blob: 6e726bf961cd00bf4eef74acb93457425d3a826e [file] [log] [blame]
Baptiste Assmann325137d2015-04-13 23:40:55 +02001/*
2 * Name server resolution
3 *
4 * Copyright 2014 Baptiste Assmann <bedis9@gmail.com>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <errno.h>
14#include <fcntl.h>
15#include <stdio.h>
16#include <stdlib.h>
17#include <string.h>
18#include <unistd.h>
19
20#include <sys/types.h>
21
Baptiste Assmann044fd5b2018-08-10 10:56:38 +020022#include <common/cfgparse.h>
Christopher Faulet67957bd2017-09-27 11:00:59 +020023#include <common/errors.h>
Willy Tarreau0108d902018-11-25 19:14:37 +010024#include <common/initcall.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020025#include <common/time.h>
26#include <common/ticks.h>
Olivier Houchard8da5f982017-08-04 18:35:36 +020027#include <common/net_helper.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020028
Baptiste Assmann333939c2019-01-21 08:34:50 +010029#include <types/action.h>
William Lallemand69e96442016-11-19 00:58:54 +010030#include <types/applet.h>
31#include <types/cli.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020032#include <types/global.h>
33#include <types/dns.h>
William Lallemand69e96442016-11-19 00:58:54 +010034#include <types/stats.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020035
Baptiste Assmann333939c2019-01-21 08:34:50 +010036#include <proto/action.h>
William Lallemand69e96442016-11-19 00:58:54 +010037#include <proto/channel.h>
38#include <proto/cli.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020039#include <proto/checks.h>
40#include <proto/dns.h>
41#include <proto/fd.h>
Christopher Fauletfc9cfe42019-07-16 14:54:53 +020042#include <proto/http_ana.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010043#include <proto/http_rules.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020044#include <proto/log.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010045#include <proto/sample.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020046#include <proto/server.h>
47#include <proto/task.h>
48#include <proto/proto_udp.h>
Christopher Faulet67957bd2017-09-27 11:00:59 +020049#include <proto/proxy.h>
William Lallemand69e96442016-11-19 00:58:54 +010050#include <proto/stream_interface.h>
Baptiste Assmann333939c2019-01-21 08:34:50 +010051#include <proto/tcp_rules.h>
52#include <proto/vars.h>
Baptiste Assmann325137d2015-04-13 23:40:55 +020053
Christopher Faulet67957bd2017-09-27 11:00:59 +020054struct list dns_resolvers = LIST_HEAD_INIT(dns_resolvers);
55struct list dns_srvrq_list = LIST_HEAD_INIT(dns_srvrq_list);
Baptiste Assmann325137d2015-04-13 23:40:55 +020056
Christopher Fauletb2812a62017-10-04 16:17:58 +020057static THREAD_LOCAL int64_t dns_query_id_seed = 0; /* random seed */
Willy Tarreau8ceae722018-11-26 11:58:30 +010058
59DECLARE_STATIC_POOL(dns_answer_item_pool, "dns_answer_item", sizeof(struct dns_answer_item));
60DECLARE_STATIC_POOL(dns_resolution_pool, "dns_resolution", sizeof(struct dns_resolution));
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +010061DECLARE_POOL(dns_requester_pool, "dns_requester", sizeof(struct dns_requester));
Willy Tarreau8ceae722018-11-26 11:58:30 +010062
Christopher Faulet67957bd2017-09-27 11:00:59 +020063static unsigned int resolution_uuid = 1;
Baptiste Assmann333939c2019-01-21 08:34:50 +010064unsigned int dns_failed_resolutions = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020065
Christopher Faulet67957bd2017-09-27 11:00:59 +020066/* Returns a pointer to the resolvers matching the id <id>. NULL is returned if
67 * no match is found.
Baptiste Assmann325137d2015-04-13 23:40:55 +020068 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020069struct dns_resolvers *find_resolvers_by_id(const char *id)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020070{
Christopher Faulet67957bd2017-09-27 11:00:59 +020071 struct dns_resolvers *res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020072
Christopher Faulet67957bd2017-09-27 11:00:59 +020073 list_for_each_entry(res, &dns_resolvers, list) {
74 if (!strcmp(res->id, id))
75 return res;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020076 }
Christopher Faulet67957bd2017-09-27 11:00:59 +020077 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020078}
79
Christopher Faulet67957bd2017-09-27 11:00:59 +020080/* Returns a pointer on the SRV request matching the name <name> for the proxy
81 * <px>. NULL is returned if no match is found.
Baptiste Assmann201c07f2017-05-22 15:17:15 +020082 */
Christopher Faulet67957bd2017-09-27 11:00:59 +020083struct dns_srvrq *find_srvrq_by_name(const char *name, struct proxy *px)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020084{
Christopher Faulet67957bd2017-09-27 11:00:59 +020085 struct dns_srvrq *srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020086
Christopher Faulet67957bd2017-09-27 11:00:59 +020087 list_for_each_entry(srvrq, &dns_srvrq_list, list) {
88 if (srvrq->proxy == px && !strcmp(srvrq->name, name))
89 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020090 }
Christopher Faulet67957bd2017-09-27 11:00:59 +020091 return NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +020092}
93
Christopher Faulet67957bd2017-09-27 11:00:59 +020094/* Allocates a new SRVRQ for the given server with the name <fqdn>. It returns
95 * NULL if an error occurred. */
96struct dns_srvrq *new_dns_srvrq(struct server *srv, char *fqdn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +020097{
Christopher Faulet67957bd2017-09-27 11:00:59 +020098 struct proxy *px = srv->proxy;
99 struct dns_srvrq *srvrq = NULL;
100 int fqdn_len, hostname_dn_len;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200101
Christopher Faulet67957bd2017-09-27 11:00:59 +0200102 fqdn_len = strlen(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200103 hostname_dn_len = dns_str_to_dn_label(fqdn, fqdn_len + 1, trash.area,
104 trash.size);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200105 if (hostname_dn_len == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100106 ha_alert("config : %s '%s', server '%s': failed to parse FQDN '%s'\n",
107 proxy_type_str(px), px->id, srv->id, fqdn);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200108 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200109 }
110
Christopher Faulet67957bd2017-09-27 11:00:59 +0200111 if ((srvrq = calloc(1, sizeof(*srvrq))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100112 ha_alert("config : %s '%s', server '%s': out of memory\n",
113 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200114 goto err;
115 }
116 srvrq->obj_type = OBJ_TYPE_SRVRQ;
117 srvrq->proxy = px;
118 srvrq->name = strdup(fqdn);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200119 srvrq->hostname_dn = strdup(trash.area);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200120 srvrq->hostname_dn_len = hostname_dn_len;
121 if (!srvrq->name || !srvrq->hostname_dn) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100122 ha_alert("config : %s '%s', server '%s': out of memory\n",
123 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200124 goto err;
125 }
126 LIST_ADDQ(&dns_srvrq_list, &srvrq->list);
127 return srvrq;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200128
Christopher Faulet67957bd2017-09-27 11:00:59 +0200129 err:
130 if (srvrq) {
131 free(srvrq->name);
132 free(srvrq->hostname_dn);
133 free(srvrq);
134 }
135 return NULL;
136}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200137
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200138
Christopher Faulet67957bd2017-09-27 11:00:59 +0200139/* 2 bytes random generator to generate DNS query ID */
140static inline uint16_t dns_rnd16(void)
141{
Christopher Fauletb2812a62017-10-04 16:17:58 +0200142 if (!dns_query_id_seed)
143 dns_query_id_seed = now_ms;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200144 dns_query_id_seed ^= dns_query_id_seed << 13;
145 dns_query_id_seed ^= dns_query_id_seed >> 7;
146 dns_query_id_seed ^= dns_query_id_seed << 17;
147 return dns_query_id_seed;
148}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200149
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200150
Christopher Faulet67957bd2017-09-27 11:00:59 +0200151static inline int dns_resolution_timeout(struct dns_resolution *res)
152{
Baptiste Assmannf50e1ac2019-11-07 11:02:18 +0100153 return res->resolvers->timeout.resolve;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200154}
155
Christopher Faulet67957bd2017-09-27 11:00:59 +0200156/* Updates a resolvers' task timeout for next wake up and queue it */
157static void dns_update_resolvers_timeout(struct dns_resolvers *resolvers)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200158{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200159 struct dns_resolution *res;
160 int next;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200161
Christopher Faulet67957bd2017-09-27 11:00:59 +0200162 next = tick_add(now_ms, resolvers->timeout.resolve);
163 if (!LIST_ISEMPTY(&resolvers->resolutions.curr)) {
164 res = LIST_NEXT(&resolvers->resolutions.curr, struct dns_resolution *, list);
165 next = MIN(next, tick_add(res->last_query, resolvers->timeout.retry));
166 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200167
Christopher Faulet67957bd2017-09-27 11:00:59 +0200168 list_for_each_entry(res, &resolvers->resolutions.wait, list)
169 next = MIN(next, tick_add(res->last_resolution, dns_resolution_timeout(res)));
Baptiste Assmann325137d2015-04-13 23:40:55 +0200170
Christopher Faulet67957bd2017-09-27 11:00:59 +0200171 resolvers->t->expire = next;
172 task_queue(resolvers->t);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200173}
174
Christopher Faulet67957bd2017-09-27 11:00:59 +0200175/* Opens an UDP socket on the namesaver's IP/Port, if required. Returns 0 on
176 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200177 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200178static int dns_connect_namesaver(struct dns_nameserver *ns)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200179{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200180 struct dgram_conn *dgram = ns->dgram;
181 int fd;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200182
Christopher Faulet67957bd2017-09-27 11:00:59 +0200183 /* Already connected */
184 if (dgram->t.sock.fd != -1)
185 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200186
Christopher Faulet67957bd2017-09-27 11:00:59 +0200187 /* Create an UDP socket and connect it on the nameserver's IP/Port */
188 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
189 send_log(NULL, LOG_WARNING,
190 "DNS : resolvers '%s': can't create socket for nameserver '%s'.\n",
191 ns->resolvers->id, ns->id);
192 return -1;
193 }
194 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
195 send_log(NULL, LOG_WARNING,
196 "DNS : resolvers '%s': can't connect socket for nameserver '%s'.\n",
197 ns->resolvers->id, ns->id);
198 close(fd);
199 return -1;
200 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200201
Christopher Faulet67957bd2017-09-27 11:00:59 +0200202 /* Make the socket non blocking */
203 fcntl(fd, F_SETFL, O_NONBLOCK);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200204
Christopher Faulet67957bd2017-09-27 11:00:59 +0200205 /* Add the fd in the fd list and update its parameters */
206 dgram->t.sock.fd = fd;
Willy Tarreaua9786b62018-01-25 07:22:13 +0100207 fd_insert(fd, dgram, dgram_fd_handler, MAX_THREADS_MASK);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200208 fd_want_recv(fd);
209 return 0;
210}
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200211
Christopher Faulet67957bd2017-09-27 11:00:59 +0200212/* Forges a DNS query. It needs the following information from the caller:
213 * - <query_id> : the DNS query id corresponding to this query
214 * - <query_type> : DNS_RTYPE_* request DNS record type (A, AAAA, ANY...)
215 * - <hostname_dn> : hostname in domain name format
216 * - <hostname_dn_len> : length of <hostname_dn>
217 *
218 * To store the query, the caller must pass a buffer <buf> and its size
219 * <bufsize>. It returns the number of written bytes in success, -1 if <buf> is
220 * too short.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200221 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200222static int dns_build_query(int query_id, int query_type, unsigned int accepted_payload_size,
223 char *hostname_dn, int hostname_dn_len, char *buf, int bufsize)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200224{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200225 struct dns_header dns_hdr;
226 struct dns_question qinfo;
227 struct dns_additional_record edns;
228 char *p = buf;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200229
Christopher Faulet67957bd2017-09-27 11:00:59 +0200230 if (sizeof(dns_hdr) + sizeof(qinfo) + sizeof(edns) + hostname_dn_len >= bufsize)
231 return -1;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200232
Christopher Faulet67957bd2017-09-27 11:00:59 +0200233 memset(buf, 0, bufsize);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +0200234
Christopher Faulet67957bd2017-09-27 11:00:59 +0200235 /* Set dns query headers */
236 dns_hdr.id = (unsigned short) htons(query_id);
237 dns_hdr.flags = htons(0x0100); /* qr=0, opcode=0, aa=0, tc=0, rd=1, ra=0, z=0, rcode=0 */
238 dns_hdr.qdcount = htons(1); /* 1 question */
239 dns_hdr.ancount = 0;
240 dns_hdr.nscount = 0;
241 dns_hdr.arcount = htons(1);
242 memcpy(p, &dns_hdr, sizeof(dns_hdr));
243 p += sizeof(dns_hdr);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200244
Christopher Faulet67957bd2017-09-27 11:00:59 +0200245 /* Set up query hostname */
246 memcpy(p, hostname_dn, hostname_dn_len);
247 p += hostname_dn_len;
248 *p++ = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200249
Christopher Faulet67957bd2017-09-27 11:00:59 +0200250 /* Set up query info (type and class) */
251 qinfo.qtype = htons(query_type);
252 qinfo.qclass = htons(DNS_RCLASS_IN);
253 memcpy(p, &qinfo, sizeof(qinfo));
254 p += sizeof(qinfo);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200255
Christopher Faulet67957bd2017-09-27 11:00:59 +0200256 /* Set the DNS extension */
257 edns.name = 0;
258 edns.type = htons(DNS_RTYPE_OPT);
259 edns.udp_payload_size = htons(accepted_payload_size);
260 edns.extension = 0;
261 edns.data_length = 0;
262 memcpy(p, &edns, sizeof(edns));
263 p += sizeof(edns);
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200264
Christopher Faulet67957bd2017-09-27 11:00:59 +0200265 return (p - buf);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200266}
267
Christopher Faulet67957bd2017-09-27 11:00:59 +0200268/* Sends a DNS query to resolvers associated to a resolution. It returns 0 on
269 * success, -1 otherwise.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200270 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200271static int dns_send_query(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200272{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200273 struct dns_resolvers *resolvers = resolution->resolvers;
274 struct dns_nameserver *ns;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200275
Christopher Faulet67957bd2017-09-27 11:00:59 +0200276 list_for_each_entry(ns, &resolvers->nameservers, list) {
277 int fd = ns->dgram->t.sock.fd;
278 if (fd == -1) {
279 if (dns_connect_namesaver(ns) == -1)
280 continue;
281 fd = ns->dgram->t.sock.fd;
282 resolvers->nb_nameservers++;
283 }
284 fd_want_send(fd);
285 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200286
Christopher Faulet67957bd2017-09-27 11:00:59 +0200287 /* Update resolution */
288 resolution->nb_queries = 0;
289 resolution->nb_responses = 0;
290 resolution->last_query = now_ms;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200291
Christopher Faulet67957bd2017-09-27 11:00:59 +0200292 /* Push the resolution at the end of the active list */
293 LIST_DEL(&resolution->list);
294 LIST_ADDQ(&resolvers->resolutions.curr, &resolution->list);
295 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200296}
297
Christopher Faulet67957bd2017-09-27 11:00:59 +0200298/* Prepares and sends a DNS resolution. It returns 1 if the query was sent, 0 if
299 * skipped and -1 if an error occurred.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200300 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200301static int
302dns_run_resolution(struct dns_resolution *resolution)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200303{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200304 struct dns_resolvers *resolvers = resolution->resolvers;
305 int query_id, i;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200306
Christopher Faulet67957bd2017-09-27 11:00:59 +0200307 /* Avoid sending requests for resolutions that don't yet have an
308 * hostname, ie resolutions linked to servers that do not yet have an
309 * fqdn */
310 if (!resolution->hostname_dn)
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200311 return 0;
312
Christopher Faulet67957bd2017-09-27 11:00:59 +0200313 /* Check if a resolution has already been started for this server return
314 * directly to avoid resolution pill up. */
315 if (resolution->step != RSLV_STEP_NONE)
316 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200317
Christopher Faulet67957bd2017-09-27 11:00:59 +0200318 /* Generates a new query id. We try at most 100 times to find a free
319 * query id */
320 for (i = 0; i < 100; ++i) {
321 query_id = dns_rnd16();
322 if (!eb32_lookup(&resolvers->query_ids, query_id))
Olivier Houchard8da5f982017-08-04 18:35:36 +0200323 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200324 query_id = -1;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200325 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200326 if (query_id == -1) {
327 send_log(NULL, LOG_NOTICE,
328 "could not generate a query id for %s, in resolvers %s.\n",
329 resolution->hostname_dn, resolvers->id);
330 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200331 }
332
Christopher Faulet67957bd2017-09-27 11:00:59 +0200333 /* Update resolution parameters */
334 resolution->query_id = query_id;
335 resolution->qid.key = query_id;
336 resolution->step = RSLV_STEP_RUNNING;
337 resolution->query_type = resolution->prefered_query_type;
338 resolution->try = resolvers->resolve_retries;
339 eb32_insert(&resolvers->query_ids, &resolution->qid);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200340
Christopher Faulet67957bd2017-09-27 11:00:59 +0200341 /* Send the DNS query */
342 resolution->try -= 1;
343 dns_send_query(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200344 return 1;
345}
346
Christopher Faulet67957bd2017-09-27 11:00:59 +0200347/* Performs a name resolution for the requester <req> */
348void dns_trigger_resolution(struct dns_requester *req)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200349{
Christopher Faulet67957bd2017-09-27 11:00:59 +0200350 struct dns_resolvers *resolvers;
351 struct dns_resolution *res;
352 int exp;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200353
Christopher Faulet67957bd2017-09-27 11:00:59 +0200354 if (!req || !req->resolution)
355 return;
356 res = req->resolution;
357 resolvers = res->resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200358
Christopher Faulet67957bd2017-09-27 11:00:59 +0200359 /* The resolution must not be triggered yet. Use the cached response, if
360 * valid */
361 exp = tick_add(res->last_resolution, resolvers->hold.valid);
Olivier Houchardf3d9e602018-05-22 18:40:07 +0200362 if (resolvers->t && (res->status != RSLV_STATUS_VALID ||
363 !tick_isset(res->last_resolution) || tick_is_expired(exp, now_ms)))
364 task_wakeup(resolvers->t, TASK_WOKEN_OTHER);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200365}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200366
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200367
Christopher Faulet67957bd2017-09-27 11:00:59 +0200368/* Resets some resolution parameters to initial values and also delete the query
369 * ID from the resolver's tree.
370 */
371static void dns_reset_resolution(struct dns_resolution *resolution)
372{
373 /* update resolution status */
374 resolution->step = RSLV_STEP_NONE;
375 resolution->try = 0;
376 resolution->last_resolution = now_ms;
377 resolution->nb_queries = 0;
378 resolution->nb_responses = 0;
379 resolution->query_type = resolution->prefered_query_type;
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200380
Christopher Faulet67957bd2017-09-27 11:00:59 +0200381 /* clean up query id */
382 eb32_delete(&resolution->qid);
383 resolution->query_id = 0;
384 resolution->qid.key = 0;
385}
Baptiste Assmann201c07f2017-05-22 15:17:15 +0200386
Christopher Faulet67957bd2017-09-27 11:00:59 +0200387/* Returns the query id contained in a DNS response */
388static inline unsigned short dns_response_get_query_id(unsigned char *resp)
389{
390 return resp[0] * 256 + resp[1];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200391}
392
Christopher Faulet67957bd2017-09-27 11:00:59 +0200393
394/* Analyses, re-builds and copies the name <name> from the DNS response packet
395 * <buffer>. <name> must point to the 'data_len' information or pointer 'c0'
396 * for compressed data. The result is copied into <dest>, ensuring we don't
397 * overflow using <dest_len> Returns the number of bytes the caller can move
398 * forward. If 0 it means an error occurred while parsing the name. <offset> is
399 * the number of bytes the caller could move forward.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200400 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200401int dns_read_name(unsigned char *buffer, unsigned char *bufend,
402 unsigned char *name, char *destination, int dest_len,
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100403 int *offset, unsigned int depth)
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200404{
405 int nb_bytes = 0, n = 0;
406 int label_len;
407 unsigned char *reader = name;
408 char *dest = destination;
409
410 while (1) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100411 if (reader >= bufend)
412 goto err;
413
Christopher Faulet67957bd2017-09-27 11:00:59 +0200414 /* Name compression is in use */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200415 if ((*reader & 0xc0) == 0xc0) {
Remi Gacogne2d19fbc2018-12-05 17:55:10 +0100416 if (reader + 1 >= bufend)
417 goto err;
418
Christopher Faulet67957bd2017-09-27 11:00:59 +0200419 /* Must point BEFORE current position */
420 if ((buffer + reader[1]) > reader)
421 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200422
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100423 if (depth++ > 100)
424 goto err;
425
Nikhil Agrawal2fa66c32018-12-20 10:50:59 +0530426 n = dns_read_name(buffer, bufend, buffer + (*reader & 0x3f)*256 + reader[1],
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100427 dest, dest_len - nb_bytes, offset, depth);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200428 if (n == 0)
Christopher Faulet67957bd2017-09-27 11:00:59 +0200429 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200430
Christopher Faulet67957bd2017-09-27 11:00:59 +0200431 dest += n;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200432 nb_bytes += n;
433 goto out;
434 }
435
436 label_len = *reader;
437 if (label_len == 0)
438 goto out;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200439
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200440 /* Check if:
441 * - we won't read outside the buffer
442 * - there is enough place in the destination
443 */
444 if ((reader + label_len >= bufend) || (nb_bytes + label_len >= dest_len))
Christopher Faulet67957bd2017-09-27 11:00:59 +0200445 goto err;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200446
447 /* +1 to take label len + label string */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200448 label_len++;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200449
450 memcpy(dest, reader, label_len);
451
Christopher Faulet67957bd2017-09-27 11:00:59 +0200452 dest += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200453 nb_bytes += label_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200454 reader += label_len;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200455 }
456
Christopher Faulet67957bd2017-09-27 11:00:59 +0200457 out:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200458 /* offset computation:
459 * parse from <name> until finding either NULL or a pointer "c0xx"
460 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200461 reader = name;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200462 *offset = 0;
463 while (reader < bufend) {
464 if ((reader[0] & 0xc0) == 0xc0) {
465 *offset += 2;
466 break;
467 }
468 else if (*reader == 0) {
469 *offset += 1;
470 break;
471 }
472 *offset += 1;
473 ++reader;
474 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200475 return nb_bytes;
476
Christopher Faulet67957bd2017-09-27 11:00:59 +0200477 err:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200478 return 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200479}
480
Christopher Faulet67957bd2017-09-27 11:00:59 +0200481/* Checks for any obsolete record, also identify any SRV request, and try to
482 * find a corresponding server.
483*/
484static void dns_check_dns_response(struct dns_resolution *res)
485{
486 struct dns_resolvers *resolvers = res->resolvers;
487 struct dns_requester *req, *reqback;
488 struct dns_answer_item *item, *itemback;
489 struct server *srv;
490 struct dns_srvrq *srvrq;
491
492 list_for_each_entry_safe(item, itemback, &res->response.answer_list, list) {
493
494 /* Remove obsolete items */
495 if ((item->last_seen + resolvers->hold.obsolete / 1000) < now.tv_sec) {
496 if (item->type != DNS_RTYPE_SRV)
497 goto rm_obselete_item;
498
499 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
500 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
501 continue;
502
503 /* Remove any associated server */
504 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100505 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200506 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
507 item->data_len == srv->hostname_dn_len &&
508 !memcmp(srv->hostname_dn, item->target, item->data_len)) {
509 snr_update_srv_status(srv, 1);
510 free(srv->hostname);
511 free(srv->hostname_dn);
512 srv->hostname = NULL;
513 srv->hostname_dn = NULL;
514 srv->hostname_dn_len = 0;
515 dns_unlink_resolution(srv->dns_requester);
516 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100517 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200518 }
519 }
520
521 rm_obselete_item:
522 LIST_DEL(&item->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +0100523 pool_free(dns_answer_item_pool, item);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200524 continue;
525 }
526
527 if (item->type != DNS_RTYPE_SRV)
528 continue;
529
530 /* Now process SRV records */
531 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
532 if ((srvrq = objt_dns_srvrq(req->owner)) == NULL)
533 continue;
534
535 /* Check if a server already uses that hostname */
536 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100537 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200538 if (srv->srvrq == srvrq && srv->svc_port == item->port &&
539 item->data_len == srv->hostname_dn_len &&
Daniel Corbettf8716912019-11-17 09:48:56 -0500540 !memcmp(srv->hostname_dn, item->target, item->data_len) &&
541 !srv->dns_opts.ignore_weight) {
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100542 int ha_weight;
543
Baptiste Assmann25e6fc22019-10-21 15:13:48 +0200544 /* DNS weight range if from 0 to 65535
545 * HAProxy weight is from 0 to 256
546 * The rule below ensures that weight 0 is well respected
547 * while allowing a "mapping" from DNS weight into HAProxy's one.
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100548 */
Baptiste Assmann25e6fc22019-10-21 15:13:48 +0200549 ha_weight = (item->weight + 255) / 256;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100550 if (srv->uweight != ha_weight) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200551 char weight[9];
552
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100553 snprintf(weight, sizeof(weight), "%d", ha_weight);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200554 server_parse_weight_change_request(srv, weight);
555 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100556 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200557 break;
558 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100559 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200560 }
561 if (srv)
562 continue;
563
564 /* If not, try to find a server with undefined hostname */
565 for (srv = srvrq->proxy->srv; srv != NULL; srv = srv->next) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100566 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200567 if (srv->srvrq == srvrq && !srv->hostname_dn)
568 break;
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100569 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200570 }
571 /* And update this server, if found */
572 if (srv) {
573 const char *msg = NULL;
574 char weight[9];
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100575 int ha_weight;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200576 char hostname[DNS_MAX_NAME_SIZE];
577
578 if (dns_dn_label_to_str(item->target, item->data_len+1,
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100579 hostname, DNS_MAX_NAME_SIZE) == -1) {
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100580 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200581 continue;
Olivier Houchard55dcdf42017-11-06 15:15:04 +0100582 }
Olivier Houchardd16bfe62017-10-31 15:21:19 +0100583 msg = update_server_fqdn(srv, hostname, "SRV record", 1);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200584 if (msg)
585 send_log(srv->proxy, LOG_NOTICE, "%s", msg);
586
587 srv->svc_port = item->port;
588 srv->flags &= ~SRV_F_MAPPORTS;
589 if ((srv->check.state & CHK_ST_CONFIGURED) &&
590 !(srv->flags & SRV_F_CHECKPORT))
591 srv->check.port = item->port;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100592
Daniel Corbettf8716912019-11-17 09:48:56 -0500593 if (!srv->dns_opts.ignore_weight) {
594 /* DNS weight range if from 0 to 65535
595 * HAProxy weight is from 0 to 256
596 * The rule below ensures that weight 0 is well respected
597 * while allowing a "mapping" from DNS weight into HAProxy's one.
598 */
599 ha_weight = (item->weight + 255) / 256;
Olivier Houchard2ec2db92018-01-08 16:28:57 +0100600
Daniel Corbettf8716912019-11-17 09:48:56 -0500601 snprintf(weight, sizeof(weight), "%d", ha_weight);
602 server_parse_weight_change_request(srv, weight);
603 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100604 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200605 }
606 }
607 }
608}
609
610/* Validates that the buffer DNS response provided in <resp> and finishing
611 * before <bufend> is valid from a DNS protocol point of view.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200612 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200613 * The result is stored in <resolution>' response, buf_response,
614 * response_query_records and response_answer_records members.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200615 *
616 * This function returns one of the DNS_RESP_* code to indicate the type of
617 * error found.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200618 */
Christopher Faulet67957bd2017-09-27 11:00:59 +0200619static int dns_validate_dns_response(unsigned char *resp, unsigned char *bufend,
620 struct dns_resolution *resolution, int max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200621{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200622 unsigned char *reader;
623 char *previous_dname, tmpname[DNS_MAX_NAME_SIZE];
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200624 int len, flags, offset;
625 int dns_query_record_id;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200626 int nb_saved_records;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200627 struct dns_query_item *dns_query;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200628 struct dns_answer_item *dns_answer_record, *tmp_record;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200629 struct dns_response_packet *dns_p;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200630 int i, found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200631
Christopher Faulet67957bd2017-09-27 11:00:59 +0200632 reader = resp;
633 len = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200634 previous_dname = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200635 dns_query = NULL;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200636
Christopher Faulet67957bd2017-09-27 11:00:59 +0200637 /* Initialization of response buffer and structure */
Baptiste Assmann729c9012017-05-22 15:13:10 +0200638 dns_p = &resolution->response;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200639
640 /* query id */
641 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200642 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200643 dns_p->header.id = reader[0] * 256 + reader[1];
644 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200645
Christopher Faulet67957bd2017-09-27 11:00:59 +0200646 /* Flags and rcode are stored over 2 bytes
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200647 * First byte contains:
648 * - response flag (1 bit)
649 * - opcode (4 bits)
650 * - authoritative (1 bit)
651 * - truncated (1 bit)
652 * - recursion desired (1 bit)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200653 */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200654 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200655 return DNS_RESP_INVALID;
656
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200657 flags = reader[0] * 256 + reader[1];
658
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200659 if ((flags & DNS_FLAG_REPLYCODE) != DNS_RCODE_NO_ERROR) {
660 if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_NX_DOMAIN)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200661 return DNS_RESP_NX_DOMAIN;
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200662 else if ((flags & DNS_FLAG_REPLYCODE) == DNS_RCODE_REFUSED)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200663 return DNS_RESP_REFUSED;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200664 return DNS_RESP_ERROR;
665 }
666
Christopher Faulet67957bd2017-09-27 11:00:59 +0200667 /* Move forward 2 bytes for flags */
Baptiste Assmann3440f0d2015-09-02 22:08:38 +0200668 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200669
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200670 /* 2 bytes for question count */
671 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200672 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200673 dns_p->header.qdcount = reader[0] * 256 + reader[1];
Christopher Faulet67957bd2017-09-27 11:00:59 +0200674 /* (for now) we send one query only, so we expect only one in the
675 * response too */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200676 if (dns_p->header.qdcount != 1)
677 return DNS_RESP_QUERY_COUNT_ERROR;
678 if (dns_p->header.qdcount > DNS_MAX_QUERY_RECORDS)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200679 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200680 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200681
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200682 /* 2 bytes for answer count */
683 if (reader + 2 >= bufend)
684 return DNS_RESP_INVALID;
685 dns_p->header.ancount = reader[0] * 256 + reader[1];
686 if (dns_p->header.ancount == 0)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200687 return DNS_RESP_ANCOUNT_ZERO;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200688 /* Check if too many records are announced */
Baptiste Assmann9d8dbbc2017-08-18 23:35:08 +0200689 if (dns_p->header.ancount > max_answer_records)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200690 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200691 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200692
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200693 /* 2 bytes authority count */
694 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200695 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200696 dns_p->header.nscount = reader[0] * 256 + reader[1];
697 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200698
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200699 /* 2 bytes additional count */
700 if (reader + 2 >= bufend)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200701 return DNS_RESP_INVALID;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200702 dns_p->header.arcount = reader[0] * 256 + reader[1];
703 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200704
Christopher Faulet67957bd2017-09-27 11:00:59 +0200705 /* Parsing dns queries */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200706 LIST_INIT(&dns_p->query_list);
707 for (dns_query_record_id = 0; dns_query_record_id < dns_p->header.qdcount; dns_query_record_id++) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200708 /* Use next pre-allocated dns_query_item after ensuring there is
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200709 * still one available.
Christopher Faulet67957bd2017-09-27 11:00:59 +0200710 * It's then added to our packet query list. */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200711 if (dns_query_record_id > DNS_MAX_QUERY_RECORDS)
712 return DNS_RESP_INVALID;
Baptiste Assmann729c9012017-05-22 15:13:10 +0200713 dns_query = &resolution->response_query_records[dns_query_record_id];
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200714 LIST_ADDQ(&dns_p->query_list, &dns_query->list);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200715
Christopher Faulet67957bd2017-09-27 11:00:59 +0200716 /* Name is a NULL terminated string in our case, since we have
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200717 * one query per response and the first one can't be compressed
Christopher Faulet67957bd2017-09-27 11:00:59 +0200718 * (using the 0x0c format) */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200719 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100720 len = dns_read_name(resp, bufend, reader, dns_query->name, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200721
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200722 if (len == 0)
723 return DNS_RESP_INVALID;
724
725 reader += offset;
726 previous_dname = dns_query->name;
727
728 /* move forward 2 bytes for question type */
729 if (reader + 2 >= bufend)
730 return DNS_RESP_INVALID;
731 dns_query->type = reader[0] * 256 + reader[1];
732 reader += 2;
733
734 /* move forward 2 bytes for question class */
735 if (reader + 2 >= bufend)
736 return DNS_RESP_INVALID;
737 dns_query->class = reader[0] * 256 + reader[1];
738 reader += 2;
739 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200740
Baptiste Assmann251abb92017-08-11 09:58:27 +0200741 /* TRUNCATED flag must be checked after we could read the query type
Christopher Faulet67957bd2017-09-27 11:00:59 +0200742 * because a TRUNCATED SRV query type response can still be exploited */
Baptiste Assmann251abb92017-08-11 09:58:27 +0200743 if (dns_query->type != DNS_RTYPE_SRV && flags & DNS_FLAG_TRUNCATED)
744 return DNS_RESP_TRUNCATED;
745
Baptiste Assmann325137d2015-04-13 23:40:55 +0200746 /* now parsing response records */
Baptiste Assmann69fce672017-05-04 08:37:45 +0200747 nb_saved_records = 0;
Olivier Houchard8da5f982017-08-04 18:35:36 +0200748 for (i = 0; i < dns_p->header.ancount; i++) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200749 if (reader >= bufend)
750 return DNS_RESP_INVALID;
751
Willy Tarreaubafbe012017-11-24 17:34:44 +0100752 dns_answer_record = pool_alloc(dns_answer_item_pool);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200753 if (dns_answer_record == NULL)
754 return (DNS_RESP_INVALID);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200755
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200756 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100757 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200758
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200759 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100760 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200761 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200762 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200763
Christopher Faulet67957bd2017-09-27 11:00:59 +0200764 /* Check if the current record dname is valid. previous_dname
765 * points either to queried dname or last CNAME target */
Baptiste Assmannddc8ce62017-08-11 10:31:22 +0200766 if (dns_query->type != DNS_RTYPE_SRV && memcmp(previous_dname, tmpname, len) != 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100767 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200768 if (i == 0) {
Christopher Faulet67957bd2017-09-27 11:00:59 +0200769 /* First record, means a mismatch issue between
770 * queried dname and dname found in the first
771 * record */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200772 return DNS_RESP_INVALID;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200773 }
774 else {
775 /* If not the first record, this means we have a
776 * CNAME resolution error */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200777 return DNS_RESP_CNAME_ERROR;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200778 }
779
Baptiste Assmann325137d2015-04-13 23:40:55 +0200780 }
781
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200782 memcpy(dns_answer_record->name, tmpname, len);
783 dns_answer_record->name[len] = 0;
Baptiste Assmann2359ff12015-08-07 11:24:05 +0200784
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200785 reader += offset;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200786 if (reader >= bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100787 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200788 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200789 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200790
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200791 /* 2 bytes for record type (A, AAAA, CNAME, etc...) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200792 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100793 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200794 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200795 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200796 dns_answer_record->type = reader[0] * 256 + reader[1];
797 reader += 2;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200798
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200799 /* 2 bytes for class (2) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200800 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100801 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200802 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200803 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200804 dns_answer_record->class = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200805 reader += 2;
806
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200807 /* 4 bytes for ttl (4) */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200808 if (reader + 4 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100809 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200810 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200811 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200812 dns_answer_record->ttl = reader[0] * 16777216 + reader[1] * 65536
813 + reader[2] * 256 + reader[3];
814 reader += 4;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200815
Christopher Faulet67957bd2017-09-27 11:00:59 +0200816 /* Now reading data len */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200817 if (reader + 2 > bufend) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100818 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200819 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200820 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200821 dns_answer_record->data_len = reader[0] * 256 + reader[1];
Baptiste Assmann325137d2015-04-13 23:40:55 +0200822
Christopher Faulet67957bd2017-09-27 11:00:59 +0200823 /* Move forward 2 bytes for data len */
Baptiste Assmann325137d2015-04-13 23:40:55 +0200824 reader += 2;
825
Jérôme Magnin8d4e7dc2018-12-20 16:47:31 +0100826 if (reader + dns_answer_record->data_len > bufend) {
Remi Gacogneefbbdf72018-12-05 17:56:29 +0100827 pool_free(dns_answer_item_pool, dns_answer_record);
828 return DNS_RESP_INVALID;
829 }
830
Christopher Faulet67957bd2017-09-27 11:00:59 +0200831 /* Analyzing record content */
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200832 switch (dns_answer_record->type) {
Baptiste Assmann325137d2015-04-13 23:40:55 +0200833 case DNS_RTYPE_A:
834 /* ipv4 is stored on 4 bytes */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200835 if (dns_answer_record->data_len != 4) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100836 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200837 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200838 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200839 dns_answer_record->address.sa_family = AF_INET;
840 memcpy(&(((struct sockaddr_in *)&dns_answer_record->address)->sin_addr),
841 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200842 break;
843
844 case DNS_RTYPE_CNAME:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200845 /* Check if this is the last record and update the caller about the status:
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200846 * no IP could be found and last record was a CNAME. Could be triggered
847 * by a wrong query type
848 *
Christopher Faulet67957bd2017-09-27 11:00:59 +0200849 * + 1 because dns_answer_record_id starts at 0
850 * while number of answers is an integer and
851 * starts at 1.
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200852 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200853 if (i + 1 == dns_p->header.ancount) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100854 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200855 return DNS_RESP_CNAME_ERROR;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200856 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200857
858 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100859 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200860 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100861 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200862 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200863 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200864
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200865 memcpy(dns_answer_record->target, tmpname, len);
866 dns_answer_record->target[len] = 0;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200867 previous_dname = dns_answer_record->target;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200868 break;
869
Olivier Houchard8da5f982017-08-04 18:35:36 +0200870
871 case DNS_RTYPE_SRV:
Christopher Faulet67957bd2017-09-27 11:00:59 +0200872 /* Answer must contain :
Olivier Houchard8da5f982017-08-04 18:35:36 +0200873 * - 2 bytes for the priority
874 * - 2 bytes for the weight
875 * - 2 bytes for the port
876 * - the target hostname
877 */
878 if (dns_answer_record->data_len <= 6) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100879 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200880 return DNS_RESP_INVALID;
881 }
Willy Tarreaud5370e12017-09-19 14:59:52 +0200882 dns_answer_record->priority = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200883 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200884 dns_answer_record->weight = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200885 reader += sizeof(uint16_t);
Willy Tarreaud5370e12017-09-19 14:59:52 +0200886 dns_answer_record->port = read_n16(reader);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200887 reader += sizeof(uint16_t);
888 offset = 0;
Remi Gacogne58df5ae2018-12-05 17:52:54 +0100889 len = dns_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200890 if (len == 0) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100891 pool_free(dns_answer_item_pool, dns_answer_record);
Olivier Houchard8da5f982017-08-04 18:35:36 +0200892 return DNS_RESP_INVALID;
893 }
Olivier Houchard8da5f982017-08-04 18:35:36 +0200894 dns_answer_record->data_len = len;
895 memcpy(dns_answer_record->target, tmpname, len);
896 dns_answer_record->target[len] = 0;
897 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200898
Baptiste Assmann325137d2015-04-13 23:40:55 +0200899 case DNS_RTYPE_AAAA:
900 /* ipv6 is stored on 16 bytes */
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200901 if (dns_answer_record->data_len != 16) {
Willy Tarreaubafbe012017-11-24 17:34:44 +0100902 pool_free(dns_answer_item_pool, dns_answer_record);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200903 return DNS_RESP_INVALID;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200904 }
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200905 dns_answer_record->address.sa_family = AF_INET6;
906 memcpy(&(((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr),
907 reader, dns_answer_record->data_len);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200908 break;
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200909
Baptiste Assmann325137d2015-04-13 23:40:55 +0200910 } /* switch (record type) */
911
Christopher Faulet67957bd2017-09-27 11:00:59 +0200912 /* Increment the counter for number of records saved into our
913 * local response */
914 nb_saved_records++;
Baptiste Assmann69fce672017-05-04 08:37:45 +0200915
Christopher Faulet67957bd2017-09-27 11:00:59 +0200916 /* Move forward dns_answer_record->data_len for analyzing next
917 * record in the response */
918 reader += ((dns_answer_record->type == DNS_RTYPE_SRV)
919 ? offset
920 : dns_answer_record->data_len);
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200921
922 /* Lookup to see if we already had this entry */
Olivier Houchard8da5f982017-08-04 18:35:36 +0200923 found = 0;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200924 list_for_each_entry(tmp_record, &dns_p->answer_list, list) {
925 if (tmp_record->type != dns_answer_record->type)
926 continue;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200927
928 switch(tmp_record->type) {
929 case DNS_RTYPE_A:
930 if (!memcmp(&((struct sockaddr_in *)&dns_answer_record->address)->sin_addr,
931 &((struct sockaddr_in *)&tmp_record->address)->sin_addr,
932 sizeof(in_addr_t)))
933 found = 1;
934 break;
935
936 case DNS_RTYPE_AAAA:
937 if (!memcmp(&((struct sockaddr_in6 *)&dns_answer_record->address)->sin6_addr,
938 &((struct sockaddr_in6 *)&tmp_record->address)->sin6_addr,
939 sizeof(struct in6_addr)))
940 found = 1;
941 break;
942
Olivier Houchard8da5f982017-08-04 18:35:36 +0200943 case DNS_RTYPE_SRV:
944 if (dns_answer_record->data_len == tmp_record->data_len &&
Christopher Faulet67957bd2017-09-27 11:00:59 +0200945 !memcmp(dns_answer_record->target, tmp_record->target, dns_answer_record->data_len) &&
Olivier Houchard8da5f982017-08-04 18:35:36 +0200946 dns_answer_record->port == tmp_record->port) {
947 tmp_record->weight = dns_answer_record->weight;
948 found = 1;
949 }
950 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200951
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200952 default:
953 break;
954 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200955
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200956 if (found == 1)
957 break;
958 }
Christopher Faulet67957bd2017-09-27 11:00:59 +0200959
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200960 if (found == 1) {
961 tmp_record->last_seen = now.tv_sec;
Willy Tarreaubafbe012017-11-24 17:34:44 +0100962 pool_free(dns_answer_item_pool, dns_answer_record);
Christopher Faulet67957bd2017-09-27 11:00:59 +0200963 }
964 else {
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200965 dns_answer_record->last_seen = now.tv_sec;
966 LIST_ADDQ(&dns_p->answer_list, &dns_answer_record->list);
967 }
Baptiste Assmann325137d2015-04-13 23:40:55 +0200968 } /* for i 0 to ancount */
969
Christopher Faulet67957bd2017-09-27 11:00:59 +0200970 /* Save the number of records we really own */
Baptiste Assmann69fce672017-05-04 08:37:45 +0200971 dns_p->header.ancount = nb_saved_records;
Christopher Faulet67957bd2017-09-27 11:00:59 +0200972 dns_check_dns_response(resolution);
Baptiste Assmann325137d2015-04-13 23:40:55 +0200973 return DNS_RESP_VALID;
974}
975
Christopher Faulet67957bd2017-09-27 11:00:59 +0200976/* Searches dn_name resolution in resp.
Baptiste Assmann325137d2015-04-13 23:40:55 +0200977 * If existing IP not found, return the first IP matching family_priority,
978 * otherwise, first ip found
979 * The following tasks are the responsibility of the caller:
Baptiste Assmann3cf7f982016-04-17 22:43:26 +0200980 * - <dns_p> contains an error free DNS response
Baptiste Assmann325137d2015-04-13 23:40:55 +0200981 * For both cases above, dns_validate_dns_response is required
982 * returns one of the DNS_UPD_* code
983 */
Baptiste Assmannfb7091e2017-05-03 15:43:12 +0200984int dns_get_ip_from_response(struct dns_response_packet *dns_p,
Baptiste Assmann42746372017-05-03 12:12:02 +0200985 struct dns_options *dns_opts, void *currentip,
Thierry Fournierada34842016-02-17 21:25:09 +0100986 short currentip_sin_family,
Baptiste Assmannfb7091e2017-05-03 15:43:12 +0200987 void **newip, short *newip_sin_family,
988 void *owner)
Baptiste Assmann325137d2015-04-13 23:40:55 +0200989{
Baptiste Assmannc1ce5f32016-05-14 11:26:22 +0200990 struct dns_answer_item *record;
Thierry Fournierada34842016-02-17 21:25:09 +0100991 int family_priority;
Olivier Houcharda8c6db82017-07-06 18:46:47 +0200992 int currentip_found;
Baptiste Assmann3cf7f982016-04-17 22:43:26 +0200993 unsigned char *newip4, *newip6;
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100994 int currentip_sel;
995 int j;
Thierry Fournierac88cfe2016-02-17 22:05:30 +0100996 int score, max_score;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +0200997 int allowed_duplicated_ip;
Baptiste Assmann325137d2015-04-13 23:40:55 +0200998
Christopher Faulet67957bd2017-09-27 11:00:59 +0200999 family_priority = dns_opts->family_prio;
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001000 allowed_duplicated_ip = dns_opts->accept_duplicate_ip;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001001 *newip = newip4 = newip6 = NULL;
1002 currentip_found = 0;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001003 *newip_sin_family = AF_UNSPEC;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001004 max_score = -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001005
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001006 /* Select an IP regarding configuration preference.
Joseph Herlant42cf6392018-11-15 10:33:28 -08001007 * Top priority is the preferred network ip version,
1008 * second priority is the preferred network.
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001009 * the last priority is the currently used IP,
1010 *
1011 * For these three priorities, a score is calculated. The
1012 * weight are:
Joseph Herlant42cf6392018-11-15 10:33:28 -08001013 * 8 - preferred ip version.
1014 * 4 - preferred network.
Baptistefc725902016-12-26 23:21:08 +01001015 * 2 - if the ip in the record is not affected to any other server in the same backend (duplication)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001016 * 1 - current ip.
1017 * The result with the biggest score is returned.
1018 */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001019
1020 list_for_each_entry(record, &dns_p->answer_list, list) {
1021 void *ip;
1022 unsigned char ip_type;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001023
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001024 if (record->type == DNS_RTYPE_A) {
1025 ip = &(((struct sockaddr_in *)&record->address)->sin_addr);
1026 ip_type = AF_INET;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001027 }
1028 else if (record->type == DNS_RTYPE_AAAA) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001029 ip_type = AF_INET6;
1030 ip = &(((struct sockaddr_in6 *)&record->address)->sin6_addr);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001031 }
1032 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001033 continue;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001034 score = 0;
1035
Joseph Herlant42cf6392018-11-15 10:33:28 -08001036 /* Check for preferred ip protocol. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001037 if (ip_type == family_priority)
Baptistefc725902016-12-26 23:21:08 +01001038 score += 8;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001039
Joseph Herlant42cf6392018-11-15 10:33:28 -08001040 /* Check for preferred network. */
Baptiste Assmann42746372017-05-03 12:12:02 +02001041 for (j = 0; j < dns_opts->pref_net_nb; j++) {
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001042
1043 /* Compare only the same adresses class. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001044 if (dns_opts->pref_net[j].family != ip_type)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001045 continue;
1046
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001047 if ((ip_type == AF_INET &&
1048 in_net_ipv4(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001049 &dns_opts->pref_net[j].mask.in4,
1050 &dns_opts->pref_net[j].addr.in4)) ||
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001051 (ip_type == AF_INET6 &&
1052 in_net_ipv6(ip,
Baptiste Assmann42746372017-05-03 12:12:02 +02001053 &dns_opts->pref_net[j].mask.in6,
1054 &dns_opts->pref_net[j].addr.in6))) {
Baptistefc725902016-12-26 23:21:08 +01001055 score += 4;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001056 break;
1057 }
1058 }
1059
Christopher Faulet67957bd2017-09-27 11:00:59 +02001060 /* Check if the IP found in the record is already affected to a
Baptiste Assmann84221b42018-06-22 13:03:50 +02001061 * member of a group. If not, the score should be incremented
Christopher Faulet67957bd2017-09-27 11:00:59 +02001062 * by 2. */
Baptiste Assmann84221b42018-06-22 13:03:50 +02001063 if (owner && snr_check_ip_callback(owner, ip, &ip_type)) {
Baptiste Assmann8e2d9432018-06-22 15:04:43 +02001064 if (!allowed_duplicated_ip) {
1065 continue;
1066 }
Baptiste Assmann84221b42018-06-22 13:03:50 +02001067 } else {
1068 score += 2;
1069 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001070
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001071 /* Check for current ip matching. */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001072 if (ip_type == currentip_sin_family &&
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001073 ((currentip_sin_family == AF_INET &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001074 !memcmp(ip, currentip, 4)) ||
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001075 (currentip_sin_family == AF_INET6 &&
Christopher Faulet67957bd2017-09-27 11:00:59 +02001076 !memcmp(ip, currentip, 16)))) {
1077 score++;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001078 currentip_sel = 1;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001079 }
1080 else
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001081 currentip_sel = 0;
1082
1083 /* Keep the address if the score is better than the previous
Christopher Faulet67957bd2017-09-27 11:00:59 +02001084 * score. The maximum score is 15, if this value is reached, we
1085 * break the parsing. Implicitly, this score is reached the ip
1086 * selected is the current ip. */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001087 if (score > max_score) {
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001088 if (ip_type == AF_INET)
1089 newip4 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001090 else
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001091 newip6 = ip;
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001092 currentip_found = currentip_sel;
Baptistefc725902016-12-26 23:21:08 +01001093 if (score == 15)
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001094 return DNS_UPD_NO;
1095 max_score = score;
1096 }
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001097 } /* list for each record entries */
Thierry Fournierac88cfe2016-02-17 22:05:30 +01001098
Christopher Faulet67957bd2017-09-27 11:00:59 +02001099 /* No IP found in the response */
Olivier Houcharda8c6db82017-07-06 18:46:47 +02001100 if (!newip4 && !newip6)
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001101 return DNS_UPD_NO_IP_FOUND;
Baptiste Assmann0453a1d2015-09-09 00:51:08 +02001102
Christopher Faulet67957bd2017-09-27 11:00:59 +02001103 /* Case when the caller looks first for an IPv4 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001104 if (family_priority == AF_INET) {
1105 if (newip4) {
1106 *newip = newip4;
1107 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001108 }
1109 else if (newip6) {
1110 *newip = newip6;
1111 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001112 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001113 if (!currentip_found)
1114 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001115 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001116 /* Case when the caller looks first for an IPv6 address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001117 else if (family_priority == AF_INET6) {
1118 if (newip6) {
1119 *newip = newip6;
1120 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001121 }
1122 else if (newip4) {
1123 *newip = newip4;
1124 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001125 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001126 if (!currentip_found)
1127 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001128 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001129 /* Case when the caller have no preference (we prefer IPv6) */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001130 else if (family_priority == AF_UNSPEC) {
1131 if (newip6) {
1132 *newip = newip6;
1133 *newip_sin_family = AF_INET6;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001134 }
1135 else if (newip4) {
1136 *newip = newip4;
1137 *newip_sin_family = AF_INET;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001138 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001139 if (!currentip_found)
1140 goto not_found;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001141 }
1142
Christopher Faulet67957bd2017-09-27 11:00:59 +02001143 /* No reason why we should change the server's IP address */
Baptiste Assmann325137d2015-04-13 23:40:55 +02001144 return DNS_UPD_NO;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001145
Christopher Faulet67957bd2017-09-27 11:00:59 +02001146 not_found:
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001147 list_for_each_entry(record, &dns_p->answer_list, list) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001148 /* Move the first record to the end of the list, for internal
1149 * round robin */
1150 LIST_DEL(&record->list);
1151 LIST_ADDQ(&dns_p->answer_list, &record->list);
1152 break;
Baptiste Assmann8ea0bcc2017-05-04 08:24:11 +02001153 }
1154 return DNS_UPD_SRVIP_NOT_FOUND;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001155}
1156
Christopher Faulet67957bd2017-09-27 11:00:59 +02001157/* Turns a domain name label into a string.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001158 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001159 * <dn> must be a null-terminated string. <dn_len> must include the terminating
1160 * null byte. <str> must be allocated and its size must be passed in <str_len>.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001161 *
Christopher Faulet67957bd2017-09-27 11:00:59 +02001162 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1163 * <str> (including the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001164 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001165int dns_dn_label_to_str(const char *dn, int dn_len, char *str, int str_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001166{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001167 char *ptr;
1168 int i, sz;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001169
Christopher Faulet67957bd2017-09-27 11:00:59 +02001170 if (str_len < dn_len - 1)
Baptiste Assmann2af08fe2017-08-14 00:13:01 +02001171 return -1;
1172
Christopher Faulet67957bd2017-09-27 11:00:59 +02001173 ptr = str;
1174 for (i = 0; i < dn_len-1; ++i) {
1175 sz = dn[i];
1176 if (i)
1177 *ptr++ = '.';
1178 memcpy(ptr, dn+i+1, sz);
1179 ptr += sz;
1180 i += sz;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001181 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001182 *ptr++ = '\0';
1183 return (ptr - str);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001184}
1185
Christopher Faulet67957bd2017-09-27 11:00:59 +02001186/* Turns a string into domain name label: www.haproxy.org into 3www7haproxy3org
1187 *
1188 * <str> must be a null-terminated string. <str_len> must include the
1189 * terminating null byte. <dn> buffer must be allocated and its size must be
1190 * passed in <dn_len>.
1191 *
1192 * In case of error, -1 is returned, otherwise, the number of bytes copied in
1193 * <dn> (excluding the terminating null byte).
Baptiste Assmann325137d2015-04-13 23:40:55 +02001194 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001195int dns_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001196{
Baptiste Assmann325137d2015-04-13 23:40:55 +02001197 int i, offset;
1198
Christopher Faulet67957bd2017-09-27 11:00:59 +02001199 if (dn_len < str_len + 1)
1200 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001201
Christopher Faulet67957bd2017-09-27 11:00:59 +02001202 /* First byte of dn will be used to store the length of the first
1203 * label */
1204 offset = 0;
1205 for (i = 0; i < str_len; ++i) {
1206 if (str[i] == '.') {
1207 /* 2 or more consecutive dots is invalid */
1208 if (i == offset)
1209 return -1;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001210
Christopher Faulet67957bd2017-09-27 11:00:59 +02001211 dn[offset] = (i - offset);
1212 offset = i+1;
1213 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001214 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001215 dn[i+1] = str[i];
Baptiste Assmann325137d2015-04-13 23:40:55 +02001216 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001217 dn[offset] = (i - offset - 1);
1218 dn[i] = '\0';
1219 return i;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001220}
1221
Christopher Faulet67957bd2017-09-27 11:00:59 +02001222/* Validates host name:
Baptiste Assmann325137d2015-04-13 23:40:55 +02001223 * - total size
1224 * - each label size individually
1225 * returns:
1226 * 0 in case of error. If <err> is not NULL, an error message is stored there.
1227 * 1 when no error. <err> is left unaffected.
1228 */
1229int dns_hostname_validation(const char *string, char **err)
1230{
1231 const char *c, *d;
1232 int i;
1233
1234 if (strlen(string) > DNS_MAX_NAME_SIZE) {
1235 if (err)
1236 *err = DNS_TOO_LONG_FQDN;
1237 return 0;
1238 }
1239
1240 c = string;
1241 while (*c) {
1242 d = c;
1243
1244 i = 0;
1245 while (*d != '.' && *d && i <= DNS_MAX_LABEL_SIZE) {
1246 i++;
1247 if (!((*d == '-') || (*d == '_') ||
1248 ((*d >= 'a') && (*d <= 'z')) ||
1249 ((*d >= 'A') && (*d <= 'Z')) ||
1250 ((*d >= '0') && (*d <= '9')))) {
1251 if (err)
1252 *err = DNS_INVALID_CHARACTER;
1253 return 0;
1254 }
1255 d++;
1256 }
1257
1258 if ((i >= DNS_MAX_LABEL_SIZE) && (d[i] != '.')) {
1259 if (err)
1260 *err = DNS_LABEL_TOO_LONG;
1261 return 0;
1262 }
1263
1264 if (*d == '\0')
1265 goto out;
1266
1267 c = ++d;
1268 }
1269 out:
1270 return 1;
1271}
1272
Christopher Faulet67957bd2017-09-27 11:00:59 +02001273/* Picks up an available resolution from the different resolution list
1274 * associated to a resolvers section, in this order:
1275 * 1. check in resolutions.curr for the same hostname and query_type
1276 * 2. check in resolutions.wait for the same hostname and query_type
1277 * 3. Get a new resolution from resolution pool
1278 *
1279 * Returns an available resolution, NULL if none found.
Baptiste Assmann325137d2015-04-13 23:40:55 +02001280 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001281static struct dns_resolution *dns_pick_resolution(struct dns_resolvers *resolvers,
1282 char **hostname_dn, int hostname_dn_len,
1283 int query_type)
Baptiste Assmann325137d2015-04-13 23:40:55 +02001284{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001285 struct dns_resolution *res;
1286
1287 if (!*hostname_dn)
1288 goto from_pool;
1289
1290 /* Search for same hostname and query type in resolutions.curr */
1291 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
1292 if (!res->hostname_dn)
1293 continue;
1294 if ((query_type == res->prefered_query_type) &&
1295 hostname_dn_len == res->hostname_dn_len &&
1296 !memcmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
1297 return res;
1298 }
1299
1300 /* Search for same hostname and query type in resolutions.wait */
1301 list_for_each_entry(res, &resolvers->resolutions.wait, list) {
1302 if (!res->hostname_dn)
1303 continue;
1304 if ((query_type == res->prefered_query_type) &&
1305 hostname_dn_len == res->hostname_dn_len &&
1306 !memcmp(*hostname_dn, res->hostname_dn, hostname_dn_len))
1307 return res;
1308 }
1309
1310 from_pool:
1311 /* No resolution could be found, so let's allocate a new one */
Willy Tarreaubafbe012017-11-24 17:34:44 +01001312 res = pool_alloc(dns_resolution_pool);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001313 if (res) {
1314 memset(res, 0, sizeof(*res));
1315 res->resolvers = resolvers;
1316 res->uuid = resolution_uuid;
1317 res->status = RSLV_STATUS_NONE;
1318 res->step = RSLV_STEP_NONE;
1319 res->last_valid = now_ms;
1320
1321 LIST_INIT(&res->requesters);
1322 LIST_INIT(&res->response.answer_list);
1323
1324 res->prefered_query_type = query_type;
1325 res->query_type = query_type;
1326 res->hostname_dn = *hostname_dn;
1327 res->hostname_dn_len = hostname_dn_len;
1328
1329 ++resolution_uuid;
1330
1331 /* Move the resolution to the resolvers wait queue */
1332 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1333 }
1334 return res;
1335}
1336
1337/* Releases a resolution from its requester(s) and move it back to the pool */
1338static void dns_free_resolution(struct dns_resolution *resolution)
1339{
1340 struct dns_requester *req, *reqback;
1341
1342 /* clean up configuration */
1343 dns_reset_resolution(resolution);
1344 resolution->hostname_dn = NULL;
1345 resolution->hostname_dn_len = 0;
1346
1347 list_for_each_entry_safe(req, reqback, &resolution->requesters, list) {
1348 LIST_DEL(&req->list);
1349 req->resolution = NULL;
1350 }
1351
1352 LIST_DEL(&resolution->list);
Willy Tarreaubafbe012017-11-24 17:34:44 +01001353 pool_free(dns_resolution_pool, resolution);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001354}
1355
1356/* Links a requester (a server or a dns_srvrq) with a resolution. It returns 0
1357 * on success, -1 otherwise.
1358 */
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001359int dns_link_resolution(void *requester, int requester_type, int requester_locked)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001360{
1361 struct dns_resolution *res = NULL;
1362 struct dns_requester *req;
1363 struct dns_resolvers *resolvers;
1364 struct server *srv = NULL;
1365 struct dns_srvrq *srvrq = NULL;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001366 struct stream *stream = NULL;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001367 char **hostname_dn;
1368 int hostname_dn_len, query_type;
1369
1370 switch (requester_type) {
1371 case OBJ_TYPE_SERVER:
1372 srv = (struct server *)requester;
1373 hostname_dn = &srv->hostname_dn;
1374 hostname_dn_len = srv->hostname_dn_len;
1375 resolvers = srv->resolvers;
1376 query_type = ((srv->dns_opts.family_prio == AF_INET)
1377 ? DNS_RTYPE_A
1378 : DNS_RTYPE_AAAA);
1379 break;
1380
1381 case OBJ_TYPE_SRVRQ:
1382 srvrq = (struct dns_srvrq *)requester;
1383 hostname_dn = &srvrq->hostname_dn;
1384 hostname_dn_len = srvrq->hostname_dn_len;
1385 resolvers = srvrq->resolvers;
1386 query_type = DNS_RTYPE_SRV;
1387 break;
1388
Baptiste Assmann333939c2019-01-21 08:34:50 +01001389 case OBJ_TYPE_STREAM:
1390 stream = (struct stream *)requester;
1391 hostname_dn = &stream->dns_ctx.hostname_dn;
1392 hostname_dn_len = stream->dns_ctx.hostname_dn_len;
1393 resolvers = stream->dns_ctx.parent->arg.dns.resolvers;
1394 query_type = ((stream->dns_ctx.parent->arg.dns.dns_opts.family_prio == AF_INET)
1395 ? DNS_RTYPE_A
1396 : DNS_RTYPE_AAAA);
1397 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001398 default:
1399 goto err;
1400 }
1401
1402 /* Get a resolution from the resolvers' wait queue or pool */
1403 if ((res = dns_pick_resolution(resolvers, hostname_dn, hostname_dn_len, query_type)) == NULL)
1404 goto err;
1405
1406 if (srv) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001407 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001408 HA_SPIN_LOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001409 if (srv->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001410 if ((req = pool_alloc(dns_requester_pool)) == NULL) {
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001411 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001412 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001413 goto err;
Willy Tarreau5ec84572017-11-05 10:35:57 +01001414 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001415 req->owner = &srv->obj_type;
1416 srv->dns_requester = req;
1417 }
1418 else
1419 req = srv->dns_requester;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001420 if (!requester_locked)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001421 HA_SPIN_UNLOCK(SERVER_LOCK, &srv->lock);
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001422
1423 req->requester_cb = snr_resolution_cb;
1424 req->requester_error_cb = snr_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001425 }
1426 else if (srvrq) {
1427 if (srvrq->dns_requester == NULL) {
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001428 if ((req = pool_alloc(dns_requester_pool)) == NULL)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001429 goto err;
1430 req->owner = &srvrq->obj_type;
1431 srvrq->dns_requester = req;
1432 }
1433 else
1434 req = srvrq->dns_requester;
Baptiste Assmanndb4c8522018-01-30 08:08:04 +01001435
1436 req->requester_cb = snr_resolution_cb;
1437 req->requester_error_cb = snr_resolution_error_cb;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001438 }
Baptiste Assmann333939c2019-01-21 08:34:50 +01001439 else if (stream) {
1440 if (stream->dns_ctx.dns_requester == NULL) {
1441 if ((req = pool_alloc(dns_requester_pool)) == NULL)
1442 goto err;
1443 req->owner = &stream->obj_type;
1444 stream->dns_ctx.dns_requester = req;
1445 }
1446 else
1447 req = stream->dns_ctx.dns_requester;
1448
1449 req->requester_cb = act_resolution_cb;
1450 req->requester_error_cb = act_resolution_error_cb;
1451 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001452 else
1453 goto err;
1454
1455 req->resolution = res;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001456
1457 LIST_ADDQ(&res->requesters, &req->list);
1458 return 0;
1459
1460 err:
1461 if (res && LIST_ISEMPTY(&res->requesters))
1462 dns_free_resolution(res);
1463 return -1;
1464}
1465
1466/* Removes a requester from a DNS resoltion. It takes takes care of all the
1467 * consequences. It also cleans up some parameters from the requester.
1468 */
1469void dns_unlink_resolution(struct dns_requester *requester)
1470{
1471 struct dns_resolution *res;
1472 struct dns_requester *req;
1473
1474 /* Nothing to do */
1475 if (!requester || !requester->resolution)
1476 return;
1477 res = requester->resolution;
1478
1479 /* Clean up the requester */
1480 LIST_DEL(&requester->list);
1481 requester->resolution = NULL;
1482
1483 /* We need to find another requester linked on this resolution */
1484 if (!LIST_ISEMPTY(&res->requesters))
1485 req = LIST_NEXT(&res->requesters, struct dns_requester *, list);
1486 else {
1487 dns_free_resolution(res);
1488 return;
1489 }
1490
1491 /* Move hostname_dn related pointers to the next requester */
1492 switch (obj_type(req->owner)) {
1493 case OBJ_TYPE_SERVER:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001494 res->hostname_dn = __objt_server(req->owner)->hostname_dn;
1495 res->hostname_dn_len = __objt_server(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001496 break;
1497 case OBJ_TYPE_SRVRQ:
Willy Tarreau433c16f2018-09-20 11:15:27 +02001498 res->hostname_dn = __objt_dns_srvrq(req->owner)->hostname_dn;
1499 res->hostname_dn_len = __objt_dns_srvrq(req->owner)->hostname_dn_len;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001500 break;
Baptiste Assmann333939c2019-01-21 08:34:50 +01001501 case OBJ_TYPE_STREAM:
1502 res->hostname_dn = __objt_stream(req->owner)->dns_ctx.hostname_dn;
1503 res->hostname_dn_len = __objt_stream(req->owner)->dns_ctx.hostname_dn_len;
1504 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001505 default:
1506 res->hostname_dn = NULL;
1507 res->hostname_dn_len = 0;
1508 break;
1509 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001510}
1511
Christopher Faulet67957bd2017-09-27 11:00:59 +02001512/* Called when a network IO is generated on a name server socket for an incoming
1513 * packet. It performs the following actions:
1514 * - check if the packet requires processing (not outdated resolution)
1515 * - ensure the DNS packet received is valid and call requester's callback
1516 * - call requester's error callback if invalid response
1517 * - check the dn_name in the packet against the one sent
1518 */
1519static void dns_resolve_recv(struct dgram_conn *dgram)
1520{
1521 struct dns_nameserver *ns, *tmpns;
1522 struct dns_resolvers *resolvers;
1523 struct dns_resolution *res;
1524 struct dns_query_item *query;
1525 unsigned char buf[DNS_MAX_UDP_MESSAGE + 1];
1526 unsigned char *bufend;
1527 int fd, buflen, dns_resp;
1528 int max_answer_records;
1529 unsigned short query_id;
1530 struct eb32_node *eb;
1531 struct dns_requester *req;
1532
1533 fd = dgram->t.sock.fd;
1534
1535 /* check if ready for reading */
1536 if (!fd_recv_ready(fd))
1537 return;
1538
1539 /* no need to go further if we can't retrieve the nameserver */
1540 if ((ns = dgram->owner) == NULL)
1541 return;
1542
1543 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001544 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001545
1546 /* process all pending input messages */
1547 while (1) {
1548 /* read message received */
1549 memset(buf, '\0', resolvers->accepted_payload_size + 1);
1550 if ((buflen = recv(fd, (char*)buf , resolvers->accepted_payload_size + 1, 0)) < 0) {
1551 /* FIXME : for now we consider EAGAIN only */
1552 fd_cant_recv(fd);
1553 break;
1554 }
1555
1556 /* message too big */
1557 if (buflen > resolvers->accepted_payload_size) {
1558 ns->counters.too_big++;
1559 continue;
1560 }
1561
1562 /* initializing variables */
1563 bufend = buf + buflen; /* pointer to mark the end of the buffer */
1564
1565 /* read the query id from the packet (16 bits) */
1566 if (buf + 2 > bufend) {
1567 ns->counters.invalid++;
1568 continue;
1569 }
1570 query_id = dns_response_get_query_id(buf);
1571
1572 /* search the query_id in the pending resolution tree */
1573 eb = eb32_lookup(&resolvers->query_ids, query_id);
1574 if (eb == NULL) {
1575 /* unknown query id means an outdated response and can be safely ignored */
1576 ns->counters.outdated++;
1577 continue;
1578 }
1579
1580 /* known query id means a resolution in prgress */
1581 res = eb32_entry(eb, struct dns_resolution, qid);
1582 if (!res) {
1583 ns->counters.outdated++;
1584 continue;
1585 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001586
Christopher Faulet67957bd2017-09-27 11:00:59 +02001587 /* number of responses received */
1588 res->nb_responses++;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001589
Christopher Faulet67957bd2017-09-27 11:00:59 +02001590 max_answer_records = (resolvers->accepted_payload_size - DNS_HEADER_SIZE) / DNS_MIN_RECORD_SIZE;
1591 dns_resp = dns_validate_dns_response(buf, bufend, res, max_answer_records);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001592
Christopher Faulet67957bd2017-09-27 11:00:59 +02001593 switch (dns_resp) {
1594 case DNS_RESP_VALID:
1595 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001596
Christopher Faulet67957bd2017-09-27 11:00:59 +02001597 case DNS_RESP_INVALID:
1598 case DNS_RESP_QUERY_COUNT_ERROR:
1599 case DNS_RESP_WRONG_NAME:
1600 res->status = RSLV_STATUS_INVALID;
1601 ns->counters.invalid++;
1602 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001603
Christopher Faulet67957bd2017-09-27 11:00:59 +02001604 case DNS_RESP_NX_DOMAIN:
1605 res->status = RSLV_STATUS_NX;
1606 ns->counters.nx++;
1607 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001608
Christopher Faulet67957bd2017-09-27 11:00:59 +02001609 case DNS_RESP_REFUSED:
1610 res->status = RSLV_STATUS_REFUSED;
1611 ns->counters.refused++;
1612 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001613
Christopher Faulet67957bd2017-09-27 11:00:59 +02001614 case DNS_RESP_ANCOUNT_ZERO:
1615 res->status = RSLV_STATUS_OTHER;
1616 ns->counters.any_err++;
1617 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001618
Christopher Faulet67957bd2017-09-27 11:00:59 +02001619 case DNS_RESP_CNAME_ERROR:
1620 res->status = RSLV_STATUS_OTHER;
1621 ns->counters.cname_error++;
1622 break;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001623
Christopher Faulet67957bd2017-09-27 11:00:59 +02001624 case DNS_RESP_TRUNCATED:
1625 res->status = RSLV_STATUS_OTHER;
1626 ns->counters.truncated++;
1627 break;
Baptiste Assmanne70bc052017-08-21 16:51:09 +02001628
Christopher Faulet67957bd2017-09-27 11:00:59 +02001629 case DNS_RESP_NO_EXPECTED_RECORD:
1630 case DNS_RESP_ERROR:
1631 case DNS_RESP_INTERNAL:
1632 res->status = RSLV_STATUS_OTHER;
1633 ns->counters.other++;
1634 break;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001635 }
1636
Christopher Faulet67957bd2017-09-27 11:00:59 +02001637 /* Wait all nameservers response to handle errors */
1638 if (dns_resp != DNS_RESP_VALID && res->nb_responses < resolvers->nb_nameservers)
1639 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001640
Christopher Faulet67957bd2017-09-27 11:00:59 +02001641 /* Process error codes */
1642 if (dns_resp != DNS_RESP_VALID) {
1643 if (res->prefered_query_type != res->query_type) {
1644 /* The fallback on the query type was already performed,
1645 * so check the try counter. If it falls to 0, we can
1646 * report an error. Else, wait the next attempt. */
1647 if (!res->try)
1648 goto report_res_error;
1649 }
1650 else {
1651 /* Fallback from A to AAAA or the opposite and re-send
1652 * the resolution immediately. try counter is not
1653 * decremented. */
1654 if (res->prefered_query_type == DNS_RTYPE_A) {
1655 res->query_type = DNS_RTYPE_AAAA;
1656 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001657 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001658 else if (res->prefered_query_type == DNS_RTYPE_AAAA) {
1659 res->query_type = DNS_RTYPE_A;
1660 dns_send_query(res);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001661 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001662 }
1663 continue;
1664 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001665
Christopher Faulet67957bd2017-09-27 11:00:59 +02001666 /* Now let's check the query's dname corresponds to the one we
1667 * sent. We can check only the first query of the list. We send
1668 * one query at a time so we get one query in the response */
1669 query = LIST_NEXT(&res->response.query_list, struct dns_query_item *, list);
1670 if (query && memcmp(query->name, res->hostname_dn, res->hostname_dn_len) != 0) {
1671 dns_resp = DNS_RESP_WRONG_NAME;
1672 ns->counters.other++;
1673 goto report_res_error;
1674 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001675
Christopher Faulet67957bd2017-09-27 11:00:59 +02001676 /* So the resolution succeeded */
1677 res->status = RSLV_STATUS_VALID;
1678 res->last_valid = now_ms;
1679 ns->counters.valid++;
1680 goto report_res_success;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001681
Christopher Faulet67957bd2017-09-27 11:00:59 +02001682 report_res_error:
1683 list_for_each_entry(req, &res->requesters, list)
1684 req->requester_error_cb(req, dns_resp);
1685 dns_reset_resolution(res);
1686 LIST_DEL(&res->list);
1687 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1688 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001689
Christopher Faulet67957bd2017-09-27 11:00:59 +02001690 report_res_success:
1691 /* Only the 1rst requester s managed by the server, others are
1692 * from the cache */
1693 tmpns = ns;
1694 list_for_each_entry(req, &res->requesters, list) {
Olivier Houchard28381072017-11-06 17:30:28 +01001695 struct server *s = objt_server(req->owner);
1696
1697 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001698 HA_SPIN_LOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001699 req->requester_cb(req, tmpns);
Olivier Houchard28381072017-11-06 17:30:28 +01001700 if (s)
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001701 HA_SPIN_UNLOCK(SERVER_LOCK, &s->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001702 tmpns = NULL;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001703 }
Baptiste Assmann42746372017-05-03 12:12:02 +02001704
Christopher Faulet67957bd2017-09-27 11:00:59 +02001705 dns_reset_resolution(res);
1706 LIST_DEL(&res->list);
1707 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
1708 continue;
Baptiste Assmann325137d2015-04-13 23:40:55 +02001709 }
Baptiste Assmann325137d2015-04-13 23:40:55 +02001710 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001711 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Baptiste Assmann325137d2015-04-13 23:40:55 +02001712}
William Lallemand69e96442016-11-19 00:58:54 +01001713
Christopher Faulet67957bd2017-09-27 11:00:59 +02001714/* Called when a resolvers network socket is ready to send data */
1715static void dns_resolve_send(struct dgram_conn *dgram)
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001716{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001717 struct dns_resolvers *resolvers;
1718 struct dns_nameserver *ns;
1719 struct dns_resolution *res;
1720 int fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001721
Christopher Faulet67957bd2017-09-27 11:00:59 +02001722 fd = dgram->t.sock.fd;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001723
Christopher Faulet67957bd2017-09-27 11:00:59 +02001724 /* check if ready for sending */
1725 if (!fd_send_ready(fd))
1726 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001727
Christopher Faulet67957bd2017-09-27 11:00:59 +02001728 /* we don't want/need to be waked up any more for sending */
1729 fd_stop_send(fd);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001730
Christopher Faulet67957bd2017-09-27 11:00:59 +02001731 /* no need to go further if we can't retrieve the nameserver */
1732 if ((ns = dgram->owner) == NULL)
1733 return;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001734
Christopher Faulet67957bd2017-09-27 11:00:59 +02001735 resolvers = ns->resolvers;
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001736 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02001737
Christopher Faulet67957bd2017-09-27 11:00:59 +02001738 list_for_each_entry(res, &resolvers->resolutions.curr, list) {
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001739 int ret, len;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001740
Christopher Faulet67957bd2017-09-27 11:00:59 +02001741 if (res->nb_queries == resolvers->nb_nameservers)
1742 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001743
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001744 len = dns_build_query(res->query_id, res->query_type,
1745 resolvers->accepted_payload_size,
1746 res->hostname_dn, res->hostname_dn_len,
1747 trash.area, trash.size);
1748 if (len == -1)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001749 goto snd_error;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001750
Willy Tarreauf6ee9dc2018-08-22 04:52:02 +02001751 ret = send(fd, trash.area, len, 0);
1752 if (ret != len)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001753 goto snd_error;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001754
Christopher Faulet67957bd2017-09-27 11:00:59 +02001755 ns->counters.sent++;
1756 res->nb_queries++;
1757 continue;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001758
Christopher Faulet67957bd2017-09-27 11:00:59 +02001759 snd_error:
1760 ns->counters.snd_error++;
1761 res->nb_queries++;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001762 }
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001763 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001764}
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001765
Christopher Faulet67957bd2017-09-27 11:00:59 +02001766/* Processes DNS resolution. First, it checks the active list to detect expired
1767 * resolutions and retry them if possible. Else a timeout is reported. Then, it
1768 * checks the wait list to trigger new resolutions.
1769 */
Olivier Houchard9f6af332018-05-25 14:04:04 +02001770static struct task *dns_process_resolvers(struct task *t, void *context, unsigned short state)
Christopher Faulet67957bd2017-09-27 11:00:59 +02001771{
Olivier Houchard9f6af332018-05-25 14:04:04 +02001772 struct dns_resolvers *resolvers = context;
Christopher Faulet67957bd2017-09-27 11:00:59 +02001773 struct dns_resolution *res, *resback;
1774 int exp;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001775
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001776 HA_SPIN_LOCK(DNS_LOCK, &resolvers->lock);
Christopher Fauletb2812a62017-10-04 16:17:58 +02001777
Christopher Faulet67957bd2017-09-27 11:00:59 +02001778 /* Handle all expired resolutions from the active list */
1779 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
1780 /* When we find the first resolution in the future, then we can
1781 * stop here */
1782 exp = tick_add(res->last_query, resolvers->timeout.retry);
1783 if (!tick_is_expired(exp, now_ms))
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001784 break;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001785
Christopher Faulet67957bd2017-09-27 11:00:59 +02001786 /* If current resolution has been tried too many times and
1787 * finishes in timeout we update its status and remove it from
1788 * the list */
1789 if (!res->try) {
1790 struct dns_requester *req;
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001791
Christopher Faulet67957bd2017-09-27 11:00:59 +02001792 /* Notify the result to the requesters */
1793 if (!res->nb_responses)
1794 res->status = RSLV_STATUS_TIMEOUT;
1795 list_for_each_entry(req, &res->requesters, list)
1796 req->requester_error_cb(req, res->status);
Baptiste Assmannfa4a6632017-05-04 09:05:00 +02001797
Christopher Faulet67957bd2017-09-27 11:00:59 +02001798 /* Clean up resolution info and remove it from the
1799 * current list */
1800 dns_reset_resolution(res);
1801 LIST_DEL(&res->list);
1802 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
William Lallemand69e96442016-11-19 00:58:54 +01001803 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001804 else {
1805 /* Otherwise resend the DNS query and requeue the resolution */
1806 if (!res->nb_responses || res->prefered_query_type != res->query_type) {
1807 /* No response received (a real timeout) or fallback already done */
1808 res->query_type = res->prefered_query_type;
1809 res->try--;
1810 }
1811 else {
1812 /* Fallback from A to AAAA or the opposite and re-send
1813 * the resolution immediately. try counter is not
1814 * decremented. */
1815 if (res->prefered_query_type == DNS_RTYPE_A)
1816 res->query_type = DNS_RTYPE_AAAA;
1817 else if (res->prefered_query_type == DNS_RTYPE_AAAA)
1818 res->query_type = DNS_RTYPE_A;
1819 else
1820 res->try--;
1821 }
1822 dns_send_query(res);
William Lallemand69e96442016-11-19 00:58:54 +01001823 }
1824 }
William Lallemand69e96442016-11-19 00:58:54 +01001825
Christopher Faulet67957bd2017-09-27 11:00:59 +02001826 /* Handle all resolutions in the wait list */
1827 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
1828 exp = tick_add(res->last_resolution, dns_resolution_timeout(res));
1829 if (tick_isset(res->last_resolution) && !tick_is_expired(exp, now_ms))
1830 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001831
Christopher Faulet67957bd2017-09-27 11:00:59 +02001832 if (dns_run_resolution(res) != 1) {
1833 res->last_resolution = now_ms;
1834 LIST_DEL(&res->list);
1835 LIST_ADDQ(&resolvers->resolutions.wait, &res->list);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001836 }
1837 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001838
Christopher Faulet67957bd2017-09-27 11:00:59 +02001839 dns_update_resolvers_timeout(resolvers);
Christopher Faulet2a944ee2017-11-07 10:42:54 +01001840 HA_SPIN_UNLOCK(DNS_LOCK, &resolvers->lock);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001841 return t;
1842}
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001843
Christopher Faulet67957bd2017-09-27 11:00:59 +02001844/* proto_udp callback functions for a DNS resolution */
1845struct dgram_data_cb resolve_dgram_cb = {
1846 .recv = dns_resolve_recv,
1847 .send = dns_resolve_send,
1848};
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001849
Christopher Faulet67957bd2017-09-27 11:00:59 +02001850/* Release memory allocated by DNS */
1851static void dns_deinit(void)
1852{
1853 struct dns_resolvers *resolvers, *resolversback;
1854 struct dns_nameserver *ns, *nsback;
1855 struct dns_resolution *res, *resback;
1856 struct dns_requester *req, *reqback;
1857 struct dns_srvrq *srvrq, *srvrqback;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001858
Christopher Faulet67957bd2017-09-27 11:00:59 +02001859 list_for_each_entry_safe(resolvers, resolversback, &dns_resolvers, list) {
1860 list_for_each_entry_safe(ns, nsback, &resolvers->nameservers, list) {
1861 free(ns->id);
1862 free((char *)ns->conf.file);
1863 if (ns->dgram && ns->dgram->t.sock.fd != -1)
1864 fd_delete(ns->dgram->t.sock.fd);
1865 free(ns->dgram);
1866 LIST_DEL(&ns->list);
1867 free(ns);
1868 }
1869
1870 list_for_each_entry_safe(res, resback, &resolvers->resolutions.curr, list) {
1871 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
1872 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001873 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001874 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001875 dns_free_resolution(res);
1876 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001877
Christopher Faulet67957bd2017-09-27 11:00:59 +02001878 list_for_each_entry_safe(res, resback, &resolvers->resolutions.wait, list) {
1879 list_for_each_entry_safe(req, reqback, &res->requesters, list) {
1880 LIST_DEL(&req->list);
Baptiste Assmanndfd35fd2019-01-21 08:18:09 +01001881 pool_free(dns_requester_pool, req);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001882 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001883 dns_free_resolution(res);
1884 }
Olivier Houchard8da5f982017-08-04 18:35:36 +02001885
Christopher Faulet67957bd2017-09-27 11:00:59 +02001886 free(resolvers->id);
1887 free((char *)resolvers->conf.file);
Olivier Houchard3f795f72019-04-17 22:51:06 +02001888 task_destroy(resolvers->t);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001889 LIST_DEL(&resolvers->list);
1890 free(resolvers);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001891 }
1892
Christopher Faulet67957bd2017-09-27 11:00:59 +02001893 list_for_each_entry_safe(srvrq, srvrqback, &dns_srvrq_list, list) {
1894 free(srvrq->name);
1895 free(srvrq->hostname_dn);
1896 LIST_DEL(&srvrq->list);
1897 free(srvrq);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001898 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001899}
1900
Christopher Faulet67957bd2017-09-27 11:00:59 +02001901/* Finalizes the DNS configuration by allocating required resources and checking
1902 * live parameters.
1903 * Returns 0 on success, ERR_* flags otherwise.
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001904 */
Christopher Faulet67957bd2017-09-27 11:00:59 +02001905static int dns_finalize_config(void)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001906{
Christopher Faulet67957bd2017-09-27 11:00:59 +02001907 struct dns_resolvers *resolvers;
1908 struct proxy *px;
1909 int err_code = 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001910
Christopher Faulet67957bd2017-09-27 11:00:59 +02001911 /* allocate pool of resolution per resolvers */
1912 list_for_each_entry(resolvers, &dns_resolvers, list) {
1913 struct dns_nameserver *ns;
1914 struct task *t;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001915
Christopher Faulet67957bd2017-09-27 11:00:59 +02001916 /* Check if we can create the socket with nameservers info */
1917 list_for_each_entry(ns, &resolvers->nameservers, list) {
1918 struct dgram_conn *dgram = NULL;
1919 int fd;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001920
Christopher Faulet67957bd2017-09-27 11:00:59 +02001921 /* Check nameserver info */
1922 if ((fd = socket(ns->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001923 ha_alert("config : resolvers '%s': can't create socket for nameserver '%s'.\n",
1924 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001925 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001926 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001927 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001928 if (connect(fd, (struct sockaddr*)&ns->addr, get_addr_len(&ns->addr)) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001929 ha_alert("config : resolvers '%s': can't connect socket for nameserver '%s'.\n",
1930 resolvers->id, ns->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001931 close(fd);
1932 err_code |= (ERR_ALERT|ERR_ABORT);
Olivier Houchard8da5f982017-08-04 18:35:36 +02001933 continue;
Olivier Houchard8da5f982017-08-04 18:35:36 +02001934 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02001935 close(fd);
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001936
Christopher Faulet67957bd2017-09-27 11:00:59 +02001937 /* Create dgram structure that will hold the UPD socket
1938 * and attach it on the current nameserver */
1939 if ((dgram = calloc(1, sizeof(*dgram))) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001940 ha_alert("config: resolvers '%s' : out of memory.\n",
1941 resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001942 err_code |= (ERR_ALERT|ERR_ABORT);
1943 goto err;
1944 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001945
Christopher Faulet67957bd2017-09-27 11:00:59 +02001946 /* Leave dgram partially initialized, no FD attached for
1947 * now. */
1948 dgram->owner = ns;
1949 dgram->data = &resolve_dgram_cb;
1950 dgram->t.sock.fd = -1;
1951 ns->dgram = dgram;
1952 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001953
Christopher Faulet67957bd2017-09-27 11:00:59 +02001954 /* Create the task associated to the resolvers section */
Emeric Brunc60def82017-09-27 14:59:38 +02001955 if ((t = task_new(MAX_THREADS_MASK)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001956 ha_alert("config : resolvers '%s' : out of memory.\n", resolvers->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001957 err_code |= (ERR_ALERT|ERR_ABORT);
1958 goto err;
1959 }
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001960
Christopher Faulet67957bd2017-09-27 11:00:59 +02001961 /* Update task's parameters */
1962 t->process = dns_process_resolvers;
1963 t->context = resolvers;
1964 resolvers->t = t;
1965 task_wakeup(t, TASK_WOKEN_INIT);
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001966 }
1967
Olivier Houchardfbc74e82017-11-24 16:54:05 +01001968 for (px = proxies_list; px; px = px->next) {
Christopher Faulet67957bd2017-09-27 11:00:59 +02001969 struct server *srv;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001970
Christopher Faulet67957bd2017-09-27 11:00:59 +02001971 for (srv = px->srv; srv; srv = srv->next) {
1972 struct dns_resolvers *resolvers;
Baptiste Assmann81ed1a02017-05-03 10:11:44 +02001973
Christopher Faulet67957bd2017-09-27 11:00:59 +02001974 if (!srv->resolvers_id)
1975 continue;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001976
Christopher Faulet67957bd2017-09-27 11:00:59 +02001977 if ((resolvers = find_resolvers_by_id(srv->resolvers_id)) == NULL) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001978 ha_alert("config : %s '%s', server '%s': unable to find required resolvers '%s'\n",
1979 proxy_type_str(px), px->id, srv->id, srv->resolvers_id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001980 err_code |= (ERR_ALERT|ERR_ABORT);
1981 continue;
1982 }
1983 srv->resolvers = resolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02001984
Christopher Faulet67957bd2017-09-27 11:00:59 +02001985 if (srv->srvrq && !srv->srvrq->resolvers) {
1986 srv->srvrq->resolvers = srv->resolvers;
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001987 if (dns_link_resolution(srv->srvrq, OBJ_TYPE_SRVRQ, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001988 ha_alert("config : %s '%s' : unable to set DNS resolution for server '%s'.\n",
1989 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001990 err_code |= (ERR_ALERT|ERR_ABORT);
1991 continue;
1992 }
1993 }
Olivier Houchard55dcdf42017-11-06 15:15:04 +01001994 if (dns_link_resolution(srv, OBJ_TYPE_SERVER, 0) == -1) {
Christopher Faulet767a84b2017-11-24 16:50:31 +01001995 ha_alert("config : %s '%s', unable to set DNS resolution for server '%s'.\n",
1996 proxy_type_str(px), px->id, srv->id);
Christopher Faulet67957bd2017-09-27 11:00:59 +02001997 err_code |= (ERR_ALERT|ERR_ABORT);
1998 continue;
1999 }
2000 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002001 }
2002
Christopher Faulet67957bd2017-09-27 11:00:59 +02002003 if (err_code & (ERR_ALERT|ERR_ABORT))
2004 goto err;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002005
Christopher Faulet67957bd2017-09-27 11:00:59 +02002006 return err_code;
2007 err:
2008 dns_deinit();
2009 return err_code;
2010
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002011}
2012
Christopher Faulet67957bd2017-09-27 11:00:59 +02002013/* if an arg is found, it sets the resolvers section pointer into cli.p0 */
Aurélien Nephtaliabbf6072018-04-18 13:26:46 +02002014static int cli_parse_stat_resolvers(char **args, char *payload, struct appctx *appctx, void *private)
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002015{
Christopher Faulet67957bd2017-09-27 11:00:59 +02002016 struct dns_resolvers *presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002017
Christopher Faulet67957bd2017-09-27 11:00:59 +02002018 if (*args[2]) {
2019 list_for_each_entry(presolvers, &dns_resolvers, list) {
2020 if (strcmp(presolvers->id, args[2]) == 0) {
2021 appctx->ctx.cli.p0 = presolvers;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002022 break;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002023 }
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002024 }
Willy Tarreau9d008692019-08-09 11:21:01 +02002025 if (appctx->ctx.cli.p0 == NULL)
2026 return cli_err(appctx, "Can't find that resolvers section\n");
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002027 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002028 return 0;
Baptiste Assmann201c07f2017-05-22 15:17:15 +02002029}
2030
Christopher Faulet67957bd2017-09-27 11:00:59 +02002031/* Dumps counters from all resolvers section and associated name servers. It
2032 * returns 0 if the output buffer is full and it needs to be called again,
2033 * otherwise non-zero. It may limit itself to the resolver pointed to by
Willy Tarreau777b5602016-12-16 18:06:26 +01002034 * <cli.p0> if it's not null.
William Lallemand69e96442016-11-19 00:58:54 +01002035 */
2036static int cli_io_handler_dump_resolvers_to_buffer(struct appctx *appctx)
2037{
2038 struct stream_interface *si = appctx->owner;
Christopher Faulet67957bd2017-09-27 11:00:59 +02002039 struct dns_resolvers *resolvers;
2040 struct dns_nameserver *ns;
William Lallemand69e96442016-11-19 00:58:54 +01002041
2042 chunk_reset(&trash);
2043
2044 switch (appctx->st2) {
2045 case STAT_ST_INIT:
2046 appctx->st2 = STAT_ST_LIST; /* let's start producing data */
2047 /* fall through */
2048
2049 case STAT_ST_LIST:
2050 if (LIST_ISEMPTY(&dns_resolvers)) {
2051 chunk_appendf(&trash, "No resolvers found\n");
2052 }
2053 else {
Christopher Faulet67957bd2017-09-27 11:00:59 +02002054 list_for_each_entry(resolvers, &dns_resolvers, list) {
2055 if (appctx->ctx.cli.p0 != NULL && appctx->ctx.cli.p0 != resolvers)
William Lallemand69e96442016-11-19 00:58:54 +01002056 continue;
2057
Christopher Faulet67957bd2017-09-27 11:00:59 +02002058 chunk_appendf(&trash, "Resolvers section %s\n", resolvers->id);
2059 list_for_each_entry(ns, &resolvers->nameservers, list) {
2060 chunk_appendf(&trash, " nameserver %s:\n", ns->id);
2061 chunk_appendf(&trash, " sent: %lld\n", ns->counters.sent);
2062 chunk_appendf(&trash, " snd_error: %lld\n", ns->counters.snd_error);
2063 chunk_appendf(&trash, " valid: %lld\n", ns->counters.valid);
2064 chunk_appendf(&trash, " update: %lld\n", ns->counters.update);
2065 chunk_appendf(&trash, " cname: %lld\n", ns->counters.cname);
2066 chunk_appendf(&trash, " cname_error: %lld\n", ns->counters.cname_error);
2067 chunk_appendf(&trash, " any_err: %lld\n", ns->counters.any_err);
2068 chunk_appendf(&trash, " nx: %lld\n", ns->counters.nx);
2069 chunk_appendf(&trash, " timeout: %lld\n", ns->counters.timeout);
2070 chunk_appendf(&trash, " refused: %lld\n", ns->counters.refused);
2071 chunk_appendf(&trash, " other: %lld\n", ns->counters.other);
2072 chunk_appendf(&trash, " invalid: %lld\n", ns->counters.invalid);
2073 chunk_appendf(&trash, " too_big: %lld\n", ns->counters.too_big);
2074 chunk_appendf(&trash, " truncated: %lld\n", ns->counters.truncated);
2075 chunk_appendf(&trash, " outdated: %lld\n", ns->counters.outdated);
William Lallemand69e96442016-11-19 00:58:54 +01002076 }
Christopher Faulet67957bd2017-09-27 11:00:59 +02002077 chunk_appendf(&trash, "\n");
William Lallemand69e96442016-11-19 00:58:54 +01002078 }
2079 }
2080
2081 /* display response */
Willy Tarreau06d80a92017-10-19 14:32:15 +02002082 if (ci_putchk(si_ic(si), &trash) == -1) {
William Lallemand69e96442016-11-19 00:58:54 +01002083 /* let's try again later from this session. We add ourselves into
2084 * this session's users so that it can remove us upon termination.
2085 */
Willy Tarreaudb398432018-11-15 11:08:52 +01002086 si_rx_room_blk(si);
William Lallemand69e96442016-11-19 00:58:54 +01002087 return 0;
2088 }
William Lallemand69e96442016-11-19 00:58:54 +01002089 /* fall through */
2090
2091 default:
2092 appctx->st2 = STAT_ST_FIN;
2093 return 1;
2094 }
2095}
2096
2097/* register cli keywords */
Christopher Fauletff88efb2017-10-03 16:00:57 +02002098static struct cli_kw_list cli_kws = {{ }, {
2099 { { "show", "resolvers", NULL }, "show resolvers [id]: dumps counters from all resolvers section and\n"
2100 " associated name servers",
2101 cli_parse_stat_resolvers, cli_io_handler_dump_resolvers_to_buffer },
2102 {{},}
2103 }
2104};
William Lallemand69e96442016-11-19 00:58:54 +01002105
Willy Tarreau0108d902018-11-25 19:14:37 +01002106INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
William Lallemand69e96442016-11-19 00:58:54 +01002107
Baptiste Assmann333939c2019-01-21 08:34:50 +01002108/*
2109 * Prepare <rule> for hostname resolution.
2110 * Returns -1 in case of any allocation failure, 0 if not.
2111 * On error, a global failure counter is also incremented.
2112 */
2113static int action_prepare_for_resolution(struct stream *stream, const char *hostname)
2114{
2115 char *hostname_dn;
2116 int hostname_len, hostname_dn_len;
2117 struct buffer *tmp = get_trash_chunk();
2118
2119 if (!hostname)
2120 return 0;
2121
2122 hostname_len = strlen(hostname);
2123 hostname_dn = tmp->area;
2124 hostname_dn_len = dns_str_to_dn_label(hostname, hostname_len + 1,
2125 hostname_dn, tmp->size);
2126 if (hostname_dn_len == -1)
2127 goto err;
2128
2129
2130 stream->dns_ctx.hostname_dn = strdup(hostname_dn);
2131 stream->dns_ctx.hostname_dn_len = hostname_dn_len;
2132 if (!stream->dns_ctx.hostname_dn)
2133 goto err;
2134
2135 return 0;
2136
2137 err:
2138 free(stream->dns_ctx.hostname_dn); stream->dns_ctx.hostname_dn = NULL;
2139 dns_failed_resolutions += 1;
2140 return -1;
2141}
2142
2143
2144/*
2145 * Execute the "do-resolution" action. May be called from {tcp,http}request.
2146 */
2147enum act_return dns_action_do_resolve(struct act_rule *rule, struct proxy *px,
2148 struct session *sess, struct stream *s, int flags)
2149{
Baptiste Assmann333939c2019-01-21 08:34:50 +01002150 struct dns_resolution *resolution;
Willy Tarreau45726fd2019-07-17 10:38:45 +02002151 struct sample *smp;
2152 char *fqdn;
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002153 struct dns_requester *req;
2154 struct dns_resolvers *resolvers;
2155 struct dns_resolution *res;
2156 int exp;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002157
2158 /* we have a response to our DNS resolution */
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002159 use_cache:
Baptiste Assmann333939c2019-01-21 08:34:50 +01002160 if (s->dns_ctx.dns_requester && s->dns_ctx.dns_requester->resolution != NULL) {
2161 resolution = s->dns_ctx.dns_requester->resolution;
Baptiste Assmann4c52e4b2019-10-01 15:32:40 +02002162 if (resolution->step == RSLV_STEP_RUNNING) {
2163 return ACT_RET_YIELD;
2164 }
Baptiste Assmann333939c2019-01-21 08:34:50 +01002165 if (resolution->step == RSLV_STEP_NONE) {
2166 /* We update the variable only if we have a valid response. */
2167 if (resolution->status == RSLV_STATUS_VALID) {
2168 struct sample smp;
2169 short ip_sin_family = 0;
2170 void *ip = NULL;
2171
2172 dns_get_ip_from_response(&resolution->response, &rule->arg.dns.dns_opts, NULL,
2173 0, &ip, &ip_sin_family, NULL);
2174
2175 switch (ip_sin_family) {
2176 case AF_INET:
2177 smp.data.type = SMP_T_IPV4;
2178 memcpy(&smp.data.u.ipv4, ip, 4);
2179 break;
2180 case AF_INET6:
2181 smp.data.type = SMP_T_IPV6;
2182 memcpy(&smp.data.u.ipv6, ip, 16);
2183 break;
2184 default:
2185 ip = NULL;
2186 }
2187
2188 if (ip) {
2189 smp.px = px;
2190 smp.sess = sess;
2191 smp.strm = s;
2192
2193 vars_set_by_name(rule->arg.dns.varname, strlen(rule->arg.dns.varname), &smp);
2194 }
2195 }
2196 }
2197
2198 free(s->dns_ctx.hostname_dn); s->dns_ctx.hostname_dn = NULL;
2199 s->dns_ctx.hostname_dn_len = 0;
2200 dns_unlink_resolution(s->dns_ctx.dns_requester);
2201
2202 pool_free(dns_requester_pool, s->dns_ctx.dns_requester);
2203 s->dns_ctx.dns_requester = NULL;
2204
2205 return ACT_RET_CONT;
2206 }
2207
2208 /* need to configure and start a new DNS resolution */
Willy Tarreau45726fd2019-07-17 10:38:45 +02002209 smp = sample_fetch_as_type(px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.dns.expr, SMP_T_STR);
2210 if (smp == NULL)
2211 return ACT_RET_CONT;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002212
Willy Tarreau45726fd2019-07-17 10:38:45 +02002213 fqdn = smp->data.u.str.area;
2214 if (action_prepare_for_resolution(s, fqdn) == -1)
2215 return ACT_RET_ERR;
Baptiste Assmann333939c2019-01-21 08:34:50 +01002216
Willy Tarreau45726fd2019-07-17 10:38:45 +02002217 s->dns_ctx.parent = rule;
2218 dns_link_resolution(s, OBJ_TYPE_STREAM, 0);
Baptiste Assmann7264dfe2019-10-30 16:06:53 +01002219
2220 /* Check if there is a fresh enough response in the cache of our associated resolution */
2221 req = s->dns_ctx.dns_requester;
2222 if (!req || !req->resolution) {
2223 dns_trigger_resolution(s->dns_ctx.dns_requester);
2224 return ACT_RET_YIELD;
2225 }
2226 res = req->resolution;
2227 resolvers = res->resolvers;
2228
2229 exp = tick_add(res->last_resolution, resolvers->hold.valid);
2230 if (resolvers->t && res->status == RSLV_STATUS_VALID && tick_isset(res->last_resolution)
2231 && !tick_is_expired(exp, now_ms)) {
2232 goto use_cache;
2233 }
2234
Willy Tarreau45726fd2019-07-17 10:38:45 +02002235 dns_trigger_resolution(s->dns_ctx.dns_requester);
Baptiste Assmann333939c2019-01-21 08:34:50 +01002236 return ACT_RET_YIELD;
2237}
2238
2239
2240/* parse "do-resolve" action
2241 * This action takes the following arguments:
2242 * do-resolve(<varName>,<resolversSectionName>,<resolvePrefer>) <expr>
2243 *
2244 * - <varName> is the variable name where the result of the DNS resolution will be stored
2245 * (mandatory)
2246 * - <resolversSectionName> is the name of the resolvers section to use to perform the resolution
2247 * (mandatory)
2248 * - <resolvePrefer> can be either 'ipv4' or 'ipv6' and is the IP family we would like to resolve first
2249 * (optional), defaults to ipv6
2250 * - <expr> is an HAProxy expression used to fetch the name to be resolved
2251 */
2252enum act_parse_ret dns_parse_do_resolve(const char **args, int *orig_arg, struct proxy *px, struct act_rule *rule, char **err)
2253{
2254 int cur_arg;
2255 struct sample_expr *expr;
2256 unsigned int where;
2257 const char *beg, *end;
2258
2259 /* orig_arg points to the first argument, but we need to analyse the command itself first */
2260 cur_arg = *orig_arg - 1;
2261
2262 /* locate varName, which is mandatory */
2263 beg = strchr(args[cur_arg], '(');
2264 if (beg == NULL)
2265 goto do_resolve_parse_error;
2266 beg = beg + 1; /* beg should points to the first character after opening parenthesis '(' */
2267 end = strchr(beg, ',');
2268 if (end == NULL)
2269 goto do_resolve_parse_error;
2270 rule->arg.dns.varname = my_strndup(beg, end - beg);
2271 if (rule->arg.dns.varname == NULL)
2272 goto do_resolve_parse_error;
2273
2274
2275 /* locate resolversSectionName, which is mandatory.
2276 * Since next parameters are optional, the delimiter may be comma ','
2277 * or closing parenthesis ')'
2278 */
2279 beg = end + 1;
2280 end = strchr(beg, ',');
2281 if (end == NULL)
2282 end = strchr(beg, ')');
2283 if (end == NULL)
2284 goto do_resolve_parse_error;
2285 rule->arg.dns.resolvers_id = my_strndup(beg, end - beg);
2286 if (rule->arg.dns.resolvers_id == NULL)
2287 goto do_resolve_parse_error;
2288
2289
2290 /* Default priority is ipv6 */
2291 rule->arg.dns.dns_opts.family_prio = AF_INET6;
2292
2293 /* optional arguments accepted for now:
2294 * ipv4 or ipv6
2295 */
2296 while (*end != ')') {
2297 beg = end + 1;
2298 end = strchr(beg, ',');
2299 if (end == NULL)
2300 end = strchr(beg, ')');
2301 if (end == NULL)
2302 goto do_resolve_parse_error;
2303
2304 if (strncmp(beg, "ipv4", end - beg) == 0) {
2305 rule->arg.dns.dns_opts.family_prio = AF_INET;
2306 }
2307 else if (strncmp(beg, "ipv6", end - beg) == 0) {
2308 rule->arg.dns.dns_opts.family_prio = AF_INET6;
2309 }
2310 else {
2311 goto do_resolve_parse_error;
2312 }
2313 }
2314
2315 cur_arg = cur_arg + 1;
2316
2317 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args);
2318 if (!expr)
2319 goto do_resolve_parse_error;
2320
2321
2322 where = 0;
2323 if (px->cap & PR_CAP_FE)
2324 where |= SMP_VAL_FE_HRQ_HDR;
2325 if (px->cap & PR_CAP_BE)
2326 where |= SMP_VAL_BE_HRQ_HDR;
2327
2328 if (!(expr->fetch->val & where)) {
2329 memprintf(err,
2330 "fetch method '%s' extracts information from '%s', none of which is available here",
2331 args[cur_arg-1], sample_src_names(expr->fetch->use));
2332 free(expr);
2333 return ACT_RET_PRS_ERR;
2334 }
2335 rule->arg.dns.expr = expr;
2336 rule->action = ACT_CUSTOM;
2337 rule->action_ptr = dns_action_do_resolve;
2338 *orig_arg = cur_arg;
2339
2340 rule->check_ptr = check_action_do_resolve;
2341
2342 return ACT_RET_PRS_OK;
2343
2344 do_resolve_parse_error:
2345 free(rule->arg.dns.varname); rule->arg.dns.varname = NULL;
2346 free(rule->arg.dns.resolvers_id); rule->arg.dns.resolvers_id = NULL;
2347 memprintf(err, "Can't parse '%s'. Expects 'do-resolve(<varname>,<resolvers>[,<options>]) <expr>'. Available options are 'ipv4' and 'ipv6'",
2348 args[cur_arg]);
2349 return ACT_RET_PRS_ERR;
2350}
2351
2352static struct action_kw_list http_req_kws = { { }, {
2353 { "do-resolve", dns_parse_do_resolve, 1 },
2354 { /* END */ }
2355}};
2356
2357INITCALL1(STG_REGISTER, http_req_keywords_register, &http_req_kws);
2358
2359static struct action_kw_list tcp_req_cont_actions = {ILH, {
2360 { "do-resolve", dns_parse_do_resolve, 1 },
2361 { /* END */ }
2362}};
2363
2364INITCALL1(STG_REGISTER, tcp_req_cont_keywords_register, &tcp_req_cont_actions);
2365
2366/* Check an "http-request do-resolve" action.
2367 *
2368 * The function returns 1 in success case, otherwise, it returns 0 and err is
2369 * filled.
2370 */
2371int check_action_do_resolve(struct act_rule *rule, struct proxy *px, char **err)
2372{
2373 struct dns_resolvers *resolvers = NULL;
2374
2375 if (rule->arg.dns.resolvers_id == NULL) {
2376 memprintf(err,"Proxy '%s': %s", px->id, "do-resolve action without resolvers");
2377 return 0;
2378 }
2379
2380 resolvers = find_resolvers_by_id(rule->arg.dns.resolvers_id);
2381 if (resolvers == NULL) {
2382 memprintf(err,"Can't find resolvers section '%s' for do-resolve action", rule->arg.dns.resolvers_id);
2383 return 0;
2384 }
2385 rule->arg.dns.resolvers = resolvers;
2386
2387 return 1;
2388}
2389
Willy Tarreau172f5ce2018-11-26 11:21:50 +01002390REGISTER_POST_DEINIT(dns_deinit);
Willy Tarreaue6552512018-11-26 11:33:13 +01002391REGISTER_CONFIG_POSTPARSER("dns runtime resolver", dns_finalize_config);