2 * services/cache/dns.c - Cache services for DNS using msg and rrset caches.
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
6 * This software is open source.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 * This file contains the DNS cache.
42 #include "iterator/iter_delegpt.h"
43 #include "iterator/iter_utils.h"
44 #include "validator/val_nsec.h"
45 #include "validator/val_utils.h"
46 #include "services/cache/dns.h"
47 #include "services/cache/rrset.h"
48 #include "util/data/msgparse.h"
49 #include "util/data/msgreply.h"
50 #include "util/data/packed_rrset.h"
51 #include "util/data/dname.h"
52 #include "util/module.h"
53 #include "util/net_help.h"
54 #include "util/regional.h"
55 #include "util/config_file.h"
56 #include "sldns/sbuffer.h"
58 /** store rrsets in the rrset cache.
59 * @param env: module environment with caches.
60 * @param rep: contains list of rrsets to store.
61 * @param now: current time.
62 * @param leeway: during prefetch how much leeway to update TTLs.
63 * This makes rrsets (other than type NS) timeout sooner so they get
64 * updated with a new full TTL.
65 * Type NS does not get this, because it must not be refreshed from the
66 * child domain, but keep counting down properly.
67 * @param pside: if from parentside discovered NS, so that its NS is okay
68 * in a prefetch situation to be updated (without becoming sticky).
69 * @param qrep: update rrsets here if cache is better
70 * @param region: for qrep allocs.
73 store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
74 time_t leeway, int pside, struct reply_info* qrep,
75 struct regional* region)
78 /* see if rrset already exists in cache, if not insert it. */
79 for(i=0; i<rep->rrset_count; i++) {
80 rep->ref[i].key = rep->rrsets[i];
81 rep->ref[i].id = rep->rrsets[i]->id;
82 /* update ref if it was in the cache */
83 switch(rrset_cache_update(env->rrset_cache, &rep->ref[i],
84 env->alloc, now + ((ntohs(rep->ref[i].key->rk.type)==
85 LDNS_RR_TYPE_NS && !pside)?0:leeway))) {
86 case 0: /* ref unchanged, item inserted */
88 case 2: /* ref updated, cache is superior */
90 struct ub_packed_rrset_key* ck;
91 lock_rw_rdlock(&rep->ref[i].key->entry.lock);
92 /* if deleted rrset, do not copy it */
93 if(rep->ref[i].key->id == 0)
95 else ck = packed_rrset_copy_region(
96 rep->ref[i].key, region, now);
97 lock_rw_unlock(&rep->ref[i].key->entry.lock);
99 /* use cached copy if memory allows */
100 qrep->rrsets[i] = ck;
103 /* no break: also copy key item */
104 /* the line below is matched by gcc regex and silences
105 * the fallthrough warning */
107 case 1: /* ref updated, item inserted */
108 rep->rrsets[i] = rep->ref[i].key;
113 /** delete message from message cache */
115 msg_cache_remove(struct module_env* env, uint8_t* qname, size_t qnamelen,
116 uint16_t qtype, uint16_t qclass, uint16_t flags)
122 k.qname_len = qnamelen;
125 k.local_alias = NULL;
126 h = query_info_hash(&k, flags);
127 slabhash_remove(env->msg_cache, h, &k);
130 /** remove servfail msg cache entry */
132 msg_del_servfail(struct module_env* env, struct query_info* qinfo,
135 struct msgreply_entry* e;
136 /* see if the entry is servfail, and then remove it, so that
137 * lookups move from the cacheresponse stage to the recursionresponse
139 e = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len,
140 qinfo->qtype, qinfo->qclass, flags, 0, 0);
142 /* we don't check for the ttl here, also expired servfail entries
143 * are removed. If the user uses serve-expired, they would still be
144 * used to answer from cache */
145 if(FLAGS_GET_RCODE(((struct reply_info*)e->entry.data)->flags)
146 != LDNS_RCODE_SERVFAIL) {
147 lock_rw_unlock(&e->entry.lock);
150 lock_rw_unlock(&e->entry.lock);
151 msg_cache_remove(env, qinfo->qname, qinfo->qname_len, qinfo->qtype,
152 qinfo->qclass, flags);
156 dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
157 hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside,
158 struct reply_info* qrep, uint32_t flags, struct regional* region)
160 struct msgreply_entry* e;
161 time_t ttl = rep->ttl;
165 for(i=0; i<rep->rrset_count; i++) {
166 rep->ref[i].key = rep->rrsets[i];
167 rep->ref[i].id = rep->rrsets[i]->id;
170 /* there was a reply_info_sortref(rep) here but it seems to be
171 * unnecessary, because the cache gets locked per rrset. */
172 reply_info_set_ttls(rep, *env->now);
173 store_rrsets(env, rep, *env->now, leeway, pside, qrep, region);
174 if(ttl == 0 && !(flags & DNSCACHE_STORE_ZEROTTL)) {
175 /* we do not store the message, but we did store the RRs,
176 * which could be useful for delegation information */
177 verbose(VERB_ALGO, "TTL 0: dropped msg from cache");
179 /* if the message is SERVFAIL in cache, remove that SERVFAIL,
180 * so that the TTL 0 response can be returned for future
181 * responses (i.e. don't get answered by the servfail from
182 * cache, but instead go to recursion to get this TTL0
184 msg_del_servfail(env, qinfo, flags);
188 /* store msg in the cache */
189 reply_info_sortref(rep);
190 if(!(e = query_info_entrysetup(qinfo, rep, hash))) {
191 log_err("store_msg: malloc failed");
194 slabhash_insert(env->msg_cache, hash, &e->entry, rep, env->alloc);
197 /** find closest NS or DNAME and returns the rrset (locked) */
198 static struct ub_packed_rrset_key*
199 find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen,
200 uint16_t qclass, time_t now, uint16_t searchtype, int stripfront)
202 struct ub_packed_rrset_key *rrset;
206 /* strip off so that DNAMEs have strict subdomain match */
209 qnamelen -= lablen + 1;
212 /* snip off front part of qname until the type is found */
213 while(qnamelen > 0) {
214 if((rrset = rrset_cache_lookup(env->rrset_cache, qname,
215 qnamelen, searchtype, qclass, 0, now, 0)))
218 /* snip off front label */
221 qnamelen -= lablen + 1;
226 /** add addr to additional section */
228 addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region,
229 struct dns_msg* msg, time_t now)
231 if((msg->rep->rrsets[msg->rep->rrset_count] =
232 packed_rrset_copy_region(rrset, region, now))) {
233 msg->rep->ar_numrrsets++;
234 msg->rep->rrset_count++;
238 /** lookup message in message cache */
239 struct msgreply_entry*
240 msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen,
241 uint16_t qtype, uint16_t qclass, uint16_t flags, time_t now, int wr)
243 struct lruhash_entry* e;
248 k.qname_len = qnamelen;
251 k.local_alias = NULL;
252 h = query_info_hash(&k, flags);
253 e = slabhash_lookup(env->msg_cache, h, &k, wr);
256 if( now > ((struct reply_info*)e->data)->ttl ) {
257 lock_rw_unlock(&e->lock);
260 return (struct msgreply_entry*)e->key;
263 /** find and add A and AAAA records for nameservers in delegpt */
265 find_add_addrs(struct module_env* env, uint16_t qclass,
266 struct regional* region, struct delegpt* dp, time_t now,
267 struct dns_msg** msg)
269 struct delegpt_ns* ns;
270 struct msgreply_entry* neg;
271 struct ub_packed_rrset_key* akey;
272 for(ns = dp->nslist; ns; ns = ns->next) {
273 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
274 ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
276 if(!delegpt_add_rrset_A(dp, region, akey, 0, NULL)) {
277 lock_rw_unlock(&akey->entry.lock);
281 addr_to_additional(akey, region, *msg, now);
282 lock_rw_unlock(&akey->entry.lock);
284 /* BIT_CD on false because delegpt lookup does
285 * not use dns64 translation */
286 neg = msg_cache_lookup(env, ns->name, ns->namelen,
287 LDNS_RR_TYPE_A, qclass, 0, now, 0);
289 delegpt_add_neg_msg(dp, neg);
290 lock_rw_unlock(&neg->entry.lock);
293 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
294 ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
296 if(!delegpt_add_rrset_AAAA(dp, region, akey, 0, NULL)) {
297 lock_rw_unlock(&akey->entry.lock);
301 addr_to_additional(akey, region, *msg, now);
302 lock_rw_unlock(&akey->entry.lock);
304 /* BIT_CD on false because delegpt lookup does
305 * not use dns64 translation */
306 neg = msg_cache_lookup(env, ns->name, ns->namelen,
307 LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
309 delegpt_add_neg_msg(dp, neg);
310 lock_rw_unlock(&neg->entry.lock);
317 /** find and add A and AAAA records for missing nameservers in delegpt */
319 cache_fill_missing(struct module_env* env, uint16_t qclass,
320 struct regional* region, struct delegpt* dp)
322 struct delegpt_ns* ns;
323 struct msgreply_entry* neg;
324 struct ub_packed_rrset_key* akey;
325 time_t now = *env->now;
326 for(ns = dp->nslist; ns; ns = ns->next) {
327 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
328 ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
330 if(!delegpt_add_rrset_A(dp, region, akey, ns->lame,
332 lock_rw_unlock(&akey->entry.lock);
335 log_nametypeclass(VERB_ALGO, "found in cache",
336 ns->name, LDNS_RR_TYPE_A, qclass);
337 lock_rw_unlock(&akey->entry.lock);
339 /* BIT_CD on false because delegpt lookup does
340 * not use dns64 translation */
341 neg = msg_cache_lookup(env, ns->name, ns->namelen,
342 LDNS_RR_TYPE_A, qclass, 0, now, 0);
344 delegpt_add_neg_msg(dp, neg);
345 lock_rw_unlock(&neg->entry.lock);
348 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
349 ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
351 if(!delegpt_add_rrset_AAAA(dp, region, akey, ns->lame,
353 lock_rw_unlock(&akey->entry.lock);
356 log_nametypeclass(VERB_ALGO, "found in cache",
357 ns->name, LDNS_RR_TYPE_AAAA, qclass);
358 lock_rw_unlock(&akey->entry.lock);
360 /* BIT_CD on false because delegpt lookup does
361 * not use dns64 translation */
362 neg = msg_cache_lookup(env, ns->name, ns->namelen,
363 LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
365 delegpt_add_neg_msg(dp, neg);
366 lock_rw_unlock(&neg->entry.lock);
373 /** find and add DS or NSEC to delegation msg */
375 find_add_ds(struct module_env* env, struct regional* region,
376 struct dns_msg* msg, struct delegpt* dp, time_t now)
378 /* Lookup the DS or NSEC at the delegation point. */
379 struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
380 env->rrset_cache, dp->name, dp->namelen, LDNS_RR_TYPE_DS,
381 msg->qinfo.qclass, 0, now, 0);
383 /* NOTE: this won't work for alternate NSEC schemes
385 rrset = rrset_cache_lookup(env->rrset_cache, dp->name,
386 dp->namelen, LDNS_RR_TYPE_NSEC, msg->qinfo.qclass,
388 /* Note: the PACKED_RRSET_NSEC_AT_APEX flag is not used.
389 * since this is a referral, we need the NSEC at the parent
390 * side of the zone cut, not the NSEC at apex side. */
391 if(rrset && nsec_has_type(rrset, LDNS_RR_TYPE_DS)) {
392 lock_rw_unlock(&rrset->entry.lock);
393 rrset = NULL; /* discard wrong NSEC */
397 /* add it to auth section. This is the second rrset. */
398 if((msg->rep->rrsets[msg->rep->rrset_count] =
399 packed_rrset_copy_region(rrset, region, now))) {
400 msg->rep->ns_numrrsets++;
401 msg->rep->rrset_count++;
403 lock_rw_unlock(&rrset->entry.lock);
408 dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
409 uint16_t qclass, struct regional* region, size_t capacity)
411 struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
412 sizeof(struct dns_msg));
415 msg->qinfo.qname = regional_alloc_init(region, qname, qnamelen);
416 if(!msg->qinfo.qname)
418 msg->qinfo.qname_len = qnamelen;
419 msg->qinfo.qtype = qtype;
420 msg->qinfo.qclass = qclass;
421 msg->qinfo.local_alias = NULL;
422 /* non-packed reply_info, because it needs to grow the array */
423 msg->rep = (struct reply_info*)regional_alloc_zero(region,
424 sizeof(struct reply_info)-sizeof(struct rrset_ref));
427 if(capacity > RR_COUNT_MAX)
428 return NULL; /* integer overflow protection */
429 msg->rep->flags = BIT_QR; /* with QR, no AA */
430 msg->rep->qdcount = 1;
431 msg->rep->rrsets = (struct ub_packed_rrset_key**)
432 regional_alloc(region,
433 capacity*sizeof(struct ub_packed_rrset_key*));
434 if(!msg->rep->rrsets)
440 dns_msg_authadd(struct dns_msg* msg, struct regional* region,
441 struct ub_packed_rrset_key* rrset, time_t now)
443 if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
444 packed_rrset_copy_region(rrset, region, now)))
446 msg->rep->ns_numrrsets++;
451 dns_msg_ansadd(struct dns_msg* msg, struct regional* region,
452 struct ub_packed_rrset_key* rrset, time_t now)
454 if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
455 packed_rrset_copy_region(rrset, region, now)))
457 msg->rep->an_numrrsets++;
462 dns_cache_find_delegation(struct module_env* env, uint8_t* qname,
463 size_t qnamelen, uint16_t qtype, uint16_t qclass,
464 struct regional* region, struct dns_msg** msg, time_t now)
466 /* try to find closest NS rrset */
467 struct ub_packed_rrset_key* nskey;
468 struct packed_rrset_data* nsdata;
471 nskey = find_closest_of_type(env, qname, qnamelen, qclass, now,
473 if(!nskey) /* hope the caller has hints to prime or something */
475 nsdata = (struct packed_rrset_data*)nskey->entry.data;
476 /* got the NS key, create delegation point */
477 dp = delegpt_create(region);
478 if(!dp || !delegpt_set_name(dp, region, nskey->rk.dname)) {
479 lock_rw_unlock(&nskey->entry.lock);
480 log_err("find_delegation: out of memory");
483 /* create referral message */
485 /* allocate the array to as much as we could need:
486 * NS rrset + DS/NSEC rrset +
487 * A rrset for every NS RR
488 * AAAA rrset for every NS RR
490 *msg = dns_msg_create(qname, qnamelen, qtype, qclass, region,
491 2 + nsdata->count*2);
492 if(!*msg || !dns_msg_authadd(*msg, region, nskey, now)) {
493 lock_rw_unlock(&nskey->entry.lock);
494 log_err("find_delegation: out of memory");
498 if(!delegpt_rrset_add_ns(dp, region, nskey, 0))
499 log_err("find_delegation: addns out of memory");
500 lock_rw_unlock(&nskey->entry.lock); /* first unlock before next lookup*/
501 /* find and add DS/NSEC (if any) */
503 find_add_ds(env, region, *msg, dp, now);
504 /* find and add A entries */
505 if(!find_add_addrs(env, qclass, region, dp, now, msg))
506 log_err("find_delegation: addrs out of memory");
510 /** allocate dns_msg from query_info and reply_info */
511 static struct dns_msg*
512 gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
514 struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
515 sizeof(struct dns_msg));
518 memcpy(&msg->qinfo, q, sizeof(struct query_info));
519 msg->qinfo.qname = regional_alloc_init(region, q->qname, q->qname_len);
520 if(!msg->qinfo.qname)
522 /* allocate replyinfo struct and rrset key array separately */
523 msg->rep = (struct reply_info*)regional_alloc(region,
524 sizeof(struct reply_info) - sizeof(struct rrset_ref));
527 if(num > RR_COUNT_MAX)
528 return NULL; /* integer overflow protection */
529 msg->rep->rrsets = (struct ub_packed_rrset_key**)
530 regional_alloc(region,
531 num * sizeof(struct ub_packed_rrset_key*));
532 if(!msg->rep->rrsets)
538 tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
539 struct regional* region, time_t now, int allow_expired,
540 struct regional* scratch)
545 time_t now_control = now;
547 /* Check if we are allowed to serve expired */
549 if(env->cfg->serve_expired_ttl &&
550 r->serve_expired_ttl < now) {
556 /* Change the current time so we can pass the below TTL checks when
557 * serving expired data. */
558 now_control = r->ttl - env->cfg->serve_expired_reply_ttl;
562 msg = gen_dns_msg(region, q, r->rrset_count);
563 if(!msg) return NULL;
564 msg->rep->flags = r->flags;
565 msg->rep->qdcount = r->qdcount;
566 msg->rep->ttl = is_expired
567 ?SERVE_EXPIRED_REPLY_TTL
569 if(r->prefetch_ttl > now)
570 msg->rep->prefetch_ttl = r->prefetch_ttl - now;
572 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
573 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
574 msg->rep->security = r->security;
575 msg->rep->an_numrrsets = r->an_numrrsets;
576 msg->rep->ns_numrrsets = r->ns_numrrsets;
577 msg->rep->ar_numrrsets = r->ar_numrrsets;
578 msg->rep->rrset_count = r->rrset_count;
579 msg->rep->authoritative = r->authoritative;
580 if(!rrset_array_lock(r->ref, r->rrset_count, now_control)) {
583 if(r->an_numrrsets > 0 && (r->rrsets[0]->rk.type == htons(
584 LDNS_RR_TYPE_CNAME) || r->rrsets[0]->rk.type == htons(
585 LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(q, r)) {
586 /* cname chain is now invalid, reconstruct msg */
587 rrset_array_unlock(r->ref, r->rrset_count);
590 if(r->security == sec_status_secure && !reply_all_rrsets_secure(r)) {
591 /* message rrsets have changed status, revalidate */
592 rrset_array_unlock(r->ref, r->rrset_count);
595 for(i=0; i<msg->rep->rrset_count; i++) {
596 msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i],
598 if(!msg->rep->rrsets[i]) {
599 rrset_array_unlock(r->ref, r->rrset_count);
604 rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref,
607 rrset_array_unlock(r->ref, r->rrset_count);
611 /** synthesize RRset-only response from cached RRset item */
612 static struct dns_msg*
613 rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
614 time_t now, struct query_info* q)
617 struct packed_rrset_data* d = (struct packed_rrset_data*)
621 msg = gen_dns_msg(region, q, 1); /* only the CNAME (or other) RRset */
624 msg->rep->flags = BIT_QR; /* reply, no AA, no error */
625 msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
626 msg->rep->qdcount = 1;
627 msg->rep->ttl = d->ttl - now;
628 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
629 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
630 msg->rep->security = sec_status_unchecked;
631 msg->rep->an_numrrsets = 1;
632 msg->rep->ns_numrrsets = 0;
633 msg->rep->ar_numrrsets = 0;
634 msg->rep->rrset_count = 1;
635 msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
636 if(!msg->rep->rrsets[0]) /* copy CNAME */
641 /** synthesize DNAME+CNAME response from cached DNAME item */
642 static struct dns_msg*
643 synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
644 time_t now, struct query_info* q, enum sec_status* sec_status)
647 struct ub_packed_rrset_key* ck;
648 struct packed_rrset_data* newd, *d = (struct packed_rrset_data*)
650 uint8_t* newname, *dtarg = NULL;
651 size_t newlen, dtarglen;
654 /* only allow validated (with DNSSEC) DNAMEs used from cache
655 * for insecure DNAMEs, query again. */
656 *sec_status = d->security;
657 /* return sec status, so the status of the CNAME can be checked
658 * by the calling routine. */
659 msg = gen_dns_msg(region, q, 2); /* DNAME + CNAME RRset */
662 msg->rep->flags = BIT_QR; /* reply, no AA, no error */
663 msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
664 msg->rep->qdcount = 1;
665 msg->rep->ttl = d->ttl - now;
666 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
667 msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
668 msg->rep->security = sec_status_unchecked;
669 msg->rep->an_numrrsets = 1;
670 msg->rep->ns_numrrsets = 0;
671 msg->rep->ar_numrrsets = 0;
672 msg->rep->rrset_count = 1;
673 msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
674 if(!msg->rep->rrsets[0]) /* copy DNAME */
676 /* synth CNAME rrset */
677 get_cname_target(rrset, &dtarg, &dtarglen);
680 newlen = q->qname_len + dtarglen - rrset->rk.dname_len;
681 if(newlen > LDNS_MAX_DOMAINLEN) {
682 msg->rep->flags |= LDNS_RCODE_YXDOMAIN;
685 newname = (uint8_t*)regional_alloc(region, newlen);
688 /* new name is concatenation of qname front (without DNAME owner)
689 * and DNAME target name */
690 memcpy(newname, q->qname, q->qname_len-rrset->rk.dname_len);
691 memmove(newname+(q->qname_len-rrset->rk.dname_len), dtarg, dtarglen);
692 /* create rest of CNAME rrset */
693 ck = (struct ub_packed_rrset_key*)regional_alloc(region,
694 sizeof(struct ub_packed_rrset_key));
697 memset(&ck->entry, 0, sizeof(ck->entry));
698 msg->rep->rrsets[1] = ck;
700 ck->rk.type = htons(LDNS_RR_TYPE_CNAME);
701 ck->rk.rrset_class = rrset->rk.rrset_class;
703 ck->rk.dname = regional_alloc_init(region, q->qname, q->qname_len);
706 ck->rk.dname_len = q->qname_len;
707 ck->entry.hash = rrset_key_hash(&ck->rk);
708 newd = (struct packed_rrset_data*)regional_alloc_zero(region,
709 sizeof(struct packed_rrset_data) + sizeof(size_t) +
710 sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t)
714 ck->entry.data = newd;
715 newd->ttl = 0; /* 0 for synthesized CNAME TTL */
717 newd->rrsig_count = 0;
718 newd->trust = rrset_trust_ans_noAA;
719 newd->rr_len = (size_t*)((uint8_t*)newd +
720 sizeof(struct packed_rrset_data));
721 newd->rr_len[0] = newlen + sizeof(uint16_t);
722 packed_rrset_ptr_fixup(newd);
723 newd->rr_ttl[0] = newd->ttl;
724 msg->rep->ttl = newd->ttl;
725 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(newd->ttl);
726 msg->rep->serve_expired_ttl = newd->ttl + SERVE_EXPIRED_TTL;
727 sldns_write_uint16(newd->rr_data[0], newlen);
728 memmove(newd->rr_data[0] + sizeof(uint16_t), newname, newlen);
729 msg->rep->an_numrrsets ++;
730 msg->rep->rrset_count ++;
734 /** Fill TYPE_ANY response with some data from cache */
735 static struct dns_msg*
736 fill_any(struct module_env* env,
737 uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
738 struct regional* region)
740 time_t now = *env->now;
741 struct dns_msg* msg = NULL;
742 uint16_t lookup[] = {LDNS_RR_TYPE_A, LDNS_RR_TYPE_AAAA,
743 LDNS_RR_TYPE_MX, LDNS_RR_TYPE_SOA, LDNS_RR_TYPE_NS,
744 LDNS_RR_TYPE_DNAME, 0};
745 int i, num=6; /* number of RR types to look up */
746 log_assert(lookup[num] == 0);
748 if(env->cfg->deny_any) {
749 /* return empty message */
750 msg = dns_msg_create(qname, qnamelen, qtype, qclass,
755 /* set NOTIMPL for RFC 8482 */
756 msg->rep->flags |= LDNS_RCODE_NOTIMPL;
757 msg->rep->security = sec_status_indeterminate;
761 for(i=0; i<num; i++) {
762 /* look up this RR for inclusion in type ANY response */
763 struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
764 env->rrset_cache, qname, qnamelen, lookup[i],
766 struct packed_rrset_data *d;
770 /* only if rrset from answer section */
771 d = (struct packed_rrset_data*)rrset->entry.data;
772 if(d->trust == rrset_trust_add_noAA ||
773 d->trust == rrset_trust_auth_noAA ||
774 d->trust == rrset_trust_add_AA ||
775 d->trust == rrset_trust_auth_AA) {
776 lock_rw_unlock(&rrset->entry.lock);
780 /* create msg if none */
782 msg = dns_msg_create(qname, qnamelen, qtype, qclass,
783 region, (size_t)(num-i));
785 lock_rw_unlock(&rrset->entry.lock);
790 /* add RRset to response */
791 if(!dns_msg_ansadd(msg, region, rrset, now)) {
792 lock_rw_unlock(&rrset->entry.lock);
795 lock_rw_unlock(&rrset->entry.lock);
801 dns_cache_lookup(struct module_env* env,
802 uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
803 uint16_t flags, struct regional* region, struct regional* scratch,
806 struct lruhash_entry* e;
809 time_t now = *env->now;
810 struct ub_packed_rrset_key* rrset;
812 /* lookup first, this has both NXdomains and ANSWER responses */
814 k.qname_len = qnamelen;
817 k.local_alias = NULL;
818 h = query_info_hash(&k, flags);
819 e = slabhash_lookup(env->msg_cache, h, &k, 0);
821 struct msgreply_entry* key = (struct msgreply_entry*)e->key;
822 struct reply_info* data = (struct reply_info*)e->data;
823 struct dns_msg* msg = tomsg(env, &key->key, data, region, now, 0,
826 lock_rw_unlock(&e->lock);
829 /* could be msg==NULL; due to TTL or not all rrsets available */
830 lock_rw_unlock(&e->lock);
833 /* see if a DNAME exists. Checked for first, to enforce that DNAMEs
834 * are more important, the CNAME is resynthesized and thus
835 * consistent with the DNAME */
837 (rrset=find_closest_of_type(env, qname, qnamelen, qclass, now,
838 LDNS_RR_TYPE_DNAME, 1))) {
839 /* synthesize a DNAME+CNAME message based on this */
840 enum sec_status sec_status = sec_status_unchecked;
841 struct dns_msg* msg = synth_dname_msg(rrset, region, now, &k,
844 struct ub_packed_rrset_key* cname_rrset;
845 lock_rw_unlock(&rrset->entry.lock);
846 /* now, after unlocking the DNAME rrset lock,
847 * check the sec_status, and see if we need to look
848 * up the CNAME record associated before it can
850 /* normally, only secure DNAMEs allowed from cache*/
851 if(sec_status == sec_status_secure)
853 /* but if we have a CNAME cached with this name, then we
854 * have previously already allowed this name to pass.
855 * the next cache lookup is going to fetch that CNAME itself,
856 * but it is better to have the (unsigned)DNAME + CNAME in
858 cname_rrset = rrset_cache_lookup(
859 env->rrset_cache, qname, qnamelen,
860 LDNS_RR_TYPE_CNAME, qclass, 0, now, 0);
862 /* CNAME already synthesized by
863 * synth_dname_msg routine, so we can
864 * straight up return the msg */
865 lock_rw_unlock(&cname_rrset->entry.lock);
869 lock_rw_unlock(&rrset->entry.lock);
873 /* see if we have CNAME for this domain,
874 * but not for DS records (which are part of the parent) */
875 if(!no_partial && qtype != LDNS_RR_TYPE_DS &&
876 (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
877 LDNS_RR_TYPE_CNAME, qclass, 0, now, 0))) {
880 /* if the rrset is not a wildcard expansion, with wcname */
881 /* because, if we return that CNAME rrset on its own, it is
882 * missing the NSEC or NSEC3 proof */
883 if(!(val_rrset_wildcard(rrset, &wc, &wl) && wc != NULL)) {
884 struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
886 lock_rw_unlock(&rrset->entry.lock);
890 lock_rw_unlock(&rrset->entry.lock);
893 /* construct DS, DNSKEY messages from rrset cache. */
894 if((qtype == LDNS_RR_TYPE_DS || qtype == LDNS_RR_TYPE_DNSKEY) &&
895 (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
896 qtype, qclass, 0, now, 0))) {
897 /* if the rrset is from the additional section, and the
898 * signatures have fallen off, then do not synthesize a msg
899 * instead, allow a full query for signed results to happen.
900 * Forego all rrset data from additional section, because
901 * some signatures may not be present and cause validation
904 struct packed_rrset_data *d = (struct packed_rrset_data*)
906 if(d->trust != rrset_trust_add_noAA &&
907 d->trust != rrset_trust_add_AA &&
908 (qtype == LDNS_RR_TYPE_DS ||
909 (d->trust != rrset_trust_auth_noAA
910 && d->trust != rrset_trust_auth_AA) )) {
911 struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
913 lock_rw_unlock(&rrset->entry.lock);
917 lock_rw_unlock(&rrset->entry.lock);
920 /* stop downwards cache search on NXDOMAIN.
921 * Empty nonterminals are NOERROR, so an NXDOMAIN for foo
922 * means bla.foo also does not exist. The DNSSEC proofs are
923 * the same. We search upwards for NXDOMAINs. */
924 if(env->cfg->harden_below_nxdomain) {
925 while(!dname_is_root(k.qname)) {
926 dname_remove_label(&k.qname, &k.qname_len);
927 h = query_info_hash(&k, flags);
928 e = slabhash_lookup(env->msg_cache, h, &k, 0);
929 if(!e && k.qtype != LDNS_RR_TYPE_A &&
930 env->cfg->qname_minimisation) {
931 k.qtype = LDNS_RR_TYPE_A;
932 h = query_info_hash(&k, flags);
933 e = slabhash_lookup(env->msg_cache, h, &k, 0);
936 struct reply_info* data = (struct reply_info*)e->data;
938 if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN
939 && data->security == sec_status_secure
940 && (data->an_numrrsets == 0 ||
941 ntohs(data->rrsets[0]->rk.type) != LDNS_RR_TYPE_CNAME)
942 && (msg=tomsg(env, &k, data, region, now, 0, scratch))) {
943 lock_rw_unlock(&e->lock);
944 msg->qinfo.qname=qname;
945 msg->qinfo.qname_len=qnamelen;
946 /* check that DNSSEC really works out */
947 msg->rep->security = sec_status_unchecked;
948 iter_scrub_nxdomain(msg);
951 lock_rw_unlock(&e->lock);
957 /* fill common RR types for ANY response to avoid requery */
958 if(qtype == LDNS_RR_TYPE_ANY) {
959 return fill_any(env, qname, qnamelen, qtype, qclass, region);
966 dns_cache_store(struct module_env* env, struct query_info* msgqinf,
967 struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
968 struct regional* region, uint32_t flags)
970 struct reply_info* rep = NULL;
971 /* alloc, malloc properly (not in region, like msg is) */
972 rep = reply_info_copy(msgrep, env->alloc, NULL);
975 /* ttl must be relative ;i.e. 0..86400 not time(0)+86400.
976 * the env->now is added to message and RRsets in this routine. */
977 /* the leeway is used to invalidate other rrsets earlier */
981 struct rrset_ref ref;
983 for(i=0; i<rep->rrset_count; i++) {
984 packed_rrset_ttl_add((struct packed_rrset_data*)
985 rep->rrsets[i]->entry.data, *env->now);
986 ref.key = rep->rrsets[i];
987 ref.id = rep->rrsets[i]->id;
988 /*ignore ret: it was in the cache, ref updated */
989 /* no leeway for typeNS */
990 (void)rrset_cache_update(env->rrset_cache, &ref,
991 env->alloc, *env->now +
992 ((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS
993 && !pside) ? 0:leeway));
998 /* store msg, and rrsets */
999 struct query_info qinf;
1003 qinf.qname = memdup(msgqinf->qname, msgqinf->qname_len);
1005 reply_info_parsedelete(rep, env->alloc);
1008 /* fixup flags to be sensible for a reply based on the cache */
1009 /* this module means that RA is available. It is an answer QR.
1010 * Not AA from cache. Not CD in cache (depends on client bit). */
1011 rep->flags |= (BIT_RA | BIT_QR);
1012 rep->flags &= ~(BIT_AA | BIT_CD);
1013 h = query_info_hash(&qinf, (uint16_t)flags);
1014 dns_cache_store_msg(env, &qinf, h, rep, leeway, pside, msgrep,
1016 /* qname is used inside query_info_entrysetup, and set to
1017 * NULL. If it has not been used, free it. free(0) is safe. */
1024 dns_cache_prefetch_adjust(struct module_env* env, struct query_info* qinfo,
1025 time_t adjust, uint16_t flags)
1027 struct msgreply_entry* msg;
1028 msg = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len,
1029 qinfo->qtype, qinfo->qclass, flags, *env->now, 1);
1031 struct reply_info* rep = (struct reply_info*)msg->entry.data;
1033 rep->prefetch_ttl += adjust;
1034 lock_rw_unlock(&msg->entry.lock);
1037 lock_rw_unlock(&msg->entry.lock);