-27 11:00:59 +0200167/* Updates a resolvers' task timeout for next wake up and queue it */
168static void dns_update_resolvers_timeout(struct dns_resolvers *resolvers)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200169{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200170 struct dns_resolution *res;
171 int next;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200172
Christopher Faulet67957bd2017-09-27 11:00:59 +0200173 next = tick_add(now_ms, resolvers->timeout.resolve);
174 if (!LIST_ISEMPTY(&resolvers->resolutions.curr)) {
175 res = LIST_NEXT(&resolvers->resolutions.curr, struct dns_resolution *, list);
176 next = MIN(next, tick_add(res->last_query, resolvers->timeout.retry));
177 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200178
Christopher Faulet67957bd2017-09-27 11:00:59 +0200179 list_for_each_entry(res, &resolvers->resolutions.wait, list)
180 next = MIN(next, tick_add(res->last_resolution, dns_resolution_timeout(res)));
Baptiste Assmann325137d2015-04-13 23:40:55 +0200181
Christopher Faulet67957bd2017-09-27 11:00:59 +0200182 resolvers->t->expire = next;
183 task_queue(resolvers->t);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200184}
185
Christopher Faulet67957bd2017-09-27 11:00:59 +0200186/* Opens an UDP socket on the namesaver's IP/Port, if required. Returns 0 on
187 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200188 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200189static int dns_connect_namesaver(struct dns_nameserver *ns)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200190{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200191 struct dgram_conn *dgram = ns->dgram;
192 int fd;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200193
Christopher Faulet67957bd2017-09-27 11:00:59 +0200194 /* Already connected */
195 if (dgram->t.sock.fd != -1)
196 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200197
Christopher Faulet67957bd2017-09-27 11:00:59 +0200198 /* Create an UDP socket and connect it on the nameserver's IP/Port */
199 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
200 send_log(NULL, LOG_WARNING,
201 "DNS : resolvers '%s': can't create socket for nameserver '%s'.\n",
202 ns->resolvers->id, ns->id);
203 return -1;
204 }
205 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
206 send_log(NULL, LOG_WARNING,
207 "DNS : resolvers '%s': can't connect socket for nameserver '%s'.\n",
208 ns->resolvers->id, ns->id);
209 close(fd);
210 return -1;
211 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200212
Christopher Faulet67957bd2017-09-27 11:00:59 +0200213 /* Make the socket non blocking */
214 fcntl(fd, F_SETFL, O_NONBLOCK);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200215
Christopher Faulet67957bd2017-09-27 11:00:59 +0200216 /* Add the fd in the fd list and update its parameters */
217 dgram->t.sock.fd = fd;
Willy Tarreaua9786b62018-01-25 07:22:13 +0100218 fd_insert(fd, dgram, dgram_fd_handler, MAX_THREADS_MASK);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200219 fd_want_recv(fd);
220 return 0;
221}
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200222
Christopher Faulet67957bd2017-09-27 11:00:59 +0200223/* Forges a DNS query. It needs the following information from the caller:
224 * - <query_id> : the DNS query id corresponding to this query
225 * - <query_type> : DNS_RTYPE_* request DNS record type (A, AAAA, ANY...)
226 * - <hostname_dn> : hostname in domain name format
227 * - <hostname_dn_len> : length of <hostname_dn>
228 *
229 * To store the query, the caller must pass a buffer <buf> and its size
230 * <bufsize>. It returns the number of written bytes in success, -1 if <buf> is
231 * too short.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200232 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200233static int dns_build_query(int query_id, int query_type, unsigned int accepted_payload_size,
234 char *hostname_dn, int hostname_dn_len, char *buf, int bufsize)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200235{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200236 struct dns_header dns_hdr;
237 struct dns_question qinfo;
238 struct dns_additional_record edns;
239 char *p = buf;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200240
Christopher Faulet67957bd2017-09-27 11:00:59 +0200241 if (sizeof(dns_hdr) + sizeof(qinfo) + sizeof(edns) + hostname_dn_len >= bufsize)
242 return -1;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200243
Christopher Faulet67957bd2017-09-27 11:00:59 +0200244 memset(buf, 0, bufsize);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200245
Christopher Faulet67957bd2017-09-27 11:00:59 +0200246 /* Set dns query headers */
247 dns_hdr.id = (unsigned short) htons(query_id);
248 dns_hdr.flags = htons(0x0100); /* qr=0, opcode=0, aa=0, tc=0, rd=1, ra=0, z=0, rcode=0 */
249 dns_hdr.qdcount = htons(1); /* 1 question */
250 dns_hdr.ancount = 0;
251 dns_hdr.nscount = 0;
252 dns_hdr.arcount = htons(1);
253 memcpy(p, &dns_hdr, sizeof(dns_hdr));
254 p += sizeof(dns_hdr);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200255
Christopher Faulet67957bd2017-09-27 11:00:59 +0200256 /* Set up query hostname */
257 memcpy(p, hostname_dn, hostname_dn_len);
258 p += hostname_dn_len;
259 *p++ = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200260
Christopher Faulet67957bd2017-09-27 11:00:59 +0200261 /* Set up query info (type and class) */
262 qinfo.qtype = htons(query_type);
263 qinfo.qclass = htons(DNS_RCLASS_IN);
264 memcpy(p, &qinfo, sizeof(qinfo));
265 p += sizeof(qinfo);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200266
Christopher Faulet67957bd2017-09-27 11:00:59 +0200267 /* Set the DNS extension */
268 edns.name = 0;
269 edns.type = htons(DNS_RTYPE_OPT);
270 edns.udp_payload_size = htons(accepted_payload_size);
271 edns.extension = 0;
272 edns.data_length = 0;
273 memcpy(p, &edns, sizeof(edns));
274 p += sizeof(edns);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200275
Christopher Faulet67957bd2017-09-27 11:00:59 +0200276 return (p - buf);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200277}
278
Christopher Faulet67957bd2017-09-27 11:00:59 +0200279/* Sends a DNS query to resolvers associated to a resolution. It returns 0 on
280 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200281 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200282static int dns_send_query(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200283{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200284 struct dns_resolvers *resolvers = resolution->resolvers;
285 struct dns_nameserver *ns;
Willy Tarreau0eae6322019-12-20 11:18:54 +0100286 int len;
287
288 /* Update resolution */
289 resolution->nb_queries = 0;
290 resolution->nb_responses = 0;
291 resolution->last_query = now_ms;
292
293 len = dns_build_query(resolution->query_id, resolution->query_type,
294 resolvers->accepted_payload_size,
295 resolution->hostname_dn, resolution->hostname_dn_len,
296 trash.area, trash.size);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200297
Christopher Faulet67957bd2017-09-27 11:00:59 +0200298 list_for_each_entry(ns, &resolvers->nameservers, list) {
299 int fd = ns->dgram->t.sock.fd;
Willy Tarreau0eae6322019-12-20 11:18:54 +0100300 int ret;
301
Christopher Faulet67957bd2017-09-27 11:00:59 +0200302 if (fd == -1) {
303 if (dns_connect_namesaver(ns) == -1)
304 continue;
305 fd = ns->dgram->t.sock.fd;
306 resolvers->nb_nameservers++;
307 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200308
Willy Tarreau0eae6322019-12-20 11:18:54 +0100309 if (len < 0)
310 goto snd_error;
311
312 ret = send(fd, trash.area, len, 0);
313 if (ret == len) {
314 ns->counters.sent++;
315 resolution->nb_queries++;
316 continue;
317 }
318
319 if (ret == -1 && errno == EAGAIN) {
320 /* retry once the socket is ready */
321 fd_cant_send(fd);
322 continue;
323 }
324
325 snd_error:
326 ns->counters.snd_error++;
327 resolution->nb_queries++;
328 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200329
Christopher Faulet67957bd2017-09-27 11:00:59 +0200330 /* Push the resolution at the end of the active list */
331 LIST_DEL(&resolution->list);
332 LIST_ADDQ(&resolvers->resolutions.curr, &resolution->list);
333 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200334}
335
Christopher Faulet67957bd2017-09-27 11:00:59 +0200336/* Prepares and sends a DNS resolution. It returns 1 if the query was sent, 0 if
337 * skipped and -1 if an error occurred.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200338 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200339static int
340dns_run_resolution(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200341{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200342 struct dns_resolvers *resolvers = resolution->resolvers;
343 int query_id, i;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200344
Christopher Faulet67957bd2017-09-27 11:00:59 +0200345 /* Avoid sending requests for resolutions that don't yet have an
346 * hostname, ie resolutions linked to servers that do not yet have an
347 * fqdn */
348 if (!resolution->hostname_dn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200349 return 0;
350
Christopher Faulet67957bd2017-09-27 11:00:59 +0200351 /* Check if a resolution has already been started for this server return
352 * directly to avoid resolution pill up. */
353 if (resolution->step != RSLV_STEP_NONE)
354 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200355
Christopher Faulet67957bd2017-09-27 11:00:59 +0200356 /* Generates a new query id. We try at most 100 times to find a free
357 * query id */
358 for (i = 0; i < 100; ++i) {
359 query_id = dns_rnd16();
360 if (!eb32_lookup(&resolvers->query_ids, query_id))
Olivier Houchard8da5f982017-08-04 18:35:36 +0200361 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200362 query_id = -1;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200363 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200364 if (query_id == -1) {
365 send_log(NULL, LOG_NOTICE,
366 "could not generate a query id for %s, in resolvers %s.\n",
367 resolution->hostname_dn, resolvers->id);
368 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200369 }
370
Christopher Faulet67957bd2017-09-27 11:00:59 +0200371 /* Update resolution parameters */
372 resolution->query_id = query_id;
373 resolution->qid.key = query_id;
374 resolution->step = RSLV_STEP_RUNNING;
375 resolution->query_type = resolution->prefered_query_type;
376 resolution->try = resolvers->resolve_retries;
377 eb32_insert(&resolvers->query_ids, &resolution->qid);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200378
Christopher Faulet67957bd2017-09-27 11:00:59 +0200379 /* Send the DNS query */
380 resolution->try -= 1;
381 dns_send_query(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200382 return 1;
383}
384
Christopher Faulet67957bd2017-09-27 11:00:59 +0200385/* Performs a name resolution for the requester <req> */
386void dns_trigger_resolution(struct dns_requester *req)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200387{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200388 struct dns_resolvers *resolvers;
389 struct dns_resolution *res;
390 int exp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200391
Christopher Faulet67957bd2017-09-27 11:00:59 +0200392 if (!req || !req->resolution)
393 return;
394 res = req->resolution;
395 resolvers = res->resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200396
Christopher Faulet67957bd2017-09-27 11:00:59 +0200397 /* The resolution must not be triggered yet. Use the cached response, if
398 * valid */
399 exp = tick_add(res->last_resolution, resolvers->hold.valid);
Olivier Houchardf3d9e602018-05-22 18:40:07 +0200400 if (resolvers->t && (res->status != RSLV_STATUS_VALID ||
401 !tick_isset(res->last_resolution) || tick_is_expired(exp, now_ms)))
402 task_wakeup(resolvers->t, TASK_WOKEN_OTHER);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200403}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200404
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200405
Christopher Faulet67957bd2017-09-27 11:00:59 +0200406/* Resets some resolution parameters to initial values and also delete the query
407 * ID from the resolver's tree.
408 */
409static void dns_reset_resolution(struct dns_resolution *resolution)
410{
411 /* update resolution status */
412 resolution->step = RSLV_STEP_NONE;
413 resolution->try = 0;
414 resolution->last_resolution = now_ms;
415 resolution->nb_queries = 0;
416 resolution->nb_responses = 0;
417 resolution->query_type = resolution->prefered_query_type;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200418
Christopher Faulet67957bd2017-09-27 11:00:59 +0200419 /* clean up query id */
420 eb32_delete(&resolution->qid);
421 resolution->query_id = 0;
422 resolution->qid.key = 0;
423}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200424
Christopher Faulet67957bd2017-09-27 11:00:59 +0200425/* Returns the query id contained in a DNS response */
426static inline unsigned short dns_response_get_query_id(unsigned char *resp)
427{
428 return resp[0] * 256 + resp[1];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200429}
430
Christopher Faulet67957bd2017-09-27 11:00:59 +0200431
432/* Analyses, re-builds and copies the name <name> from the DNS response packet
433 * <buffer>. <name> must point to the 'data_len' information or pointer 'c0'
434 * for compressed data. The result is copied into <dest>, ensuring we don't
435 * overflow using <dest_len> Returns the number of bytes the caller can move
436 * forward. If 0 it means an error occurred while parsing the name. <offset> is
437 * the number of bytes the caller could move forward.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200438 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200439int dns_read_name(unsigned char *buffer, unsigned char *bufend,
440 unsigned char *name, char *destination, int dest_len,
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100441 int *offset, unsigned int depth)
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200442{
443 int nb_bytes = 0, n = 0;
444 int label_len;
445 unsigned char *reader = name;
446 char *dest = destination;
447
448 while (1) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100449 if (reader >= bufend)
450 goto err;
451
Christopher Faulet67957bd2017-09-27 11:00:59 +0200452 /* Name compression is in use */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200453 if ((*reader & 0xc0) == 0xc0) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100454 if (reader + 1 >= bufend)
455 goto err;
456
Christopher Faulet67957bd2017-09-27 11:00:59 +0200457 /* Must point BEFORE current position */
458 if ((buffer + reader[1]) > reader)
459 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200460
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100461 if (depth++ > 100)
462 goto err;
463
Nikhil Agrawal2fa66c32018-12-20 10:50:59 +0530464 n = dns_read_name(buffer, bufend, buffer + (*reader & 0x3f)*256 + reader[1],
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100465 dest, dest_len - nb_bytes, offset, depth);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200466 if (n == 0)
Christopher Faulet67957bd2017-09-27 11:00:59 +0200467 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200468
Christopher Faulet67957bd2017-09-27 11:00:59 +0200469 dest += n;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200470 nb_bytes += n;
471 goto out;
472 }
473
474 label_len = *reader;
475 if (label_len == 0)
476 goto out;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200477
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200478 /* Check if:
479 * - we won't read outside the buffer
480 * - there is enough place in the destination
481 */
482 if ((reader + label_len >= bufend) || (nb_bytes + label_len >= dest_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +0200483 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200484
485 /* +1 to take label len + label string */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200486 label_len++;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200487
488 memcpy(dest, reader, label_len);
489
Christopher Faulet67957bd2017-09-27 11:00:59 +0200490 dest += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200491 nb_bytes += label_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200492 reader += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200493 }
494
Christopher Faulet67957bd2017-09-27 11:00:59 +0200495 out:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200496 /* offset computation:
497 * parse from <name> until finding either NULL or a pointer "c0xx"
498 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200499 reader = name;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200500 *offset = 0;
501 while (reader < bufend) {
502 if ((reader[0] & 0xc0) == 0xc0) {
503 *offset += 2;
504 break;
505 }
506 else if (*reader == 0) {
507 *offset += 1;
508 break;
509 }
510 *offset += 1;
511 ++reader;
512 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200513 return nb_bytes;
514
Christopher Faulet67957bd2017-09-27 11:00:59 +0200515 err:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200516 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200517}
518
Christopher Faulet67957bd2017-09-27 11:00:59 +0200519/* Checks for any obsolete record, also identify any SRV request, and try to
520 * find a corresponding server.
521*/
522static void dns_check_dns_response(struct dns_resolution *res)
523{
524 struct dns_resolvers *resolvers = res->resolvers;
525 struct dns_requester *req, *reqback;
526 struct dns_answer_item *item, *itemback;
527 struct server *srv;
528 struct dns_srvrq *srvrq;
529
Baptiste Assmann13a92322019-06-07 09:40:55 +0200530 /* clean up obsolete Additional records */
531 list_for_each_entry_safe(item, itemback, &res->response.ar_list, list) {
532 if ((item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
533 LIST_DEL(&item->list);
534 pool_free(dns_answer_item_pool, item);
535 }
536 }
537
Christopher Faulet67957bd2017-09-27 11:00:59 +0200538 list_for_each_entry_safe(item, itemback, &res->response.answer_list, list) {
539
540 /* Remove obsolete items */
541 if ((item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
542 if (item->type != DNS_RTYPE_SRV)
543 goto rm_obselete_item;
544
545 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
546 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
547 continue;
548
549 /* Remove any associated server */
550 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100551 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200552 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
553 item->data_len == srv->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +0200554 !dns_hostname_cmp(srv->hostname_dn, item->target, item->data_len)) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200555 snr_update_srv_status(srv, 1);
556 free(srv->hostname);
557 free(srv->hostname_dn);
558 srv->hostname = NULL;
559 srv->hostname_dn = NULL;
560 srv->hostname_dn_len = 0;
561 dns_unlink_resolution(srv->dns_requester);
562 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100563 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200564 }
565 }
566
567 rm_obselete_item:
568 LIST_DEL(&item->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +0100569 pool_free(dns_answer_item_pool, item);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200570 continue;
571 }
572
573 if (item->type != DNS_RTYPE_SRV)
574 continue;
575
576 /* Now process SRV records */
577 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
578 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
579 continue;
580
581 /* Check if a server already uses that hostname */
582 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100583 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200584 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
585 item->data_len == srv->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +0200586 !dns_hostname_cmp(srv->hostname_dn, item->target, item->data_len) &&
Daniel Corbettf8716912019-11-17 09:48:56 -0500587 !srv->dns_opts.ignore_weight) {
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100588 int ha_weight;
589
Baptiste Assmann25e6fc22019-10-21 15:13:48 +0200590 /* DNS weight range if from 0 to 65535
591 * HAProxy weight is from 0 to 256
592 * The rule below ensures that weight 0 is well respected
593 * while allowing a "mapping" from DNS weight into HAProxy's one.
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100594 */
Baptiste Assmann25e6fc22019-10-21 15:13:48 +0200595 ha_weight = (item->weight + 255) / 256;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100596 if (srv->uweight != ha_weight) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200597 char weight[9];
598
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100599 snprintf(weight, sizeof(weight), "%d", ha_weight);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200600 server_parse_weight_change_request(srv, weight);
601 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100602 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200603 break;
604 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100605 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200606 }
607 if (srv)
608 continue;
609
610 /* If not, try to find a server with undefined hostname */
611 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100612 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200613 if (srv->srvrq == srvrq && !srv->hostname_dn)
614 break;
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100615 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200616 }
617 /* And update this server, if found */
618 if (srv) {
619 const char *msg = NULL;
620 char weight[9];
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100621 int ha_weight;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200622 char hostname[DNS_MAX_NAME_SIZE];
623
624 if (dns_dn_label_to_str(item->target, item->data_len+1,
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100625 hostname, DNS_MAX_NAME_SIZE) == -1) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100626 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200627 continue;
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100628 }
Baptiste Assmann13a92322019-06-07 09:40:55 +0200629
630 /* Check if an Additional Record is associated to this SRV record.
631 * Perform some sanity checks too to ensure the record can be used.
632 * If all fine, we simply pick up the IP address found and associate
633 * it to the server.
634 */
635 if ((item->ar_item != NULL) &&
636 (item->ar_item->type == DNS_RTYPE_A || item->ar_item->type == DNS_RTYPE_AAAA))
637 {
638
639 switch (item->ar_item->type) {
640 case DNS_RTYPE_A:
641 update_server_addr(srv, &(((struct sockaddr_in*)&item->ar_item->address)->sin_addr), AF_INET, "DNS additional recrd");
642 break;
643 case DNS_RTYPE_AAAA:
644 update_server_addr(srv, &(((struct sockaddr_in6*)&item->ar_item->address)->sin6_addr), AF_INET6, "DNS additional recrd");
645 break;
646 }
647
648 srv->flags |= SRV_F_NO_RESOLUTION;
649 }
650
Olivier Houchardd16bfe62017-10-31 15:21:19 +0100651 msg = update_server_fqdn(srv, hostname, "SRV record", 1);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200652 if (msg)
653 send_log(srv->proxy, LOG_NOTICE, "%s", msg);
654
655 srv->svc_port = item->port;
656 srv->flags &= ~SRV_F_MAPPORTS;
657 if ((srv->check.state & CHK_ST_CONFIGURED) &&
658 !(srv->flags & SRV_F_CHECKPORT))
659 srv->check.port = item->port;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100660
Daniel Corbettf8716912019-11-17 09:48:56 -0500661 if (!srv->dns_opts.ignore_weight) {
662 /* DNS weight range if from 0 to 65535
663 * HAProxy weight is from 0 to 256
664 * The rule below ensures that weight 0 is well respected
665 * while allowing a "mapping" from DNS weight into HAProxy's one.
666 */
667 ha_weight = (item->weight + 255) / 256;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100668
Daniel Corbettf8716912019-11-17 09:48:56 -0500669 snprintf(weight, sizeof(weight), "%d", ha_weight);
670 server_parse_weight_change_request(srv, weight);
671 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100672 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200673 }
674 }
675 }
676}
677
678/* Validates that the buffer DNS response provided in <resp> and finishing
679 * before <bufend> is valid from a DNS protocol point of view.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200680 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200681 * The result is stored in <resolution>' response, buf_response,
682 * response_query_records and response_answer_records members.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200683 *
684 * This function returns one of the DNS_RESP_* code to indicate the type of
685 * error found.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200686 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200687static int dns_validate_dns_response(unsigned char *resp, unsigned char *bufend,
688 struct dns_resolution *resolution, int max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200689{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200690 unsigned char *reader;
691 char *previous_dname, tmpname[DNS_MAX_NAME_SIZE];
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200692 int len, flags, offset;
693 int dns_query_record_id;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200694 int nb_saved_records;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200695 struct dns_query_item *dns_query;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200696 struct dns_answer_item *dns_answer_record, *tmp_record;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200697 struct dns_response_packet *dns_p;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200698 int i, found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200699
Christopher Faulet67957bd2017-09-27 11:00:59 +0200700 reader = resp;
701 len = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200702 previous_dname = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200703 dns_query = NULL;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200704
Christopher Faulet67957bd2017-09-27 11:00:59 +0200705 /* Initialization of response buffer and structure */
Baptiste Assmann729c9012017-05-22 15:13:10 +0200706 dns_p = &resolution->response;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200707
708 /* query id */
709 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200710 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200711 dns_p->header.id = reader[0] * 256 + reader[1];
712 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200713
Christopher Faulet67957bd2017-09-27 11:00:59 +0200714 /* Flags and rcode are stored over 2 bytes
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200715 * First byte contains:
716 * - response flag (1 bit)
717 * - opcode (4 bits)
718 * - authoritative (1 bit)
719 * - truncated (1 bit)
720 * - recursion desired (1 bit)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200721 */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200722 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200723 return DNS_RESP_INVALID;
724
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200725 flags = reader[0] * 256 + reader[1];
726
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200727 if ((flags & DNS_FLAG_REPLYCODE) != DNS_RCODE_NO_ERROR) {
728 if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_NX_DOMAIN)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200729 return DNS_RESP_NX_DOMAIN;
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200730 else if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_REFUSED)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200731 return DNS_RESP_REFUSED;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200732 return DNS_RESP_ERROR;
733 }
734
Christopher Faulet67957bd2017-09-27 11:00:59 +0200735 /* Move forward 2 bytes for flags */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200736 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200737
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200738 /* 2 bytes for question count */
739 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200740 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200741 dns_p->header.qdcount = reader[0] * 256 + reader[1];
Christopher Faulet67957bd2017-09-27 11:00:59 +0200742 /* (for now) we send one query only, so we expect only one in the
743 * response too */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200744 if (dns_p->header.qdcount != 1)
745 return DNS_RESP_QUERY_COUNT_ERROR;
746 if (dns_p->header.qdcount > DNS_MAX_QUERY_RECORDS)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200747 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200748 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200749
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200750 /* 2 bytes for answer count */
751 if (reader + 2 >= bufend)
752 return DNS_RESP_INVALID;
753 dns_p->header.ancount = reader[0] * 256 + reader[1];
754 if (dns_p->header.ancount == 0)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200755 return DNS_RESP_ANCOUNT_ZERO;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200756 /* Check if too many records are announced */
Baptiste Assmann9d8dbbc2017-08-18 23:35:08 +0200757 if (dns_p->header.ancount > max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200758 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200759 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200760
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200761 /* 2 bytes authority count */
762 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200763 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200764 dns_p->header.nscount = reader[0] * 256 + reader[1];
765 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200766
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200767 /* 2 bytes additional count */
768 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200769 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200770 dns_p->header.arcount = reader[0] * 256 + reader[1];
771 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200772
Christopher Faulet67957bd2017-09-27 11:00:59 +0200773 /* Parsing dns queries */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200774 LIST_INIT(&dns_p->query_list);
775 for (dns_query_record_id = 0; dns_query_record_id < dns_p->header.qdcount; dns_query_record_id++) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200776 /* Use next pre-allocated dns_query_item after ensuring there is
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200777 * still one available.
Christopher Faulet67957bd2017-09-27 11:00:59 +0200778 * It's then added to our packet query list. */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200779 if (dns_query_record_id > DNS_MAX_QUERY_RECORDS)
780 return DNS_RESP_INVALID;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200781 dns_query = &resolution->response_query_records[dns_query_record_id];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200782 LIST_ADDQ(&dns_p->query_list, &dns_query->list);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200783
Christopher Faulet67957bd2017-09-27 11:00:59 +0200784 /* Name is a NULL terminated string in our case, since we have
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200785 * one query per response and the first one can't be compressed
Christopher Faulet67957bd2017-09-27 11:00:59 +0200786 * (using the 0x0c format) */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200787 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100788 len = dns_read_name(resp, bufend, reader, dns_query->name, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200789
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200790 if (len == 0)
791 return DNS_RESP_INVALID;
792
793 reader += offset;
794 previous_dname = dns_query->name;
795
796 /* move forward 2 bytes for question type */
797 if (reader + 2 >= bufend)
798 return DNS_RESP_INVALID;
799 dns_query->type = reader[0] * 256 + reader[1];
800 reader += 2;
801
802 /* move forward 2 bytes for question class */
803 if (reader + 2 >= bufend)
804 return DNS_RESP_INVALID;
805 dns_query->class = reader[0] * 256 + reader[1];
806 reader += 2;
807 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200808
Baptiste Assmann251abb92017-08-11 09:58:27 +0200809 /* TRUNCATED flag must be checked after we could read the query type
Christopher Faulet67957bd2017-09-27 11:00:59 +0200810 * because a TRUNCATED SRV query type response can still be exploited */
Baptiste Assmann251abb92017-08-11 09:58:27 +0200811 if (dns_query->type != DNS_RTYPE_SRV && flags & DNS_FLAG_TRUNCATED)
812 return DNS_RESP_TRUNCATED;
813
Baptiste Assmann325137d2015-04-13 23:40:55 +0200814 /* now parsing response records */
Baptiste Assmann69fce672017-05-04 08:37:45 +0200815 nb_saved_records = 0;
Olivier Houchard8da5f982017-08-04 18:35:36 +0200816 for (i = 0; i < dns_p->header.ancount; i++) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200817 if (reader >= bufend)
818 return DNS_RESP_INVALID;
819
Willy Tarreaubafbe012017-11-24 17:34:44 +0100820 dns_answer_record = pool_alloc(dns_answer_item_pool);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200821 if (dns_answer_record == NULL)
822 return (DNS_RESP_INVALID);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200823
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200824 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100825 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200826
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200827 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100828 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200829 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200830 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200831
Christopher Faulet67957bd2017-09-27 11:00:59 +0200832 /* Check if the current record dname is valid. previous_dname
833 * points either to queried dname or last CNAME target */
Olivier Houchardb17b8842020-04-01 18:30:27 +0200834 if (dns_query->type != DNS_RTYPE_SRV && dns_hostname_cmp(previous_dname, tmpname, len) != 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100835 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200836 if (i == 0) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200837 /* First record, means a mismatch issue between
838 * queried dname and dname found in the first
839 * record */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200840 return DNS_RESP_INVALID;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200841 }
842 else {
843 /* If not the first record, this means we have a
844 * CNAME resolution error */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200845 return DNS_RESP_CNAME_ERROR;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200846 }
847
Baptiste Assmann325137d2015-04-13 23:40:55 +0200848 }
849
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200850 memcpy(dns_answer_record->name, tmpname, len);
851 dns_answer_record->name[len] = 0;
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200852
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200853 reader += offset;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200854 if (reader >= bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100855 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200856 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200857 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200858
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200859 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200860 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100861 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200862 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200863 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200864 dns_answer_record->type = reader[0] * 256 + reader[1];
865 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200866
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200867 /* 2 bytes for class (2) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200868 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100869 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200870 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200871 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200872 dns_answer_record->class = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200873 reader += 2;
874
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200875 /* 4 bytes for ttl (4) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200876 if (reader + 4 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100877 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200878 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200879 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200880 dns_answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
881 + reader[2] * 256 + reader[3];
882 reader += 4;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200883
Christopher Faulet67957bd2017-09-27 11:00:59 +0200884 /* Now reading data len */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200885 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100886 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200887 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200888 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200889 dns_answer_record->data_len = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200890
Christopher Faulet67957bd2017-09-27 11:00:59 +0200891 /* Move forward 2 bytes for data len */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200892 reader += 2;
893
Jérôme Magnin8d4e7dc2018-12-20 16:47:31 +0100894 if (reader + dns_answer_record->data_len > bufend) {
Remi Gacogneefbbdf72018-12-05 17:56:29 +0100895 pool_free(dns_answer_item_pool, dns_answer_record);
896 return DNS_RESP_INVALID;
897 }
898
Christopher Faulet67957bd2017-09-27 11:00:59 +0200899 /* Analyzing record content */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200900 switch (dns_answer_record->type) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200901 case DNS_RTYPE_A:
902 /* ipv4 is stored on 4 bytes */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200903 if (dns_answer_record->data_len != 4) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100904 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200905 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200906 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200907 dns_answer_record->address.sa_family = AF_INET;
908 memcpy(&(((struct sockaddr_in *)&dns_answer_record->address)->sin_addr),
909 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200910 break;
911
912 case DNS_RTYPE_CNAME:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200913 /* Check if this is the last record and update the caller about the status:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200914 * no IP could be found and last record was a CNAME. Could be triggered
915 * by a wrong query type
916 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200917 * + 1 because dns_answer_record_id starts at 0
918 * while number of answers is an integer and
919 * starts at 1.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200920 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200921 if (i + 1 == dns_p->header.ancount) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100922 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200923 return DNS_RESP_CNAME_ERROR;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200924 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200925
926 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100927 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200928 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100929 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200930 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200931 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200932
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200933 memcpy(dns_answer_record->target, tmpname, len);
934 dns_answer_record->target[len] = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200935 previous_dname = dns_answer_record->target;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200936 break;
937
Olivier Houchard8da5f982017-08-04 18:35:36 +0200938
939 case DNS_RTYPE_SRV:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200940 /* Answer must contain :
Olivier Houchard8da5f982017-08-04 18:35:36 +0200941 * - 2 bytes for the priority
942 * - 2 bytes for the weight
943 * - 2 bytes for the port
944 * - the target hostname
945 */
946 if (dns_answer_record->data_len <= 6) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100947 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200948 return DNS_RESP_INVALID;
949 }
Willy Tarreaud5370e12017-09-19 14:59:52 +0200950 dns_answer_record->priority = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200951 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200952 dns_answer_record->weight = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200953 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200954 dns_answer_record->port = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200955 reader += sizeof(uint16_t);
956 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100957 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200958 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100959 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200960 return DNS_RESP_INVALID;
961 }
Olivier Houchard8da5f982017-08-04 18:35:36 +0200962 dns_answer_record->data_len = len;
963 memcpy(dns_answer_record->target, tmpname, len);
964 dns_answer_record->target[len] = 0;
965 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200966
Baptiste Assmann325137d2015-04-13 23:40:55 +0200967 case DNS_RTYPE_AAAA:
968 /* ipv6 is stored on 16 bytes */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200969 if (dns_answer_record->data_len != 16) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100970 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200971 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200972 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200973 dns_answer_record->address.sa_family = AF_INET6;
974 memcpy(&(((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr),
975 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200976 break;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200977
Baptiste Assmann325137d2015-04-13 23:40:55 +0200978 } /* switch (record type) */
979
Christopher Faulet67957bd2017-09-27 11:00:59 +0200980 /* Increment the counter for number of records saved into our
981 * local response */
982 nb_saved_records++;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200983
Christopher Faulet67957bd2017-09-27 11:00:59 +0200984 /* Move forward dns_answer_record->data_len for analyzing next
985 * record in the response */
986 reader += ((dns_answer_record->type == DNS_RTYPE_SRV)
987 ? offset
988 : dns_answer_record->data_len);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200989
990 /* Lookup to see if we already had this entry */
Olivier Houchard8da5f982017-08-04 18:35:36 +0200991 found = 0;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200992 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
993 if (tmp_record->type != dns_answer_record->type)
994 continue;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200995
996 switch(tmp_record->type) {
997 case DNS_RTYPE_A:
998 if (!memcmp(&((struct sockaddr_in *)&dns_answer_record->address)->sin_addr,
999 &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
1000 sizeof(in_addr_t)))
1001 found = 1;
1002 break;
1003
1004 case DNS_RTYPE_AAAA:
1005 if (!memcmp(&((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr,
1006 &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
1007 sizeof(struct in6_addr)))
1008 found = 1;
1009 break;
1010
Olivier Houchard8da5f982017-08-04 18:35:36 +02001011 case DNS_RTYPE_SRV:
1012 if (dns_answer_record->data_len == tmp_record->data_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001013 !dns_hostname_cmp(dns_answer_record->target, tmp_record->target, dns_answer_record->data_len) &&
Olivier Houchard8da5f982017-08-04 18:35:36 +02001014 dns_answer_record->port == tmp_record->port) {
1015 tmp_record->weight = dns_answer_record->weight;
1016 found = 1;
1017 }
1018 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001019
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001020 default:
1021 break;
1022 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001023
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001024 if (found == 1)
1025 break;
1026 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001027
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001028 if (found == 1) {
1029 tmp_record->last_seen = now.tv_sec;
Willy Tarreaubafbe012017-11-24 17:34:44 +01001030 pool_free(dns_answer_item_pool, dns_answer_record);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001031 }
1032 else {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001033 dns_answer_record->last_seen = now.tv_sec;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001034 dns_answer_record->ar_item = NULL;
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001035 LIST_ADDQ(&dns_p->answer_list, &dns_answer_record->list);
1036 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001037 } /* for i 0 to ancount */
1038
Christopher Faulet67957bd2017-09-27 11:00:59 +02001039 /* Save the number of records we really own */
Baptiste Assmann69fce672017-05-04 08:37:45 +02001040 dns_p->header.ancount = nb_saved_records;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001041
Baptiste Assmann37950c82020-02-19 01:08:51 +01001042 /* now parsing additional records for SRV queries only */
1043 if (dns_query->type != DNS_RTYPE_SRV)
1044 goto skip_parsing_additional_records;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001045 nb_saved_records = 0;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001046 for (i = 0; i < dns_p->header.arcount; i++) {
1047 if (reader >= bufend)
1048 return DNS_RESP_INVALID;
1049
1050 dns_answer_record = pool_alloc(dns_answer_item_pool);
1051 if (dns_answer_record == NULL)
1052 return (DNS_RESP_INVALID);
1053
1054 offset = 0;
1055 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
1056
1057 if (len == 0) {
1058 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann37950c82020-02-19 01:08:51 +01001059 continue;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001060 }
1061
1062 memcpy(dns_answer_record->name, tmpname, len);
1063 dns_answer_record->name[len] = 0;
1064
1065 reader += offset;
1066 if (reader >= bufend) {
1067 pool_free(dns_answer_item_pool, dns_answer_record);
1068 return DNS_RESP_INVALID;
1069 }
1070
1071 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
1072 if (reader + 2 > bufend) {
1073 pool_free(dns_answer_item_pool, dns_answer_record);
1074 return DNS_RESP_INVALID;
1075 }
1076 dns_answer_record->type = reader[0] * 256 + reader[1];
1077 reader += 2;
1078
1079 /* 2 bytes for class (2) */
1080 if (reader + 2 > bufend) {
1081 pool_free(dns_answer_item_pool, dns_answer_record);
1082 return DNS_RESP_INVALID;
1083 }
1084 dns_answer_record->class = reader[0] * 256 + reader[1];
1085 reader += 2;
1086
1087 /* 4 bytes for ttl (4) */
1088 if (reader + 4 > bufend) {
1089 pool_free(dns_answer_item_pool, dns_answer_record);
1090 return DNS_RESP_INVALID;
1091 }
1092 dns_answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
1093 + reader[2] * 256 + reader[3];
1094 reader += 4;
1095
1096 /* Now reading data len */
1097 if (reader + 2 > bufend) {
1098 pool_free(dns_answer_item_pool, dns_answer_record);
1099 return DNS_RESP_INVALID;
1100 }
1101 dns_answer_record->data_len = reader[0] * 256 + reader[1];
1102
1103 /* Move forward 2 bytes for data len */
1104 reader += 2;
1105
1106 if (reader + dns_answer_record->data_len > bufend) {
1107 pool_free(dns_answer_item_pool, dns_answer_record);
1108 return DNS_RESP_INVALID;
1109 }
1110
1111 /* Analyzing record content */
1112 switch (dns_answer_record->type) {
1113 case DNS_RTYPE_A:
1114 /* ipv4 is stored on 4 bytes */
1115 if (dns_answer_record->data_len != 4) {
1116 pool_free(dns_answer_item_pool, dns_answer_record);
1117 return DNS_RESP_INVALID;
1118 }
1119 dns_answer_record->address.sa_family = AF_INET;
1120 memcpy(&(((struct sockaddr_in *)&dns_answer_record->address)->sin_addr),
1121 reader, dns_answer_record->data_len);
1122 break;
1123
1124 case DNS_RTYPE_AAAA:
1125 /* ipv6 is stored on 16 bytes */
1126 if (dns_answer_record->data_len != 16) {
1127 pool_free(dns_answer_item_pool, dns_answer_record);
1128 return DNS_RESP_INVALID;
1129 }
1130 dns_answer_record->address.sa_family = AF_INET6;
1131 memcpy(&(((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr),
1132 reader, dns_answer_record->data_len);
1133 break;
1134
1135 default:
1136 pool_free(dns_answer_item_pool, dns_answer_record);
1137 continue;
1138
1139 } /* switch (record type) */
1140
1141 /* Increment the counter for number of records saved into our
1142 * local response */
1143 nb_saved_records++;
1144
1145 /* Move forward dns_answer_record->data_len for analyzing next
1146 * record in the response */
1147 reader += ((dns_answer_record->type == DNS_RTYPE_SRV)
1148 ? offset
1149 : dns_answer_record->data_len);
1150
1151 /* Lookup to see if we already had this entry */
1152 found = 0;
1153 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
1154 if (tmp_record->type != dns_answer_record->type)
1155 continue;
1156
1157 switch(tmp_record->type) {
1158 case DNS_RTYPE_A:
1159 if (!memcmp(&((struct sockaddr_in *)&dns_answer_record->address)->sin_addr,
1160 &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
1161 sizeof(in_addr_t)))
1162 found = 1;
1163 break;
1164
1165 case DNS_RTYPE_AAAA:
1166 if (!memcmp(&((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr,
1167 &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
1168 sizeof(struct in6_addr)))
1169 found = 1;
1170 break;
1171
1172 default:
1173 break;
1174 }
1175
1176 if (found == 1)
1177 break;
1178 }
1179
1180 if (found == 1) {
1181 tmp_record->last_seen = now.tv_sec;
1182 pool_free(dns_answer_item_pool, dns_answer_record);
1183 }
1184 else {
1185 dns_answer_record->last_seen = now.tv_sec;
1186 dns_answer_record->ar_item = NULL;
1187
1188 // looking for the SRV record in the response list linked to this additional record
1189 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
1190 if ( !(
1191 (tmp_record->type == DNS_RTYPE_SRV) &&
1192 (tmp_record->ar_item == NULL) &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001193 (dns_hostname_cmp(tmp_record->target, dns_answer_record->name, tmp_record->data_len) == 0)
Baptiste Assmann13a92322019-06-07 09:40:55 +02001194 )
1195 )
1196 continue;
1197 tmp_record->ar_item = dns_answer_record;
1198 }
Baptiste Assmann13a92322019-06-07 09:40:55 +02001199
1200 LIST_ADDQ(&dns_p->ar_list, &dns_answer_record->list);
1201 }
1202 } /* for i 0 to arcount */
1203
Baptiste Assmann37950c82020-02-19 01:08:51 +01001204 skip_parsing_additional_records:
1205
Baptiste Assmann13a92322019-06-07 09:40:55 +02001206 /* Save the number of records we really own */
1207 dns_p->header.arcount = nb_saved_records;
1208
Christopher Faulet67957bd2017-09-27 11:00:59 +02001209 dns_check_dns_response(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001210 return DNS_RESP_VALID;
1211}
1212
Christopher Faulet67957bd2017-09-27 11:00:59 +02001213/* Searches dn_name resolution in resp.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001214 * If existing IP not found, return the first IP matching family_priority,
1215 * otherwise, first ip found
1216 * The following tasks are the responsibility of the caller:
Baptiste Assmann3cf7f982016-04-17 22:43:26 +02001217 * - <dns_p> contains an error free DNS response
Baptiste Assmann325137d2015-04-13 23:40:55 +02001218 * For both cases above, dns_validate_dns_response is required
1219 * returns one of the DNS_UPD_* code
1220 */
Baptiste Assmannfb7091e2017-05-03 15:43:12 +02001221int dns_get_ip_from_response(struct dns_response_packet *dns_p,
Baptiste Assmann42746372017-05-03 12:12:02 +02001222 struct dns_options *dns_opts, void *currentip,
Thierry Fournierada34842016-02-17 21:25:09 +01001223 short currentip_sin_family,
Baptiste Assmannfb7091e2017-05-03 15:43:12 +02001224 void **newip, short *newip_sin_family,
1225 void *owner)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001226{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +02001227 struct dns_answer_item *record;
Thierry Fournierada34842016-02-17 21:25:09 +01001228 int family_priority;
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001229 int currentip_found;
Baptiste Assmann3cf7f982016-04-17 22:43:26 +02001230 unsigned char *newip4, *newip6;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001231 int currentip_sel;
1232 int j;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001233 int score, max_score;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001234 int allowed_duplicated_ip;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001235
Christopher Faulet67957bd2017-09-27 11:00:59 +02001236 family_priority = dns_opts->family_prio;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001237 allowed_duplicated_ip = dns_opts->accept_duplicate_ip;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001238 *newip = newip4 = newip6 = NULL;
1239 currentip_found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001240 *newip_sin_family = AF_UNSPEC;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001241 max_score = -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001242
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001243 /* Select an IP regarding configuration preference.
Joseph Herlant42cf6392018-11-15 10:33:28 -08001244 * Top priority is the preferred network ip version,
1245 * second priority is the preferred network.
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001246 * the last priority is the currently used IP,
1247 *
1248 * For these three priorities, a score is calculated. The
1249 * weight are:
Joseph Herlant42cf6392018-11-15 10:33:28 -08001250 * 8 - preferred ip version.
1251 * 4 - preferred network.
Baptistefc725902016-12-26 23:21:08 +01001252 * 2 - if the ip in the record is not affected to any other server in the same backend (duplication)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001253 * 1 - current ip.
1254 * The result with the biggest score is returned.
1255 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001256
1257 list_for_each_entry(record, &dns_p->answer_list, list) {
1258 void *ip;
1259 unsigned char ip_type;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001260
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001261 if (record->type == DNS_RTYPE_A) {
1262 ip = &(((struct sockaddr_in *)&record->address)->sin_addr);
1263 ip_type = AF_INET;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001264 }
1265 else if (record->type == DNS_RTYPE_AAAA) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001266 ip_type = AF_INET6;
1267 ip = &(((struct sockaddr_in6 *)&record->address)->sin6_addr);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001268 }
1269 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001270 continue;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001271 score = 0;
1272
Joseph Herlant42cf6392018-11-15 10:33:28 -08001273 /* Check for preferred ip protocol. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001274 if (ip_type == family_priority)
Baptistefc725902016-12-26 23:21:08 +01001275 score += 8;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001276
Joseph Herlant42cf6392018-11-15 10:33:28 -08001277 /* Check for preferred network. */
Baptiste Assmann42746372017-05-03 12:12:02 +02001278 for (j = 0; j < dns_opts->pref_net_nb; j++) {
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001279
1280 /* Compare only the same adresses class. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001281 if (dns_opts->pref_net[j].family != ip_type)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001282 continue;
1283
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001284 if ((ip_type == AF_INET &&
1285 in_net_ipv4(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001286 &dns_opts->pref_net[j].mask.in4,
1287 &dns_opts->pref_net[j].addr.in4)) ||
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001288 (ip_type == AF_INET6 &&
1289 in_net_ipv6(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001290 &dns_opts->pref_net[j].mask.in6,
1291 &dns_opts->pref_net[j].addr.in6))) {
Baptistefc725902016-12-26 23:21:08 +01001292 score += 4;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001293 break;
1294 }
1295 }
1296
Christopher Faulet67957bd2017-09-27 11:00:59 +02001297 /* Check if the IP found in the record is already affected to a
Baptiste Assmann84221b42018-06-22 13:03:50 +02001298 * member of a group. If not, the score should be incremented
Christopher Faulet67957bd2017-09-27 11:00:59 +02001299 * by 2. */
Baptiste Assmann84221b42018-06-22 13:03:50 +02001300 if (owner && snr_check_ip_callback(owner, ip, &ip_type)) {
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001301 if (!allowed_duplicated_ip) {
1302 continue;
1303 }
Baptiste Assmann84221b42018-06-22 13:03:50 +02001304 } else {
1305 score += 2;
1306 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001307
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001308 /* Check for current ip matching. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001309 if (ip_type == currentip_sin_family &&
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001310 ((currentip_sin_family == AF_INET &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001311 !memcmp(ip, currentip, 4)) ||
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001312 (currentip_sin_family == AF_INET6 &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001313 !memcmp(ip, currentip, 16)))) {
1314 score++;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001315 currentip_sel = 1;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001316 }
1317 else
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001318 currentip_sel = 0;
1319
1320 /* Keep the address if the score is better than the previous
Christopher Faulet67957bd2017-09-27 11:00:59 +02001321 * score. The maximum score is 15, if this value is reached, we
1322 * break the parsing. Implicitly, this score is reached the ip
1323 * selected is the current ip. */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001324 if (score > max_score) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001325 if (ip_type == AF_INET)
1326 newip4 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001327 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001328 newip6 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001329 currentip_found = currentip_sel;
Baptistefc725902016-12-26 23:21:08 +01001330 if (score == 15)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001331 return DNS_UPD_NO;
1332 max_score = score;
1333 }
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001334 } /* list for each record entries */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001335
Christopher Faulet67957bd2017-09-27 11:00:59 +02001336 /* No IP found in the response */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001337 if (!newip4 && !newip6)
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001338 return DNS_UPD_NO_IP_FOUND;
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001339
Christopher Faulet67957bd2017-09-27 11:00:59 +02001340 /* Case when the caller looks first for an IPv4 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001341 if (family_priority == AF_INET) {
1342 if (newip4) {
1343 *newip = newip4;
1344 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001345 }
1346 else if (newip6) {
1347 *newip = newip6;
1348 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001349 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001350 if (!currentip_found)
1351 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001352 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001353 /* Case when the caller looks first for an IPv6 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001354 else if (family_priority == AF_INET6) {
1355 if (newip6) {
1356 *newip = newip6;
1357 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001358 }
1359 else if (newip4) {
1360 *newip = newip4;
1361 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001362 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001363 if (!currentip_found)
1364 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001365 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001366 /* Case when the caller have no preference (we prefer IPv6) */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001367 else if (family_priority == AF_UNSPEC) {
1368 if (newip6) {
1369 *newip = newip6;
1370 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001371 }
1372 else if (newip4) {
1373 *newip = newip4;
1374 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001375 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001376 if (!currentip_found)
1377 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001378 }
1379
Christopher Faulet67957bd2017-09-27 11:00:59 +02001380 /* No reason why we should change the server's IP address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001381 return DNS_UPD_NO;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001382
Christopher Faulet67957bd2017-09-27 11:00:59 +02001383 not_found:
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001384 list_for_each_entry(record, &dns_p->answer_list, list) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001385 /* Move the first record to the end of the list, for internal
1386 * round robin */
1387 LIST_DEL(&record->list);
1388 LIST_ADDQ(&dns_p->answer_list, &record->list);
1389 break;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001390 }
1391 return DNS_UPD_SRVIP_NOT_FOUND;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001392}
1393
Christopher Faulet67957bd2017-09-27 11:00:59 +02001394/* Turns a domain name label into a string.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001395 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001396 * <dn> must be a null-terminated string. <dn_len> must include the terminating
1397 * null byte. <str> must be allocated and its size must be passed in <str_len>.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001398 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001399 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1400 * <str> (including the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001401 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001402int dns_dn_label_to_str(const char *dn, int dn_len, char *str, int str_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001403{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001404 char *ptr;
1405 int i, sz;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001406
Christopher Faulet67957bd2017-09-27 11:00:59 +02001407 if (str_len < dn_len - 1)
Baptiste Assmann2af08fe2017-08-14 00:13:01 +02001408 return -1;
1409
Christopher Faulet67957bd2017-09-27 11:00:59 +02001410 ptr = str;
1411 for (i = 0; i < dn_len-1; ++i) {
1412 sz = dn[i];
1413 if (i)
1414 *ptr++ = '.';
1415 memcpy(ptr, dn+i+1, sz);
1416 ptr += sz;
1417 i += sz;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001418 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001419 *ptr++ = '\0';
1420 return (ptr - str);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001421}
1422
Christopher Faulet67957bd2017-09-27 11:00:59 +02001423/* Turns a string into domain name label: www.haproxy.org into 3www7haproxy3org
1424 *
1425 * <str> must be a null-terminated string. <str_len> must include the
1426 * terminating null byte. <dn> buffer must be allocated and its size must be
1427 * passed in <dn_len>.
1428 *
1429 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1430 * <dn> (excluding the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001431 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001432int dns_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001433{
Baptiste Assmann325137d2015-04-13 23:40:55 +02001434 int i, offset;
1435
Christopher Faulet67957bd2017-09-27 11:00:59 +02001436 if (dn_len < str_len + 1)
1437 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001438
Christopher Faulet67957bd2017-09-27 11:00:59 +02001439 /* First byte of dn will be used to store the length of the first
1440 * label */
1441 offset = 0;
1442 for (i = 0; i < str_len; ++i) {
1443 if (str[i] == '.') {
1444 /* 2 or more consecutive dots is invalid */
1445 if (i == offset)
1446 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001447
Lukas Tribus81725b82020-02-27 15:47:24 +01001448 /* ignore trailing dot */
1449 if (i + 2 == str_len) {
1450 i++;
1451 break;
1452 }
1453
Christopher Faulet67957bd2017-09-27 11:00:59 +02001454 dn[offset] = (i - offset);
1455 offset = i+1;
1456 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001457 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001458 dn[i+1] = str[i];
Baptiste Assmann325137d2015-04-13 23:40:55 +02001459 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001460 dn[offset] = (i - offset - 1);
1461 dn[i] = '\0';
1462 return i;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001463}
1464
Christopher Faulet67957bd2017-09-27 11:00:59 +02001465/* Validates host name:
Baptiste Assmann325137d2015-04-13 23:40:55 +02001466 * - total size
1467 * - each label size individually
1468 * returns:
1469 * 0 in case of error. If <err> is not NULL, an error message is stored there.
1470 * 1 when no error. <err> is left unaffected.
1471 */
1472int dns_hostname_validation(const char *string, char **err)
1473{
Baptiste Assmann325137d2015-04-13 23:40:55 +02001474 int i;
1475
1476 if (strlen(string) > DNS_MAX_NAME_SIZE) {
1477 if (err)
1478 *err = DNS_TOO_LONG_FQDN;
1479 return 0;
1480 }
1481
William Dauchyaecd5dc2020-01-26 19:52:34 +01001482 while (*string) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001483 i = 0;
William Dauchyaecd5dc2020-01-26 19:52:34 +01001484 while (*string && *string != '.' && i < DNS_MAX_LABEL_SIZE) {
1485 if (!(*string == '-' || *string == '_' ||
1486 (*string >= 'a' && *string <= 'z') ||
1487 (*string >= 'A' && *string <= 'Z') ||
1488 (*string >= '0' && *string <= '9'))) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001489 if (err)
1490 *err = DNS_INVALID_CHARACTER;
1491 return 0;
1492 }
William Dauchyaecd5dc2020-01-26 19:52:34 +01001493 i++;
1494 string++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001495 }
1496
William Dauchyaecd5dc2020-01-26 19:52:34 +01001497 if (!(*string))
1498 break;
1499
1500 if (*string != '.' && i >= DNS_MAX_LABEL_SIZE) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001501 if (err)
1502 *err = DNS_LABEL_TOO_LONG;
1503 return 0;
1504 }
1505
William Dauchyaecd5dc2020-01-26 19:52:34 +01001506 string++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001507 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001508 return 1;
1509}
1510
Christopher Faulet67957bd2017-09-27 11:00:59 +02001511/* Picks up an available resolution from the different resolution list
1512 * associated to a resolvers section, in this order:
1513 * 1. check in resolutions.curr for the same hostname and query_type
1514 * 2. check in resolutions.wait for the same hostname and query_type
1515 * 3. Get a new resolution from resolution pool
1516 *
1517 * Returns an available resolution, NULL if none found.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001518 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001519static struct dns_resolution *dns_pick_resolution(struct dns_resolvers *resolvers,
1520 char **hostname_dn, int hostname_dn_len,
1521 int query_type)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001522{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001523 struct dns_resolution *res;
1524
1525 if (!*hostname_dn)
1526 goto from_pool;
1527
1528 /* Search for same hostname and query type in resolutions.curr */
1529 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
1530 if (!res->hostname_dn)
1531 continue;
1532 if ((query_type == res->prefered_query_type) &&
1533 hostname_dn_len == res->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001534 !dns_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +02001535 return res;
1536 }
1537
1538 /* Search for same hostname and query type in resolutions.wait */
1539 list_for_each_entry(res, &resolvers->resolutions.wait, list) {
1540 if (!res->hostname_dn)
1541 continue;
1542 if ((query_type == res->prefered_query_type) &&
1543 hostname_dn_len == res->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001544 !dns_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +02001545 return res;
1546 }
1547
1548 from_pool:
1549 /* No resolution could be found, so let's allocate a new one */
Willy Tarreaubafbe012017-11-24 17:34:44 +01001550 res = pool_alloc(dns_resolution_pool);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001551 if (res) {
1552 memset(res, 0, sizeof(*res));
1553 res->resolvers = resolvers;
1554 res->uuid = resolution_uuid;
1555 res->status = RSLV_STATUS_NONE;
1556 res->step = RSLV_STEP_NONE;
1557 res->last_valid = now_ms;
1558
1559 LIST_INIT(&res->requesters);
1560 LIST_INIT(&res->response.answer_list);
Baptiste Assmann13a92322019-06-07 09:40:55 +02001561 LIST_INIT(&res->response.ar_list);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001562
1563 res->prefered_query_type = query_type;
1564 res->query_type = query_type;
1565 res->hostname_dn = *hostname_dn;
1566 res->hostname_dn_len = hostname_dn_len;
1567
1568 ++resolution_uuid;
1569
1570 /* Move the resolution to the resolvers wait queue */
1571 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1572 }
1573 return res;
1574}
1575
1576/* Releases a resolution from its requester(s) and move it back to the pool */
1577static void dns_free_resolution(struct dns_resolution *resolution)
1578{
1579 struct dns_requester *req, *reqback;
1580
1581 /* clean up configuration */
1582 dns_reset_resolution(resolution);
1583 resolution->hostname_dn = NULL;
1584 resolution->hostname_dn_len = 0;
1585
1586 list_for_each_entry_safe(req, reqback, &resolution->requesters, list) {
1587 LIST_DEL(&req->list);
1588 req->resolution = NULL;
1589 }
1590
1591 LIST_DEL(&resolution->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +01001592 pool_free(dns_resolution_pool, resolution);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001593}
1594
1595/* Links a requester (a server or a dns_srvrq) with a resolution. It returns 0
1596 * on success, -1 otherwise.
1597 */
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001598int dns_link_resolution(void *requester, int requester_type, int requester_locked)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001599{
1600 struct dns_resolution *res = NULL;
1601 struct dns_requester *req;
1602 struct dns_resolvers *resolvers;
1603 struct server *srv = NULL;
1604 struct dns_srvrq *srvrq = NULL;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001605 struct stream *stream = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001606 char **hostname_dn;
1607 int hostname_dn_len, query_type;
1608
1609 switch (requester_type) {
1610 case OBJ_TYPE_SERVER:
1611 srv = (struct server *)requester;
1612 hostname_dn = &srv->hostname_dn;
1613 hostname_dn_len = srv->hostname_dn_len;
1614 resolvers = srv->resolvers;
1615 query_type = ((srv->dns_opts.family_prio == AF_INET)
1616 ? DNS_RTYPE_A
1617 : DNS_RTYPE_AAAA);
1618 break;
1619
1620 case OBJ_TYPE_SRVRQ:
1621 srvrq = (struct dns_srvrq *)requester;
1622 hostname_dn = &srvrq->hostname_dn;
1623 hostname_dn_len = srvrq->hostname_dn_len;
1624 resolvers = srvrq->resolvers;
1625 query_type = DNS_RTYPE_SRV;
1626 break;
1627
Baptiste Assmann333939c2019-01-21 08:34:50 +01001628 case OBJ_TYPE_STREAM:
1629 stream = (struct stream *)requester;
1630 hostname_dn = &stream->dns_ctx.hostname_dn;
1631 hostname_dn_len = stream->dns_ctx.hostname_dn_len;
1632 resolvers = stream->dns_ctx.parent->arg.dns.resolvers;
Christopher Fauleta4168432020-01-24 18:08:42 +01001633 query_type = ((stream->dns_ctx.parent->arg.dns.dns_opts->family_prio == AF_INET)
Baptiste Assmann333939c2019-01-21 08:34:50 +01001634 ? DNS_RTYPE_A
1635 : DNS_RTYPE_AAAA);
1636 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001637 default:
1638 goto err;
1639 }
1640
1641 /* Get a resolution from the resolvers' wait queue or pool */
1642 if ((res = dns_pick_resolution(resolvers, hostname_dn, hostname_dn_len, query_type)) == NULL)
1643 goto err;
1644
1645 if (srv) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001646 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001647 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001648 if (srv->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001649 if ((req = pool_alloc(dns_requester_pool)) == NULL) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001650 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001651 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001652 goto err;
Willy Tarreau5ec84572017-11-05 10:35:57 +01001653 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001654 req->owner = &srv->obj_type;
1655 srv->dns_requester = req;
1656 }
1657 else
1658 req = srv->dns_requester;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001659 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001660 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001661
1662 req->requester_cb = snr_resolution_cb;
1663 req->requester_error_cb = snr_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001664 }
1665 else if (srvrq) {
1666 if (srvrq->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001667 if ((req = pool_alloc(dns_requester_pool)) == NULL)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001668 goto err;
1669 req->owner = &srvrq->obj_type;
1670 srvrq->dns_requester = req;
1671 }
1672 else
1673 req = srvrq->dns_requester;
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001674
1675 req->requester_cb = snr_resolution_cb;
1676 req->requester_error_cb = snr_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001677 }
Baptiste Assmann333939c2019-01-21 08:34:50 +01001678 else if (stream) {
1679 if (stream->dns_ctx.dns_requester == NULL) {
1680 if ((req = pool_alloc(dns_requester_pool)) == NULL)
1681 goto err;
1682 req->owner = &stream->obj_type;
1683 stream->dns_ctx.dns_requester = req;
1684 }
1685 else
1686 req = stream->dns_ctx.dns_requester;
1687
1688 req->requester_cb = act_resolution_cb;
1689 req->requester_error_cb = act_resolution_error_cb;
1690 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001691 else
1692 goto err;
1693
1694 req->resolution = res;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001695
1696 LIST_ADDQ(&res->requesters, &req->list);
1697 return 0;
1698
1699 err:
1700 if (res && LIST_ISEMPTY(&res->requesters))
1701 dns_free_resolution(res);
1702 return -1;
1703}
1704
1705/* Removes a requester from a DNS resoltion. It takes takes care of all the
1706 * consequences. It also cleans up some parameters from the requester.
1707 */
1708void dns_unlink_resolution(struct dns_requester *requester)
1709{
1710 struct dns_resolution *res;
1711 struct dns_requester *req;
1712
1713 /* Nothing to do */
1714 if (!requester || !requester->resolution)
1715 return;
1716 res = requester->resolution;
1717
1718 /* Clean up the requester */
1719 LIST_DEL(&requester->list);
1720 requester->resolution = NULL;
1721
1722 /* We need to find another requester linked on this resolution */
1723 if (!LIST_ISEMPTY(&res->requesters))
1724 req = LIST_NEXT(&res->requesters, struct dns_requester *, list);
1725 else {
1726 dns_free_resolution(res);
1727 return;
1728 }
1729
1730 /* Move hostname_dn related pointers to the next requester */
1731 switch (obj_type(req->owner)) {
1732 case OBJ_TYPE_SERVER:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001733 res->hostname_dn = __objt_server(req->owner)->hostname_dn;
1734 res->hostname_dn_len = __objt_server(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001735 break;
1736 case OBJ_TYPE_SRVRQ:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001737 res->hostname_dn = __objt_dns_srvrq(req->owner)->hostname_dn;
1738 res->hostname_dn_len = __objt_dns_srvrq(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001739 break;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001740 case OBJ_TYPE_STREAM:
1741 res->hostname_dn = __objt_stream(req->owner)->dns_ctx.hostname_dn;
1742 res->hostname_dn_len = __objt_stream(req->owner)->dns_ctx.hostname_dn_len;
1743 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001744 default:
1745 res->hostname_dn = NULL;
1746 res->hostname_dn_len = 0;
1747 break;
1748 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001749}
1750
Christopher Faulet67957bd2017-09-27 11:00:59 +02001751/* Called when a network IO is generated on a name server socket for an incoming
1752 * packet. It performs the following actions:
1753 * - check if the packet requires processing (not outdated resolution)
1754 * - ensure the DNS packet received is valid and call requester's callback
1755 * - call requester's error callback if invalid response
1756 * - check the dn_name in the packet against the one sent
1757 */
1758static void dns_resolve_recv(struct dgram_conn *dgram)
1759{
1760 struct dns_nameserver *ns, *tmpns;
1761 struct dns_resolvers *resolvers;
1762 struct dns_resolution *res;
1763 struct dns_query_item *query;
1764 unsigned char buf[DNS_MAX_UDP_MESSAGE + 1];
1765 unsigned char *bufend;
1766 int fd, buflen, dns_resp;
1767 int max_answer_records;
1768 unsigned short query_id;
1769 struct eb32_node *eb;
1770 struct dns_requester *req;
1771
1772 fd = dgram->t.sock.fd;
1773
1774 /* check if ready for reading */
1775 if (!fd_recv_ready(fd))
1776 return;
1777
1778 /* no need to go further if we can't retrieve the nameserver */
Willy Tarreau1c759952019-12-10 18:38:09 +01001779 if ((ns = dgram->owner) == NULL) {
1780 _HA_ATOMIC_AND(&fdtab[fd].ev, ~(FD_POLL_HUP|FD_POLL_ERR));
1781 fd_stop_recv(fd);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001782 return;
Willy Tarreau1c759952019-12-10 18:38:09 +01001783 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001784
1785 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001786 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001787
1788 /* process all pending input messages */
Willy Tarreau1c759952019-12-10 18:38:09 +01001789 while (fd_recv_ready(fd)) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001790 /* read message received */
1791 memset(buf, '\0', resolvers->accepted_payload_size + 1);
1792 if ((buflen = recv(fd, (char*)buf , resolvers->accepted_payload_size + 1, 0)) < 0) {
Willy Tarreau1c759952019-12-10 18:38:09 +01001793 /* FIXME : for now we consider EAGAIN only, but at
1794 * least we purge sticky errors that would cause us to
1795 * be called in loops.
1796 */
1797 _HA_ATOMIC_AND(&fdtab[fd].ev, ~(FD_POLL_HUP|FD_POLL_ERR));
Christopher Faulet67957bd2017-09-27 11:00:59 +02001798 fd_cant_recv(fd);
1799 break;
1800 }
1801
1802 /* message too big */
1803 if (buflen > resolvers->accepted_payload_size) {
1804 ns->counters.too_big++;
1805 continue;
1806 }
1807
1808 /* initializing variables */
1809 bufend = buf + buflen; /* pointer to mark the end of the buffer */
1810
1811 /* read the query id from the packet (16 bits) */
1812 if (buf + 2 > bufend) {
1813 ns->counters.invalid++;
1814 continue;
1815 }
1816 query_id = dns_response_get_query_id(buf);
1817
1818 /* search the query_id in the pending resolution tree */
1819 eb = eb32_lookup(&resolvers->query_ids, query_id);
1820 if (eb == NULL) {
1821 /* unknown query id means an outdated response and can be safely ignored */
1822 ns->counters.outdated++;
1823 continue;
1824 }
1825
William Dauchybe8a3872019-11-27 23:32:41 +01001826 /* known query id means a resolution in progress */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001827 res = eb32_entry(eb, struct dns_resolution, qid);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001828 /* number of responses received */
1829 res->nb_responses++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001830
Christopher Faulet67957bd2017-09-27 11:00:59 +02001831 max_answer_records = (resolvers->accepted_payload_size - DNS_HEADER_SIZE) / DNS_MIN_RECORD_SIZE;
1832 dns_resp = dns_validate_dns_response(buf, bufend, res, max_answer_records);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001833
Christopher Faulet67957bd2017-09-27 11:00:59 +02001834 switch (dns_resp) {
1835 case DNS_RESP_VALID:
1836 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001837
Christopher Faulet67957bd2017-09-27 11:00:59 +02001838 case DNS_RESP_INVALID:
1839 case DNS_RESP_QUERY_COUNT_ERROR:
1840 case DNS_RESP_WRONG_NAME:
1841 res->status = RSLV_STATUS_INVALID;
1842 ns->counters.invalid++;
1843 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001844
Christopher Faulet67957bd2017-09-27 11:00:59 +02001845 case DNS_RESP_NX_DOMAIN:
1846 res->status = RSLV_STATUS_NX;
1847 ns->counters.nx++;
1848 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001849
Christopher Faulet67957bd2017-09-27 11:00:59 +02001850 case DNS_RESP_REFUSED:
1851 res->status = RSLV_STATUS_REFUSED;
1852 ns->counters.refused++;
1853 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001854
Christopher Faulet67957bd2017-09-27 11:00:59 +02001855 case DNS_RESP_ANCOUNT_ZERO:
1856 res->status = RSLV_STATUS_OTHER;
1857 ns->counters.any_err++;
1858 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001859
Christopher Faulet67957bd2017-09-27 11:00:59 +02001860 case DNS_RESP_CNAME_ERROR:
1861 res->status = RSLV_STATUS_OTHER;
1862 ns->counters.cname_error++;
1863 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001864
Christopher Faulet67957bd2017-09-27 11:00:59 +02001865 case DNS_RESP_TRUNCATED:
1866 res->status = RSLV_STATUS_OTHER;
1867 ns->counters.truncated++;
1868 break;
Baptiste Assmanne70bc052017-08-21 16:51:09 +02001869
Christopher Faulet67957bd2017-09-27 11:00:59 +02001870 case DNS_RESP_NO_EXPECTED_RECORD:
1871 case DNS_RESP_ERROR:
1872 case DNS_RESP_INTERNAL:
1873 res->status = RSLV_STATUS_OTHER;
1874 ns->counters.other++;
1875 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001876 }
1877
Christopher Faulet67957bd2017-09-27 11:00:59 +02001878 /* Wait all nameservers response to handle errors */
1879 if (dns_resp != DNS_RESP_VALID && res->nb_responses < resolvers->nb_nameservers)
1880 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001881
Christopher Faulet67957bd2017-09-27 11:00:59 +02001882 /* Process error codes */
1883 if (dns_resp != DNS_RESP_VALID) {
1884 if (res->prefered_query_type != res->query_type) {
1885 /* The fallback on the query type was already performed,
1886 * so check the try counter. If it falls to 0, we can
1887 * report an error. Else, wait the next attempt. */
1888 if (!res->try)
1889 goto report_res_error;
1890 }
1891 else {
1892 /* Fallback from A to AAAA or the opposite and re-send
1893 * the resolution immediately. try counter is not
1894 * decremented. */
1895 if (res->prefered_query_type == DNS_RTYPE_A) {
1896 res->query_type = DNS_RTYPE_AAAA;
1897 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001898 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001899 else if (res->prefered_query_type == DNS_RTYPE_AAAA) {
1900 res->query_type = DNS_RTYPE_A;
1901 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001902 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001903 }
1904 continue;
1905 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001906
Christopher Faulet67957bd2017-09-27 11:00:59 +02001907 /* Now let's check the query's dname corresponds to the one we
1908 * sent. We can check only the first query of the list. We send
1909 * one query at a time so we get one query in the response */
1910 query = LIST_NEXT(&res->response.query_list, struct dns_query_item *, list);
Olivier Houchardb17b8842020-04-01 18:30:27 +02001911 if (query && dns_hostname_cmp(query->name, res->hostname_dn, res->hostname_dn_len) != 0) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001912 dns_resp = DNS_RESP_WRONG_NAME;
1913 ns->counters.other++;
1914 goto report_res_error;
1915 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001916
Christopher Faulet67957bd2017-09-27 11:00:59 +02001917 /* So the resolution succeeded */
1918 res->status = RSLV_STATUS_VALID;
1919 res->last_valid = now_ms;
1920 ns->counters.valid++;
1921 goto report_res_success;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001922
Christopher Faulet67957bd2017-09-27 11:00:59 +02001923 report_res_error:
1924 list_for_each_entry(req, &res->requesters, list)
1925 req->requester_error_cb(req, dns_resp);
1926 dns_reset_resolution(res);
1927 LIST_DEL(&res->list);
1928 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1929 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001930
Christopher Faulet67957bd2017-09-27 11:00:59 +02001931 report_res_success:
1932 /* Only the 1rst requester s managed by the server, others are
1933 * from the cache */
1934 tmpns = ns;
1935 list_for_each_entry(req, &res->requesters, list) {
Olivier Houchard28381072017-11-06 17:30:28 +01001936 struct server *s = objt_server(req->owner);
1937
1938 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001939 HA_SPIN_LOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001940 req->requester_cb(req, tmpns);
Olivier Houchard28381072017-11-06 17:30:28 +01001941 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001942 HA_SPIN_UNLOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001943 tmpns = NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001944 }
Baptiste Assmann42746372017-05-03 12:12:02 +02001945
Christopher Faulet67957bd2017-09-27 11:00:59 +02001946 dns_reset_resolution(res);
1947 LIST_DEL(&res->list);
1948 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1949 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001950 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001951 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001952 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001953}
William Lallemand69e96442016-11-19 00:58:54 +01001954
Christopher Faulet67957bd2017-09-27 11:00:59 +02001955/* Called when a resolvers network socket is ready to send data */
1956static void dns_resolve_send(struct dgram_conn *dgram)
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001957{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001958 struct dns_resolvers *resolvers;
1959 struct dns_nameserver *ns;
1960 struct dns_resolution *res;
1961 int fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001962
Christopher Faulet67957bd2017-09-27 11:00:59 +02001963 fd = dgram->t.sock.fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001964
Christopher Faulet67957bd2017-09-27 11:00:59 +02001965 /* check if ready for sending */
1966 if (!fd_send_ready(fd))
1967 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001968
Christopher Faulet67957bd2017-09-27 11:00:59 +02001969 /* we don't want/need to be waked up any more for sending */
1970 fd_stop_send(fd);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001971
Christopher Faulet67957bd2017-09-27 11:00:59 +02001972 /* no need to go further if we can't retrieve the nameserver */
1973 if ((ns = dgram->owner) == NULL)
1974 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001975
Christopher Faulet67957bd2017-09-27 11:00:59 +02001976 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001977 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02001978
Christopher Faulet67957bd2017-09-27 11:00:59 +02001979 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001980 int ret, len;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001981
Christopher Faulet67957bd2017-09-27 11:00:59 +02001982 if (res->nb_queries == resolvers->nb_nameservers)
1983 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001984
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001985 len = dns_build_query(res->query_id, res->query_type,
1986 resolvers->accepted_payload_size,
1987 res->hostname_dn, res->hostname_dn_len,
1988 trash.area, trash.size);
1989 if (len == -1)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001990 goto snd_error;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001991
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001992 ret = send(fd, trash.area, len, 0);
Willy Tarreau0eae6322019-12-20 11:18:54 +01001993 if (ret != len) {
1994 if (ret == -1 && errno == EAGAIN) {
1995 /* retry once the socket is ready */
1996 fd_cant_send(fd);
1997 continue;
1998 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001999 goto snd_error;
Willy Tarreau0eae6322019-12-20 11:18:54 +01002000 }
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002001
Christopher Faulet67957bd2017-09-27 11:00:59 +02002002 ns->counters.sent++;
2003 res->nb_queries++;
2004 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002005
Christopher Faulet67957bd2017-09-27 11:00:59 +02002006 snd_error:
2007 ns->counters.snd_error++;
2008 res->nb_queries++;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002009 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002010 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002011}
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002012
Christopher Faulet67957bd2017-09-27 11:00:59 +02002013/* Processes DNS resolution. First, it checks the active list to detect expired
2014 * resolutions and retry them if possible. Else a timeout is reported. Then, it
2015 * checks the wait list to trigger new resolutions.
2016 */
Olivier Houchard9f6af332018-05-25 14:04:04 +02002017static struct task *dns_process_resolvers(struct task *t, void *context, unsigned short state)
Christopher Faulet67957bd2017-09-27 11:00:59 +02002018{
Olivier Houchard9f6af332018-05-25 14:04:04 +02002019 struct dns_resolvers *resolvers = context;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002020 struct dns_resolution *res, *resback;
2021 int exp;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002022
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002023 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02002024
Christopher Faulet67957bd2017-09-27 11:00:59 +02002025 /* Handle all expired resolutions from the active list */
2026 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
2027 /* When we find the first resolution in the future, then we can
2028 * stop here */
2029 exp = tick_add(res->last_query, resolvers->timeout.retry);
2030 if (!tick_is_expired(exp, now_ms))
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002031 break;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002032
Christopher Faulet67957bd2017-09-27 11:00:59 +02002033 /* If current resolution has been tried too many times and
2034 * finishes in timeout we update its status and remove it from
2035 * the list */
2036 if (!res->try) {
2037 struct dns_requester *req;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002038
Christopher Faulet67957bd2017-09-27 11:00:59 +02002039 /* Notify the result to the requesters */
2040 if (!res->nb_responses)
2041 res->status = RSLV_STATUS_TIMEOUT;
2042 list_for_each_entry(req, &res->requesters, list)
2043 req->requester_error_cb(req, res->status);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002044
Christopher Faulet67957bd2017-09-27 11:00:59 +02002045 /* Clean up resolution info and remove it from the
2046 * current list */
2047 dns_reset_resolution(res);
2048 LIST_DEL(&res->list);
2049 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
William Lallemand69e96442016-11-19 00:58:54 +01002050 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002051 else {
2052 /* Otherwise resend the DNS query and requeue the resolution */
2053 if (!res->nb_responses || res->prefered_query_type != res->query_type) {
2054 /* No response received (a real timeout) or fallback already done */
2055 res->query_type = res->prefered_query_type;
2056 res->try--;
2057 }
2058 else {
2059 /* Fallback from A to AAAA or the opposite and re-send
2060 * the resolution immediately. try counter is not
2061 * decremented. */
2062 if (res->prefered_query_type == DNS_RTYPE_A)
2063 res->query_type = DNS_RTYPE_AAAA;
2064 else if (res->prefered_query_type == DNS_RTYPE_AAAA)
2065 res->query_type = DNS_RTYPE_A;
2066 else
2067 res->try--;
2068 }
2069 dns_send_query(res);
William Lallemand69e96442016-11-19 00:58:54 +01002070 }
2071 }
William Lallemand69e96442016-11-19 00:58:54 +01002072
Christopher Faulet67957bd2017-09-27 11:00:59 +02002073 /* Handle all resolutions in the wait list */
2074 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
2075 exp = tick_add(res->last_resolution, dns_resolution_timeout(res));
2076 if (tick_isset(res->last_resolution) && !tick_is_expired(exp, now_ms))
2077 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002078
Christopher Faulet67957bd2017-09-27 11:00:59 +02002079 if (dns_run_resolution(res) != 1) {
2080 res->last_resolution = now_ms;
2081 LIST_DEL(&res->list);
2082 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002083 }
2084 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002085
Christopher Faulet67957bd2017-09-27 11:00:59 +02002086 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002087 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002088 return t;
2089}
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002090
Christopher Faulet67957bd2017-09-27 11:00:59 +02002091/* proto_udp callback functions for a DNS resolution */
2092struct dgram_data_cb resolve_dgram_cb = {
2093 .recv = dns_resolve_recv,
2094 .send = dns_resolve_send,
2095};
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002096
Christopher Faulet67957bd2017-09-27 11:00:59 +02002097/* Release memory allocated by DNS */
2098static void dns_deinit(void)
2099{
2100 struct dns_resolvers *resolvers, *resolversback;
2101 struct dns_nameserver *ns, *nsback;
2102 struct dns_resolution *res, *resback;
2103 struct dns_requester *req, *reqback;
2104 struct dns_srvrq *srvrq, *srvrqback;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002105
Christopher Faulet67957bd2017-09-27 11:00:59 +02002106 list_for_each_entry_safe(resolvers, resolversback, &dns_resolvers, list) {
2107 list_for_each_entry_safe(ns, nsback, &resolvers->nameservers, list) {
2108 free(ns->id);
2109 free((char *)ns->conf.file);
2110 if (ns->dgram && ns->dgram->t.sock.fd != -1)
2111 fd_delete(ns->dgram->t.sock.fd);
2112 free(ns->dgram);
2113 LIST_DEL(&ns->list);
2114 free(ns);
2115 }
2116
2117 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
2118 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
2119 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01002120 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002121 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002122 dns_free_resolution(res);
2123 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02002124
Christopher Faulet67957bd2017-09-27 11:00:59 +02002125 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
2126 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
2127 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01002128 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002129 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002130 dns_free_resolution(res);
2131 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02002132
Christopher Faulet67957bd2017-09-27 11:00:59 +02002133 free(resolvers->id);
2134 free((char *)resolvers->conf.file);
Olivier Houchard3f795f72019-04-17 22:51:06 +02002135 task_destroy(resolvers->t);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002136 LIST_DEL(&resolvers->list);
2137 free(resolvers);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002138 }
2139
Christopher Faulet67957bd2017-09-27 11:00:59 +02002140 list_for_each_entry_safe(srvrq, srvrqback, &dns_srvrq_list, list) {
2141 free(srvrq->name);
2142 free(srvrq->hostname_dn);
2143 LIST_DEL(&srvrq->list);
2144 free(srvrq);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002145 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002146}
2147
Christopher Faulet67957bd2017-09-27 11:00:59 +02002148/* Finalizes the DNS configuration by allocating required resources and checking
2149 * live parameters.
2150 * Returns 0 on success, ERR_* flags otherwise.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002151 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02002152static int dns_finalize_config(void)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002153{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002154 struct dns_resolvers *resolvers;
2155 struct proxy *px;
2156 int err_code = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002157
Christopher Faulet67957bd2017-09-27 11:00:59 +02002158 /* allocate pool of resolution per resolvers */
2159 list_for_each_entry(resolvers, &dns_resolvers, list) {
2160 struct dns_nameserver *ns;
2161 struct task *t;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002162
Christopher Faulet67957bd2017-09-27 11:00:59 +02002163 /* Check if we can create the socket with nameservers info */
2164 list_for_each_entry(ns, &resolvers->nameservers, list) {
2165 struct dgram_conn *dgram = NULL;
2166 int fd;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002167
Christopher Faulet67957bd2017-09-27 11:00:59 +02002168 /* Check nameserver info */
2169 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002170 ha_alert("config : resolvers '%s': can't create socket for nameserver '%s'.\n",
2171 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002172 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002173 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02002174 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002175 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002176 ha_alert("config : resolvers '%s': can't connect socket for nameserver '%s'.\n",
2177 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002178 close(fd);
2179 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002180 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02002181 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002182 close(fd);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002183
Christopher Faulet67957bd2017-09-27 11:00:59 +02002184 /* Create dgram structure that will hold the UPD socket
2185 * and attach it on the current nameserver */
2186 if ((dgram = calloc(1, sizeof(*dgram))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002187 ha_alert("config: resolvers '%s' : out of memory.\n",
2188 resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002189 err_code |= (ERR_ALERT|ERR_ABORT);
2190 goto err;
2191 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002192
Christopher Faulet67957bd2017-09-27 11:00:59 +02002193 /* Leave dgram partially initialized, no FD attached for
2194 * now. */
2195 dgram->owner = ns;
2196 dgram->data = &resolve_dgram_cb;
2197 dgram->t.sock.fd = -1;
2198 ns->dgram = dgram;
2199 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002200
Christopher Faulet67957bd2017-09-27 11:00:59 +02002201 /* Create the task associated to the resolvers section */
Emeric Brunc60def82017-09-27 14:59:38 +02002202 if ((t = task_new(MAX_THREADS_MASK)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002203 ha_alert("config : resolvers '%s' : out of memory.\n", resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002204 err_code |= (ERR_ALERT|ERR_ABORT);
2205 goto err;
2206 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002207
Christopher Faulet67957bd2017-09-27 11:00:59 +02002208 /* Update task's parameters */
2209 t->process = dns_process_resolvers;
2210 t->context = resolvers;
2211 resolvers->t = t;
2212 task_wakeup(t, TASK_WOKEN_INIT);
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002213 }
2214
Olivier Houchardfbc74e82017-11-24 16:54:05 +01002215 for (px = proxies_list; px; px = px->next) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002216 struct server *srv;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002217
Christopher Faulet67957bd2017-09-27 11:00:59 +02002218 for (srv = px->srv; srv; srv = srv->next) {
2219 struct dns_resolvers *resolvers;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002220
Christopher Faulet67957bd2017-09-27 11:00:59 +02002221 if (!srv->resolvers_id)
2222 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002223
Christopher Faulet67957bd2017-09-27 11:00:59 +02002224 if ((resolvers = find_resolvers_by_id(srv->resolvers_id)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002225 ha_alert("config : %s '%s', server '%s': unable to find required resolvers '%s'\n",
2226 proxy_type_str(px), px->id, srv->id, srv->resolvers_id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002227 err_code |= (ERR_ALERT|ERR_ABORT);
2228 continue;
2229 }
2230 srv->resolvers = resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002231
Christopher Faulet67957bd2017-09-27 11:00:59 +02002232 if (srv->srvrq && !srv->srvrq->resolvers) {
2233 srv->srvrq->resolvers = srv->resolvers;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01002234 if (dns_link_resolution(srv->srvrq, OBJ_TYPE_SRVRQ, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002235 ha_alert("config : %s '%s' : unable to set DNS resolution for server '%s'.\n",
2236 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002237 err_code |= (ERR_ALERT|ERR_ABORT);
2238 continue;
2239 }
2240 }
Olivier Houchard55dcdf42017-11-06 15:15:04 +01002241 if (dns_link_resolution(srv, OBJ_TYPE_SERVER, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002242 ha_alert("config : %s '%s', unable to set DNS resolution for server '%s'.\n",
2243 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002244 err_code |= (ERR_ALERT|ERR_ABORT);
2245 continue;
2246 }
2247 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002248 }
2249
Christopher Faulet67957bd2017-09-27 11:00:59 +02002250 if (err_code & (ERR_ALERT|ERR_ABORT))
2251 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002252
Christopher Faulet67957bd2017-09-27 11:00:59 +02002253 return err_code;
2254 err:
2255 dns_deinit();
2256 return err_code;
2257
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002258}
2259
Christopher Faulet67957bd2017-09-27 11:00:59 +02002260/* if an arg is found, it sets the resolvers section pointer into cli.p0 */
Aurélien Nephtaliabbf6072018-04-18 13:26:46 +02002261static int cli_parse_stat_resolvers(char **args, char *payload, struct appctx *appctx, void *private)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002262{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002263 struct dns_resolvers *presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002264
Christopher Faulet67957bd2017-09-27 11:00:59 +02002265 if (*args[2]) {
2266 list_for_each_entry(presolvers, &dns_resolvers, list) {
2267 if (strcmp(presolvers->id, args[2]) == 0) {
2268 appctx->ctx.cli.p0 = presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002269 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002270 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002271 }
Willy Tarreau9d008692019-08-09 11:21:01 +02002272 if (appctx->ctx.cli.p0 == NULL)
2273 return cli_err(appctx, "Can't find that resolvers section\n");
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002274 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002275 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002276}
2277
Christopher Faulet67957bd2017-09-27 11:00:59 +02002278/* Dumps counters from all resolvers section and associated name servers. It
2279 * returns 0 if the output buffer is full and it needs to be called again,
2280 * otherwise non-zero. It may limit itself to the resolver pointed to by
Willy Tarreau777b5602016-12-16 18:06:26 +01002281 * <cli.p0> if it's not null.
William Lallemand69e96442016-11-19 00:58:54 +01002282 */
2283static int cli_io_handler_dump_resolvers_to_buffer(struct appctx *appctx)
2284{
2285 struct stream_interface *si = appctx->owner;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002286 struct dns_resolvers *resolvers;
2287 struct dns_nameserver *ns;
William Lallemand69e96442016-11-19 00:58:54 +01002288
2289 chunk_reset(&trash);
2290
2291 switch (appctx->st2) {
2292 case STAT_ST_INIT:
2293 appctx->st2 = STAT_ST_LIST; /* let's start producing data */
2294 /* fall through */
2295
2296 case STAT_ST_LIST:
2297 if (LIST_ISEMPTY(&dns_resolvers)) {
2298 chunk_appendf(&trash, "No resolvers found\n");
2299 }
2300 else {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002301 list_for_each_entry(resolvers, &dns_resolvers, list) {
2302 if (appctx->ctx.cli.p0 != NULL && appctx->ctx.cli.p0 != resolvers)
William Lallemand69e96442016-11-19 00:58:54 +01002303 continue;
2304
Christopher Faulet67957bd2017-09-27 11:00:59 +02002305 chunk_appendf(&trash, "Resolvers section %s\n", resolvers->id);
2306 list_for_each_entry(ns, &resolvers->nameservers, list) {
2307 chunk_appendf(&trash, " nameserver %s:\n", ns->id);
2308 chunk_appendf(&trash, " sent: %lld\n", ns->counters.sent);
2309 chunk_appendf(&trash, " snd_error: %lld\n", ns->counters.snd_error);
2310 chunk_appendf(&trash, " valid: %lld\n", ns->counters.valid);
2311 chunk_appendf(&trash, " update: %lld\n", ns->counters.update);
2312 chunk_appendf(&trash, " cname: %lld\n", ns->counters.cname);
2313 chunk_appendf(&trash, " cname_error: %lld\n", ns->counters.cname_error);
2314 chunk_appendf(&trash, " any_err: %lld\n", ns->counters.any_err);
2315 chunk_appendf(&trash, " nx: %lld\n", ns->counters.nx);
2316 chunk_appendf(&trash, " timeout: %lld\n", ns->counters.timeout);
2317 chunk_appendf(&trash, " refused: %lld\n", ns->counters.refused);
2318 chunk_appendf(&trash, " other: %lld\n", ns->counters.other);
2319 chunk_appendf(&trash, " invalid: %lld\n", ns->counters.invalid);
2320 chunk_appendf(&trash, " too_big: %lld\n", ns->counters.too_big);
2321 chunk_appendf(&trash, " truncated: %lld\n", ns->counters.truncated);
2322 chunk_appendf(&trash, " outdated: %lld\n", ns->counters.outdated);
William Lallemand69e96442016-11-19 00:58:54 +01002323 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002324 chunk_appendf(&trash, "\n");
William Lallemand69e96442016-11-19 00:58:54 +01002325 }
2326 }
2327
2328 /* display response */
Willy Tarreau06d80a92017-10-19 14:32:15 +02002329 if (ci_putchk(si_ic(si), &trash) == -1) {
William Lallemand69e96442016-11-19 00:58:54 +01002330 /* let's try again later from this session. We add ourselves into
2331 * this session's users so that it can remove us upon termination.
2332 */
Willy Tarreaudb398432018-11-15 11:08:52 +01002333 si_rx_room_blk(si);
William Lallemand69e96442016-11-19 00:58:54 +01002334 return 0;
2335 }
William Lallemand69e96442016-11-19 00:58:54 +01002336 /* fall through */
2337
2338 default:
2339 appctx->st2 = STAT_ST_FIN;
2340 return 1;
2341 }
2342}
2343
2344/* register cli keywords */
Christopher Fauletff88efb2017-10-03 16:00:57 +02002345static struct cli_kw_list cli_kws = {{ }, {
2346 { { "show", "resolvers", NULL }, "show resolvers [id]: dumps counters from all resolvers section and\n"
2347 " associated name servers",
2348 cli_parse_stat_resolvers, cli_io_handler_dump_resolvers_to_buffer },
2349 {{},}
2350 }
2351};
William Lallemand69e96442016-11-19 00:58:54 +01002352
Willy Tarreau0108d902018-11-25 19:14:37 +01002353INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
William Lallemand69e96442016-11-19 00:58:54 +01002354
Baptiste Assmann333939c2019-01-21 08:34:50 +01002355/*
2356 * Prepare <rule> for hostname resolution.
2357 * Returns -1 in case of any allocation failure, 0 if not.
2358 * On error, a global failure counter is also incremented.
2359 */
2360static int action_prepare_for_resolution(struct stream *stream, const char *hostname)
2361{
2362 char *hostname_dn;
2363 int hostname_len, hostname_dn_len;
2364 struct buffer *tmp = get_trash_chunk();
2365
2366 if (!hostname)
2367 return 0;
2368
2369 hostname_len = strlen(hostname);
2370 hostname_dn = tmp->area;
2371 hostname_dn_len = dns_str_to_dn_label(hostname, hostname_len + 1,
2372 hostname_dn, tmp->size);
2373 if (hostname_dn_len == -1)
2374 goto err;
2375
2376
2377 stream->dns_ctx.hostname_dn = strdup(hostname_dn);
2378 stream->dns_ctx.hostname_dn_len = hostname_dn_len;
2379 if (!stream->dns_ctx.hostname_dn)
2380 goto err;
2381
2382 return 0;
2383
2384 err:
2385 free(stream->dns_ctx.hostname_dn); stream->dns_ctx.hostname_dn = NULL;
2386 dns_failed_resolutions += 1;
2387 return -1;
2388}
2389
2390
2391/*
2392 * Execute the "do-resolution" action. May be called from {tcp,http}request.
2393 */
2394enum act_return dns_action_do_resolve(struct act_rule *rule, struct proxy *px,
2395 struct session *sess, struct stream *s, int flags)
2396{
Baptiste Assmann333939c2019-01-21 08:34:50 +01002397 struct dns_resolution *resolution;
Willy Tarreau45726fd2019-07-17 10:38:45 +02002398 struct sample *smp;
2399 char *fqdn;
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002400 struct dns_requester *req;
2401 struct dns_resolvers *resolvers;
2402 struct dns_resolution *res;
2403 int exp;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002404
2405 /* we have a response to our DNS resolution */
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002406 use_cache:
Baptiste Assmann333939c2019-01-21 08:34:50 +01002407 if (s->dns_ctx.dns_requester && s->dns_ctx.dns_requester->resolution != NULL) {
2408 resolution = s->dns_ctx.dns_requester->resolution;
Baptiste Assmann4c52e4b2019-10-01 15:32:40 +02002409 if (resolution->step == RSLV_STEP_RUNNING) {
2410 return ACT_RET_YIELD;
2411 }
Baptiste Assmann333939c2019-01-21 08:34:50 +01002412 if (resolution->step == RSLV_STEP_NONE) {
2413 /* We update the variable only if we have a valid response. */
2414 if (resolution->status == RSLV_STATUS_VALID) {
2415 struct sample smp;
2416 short ip_sin_family = 0;
2417 void *ip = NULL;
2418
Christopher Fauleta4168432020-01-24 18:08:42 +01002419 dns_get_ip_from_response(&resolution->response, rule->arg.dns.dns_opts, NULL,
Baptiste Assmann333939c2019-01-21 08:34:50 +01002420 0, &ip, &ip_sin_family, NULL);
2421
2422 switch (ip_sin_family) {
2423 case AF_INET:
2424 smp.data.type = SMP_T_IPV4;
2425 memcpy(&smp.data.u.ipv4, ip, 4);
2426 break;
2427 case AF_INET6:
2428 smp.data.type = SMP_T_IPV6;
2429 memcpy(&smp.data.u.ipv6, ip, 16);
2430 break;
2431 default:
2432 ip = NULL;
2433 }
2434
2435 if (ip) {
2436 smp.px = px;
2437 smp.sess = sess;
2438 smp.strm = s;
2439
2440 vars_set_by_name(rule->arg.dns.varname, strlen(rule->arg.dns.varname), &smp);
2441 }
2442 }
2443 }
2444
2445 free(s->dns_ctx.hostname_dn); s->dns_ctx.hostname_dn = NULL;
2446 s->dns_ctx.hostname_dn_len = 0;
2447 dns_unlink_resolution(s->dns_ctx.dns_requester);
2448
2449 pool_free(dns_requester_pool, s->dns_ctx.dns_requester);
2450 s->dns_ctx.dns_requester = NULL;
2451
2452 return ACT_RET_CONT;
2453 }
2454
2455 /* need to configure and start a new DNS resolution */
Willy Tarreau45726fd2019-07-17 10:38:45 +02002456 smp = sample_fetch_as_type(px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.dns.expr, SMP_T_STR);
2457 if (smp == NULL)
2458 return ACT_RET_CONT;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002459
Willy Tarreau45726fd2019-07-17 10:38:45 +02002460 fqdn = smp->data.u.str.area;
2461 if (action_prepare_for_resolution(s, fqdn) == -1)
Christopher Faulet13403762019-12-13 09:01:57 +01002462 return ACT_RET_CONT; /* on error, ignore the action */
Baptiste Assmann333939c2019-01-21 08:34:50 +01002463
Willy Tarreau45726fd2019-07-17 10:38:45 +02002464 s->dns_ctx.parent = rule;
2465 dns_link_resolution(s, OBJ_TYPE_STREAM, 0);
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002466
2467 /* Check if there is a fresh enough response in the cache of our associated resolution */
2468 req = s->dns_ctx.dns_requester;
2469 if (!req || !req->resolution) {
2470 dns_trigger_resolution(s->dns_ctx.dns_requester);
2471 return ACT_RET_YIELD;
2472 }
2473 res = req->resolution;
2474 resolvers = res->resolvers;
2475
2476 exp = tick_add(res->last_resolution, resolvers->hold.valid);
2477 if (resolvers->t && res->status == RSLV_STATUS_VALID && tick_isset(res->last_resolution)
2478 && !tick_is_expired(exp, now_ms)) {
2479 goto use_cache;
2480 }
2481
Willy Tarreau45726fd2019-07-17 10:38:45 +02002482 dns_trigger_resolution(s->dns_ctx.dns_requester);
Baptiste Assmann333939c2019-01-21 08:34:50 +01002483 return ACT_RET_YIELD;
2484}
2485
Christopher Faulet3b2bb632020-01-24 18:12:58 +01002486static void release_dns_action(struct act_rule *rule)
2487{
2488 release_sample_expr(rule->arg.dns.expr);
2489 free(rule->arg.dns.varname);
2490 free(rule->arg.dns.resolvers_id);
2491 free(rule->arg.dns.dns_opts);
2492}
2493
Baptiste Assmann333939c2019-01-21 08:34:50 +01002494
2495/* parse "do-resolve" action
2496 * This action takes the following arguments:
2497 * do-resolve(<varName>,<resolversSectionName>,<resolvePrefer>) <expr>
2498 *
2499 * - <varName> is the variable name where the result of the DNS resolution will be stored
2500 * (mandatory)
2501 * - <resolversSectionName> is the name of the resolvers section to use to perform the resolution
2502 * (mandatory)
2503 * - <resolvePrefer> can be either 'ipv4' or 'ipv6' and is the IP family we would like to resolve first
2504 * (optional), defaults to ipv6
2505 * - <expr> is an HAProxy expression used to fetch the name to be resolved
2506 */
2507enum act_parse_ret dns_parse_do_resolve(const char **args, int *orig_arg, struct proxy *px, struct act_rule *rule, char **err)
2508{
2509 int cur_arg;
2510 struct sample_expr *expr;
2511 unsigned int where;
2512 const char *beg, *end;
2513
2514 /* orig_arg points to the first argument, but we need to analyse the command itself first */
2515 cur_arg = *orig_arg - 1;
2516
2517 /* locate varName, which is mandatory */
2518 beg = strchr(args[cur_arg], '(');
2519 if (beg == NULL)
2520 goto do_resolve_parse_error;
2521 beg = beg + 1; /* beg should points to the first character after opening parenthesis '(' */
2522 end = strchr(beg, ',');
2523 if (end == NULL)
2524 goto do_resolve_parse_error;
2525 rule->arg.dns.varname = my_strndup(beg, end - beg);
2526 if (rule->arg.dns.varname == NULL)
2527 goto do_resolve_parse_error;
2528
2529
2530 /* locate resolversSectionName, which is mandatory.
2531 * Since next parameters are optional, the delimiter may be comma ','
2532 * or closing parenthesis ')'
2533 */
2534 beg = end + 1;
2535 end = strchr(beg, ',');
2536 if (end == NULL)
2537 end = strchr(beg, ')');
2538 if (end == NULL)
2539 goto do_resolve_parse_error;
2540 rule->arg.dns.resolvers_id = my_strndup(beg, end - beg);
2541 if (rule->arg.dns.resolvers_id == NULL)
2542 goto do_resolve_parse_error;
2543
2544
Christopher Fauleta4168432020-01-24 18:08:42 +01002545 rule->arg.dns.dns_opts = calloc(1, sizeof(*rule->arg.dns.dns_opts));
2546 if (rule->arg.dns.dns_opts == NULL)
2547 goto do_resolve_parse_error;
2548
Baptiste Assmann333939c2019-01-21 08:34:50 +01002549 /* Default priority is ipv6 */
Christopher Fauleta4168432020-01-24 18:08:42 +01002550 rule->arg.dns.dns_opts->family_prio = AF_INET6;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002551
2552 /* optional arguments accepted for now:
2553 * ipv4 or ipv6
2554 */
2555 while (*end != ')') {
2556 beg = end + 1;
2557 end = strchr(beg, ',');
2558 if (end == NULL)
2559 end = strchr(beg, ')');
2560 if (end == NULL)
2561 goto do_resolve_parse_error;
2562
2563 if (strncmp(beg, "ipv4", end - beg) == 0) {
Christopher Fauleta4168432020-01-24 18:08:42 +01002564 rule->arg.dns.dns_opts->family_prio = AF_INET;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002565 }
2566 else if (strncmp(beg, "ipv6", end - beg) == 0) {
Christopher Fauleta4168432020-01-24 18:08:42 +01002567 rule->arg.dns.dns_opts->family_prio = AF_INET6;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002568 }
2569 else {
2570 goto do_resolve_parse_error;
2571 }
2572 }
2573
2574 cur_arg = cur_arg + 1;
2575
Willy Tarreaue3b57bf2020-02-14 16:50:14 +01002576 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args, NULL);
Baptiste Assmann333939c2019-01-21 08:34:50 +01002577 if (!expr)
2578 goto do_resolve_parse_error;
2579
2580
2581 where = 0;
2582 if (px->cap & PR_CAP_FE)
2583 where |= SMP_VAL_FE_HRQ_HDR;
2584 if (px->cap & PR_CAP_BE)
2585 where |= SMP_VAL_BE_HRQ_HDR;
2586
2587 if (!(expr->fetch->val & where)) {
2588 memprintf(err,
2589 "fetch method '%s' extracts information from '%s', none of which is available here",
2590 args[cur_arg-1], sample_src_names(expr->fetch->use));
2591 free(expr);
2592 return ACT_RET_PRS_ERR;
2593 }
2594 rule->arg.dns.expr = expr;
2595 rule->action = ACT_CUSTOM;
2596 rule->action_ptr = dns_action_do_resolve;
2597 *orig_arg = cur_arg;
2598
2599 rule->check_ptr = check_action_do_resolve;
Christopher Faulet3b2bb632020-01-24 18:12:58 +01002600 rule->release_ptr = release_dns_action;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002601
2602 return ACT_RET_PRS_OK;
2603
2604 do_resolve_parse_error:
2605 free(rule->arg.dns.varname); rule->arg.dns.varname = NULL;
2606 free(rule->arg.dns.resolvers_id); rule->arg.dns.resolvers_id = NULL;
2607 memprintf(err, "Can't parse '%s'. Expects 'do-resolve(<varname>,<resolvers>[,<options>]) <expr>'. Available options are 'ipv4' and 'ipv6'",
2608 args[cur_arg]);
2609 return ACT_RET_PRS_ERR;
2610}
2611
2612static struct action_kw_list http_req_kws = { { }, {
2613 { "do-resolve", dns_parse_do_resolve, 1 },
2614 { /* END */ }
2615}};
2616
2617INITCALL1(STG_REGISTER, http_req_keywords_register, &http_req_kws);
2618
2619static struct action_kw_list tcp_req_cont_actions = {ILH, {
2620 { "do-resolve", dns_parse_do_resolve, 1 },
2621 { /* END */ }
2622}};
2623
2624INITCALL1(STG_REGISTER, tcp_req_cont_keywords_register, &tcp_req_cont_actions);
2625
2626/* Check an "http-request do-resolve" action.
2627 *
2628 * The function returns 1 in success case, otherwise, it returns 0 and err is
2629 * filled.
2630 */
2631int check_action_do_resolve(struct act_rule *rule, struct proxy *px, char **err)
2632{
2633 struct dns_resolvers *resolvers = NULL;
2634
2635 if (rule->arg.dns.resolvers_id == NULL) {
2636 memprintf(err,"Proxy '%s': %s", px->id, "do-resolve action without resolvers");
2637 return 0;
2638 }
2639
2640 resolvers = find_resolvers_by_id(rule->arg.dns.resolvers_id);
2641 if (resolvers == NULL) {
2642 memprintf(err,"Can't find resolvers section '%s' for do-resolve action", rule->arg.dns.resolvers_id);
2643 return 0;
2644 }
2645 rule->arg.dns.resolvers = resolvers;
2646
2647 return 1;
2648}
2649
Willy Tarreau172f5ce2018-11-26 11:21:50 +01002650REGISTER_POST_DEINIT(dns_deinit);
Willy Tarreaue6552512018-11-26 11:33:13 +01002651REGISTER_CONFIG_POSTPARSER("dns runtime resolver", dns_finalize_config);