blob: c8f34874d00489572194024cea329b62b8628454 [file] [log] [blame]
Baptiste Assmann325137d2015-04-13 23:40:55 +02001/*
2 * Name server resolution
3 *
4 * Copyright 2014 Baptiste Assmann <bedis9@gmail.com>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <errno.h>
14#include <fcntl.h>
15#include <stdio.h>
16#include <stdlib.h>
17#include <string.h>
18#include <unistd.h>
19
20#include <sys/types.h>
21
Willy Tarreau122eba92020-06-04 10:15:32 +020022#include <haproxy/action.h>
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020023#include <haproxy/api.h>
Willy Tarreau6be78492020-06-05 00:00:29 +020024#include <haproxy/cfgparse.h>
Willy Tarreauf1d32c42020-06-04 21:07:02 +020025#include <haproxy/channel.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020026#include <haproxy/check.h>
Willy Tarreau83487a82020-06-04 20:19:54 +020027#include <haproxy/cli.h>
Willy Tarreau7c18b542020-06-11 09:23:02 +020028#include <haproxy/dgram.h>
Willy Tarreaueb92deb2020-06-04 10:53:16 +020029#include <haproxy/dns.h>
Willy Tarreau8d366972020-05-27 16:10:29 +020030#include <haproxy/errors.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020031#include <haproxy/fd.h>
32#include <haproxy/global.h>
Willy Tarreauc761f842020-06-04 11:40:28 +020033#include <haproxy/http_rules.h>
Willy Tarreauaeed4a82020-06-04 22:01:04 +020034#include <haproxy/log.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020035#include <haproxy/net_helper.h>
Willy Tarreaua264d962020-06-04 22:29:18 +020036#include <haproxy/proxy.h>
Willy Tarreaue6ce10b2020-06-04 15:33:47 +020037#include <haproxy/sample.h>
Willy Tarreau1e56f922020-06-04 23:20:13 +020038#include <haproxy/server.h>
Willy Tarreau2eec9b52020-06-04 19:58:55 +020039#include <haproxy/stats-t.h>
Willy Tarreau5e539c92020-06-04 20:45:39 +020040#include <haproxy/stream_interface.h>
Willy Tarreaucea0e1b2020-06-04 17:25:40 +020041#include <haproxy/task.h>
Willy Tarreau8b550af2020-06-04 17:42:48 +020042#include <haproxy/tcp_rules.h>
Willy Tarreauc2f7c582020-06-02 18:15:32 +020043#include <haproxy/ticks.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020044#include <haproxy/time.h>
Willy Tarreaua1718922020-06-04 16:25:31 +020045#include <haproxy/vars.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020046
Baptiste Assmann325137d2015-04-13 23:40:55 +020047
Christopher Faulet67957bd2017-09-27 11:00:59 +020048struct list dns_resolvers = LIST_HEAD_INIT(dns_resolvers);
49struct list dns_srvrq_list = LIST_HEAD_INIT(dns_srvrq_list);
Baptiste Assmann325137d2015-04-13 23:40:55 +020050
Tim Duesterhusfcac33d2020-01-18 02:04:12 +010051static THREAD_LOCAL uint64_t dns_query_id_seed = 0; /* random seed */
Willy Tarreau8ceae722018-11-26 11:58:30 +010052
53DECLARE_STATIC_POOL(dns_answer_item_pool, "dns_answer_item", sizeof(struct dns_answer_item));
54DECLARE_STATIC_POOL(dns_resolution_pool, "dns_resolution", sizeof(struct dns_resolution));
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +010055DECLARE_POOL(dns_requester_pool, "dns_requester", sizeof(struct dns_requester));
Willy Tarreau8ceae722018-11-26 11:58:30 +010056
Christopher Faulet67957bd2017-09-27 11:00:59 +020057static unsigned int resolution_uuid = 1;
Baptiste Assmann333939c2019-01-21 08:34:50 +010058unsigned int dns_failed_resolutions = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020059
Christopher Faulet67957bd2017-09-27 11:00:59 +020060/* Returns a pointer to the resolvers matching the id <id>. NULL is returned if
61 * no match is found.
Baptiste Assmann325137d2015-04-13 23:40:55 +020062 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020063struct dns_resolvers *find_resolvers_by_id(const char *id)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020064{
Christopher Faulet67957bd2017-09-27 11:00:59 +020065 struct dns_resolvers *res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020066
Christopher Faulet67957bd2017-09-27 11:00:59 +020067 list_for_each_entry(res, &dns_resolvers, list) {
68 if (!strcmp(res->id, id))
69 return res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020070 }
Christopher Faulet67957bd2017-09-27 11:00:59 +020071 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020072}
73
Olivier Houchardb17b8842020-04-01 18:30:27 +020074/* Compare hostnames in a case-insensitive way .
75 * Returns 0 if they are the same, non-zero otherwise
76 */
77static __inline int dns_hostname_cmp(const char *name1, const char *name2, int len)
78{
79 int i;
80
81 for (i = 0; i < len; i++)
Willy Tarreauf278eec2020-07-05 21:46:32 +020082 if (tolower((unsigned char)name1[i]) != tolower((unsigned char)name2[i]))
Olivier Houchardb17b8842020-04-01 18:30:27 +020083 return -1;
84 return 0;
85}
86
Christopher Faulet67957bd2017-09-27 11:00:59 +020087/* Returns a pointer on the SRV request matching the name <name> for the proxy
88 * <px>. NULL is returned if no match is found.
Baptiste Assmann201c07f2017-05-22 15:17:15 +020089 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020090struct dns_srvrq *find_srvrq_by_name(const char *name, struct proxy *px)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020091{
Christopher Faulet67957bd2017-09-27 11:00:59 +020092 struct dns_srvrq *srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020093
Christopher Faulet67957bd2017-09-27 11:00:59 +020094 list_for_each_entry(srvrq, &dns_srvrq_list, list) {
95 if (srvrq->proxy == px && !strcmp(srvrq->name, name))
96 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020097 }
Christopher Faulet67957bd2017-09-27 11:00:59 +020098 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020099}
100
Christopher Faulet67957bd2017-09-27 11:00:59 +0200101/* Allocates a new SRVRQ for the given server with the name <fqdn>. It returns
102 * NULL if an error occurred. */
103struct dns_srvrq *new_dns_srvrq(struct server *srv, char *fqdn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200104{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200105 struct proxy *px = srv->proxy;
106 struct dns_srvrq *srvrq = NULL;
107 int fqdn_len, hostname_dn_len;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200108
Christopher Faulet67957bd2017-09-27 11:00:59 +0200109 fqdn_len = strlen(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200110 hostname_dn_len = dns_str_to_dn_label(fqdn, fqdn_len + 1, trash.area,
111 trash.size);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200112 if (hostname_dn_len == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100113 ha_alert("config : %s '%s', server '%s': failed to parse FQDN '%s'\n",
114 proxy_type_str(px), px->id, srv->id, fqdn);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200115 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200116 }
117
Christopher Faulet67957bd2017-09-27 11:00:59 +0200118 if ((srvrq = calloc(1, sizeof(*srvrq))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100119 ha_alert("config : %s '%s', server '%s': out of memory\n",
120 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200121 goto err;
122 }
123 srvrq->obj_type = OBJ_TYPE_SRVRQ;
124 srvrq->proxy = px;
125 srvrq->name = strdup(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200126 srvrq->hostname_dn = strdup(trash.area);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200127 srvrq->hostname_dn_len = hostname_dn_len;
128 if (!srvrq->name || !srvrq->hostname_dn) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100129 ha_alert("config : %s '%s', server '%s': out of memory\n",
130 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200131 goto err;
132 }
133 LIST_ADDQ(&dns_srvrq_list, &srvrq->list);
134 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200135
Christopher Faulet67957bd2017-09-27 11:00:59 +0200136 err:
137 if (srvrq) {
138 free(srvrq->name);
139 free(srvrq->hostname_dn);
140 free(srvrq);
141 }
142 return NULL;
143}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200144
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200145
Christopher Faulet67957bd2017-09-27 11:00:59 +0200146/* 2 bytes random generator to generate DNS query ID */
147static inline uint16_t dns_rnd16(void)
148{
Christopher Fauletb2812a62017-10-04 16:17:58 +0200149 if (!dns_query_id_seed)
150 dns_query_id_seed = now_ms;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200151 dns_query_id_seed ^= dns_query_id_seed << 13;
152 dns_query_id_seed ^= dns_query_id_seed >> 7;
153 dns_query_id_seed ^= dns_query_id_seed << 17;
154 return dns_query_id_seed;
155}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200156
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200157
Christopher Faulet67957bd2017-09-27 11:00:59 +0200158static inline int dns_resolution_timeout(struct dns_resolution *res)
159{
Baptiste Assmannf50e1ac2019-11-07 11:02:18 +0100160 return res->resolvers->timeout.resolve;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200161}
162
Christopher Faulet67957bd2017-09-27 11:00:59 +0200163/* Updates a resolvers' task timeout for next wake up and queue it */
164static void dns_update_resolvers_timeout(struct dns_resolvers *resolvers)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200165{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200166 struct dns_resolution *res;
167 int next;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200168
Christopher Faulet67957bd2017-09-27 11:00:59 +0200169 next = tick_add(now_ms, resolvers->timeout.resolve);
170 if (!LIST_ISEMPTY(&resolvers->resolutions.curr)) {
171 res = LIST_NEXT(&resolvers->resolutions.curr, struct dns_resolution *, list);
172 next = MIN(next, tick_add(res->last_query, resolvers->timeout.retry));
173 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200174
Christopher Faulet67957bd2017-09-27 11:00:59 +0200175 list_for_each_entry(res, &resolvers->resolutions.wait, list)
176 next = MIN(next, tick_add(res->last_resolution, dns_resolution_timeout(res)));
Baptiste Assmann325137d2015-04-13 23:40:55 +0200177
Christopher Faulet67957bd2017-09-27 11:00:59 +0200178 resolvers->t->expire = next;
179 task_queue(resolvers->t);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200180}
181
Christopher Faulet67957bd2017-09-27 11:00:59 +0200182/* Opens an UDP socket on the namesaver's IP/Port, if required. Returns 0 on
183 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200184 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200185static int dns_connect_namesaver(struct dns_nameserver *ns)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200186{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200187 struct dgram_conn *dgram = ns->dgram;
188 int fd;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200189
Christopher Faulet67957bd2017-09-27 11:00:59 +0200190 /* Already connected */
191 if (dgram->t.sock.fd != -1)
192 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200193
Christopher Faulet67957bd2017-09-27 11:00:59 +0200194 /* Create an UDP socket and connect it on the nameserver's IP/Port */
195 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
196 send_log(NULL, LOG_WARNING,
197 "DNS : resolvers '%s': can't create socket for nameserver '%s'.\n",
198 ns->resolvers->id, ns->id);
199 return -1;
200 }
201 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
202 send_log(NULL, LOG_WARNING,
203 "DNS : resolvers '%s': can't connect socket for nameserver '%s'.\n",
204 ns->resolvers->id, ns->id);
205 close(fd);
206 return -1;
207 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200208
Christopher Faulet67957bd2017-09-27 11:00:59 +0200209 /* Make the socket non blocking */
210 fcntl(fd, F_SETFL, O_NONBLOCK);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200211
Christopher Faulet67957bd2017-09-27 11:00:59 +0200212 /* Add the fd in the fd list and update its parameters */
213 dgram->t.sock.fd = fd;
Willy Tarreaua9786b62018-01-25 07:22:13 +0100214 fd_insert(fd, dgram, dgram_fd_handler, MAX_THREADS_MASK);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200215 fd_want_recv(fd);
216 return 0;
217}
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200218
Christopher Faulet67957bd2017-09-27 11:00:59 +0200219/* Forges a DNS query. It needs the following information from the caller:
220 * - <query_id> : the DNS query id corresponding to this query
221 * - <query_type> : DNS_RTYPE_* request DNS record type (A, AAAA, ANY...)
222 * - <hostname_dn> : hostname in domain name format
223 * - <hostname_dn_len> : length of <hostname_dn>
224 *
225 * To store the query, the caller must pass a buffer <buf> and its size
226 * <bufsize>. It returns the number of written bytes in success, -1 if <buf> is
227 * too short.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200228 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200229static int dns_build_query(int query_id, int query_type, unsigned int accepted_payload_size,
230 char *hostname_dn, int hostname_dn_len, char *buf, int bufsize)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200231{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200232 struct dns_header dns_hdr;
233 struct dns_question qinfo;
234 struct dns_additional_record edns;
235 char *p = buf;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200236
Christopher Faulet67957bd2017-09-27 11:00:59 +0200237 if (sizeof(dns_hdr) + sizeof(qinfo) + sizeof(edns) + hostname_dn_len >= bufsize)
238 return -1;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200239
Christopher Faulet67957bd2017-09-27 11:00:59 +0200240 memset(buf, 0, bufsize);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200241
Christopher Faulet67957bd2017-09-27 11:00:59 +0200242 /* Set dns query headers */
243 dns_hdr.id = (unsigned short) htons(query_id);
244 dns_hdr.flags = htons(0x0100); /* qr=0, opcode=0, aa=0, tc=0, rd=1, ra=0, z=0, rcode=0 */
245 dns_hdr.qdcount = htons(1); /* 1 question */
246 dns_hdr.ancount = 0;
247 dns_hdr.nscount = 0;
248 dns_hdr.arcount = htons(1);
249 memcpy(p, &dns_hdr, sizeof(dns_hdr));
250 p += sizeof(dns_hdr);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200251
Christopher Faulet67957bd2017-09-27 11:00:59 +0200252 /* Set up query hostname */
253 memcpy(p, hostname_dn, hostname_dn_len);
254 p += hostname_dn_len;
255 *p++ = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200256
Christopher Faulet67957bd2017-09-27 11:00:59 +0200257 /* Set up query info (type and class) */
258 qinfo.qtype = htons(query_type);
259 qinfo.qclass = htons(DNS_RCLASS_IN);
260 memcpy(p, &qinfo, sizeof(qinfo));
261 p += sizeof(qinfo);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200262
Christopher Faulet67957bd2017-09-27 11:00:59 +0200263 /* Set the DNS extension */
264 edns.name = 0;
265 edns.type = htons(DNS_RTYPE_OPT);
266 edns.udp_payload_size = htons(accepted_payload_size);
267 edns.extension = 0;
268 edns.data_length = 0;
269 memcpy(p, &edns, sizeof(edns));
270 p += sizeof(edns);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200271
Christopher Faulet67957bd2017-09-27 11:00:59 +0200272 return (p - buf);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200273}
274
Christopher Faulet67957bd2017-09-27 11:00:59 +0200275/* Sends a DNS query to resolvers associated to a resolution. It returns 0 on
276 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200277 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200278static int dns_send_query(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200279{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200280 struct dns_resolvers *resolvers = resolution->resolvers;
281 struct dns_nameserver *ns;
Willy Tarreau0eae6322019-12-20 11:18:54 +0100282 int len;
283
284 /* Update resolution */
285 resolution->nb_queries = 0;
286 resolution->nb_responses = 0;
287 resolution->last_query = now_ms;
288
289 len = dns_build_query(resolution->query_id, resolution->query_type,
290 resolvers->accepted_payload_size,
291 resolution->hostname_dn, resolution->hostname_dn_len,
292 trash.area, trash.size);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200293
Christopher Faulet67957bd2017-09-27 11:00:59 +0200294 list_for_each_entry(ns, &resolvers->nameservers, list) {
295 int fd = ns->dgram->t.sock.fd;
Willy Tarreau0eae6322019-12-20 11:18:54 +0100296 int ret;
297
Christopher Faulet67957bd2017-09-27 11:00:59 +0200298 if (fd == -1) {
299 if (dns_connect_namesaver(ns) == -1)
300 continue;
301 fd = ns->dgram->t.sock.fd;
302 resolvers->nb_nameservers++;
303 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200304
Willy Tarreau0eae6322019-12-20 11:18:54 +0100305 if (len < 0)
306 goto snd_error;
307
308 ret = send(fd, trash.area, len, 0);
309 if (ret == len) {
310 ns->counters.sent++;
311 resolution->nb_queries++;
312 continue;
313 }
314
315 if (ret == -1 && errno == EAGAIN) {
316 /* retry once the socket is ready */
317 fd_cant_send(fd);
318 continue;
319 }
320
321 snd_error:
322 ns->counters.snd_error++;
323 resolution->nb_queries++;
324 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200325
Christopher Faulet67957bd2017-09-27 11:00:59 +0200326 /* Push the resolution at the end of the active list */
327 LIST_DEL(&resolution->list);
328 LIST_ADDQ(&resolvers->resolutions.curr, &resolution->list);
329 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200330}
331
Christopher Faulet67957bd2017-09-27 11:00:59 +0200332/* Prepares and sends a DNS resolution. It returns 1 if the query was sent, 0 if
333 * skipped and -1 if an error occurred.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200334 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200335static int
336dns_run_resolution(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200337{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200338 struct dns_resolvers *resolvers = resolution->resolvers;
339 int query_id, i;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200340
Christopher Faulet67957bd2017-09-27 11:00:59 +0200341 /* Avoid sending requests for resolutions that don't yet have an
342 * hostname, ie resolutions linked to servers that do not yet have an
343 * fqdn */
344 if (!resolution->hostname_dn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200345 return 0;
346
Christopher Faulet67957bd2017-09-27 11:00:59 +0200347 /* Check if a resolution has already been started for this server return
348 * directly to avoid resolution pill up. */
349 if (resolution->step != RSLV_STEP_NONE)
350 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200351
Christopher Faulet67957bd2017-09-27 11:00:59 +0200352 /* Generates a new query id. We try at most 100 times to find a free
353 * query id */
354 for (i = 0; i < 100; ++i) {
355 query_id = dns_rnd16();
356 if (!eb32_lookup(&resolvers->query_ids, query_id))
Olivier Houchard8da5f982017-08-04 18:35:36 +0200357 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200358 query_id = -1;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200359 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200360 if (query_id == -1) {
361 send_log(NULL, LOG_NOTICE,
362 "could not generate a query id for %s, in resolvers %s.\n",
363 resolution->hostname_dn, resolvers->id);
364 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200365 }
366
Christopher Faulet67957bd2017-09-27 11:00:59 +0200367 /* Update resolution parameters */
368 resolution->query_id = query_id;
369 resolution->qid.key = query_id;
370 resolution->step = RSLV_STEP_RUNNING;
371 resolution->query_type = resolution->prefered_query_type;
372 resolution->try = resolvers->resolve_retries;
373 eb32_insert(&resolvers->query_ids, &resolution->qid);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200374
Christopher Faulet67957bd2017-09-27 11:00:59 +0200375 /* Send the DNS query */
376 resolution->try -= 1;
377 dns_send_query(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200378 return 1;
379}
380
Christopher Faulet67957bd2017-09-27 11:00:59 +0200381/* Performs a name resolution for the requester <req> */
382void dns_trigger_resolution(struct dns_requester *req)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200383{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200384 struct dns_resolvers *resolvers;
385 struct dns_resolution *res;
386 int exp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200387
Christopher Faulet67957bd2017-09-27 11:00:59 +0200388 if (!req || !req->resolution)
389 return;
390 res = req->resolution;
391 resolvers = res->resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200392
Christopher Faulet67957bd2017-09-27 11:00:59 +0200393 /* The resolution must not be triggered yet. Use the cached response, if
394 * valid */
395 exp = tick_add(res->last_resolution, resolvers->hold.valid);
Olivier Houchardf3d9e602018-05-22 18:40:07 +0200396 if (resolvers->t && (res->status != RSLV_STATUS_VALID ||
397 !tick_isset(res->last_resolution) || tick_is_expired(exp, now_ms)))
398 task_wakeup(resolvers->t, TASK_WOKEN_OTHER);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200399}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200400
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200401
Christopher Faulet67957bd2017-09-27 11:00:59 +0200402/* Resets some resolution parameters to initial values and also delete the query
403 * ID from the resolver's tree.
404 */
405static void dns_reset_resolution(struct dns_resolution *resolution)
406{
407 /* update resolution status */
408 resolution->step = RSLV_STEP_NONE;
409 resolution->try = 0;
410 resolution->last_resolution = now_ms;
411 resolution->nb_queries = 0;
412 resolution->nb_responses = 0;
413 resolution->query_type = resolution->prefered_query_type;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200414
Christopher Faulet67957bd2017-09-27 11:00:59 +0200415 /* clean up query id */
416 eb32_delete(&resolution->qid);
417 resolution->query_id = 0;
418 resolution->qid.key = 0;
419}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200420
Christopher Faulet67957bd2017-09-27 11:00:59 +0200421/* Returns the query id contained in a DNS response */
422static inline unsigned short dns_response_get_query_id(unsigned char *resp)
423{
424 return resp[0] * 256 + resp[1];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200425}
426
Christopher Faulet67957bd2017-09-27 11:00:59 +0200427
428/* Analyses, re-builds and copies the name <name> from the DNS response packet
429 * <buffer>. <name> must point to the 'data_len' information or pointer 'c0'
430 * for compressed data. The result is copied into <dest>, ensuring we don't
431 * overflow using <dest_len> Returns the number of bytes the caller can move
432 * forward. If 0 it means an error occurred while parsing the name. <offset> is
433 * the number of bytes the caller could move forward.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200434 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200435int dns_read_name(unsigned char *buffer, unsigned char *bufend,
436 unsigned char *name, char *destination, int dest_len,
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100437 int *offset, unsigned int depth)
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200438{
439 int nb_bytes = 0, n = 0;
440 int label_len;
441 unsigned char *reader = name;
442 char *dest = destination;
443
444 while (1) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100445 if (reader >= bufend)
446 goto err;
447
Christopher Faulet67957bd2017-09-27 11:00:59 +0200448 /* Name compression is in use */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200449 if ((*reader & 0xc0) == 0xc0) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100450 if (reader + 1 >= bufend)
451 goto err;
452
Christopher Faulet67957bd2017-09-27 11:00:59 +0200453 /* Must point BEFORE current position */
454 if ((buffer + reader[1]) > reader)
455 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200456
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100457 if (depth++ > 100)
458 goto err;
459
Nikhil Agrawal2fa66c32018-12-20 10:50:59 +0530460 n = dns_read_name(buffer, bufend, buffer + (*reader & 0x3f)*256 + reader[1],
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100461 dest, dest_len - nb_bytes, offset, depth);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200462 if (n == 0)
Christopher Faulet67957bd2017-09-27 11:00:59 +0200463 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200464
Christopher Faulet67957bd2017-09-27 11:00:59 +0200465 dest += n;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200466 nb_bytes += n;
467 goto out;
468 }
469
470 label_len = *reader;
471 if (label_len == 0)
472 goto out;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200473
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200474 /* Check if:
475 * - we won't read outside the buffer
476 * - there is enough place in the destination
477 */
478 if ((reader + label_len >= bufend) || (nb_bytes + label_len >= dest_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +0200479 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200480
481 /* +1 to take label len + label string */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200482 label_len++;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200483
484 memcpy(dest, reader, label_len);
485
Christopher Faulet67957bd2017-09-27 11:00:59 +0200486 dest += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200487 nb_bytes += label_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200488 reader += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200489 }
490
Christopher Faulet67957bd2017-09-27 11:00:59 +0200491 out:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200492 /* offset computation:
493 * parse from <name> until finding either NULL or a pointer "c0xx"
494 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200495 reader = name;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200496 *offset = 0;
497 while (reader < bufend) {
498 if ((reader[0] & 0xc0) == 0xc0) {
499 *offset += 2;
500 break;
501 }
502 else if (*reader == 0) {
503 *offset += 1;
504 break;
505 }
506 *offset += 1;
507 ++reader;
508 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200509 return nb_bytes;
510
Christopher Faulet67957bd2017-09-27 11:00:59 +0200511 err:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200512 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200513}
514
Christopher Faulet67957bd2017-09-27 11:00:59 +0200515/* Checks for any obsolete record, also identify any SRV request, and try to
516 * find a corresponding server.
517*/
518static void dns_check_dns_response(struct dns_resolution *res)
519{
520 struct dns_resolvers *resolvers = res->resolvers;
521 struct dns_requester *req, *reqback;
522 struct dns_answer_item *item, *itemback;
523 struct server *srv;
524 struct dns_srvrq *srvrq;
525
Baptiste Assmann13a92322019-06-07 09:40:55 +0200526 /* clean up obsolete Additional records */
527 list_for_each_entry_safe(item, itemback, &res->response.ar_list, list) {
528 if ((item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
529 LIST_DEL(&item->list);
530 pool_free(dns_answer_item_pool, item);
531 }
532 }
533
Christopher Faulet67957bd2017-09-27 11:00:59 +0200534 list_for_each_entry_safe(item, itemback, &res->response.answer_list, list) {
535
536 /* Remove obsolete items */
537 if ((item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
538 if (item->type != DNS_RTYPE_SRV)
539 goto rm_obselete_item;
540
541 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
542 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
543 continue;
544
545 /* Remove any associated server */
546 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100547 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200548 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
549 item->data_len == srv->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +0200550 !dns_hostname_cmp(srv->hostname_dn, item->target, item->data_len)) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200551 snr_update_srv_status(srv, 1);
552 free(srv->hostname);
553 free(srv->hostname_dn);
554 srv->hostname = NULL;
555 srv->hostname_dn = NULL;
556 srv->hostname_dn_len = 0;
557 dns_unlink_resolution(srv->dns_requester);
558 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100559 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200560 }
561 }
562
563 rm_obselete_item:
564 LIST_DEL(&item->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +0100565 pool_free(dns_answer_item_pool, item);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200566 continue;
567 }
568
569 if (item->type != DNS_RTYPE_SRV)
570 continue;
571
572 /* Now process SRV records */
573 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
574 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
575 continue;
576
577 /* Check if a server already uses that hostname */
578 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100579 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200580 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
581 item->data_len == srv->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +0200582 !dns_hostname_cmp(srv->hostname_dn, item->target, item->data_len) &&
Daniel Corbettf8716912019-11-17 09:48:56 -0500583 !srv->dns_opts.ignore_weight) {
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100584 int ha_weight;
585
Baptiste Assmann25e6fc22019-10-21 15:13:48 +0200586 /* DNS weight range if from 0 to 65535
587 * HAProxy weight is from 0 to 256
588 * The rule below ensures that weight 0 is well respected
589 * while allowing a "mapping" from DNS weight into HAProxy's one.
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100590 */
Baptiste Assmann25e6fc22019-10-21 15:13:48 +0200591 ha_weight = (item->weight + 255) / 256;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100592 if (srv->uweight != ha_weight) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200593 char weight[9];
594
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100595 snprintf(weight, sizeof(weight), "%d", ha_weight);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200596 server_parse_weight_change_request(srv, weight);
597 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100598 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200599 break;
600 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100601 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200602 }
603 if (srv)
604 continue;
605
606 /* If not, try to find a server with undefined hostname */
607 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100608 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200609 if (srv->srvrq == srvrq && !srv->hostname_dn)
610 break;
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100611 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200612 }
613 /* And update this server, if found */
614 if (srv) {
615 const char *msg = NULL;
616 char weight[9];
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100617 int ha_weight;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200618 char hostname[DNS_MAX_NAME_SIZE];
619
620 if (dns_dn_label_to_str(item->target, item->data_len+1,
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100621 hostname, DNS_MAX_NAME_SIZE) == -1) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100622 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200623 continue;
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100624 }
Baptiste Assmann13a92322019-06-07 09:40:55 +0200625
626 /* Check if an Additional Record is associated to this SRV record.
627 * Perform some sanity checks too to ensure the record can be used.
628 * If all fine, we simply pick up the IP address found and associate
629 * it to the server.
630 */
631 if ((item->ar_item != NULL) &&
632 (item->ar_item->type == DNS_RTYPE_A || item->ar_item->type == DNS_RTYPE_AAAA))
633 {
634
635 switch (item->ar_item->type) {
636 case DNS_RTYPE_A:
637 update_server_addr(srv, &(((struct sockaddr_in*)&item->ar_item->address)->sin_addr), AF_INET, "DNS additional recrd");
638 break;
639 case DNS_RTYPE_AAAA:
640 update_server_addr(srv, &(((struct sockaddr_in6*)&item->ar_item->address)->sin6_addr), AF_INET6, "DNS additional recrd");
641 break;
642 }
643
644 srv->flags |= SRV_F_NO_RESOLUTION;
645 }
646
Olivier Houchardd16bfe62017-10-31 15:21:19 +0100647 msg = update_server_fqdn(srv, hostname, "SRV record", 1);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200648 if (msg)
649 send_log(srv->proxy, LOG_NOTICE, "%s", msg);
650
651 srv->svc_port = item->port;
652 srv->flags &= ~SRV_F_MAPPORTS;
653 if ((srv->check.state & CHK_ST_CONFIGURED) &&
654 !(srv->flags & SRV_F_CHECKPORT))
655 srv->check.port = item->port;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100656
Daniel Corbettf8716912019-11-17 09:48:56 -0500657 if (!srv->dns_opts.ignore_weight) {
658 /* DNS weight range if from 0 to 65535
659 * HAProxy weight is from 0 to 256
660 * The rule below ensures that weight 0 is well respected
661 * while allowing a "mapping" from DNS weight into HAProxy's one.
662 */
663 ha_weight = (item->weight + 255) / 256;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100664
Daniel Corbettf8716912019-11-17 09:48:56 -0500665 snprintf(weight, sizeof(weight), "%d", ha_weight);
666 server_parse_weight_change_request(srv, weight);
667 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100668 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200669 }
670 }
671 }
672}
673
674/* Validates that the buffer DNS response provided in <resp> and finishing
675 * before <bufend> is valid from a DNS protocol point of view.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200676 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200677 * The result is stored in <resolution>' response, buf_response,
678 * response_query_records and response_answer_records members.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200679 *
680 * This function returns one of the DNS_RESP_* code to indicate the type of
681 * error found.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200682 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200683static int dns_validate_dns_response(unsigned char *resp, unsigned char *bufend,
684 struct dns_resolution *resolution, int max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200685{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200686 unsigned char *reader;
687 char *previous_dname, tmpname[DNS_MAX_NAME_SIZE];
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200688 int len, flags, offset;
689 int dns_query_record_id;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200690 int nb_saved_records;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200691 struct dns_query_item *dns_query;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200692 struct dns_answer_item *dns_answer_record, *tmp_record;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200693 struct dns_response_packet *dns_p;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200694 int i, found = 0;
Willy Tarreau963f7012020-07-22 17:00:45 +0200695 int cause = DNS_RESP_ERROR;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200696
Christopher Faulet67957bd2017-09-27 11:00:59 +0200697 reader = resp;
698 len = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200699 previous_dname = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200700 dns_query = NULL;
Willy Tarreau963f7012020-07-22 17:00:45 +0200701 dns_answer_record = NULL;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200702
Christopher Faulet67957bd2017-09-27 11:00:59 +0200703 /* Initialization of response buffer and structure */
Baptiste Assmann729c9012017-05-22 15:13:10 +0200704 dns_p = &resolution->response;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200705
706 /* query id */
707 if (reader + 2 >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200708 goto invalid_resp;
709
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200710 dns_p->header.id = reader[0] * 256 + reader[1];
711 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200712
Christopher Faulet67957bd2017-09-27 11:00:59 +0200713 /* Flags and rcode are stored over 2 bytes
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200714 * First byte contains:
715 * - response flag (1 bit)
716 * - opcode (4 bits)
717 * - authoritative (1 bit)
718 * - truncated (1 bit)
719 * - recursion desired (1 bit)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200720 */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200721 if (reader + 2 >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200722 goto invalid_resp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200723
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200724 flags = reader[0] * 256 + reader[1];
725
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200726 if ((flags & DNS_FLAG_REPLYCODE) != DNS_RCODE_NO_ERROR) {
Willy Tarreau963f7012020-07-22 17:00:45 +0200727 if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_NX_DOMAIN) {
728 cause = DNS_RESP_NX_DOMAIN;
729 goto return_error;
730 }
731 else if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_REFUSED) {
732 cause = DNS_RESP_REFUSED;
733 goto return_error;
734 }
735 else {
736 cause = DNS_RESP_ERROR;
737 goto return_error;
738 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200739 }
740
Christopher Faulet67957bd2017-09-27 11:00:59 +0200741 /* Move forward 2 bytes for flags */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200742 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200743
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200744 /* 2 bytes for question count */
745 if (reader + 2 >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200746 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200747 dns_p->header.qdcount = reader[0] * 256 + reader[1];
Christopher Faulet67957bd2017-09-27 11:00:59 +0200748 /* (for now) we send one query only, so we expect only one in the
749 * response too */
Willy Tarreau963f7012020-07-22 17:00:45 +0200750 if (dns_p->header.qdcount != 1) {
751 cause = DNS_RESP_QUERY_COUNT_ERROR;
752 goto return_error;
753 }
754
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200755 if (dns_p->header.qdcount > DNS_MAX_QUERY_RECORDS)
Willy Tarreau963f7012020-07-22 17:00:45 +0200756 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200757 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200758
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200759 /* 2 bytes for answer count */
760 if (reader + 2 >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200761 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200762 dns_p->header.ancount = reader[0] * 256 + reader[1];
Willy Tarreau963f7012020-07-22 17:00:45 +0200763 if (dns_p->header.ancount == 0) {
764 cause = DNS_RESP_ANCOUNT_ZERO;
765 goto return_error;
766 }
767
Christopher Faulet67957bd2017-09-27 11:00:59 +0200768 /* Check if too many records are announced */
Baptiste Assmann9d8dbbc2017-08-18 23:35:08 +0200769 if (dns_p->header.ancount > max_answer_records)
Willy Tarreau963f7012020-07-22 17:00:45 +0200770 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200771 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200772
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200773 /* 2 bytes authority count */
774 if (reader + 2 >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200775 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200776 dns_p->header.nscount = reader[0] * 256 + reader[1];
777 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200778
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200779 /* 2 bytes additional count */
780 if (reader + 2 >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200781 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200782 dns_p->header.arcount = reader[0] * 256 + reader[1];
783 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200784
Christopher Faulet67957bd2017-09-27 11:00:59 +0200785 /* Parsing dns queries */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200786 LIST_INIT(&dns_p->query_list);
787 for (dns_query_record_id = 0; dns_query_record_id < dns_p->header.qdcount; dns_query_record_id++) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200788 /* Use next pre-allocated dns_query_item after ensuring there is
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200789 * still one available.
Christopher Faulet67957bd2017-09-27 11:00:59 +0200790 * It's then added to our packet query list. */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200791 if (dns_query_record_id > DNS_MAX_QUERY_RECORDS)
Willy Tarreau963f7012020-07-22 17:00:45 +0200792 goto invalid_resp;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200793 dns_query = &resolution->response_query_records[dns_query_record_id];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200794 LIST_ADDQ(&dns_p->query_list, &dns_query->list);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200795
Christopher Faulet67957bd2017-09-27 11:00:59 +0200796 /* Name is a NULL terminated string in our case, since we have
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200797 * one query per response and the first one can't be compressed
Christopher Faulet67957bd2017-09-27 11:00:59 +0200798 * (using the 0x0c format) */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200799 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100800 len = dns_read_name(resp, bufend, reader, dns_query->name, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200801
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200802 if (len == 0)
Willy Tarreau963f7012020-07-22 17:00:45 +0200803 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200804
805 reader += offset;
806 previous_dname = dns_query->name;
807
808 /* move forward 2 bytes for question type */
809 if (reader + 2 >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200810 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200811 dns_query->type = reader[0] * 256 + reader[1];
812 reader += 2;
813
814 /* move forward 2 bytes for question class */
815 if (reader + 2 >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200816 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200817 dns_query->class = reader[0] * 256 + reader[1];
818 reader += 2;
819 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200820
Baptiste Assmann251abb92017-08-11 09:58:27 +0200821 /* TRUNCATED flag must be checked after we could read the query type
Christopher Faulet67957bd2017-09-27 11:00:59 +0200822 * because a TRUNCATED SRV query type response can still be exploited */
Willy Tarreau963f7012020-07-22 17:00:45 +0200823 if (dns_query->type != DNS_RTYPE_SRV && flags & DNS_FLAG_TRUNCATED) {
824 cause = DNS_RESP_TRUNCATED;
825 goto return_error;
826 }
Baptiste Assmann251abb92017-08-11 09:58:27 +0200827
Baptiste Assmann325137d2015-04-13 23:40:55 +0200828 /* now parsing response records */
Baptiste Assmann69fce672017-05-04 08:37:45 +0200829 nb_saved_records = 0;
Olivier Houchard8da5f982017-08-04 18:35:36 +0200830 for (i = 0; i < dns_p->header.ancount; i++) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200831 if (reader >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +0200832 goto invalid_resp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200833
Willy Tarreaubafbe012017-11-24 17:34:44 +0100834 dns_answer_record = pool_alloc(dns_answer_item_pool);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200835 if (dns_answer_record == NULL)
Willy Tarreau963f7012020-07-22 17:00:45 +0200836 goto invalid_resp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200837
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200838 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100839 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200840
Willy Tarreau963f7012020-07-22 17:00:45 +0200841 if (len == 0)
842 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200843
Christopher Faulet67957bd2017-09-27 11:00:59 +0200844 /* Check if the current record dname is valid. previous_dname
845 * points either to queried dname or last CNAME target */
Olivier Houchardb17b8842020-04-01 18:30:27 +0200846 if (dns_query->type != DNS_RTYPE_SRV && dns_hostname_cmp(previous_dname, tmpname, len) != 0) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200847 if (i == 0) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200848 /* First record, means a mismatch issue between
849 * queried dname and dname found in the first
850 * record */
Willy Tarreau963f7012020-07-22 17:00:45 +0200851 goto invalid_resp;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200852 }
853 else {
854 /* If not the first record, this means we have a
Willy Tarreau963f7012020-07-22 17:00:45 +0200855 * CNAME resolution error.
856 */
857 cause = DNS_RESP_CNAME_ERROR;
858 goto return_error;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200859 }
860
Baptiste Assmann325137d2015-04-13 23:40:55 +0200861 }
862
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200863 memcpy(dns_answer_record->name, tmpname, len);
864 dns_answer_record->name[len] = 0;
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200865
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200866 reader += offset;
Willy Tarreau963f7012020-07-22 17:00:45 +0200867 if (reader >= bufend)
868 goto invalid_resp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200869
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200870 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
Willy Tarreau963f7012020-07-22 17:00:45 +0200871 if (reader + 2 > bufend)
872 goto invalid_resp;
873
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200874 dns_answer_record->type = reader[0] * 256 + reader[1];
875 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200876
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200877 /* 2 bytes for class (2) */
Willy Tarreau963f7012020-07-22 17:00:45 +0200878 if (reader + 2 > bufend)
879 goto invalid_resp;
880
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200881 dns_answer_record->class = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200882 reader += 2;
883
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200884 /* 4 bytes for ttl (4) */
Willy Tarreau963f7012020-07-22 17:00:45 +0200885 if (reader + 4 > bufend)
886 goto invalid_resp;
887
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200888 dns_answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
889 + reader[2] * 256 + reader[3];
890 reader += 4;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200891
Christopher Faulet67957bd2017-09-27 11:00:59 +0200892 /* Now reading data len */
Willy Tarreau963f7012020-07-22 17:00:45 +0200893 if (reader + 2 > bufend)
894 goto invalid_resp;
895
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200896 dns_answer_record->data_len = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200897
Christopher Faulet67957bd2017-09-27 11:00:59 +0200898 /* Move forward 2 bytes for data len */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200899 reader += 2;
900
Willy Tarreau963f7012020-07-22 17:00:45 +0200901 if (reader + dns_answer_record->data_len > bufend)
902 goto invalid_resp;
Remi Gacogneefbbdf72018-12-05 17:56:29 +0100903
Christopher Faulet67957bd2017-09-27 11:00:59 +0200904 /* Analyzing record content */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200905 switch (dns_answer_record->type) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200906 case DNS_RTYPE_A:
907 /* ipv4 is stored on 4 bytes */
Willy Tarreau963f7012020-07-22 17:00:45 +0200908 if (dns_answer_record->data_len != 4)
909 goto invalid_resp;
910
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200911 dns_answer_record->address.sa_family = AF_INET;
912 memcpy(&(((struct sockaddr_in *)&dns_answer_record->address)->sin_addr),
913 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200914 break;
915
916 case DNS_RTYPE_CNAME:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200917 /* Check if this is the last record and update the caller about the status:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200918 * no IP could be found and last record was a CNAME. Could be triggered
919 * by a wrong query type
920 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200921 * + 1 because dns_answer_record_id starts at 0
922 * while number of answers is an integer and
923 * starts at 1.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200924 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200925 if (i + 1 == dns_p->header.ancount) {
Willy Tarreau963f7012020-07-22 17:00:45 +0200926 cause = DNS_RESP_CNAME_ERROR;
927 goto return_error;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200928 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200929
930 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100931 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Willy Tarreau963f7012020-07-22 17:00:45 +0200932 if (len == 0)
933 goto invalid_resp;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200934
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200935 memcpy(dns_answer_record->target, tmpname, len);
936 dns_answer_record->target[len] = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200937 previous_dname = dns_answer_record->target;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200938 break;
939
Olivier Houchard8da5f982017-08-04 18:35:36 +0200940
941 case DNS_RTYPE_SRV:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200942 /* Answer must contain :
Olivier Houchard8da5f982017-08-04 18:35:36 +0200943 * - 2 bytes for the priority
944 * - 2 bytes for the weight
945 * - 2 bytes for the port
946 * - the target hostname
947 */
Willy Tarreau963f7012020-07-22 17:00:45 +0200948 if (dns_answer_record->data_len <= 6)
949 goto invalid_resp;
950
Willy Tarreaud5370e12017-09-19 14:59:52 +0200951 dns_answer_record->priority = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200952 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200953 dns_answer_record->weight = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200954 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200955 dns_answer_record->port = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200956 reader += sizeof(uint16_t);
957 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100958 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Willy Tarreau963f7012020-07-22 17:00:45 +0200959 if (len == 0)
960 goto invalid_resp;
961
Olivier Houchard8da5f982017-08-04 18:35:36 +0200962 dns_answer_record->data_len = len;
963 memcpy(dns_answer_record->target, tmpname, len);
964 dns_answer_record->target[len] = 0;
965 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200966
Baptiste Assmann325137d2015-04-13 23:40:55 +0200967 case DNS_RTYPE_AAAA:
968 /* ipv6 is stored on 16 bytes */
Willy Tarreau963f7012020-07-22 17:00:45 +0200969 if (dns_answer_record->data_len != 16)
970 goto invalid_resp;
971
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200972 dns_answer_record->address.sa_family = AF_INET6;
973 memcpy(&(((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr),
974 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200975 break;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200976
Baptiste Assmann325137d2015-04-13 23:40:55 +0200977 } /* switch (record type) */
978
Christopher Faulet67957bd2017-09-27 11:00:59 +0200979 /* Increment the counter for number of records saved into our
980 * local response */
981 nb_saved_records++;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200982
Christopher Faulet67957bd2017-09-27 11:00:59 +0200983 /* Move forward dns_answer_record->data_len for analyzing next
984 * record in the response */
985 reader += ((dns_answer_record->type == DNS_RTYPE_SRV)
986 ? offset
987 : dns_answer_record->data_len);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200988
989 /* Lookup to see if we already had this entry */
Olivier Houchard8da5f982017-08-04 18:35:36 +0200990 found = 0;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200991 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
992 if (tmp_record->type != dns_answer_record->type)
993 continue;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200994
995 switch(tmp_record->type) {
996 case DNS_RTYPE_A:
997 if (!memcmp(&((struct sockaddr_in *)&dns_answer_record->address)->sin_addr,
998 &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
999 sizeof(in_addr_t)))
1000 found = 1;
1001 break;
1002
1003 case DNS_RTYPE_AAAA:
1004 if (!memcmp(&((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr,
1005 &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
1006 sizeof(struct in6_addr)))
1007 found = 1;
1008 break;
1009
Olivier Houchard8da5f982017-08-04 18:35:36 +02001010 case DNS_RTYPE_SRV:
1011 if (dns_answer_record->data_len == tmp_record->data_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001012 !dns_hostname_cmp(dns_answer_record->target, tmp_record->target, dns_answer_record->data_len) &&
Olivier Houchard8da5f982017-08-04 18:35:36 +02001013 dns_answer_record->port == tmp_record->port) {
1014 tmp_record->weight = dns_answer_record->weight;
1015 found = 1;
1016 }
1017 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001018
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001019 default:
1020 break;
1021 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001022
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001023 if (found == 1)
1024 break;
1025 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001026
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001027 if (found == 1) {
1028 tmp_record->last_seen = now.tv_sec;
Willy Tarreaubafbe012017-11-24 17:34:44 +01001029 pool_free(dns_answer_item_pool, dns_answer_record);
Willy Tarreau963f7012020-07-22 17:00:45 +02001030 dns_answer_record = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001031 }
1032 else {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001033 dns_answer_record->last_seen = now.tv_sec;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001034 dns_answer_record->ar_item = NULL;
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001035 LIST_ADDQ(&dns_p->answer_list, &dns_answer_record->list);
Willy Tarreau963f7012020-07-22 17:00:45 +02001036 dns_answer_record = NULL;
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001037 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001038 } /* for i 0 to ancount */
1039
Christopher Faulet67957bd2017-09-27 11:00:59 +02001040 /* Save the number of records we really own */
Baptiste Assmann69fce672017-05-04 08:37:45 +02001041 dns_p->header.ancount = nb_saved_records;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001042
Baptiste Assmann37950c82020-02-19 01:08:51 +01001043 /* now parsing additional records for SRV queries only */
1044 if (dns_query->type != DNS_RTYPE_SRV)
1045 goto skip_parsing_additional_records;
Willy Tarreau963f7012020-07-22 17:00:45 +02001046
Jerome Magnin4002f8d2020-07-26 12:13:12 +02001047 /* if we find Authority records, just skip them */
1048 for (i = 0; i < dns_p->header.nscount; i++) {
1049 offset = 0;
1050 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE,
1051 &offset, 0);
1052 if (len == 0)
1053 continue;
1054
1055 if (reader + offset + 10 >= bufend)
1056 goto invalid_resp;
1057
1058 reader += offset;
1059 /* skip 2 bytes for class */
1060 reader += 2;
1061 /* skip 2 bytes for type */
1062 reader += 2;
1063 /* skip 4 bytes for ttl */
1064 reader += 4;
1065 /* read data len */
1066 len = reader[0] * 256 + reader[1];
1067 reader += 2;
1068
1069 if (reader + len >= bufend)
1070 goto invalid_resp;
1071
1072 reader += len;
1073 }
1074
Baptiste Assmann13a92322019-06-07 09:40:55 +02001075 nb_saved_records = 0;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001076 for (i = 0; i < dns_p->header.arcount; i++) {
1077 if (reader >= bufend)
Willy Tarreau963f7012020-07-22 17:00:45 +02001078 goto invalid_resp;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001079
1080 dns_answer_record = pool_alloc(dns_answer_item_pool);
1081 if (dns_answer_record == NULL)
Willy Tarreau963f7012020-07-22 17:00:45 +02001082 goto invalid_resp;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001083
1084 offset = 0;
1085 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
1086
1087 if (len == 0) {
1088 pool_free(dns_answer_item_pool, dns_answer_record);
Willy Tarreau963f7012020-07-22 17:00:45 +02001089 dns_answer_record = NULL;
Baptiste Assmann37950c82020-02-19 01:08:51 +01001090 continue;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001091 }
1092
1093 memcpy(dns_answer_record->name, tmpname, len);
1094 dns_answer_record->name[len] = 0;
1095
1096 reader += offset;
Willy Tarreau963f7012020-07-22 17:00:45 +02001097 if (reader >= bufend)
1098 goto invalid_resp;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001099
1100 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
Willy Tarreau963f7012020-07-22 17:00:45 +02001101 if (reader + 2 > bufend)
1102 goto invalid_resp;
1103
Baptiste Assmann13a92322019-06-07 09:40:55 +02001104 dns_answer_record->type = reader[0] * 256 + reader[1];
1105 reader += 2;
1106
1107 /* 2 bytes for class (2) */
Willy Tarreau963f7012020-07-22 17:00:45 +02001108 if (reader + 2 > bufend)
1109 goto invalid_resp;
1110
Baptiste Assmann13a92322019-06-07 09:40:55 +02001111 dns_answer_record->class = reader[0] * 256 + reader[1];
1112 reader += 2;
1113
1114 /* 4 bytes for ttl (4) */
Willy Tarreau963f7012020-07-22 17:00:45 +02001115 if (reader + 4 > bufend)
1116 goto invalid_resp;
1117
Baptiste Assmann13a92322019-06-07 09:40:55 +02001118 dns_answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
1119 + reader[2] * 256 + reader[3];
1120 reader += 4;
1121
1122 /* Now reading data len */
Willy Tarreau963f7012020-07-22 17:00:45 +02001123 if (reader + 2 > bufend)
1124 goto invalid_resp;
1125
Baptiste Assmann13a92322019-06-07 09:40:55 +02001126 dns_answer_record->data_len = reader[0] * 256 + reader[1];
1127
1128 /* Move forward 2 bytes for data len */
1129 reader += 2;
1130
Willy Tarreau963f7012020-07-22 17:00:45 +02001131 if (reader + dns_answer_record->data_len > bufend)
1132 goto invalid_resp;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001133
1134 /* Analyzing record content */
1135 switch (dns_answer_record->type) {
1136 case DNS_RTYPE_A:
1137 /* ipv4 is stored on 4 bytes */
Willy Tarreau963f7012020-07-22 17:00:45 +02001138 if (dns_answer_record->data_len != 4)
1139 goto invalid_resp;
1140
Baptiste Assmann13a92322019-06-07 09:40:55 +02001141 dns_answer_record->address.sa_family = AF_INET;
1142 memcpy(&(((struct sockaddr_in *)&dns_answer_record->address)->sin_addr),
1143 reader, dns_answer_record->data_len);
1144 break;
1145
1146 case DNS_RTYPE_AAAA:
1147 /* ipv6 is stored on 16 bytes */
Willy Tarreau963f7012020-07-22 17:00:45 +02001148 if (dns_answer_record->data_len != 16)
1149 goto invalid_resp;
1150
Baptiste Assmann13a92322019-06-07 09:40:55 +02001151 dns_answer_record->address.sa_family = AF_INET6;
1152 memcpy(&(((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr),
1153 reader, dns_answer_record->data_len);
1154 break;
1155
1156 default:
1157 pool_free(dns_answer_item_pool, dns_answer_record);
Willy Tarreau963f7012020-07-22 17:00:45 +02001158 dns_answer_record = NULL;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001159 continue;
1160
1161 } /* switch (record type) */
1162
1163 /* Increment the counter for number of records saved into our
1164 * local response */
1165 nb_saved_records++;
1166
1167 /* Move forward dns_answer_record->data_len for analyzing next
1168 * record in the response */
1169 reader += ((dns_answer_record->type == DNS_RTYPE_SRV)
1170 ? offset
1171 : dns_answer_record->data_len);
1172
1173 /* Lookup to see if we already had this entry */
1174 found = 0;
1175 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
1176 if (tmp_record->type != dns_answer_record->type)
1177 continue;
1178
1179 switch(tmp_record->type) {
1180 case DNS_RTYPE_A:
1181 if (!memcmp(&((struct sockaddr_in *)&dns_answer_record->address)->sin_addr,
1182 &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
1183 sizeof(in_addr_t)))
1184 found = 1;
1185 break;
1186
1187 case DNS_RTYPE_AAAA:
1188 if (!memcmp(&((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr,
1189 &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
1190 sizeof(struct in6_addr)))
1191 found = 1;
1192 break;
1193
1194 default:
1195 break;
1196 }
1197
1198 if (found == 1)
1199 break;
1200 }
1201
1202 if (found == 1) {
1203 tmp_record->last_seen = now.tv_sec;
1204 pool_free(dns_answer_item_pool, dns_answer_record);
Willy Tarreau963f7012020-07-22 17:00:45 +02001205 dns_answer_record = NULL;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001206 }
1207 else {
1208 dns_answer_record->last_seen = now.tv_sec;
1209 dns_answer_record->ar_item = NULL;
1210
1211 // looking for the SRV record in the response list linked to this additional record
1212 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
1213 if ( !(
1214 (tmp_record->type == DNS_RTYPE_SRV) &&
1215 (tmp_record->ar_item == NULL) &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001216 (dns_hostname_cmp(tmp_record->target, dns_answer_record->name, tmp_record->data_len) == 0)
Baptiste Assmann13a92322019-06-07 09:40:55 +02001217 )
1218 )
1219 continue;
1220 tmp_record->ar_item = dns_answer_record;
1221 }
Baptiste Assmann13a92322019-06-07 09:40:55 +02001222
1223 LIST_ADDQ(&dns_p->ar_list, &dns_answer_record->list);
Willy Tarreau963f7012020-07-22 17:00:45 +02001224 dns_answer_record = NULL;
Baptiste Assmann13a92322019-06-07 09:40:55 +02001225 }
1226 } /* for i 0 to arcount */
1227
Baptiste Assmann37950c82020-02-19 01:08:51 +01001228 skip_parsing_additional_records:
1229
Baptiste Assmann13a92322019-06-07 09:40:55 +02001230 /* Save the number of records we really own */
1231 dns_p->header.arcount = nb_saved_records;
1232
Christopher Faulet67957bd2017-09-27 11:00:59 +02001233 dns_check_dns_response(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001234 return DNS_RESP_VALID;
Willy Tarreau963f7012020-07-22 17:00:45 +02001235
1236 invalid_resp:
1237 cause = DNS_RESP_INVALID;
1238
1239 return_error:
1240 pool_free(dns_answer_item_pool, dns_answer_record);
1241 return cause;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001242}
1243
Christopher Faulet67957bd2017-09-27 11:00:59 +02001244/* Searches dn_name resolution in resp.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001245 * If existing IP not found, return the first IP matching family_priority,
1246 * otherwise, first ip found
1247 * The following tasks are the responsibility of the caller:
Baptiste Assmann3cf7f982016-04-17 22:43:26 +02001248 * - <dns_p> contains an error free DNS response
Baptiste Assmann325137d2015-04-13 23:40:55 +02001249 * For both cases above, dns_validate_dns_response is required
1250 * returns one of the DNS_UPD_* code
1251 */
Baptiste Assmannfb7091e2017-05-03 15:43:12 +02001252int dns_get_ip_from_response(struct dns_response_packet *dns_p,
Baptiste Assmann42746372017-05-03 12:12:02 +02001253 struct dns_options *dns_opts, void *currentip,
Thierry Fournierada34842016-02-17 21:25:09 +01001254 short currentip_sin_family,
Baptiste Assmannfb7091e2017-05-03 15:43:12 +02001255 void **newip, short *newip_sin_family,
1256 void *owner)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001257{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +02001258 struct dns_answer_item *record;
Thierry Fournierada34842016-02-17 21:25:09 +01001259 int family_priority;
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001260 int currentip_found;
Baptiste Assmann3cf7f982016-04-17 22:43:26 +02001261 unsigned char *newip4, *newip6;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001262 int currentip_sel;
1263 int j;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001264 int score, max_score;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001265 int allowed_duplicated_ip;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001266
Christopher Faulet67957bd2017-09-27 11:00:59 +02001267 family_priority = dns_opts->family_prio;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001268 allowed_duplicated_ip = dns_opts->accept_duplicate_ip;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001269 *newip = newip4 = newip6 = NULL;
1270 currentip_found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001271 *newip_sin_family = AF_UNSPEC;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001272 max_score = -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001273
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001274 /* Select an IP regarding configuration preference.
Joseph Herlant42cf6392018-11-15 10:33:28 -08001275 * Top priority is the preferred network ip version,
1276 * second priority is the preferred network.
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001277 * the last priority is the currently used IP,
1278 *
1279 * For these three priorities, a score is calculated. The
1280 * weight are:
Joseph Herlant42cf6392018-11-15 10:33:28 -08001281 * 8 - preferred ip version.
1282 * 4 - preferred network.
Baptistefc725902016-12-26 23:21:08 +01001283 * 2 - if the ip in the record is not affected to any other server in the same backend (duplication)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001284 * 1 - current ip.
1285 * The result with the biggest score is returned.
1286 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001287
1288 list_for_each_entry(record, &dns_p->answer_list, list) {
1289 void *ip;
1290 unsigned char ip_type;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001291
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001292 if (record->type == DNS_RTYPE_A) {
1293 ip = &(((struct sockaddr_in *)&record->address)->sin_addr);
1294 ip_type = AF_INET;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001295 }
1296 else if (record->type == DNS_RTYPE_AAAA) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001297 ip_type = AF_INET6;
1298 ip = &(((struct sockaddr_in6 *)&record->address)->sin6_addr);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001299 }
1300 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001301 continue;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001302 score = 0;
1303
Joseph Herlant42cf6392018-11-15 10:33:28 -08001304 /* Check for preferred ip protocol. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001305 if (ip_type == family_priority)
Baptistefc725902016-12-26 23:21:08 +01001306 score += 8;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001307
Joseph Herlant42cf6392018-11-15 10:33:28 -08001308 /* Check for preferred network. */
Baptiste Assmann42746372017-05-03 12:12:02 +02001309 for (j = 0; j < dns_opts->pref_net_nb; j++) {
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001310
Ilya Shipitsin46a030c2020-07-05 16:36:08 +05001311 /* Compare only the same addresses class. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001312 if (dns_opts->pref_net[j].family != ip_type)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001313 continue;
1314
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001315 if ((ip_type == AF_INET &&
1316 in_net_ipv4(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001317 &dns_opts->pref_net[j].mask.in4,
1318 &dns_opts->pref_net[j].addr.in4)) ||
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001319 (ip_type == AF_INET6 &&
1320 in_net_ipv6(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001321 &dns_opts->pref_net[j].mask.in6,
1322 &dns_opts->pref_net[j].addr.in6))) {
Baptistefc725902016-12-26 23:21:08 +01001323 score += 4;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001324 break;
1325 }
1326 }
1327
Christopher Faulet67957bd2017-09-27 11:00:59 +02001328 /* Check if the IP found in the record is already affected to a
Baptiste Assmann84221b42018-06-22 13:03:50 +02001329 * member of a group. If not, the score should be incremented
Christopher Faulet67957bd2017-09-27 11:00:59 +02001330 * by 2. */
Baptiste Assmann84221b42018-06-22 13:03:50 +02001331 if (owner && snr_check_ip_callback(owner, ip, &ip_type)) {
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001332 if (!allowed_duplicated_ip) {
1333 continue;
1334 }
Baptiste Assmann84221b42018-06-22 13:03:50 +02001335 } else {
1336 score += 2;
1337 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001338
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001339 /* Check for current ip matching. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001340 if (ip_type == currentip_sin_family &&
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001341 ((currentip_sin_family == AF_INET &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001342 !memcmp(ip, currentip, 4)) ||
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001343 (currentip_sin_family == AF_INET6 &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001344 !memcmp(ip, currentip, 16)))) {
1345 score++;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001346 currentip_sel = 1;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001347 }
1348 else
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001349 currentip_sel = 0;
1350
1351 /* Keep the address if the score is better than the previous
Christopher Faulet67957bd2017-09-27 11:00:59 +02001352 * score. The maximum score is 15, if this value is reached, we
1353 * break the parsing. Implicitly, this score is reached the ip
1354 * selected is the current ip. */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001355 if (score > max_score) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001356 if (ip_type == AF_INET)
1357 newip4 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001358 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001359 newip6 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001360 currentip_found = currentip_sel;
Baptistefc725902016-12-26 23:21:08 +01001361 if (score == 15)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001362 return DNS_UPD_NO;
1363 max_score = score;
1364 }
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001365 } /* list for each record entries */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001366
Christopher Faulet67957bd2017-09-27 11:00:59 +02001367 /* No IP found in the response */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001368 if (!newip4 && !newip6)
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001369 return DNS_UPD_NO_IP_FOUND;
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001370
Christopher Faulet67957bd2017-09-27 11:00:59 +02001371 /* Case when the caller looks first for an IPv4 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001372 if (family_priority == AF_INET) {
1373 if (newip4) {
1374 *newip = newip4;
1375 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001376 }
1377 else if (newip6) {
1378 *newip = newip6;
1379 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001380 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001381 if (!currentip_found)
1382 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001383 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001384 /* Case when the caller looks first for an IPv6 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001385 else if (family_priority == AF_INET6) {
1386 if (newip6) {
1387 *newip = newip6;
1388 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001389 }
1390 else if (newip4) {
1391 *newip = newip4;
1392 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001393 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001394 if (!currentip_found)
1395 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001396 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001397 /* Case when the caller have no preference (we prefer IPv6) */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001398 else if (family_priority == AF_UNSPEC) {
1399 if (newip6) {
1400 *newip = newip6;
1401 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001402 }
1403 else if (newip4) {
1404 *newip = newip4;
1405 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001406 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001407 if (!currentip_found)
1408 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001409 }
1410
Christopher Faulet67957bd2017-09-27 11:00:59 +02001411 /* No reason why we should change the server's IP address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001412 return DNS_UPD_NO;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001413
Christopher Faulet67957bd2017-09-27 11:00:59 +02001414 not_found:
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001415 list_for_each_entry(record, &dns_p->answer_list, list) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001416 /* Move the first record to the end of the list, for internal
1417 * round robin */
1418 LIST_DEL(&record->list);
1419 LIST_ADDQ(&dns_p->answer_list, &record->list);
1420 break;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001421 }
1422 return DNS_UPD_SRVIP_NOT_FOUND;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001423}
1424
Christopher Faulet67957bd2017-09-27 11:00:59 +02001425/* Turns a domain name label into a string.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001426 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001427 * <dn> must be a null-terminated string. <dn_len> must include the terminating
1428 * null byte. <str> must be allocated and its size must be passed in <str_len>.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001429 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001430 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1431 * <str> (including the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001432 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001433int dns_dn_label_to_str(const char *dn, int dn_len, char *str, int str_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001434{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001435 char *ptr;
1436 int i, sz;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001437
Christopher Faulet67957bd2017-09-27 11:00:59 +02001438 if (str_len < dn_len - 1)
Baptiste Assmann2af08fe2017-08-14 00:13:01 +02001439 return -1;
1440
Christopher Faulet67957bd2017-09-27 11:00:59 +02001441 ptr = str;
1442 for (i = 0; i < dn_len-1; ++i) {
1443 sz = dn[i];
1444 if (i)
1445 *ptr++ = '.';
1446 memcpy(ptr, dn+i+1, sz);
1447 ptr += sz;
1448 i += sz;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001449 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001450 *ptr++ = '\0';
1451 return (ptr - str);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001452}
1453
Christopher Faulet67957bd2017-09-27 11:00:59 +02001454/* Turns a string into domain name label: www.haproxy.org into 3www7haproxy3org
1455 *
1456 * <str> must be a null-terminated string. <str_len> must include the
1457 * terminating null byte. <dn> buffer must be allocated and its size must be
1458 * passed in <dn_len>.
1459 *
1460 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1461 * <dn> (excluding the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001462 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001463int dns_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001464{
Baptiste Assmann325137d2015-04-13 23:40:55 +02001465 int i, offset;
1466
Christopher Faulet67957bd2017-09-27 11:00:59 +02001467 if (dn_len < str_len + 1)
1468 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001469
Christopher Faulet67957bd2017-09-27 11:00:59 +02001470 /* First byte of dn will be used to store the length of the first
1471 * label */
1472 offset = 0;
1473 for (i = 0; i < str_len; ++i) {
1474 if (str[i] == '.') {
1475 /* 2 or more consecutive dots is invalid */
1476 if (i == offset)
1477 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001478
Lukas Tribus81725b82020-02-27 15:47:24 +01001479 /* ignore trailing dot */
1480 if (i + 2 == str_len) {
1481 i++;
1482 break;
1483 }
1484
Christopher Faulet67957bd2017-09-27 11:00:59 +02001485 dn[offset] = (i - offset);
1486 offset = i+1;
1487 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001488 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001489 dn[i+1] = str[i];
Baptiste Assmann325137d2015-04-13 23:40:55 +02001490 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001491 dn[offset] = (i - offset - 1);
1492 dn[i] = '\0';
1493 return i;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001494}
1495
Christopher Faulet67957bd2017-09-27 11:00:59 +02001496/* Validates host name:
Baptiste Assmann325137d2015-04-13 23:40:55 +02001497 * - total size
1498 * - each label size individually
1499 * returns:
1500 * 0 in case of error. If <err> is not NULL, an error message is stored there.
1501 * 1 when no error. <err> is left unaffected.
1502 */
1503int dns_hostname_validation(const char *string, char **err)
1504{
Baptiste Assmann325137d2015-04-13 23:40:55 +02001505 int i;
1506
1507 if (strlen(string) > DNS_MAX_NAME_SIZE) {
1508 if (err)
1509 *err = DNS_TOO_LONG_FQDN;
1510 return 0;
1511 }
1512
William Dauchyaecd5dc2020-01-26 19:52:34 +01001513 while (*string) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001514 i = 0;
William Dauchyaecd5dc2020-01-26 19:52:34 +01001515 while (*string && *string != '.' && i < DNS_MAX_LABEL_SIZE) {
1516 if (!(*string == '-' || *string == '_' ||
1517 (*string >= 'a' && *string <= 'z') ||
1518 (*string >= 'A' && *string <= 'Z') ||
1519 (*string >= '0' && *string <= '9'))) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001520 if (err)
1521 *err = DNS_INVALID_CHARACTER;
1522 return 0;
1523 }
William Dauchyaecd5dc2020-01-26 19:52:34 +01001524 i++;
1525 string++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001526 }
1527
William Dauchyaecd5dc2020-01-26 19:52:34 +01001528 if (!(*string))
1529 break;
1530
1531 if (*string != '.' && i >= DNS_MAX_LABEL_SIZE) {
Baptiste Assmann325137d2015-04-13 23:40:55 +02001532 if (err)
1533 *err = DNS_LABEL_TOO_LONG;
1534 return 0;
1535 }
1536
William Dauchyaecd5dc2020-01-26 19:52:34 +01001537 string++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001538 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001539 return 1;
1540}
1541
Christopher Faulet67957bd2017-09-27 11:00:59 +02001542/* Picks up an available resolution from the different resolution list
1543 * associated to a resolvers section, in this order:
1544 * 1. check in resolutions.curr for the same hostname and query_type
1545 * 2. check in resolutions.wait for the same hostname and query_type
1546 * 3. Get a new resolution from resolution pool
1547 *
1548 * Returns an available resolution, NULL if none found.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001549 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001550static struct dns_resolution *dns_pick_resolution(struct dns_resolvers *resolvers,
1551 char **hostname_dn, int hostname_dn_len,
1552 int query_type)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001553{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001554 struct dns_resolution *res;
1555
1556 if (!*hostname_dn)
1557 goto from_pool;
1558
1559 /* Search for same hostname and query type in resolutions.curr */
1560 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
1561 if (!res->hostname_dn)
1562 continue;
1563 if ((query_type == res->prefered_query_type) &&
1564 hostname_dn_len == res->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001565 !dns_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +02001566 return res;
1567 }
1568
1569 /* Search for same hostname and query type in resolutions.wait */
1570 list_for_each_entry(res, &resolvers->resolutions.wait, list) {
1571 if (!res->hostname_dn)
1572 continue;
1573 if ((query_type == res->prefered_query_type) &&
1574 hostname_dn_len == res->hostname_dn_len &&
Olivier Houchardb17b8842020-04-01 18:30:27 +02001575 !dns_hostname_cmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +02001576 return res;
1577 }
1578
1579 from_pool:
1580 /* No resolution could be found, so let's allocate a new one */
Willy Tarreaubafbe012017-11-24 17:34:44 +01001581 res = pool_alloc(dns_resolution_pool);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001582 if (res) {
1583 memset(res, 0, sizeof(*res));
1584 res->resolvers = resolvers;
1585 res->uuid = resolution_uuid;
1586 res->status = RSLV_STATUS_NONE;
1587 res->step = RSLV_STEP_NONE;
1588 res->last_valid = now_ms;
1589
1590 LIST_INIT(&res->requesters);
1591 LIST_INIT(&res->response.answer_list);
Baptiste Assmann13a92322019-06-07 09:40:55 +02001592 LIST_INIT(&res->response.ar_list);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001593
1594 res->prefered_query_type = query_type;
1595 res->query_type = query_type;
1596 res->hostname_dn = *hostname_dn;
1597 res->hostname_dn_len = hostname_dn_len;
1598
1599 ++resolution_uuid;
1600
1601 /* Move the resolution to the resolvers wait queue */
1602 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1603 }
1604 return res;
1605}
1606
1607/* Releases a resolution from its requester(s) and move it back to the pool */
1608static void dns_free_resolution(struct dns_resolution *resolution)
1609{
1610 struct dns_requester *req, *reqback;
Christopher Faulet010ab352020-07-22 15:55:49 +02001611 struct dns_answer_item *item, *itemback;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001612
1613 /* clean up configuration */
1614 dns_reset_resolution(resolution);
1615 resolution->hostname_dn = NULL;
1616 resolution->hostname_dn_len = 0;
1617
1618 list_for_each_entry_safe(req, reqback, &resolution->requesters, list) {
1619 LIST_DEL(&req->list);
1620 req->resolution = NULL;
1621 }
1622
Christopher Faulet010ab352020-07-22 15:55:49 +02001623 list_for_each_entry_safe(item, itemback, &resolution->response.ar_list, list) {
1624 LIST_DEL(&item->list);
1625 pool_free(dns_answer_item_pool, item);
1626 }
1627
1628 list_for_each_entry_safe(item, itemback, &resolution->response.answer_list, list) {
1629 LIST_DEL(&item->list);
1630 pool_free(dns_answer_item_pool, item);
1631 }
1632
Christopher Faulet67957bd2017-09-27 11:00:59 +02001633 LIST_DEL(&resolution->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +01001634 pool_free(dns_resolution_pool, resolution);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001635}
1636
1637/* Links a requester (a server or a dns_srvrq) with a resolution. It returns 0
1638 * on success, -1 otherwise.
1639 */
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001640int dns_link_resolution(void *requester, int requester_type, int requester_locked)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001641{
1642 struct dns_resolution *res = NULL;
1643 struct dns_requester *req;
1644 struct dns_resolvers *resolvers;
1645 struct server *srv = NULL;
1646 struct dns_srvrq *srvrq = NULL;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001647 struct stream *stream = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001648 char **hostname_dn;
1649 int hostname_dn_len, query_type;
1650
1651 switch (requester_type) {
1652 case OBJ_TYPE_SERVER:
1653 srv = (struct server *)requester;
1654 hostname_dn = &srv->hostname_dn;
1655 hostname_dn_len = srv->hostname_dn_len;
1656 resolvers = srv->resolvers;
1657 query_type = ((srv->dns_opts.family_prio == AF_INET)
1658 ? DNS_RTYPE_A
1659 : DNS_RTYPE_AAAA);
1660 break;
1661
1662 case OBJ_TYPE_SRVRQ:
1663 srvrq = (struct dns_srvrq *)requester;
1664 hostname_dn = &srvrq->hostname_dn;
1665 hostname_dn_len = srvrq->hostname_dn_len;
1666 resolvers = srvrq->resolvers;
1667 query_type = DNS_RTYPE_SRV;
1668 break;
1669
Baptiste Assmann333939c2019-01-21 08:34:50 +01001670 case OBJ_TYPE_STREAM:
1671 stream = (struct stream *)requester;
1672 hostname_dn = &stream->dns_ctx.hostname_dn;
1673 hostname_dn_len = stream->dns_ctx.hostname_dn_len;
1674 resolvers = stream->dns_ctx.parent->arg.dns.resolvers;
Christopher Fauleta4168432020-01-24 18:08:42 +01001675 query_type = ((stream->dns_ctx.parent->arg.dns.dns_opts->family_prio == AF_INET)
Baptiste Assmann333939c2019-01-21 08:34:50 +01001676 ? DNS_RTYPE_A
1677 : DNS_RTYPE_AAAA);
1678 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001679 default:
1680 goto err;
1681 }
1682
1683 /* Get a resolution from the resolvers' wait queue or pool */
1684 if ((res = dns_pick_resolution(resolvers, hostname_dn, hostname_dn_len, query_type)) == NULL)
1685 goto err;
1686
1687 if (srv) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001688 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001689 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001690 if (srv->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001691 if ((req = pool_alloc(dns_requester_pool)) == NULL) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001692 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001693 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001694 goto err;
Willy Tarreau5ec84572017-11-05 10:35:57 +01001695 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001696 req->owner = &srv->obj_type;
1697 srv->dns_requester = req;
1698 }
1699 else
1700 req = srv->dns_requester;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001701 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001702 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001703
1704 req->requester_cb = snr_resolution_cb;
1705 req->requester_error_cb = snr_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001706 }
1707 else if (srvrq) {
1708 if (srvrq->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001709 if ((req = pool_alloc(dns_requester_pool)) == NULL)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001710 goto err;
1711 req->owner = &srvrq->obj_type;
1712 srvrq->dns_requester = req;
1713 }
1714 else
1715 req = srvrq->dns_requester;
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001716
1717 req->requester_cb = snr_resolution_cb;
1718 req->requester_error_cb = snr_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001719 }
Baptiste Assmann333939c2019-01-21 08:34:50 +01001720 else if (stream) {
1721 if (stream->dns_ctx.dns_requester == NULL) {
1722 if ((req = pool_alloc(dns_requester_pool)) == NULL)
1723 goto err;
1724 req->owner = &stream->obj_type;
1725 stream->dns_ctx.dns_requester = req;
1726 }
1727 else
1728 req = stream->dns_ctx.dns_requester;
1729
1730 req->requester_cb = act_resolution_cb;
1731 req->requester_error_cb = act_resolution_error_cb;
1732 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001733 else
1734 goto err;
1735
1736 req->resolution = res;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001737
1738 LIST_ADDQ(&res->requesters, &req->list);
1739 return 0;
1740
1741 err:
1742 if (res && LIST_ISEMPTY(&res->requesters))
1743 dns_free_resolution(res);
1744 return -1;
1745}
1746
Ilya Shipitsin46a030c2020-07-05 16:36:08 +05001747/* Removes a requester from a DNS resolution. It takes takes care of all the
Christopher Faulet67957bd2017-09-27 11:00:59 +02001748 * consequences. It also cleans up some parameters from the requester.
1749 */
1750void dns_unlink_resolution(struct dns_requester *requester)
1751{
1752 struct dns_resolution *res;
1753 struct dns_requester *req;
1754
1755 /* Nothing to do */
1756 if (!requester || !requester->resolution)
1757 return;
1758 res = requester->resolution;
1759
1760 /* Clean up the requester */
1761 LIST_DEL(&requester->list);
1762 requester->resolution = NULL;
1763
1764 /* We need to find another requester linked on this resolution */
1765 if (!LIST_ISEMPTY(&res->requesters))
1766 req = LIST_NEXT(&res->requesters, struct dns_requester *, list);
1767 else {
1768 dns_free_resolution(res);
1769 return;
1770 }
1771
1772 /* Move hostname_dn related pointers to the next requester */
1773 switch (obj_type(req->owner)) {
1774 case OBJ_TYPE_SERVER:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001775 res->hostname_dn = __objt_server(req->owner)->hostname_dn;
1776 res->hostname_dn_len = __objt_server(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001777 break;
1778 case OBJ_TYPE_SRVRQ:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001779 res->hostname_dn = __objt_dns_srvrq(req->owner)->hostname_dn;
1780 res->hostname_dn_len = __objt_dns_srvrq(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001781 break;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001782 case OBJ_TYPE_STREAM:
1783 res->hostname_dn = __objt_stream(req->owner)->dns_ctx.hostname_dn;
1784 res->hostname_dn_len = __objt_stream(req->owner)->dns_ctx.hostname_dn_len;
1785 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001786 default:
1787 res->hostname_dn = NULL;
1788 res->hostname_dn_len = 0;
1789 break;
1790 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001791}
1792
Christopher Faulet67957bd2017-09-27 11:00:59 +02001793/* Called when a network IO is generated on a name server socket for an incoming
1794 * packet. It performs the following actions:
1795 * - check if the packet requires processing (not outdated resolution)
1796 * - ensure the DNS packet received is valid and call requester's callback
1797 * - call requester's error callback if invalid response
1798 * - check the dn_name in the packet against the one sent
1799 */
1800static void dns_resolve_recv(struct dgram_conn *dgram)
1801{
1802 struct dns_nameserver *ns, *tmpns;
1803 struct dns_resolvers *resolvers;
1804 struct dns_resolution *res;
1805 struct dns_query_item *query;
1806 unsigned char buf[DNS_MAX_UDP_MESSAGE + 1];
1807 unsigned char *bufend;
1808 int fd, buflen, dns_resp;
1809 int max_answer_records;
1810 unsigned short query_id;
1811 struct eb32_node *eb;
1812 struct dns_requester *req;
1813
1814 fd = dgram->t.sock.fd;
1815
1816 /* check if ready for reading */
1817 if (!fd_recv_ready(fd))
1818 return;
1819
1820 /* no need to go further if we can't retrieve the nameserver */
Willy Tarreau1c759952019-12-10 18:38:09 +01001821 if ((ns = dgram->owner) == NULL) {
1822 _HA_ATOMIC_AND(&fdtab[fd].ev, ~(FD_POLL_HUP|FD_POLL_ERR));
1823 fd_stop_recv(fd);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001824 return;
Willy Tarreau1c759952019-12-10 18:38:09 +01001825 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001826
1827 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001828 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001829
1830 /* process all pending input messages */
Willy Tarreau1c759952019-12-10 18:38:09 +01001831 while (fd_recv_ready(fd)) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001832 /* read message received */
1833 memset(buf, '\0', resolvers->accepted_payload_size + 1);
1834 if ((buflen = recv(fd, (char*)buf , resolvers->accepted_payload_size + 1, 0)) < 0) {
Willy Tarreau1c759952019-12-10 18:38:09 +01001835 /* FIXME : for now we consider EAGAIN only, but at
1836 * least we purge sticky errors that would cause us to
1837 * be called in loops.
1838 */
1839 _HA_ATOMIC_AND(&fdtab[fd].ev, ~(FD_POLL_HUP|FD_POLL_ERR));
Christopher Faulet67957bd2017-09-27 11:00:59 +02001840 fd_cant_recv(fd);
1841 break;
1842 }
1843
1844 /* message too big */
1845 if (buflen > resolvers->accepted_payload_size) {
1846 ns->counters.too_big++;
1847 continue;
1848 }
1849
1850 /* initializing variables */
1851 bufend = buf + buflen; /* pointer to mark the end of the buffer */
1852
1853 /* read the query id from the packet (16 bits) */
1854 if (buf + 2 > bufend) {
1855 ns->counters.invalid++;
1856 continue;
1857 }
1858 query_id = dns_response_get_query_id(buf);
1859
1860 /* search the query_id in the pending resolution tree */
1861 eb = eb32_lookup(&resolvers->query_ids, query_id);
1862 if (eb == NULL) {
1863 /* unknown query id means an outdated response and can be safely ignored */
1864 ns->counters.outdated++;
1865 continue;
1866 }
1867
William Dauchybe8a3872019-11-27 23:32:41 +01001868 /* known query id means a resolution in progress */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001869 res = eb32_entry(eb, struct dns_resolution, qid);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001870 /* number of responses received */
1871 res->nb_responses++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001872
Christopher Faulet67957bd2017-09-27 11:00:59 +02001873 max_answer_records = (resolvers->accepted_payload_size - DNS_HEADER_SIZE) / DNS_MIN_RECORD_SIZE;
1874 dns_resp = dns_validate_dns_response(buf, bufend, res, max_answer_records);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001875
Christopher Faulet67957bd2017-09-27 11:00:59 +02001876 switch (dns_resp) {
1877 case DNS_RESP_VALID:
1878 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001879
Christopher Faulet67957bd2017-09-27 11:00:59 +02001880 case DNS_RESP_INVALID:
1881 case DNS_RESP_QUERY_COUNT_ERROR:
1882 case DNS_RESP_WRONG_NAME:
1883 res->status = RSLV_STATUS_INVALID;
1884 ns->counters.invalid++;
1885 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001886
Christopher Faulet67957bd2017-09-27 11:00:59 +02001887 case DNS_RESP_NX_DOMAIN:
1888 res->status = RSLV_STATUS_NX;
1889 ns->counters.nx++;
1890 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001891
Christopher Faulet67957bd2017-09-27 11:00:59 +02001892 case DNS_RESP_REFUSED:
1893 res->status = RSLV_STATUS_REFUSED;
1894 ns->counters.refused++;
1895 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001896
Christopher Faulet67957bd2017-09-27 11:00:59 +02001897 case DNS_RESP_ANCOUNT_ZERO:
1898 res->status = RSLV_STATUS_OTHER;
1899 ns->counters.any_err++;
1900 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001901
Christopher Faulet67957bd2017-09-27 11:00:59 +02001902 case DNS_RESP_CNAME_ERROR:
1903 res->status = RSLV_STATUS_OTHER;
1904 ns->counters.cname_error++;
1905 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001906
Christopher Faulet67957bd2017-09-27 11:00:59 +02001907 case DNS_RESP_TRUNCATED:
1908 res->status = RSLV_STATUS_OTHER;
1909 ns->counters.truncated++;
1910 break;
Baptiste Assmanne70bc052017-08-21 16:51:09 +02001911
Christopher Faulet67957bd2017-09-27 11:00:59 +02001912 case DNS_RESP_NO_EXPECTED_RECORD:
1913 case DNS_RESP_ERROR:
1914 case DNS_RESP_INTERNAL:
1915 res->status = RSLV_STATUS_OTHER;
1916 ns->counters.other++;
1917 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001918 }
1919
Christopher Faulet67957bd2017-09-27 11:00:59 +02001920 /* Wait all nameservers response to handle errors */
1921 if (dns_resp != DNS_RESP_VALID && res->nb_responses < resolvers->nb_nameservers)
1922 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001923
Christopher Faulet67957bd2017-09-27 11:00:59 +02001924 /* Process error codes */
1925 if (dns_resp != DNS_RESP_VALID) {
1926 if (res->prefered_query_type != res->query_type) {
1927 /* The fallback on the query type was already performed,
1928 * so check the try counter. If it falls to 0, we can
1929 * report an error. Else, wait the next attempt. */
1930 if (!res->try)
1931 goto report_res_error;
1932 }
1933 else {
1934 /* Fallback from A to AAAA or the opposite and re-send
1935 * the resolution immediately. try counter is not
1936 * decremented. */
1937 if (res->prefered_query_type == DNS_RTYPE_A) {
1938 res->query_type = DNS_RTYPE_AAAA;
1939 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001940 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001941 else if (res->prefered_query_type == DNS_RTYPE_AAAA) {
1942 res->query_type = DNS_RTYPE_A;
1943 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001944 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001945 }
1946 continue;
1947 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001948
Christopher Faulet67957bd2017-09-27 11:00:59 +02001949 /* Now let's check the query's dname corresponds to the one we
1950 * sent. We can check only the first query of the list. We send
1951 * one query at a time so we get one query in the response */
1952 query = LIST_NEXT(&res->response.query_list, struct dns_query_item *, list);
Olivier Houchardb17b8842020-04-01 18:30:27 +02001953 if (query && dns_hostname_cmp(query->name, res->hostname_dn, res->hostname_dn_len) != 0) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001954 dns_resp = DNS_RESP_WRONG_NAME;
1955 ns->counters.other++;
1956 goto report_res_error;
1957 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001958
Christopher Faulet67957bd2017-09-27 11:00:59 +02001959 /* So the resolution succeeded */
1960 res->status = RSLV_STATUS_VALID;
1961 res->last_valid = now_ms;
1962 ns->counters.valid++;
1963 goto report_res_success;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001964
Christopher Faulet67957bd2017-09-27 11:00:59 +02001965 report_res_error:
1966 list_for_each_entry(req, &res->requesters, list)
1967 req->requester_error_cb(req, dns_resp);
1968 dns_reset_resolution(res);
1969 LIST_DEL(&res->list);
1970 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1971 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001972
Christopher Faulet67957bd2017-09-27 11:00:59 +02001973 report_res_success:
1974 /* Only the 1rst requester s managed by the server, others are
1975 * from the cache */
1976 tmpns = ns;
1977 list_for_each_entry(req, &res->requesters, list) {
Olivier Houchard28381072017-11-06 17:30:28 +01001978 struct server *s = objt_server(req->owner);
1979
1980 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001981 HA_SPIN_LOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001982 req->requester_cb(req, tmpns);
Olivier Houchard28381072017-11-06 17:30:28 +01001983 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001984 HA_SPIN_UNLOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001985 tmpns = NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001986 }
Baptiste Assmann42746372017-05-03 12:12:02 +02001987
Christopher Faulet67957bd2017-09-27 11:00:59 +02001988 dns_reset_resolution(res);
1989 LIST_DEL(&res->list);
1990 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1991 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001992 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001993 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001994 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001995}
William Lallemand69e96442016-11-19 00:58:54 +01001996
Christopher Faulet67957bd2017-09-27 11:00:59 +02001997/* Called when a resolvers network socket is ready to send data */
1998static void dns_resolve_send(struct dgram_conn *dgram)
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001999{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002000 struct dns_resolvers *resolvers;
2001 struct dns_nameserver *ns;
2002 struct dns_resolution *res;
2003 int fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002004
Christopher Faulet67957bd2017-09-27 11:00:59 +02002005 fd = dgram->t.sock.fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002006
Christopher Faulet67957bd2017-09-27 11:00:59 +02002007 /* check if ready for sending */
2008 if (!fd_send_ready(fd))
2009 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002010
Christopher Faulet67957bd2017-09-27 11:00:59 +02002011 /* we don't want/need to be waked up any more for sending */
2012 fd_stop_send(fd);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002013
Christopher Faulet67957bd2017-09-27 11:00:59 +02002014 /* no need to go further if we can't retrieve the nameserver */
2015 if ((ns = dgram->owner) == NULL)
2016 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002017
Christopher Faulet67957bd2017-09-27 11:00:59 +02002018 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002019 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02002020
Christopher Faulet67957bd2017-09-27 11:00:59 +02002021 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02002022 int ret, len;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002023
Christopher Faulet67957bd2017-09-27 11:00:59 +02002024 if (res->nb_queries == resolvers->nb_nameservers)
2025 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002026
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02002027 len = dns_build_query(res->query_id, res->query_type,
2028 resolvers->accepted_payload_size,
2029 res->hostname_dn, res->hostname_dn_len,
2030 trash.area, trash.size);
2031 if (len == -1)
Christopher Faulet67957bd2017-09-27 11:00:59 +02002032 goto snd_error;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002033
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02002034 ret = send(fd, trash.area, len, 0);
Willy Tarreau0eae6322019-12-20 11:18:54 +01002035 if (ret != len) {
2036 if (ret == -1 && errno == EAGAIN) {
2037 /* retry once the socket is ready */
2038 fd_cant_send(fd);
2039 continue;
2040 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002041 goto snd_error;
Willy Tarreau0eae6322019-12-20 11:18:54 +01002042 }
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002043
Christopher Faulet67957bd2017-09-27 11:00:59 +02002044 ns->counters.sent++;
2045 res->nb_queries++;
2046 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002047
Christopher Faulet67957bd2017-09-27 11:00:59 +02002048 snd_error:
2049 ns->counters.snd_error++;
2050 res->nb_queries++;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002051 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002052 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002053}
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002054
Christopher Faulet67957bd2017-09-27 11:00:59 +02002055/* Processes DNS resolution. First, it checks the active list to detect expired
2056 * resolutions and retry them if possible. Else a timeout is reported. Then, it
2057 * checks the wait list to trigger new resolutions.
2058 */
Olivier Houchard9f6af332018-05-25 14:04:04 +02002059static struct task *dns_process_resolvers(struct task *t, void *context, unsigned short state)
Christopher Faulet67957bd2017-09-27 11:00:59 +02002060{
Olivier Houchard9f6af332018-05-25 14:04:04 +02002061 struct dns_resolvers *resolvers = context;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002062 struct dns_resolution *res, *resback;
2063 int exp;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002064
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002065 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02002066
Christopher Faulet67957bd2017-09-27 11:00:59 +02002067 /* Handle all expired resolutions from the active list */
2068 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
2069 /* When we find the first resolution in the future, then we can
2070 * stop here */
2071 exp = tick_add(res->last_query, resolvers->timeout.retry);
2072 if (!tick_is_expired(exp, now_ms))
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002073 break;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002074
Christopher Faulet67957bd2017-09-27 11:00:59 +02002075 /* If current resolution has been tried too many times and
2076 * finishes in timeout we update its status and remove it from
2077 * the list */
2078 if (!res->try) {
2079 struct dns_requester *req;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002080
Christopher Faulet67957bd2017-09-27 11:00:59 +02002081 /* Notify the result to the requesters */
2082 if (!res->nb_responses)
2083 res->status = RSLV_STATUS_TIMEOUT;
2084 list_for_each_entry(req, &res->requesters, list)
2085 req->requester_error_cb(req, res->status);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02002086
Christopher Faulet67957bd2017-09-27 11:00:59 +02002087 /* Clean up resolution info and remove it from the
2088 * current list */
2089 dns_reset_resolution(res);
2090 LIST_DEL(&res->list);
2091 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
William Lallemand69e96442016-11-19 00:58:54 +01002092 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002093 else {
2094 /* Otherwise resend the DNS query and requeue the resolution */
2095 if (!res->nb_responses || res->prefered_query_type != res->query_type) {
2096 /* No response received (a real timeout) or fallback already done */
2097 res->query_type = res->prefered_query_type;
2098 res->try--;
2099 }
2100 else {
2101 /* Fallback from A to AAAA or the opposite and re-send
2102 * the resolution immediately. try counter is not
2103 * decremented. */
2104 if (res->prefered_query_type == DNS_RTYPE_A)
2105 res->query_type = DNS_RTYPE_AAAA;
2106 else if (res->prefered_query_type == DNS_RTYPE_AAAA)
2107 res->query_type = DNS_RTYPE_A;
2108 else
2109 res->try--;
2110 }
2111 dns_send_query(res);
William Lallemand69e96442016-11-19 00:58:54 +01002112 }
2113 }
William Lallemand69e96442016-11-19 00:58:54 +01002114
Christopher Faulet67957bd2017-09-27 11:00:59 +02002115 /* Handle all resolutions in the wait list */
2116 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
2117 exp = tick_add(res->last_resolution, dns_resolution_timeout(res));
2118 if (tick_isset(res->last_resolution) && !tick_is_expired(exp, now_ms))
2119 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002120
Christopher Faulet67957bd2017-09-27 11:00:59 +02002121 if (dns_run_resolution(res) != 1) {
2122 res->last_resolution = now_ms;
2123 LIST_DEL(&res->list);
2124 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002125 }
2126 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002127
Christopher Faulet67957bd2017-09-27 11:00:59 +02002128 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01002129 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002130 return t;
2131}
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002132
Christopher Faulet67957bd2017-09-27 11:00:59 +02002133/* proto_udp callback functions for a DNS resolution */
2134struct dgram_data_cb resolve_dgram_cb = {
2135 .recv = dns_resolve_recv,
2136 .send = dns_resolve_send,
2137};
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002138
Christopher Faulet67957bd2017-09-27 11:00:59 +02002139/* Release memory allocated by DNS */
2140static void dns_deinit(void)
2141{
2142 struct dns_resolvers *resolvers, *resolversback;
2143 struct dns_nameserver *ns, *nsback;
2144 struct dns_resolution *res, *resback;
2145 struct dns_requester *req, *reqback;
2146 struct dns_srvrq *srvrq, *srvrqback;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002147
Christopher Faulet67957bd2017-09-27 11:00:59 +02002148 list_for_each_entry_safe(resolvers, resolversback, &dns_resolvers, list) {
2149 list_for_each_entry_safe(ns, nsback, &resolvers->nameservers, list) {
2150 free(ns->id);
2151 free((char *)ns->conf.file);
2152 if (ns->dgram && ns->dgram->t.sock.fd != -1)
2153 fd_delete(ns->dgram->t.sock.fd);
2154 free(ns->dgram);
2155 LIST_DEL(&ns->list);
2156 free(ns);
2157 }
2158
2159 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
2160 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
2161 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01002162 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002163 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002164 dns_free_resolution(res);
2165 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02002166
Christopher Faulet67957bd2017-09-27 11:00:59 +02002167 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
2168 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
2169 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01002170 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002171 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002172 dns_free_resolution(res);
2173 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02002174
Christopher Faulet67957bd2017-09-27 11:00:59 +02002175 free(resolvers->id);
2176 free((char *)resolvers->conf.file);
Olivier Houchard3f795f72019-04-17 22:51:06 +02002177 task_destroy(resolvers->t);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002178 LIST_DEL(&resolvers->list);
2179 free(resolvers);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002180 }
2181
Christopher Faulet67957bd2017-09-27 11:00:59 +02002182 list_for_each_entry_safe(srvrq, srvrqback, &dns_srvrq_list, list) {
2183 free(srvrq->name);
2184 free(srvrq->hostname_dn);
2185 LIST_DEL(&srvrq->list);
2186 free(srvrq);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002187 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002188}
2189
Christopher Faulet67957bd2017-09-27 11:00:59 +02002190/* Finalizes the DNS configuration by allocating required resources and checking
2191 * live parameters.
2192 * Returns 0 on success, ERR_* flags otherwise.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002193 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02002194static int dns_finalize_config(void)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002195{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002196 struct dns_resolvers *resolvers;
2197 struct proxy *px;
2198 int err_code = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002199
Christopher Faulet67957bd2017-09-27 11:00:59 +02002200 /* allocate pool of resolution per resolvers */
2201 list_for_each_entry(resolvers, &dns_resolvers, list) {
2202 struct dns_nameserver *ns;
2203 struct task *t;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002204
Christopher Faulet67957bd2017-09-27 11:00:59 +02002205 /* Check if we can create the socket with nameservers info */
2206 list_for_each_entry(ns, &resolvers->nameservers, list) {
2207 struct dgram_conn *dgram = NULL;
2208 int fd;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002209
Christopher Faulet67957bd2017-09-27 11:00:59 +02002210 /* Check nameserver info */
2211 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002212 ha_alert("config : resolvers '%s': can't create socket for nameserver '%s'.\n",
2213 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002214 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002215 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02002216 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002217 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002218 ha_alert("config : resolvers '%s': can't connect socket for nameserver '%s'.\n",
2219 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002220 close(fd);
2221 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02002222 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02002223 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002224 close(fd);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002225
Christopher Faulet67957bd2017-09-27 11:00:59 +02002226 /* Create dgram structure that will hold the UPD socket
2227 * and attach it on the current nameserver */
2228 if ((dgram = calloc(1, sizeof(*dgram))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002229 ha_alert("config: resolvers '%s' : out of memory.\n",
2230 resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002231 err_code |= (ERR_ALERT|ERR_ABORT);
2232 goto err;
2233 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002234
Christopher Faulet67957bd2017-09-27 11:00:59 +02002235 /* Leave dgram partially initialized, no FD attached for
2236 * now. */
2237 dgram->owner = ns;
2238 dgram->data = &resolve_dgram_cb;
2239 dgram->t.sock.fd = -1;
2240 ns->dgram = dgram;
2241 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002242
Christopher Faulet67957bd2017-09-27 11:00:59 +02002243 /* Create the task associated to the resolvers section */
Emeric Brunc60def82017-09-27 14:59:38 +02002244 if ((t = task_new(MAX_THREADS_MASK)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002245 ha_alert("config : resolvers '%s' : out of memory.\n", resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002246 err_code |= (ERR_ALERT|ERR_ABORT);
2247 goto err;
2248 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002249
Christopher Faulet67957bd2017-09-27 11:00:59 +02002250 /* Update task's parameters */
2251 t->process = dns_process_resolvers;
2252 t->context = resolvers;
2253 resolvers->t = t;
2254 task_wakeup(t, TASK_WOKEN_INIT);
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002255 }
2256
Olivier Houchardfbc74e82017-11-24 16:54:05 +01002257 for (px = proxies_list; px; px = px->next) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002258 struct server *srv;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002259
Christopher Faulet67957bd2017-09-27 11:00:59 +02002260 for (srv = px->srv; srv; srv = srv->next) {
2261 struct dns_resolvers *resolvers;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02002262
Christopher Faulet67957bd2017-09-27 11:00:59 +02002263 if (!srv->resolvers_id)
2264 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002265
Christopher Faulet67957bd2017-09-27 11:00:59 +02002266 if ((resolvers = find_resolvers_by_id(srv->resolvers_id)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002267 ha_alert("config : %s '%s', server '%s': unable to find required resolvers '%s'\n",
2268 proxy_type_str(px), px->id, srv->id, srv->resolvers_id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002269 err_code |= (ERR_ALERT|ERR_ABORT);
2270 continue;
2271 }
2272 srv->resolvers = resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002273
Christopher Faulet67957bd2017-09-27 11:00:59 +02002274 if (srv->srvrq && !srv->srvrq->resolvers) {
2275 srv->srvrq->resolvers = srv->resolvers;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01002276 if (dns_link_resolution(srv->srvrq, OBJ_TYPE_SRVRQ, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002277 ha_alert("config : %s '%s' : unable to set DNS resolution for server '%s'.\n",
2278 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002279 err_code |= (ERR_ALERT|ERR_ABORT);
2280 continue;
2281 }
2282 }
Olivier Houchard55dcdf42017-11-06 15:15:04 +01002283 if (dns_link_resolution(srv, OBJ_TYPE_SERVER, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01002284 ha_alert("config : %s '%s', unable to set DNS resolution for server '%s'.\n",
2285 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02002286 err_code |= (ERR_ALERT|ERR_ABORT);
2287 continue;
2288 }
2289 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002290 }
2291
Christopher Faulet67957bd2017-09-27 11:00:59 +02002292 if (err_code & (ERR_ALERT|ERR_ABORT))
2293 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002294
Christopher Faulet67957bd2017-09-27 11:00:59 +02002295 return err_code;
2296 err:
2297 dns_deinit();
2298 return err_code;
2299
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002300}
2301
Christopher Faulet67957bd2017-09-27 11:00:59 +02002302/* if an arg is found, it sets the resolvers section pointer into cli.p0 */
Aurélien Nephtaliabbf6072018-04-18 13:26:46 +02002303static int cli_parse_stat_resolvers(char **args, char *payload, struct appctx *appctx, void *private)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002304{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002305 struct dns_resolvers *presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002306
Christopher Faulet67957bd2017-09-27 11:00:59 +02002307 if (*args[2]) {
2308 list_for_each_entry(presolvers, &dns_resolvers, list) {
2309 if (strcmp(presolvers->id, args[2]) == 0) {
2310 appctx->ctx.cli.p0 = presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002311 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002312 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002313 }
Willy Tarreau9d008692019-08-09 11:21:01 +02002314 if (appctx->ctx.cli.p0 == NULL)
2315 return cli_err(appctx, "Can't find that resolvers section\n");
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002316 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002317 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002318}
2319
Christopher Faulet67957bd2017-09-27 11:00:59 +02002320/* Dumps counters from all resolvers section and associated name servers. It
2321 * returns 0 if the output buffer is full and it needs to be called again,
2322 * otherwise non-zero. It may limit itself to the resolver pointed to by
Willy Tarreau777b5602016-12-16 18:06:26 +01002323 * <cli.p0> if it's not null.
William Lallemand69e96442016-11-19 00:58:54 +01002324 */
2325static int cli_io_handler_dump_resolvers_to_buffer(struct appctx *appctx)
2326{
2327 struct stream_interface *si = appctx->owner;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002328 struct dns_resolvers *resolvers;
2329 struct dns_nameserver *ns;
William Lallemand69e96442016-11-19 00:58:54 +01002330
2331 chunk_reset(&trash);
2332
2333 switch (appctx->st2) {
2334 case STAT_ST_INIT:
2335 appctx->st2 = STAT_ST_LIST; /* let's start producing data */
2336 /* fall through */
2337
2338 case STAT_ST_LIST:
2339 if (LIST_ISEMPTY(&dns_resolvers)) {
2340 chunk_appendf(&trash, "No resolvers found\n");
2341 }
2342 else {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002343 list_for_each_entry(resolvers, &dns_resolvers, list) {
2344 if (appctx->ctx.cli.p0 != NULL && appctx->ctx.cli.p0 != resolvers)
William Lallemand69e96442016-11-19 00:58:54 +01002345 continue;
2346
Christopher Faulet67957bd2017-09-27 11:00:59 +02002347 chunk_appendf(&trash, "Resolvers section %s\n", resolvers->id);
2348 list_for_each_entry(ns, &resolvers->nameservers, list) {
2349 chunk_appendf(&trash, " nameserver %s:\n", ns->id);
2350 chunk_appendf(&trash, " sent: %lld\n", ns->counters.sent);
2351 chunk_appendf(&trash, " snd_error: %lld\n", ns->counters.snd_error);
2352 chunk_appendf(&trash, " valid: %lld\n", ns->counters.valid);
2353 chunk_appendf(&trash, " update: %lld\n", ns->counters.update);
2354 chunk_appendf(&trash, " cname: %lld\n", ns->counters.cname);
2355 chunk_appendf(&trash, " cname_error: %lld\n", ns->counters.cname_error);
2356 chunk_appendf(&trash, " any_err: %lld\n", ns->counters.any_err);
2357 chunk_appendf(&trash, " nx: %lld\n", ns->counters.nx);
2358 chunk_appendf(&trash, " timeout: %lld\n", ns->counters.timeout);
2359 chunk_appendf(&trash, " refused: %lld\n", ns->counters.refused);
2360 chunk_appendf(&trash, " other: %lld\n", ns->counters.other);
2361 chunk_appendf(&trash, " invalid: %lld\n", ns->counters.invalid);
2362 chunk_appendf(&trash, " too_big: %lld\n", ns->counters.too_big);
2363 chunk_appendf(&trash, " truncated: %lld\n", ns->counters.truncated);
2364 chunk_appendf(&trash, " outdated: %lld\n", ns->counters.outdated);
William Lallemand69e96442016-11-19 00:58:54 +01002365 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002366 chunk_appendf(&trash, "\n");
William Lallemand69e96442016-11-19 00:58:54 +01002367 }
2368 }
2369
2370 /* display response */
Willy Tarreau06d80a92017-10-19 14:32:15 +02002371 if (ci_putchk(si_ic(si), &trash) == -1) {
William Lallemand69e96442016-11-19 00:58:54 +01002372 /* let's try again later from this session. We add ourselves into
2373 * this session's users so that it can remove us upon termination.
2374 */
Willy Tarreaudb398432018-11-15 11:08:52 +01002375 si_rx_room_blk(si);
William Lallemand69e96442016-11-19 00:58:54 +01002376 return 0;
2377 }
William Lallemand69e96442016-11-19 00:58:54 +01002378 /* fall through */
2379
2380 default:
2381 appctx->st2 = STAT_ST_FIN;
2382 return 1;
2383 }
2384}
2385
2386/* register cli keywords */
Christopher Fauletff88efb2017-10-03 16:00:57 +02002387static struct cli_kw_list cli_kws = {{ }, {
2388 { { "show", "resolvers", NULL }, "show resolvers [id]: dumps counters from all resolvers section and\n"
2389 " associated name servers",
2390 cli_parse_stat_resolvers, cli_io_handler_dump_resolvers_to_buffer },
2391 {{},}
2392 }
2393};
William Lallemand69e96442016-11-19 00:58:54 +01002394
Willy Tarreau0108d902018-11-25 19:14:37 +01002395INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
William Lallemand69e96442016-11-19 00:58:54 +01002396
Baptiste Assmann333939c2019-01-21 08:34:50 +01002397/*
2398 * Prepare <rule> for hostname resolution.
2399 * Returns -1 in case of any allocation failure, 0 if not.
2400 * On error, a global failure counter is also incremented.
2401 */
2402static int action_prepare_for_resolution(struct stream *stream, const char *hostname)
2403{
2404 char *hostname_dn;
2405 int hostname_len, hostname_dn_len;
2406 struct buffer *tmp = get_trash_chunk();
2407
2408 if (!hostname)
2409 return 0;
2410
2411 hostname_len = strlen(hostname);
2412 hostname_dn = tmp->area;
2413 hostname_dn_len = dns_str_to_dn_label(hostname, hostname_len + 1,
2414 hostname_dn, tmp->size);
2415 if (hostname_dn_len == -1)
2416 goto err;
2417
2418
2419 stream->dns_ctx.hostname_dn = strdup(hostname_dn);
2420 stream->dns_ctx.hostname_dn_len = hostname_dn_len;
2421 if (!stream->dns_ctx.hostname_dn)
2422 goto err;
2423
2424 return 0;
2425
2426 err:
2427 free(stream->dns_ctx.hostname_dn); stream->dns_ctx.hostname_dn = NULL;
2428 dns_failed_resolutions += 1;
2429 return -1;
2430}
2431
2432
2433/*
2434 * Execute the "do-resolution" action. May be called from {tcp,http}request.
2435 */
2436enum act_return dns_action_do_resolve(struct act_rule *rule, struct proxy *px,
2437 struct session *sess, struct stream *s, int flags)
2438{
Baptiste Assmann333939c2019-01-21 08:34:50 +01002439 struct dns_resolution *resolution;
Willy Tarreau45726fd2019-07-17 10:38:45 +02002440 struct sample *smp;
2441 char *fqdn;
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002442 struct dns_requester *req;
2443 struct dns_resolvers *resolvers;
2444 struct dns_resolution *res;
Christopher Faulet5098a082020-07-22 11:46:32 +02002445 int exp, locked = 0;
2446 enum act_return ret = ACT_RET_CONT;
2447
2448 resolvers = rule->arg.dns.resolvers;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002449
2450 /* we have a response to our DNS resolution */
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002451 use_cache:
Baptiste Assmann333939c2019-01-21 08:34:50 +01002452 if (s->dns_ctx.dns_requester && s->dns_ctx.dns_requester->resolution != NULL) {
2453 resolution = s->dns_ctx.dns_requester->resolution;
Christopher Faulet5098a082020-07-22 11:46:32 +02002454 if (!locked) {
2455 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
2456 locked = 1;
2457 }
2458
Christopher Faulet385101e2020-07-28 10:21:54 +02002459 if (resolution->step == RSLV_STEP_RUNNING)
2460 goto yield;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002461 if (resolution->step == RSLV_STEP_NONE) {
2462 /* We update the variable only if we have a valid response. */
2463 if (resolution->status == RSLV_STATUS_VALID) {
2464 struct sample smp;
2465 short ip_sin_family = 0;
2466 void *ip = NULL;
2467
Christopher Fauleta4168432020-01-24 18:08:42 +01002468 dns_get_ip_from_response(&resolution->response, rule->arg.dns.dns_opts, NULL,
Baptiste Assmann333939c2019-01-21 08:34:50 +01002469 0, &ip, &ip_sin_family, NULL);
2470
2471 switch (ip_sin_family) {
2472 case AF_INET:
2473 smp.data.type = SMP_T_IPV4;
2474 memcpy(&smp.data.u.ipv4, ip, 4);
2475 break;
2476 case AF_INET6:
2477 smp.data.type = SMP_T_IPV6;
2478 memcpy(&smp.data.u.ipv6, ip, 16);
2479 break;
2480 default:
2481 ip = NULL;
2482 }
2483
2484 if (ip) {
2485 smp.px = px;
2486 smp.sess = sess;
2487 smp.strm = s;
2488
2489 vars_set_by_name(rule->arg.dns.varname, strlen(rule->arg.dns.varname), &smp);
2490 }
2491 }
2492 }
2493
Christopher Faulet385101e2020-07-28 10:21:54 +02002494 goto release_requester;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002495 }
2496
2497 /* need to configure and start a new DNS resolution */
Willy Tarreau45726fd2019-07-17 10:38:45 +02002498 smp = sample_fetch_as_type(px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.dns.expr, SMP_T_STR);
2499 if (smp == NULL)
Christopher Faulet5098a082020-07-22 11:46:32 +02002500 goto end;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002501
Willy Tarreau45726fd2019-07-17 10:38:45 +02002502 fqdn = smp->data.u.str.area;
2503 if (action_prepare_for_resolution(s, fqdn) == -1)
Christopher Faulet5098a082020-07-22 11:46:32 +02002504 goto end; /* on error, ignore the action */
Baptiste Assmann333939c2019-01-21 08:34:50 +01002505
Willy Tarreau45726fd2019-07-17 10:38:45 +02002506 s->dns_ctx.parent = rule;
Christopher Faulet5098a082020-07-22 11:46:32 +02002507
2508 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
2509 locked = 1;
2510
Willy Tarreau45726fd2019-07-17 10:38:45 +02002511 dns_link_resolution(s, OBJ_TYPE_STREAM, 0);
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002512
2513 /* Check if there is a fresh enough response in the cache of our associated resolution */
2514 req = s->dns_ctx.dns_requester;
Christopher Faulet385101e2020-07-28 10:21:54 +02002515 if (!req || !req->resolution)
2516 goto release_requester; /* on error, ignore the action */
Christopher Faulet5098a082020-07-22 11:46:32 +02002517 res = req->resolution;
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002518
2519 exp = tick_add(res->last_resolution, resolvers->hold.valid);
2520 if (resolvers->t && res->status == RSLV_STATUS_VALID && tick_isset(res->last_resolution)
Christopher Faulet385101e2020-07-28 10:21:54 +02002521 && !tick_is_expired(exp, now_ms)) {
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002522 goto use_cache;
2523 }
2524
Willy Tarreau45726fd2019-07-17 10:38:45 +02002525 dns_trigger_resolution(s->dns_ctx.dns_requester);
Christopher Faulet385101e2020-07-28 10:21:54 +02002526
2527 yield:
2528 if (flags & ACT_OPT_FINAL)
2529 goto release_requester;
Christopher Faulet5098a082020-07-22 11:46:32 +02002530 ret = ACT_RET_YIELD;
2531
2532 end:
2533 if (locked)
2534 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
2535 return ret;
Christopher Faulet385101e2020-07-28 10:21:54 +02002536
2537 release_requester:
2538 free(s->dns_ctx.hostname_dn);
2539 s->dns_ctx.hostname_dn = NULL;
2540 s->dns_ctx.hostname_dn_len = 0;
2541 if (s->dns_ctx.dns_requester) {
2542 dns_unlink_resolution(s->dns_ctx.dns_requester);
2543 pool_free(dns_requester_pool, s->dns_ctx.dns_requester);
2544 s->dns_ctx.dns_requester = NULL;
2545 }
2546 goto end;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002547}
2548
Christopher Faulet3b2bb632020-01-24 18:12:58 +01002549static void release_dns_action(struct act_rule *rule)
2550{
2551 release_sample_expr(rule->arg.dns.expr);
2552 free(rule->arg.dns.varname);
2553 free(rule->arg.dns.resolvers_id);
2554 free(rule->arg.dns.dns_opts);
2555}
2556
Baptiste Assmann333939c2019-01-21 08:34:50 +01002557
2558/* parse "do-resolve" action
2559 * This action takes the following arguments:
2560 * do-resolve(<varName>,<resolversSectionName>,<resolvePrefer>) <expr>
2561 *
2562 * - <varName> is the variable name where the result of the DNS resolution will be stored
2563 * (mandatory)
2564 * - <resolversSectionName> is the name of the resolvers section to use to perform the resolution
2565 * (mandatory)
2566 * - <resolvePrefer> can be either 'ipv4' or 'ipv6' and is the IP family we would like to resolve first
2567 * (optional), defaults to ipv6
2568 * - <expr> is an HAProxy expression used to fetch the name to be resolved
2569 */
2570enum act_parse_ret dns_parse_do_resolve(const char **args, int *orig_arg, struct proxy *px, struct act_rule *rule, char **err)
2571{
2572 int cur_arg;
2573 struct sample_expr *expr;
2574 unsigned int where;
2575 const char *beg, *end;
2576
2577 /* orig_arg points to the first argument, but we need to analyse the command itself first */
2578 cur_arg = *orig_arg - 1;
2579
2580 /* locate varName, which is mandatory */
2581 beg = strchr(args[cur_arg], '(');
2582 if (beg == NULL)
2583 goto do_resolve_parse_error;
2584 beg = beg + 1; /* beg should points to the first character after opening parenthesis '(' */
2585 end = strchr(beg, ',');
2586 if (end == NULL)
2587 goto do_resolve_parse_error;
2588 rule->arg.dns.varname = my_strndup(beg, end - beg);
2589 if (rule->arg.dns.varname == NULL)
2590 goto do_resolve_parse_error;
2591
2592
2593 /* locate resolversSectionName, which is mandatory.
2594 * Since next parameters are optional, the delimiter may be comma ','
2595 * or closing parenthesis ')'
2596 */
2597 beg = end + 1;
2598 end = strchr(beg, ',');
2599 if (end == NULL)
2600 end = strchr(beg, ')');
2601 if (end == NULL)
2602 goto do_resolve_parse_error;
2603 rule->arg.dns.resolvers_id = my_strndup(beg, end - beg);
2604 if (rule->arg.dns.resolvers_id == NULL)
2605 goto do_resolve_parse_error;
2606
2607
Christopher Fauleta4168432020-01-24 18:08:42 +01002608 rule->arg.dns.dns_opts = calloc(1, sizeof(*rule->arg.dns.dns_opts));
2609 if (rule->arg.dns.dns_opts == NULL)
2610 goto do_resolve_parse_error;
2611
Baptiste Assmann333939c2019-01-21 08:34:50 +01002612 /* Default priority is ipv6 */
Christopher Fauleta4168432020-01-24 18:08:42 +01002613 rule->arg.dns.dns_opts->family_prio = AF_INET6;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002614
2615 /* optional arguments accepted for now:
2616 * ipv4 or ipv6
2617 */
2618 while (*end != ')') {
2619 beg = end + 1;
2620 end = strchr(beg, ',');
2621 if (end == NULL)
2622 end = strchr(beg, ')');
2623 if (end == NULL)
2624 goto do_resolve_parse_error;
2625
2626 if (strncmp(beg, "ipv4", end - beg) == 0) {
Christopher Fauleta4168432020-01-24 18:08:42 +01002627 rule->arg.dns.dns_opts->family_prio = AF_INET;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002628 }
2629 else if (strncmp(beg, "ipv6", end - beg) == 0) {
Christopher Fauleta4168432020-01-24 18:08:42 +01002630 rule->arg.dns.dns_opts->family_prio = AF_INET6;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002631 }
2632 else {
2633 goto do_resolve_parse_error;
2634 }
2635 }
2636
2637 cur_arg = cur_arg + 1;
2638
Willy Tarreaue3b57bf2020-02-14 16:50:14 +01002639 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args, NULL);
Baptiste Assmann333939c2019-01-21 08:34:50 +01002640 if (!expr)
2641 goto do_resolve_parse_error;
2642
2643
2644 where = 0;
2645 if (px->cap & PR_CAP_FE)
2646 where |= SMP_VAL_FE_HRQ_HDR;
2647 if (px->cap & PR_CAP_BE)
2648 where |= SMP_VAL_BE_HRQ_HDR;
2649
2650 if (!(expr->fetch->val & where)) {
2651 memprintf(err,
2652 "fetch method '%s' extracts information from '%s', none of which is available here",
2653 args[cur_arg-1], sample_src_names(expr->fetch->use));
2654 free(expr);
2655 return ACT_RET_PRS_ERR;
2656 }
2657 rule->arg.dns.expr = expr;
2658 rule->action = ACT_CUSTOM;
2659 rule->action_ptr = dns_action_do_resolve;
2660 *orig_arg = cur_arg;
2661
2662 rule->check_ptr = check_action_do_resolve;
Christopher Faulet3b2bb632020-01-24 18:12:58 +01002663 rule->release_ptr = release_dns_action;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002664
2665 return ACT_RET_PRS_OK;
2666
2667 do_resolve_parse_error:
2668 free(rule->arg.dns.varname); rule->arg.dns.varname = NULL;
2669 free(rule->arg.dns.resolvers_id); rule->arg.dns.resolvers_id = NULL;
2670 memprintf(err, "Can't parse '%s'. Expects 'do-resolve(<varname>,<resolvers>[,<options>]) <expr>'. Available options are 'ipv4' and 'ipv6'",
2671 args[cur_arg]);
2672 return ACT_RET_PRS_ERR;
2673}
2674
2675static struct action_kw_list http_req_kws = { { }, {
2676 { "do-resolve", dns_parse_do_resolve, 1 },
2677 { /* END */ }
2678}};
2679
2680INITCALL1(STG_REGISTER, http_req_keywords_register, &http_req_kws);
2681
2682static struct action_kw_list tcp_req_cont_actions = {ILH, {
2683 { "do-resolve", dns_parse_do_resolve, 1 },
2684 { /* END */ }
2685}};
2686
2687INITCALL1(STG_REGISTER, tcp_req_cont_keywords_register, &tcp_req_cont_actions);
2688
2689/* Check an "http-request do-resolve" action.
2690 *
2691 * The function returns 1 in success case, otherwise, it returns 0 and err is
2692 * filled.
2693 */
2694int check_action_do_resolve(struct act_rule *rule, struct proxy *px, char **err)
2695{
2696 struct dns_resolvers *resolvers = NULL;
2697
2698 if (rule->arg.dns.resolvers_id == NULL) {
2699 memprintf(err,"Proxy '%s': %s", px->id, "do-resolve action without resolvers");
2700 return 0;
2701 }
2702
2703 resolvers = find_resolvers_by_id(rule->arg.dns.resolvers_id);
2704 if (resolvers == NULL) {
2705 memprintf(err,"Can't find resolvers section '%s' for do-resolve action", rule->arg.dns.resolvers_id);
2706 return 0;
2707 }
2708 rule->arg.dns.resolvers = resolvers;
2709
2710 return 1;
2711}
2712
Willy Tarreau172f5ce2018-11-26 11:21:50 +01002713REGISTER_POST_DEINIT(dns_deinit);
Willy Tarreaue6552512018-11-26 11:33:13 +01002714REGISTER_CONFIG_POSTPARSER("dns runtime resolver", dns_finalize_config);