contrib/unbound/services/cache/dns.c

   1 /*
   2  * services/cache/dns.c - Cache services for DNS using msg and rrset caches.
   3  *
   4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * This file contains the DNS cache.
  40  */
  41 #include "config.h"
  42 #include "iterator/iter_delegpt.h"
  43 #include "validator/val_nsec.h"
  44 #include "validator/val_utils.h"
  45 #include "services/cache/dns.h"
  46 #include "services/cache/rrset.h"
  47 #include "util/data/msgreply.h"
  48 #include "util/data/packed_rrset.h"
  49 #include "util/data/dname.h"
  50 #include "util/module.h"
  51 #include "util/net_help.h"
  52 #include "util/regional.h"
  53 #include "util/config_file.h"
  54 #include "sldns/sbuffer.h"
  55
  56 /** store rrsets in the rrset cache.
  57  * @param env: module environment with caches.
  58  * @param rep: contains list of rrsets to store.
  59  * @param now: current time.
  60  * @param leeway: during prefetch how much leeway to update TTLs.
  61  *      This makes rrsets (other than type NS) timeout sooner so they get
  62  *      updated with a new full TTL.
  63  *      Type NS does not get this, because it must not be refreshed from the
  64  *      child domain, but keep counting down properly.
  65  * @param pside: if from parentside discovered NS, so that its NS is okay
  66  *      in a prefetch situation to be updated (without becoming sticky).
  67  * @param qrep: update rrsets here if cache is better
  68  * @param region: for qrep allocs.
  69  */
  70 static void
  71 store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
  72         time_t leeway, int pside, struct reply_info* qrep,
  73         struct regional* region)
  74 {
  75         size_t i;
  76         /* see if rrset already exists in cache, if not insert it. */
  77         for(i=0; i<rep->rrset_count; i++) {
  78                 rep->ref[i].key = rep->rrsets[i];
  79                 rep->ref[i].id = rep->rrsets[i]->id;
  80                 /* update ref if it was in the cache */
  81                 switch(rrset_cache_update(env->rrset_cache, &rep->ref[i],
  82                         env->alloc, now + ((ntohs(rep->ref[i].key->rk.type)==
  83                         LDNS_RR_TYPE_NS && !pside)?0:leeway))) {
  84                 case 0: /* ref unchanged, item inserted */
  85                         break;
  86                 case 2: /* ref updated, cache is superior */
  87                         if(region) {
  88                                 struct ub_packed_rrset_key* ck;
  89                                 lock_rw_rdlock(&rep->ref[i].key->entry.lock);
  90                                 /* if deleted rrset, do not copy it */
  91                                 if(rep->ref[i].key->id == 0)
  92                                         ck = NULL;
  93                                 else    ck = packed_rrset_copy_region(
  94                                         rep->ref[i].key, region, now);
  95                                 lock_rw_unlock(&rep->ref[i].key->entry.lock);
  96                                 if(ck) {
  97                                         /* use cached copy if memory allows */
  98                                         qrep->rrsets[i] = ck;
  99                                 }
 100                         }
 101                         /* no break: also copy key item */
 102                 case 1: /* ref updated, item inserted */
 103                         rep->rrsets[i] = rep->ref[i].key;
 104                 }
 105         }
 106 }
 107
 108 void
 109 dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 110         hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside,
 111         struct reply_info* qrep, struct regional* region)
 112 {
 113         struct msgreply_entry* e;
 114         time_t ttl = rep->ttl;
 115         size_t i;
 116
 117         /* store RRsets */
 118         for(i=0; i<rep->rrset_count; i++) {
 119                 rep->ref[i].key = rep->rrsets[i];
 120                 rep->ref[i].id = rep->rrsets[i]->id;
 121         }
 122
 123         /* there was a reply_info_sortref(rep) here but it seems to be
 124          * unnecessary, because the cache gets locked per rrset. */
 125         reply_info_set_ttls(rep, *env->now);
 126         store_rrsets(env, rep, *env->now, leeway, pside, qrep, region);
 127         if(ttl == 0) {
 128                 /* we do not store the message, but we did store the RRs,
 129                  * which could be useful for delegation information */
 130                 verbose(VERB_ALGO, "TTL 0: dropped msg from cache");
 131                 free(rep);
 132                 return;
 133         }
 134
 135         /* store msg in the cache */
 136         reply_info_sortref(rep);
 137         if(!(e = query_info_entrysetup(qinfo, rep, hash))) {
 138                 log_err("store_msg: malloc failed");
 139                 return;
 140         }
 141         slabhash_insert(env->msg_cache, hash, &e->entry, rep, env->alloc);
 142 }
 143
 144 /** find closest NS or DNAME and returns the rrset (locked) */
 145 static struct ub_packed_rrset_key*
 146 find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen,
 147         uint16_t qclass, time_t now, uint16_t searchtype, int stripfront)
 148 {
 149         struct ub_packed_rrset_key *rrset;
 150         uint8_t lablen;
 151
 152         if(stripfront) {
 153                 /* strip off so that DNAMEs have strict subdomain match */
 154                 lablen = *qname;
 155                 qname += lablen + 1;
 156                 qnamelen -= lablen + 1;
 157         }
 158
 159         /* snip off front part of qname until the type is found */
 160         while(qnamelen > 0) {
 161                 if((rrset = rrset_cache_lookup(env->rrset_cache, qname,
 162                         qnamelen, searchtype, qclass, 0, now, 0)))
 163                         return rrset;
 164
 165                 /* snip off front label */
 166                 lablen = *qname;
 167                 qname += lablen + 1;
 168                 qnamelen -= lablen + 1;
 169         }
 170         return NULL;
 171 }
 172
 173 /** add addr to additional section */
 174 static void
 175 addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region,
 176         struct dns_msg* msg, time_t now)
 177 {
 178         if((msg->rep->rrsets[msg->rep->rrset_count] =
 179                 packed_rrset_copy_region(rrset, region, now))) {
 180                 msg->rep->ar_numrrsets++;
 181                 msg->rep->rrset_count++;
 182         }
 183 }
 184
 185 /** lookup message in message cache */
 186 struct msgreply_entry*
 187 msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen,
 188         uint16_t qtype, uint16_t qclass, uint16_t flags, time_t now, int wr)
 189 {
 190         struct lruhash_entry* e;
 191         struct query_info k;
 192         hashvalue_type h;
 193
 194         k.qname = qname;
 195         k.qname_len = qnamelen;
 196         k.qtype = qtype;
 197         k.qclass = qclass;
 198         k.local_alias = NULL;
 199         h = query_info_hash(&k, flags);
 200         e = slabhash_lookup(env->msg_cache, h, &k, wr);
 201
 202         if(!e) return NULL;
 203         if( now > ((struct reply_info*)e->data)->ttl ) {
 204                 lock_rw_unlock(&e->lock);
 205                 return NULL;
 206         }
 207         return (struct msgreply_entry*)e->key;
 208 }
 209
 210 /** find and add A and AAAA records for nameservers in delegpt */
 211 static int
 212 find_add_addrs(struct module_env* env, uint16_t qclass,
 213         struct regional* region, struct delegpt* dp, time_t now,
 214         struct dns_msg** msg)
 215 {
 216         struct delegpt_ns* ns;
 217         struct msgreply_entry* neg;
 218         struct ub_packed_rrset_key* akey;
 219         for(ns = dp->nslist; ns; ns = ns->next) {
 220                 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 221                         ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 222                 if(akey) {
 223                         if(!delegpt_add_rrset_A(dp, region, akey, 0)) {
 224                                 lock_rw_unlock(&akey->entry.lock);
 225                                 return 0;
 226                         }
 227                         if(msg)
 228                                 addr_to_additional(akey, region, *msg, now);
 229                         lock_rw_unlock(&akey->entry.lock);
 230                 } else {
 231                         /* BIT_CD on false because delegpt lookup does
 232                          * not use dns64 translation */
 233                         neg = msg_cache_lookup(env, ns->name, ns->namelen,
 234                                 LDNS_RR_TYPE_A, qclass, 0, now, 0);
 235                         if(neg) {
 236                                 delegpt_add_neg_msg(dp, neg);
 237                                 lock_rw_unlock(&neg->entry.lock);
 238                         }
 239                 }
 240                 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 241                         ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 242                 if(akey) {
 243                         if(!delegpt_add_rrset_AAAA(dp, region, akey, 0)) {
 244                                 lock_rw_unlock(&akey->entry.lock);
 245                                 return 0;
 246                         }
 247                         if(msg)
 248                                 addr_to_additional(akey, region, *msg, now);
 249                         lock_rw_unlock(&akey->entry.lock);
 250                 } else {
 251                         /* BIT_CD on false because delegpt lookup does
 252                          * not use dns64 translation */
 253                         neg = msg_cache_lookup(env, ns->name, ns->namelen,
 254                                 LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 255                         if(neg) {
 256                                 delegpt_add_neg_msg(dp, neg);
 257                                 lock_rw_unlock(&neg->entry.lock);
 258                         }
 259                 }
 260         }
 261         return 1;
 262 }
 263
 264 /** find and add A and AAAA records for missing nameservers in delegpt */
 265 int
 266 cache_fill_missing(struct module_env* env, uint16_t qclass,
 267         struct regional* region, struct delegpt* dp)
 268 {
 269         struct delegpt_ns* ns;
 270         struct msgreply_entry* neg;
 271         struct ub_packed_rrset_key* akey;
 272         time_t now = *env->now;
 273         for(ns = dp->nslist; ns; ns = ns->next) {
 274                 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 275                         ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 276                 if(akey) {
 277                         if(!delegpt_add_rrset_A(dp, region, akey, ns->lame)) {
 278                                 lock_rw_unlock(&akey->entry.lock);
 279                                 return 0;
 280                         }
 281                         log_nametypeclass(VERB_ALGO, "found in cache",
 282                                 ns->name, LDNS_RR_TYPE_A, qclass);
 283                         lock_rw_unlock(&akey->entry.lock);
 284                 } else {
 285                         /* BIT_CD on false because delegpt lookup does
 286                          * not use dns64 translation */
 287                         neg = msg_cache_lookup(env, ns->name, ns->namelen,
 288                                 LDNS_RR_TYPE_A, qclass, 0, now, 0);
 289                         if(neg) {
 290                                 delegpt_add_neg_msg(dp, neg);
 291                                 lock_rw_unlock(&neg->entry.lock);
 292                         }
 293                 }
 294                 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 295                         ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 296                 if(akey) {
 297                         if(!delegpt_add_rrset_AAAA(dp, region, akey, ns->lame)) {
 298                                 lock_rw_unlock(&akey->entry.lock);
 299                                 return 0;
 300                         }
 301                         log_nametypeclass(VERB_ALGO, "found in cache",
 302                                 ns->name, LDNS_RR_TYPE_AAAA, qclass);
 303                         lock_rw_unlock(&akey->entry.lock);
 304                 } else {
 305                         /* BIT_CD on false because delegpt lookup does
 306                          * not use dns64 translation */
 307                         neg = msg_cache_lookup(env, ns->name, ns->namelen,
 308                                 LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 309                         if(neg) {
 310                                 delegpt_add_neg_msg(dp, neg);
 311                                 lock_rw_unlock(&neg->entry.lock);
 312                         }
 313                 }
 314         }
 315         return 1;
 316 }
 317
 318 /** find and add DS or NSEC to delegation msg */
 319 static void
 320 find_add_ds(struct module_env* env, struct regional* region,
 321         struct dns_msg* msg, struct delegpt* dp, time_t now)
 322 {
 323         /* Lookup the DS or NSEC at the delegation point. */
 324         struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
 325                 env->rrset_cache, dp->name, dp->namelen, LDNS_RR_TYPE_DS,
 326                 msg->qinfo.qclass, 0, now, 0);
 327         if(!rrset) {
 328                 /* NOTE: this won't work for alternate NSEC schemes
 329                  *      (opt-in, NSEC3) */
 330                 rrset = rrset_cache_lookup(env->rrset_cache, dp->name,
 331                         dp->namelen, LDNS_RR_TYPE_NSEC, msg->qinfo.qclass,
 332                         0, now, 0);
 333                 /* Note: the PACKED_RRSET_NSEC_AT_APEX flag is not used.
 334                  * since this is a referral, we need the NSEC at the parent
 335                  * side of the zone cut, not the NSEC at apex side. */
 336                 if(rrset && nsec_has_type(rrset, LDNS_RR_TYPE_DS)) {
 337                         lock_rw_unlock(&rrset->entry.lock);
 338                         rrset = NULL; /* discard wrong NSEC */
 339                 }
 340         }
 341         if(rrset) {
 342                 /* add it to auth section. This is the second rrset. */
 343                 if((msg->rep->rrsets[msg->rep->rrset_count] =
 344                         packed_rrset_copy_region(rrset, region, now))) {
 345                         msg->rep->ns_numrrsets++;
 346                         msg->rep->rrset_count++;
 347                 }
 348                 lock_rw_unlock(&rrset->entry.lock);
 349         }
 350 }
 351
 352 struct dns_msg*
 353 dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 354         uint16_t qclass, struct regional* region, size_t capacity)
 355 {
 356         struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
 357                 sizeof(struct dns_msg));
 358         if(!msg)
 359                 return NULL;
 360         msg->qinfo.qname = regional_alloc_init(region, qname, qnamelen);
 361         if(!msg->qinfo.qname)
 362                 return NULL;
 363         msg->qinfo.qname_len = qnamelen;
 364         msg->qinfo.qtype = qtype;
 365         msg->qinfo.qclass = qclass;
 366         msg->qinfo.local_alias = NULL;
 367         /* non-packed reply_info, because it needs to grow the array */
 368         msg->rep = (struct reply_info*)regional_alloc_zero(region,
 369                 sizeof(struct reply_info)-sizeof(struct rrset_ref));
 370         if(!msg->rep)
 371                 return NULL;
 372         if(capacity > RR_COUNT_MAX)
 373                 return NULL; /* integer overflow protection */
 374         msg->rep->flags = BIT_QR; /* with QR, no AA */
 375         msg->rep->qdcount = 1;
 376         msg->rep->rrsets = (struct ub_packed_rrset_key**)
 377                 regional_alloc(region,
 378                 capacity*sizeof(struct ub_packed_rrset_key*));
 379         if(!msg->rep->rrsets)
 380                 return NULL;
 381         return msg;
 382 }
 383
 384 int
 385 dns_msg_authadd(struct dns_msg* msg, struct regional* region,
 386         struct ub_packed_rrset_key* rrset, time_t now)
 387 {
 388         if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
 389                 packed_rrset_copy_region(rrset, region, now)))
 390                 return 0;
 391         msg->rep->ns_numrrsets++;
 392         return 1;
 393 }
 394
 395 /** add rrset to answer section */
 396 static int
 397 dns_msg_ansadd(struct dns_msg* msg, struct regional* region,
 398         struct ub_packed_rrset_key* rrset, time_t now)
 399 {
 400         if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
 401                 packed_rrset_copy_region(rrset, region, now)))
 402                 return 0;
 403         msg->rep->an_numrrsets++;
 404         return 1;
 405 }
 406
 407 struct delegpt*
 408 dns_cache_find_delegation(struct module_env* env, uint8_t* qname,
 409         size_t qnamelen, uint16_t qtype, uint16_t qclass,
 410         struct regional* region, struct dns_msg** msg, time_t now)
 411 {
 412         /* try to find closest NS rrset */
 413         struct ub_packed_rrset_key* nskey;
 414         struct packed_rrset_data* nsdata;
 415         struct delegpt* dp;
 416
 417         nskey = find_closest_of_type(env, qname, qnamelen, qclass, now,
 418                 LDNS_RR_TYPE_NS, 0);
 419         if(!nskey) /* hope the caller has hints to prime or something */
 420                 return NULL;
 421         nsdata = (struct packed_rrset_data*)nskey->entry.data;
 422         /* got the NS key, create delegation point */
 423         dp = delegpt_create(region);
 424         if(!dp || !delegpt_set_name(dp, region, nskey->rk.dname)) {
 425                 lock_rw_unlock(&nskey->entry.lock);
 426                 log_err("find_delegation: out of memory");
 427                 return NULL;
 428         }
 429         /* create referral message */
 430         if(msg) {
 431                 /* allocate the array to as much as we could need:
 432                  *      NS rrset + DS/NSEC rrset +
 433                  *      A rrset for every NS RR
 434                  *      AAAA rrset for every NS RR
 435                  */
 436                 *msg = dns_msg_create(qname, qnamelen, qtype, qclass, region,
 437                         2 + nsdata->count*2);
 438                 if(!*msg || !dns_msg_authadd(*msg, region, nskey, now)) {
 439                         lock_rw_unlock(&nskey->entry.lock);
 440                         log_err("find_delegation: out of memory");
 441                         return NULL;
 442                 }
 443         }
 444         if(!delegpt_rrset_add_ns(dp, region, nskey, 0))
 445                 log_err("find_delegation: addns out of memory");
 446         lock_rw_unlock(&nskey->entry.lock); /* first unlock before next lookup*/
 447         /* find and add DS/NSEC (if any) */
 448         if(msg)
 449                 find_add_ds(env, region, *msg, dp, now);
 450         /* find and add A entries */
 451         if(!find_add_addrs(env, qclass, region, dp, now, msg))
 452                 log_err("find_delegation: addrs out of memory");
 453         return dp;
 454 }
 455
 456 /** allocate dns_msg from query_info and reply_info */
 457 static struct dns_msg*
 458 gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
 459 {
 460         struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
 461                 sizeof(struct dns_msg));
 462         if(!msg)
 463                 return NULL;
 464         memcpy(&msg->qinfo, q, sizeof(struct query_info));
 465         msg->qinfo.qname = regional_alloc_init(region, q->qname, q->qname_len);
 466         if(!msg->qinfo.qname)
 467                 return NULL;
 468         /* allocate replyinfo struct and rrset key array separately */
 469         msg->rep = (struct reply_info*)regional_alloc(region,
 470                 sizeof(struct reply_info) - sizeof(struct rrset_ref));
 471         if(!msg->rep)
 472                 return NULL;
 473         if(num > RR_COUNT_MAX)
 474                 return NULL; /* integer overflow protection */
 475         msg->rep->rrsets = (struct ub_packed_rrset_key**)
 476                 regional_alloc(region,
 477                 num * sizeof(struct ub_packed_rrset_key*));
 478         if(!msg->rep->rrsets)
 479                 return NULL;
 480         return msg;
 481 }
 482
 483 struct dns_msg*
 484 tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 485         struct regional* region, time_t now, struct regional* scratch)
 486 {
 487         struct dns_msg* msg;
 488         size_t i;
 489         if(now > r->ttl)
 490                 return NULL;
 491         msg = gen_dns_msg(region, q, r->rrset_count);
 492         if(!msg)
 493                 return NULL;
 494         msg->rep->flags = r->flags;
 495         msg->rep->qdcount = r->qdcount;
 496         msg->rep->ttl = r->ttl - now;
 497         if(r->prefetch_ttl > now)
 498                 msg->rep->prefetch_ttl = r->prefetch_ttl - now;
 499         else    msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 500         msg->rep->security = r->security;
 501         msg->rep->an_numrrsets = r->an_numrrsets;
 502         msg->rep->ns_numrrsets = r->ns_numrrsets;
 503         msg->rep->ar_numrrsets = r->ar_numrrsets;
 504         msg->rep->rrset_count = r->rrset_count;
 505         msg->rep->authoritative = r->authoritative;
 506         if(!rrset_array_lock(r->ref, r->rrset_count, now))
 507                 return NULL;
 508         if(r->an_numrrsets > 0 && (r->rrsets[0]->rk.type == htons(
 509                 LDNS_RR_TYPE_CNAME) || r->rrsets[0]->rk.type == htons(
 510                 LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(q, r)) {
 511                 /* cname chain is now invalid, reconstruct msg */
 512                 rrset_array_unlock(r->ref, r->rrset_count);
 513                 return NULL;
 514         }
 515         if(r->security == sec_status_secure && !reply_all_rrsets_secure(r)) {
 516                 /* message rrsets have changed status, revalidate */
 517                 rrset_array_unlock(r->ref, r->rrset_count);
 518                 return NULL;
 519         }
 520         for(i=0; i<msg->rep->rrset_count; i++) {
 521                 msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i],
 522                         region, now);
 523                 if(!msg->rep->rrsets[i]) {
 524                         rrset_array_unlock(r->ref, r->rrset_count);
 525                         return NULL;
 526                 }
 527         }
 528         if(env)
 529                 rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref,
 530                 r->rrset_count);
 531         else
 532                 rrset_array_unlock(r->ref, r->rrset_count);
 533         return msg;
 534 }
 535
 536 /** synthesize RRset-only response from cached RRset item */
 537 static struct dns_msg*
 538 rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 539         time_t now, struct query_info* q)
 540 {
 541         struct dns_msg* msg;
 542         struct packed_rrset_data* d = (struct packed_rrset_data*)
 543                 rrset->entry.data;
 544         if(now > d->ttl)
 545                 return NULL;
 546         msg = gen_dns_msg(region, q, 1); /* only the CNAME (or other) RRset */
 547         if(!msg)
 548                 return NULL;
 549         msg->rep->flags = BIT_QR; /* reply, no AA, no error */
 550         msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
 551         msg->rep->qdcount = 1;
 552         msg->rep->ttl = d->ttl - now;
 553         msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 554         msg->rep->security = sec_status_unchecked;
 555         msg->rep->an_numrrsets = 1;
 556         msg->rep->ns_numrrsets = 0;
 557         msg->rep->ar_numrrsets = 0;
 558         msg->rep->rrset_count = 1;
 559         msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
 560         if(!msg->rep->rrsets[0]) /* copy CNAME */
 561                 return NULL;
 562         return msg;
 563 }
 564
 565 /** synthesize DNAME+CNAME response from cached DNAME item */
 566 static struct dns_msg*
 567 synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 568         time_t now, struct query_info* q)
 569 {
 570         struct dns_msg* msg;
 571         struct ub_packed_rrset_key* ck;
 572         struct packed_rrset_data* newd, *d = (struct packed_rrset_data*)
 573                 rrset->entry.data;
 574         uint8_t* newname, *dtarg = NULL;
 575         size_t newlen, dtarglen;
 576         if(now > d->ttl)
 577                 return NULL;
 578         /* only allow validated (with DNSSEC) DNAMEs used from cache
 579          * for insecure DNAMEs, query again. */
 580         if(d->security != sec_status_secure)
 581                 return NULL;
 582         msg = gen_dns_msg(region, q, 2); /* DNAME + CNAME RRset */
 583         if(!msg)
 584                 return NULL;
 585         msg->rep->flags = BIT_QR; /* reply, no AA, no error */
 586         msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
 587         msg->rep->qdcount = 1;
 588         msg->rep->ttl = d->ttl - now;
 589         msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 590         msg->rep->security = sec_status_unchecked;
 591         msg->rep->an_numrrsets = 1;
 592         msg->rep->ns_numrrsets = 0;
 593         msg->rep->ar_numrrsets = 0;
 594         msg->rep->rrset_count = 1;
 595         msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
 596         if(!msg->rep->rrsets[0]) /* copy DNAME */
 597                 return NULL;
 598         /* synth CNAME rrset */
 599         get_cname_target(rrset, &dtarg, &dtarglen);
 600         if(!dtarg)
 601                 return NULL;
 602         newlen = q->qname_len + dtarglen - rrset->rk.dname_len;
 603         if(newlen > LDNS_MAX_DOMAINLEN) {
 604                 msg->rep->flags |= LDNS_RCODE_YXDOMAIN;
 605                 return msg;
 606         }
 607         newname = (uint8_t*)regional_alloc(region, newlen);
 608         if(!newname)
 609                 return NULL;
 610         /* new name is concatenation of qname front (without DNAME owner)
 611          * and DNAME target name */
 612         memcpy(newname, q->qname, q->qname_len-rrset->rk.dname_len);
 613         memmove(newname+(q->qname_len-rrset->rk.dname_len), dtarg, dtarglen);
 614         /* create rest of CNAME rrset */
 615         ck = (struct ub_packed_rrset_key*)regional_alloc(region,
 616                 sizeof(struct ub_packed_rrset_key));
 617         if(!ck)
 618                 return NULL;
 619         memset(&ck->entry, 0, sizeof(ck->entry));
 620         msg->rep->rrsets[1] = ck;
 621         ck->entry.key = ck;
 622         ck->rk.type = htons(LDNS_RR_TYPE_CNAME);
 623         ck->rk.rrset_class = rrset->rk.rrset_class;
 624         ck->rk.flags = 0;
 625         ck->rk.dname = regional_alloc_init(region, q->qname, q->qname_len);
 626         if(!ck->rk.dname)
 627                 return NULL;
 628         ck->rk.dname_len = q->qname_len;
 629         ck->entry.hash = rrset_key_hash(&ck->rk);
 630         newd = (struct packed_rrset_data*)regional_alloc_zero(region,
 631                 sizeof(struct packed_rrset_data) + sizeof(size_t) +
 632                 sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t)
 633                 + newlen);
 634         if(!newd)
 635                 return NULL;
 636         ck->entry.data = newd;
 637         newd->ttl = 0; /* 0 for synthesized CNAME TTL */
 638         newd->count = 1;
 639         newd->rrsig_count = 0;
 640         newd->trust = rrset_trust_ans_noAA;
 641         newd->rr_len = (size_t*)((uint8_t*)newd +
 642                 sizeof(struct packed_rrset_data));
 643         newd->rr_len[0] = newlen + sizeof(uint16_t);
 644         packed_rrset_ptr_fixup(newd);
 645         newd->rr_ttl[0] = newd->ttl;
 646         msg->rep->ttl = newd->ttl;
 647         msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(newd->ttl);
 648         sldns_write_uint16(newd->rr_data[0], newlen);
 649         memmove(newd->rr_data[0] + sizeof(uint16_t), newname, newlen);
 650         msg->rep->an_numrrsets ++;
 651         msg->rep->rrset_count ++;
 652         return msg;
 653 }
 654
 655 /** Fill TYPE_ANY response with some data from cache */
 656 static struct dns_msg*
 657 fill_any(struct module_env* env,
 658         uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
 659         struct regional* region)
 660 {
 661         time_t now = *env->now;
 662         struct dns_msg* msg = NULL;
 663         uint16_t lookup[] = {LDNS_RR_TYPE_A, LDNS_RR_TYPE_AAAA,
 664                 LDNS_RR_TYPE_MX, LDNS_RR_TYPE_SOA, LDNS_RR_TYPE_NS,
 665                 LDNS_RR_TYPE_DNAME, 0};
 666         int i, num=6; /* number of RR types to look up */
 667         log_assert(lookup[num] == 0);
 668
 669         for(i=0; i<num; i++) {
 670                 /* look up this RR for inclusion in type ANY response */
 671                 struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
 672                         env->rrset_cache, qname, qnamelen, lookup[i],
 673                         qclass, 0, now, 0);
 674                 struct packed_rrset_data *d;
 675                 if(!rrset)
 676                         continue;
 677
 678                 /* only if rrset from answer section */
 679                 d = (struct packed_rrset_data*)rrset->entry.data;
 680                 if(d->trust == rrset_trust_add_noAA ||
 681                         d->trust == rrset_trust_auth_noAA ||
 682                         d->trust == rrset_trust_add_AA ||
 683                         d->trust == rrset_trust_auth_AA) {
 684                         lock_rw_unlock(&rrset->entry.lock);
 685                         continue;
 686                 }
 687
 688                 /* create msg if none */
 689                 if(!msg) {
 690                         msg = dns_msg_create(qname, qnamelen, qtype, qclass,
 691                                 region, (size_t)(num-i));
 692                         if(!msg) {
 693                                 lock_rw_unlock(&rrset->entry.lock);
 694                                 return NULL;
 695                         }
 696                 }
 697
 698                 /* add RRset to response */
 699                 if(!dns_msg_ansadd(msg, region, rrset, now)) {
 700                         lock_rw_unlock(&rrset->entry.lock);
 701                         return NULL;
 702                 }
 703                 lock_rw_unlock(&rrset->entry.lock);
 704         }
 705         return msg;
 706 }
 707
 708 struct dns_msg*
 709 dns_cache_lookup(struct module_env* env,
 710         uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
 711         uint16_t flags, struct regional* region, struct regional* scratch)
 712 {
 713         struct lruhash_entry* e;
 714         struct query_info k;
 715         hashvalue_type h;
 716         time_t now = *env->now;
 717         struct ub_packed_rrset_key* rrset;
 718
 719         /* lookup first, this has both NXdomains and ANSWER responses */
 720         k.qname = qname;
 721         k.qname_len = qnamelen;
 722         k.qtype = qtype;
 723         k.qclass = qclass;
 724         k.local_alias = NULL;
 725         h = query_info_hash(&k, flags);
 726         e = slabhash_lookup(env->msg_cache, h, &k, 0);
 727         if(e) {
 728                 struct msgreply_entry* key = (struct msgreply_entry*)e->key;
 729                 struct reply_info* data = (struct reply_info*)e->data;
 730                 struct dns_msg* msg = tomsg(env, &key->key, data, region, now,
 731                         scratch);
 732                 if(msg) {
 733                         lock_rw_unlock(&e->lock);
 734                         return msg;
 735                 }
 736                 /* could be msg==NULL; due to TTL or not all rrsets available */
 737                 lock_rw_unlock(&e->lock);
 738         }
 739
 740         /* see if a DNAME exists. Checked for first, to enforce that DNAMEs
 741          * are more important, the CNAME is resynthesized and thus
 742          * consistent with the DNAME */
 743         if( (rrset=find_closest_of_type(env, qname, qnamelen, qclass, now,
 744                 LDNS_RR_TYPE_DNAME, 1))) {
 745                 /* synthesize a DNAME+CNAME message based on this */
 746                 struct dns_msg* msg = synth_dname_msg(rrset, region, now, &k);
 747                 if(msg) {
 748                         lock_rw_unlock(&rrset->entry.lock);
 749                         return msg;
 750                 }
 751                 lock_rw_unlock(&rrset->entry.lock);
 752         }
 753
 754         /* see if we have CNAME for this domain,
 755          * but not for DS records (which are part of the parent) */
 756         if( qtype != LDNS_RR_TYPE_DS &&
 757            (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
 758                 LDNS_RR_TYPE_CNAME, qclass, 0, now, 0))) {
 759                 uint8_t* wc = NULL;
 760                 /* if the rrset is not a wildcard expansion, with wcname */
 761                 /* because, if we return that CNAME rrset on its own, it is
 762                  * missing the NSEC or NSEC3 proof */
 763                 if(!(val_rrset_wildcard(rrset, &wc) && wc != NULL)) {
 764                         struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
 765                         if(msg) {
 766                                 lock_rw_unlock(&rrset->entry.lock);
 767                                 return msg;
 768                         }
 769                 }
 770                 lock_rw_unlock(&rrset->entry.lock);
 771         }
 772
 773         /* construct DS, DNSKEY, DLV messages from rrset cache. */
 774         if((qtype == LDNS_RR_TYPE_DS || qtype == LDNS_RR_TYPE_DNSKEY ||
 775                 qtype == LDNS_RR_TYPE_DLV) &&
 776                 (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
 777                 qtype, qclass, 0, now, 0))) {
 778                 /* if the rrset is from the additional section, and the
 779                  * signatures have fallen off, then do not synthesize a msg
 780                  * instead, allow a full query for signed results to happen.
 781                  * Forego all rrset data from additional section, because
 782                  * some signatures may not be present and cause validation
 783                  * failure.
 784                  */
 785                 struct packed_rrset_data *d = (struct packed_rrset_data*)
 786                         rrset->entry.data;
 787                 if(d->trust != rrset_trust_add_noAA &&
 788                         d->trust != rrset_trust_add_AA &&
 789                         (qtype == LDNS_RR_TYPE_DS ||
 790                                 (d->trust != rrset_trust_auth_noAA
 791                                 && d->trust != rrset_trust_auth_AA) )) {
 792                         struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
 793                         if(msg) {
 794                                 lock_rw_unlock(&rrset->entry.lock);
 795                                 return msg;
 796                         }
 797                 }
 798                 lock_rw_unlock(&rrset->entry.lock);
 799         }
 800
 801         /* stop downwards cache search on NXDOMAIN.
 802          * Empty nonterminals are NOERROR, so an NXDOMAIN for foo
 803          * means bla.foo also does not exist.  The DNSSEC proofs are
 804          * the same.  We search upwards for NXDOMAINs. */
 805         if(env->cfg->harden_below_nxdomain)
 806             while(!dname_is_root(k.qname)) {
 807                 dname_remove_label(&k.qname, &k.qname_len);
 808                 h = query_info_hash(&k, flags);
 809                 e = slabhash_lookup(env->msg_cache, h, &k, 0);
 810                 if(!e && k.qtype != LDNS_RR_TYPE_A &&
 811                         env->cfg->qname_minimisation) {
 812                         k.qtype = LDNS_RR_TYPE_A;
 813                         h = query_info_hash(&k, flags);
 814                         e = slabhash_lookup(env->msg_cache, h, &k, 0);
 815                 }
 816                 if(e) {
 817                         struct reply_info* data = (struct reply_info*)e->data;
 818                         struct dns_msg* msg;
 819                         if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN
 820                           && data->security == sec_status_secure
 821                           && (msg=tomsg(env, &k, data, region, now, scratch))){
 822                                 lock_rw_unlock(&e->lock);
 823                                 msg->qinfo.qname=qname;
 824                                 msg->qinfo.qname_len=qnamelen;
 825                                 /* check that DNSSEC really works out */
 826                                 msg->rep->security = sec_status_unchecked;
 827                                 return msg;
 828                         }
 829                         lock_rw_unlock(&e->lock);
 830                 }
 831                 k.qtype = qtype;
 832             }
 833
 834         /* fill common RR types for ANY response to avoid requery */
 835         if(qtype == LDNS_RR_TYPE_ANY) {
 836                 return fill_any(env, qname, qnamelen, qtype, qclass, region);
 837         }
 838
 839         return NULL;
 840 }
 841
 842 int
 843 dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 844         struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
 845         struct regional* region, uint16_t flags)
 846 {
 847         struct reply_info* rep = NULL;
 848         /* alloc, malloc properly (not in region, like msg is) */
 849         rep = reply_info_copy(msgrep, env->alloc, NULL);
 850         if(!rep)
 851                 return 0;
 852         /* ttl must be relative ;i.e. 0..86400 not  time(0)+86400.
 853          * the env->now is added to message and RRsets in this routine. */
 854         /* the leeway is used to invalidate other rrsets earlier */
 855
 856         if(is_referral) {
 857                 /* store rrsets */
 858                 struct rrset_ref ref;
 859                 size_t i;
 860                 for(i=0; i<rep->rrset_count; i++) {
 861                         packed_rrset_ttl_add((struct packed_rrset_data*)
 862                                 rep->rrsets[i]->entry.data, *env->now);
 863                         ref.key = rep->rrsets[i];
 864                         ref.id = rep->rrsets[i]->id;
 865                         /*ignore ret: it was in the cache, ref updated */
 866                         /* no leeway for typeNS */
 867                         (void)rrset_cache_update(env->rrset_cache, &ref,
 868                                 env->alloc, *env->now +
 869                                 ((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS
 870                                  && !pside) ? 0:leeway));
 871                 }
 872                 free(rep);
 873                 return 1;
 874         } else {
 875                 /* store msg, and rrsets */
 876                 struct query_info qinf;
 877                 hashvalue_type h;
 878
 879                 qinf = *msgqinf;
 880                 qinf.qname = memdup(msgqinf->qname, msgqinf->qname_len);
 881                 if(!qinf.qname) {
 882                         reply_info_parsedelete(rep, env->alloc);
 883                         return 0;
 884                 }
 885                 /* fixup flags to be sensible for a reply based on the cache */
 886                 /* this module means that RA is available. It is an answer QR.
 887                  * Not AA from cache. Not CD in cache (depends on client bit). */
 888                 rep->flags |= (BIT_RA | BIT_QR);
 889                 rep->flags &= ~(BIT_AA | BIT_CD);
 890                 h = query_info_hash(&qinf, flags);
 891                 dns_cache_store_msg(env, &qinf, h, rep, leeway, pside, msgrep,
 892                         region);
 893                 /* qname is used inside query_info_entrysetup, and set to
 894                  * NULL. If it has not been used, free it. free(0) is safe. */
 895                 free(qinf.qname);
 896         }
 897         return 1;
 898 }
 899
 900 int
 901 dns_cache_prefetch_adjust(struct module_env* env, struct query_info* qinfo,
 902         time_t adjust, uint16_t flags)
 903 {
 904         struct msgreply_entry* msg;
 905         msg = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len,
 906                 qinfo->qtype, qinfo->qclass, flags, *env->now, 1);
 907         if(msg) {
 908                 struct reply_info* rep = (struct reply_info*)msg->entry.data;
 909                 if(rep) {
 910                         rep->prefetch_ttl += adjust;
 911                         lock_rw_unlock(&msg->entry.lock);
 912                         return 1;
 913                 }
 914                 lock_rw_unlock(&msg->entry.lock);
 915         }
 916         return 0;
 917 }