2 * services/listen_dnsport.c - listen on port 53 for incoming DNS queries.
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
6 * This software is open source.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 * This file has functions to get queries from clients.
42 #ifdef HAVE_SYS_TYPES_H
43 # include <sys/types.h>
47 #ifdef USE_TCP_FASTOPEN
48 #include <netinet/tcp.h>
50 #include "services/listen_dnsport.h"
51 #include "services/outside_network.h"
52 #include "util/netevent.h"
54 #include "util/config_file.h"
55 #include "util/net_help.h"
56 #include "sldns/sbuffer.h"
57 #include "sldns/parseutil.h"
58 #include "services/mesh.h"
59 #include "util/fptr_wlist.h"
60 #include "util/locks.h"
72 #include <systemd/sd-daemon.h>
82 /** number of queued TCP connections for listen() */
83 #define TCP_BACKLOG 256
85 #ifndef THREADS_DISABLED
86 /** lock on the counter of stream buffer memory */
87 static lock_basic_type stream_wait_count_lock;
88 /** lock on the counter of HTTP2 query buffer memory */
89 static lock_basic_type http2_query_buffer_count_lock;
90 /** lock on the counter of HTTP2 response buffer memory */
91 static lock_basic_type http2_response_buffer_count_lock;
93 /** size (in bytes) of stream wait buffers */
94 static size_t stream_wait_count = 0;
95 /** is the lock initialised for stream wait buffers */
96 static int stream_wait_lock_inited = 0;
97 /** size (in bytes) of HTTP2 query buffers */
98 static size_t http2_query_buffer_count = 0;
99 /** is the lock initialised for HTTP2 query buffers */
100 static int http2_query_buffer_lock_inited = 0;
101 /** size (in bytes) of HTTP2 response buffers */
102 static size_t http2_response_buffer_count = 0;
103 /** is the lock initialised for HTTP2 response buffers */
104 static int http2_response_buffer_lock_inited = 0;
107 * Debug print of the getaddrinfo returned address.
108 * @param addr: the address returned.
111 verbose_print_addr(struct addrinfo *addr)
113 if(verbosity >= VERB_ALGO) {
115 void* sinaddr = &((struct sockaddr_in*)addr->ai_addr)->sin_addr;
117 if(addr->ai_family == AF_INET6)
118 sinaddr = &((struct sockaddr_in6*)addr->ai_addr)->
121 if(inet_ntop(addr->ai_family, sinaddr, buf,
122 (socklen_t)sizeof(buf)) == 0) {
123 (void)strlcpy(buf, "(null)", sizeof(buf));
125 buf[sizeof(buf)-1] = 0;
126 verbose(VERB_ALGO, "creating %s%s socket %s %d",
127 addr->ai_socktype==SOCK_DGRAM?"udp":
128 addr->ai_socktype==SOCK_STREAM?"tcp":"otherproto",
129 addr->ai_family==AF_INET?"4":
130 addr->ai_family==AF_INET6?"6":
132 ntohs(((struct sockaddr_in*)addr->ai_addr)->sin_port));
137 verbose_print_unbound_socket(struct unbound_socket* ub_sock)
139 if(verbosity >= VERB_ALGO) {
140 log_info("listing of unbound_socket structure:");
141 verbose_print_addr(ub_sock->addr);
142 log_info("s is: %d, fam is: %s", ub_sock->s, ub_sock->fam == AF_INET?"AF_INET":"AF_INET6");
148 systemd_get_activated(int family, int socktype, int listen,
149 struct sockaddr *addr, socklen_t addrlen,
155 const char* listen_pid, *listen_fds;
157 /* We should use "listen" option only for stream protocols. For UDP it should be -1 */
159 if((r = sd_booted()) < 1) {
161 log_warn("systemd is not running");
163 log_err("systemd sd_booted(): %s", strerror(-r));
167 listen_pid = getenv("LISTEN_PID");
168 listen_fds = getenv("LISTEN_FDS");
171 log_warn("Systemd mandatory ENV variable is not defined: LISTEN_PID");
176 log_warn("Systemd mandatory ENV variable is not defined: LISTEN_FDS");
180 if((r = sd_listen_fds(0)) < 1) {
182 log_warn("systemd: did not return socket, check unit configuration");
184 log_err("systemd sd_listen_fds(): %s", strerror(-r));
188 for(i = 0; i < r; i++) {
189 if(sd_is_socket(SD_LISTEN_FDS_START + i, family, socktype, listen)) {
190 s = SD_LISTEN_FDS_START + i;
196 log_err_addr("systemd sd_listen_fds()",
198 (struct sockaddr_storage *)addr, addrlen);
200 log_err("systemd sd_listen_fds(): %s", path);
207 create_udp_sock(int family, int socktype, struct sockaddr* addr,
208 socklen_t addrlen, int v6only, int* inuse, int* noproto,
209 int rcv, int snd, int listen, int* reuseport, int transparent,
210 int freebind, int use_systemd, int dscp)
214 #if defined(SO_REUSEADDR) || defined(SO_REUSEPORT) || defined(IPV6_USE_MIN_MTU) || defined(IP_TRANSPARENT) || defined(IP_BINDANY) || defined(IP_FREEBIND) || defined (SO_BINDANY)
218 int mtu = IPV6_MIN_MTU;
220 #if !defined(SO_RCVBUFFORCE) && !defined(SO_RCVBUF)
223 #if !defined(SO_SNDBUFFORCE) && !defined(SO_SNDBUF)
229 #if !defined(IP_TRANSPARENT) && !defined(IP_BINDANY) && !defined(SO_BINDANY)
232 #if !defined(IP_FREEBIND)
236 int got_fd_from_systemd = 0;
240 && (s = systemd_get_activated(family, socktype, -1, addr,
241 addrlen, NULL)) == -1)) {
245 if((s = socket(family, socktype, 0)) == -1) {
248 if(errno == EAFNOSUPPORT || errno == EPROTONOSUPPORT) {
253 if(WSAGetLastError() == WSAEAFNOSUPPORT ||
254 WSAGetLastError() == WSAEPROTONOSUPPORT) {
259 log_err("can't create socket: %s", sock_strerror(errno));
265 got_fd_from_systemd = 1;
270 if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on,
271 (socklen_t)sizeof(on)) < 0) {
272 log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
273 sock_strerror(errno));
275 if(errno != ENOSYS) {
288 #endif /* SO_REUSEADDR */
290 # ifdef SO_REUSEPORT_LB
291 /* on FreeBSD 12 we have SO_REUSEPORT_LB that does loadbalance
292 * like SO_REUSEPORT on Linux. This is what the users want
293 * with the config option in unbound.conf; if we actually
294 * need local address and port reuse they'll also need to
295 * have SO_REUSEPORT set for them, assume it was _LB they want.
297 if (reuseport && *reuseport &&
298 setsockopt(s, SOL_SOCKET, SO_REUSEPORT_LB, (void*)&on,
299 (socklen_t)sizeof(on)) < 0) {
301 if(errno != ENOPROTOOPT || verbosity >= 3)
302 log_warn("setsockopt(.. SO_REUSEPORT_LB ..) failed: %s",
305 /* this option is not essential, we can continue */
308 # else /* no SO_REUSEPORT_LB */
310 /* try to set SO_REUSEPORT so that incoming
311 * queries are distributed evenly among the receiving threads.
312 * Each thread must have its own socket bound to the same port,
313 * with SO_REUSEPORT set on each socket.
315 if (reuseport && *reuseport &&
316 setsockopt(s, SOL_SOCKET, SO_REUSEPORT, (void*)&on,
317 (socklen_t)sizeof(on)) < 0) {
319 if(errno != ENOPROTOOPT || verbosity >= 3)
320 log_warn("setsockopt(.. SO_REUSEPORT ..) failed: %s",
323 /* this option is not essential, we can continue */
326 # endif /* SO_REUSEPORT_LB */
329 #endif /* defined(SO_REUSEPORT) */
330 #ifdef IP_TRANSPARENT
332 setsockopt(s, IPPROTO_IP, IP_TRANSPARENT, (void*)&on,
333 (socklen_t)sizeof(on)) < 0) {
334 log_warn("setsockopt(.. IP_TRANSPARENT ..) failed: %s",
337 #elif defined(IP_BINDANY)
339 setsockopt(s, (family==AF_INET6? IPPROTO_IPV6:IPPROTO_IP),
340 (family == AF_INET6? IPV6_BINDANY:IP_BINDANY),
341 (void*)&on, (socklen_t)sizeof(on)) < 0) {
342 log_warn("setsockopt(.. IP%s_BINDANY ..) failed: %s",
343 (family==AF_INET6?"V6":""), strerror(errno));
345 #elif defined(SO_BINDANY)
347 setsockopt(s, SOL_SOCKET, SO_BINDANY, (void*)&on,
348 (socklen_t)sizeof(on)) < 0) {
349 log_warn("setsockopt(.. SO_BINDANY ..) failed: %s",
352 #endif /* IP_TRANSPARENT || IP_BINDANY || SO_BINDANY */
356 setsockopt(s, IPPROTO_IP, IP_FREEBIND, (void*)&on,
357 (socklen_t)sizeof(on)) < 0) {
358 log_warn("setsockopt(.. IP_FREEBIND ..) failed: %s",
361 #endif /* IP_FREEBIND */
365 socklen_t slen = (socklen_t)sizeof(got);
366 # ifdef SO_RCVBUFFORCE
367 /* Linux specific: try to use root permission to override
368 * system limits on rcvbuf. The limit is stored in
369 * /proc/sys/net/core/rmem_max or sysctl net.core.rmem_max */
370 if(setsockopt(s, SOL_SOCKET, SO_RCVBUFFORCE, (void*)&rcv,
371 (socklen_t)sizeof(rcv)) < 0) {
373 log_err("setsockopt(..., SO_RCVBUFFORCE, "
374 "...) failed: %s", sock_strerror(errno));
380 # endif /* SO_RCVBUFFORCE */
381 if(setsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&rcv,
382 (socklen_t)sizeof(rcv)) < 0) {
383 log_err("setsockopt(..., SO_RCVBUF, "
384 "...) failed: %s", sock_strerror(errno));
390 /* check if we got the right thing or if system
391 * reduced to some system max. Warn if so */
392 if(getsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&got,
393 &slen) >= 0 && got < rcv/2) {
394 log_warn("so-rcvbuf %u was not granted. "
395 "Got %u. To fix: start with "
396 "root permissions(linux) or sysctl "
397 "bigger net.core.rmem_max(linux) or "
398 "kern.ipc.maxsockbuf(bsd) values.",
399 (unsigned)rcv, (unsigned)got);
401 # ifdef SO_RCVBUFFORCE
404 #endif /* SO_RCVBUF */
406 /* first do RCVBUF as the receive buffer is more important */
410 socklen_t slen = (socklen_t)sizeof(got);
411 # ifdef SO_SNDBUFFORCE
412 /* Linux specific: try to use root permission to override
413 * system limits on sndbuf. The limit is stored in
414 * /proc/sys/net/core/wmem_max or sysctl net.core.wmem_max */
415 if(setsockopt(s, SOL_SOCKET, SO_SNDBUFFORCE, (void*)&snd,
416 (socklen_t)sizeof(snd)) < 0) {
418 log_err("setsockopt(..., SO_SNDBUFFORCE, "
419 "...) failed: %s", sock_strerror(errno));
425 # endif /* SO_SNDBUFFORCE */
426 if(setsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&snd,
427 (socklen_t)sizeof(snd)) < 0) {
428 log_err("setsockopt(..., SO_SNDBUF, "
429 "...) failed: %s", sock_strerror(errno));
435 /* check if we got the right thing or if system
436 * reduced to some system max. Warn if so */
437 if(getsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&got,
438 &slen) >= 0 && got < snd/2) {
439 log_warn("so-sndbuf %u was not granted. "
440 "Got %u. To fix: start with "
441 "root permissions(linux) or sysctl "
442 "bigger net.core.wmem_max(linux) or "
443 "kern.ipc.maxsockbuf(bsd) values.",
444 (unsigned)snd, (unsigned)got);
446 # ifdef SO_SNDBUFFORCE
449 #endif /* SO_SNDBUF */
451 err = set_ip_dscp(s, family, dscp);
453 log_warn("error setting IP DiffServ codepoint %d on UDP socket: %s", dscp, err);
454 if(family == AF_INET6) {
455 # if defined(IPV6_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
459 # if defined(IPV6_V6ONLY)
461 int val=(v6only==2)?0:1;
462 if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY,
463 (void*)&val, (socklen_t)sizeof(val)) < 0) {
464 log_err("setsockopt(..., IPV6_V6ONLY"
465 ", ...) failed: %s", sock_strerror(errno));
473 # if defined(IPV6_USE_MIN_MTU)
475 * There is no fragmentation of IPv6 datagrams
476 * during forwarding in the network. Therefore
477 * we do not send UDP datagrams larger than
478 * the minimum IPv6 MTU of 1280 octets. The
479 * EDNS0 message length can be larger if the
480 * network stack supports IPV6_USE_MIN_MTU.
482 if (setsockopt(s, IPPROTO_IPV6, IPV6_USE_MIN_MTU,
483 (void*)&on, (socklen_t)sizeof(on)) < 0) {
484 log_err("setsockopt(..., IPV6_USE_MIN_MTU, "
485 "...) failed: %s", sock_strerror(errno));
491 # elif defined(IPV6_MTU)
493 * On Linux, to send no larger than 1280, the PMTUD is
494 * disabled by default for datagrams anyway, so we set
497 if (setsockopt(s, IPPROTO_IPV6, IPV6_MTU,
498 (void*)&mtu, (socklen_t)sizeof(mtu)) < 0) {
499 log_err("setsockopt(..., IPV6_MTU, ...) failed: %s",
500 sock_strerror(errno));
506 # endif /* IPv6 MTU */
507 # if defined(IPV6_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
508 # if defined(IP_PMTUDISC_OMIT)
509 action = IP_PMTUDISC_OMIT;
510 if (setsockopt(s, IPPROTO_IPV6, IPV6_MTU_DISCOVER,
511 &action, (socklen_t)sizeof(action)) < 0) {
513 if (errno != EINVAL) {
514 log_err("setsockopt(..., IPV6_MTU_DISCOVER, IP_PMTUDISC_OMIT...) failed: %s",
527 if (omit6_set == 0) {
528 action = IP_PMTUDISC_DONT;
529 if (setsockopt(s, IPPROTO_IPV6, IPV6_MTU_DISCOVER,
530 &action, (socklen_t)sizeof(action)) < 0) {
531 log_err("setsockopt(..., IPV6_MTU_DISCOVER, IP_PMTUDISC_DONT...) failed: %s",
539 # endif /* IPV6_MTU_DISCOVER */
540 } else if(family == AF_INET) {
541 # if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
542 /* linux 3.15 has IP_PMTUDISC_OMIT, Hannes Frederic Sowa made it so that
543 * PMTU information is not accepted, but fragmentation is allowed
544 * if and only if the packet size exceeds the outgoing interface MTU
545 * (and also uses the interface mtu to determine the size of the packets).
546 * So there won't be any EMSGSIZE error. Against DNS fragmentation attacks.
547 * FreeBSD already has same semantics without setting the option. */
550 # if defined(IP_PMTUDISC_OMIT)
551 action = IP_PMTUDISC_OMIT;
552 if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER,
553 &action, (socklen_t)sizeof(action)) < 0) {
555 if (errno != EINVAL) {
556 log_err("setsockopt(..., IP_MTU_DISCOVER, IP_PMTUDISC_OMIT...) failed: %s",
570 action = IP_PMTUDISC_DONT;
571 if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER,
572 &action, (socklen_t)sizeof(action)) < 0) {
573 log_err("setsockopt(..., IP_MTU_DISCOVER, IP_PMTUDISC_DONT...) failed: %s",
581 # elif defined(IP_DONTFRAG) && !defined(__APPLE__)
582 /* the IP_DONTFRAG option if defined in the 11.0 OSX headers,
583 * but does not work on that version, so we exclude it */
585 if (setsockopt(s, IPPROTO_IP, IP_DONTFRAG,
586 &off, (socklen_t)sizeof(off)) < 0) {
587 log_err("setsockopt(..., IP_DONTFRAG, ...) failed: %s",
594 # endif /* IPv4 MTU */
598 !got_fd_from_systemd &&
600 bind(s, (struct sockaddr*)addr, addrlen) != 0) {
605 *inuse = (errno == EADDRINUSE);
606 /* detect freebsd jail with no ipv6 permission */
607 if(family==AF_INET6 && errno==EINVAL)
609 else if(errno != EADDRINUSE &&
610 !(errno == EACCES && verbosity < 4 && !listen)
612 && !(errno == EADDRNOTAVAIL && verbosity < 4 && !listen)
615 log_err_addr("can't bind socket", strerror(errno),
616 (struct sockaddr_storage*)addr, addrlen);
618 #endif /* EADDRINUSE */
619 #else /* USE_WINSOCK */
620 if(WSAGetLastError() != WSAEADDRINUSE &&
621 WSAGetLastError() != WSAEADDRNOTAVAIL &&
622 !(WSAGetLastError() == WSAEACCES && verbosity < 4 && !listen)) {
623 log_err_addr("can't bind socket",
624 wsa_strerror(WSAGetLastError()),
625 (struct sockaddr_storage*)addr, addrlen);
627 #endif /* USE_WINSOCK */
631 if(!fd_set_nonblock(s)) {
641 create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
642 int* reuseport, int transparent, int mss, int nodelay, int freebind,
643 int use_systemd, int dscp)
647 #if defined(SO_REUSEADDR) || defined(SO_REUSEPORT) || defined(IPV6_V6ONLY) || defined(IP_TRANSPARENT) || defined(IP_BINDANY) || defined(IP_FREEBIND) || defined(SO_BINDANY)
651 int got_fd_from_systemd = 0;
653 #ifdef USE_TCP_FASTOPEN
656 #if !defined(IP_TRANSPARENT) && !defined(IP_BINDANY) && !defined(SO_BINDANY)
659 #if !defined(IP_FREEBIND)
662 verbose_print_addr(addr);
667 && (s = systemd_get_activated(addr->ai_family, addr->ai_socktype, 1,
668 addr->ai_addr, addr->ai_addrlen,
673 if((s = socket(addr->ai_family, addr->ai_socktype, 0)) == -1) {
675 if(errno == EAFNOSUPPORT || errno == EPROTONOSUPPORT) {
680 if(WSAGetLastError() == WSAEAFNOSUPPORT ||
681 WSAGetLastError() == WSAEPROTONOSUPPORT) {
686 log_err("can't create socket: %s", sock_strerror(errno));
690 #if defined(IPPROTO_TCP) && defined(TCP_NODELAY)
691 if(setsockopt(s, IPPROTO_TCP, TCP_NODELAY, (void*)&on,
692 (socklen_t)sizeof(on)) < 0) {
694 log_err(" setsockopt(.. TCP_NODELAY ..) failed: %s",
697 log_err(" setsockopt(.. TCP_NODELAY ..) failed: %s",
698 wsa_strerror(WSAGetLastError()));
702 log_warn(" setsockopt(TCP_NODELAY) unsupported");
703 #endif /* defined(IPPROTO_TCP) && defined(TCP_NODELAY) */
706 #if defined(IPPROTO_TCP) && defined(TCP_MAXSEG)
707 if(setsockopt(s, IPPROTO_TCP, TCP_MAXSEG, (void*)&mss,
708 (socklen_t)sizeof(mss)) < 0) {
709 log_err(" setsockopt(.. TCP_MAXSEG ..) failed: %s",
710 sock_strerror(errno));
713 " tcp socket mss set to %d", mss);
716 log_warn(" setsockopt(TCP_MAXSEG) unsupported");
717 #endif /* defined(IPPROTO_TCP) && defined(TCP_MAXSEG) */
721 got_fd_from_systemd = 1;
725 if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on,
726 (socklen_t)sizeof(on)) < 0) {
727 log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
728 sock_strerror(errno));
732 #endif /* SO_REUSEADDR */
734 if (freebind && setsockopt(s, IPPROTO_IP, IP_FREEBIND, (void*)&on,
735 (socklen_t)sizeof(on)) < 0) {
736 log_warn("setsockopt(.. IP_FREEBIND ..) failed: %s",
739 #endif /* IP_FREEBIND */
741 /* try to set SO_REUSEPORT so that incoming
742 * connections are distributed evenly among the receiving threads.
743 * Each thread must have its own socket bound to the same port,
744 * with SO_REUSEPORT set on each socket.
746 if (reuseport && *reuseport &&
747 setsockopt(s, SOL_SOCKET, SO_REUSEPORT, (void*)&on,
748 (socklen_t)sizeof(on)) < 0) {
750 if(errno != ENOPROTOOPT || verbosity >= 3)
751 log_warn("setsockopt(.. SO_REUSEPORT ..) failed: %s",
754 /* this option is not essential, we can continue */
759 #endif /* defined(SO_REUSEPORT) */
760 #if defined(IPV6_V6ONLY)
761 if(addr->ai_family == AF_INET6 && v6only) {
762 if(setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY,
763 (void*)&on, (socklen_t)sizeof(on)) < 0) {
764 log_err("setsockopt(..., IPV6_V6ONLY, ...) failed: %s",
765 sock_strerror(errno));
772 #endif /* IPV6_V6ONLY */
773 #ifdef IP_TRANSPARENT
775 setsockopt(s, IPPROTO_IP, IP_TRANSPARENT, (void*)&on,
776 (socklen_t)sizeof(on)) < 0) {
777 log_warn("setsockopt(.. IP_TRANSPARENT ..) failed: %s",
780 #elif defined(IP_BINDANY)
782 setsockopt(s, (addr->ai_family==AF_INET6? IPPROTO_IPV6:IPPROTO_IP),
783 (addr->ai_family == AF_INET6? IPV6_BINDANY:IP_BINDANY),
784 (void*)&on, (socklen_t)sizeof(on)) < 0) {
785 log_warn("setsockopt(.. IP%s_BINDANY ..) failed: %s",
786 (addr->ai_family==AF_INET6?"V6":""), strerror(errno));
788 #elif defined(SO_BINDANY)
790 setsockopt(s, SOL_SOCKET, SO_BINDANY, (void*)&on, (socklen_t)
792 log_warn("setsockopt(.. SO_BINDANY ..) failed: %s",
795 #endif /* IP_TRANSPARENT || IP_BINDANY || SO_BINDANY */
796 err = set_ip_dscp(s, addr->ai_family, dscp);
798 log_warn("error setting IP DiffServ codepoint %d on TCP socket: %s", dscp, err);
801 !got_fd_from_systemd &&
803 bind(s, addr->ai_addr, addr->ai_addrlen) != 0) {
805 /* detect freebsd jail with no ipv6 permission */
806 if(addr->ai_family==AF_INET6 && errno==EINVAL)
809 log_err_addr("can't bind socket", strerror(errno),
810 (struct sockaddr_storage*)addr->ai_addr,
814 log_err_addr("can't bind socket",
815 wsa_strerror(WSAGetLastError()),
816 (struct sockaddr_storage*)addr->ai_addr,
822 if(!fd_set_nonblock(s)) {
826 if(listen(s, TCP_BACKLOG) == -1) {
827 log_err("can't listen: %s", sock_strerror(errno));
831 #ifdef USE_TCP_FASTOPEN
832 /* qlen specifies how many outstanding TFO requests to allow. Limit is a defense
833 against IP spoofing attacks as suggested in RFC7413 */
835 /* OS X implementation only supports qlen of 1 via this call. Actual
836 value is configured by the net.inet.tcp.fastopen_backlog kernel parm. */
839 /* 5 is recommended on linux */
842 if ((setsockopt(s, IPPROTO_TCP, TCP_FASTOPEN, &qlen,
843 sizeof(qlen))) == -1 ) {
845 /* squelch ENOPROTOOPT: freebsd server mode with kernel support
846 disabled, except when verbosity enabled for debugging */
847 if(errno != ENOPROTOOPT || verbosity >= 3) {
850 log_warn("Setting TCP Fast Open as server failed: %s ; this could likely be because sysctl net.inet.tcp.fastopen.enabled, net.inet.tcp.fastopen.server_enable, or net.ipv4.tcp_fastopen is disabled", strerror(errno));
852 log_err("Setting TCP Fast Open as server failed: %s", strerror(errno));
863 set_ip_dscp(int socket, int addrfamily, int dscp)
873 if(setsockopt(socket, IPPROTO_IPV6, IPV6_TCLASS, (void*)&ds,
875 return sock_strerror(errno);
878 return "IPV6_TCLASS not defined on this system";
881 if(setsockopt(socket, IPPROTO_IP, IP_TOS, (void*)&ds, sizeof(ds)) < 0)
882 return sock_strerror(errno);
889 create_local_accept_sock(const char *path, int* noproto, int use_systemd)
894 if (use_systemd && (ret = systemd_get_activated(AF_LOCAL, SOCK_STREAM, 1, NULL, 0, path)) != -1)
900 struct sockaddr_un usock;
905 verbose(VERB_ALGO, "creating unix socket %s", path);
906 #ifdef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
907 /* this member exists on BSDs, not Linux */
908 usock.sun_len = (unsigned)sizeof(usock);
910 usock.sun_family = AF_LOCAL;
911 /* length is 92-108, 104 on FreeBSD */
912 (void)strlcpy(usock.sun_path, path, sizeof(usock.sun_path));
914 if ((s = socket(AF_LOCAL, SOCK_STREAM, 0)) == -1) {
915 log_err("Cannot create local socket %s (%s)",
916 path, strerror(errno));
920 if (unlink(path) && errno != ENOENT) {
921 /* The socket already exists and cannot be removed */
922 log_err("Cannot remove old local socket %s (%s)",
923 path, strerror(errno));
927 if (bind(s, (struct sockaddr *)&usock,
928 (socklen_t)sizeof(struct sockaddr_un)) == -1) {
929 log_err("Cannot bind local socket %s (%s)",
930 path, strerror(errno));
934 if (!fd_set_nonblock(s)) {
935 log_err("Cannot set non-blocking mode");
939 if (listen(s, TCP_BACKLOG) == -1) {
940 log_err("can't listen: %s", strerror(errno));
944 (void)noproto; /*unused*/
957 log_err("Local sockets are not supported");
965 * Create socket from getaddrinfo results
968 make_sock(int stype, const char* ifname, const char* port,
969 struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd,
970 int* reuseport, int transparent, int tcp_mss, int nodelay, int freebind,
971 int use_systemd, int dscp, struct unbound_socket* ub_sock)
973 struct addrinfo *res = NULL;
974 int r, s, inuse, noproto;
975 hints->ai_socktype = stype;
977 if((r=getaddrinfo(ifname, port, hints, &res)) != 0 || !res) {
979 if(r == EAI_NONAME && hints->ai_family == AF_INET6){
980 *noip6 = 1; /* 'Host not found' for IP6 on winXP */
984 log_err("node %s:%s getaddrinfo: %s %s",
985 ifname?ifname:"default", port, gai_strerror(r),
987 r==EAI_SYSTEM?(char*)strerror(errno):""
994 if(stype == SOCK_DGRAM) {
995 verbose_print_addr(res);
996 s = create_udp_sock(res->ai_family, res->ai_socktype,
997 (struct sockaddr*)res->ai_addr, res->ai_addrlen,
998 v6only, &inuse, &noproto, (int)rcv, (int)snd, 1,
999 reuseport, transparent, freebind, use_systemd, dscp);
1000 if(s == -1 && inuse) {
1001 log_err("bind: address already in use");
1002 } else if(s == -1 && noproto && hints->ai_family == AF_INET6){
1006 s = create_tcp_accept_sock(res, v6only, &noproto, reuseport,
1007 transparent, tcp_mss, nodelay, freebind, use_systemd,
1009 if(s == -1 && noproto && hints->ai_family == AF_INET6){
1014 ub_sock->addr = res;
1016 ub_sock->fam = hints->ai_family;
1021 /** make socket and first see if ifname contains port override info */
1023 make_sock_port(int stype, const char* ifname, const char* port,
1024 struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd,
1025 int* reuseport, int transparent, int tcp_mss, int nodelay, int freebind,
1026 int use_systemd, int dscp, struct unbound_socket* ub_sock)
1028 char* s = strchr(ifname, '@');
1030 /* override port with ifspec@port */
1033 if((size_t)(s-ifname) >= sizeof(newif)) {
1034 log_err("ifname too long: %s", ifname);
1038 if(strlen(s+1) >= sizeof(p)) {
1039 log_err("portnumber too long: %s", ifname);
1043 (void)strlcpy(newif, ifname, sizeof(newif));
1044 newif[s-ifname] = 0;
1045 (void)strlcpy(p, s+1, sizeof(p));
1047 return make_sock(stype, newif, p, hints, v6only, noip6, rcv,
1048 snd, reuseport, transparent, tcp_mss, nodelay, freebind,
1049 use_systemd, dscp, ub_sock);
1051 return make_sock(stype, ifname, port, hints, v6only, noip6, rcv, snd,
1052 reuseport, transparent, tcp_mss, nodelay, freebind, use_systemd,
1057 * Add port to open ports list.
1058 * @param list: list head. changed.
1060 * @param ftype: if fd is UDP.
1061 * @param ub_sock: socket with address.
1062 * @return false on failure. list in unchanged then.
1065 port_insert(struct listen_port** list, int s, enum listen_type ftype, struct unbound_socket* ub_sock)
1067 struct listen_port* item = (struct listen_port*)malloc(
1068 sizeof(struct listen_port));
1073 item->ftype = ftype;
1074 item->socket = ub_sock;
1079 /** set fd to receive source address packet info */
1081 set_recvpktinfo(int s, int family)
1083 #if defined(IPV6_RECVPKTINFO) || defined(IPV6_PKTINFO) || (defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR)) || defined(IP_PKTINFO)
1088 if(family == AF_INET6) {
1089 # ifdef IPV6_RECVPKTINFO
1090 if(setsockopt(s, IPPROTO_IPV6, IPV6_RECVPKTINFO,
1091 (void*)&on, (socklen_t)sizeof(on)) < 0) {
1092 log_err("setsockopt(..., IPV6_RECVPKTINFO, ...) failed: %s",
1096 # elif defined(IPV6_PKTINFO)
1097 if(setsockopt(s, IPPROTO_IPV6, IPV6_PKTINFO,
1098 (void*)&on, (socklen_t)sizeof(on)) < 0) {
1099 log_err("setsockopt(..., IPV6_PKTINFO, ...) failed: %s",
1104 log_err("no IPV6_RECVPKTINFO and IPV6_PKTINFO options, please "
1105 "disable interface-automatic or do-ip6 in config");
1107 # endif /* defined IPV6_RECVPKTINFO */
1109 } else if(family == AF_INET) {
1111 if(setsockopt(s, IPPROTO_IP, IP_PKTINFO,
1112 (void*)&on, (socklen_t)sizeof(on)) < 0) {
1113 log_err("setsockopt(..., IP_PKTINFO, ...) failed: %s",
1117 # elif defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR)
1118 if(setsockopt(s, IPPROTO_IP, IP_RECVDSTADDR,
1119 (void*)&on, (socklen_t)sizeof(on)) < 0) {
1120 log_err("setsockopt(..., IP_RECVDSTADDR, ...) failed: %s",
1125 log_err("no IP_SENDSRCADDR or IP_PKTINFO option, please disable "
1126 "interface-automatic or do-ip4 in config");
1128 # endif /* IP_PKTINFO */
1134 /** see if interface is ssl, its port number == the ssl port number */
1136 if_is_ssl(const char* ifname, const char* port, int ssl_port,
1137 struct config_strlist* tls_additional_port)
1139 struct config_strlist* s;
1140 char* p = strchr(ifname, '@');
1141 if(!p && atoi(port) == ssl_port)
1143 if(p && atoi(p+1) == ssl_port)
1145 for(s = tls_additional_port; s; s = s->next) {
1146 if(p && atoi(p+1) == atoi(s->str))
1148 if(!p && atoi(port) == atoi(s->str))
1155 * Helper for ports_open. Creates one interface (or NULL for default).
1156 * @param ifname: The interface ip address.
1157 * @param do_auto: use automatic interface detection.
1158 * If enabled, then ifname must be the wildcard name.
1159 * @param do_udp: if udp should be used.
1160 * @param do_tcp: if udp should be used.
1161 * @param hints: for getaddrinfo. family and flags have to be set by caller.
1162 * @param port: Port number to use (as string).
1163 * @param list: list of open ports, appended to, changed to point to list head.
1164 * @param rcv: receive buffer size for UDP
1165 * @param snd: send buffer size for UDP
1166 * @param ssl_port: ssl service port number
1167 * @param tls_additional_port: list of additional ssl service port numbers.
1168 * @param https_port: DoH service port number
1169 * @param reuseport: try to set SO_REUSEPORT if nonNULL and true.
1170 * set to false on exit if reuseport failed due to no kernel support.
1171 * @param transparent: set IP_TRANSPARENT socket option.
1172 * @param tcp_mss: maximum segment size of tcp socket. default if zero.
1173 * @param freebind: set IP_FREEBIND socket option.
1174 * @param http2_nodelay: set TCP_NODELAY on HTTP/2 connection
1175 * @param use_systemd: if true, fetch sockets from systemd.
1176 * @param dnscrypt_port: dnscrypt service port number
1177 * @param dscp: DSCP to use.
1178 * @return: returns false on error.
1181 ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
1182 struct addrinfo *hints, const char* port, struct listen_port** list,
1183 size_t rcv, size_t snd, int ssl_port,
1184 struct config_strlist* tls_additional_port, int https_port,
1185 int* reuseport, int transparent, int tcp_mss, int freebind,
1186 int http2_nodelay, int use_systemd, int dnscrypt_port, int dscp)
1189 int is_https = if_is_https(ifname, port, https_port);
1190 int nodelay = is_https && http2_nodelay;
1191 struct unbound_socket* ub_sock;
1193 int is_dnscrypt = ((strchr(ifname, '@') &&
1194 atoi(strchr(ifname, '@')+1) == dnscrypt_port) ||
1195 (!strchr(ifname, '@') && atoi(port) == dnscrypt_port));
1197 int is_dnscrypt = 0;
1198 (void)dnscrypt_port;
1201 if(!do_udp && !do_tcp)
1205 ub_sock = calloc(1, sizeof(struct unbound_socket));
1208 if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1,
1209 &noip6, rcv, snd, reuseport, transparent,
1210 tcp_mss, nodelay, freebind, use_systemd, dscp, ub_sock)) == -1) {
1211 freeaddrinfo(ub_sock->addr);
1214 log_warn("IPv6 protocol not available");
1219 /* getting source addr packet info is highly non-portable */
1220 if(!set_recvpktinfo(s, hints->ai_family)) {
1222 freeaddrinfo(ub_sock->addr);
1226 if(!port_insert(list, s,
1227 is_dnscrypt?listen_type_udpancil_dnscrypt:listen_type_udpancil, ub_sock)) {
1229 freeaddrinfo(ub_sock->addr);
1234 ub_sock = calloc(1, sizeof(struct unbound_socket));
1237 /* regular udp socket */
1238 if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1,
1239 &noip6, rcv, snd, reuseport, transparent,
1240 tcp_mss, nodelay, freebind, use_systemd, dscp, ub_sock)) == -1) {
1241 freeaddrinfo(ub_sock->addr);
1244 log_warn("IPv6 protocol not available");
1249 if(!port_insert(list, s,
1250 is_dnscrypt?listen_type_udp_dnscrypt:listen_type_udp, ub_sock)) {
1252 freeaddrinfo(ub_sock->addr);
1258 int is_ssl = if_is_ssl(ifname, port, ssl_port,
1259 tls_additional_port);
1260 enum listen_type port_type;
1261 ub_sock = calloc(1, sizeof(struct unbound_socket));
1265 port_type = listen_type_ssl;
1267 port_type = listen_type_http;
1268 else if(is_dnscrypt)
1269 port_type = listen_type_tcp_dnscrypt;
1271 port_type = listen_type_tcp;
1272 if((s = make_sock_port(SOCK_STREAM, ifname, port, hints, 1,
1273 &noip6, 0, 0, reuseport, transparent, tcp_mss, nodelay,
1274 freebind, use_systemd, dscp, ub_sock)) == -1) {
1275 freeaddrinfo(ub_sock->addr);
1278 /*log_warn("IPv6 protocol not available");*/
1284 verbose(VERB_ALGO, "setup TCP for SSL service");
1285 if(!port_insert(list, s, port_type, ub_sock)) {
1287 freeaddrinfo(ub_sock->addr);
1296 * Add items to commpoint list in front.
1297 * @param c: commpoint to add.
1298 * @param front: listen struct.
1299 * @return: false on failure.
1302 listen_cp_insert(struct comm_point* c, struct listen_dnsport* front)
1304 struct listen_list* item = (struct listen_list*)malloc(
1305 sizeof(struct listen_list));
1309 item->next = front->cps;
1314 void listen_setup_locks(void)
1316 if(!stream_wait_lock_inited) {
1317 lock_basic_init(&stream_wait_count_lock);
1318 stream_wait_lock_inited = 1;
1320 if(!http2_query_buffer_lock_inited) {
1321 lock_basic_init(&http2_query_buffer_count_lock);
1322 http2_query_buffer_lock_inited = 1;
1324 if(!http2_response_buffer_lock_inited) {
1325 lock_basic_init(&http2_response_buffer_count_lock);
1326 http2_response_buffer_lock_inited = 1;
1330 void listen_desetup_locks(void)
1332 if(stream_wait_lock_inited) {
1333 stream_wait_lock_inited = 0;
1334 lock_basic_destroy(&stream_wait_count_lock);
1336 if(http2_query_buffer_lock_inited) {
1337 http2_query_buffer_lock_inited = 0;
1338 lock_basic_destroy(&http2_query_buffer_count_lock);
1340 if(http2_response_buffer_lock_inited) {
1341 http2_response_buffer_lock_inited = 0;
1342 lock_basic_destroy(&http2_response_buffer_count_lock);
1346 struct listen_dnsport*
1347 listen_create(struct comm_base* base, struct listen_port* ports,
1348 size_t bufsize, int tcp_accept_count, int tcp_idle_timeout,
1349 int harden_large_queries, uint32_t http_max_streams,
1350 char* http_endpoint, int http_notls, struct tcl_list* tcp_conn_limit,
1351 void* sslctx, struct dt_env* dtenv, comm_point_callback_type* cb,
1354 struct listen_dnsport* front = (struct listen_dnsport*)
1355 malloc(sizeof(struct listen_dnsport));
1359 front->udp_buff = sldns_buffer_new(bufsize);
1361 front->dnscrypt_udp_buff = NULL;
1363 if(!front->udp_buff) {
1368 /* create comm points as needed */
1370 struct comm_point* cp = NULL;
1371 if(ports->ftype == listen_type_udp ||
1372 ports->ftype == listen_type_udp_dnscrypt)
1373 cp = comm_point_create_udp(base, ports->fd,
1374 front->udp_buff, cb, cb_arg, ports->socket);
1375 else if(ports->ftype == listen_type_tcp ||
1376 ports->ftype == listen_type_tcp_dnscrypt)
1377 cp = comm_point_create_tcp(base, ports->fd,
1378 tcp_accept_count, tcp_idle_timeout,
1379 harden_large_queries, 0, NULL,
1380 tcp_conn_limit, bufsize, front->udp_buff,
1381 ports->ftype, cb, cb_arg, ports->socket);
1382 else if(ports->ftype == listen_type_ssl ||
1383 ports->ftype == listen_type_http) {
1384 cp = comm_point_create_tcp(base, ports->fd,
1385 tcp_accept_count, tcp_idle_timeout,
1386 harden_large_queries,
1387 http_max_streams, http_endpoint,
1388 tcp_conn_limit, bufsize, front->udp_buff,
1389 ports->ftype, cb, cb_arg, ports->socket);
1390 if(ports->ftype == listen_type_http) {
1391 if(!sslctx && !http_notls) {
1392 log_warn("HTTPS port configured, but "
1393 "no TLS tls-service-key or "
1394 "tls-service-pem set");
1396 #ifndef HAVE_SSL_CTX_SET_ALPN_SELECT_CB
1398 log_warn("Unbound is not compiled "
1399 "with an OpenSSL version "
1401 "(OpenSSL >= 1.0.2). This "
1402 "is required to use "
1406 #ifndef HAVE_NGHTTP2_NGHTTP2_H
1407 log_warn("Unbound is not compiled with "
1408 "nghttp2. This is required to use "
1412 } else if(ports->ftype == listen_type_udpancil ||
1413 ports->ftype == listen_type_udpancil_dnscrypt)
1414 cp = comm_point_create_udp_ancil(base, ports->fd,
1415 front->udp_buff, cb, cb_arg, ports->socket);
1417 log_err("can't create commpoint");
1418 listen_delete(front);
1421 if(http_notls && ports->ftype == listen_type_http)
1426 cp->do_not_close = 1;
1428 if (ports->ftype == listen_type_udp_dnscrypt ||
1429 ports->ftype == listen_type_tcp_dnscrypt ||
1430 ports->ftype == listen_type_udpancil_dnscrypt) {
1432 cp->dnscrypt_buffer = sldns_buffer_new(bufsize);
1433 if(!cp->dnscrypt_buffer) {
1434 log_err("can't alloc dnscrypt_buffer");
1435 comm_point_delete(cp);
1436 listen_delete(front);
1439 front->dnscrypt_udp_buff = cp->dnscrypt_buffer;
1442 if(!listen_cp_insert(cp, front)) {
1443 log_err("malloc failed");
1444 comm_point_delete(cp);
1445 listen_delete(front);
1448 ports = ports->next;
1451 log_err("Could not open sockets to accept queries.");
1452 listen_delete(front);
1460 listen_list_delete(struct listen_list* list)
1462 struct listen_list *p = list, *pn;
1465 comm_point_delete(p->com);
1472 listen_delete(struct listen_dnsport* front)
1476 listen_list_delete(front->cps);
1478 if(front->dnscrypt_udp_buff &&
1479 front->udp_buff != front->dnscrypt_udp_buff) {
1480 sldns_buffer_free(front->dnscrypt_udp_buff);
1483 sldns_buffer_free(front->udp_buff);
1487 #ifdef HAVE_GETIFADDRS
1489 resolve_ifa_name(struct ifaddrs *ifas, const char *search_ifa, char ***ip_addresses, int *ip_addresses_size)
1491 struct ifaddrs *ifa;
1493 int last_ip_addresses_size = *ip_addresses_size;
1495 for(ifa = ifas; ifa != NULL; ifa = ifa->ifa_next) {
1498 #ifdef INET6 /* | address ip | % | ifa name | @ | port | nul */
1499 char addr_buf[INET6_ADDRSTRLEN + 1 + IF_NAMESIZE + 1 + 16 + 1];
1501 char addr_buf[INET_ADDRSTRLEN + 1 + 16 + 1];
1504 if((atsign=strrchr(search_ifa, '@')) != NULL) {
1505 if(strlen(ifa->ifa_name) != (size_t)(atsign-search_ifa)
1506 || strncmp(ifa->ifa_name, search_ifa,
1507 atsign-search_ifa) != 0)
1510 if(strcmp(ifa->ifa_name, search_ifa) != 0)
1515 if(ifa->ifa_addr == NULL)
1518 family = ifa->ifa_addr->sa_family;
1519 if(family == AF_INET) {
1520 char a4[INET_ADDRSTRLEN + 1];
1521 struct sockaddr_in *in4 = (struct sockaddr_in *)
1523 if(!inet_ntop(family, &in4->sin_addr, a4, sizeof(a4))) {
1524 log_err("inet_ntop failed");
1527 snprintf(addr_buf, sizeof(addr_buf), "%s%s",
1531 else if(family == AF_INET6) {
1532 struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)
1534 char a6[INET6_ADDRSTRLEN + 1];
1535 char if_index_name[IF_NAMESIZE + 1];
1536 if_index_name[0] = 0;
1537 if(!inet_ntop(family, &in6->sin6_addr, a6, sizeof(a6))) {
1538 log_err("inet_ntop failed");
1541 (void)if_indextoname(in6->sin6_scope_id,
1542 (char *)if_index_name);
1543 if (strlen(if_index_name) != 0) {
1544 snprintf(addr_buf, sizeof(addr_buf),
1545 "%s%%%s%s", a6, if_index_name, atsign);
1547 snprintf(addr_buf, sizeof(addr_buf), "%s%s",
1555 verbose(4, "interface %s has address %s", search_ifa, addr_buf);
1557 tmpbuf = realloc(*ip_addresses, sizeof(char *) * (*ip_addresses_size + 1));
1559 log_err("realloc failed: out of memory");
1562 *ip_addresses = tmpbuf;
1564 (*ip_addresses)[*ip_addresses_size] = strdup(addr_buf);
1565 if(!(*ip_addresses)[*ip_addresses_size]) {
1566 log_err("strdup failed: out of memory");
1569 (*ip_addresses_size)++;
1572 if (*ip_addresses_size == last_ip_addresses_size) {
1573 tmpbuf = realloc(*ip_addresses, sizeof(char *) * (*ip_addresses_size + 1));
1575 log_err("realloc failed: out of memory");
1578 *ip_addresses = tmpbuf;
1580 (*ip_addresses)[*ip_addresses_size] = strdup(search_ifa);
1581 if(!(*ip_addresses)[*ip_addresses_size]) {
1582 log_err("strdup failed: out of memory");
1585 (*ip_addresses_size)++;
1589 #endif /* HAVE_GETIFADDRS */
1591 int resolve_interface_names(char** ifs, int num_ifs,
1592 struct config_strlist* list, char*** resif, int* num_resif)
1594 #ifdef HAVE_GETIFADDRS
1595 struct ifaddrs *addrs = NULL;
1596 if(num_ifs == 0 && list == NULL) {
1601 if(getifaddrs(&addrs) == -1) {
1602 log_err("failed to list interfaces: getifaddrs: %s",
1609 for(i=0; i<num_ifs; i++) {
1610 if(!resolve_ifa_name(addrs, ifs[i], resif, num_resif)) {
1612 config_del_strarray(*resif, *num_resif);
1620 struct config_strlist* p;
1621 for(p = list; p; p = p->next) {
1622 if(!resolve_ifa_name(addrs, p->str, resif, num_resif)) {
1624 config_del_strarray(*resif, *num_resif);
1634 struct config_strlist* p;
1635 if(num_ifs == 0 && list == NULL) {
1640 *num_resif = num_ifs;
1641 for(p = list; p; p = p->next) {
1644 *resif = calloc(*num_resif, sizeof(**resif));
1646 log_err("out of memory");
1651 for(i=0; i<num_ifs; i++) {
1652 (*resif)[i] = strdup(ifs[i]);
1653 if(!((*resif)[i])) {
1654 log_err("out of memory");
1655 config_del_strarray(*resif, *num_resif);
1664 for(p = list; p; p = p->next) {
1665 (*resif)[idx] = strdup(p->str);
1666 if(!((*resif)[idx])) {
1667 log_err("out of memory");
1668 config_del_strarray(*resif, *num_resif);
1677 #endif /* HAVE_GETIFADDRS */
1681 listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs,
1684 struct listen_port* list = NULL;
1685 struct addrinfo hints;
1686 int i, do_ip4, do_ip6;
1687 int do_tcp, do_auto;
1689 snprintf(portbuf, sizeof(portbuf), "%d", cfg->port);
1690 do_ip4 = cfg->do_ip4;
1691 do_ip6 = cfg->do_ip6;
1692 do_tcp = cfg->do_tcp;
1693 do_auto = cfg->if_automatic && cfg->do_udp;
1694 if(cfg->incoming_num_tcp == 0)
1698 memset(&hints, 0, sizeof(hints));
1699 hints.ai_flags = AI_PASSIVE;
1700 /* no name lookups on our listening ports */
1702 hints.ai_flags |= AI_NUMERICHOST;
1703 hints.ai_family = AF_UNSPEC;
1707 if(!do_ip4 && !do_ip6) {
1710 /* create ip4 and ip6 ports so that return addresses are nice. */
1711 if(do_auto || num_ifs == 0) {
1713 hints.ai_family = AF_INET6;
1714 if(!ports_create_if(do_auto?"::0":"::1",
1715 do_auto, cfg->do_udp, do_tcp,
1716 &hints, portbuf, &list,
1717 cfg->so_rcvbuf, cfg->so_sndbuf,
1718 cfg->ssl_port, cfg->tls_additional_port,
1719 cfg->https_port, reuseport, cfg->ip_transparent,
1720 cfg->tcp_mss, cfg->ip_freebind,
1721 cfg->http_nodelay, cfg->use_systemd,
1722 cfg->dnscrypt_port, cfg->ip_dscp)) {
1723 listening_ports_free(list);
1728 hints.ai_family = AF_INET;
1729 if(!ports_create_if(do_auto?"0.0.0.0":"127.0.0.1",
1730 do_auto, cfg->do_udp, do_tcp,
1731 &hints, portbuf, &list,
1732 cfg->so_rcvbuf, cfg->so_sndbuf,
1733 cfg->ssl_port, cfg->tls_additional_port,
1734 cfg->https_port, reuseport, cfg->ip_transparent,
1735 cfg->tcp_mss, cfg->ip_freebind,
1736 cfg->http_nodelay, cfg->use_systemd,
1737 cfg->dnscrypt_port, cfg->ip_dscp)) {
1738 listening_ports_free(list);
1742 } else for(i = 0; i<num_ifs; i++) {
1743 if(str_is_ip6(ifs[i])) {
1746 hints.ai_family = AF_INET6;
1747 if(!ports_create_if(ifs[i], 0, cfg->do_udp,
1748 do_tcp, &hints, portbuf, &list,
1749 cfg->so_rcvbuf, cfg->so_sndbuf,
1750 cfg->ssl_port, cfg->tls_additional_port,
1751 cfg->https_port, reuseport, cfg->ip_transparent,
1752 cfg->tcp_mss, cfg->ip_freebind,
1753 cfg->http_nodelay, cfg->use_systemd,
1754 cfg->dnscrypt_port, cfg->ip_dscp)) {
1755 listening_ports_free(list);
1761 hints.ai_family = AF_INET;
1762 if(!ports_create_if(ifs[i], 0, cfg->do_udp,
1763 do_tcp, &hints, portbuf, &list,
1764 cfg->so_rcvbuf, cfg->so_sndbuf,
1765 cfg->ssl_port, cfg->tls_additional_port,
1766 cfg->https_port, reuseport, cfg->ip_transparent,
1767 cfg->tcp_mss, cfg->ip_freebind,
1768 cfg->http_nodelay, cfg->use_systemd,
1769 cfg->dnscrypt_port, cfg->ip_dscp)) {
1770 listening_ports_free(list);
1779 void listening_ports_free(struct listen_port* list)
1781 struct listen_port* nx;
1784 if(list->fd != -1) {
1785 sock_close(list->fd);
1787 /* rc_ports don't have ub_socket */
1789 freeaddrinfo(list->socket->addr);
1797 size_t listen_get_mem(struct listen_dnsport* listen)
1799 struct listen_list* p;
1800 size_t s = sizeof(*listen) + sizeof(*listen->base) +
1801 sizeof(*listen->udp_buff) +
1802 sldns_buffer_capacity(listen->udp_buff);
1804 s += sizeof(*listen->dnscrypt_udp_buff);
1805 if(listen->udp_buff != listen->dnscrypt_udp_buff){
1806 s += sldns_buffer_capacity(listen->dnscrypt_udp_buff);
1809 for(p = listen->cps; p; p = p->next) {
1811 s += comm_point_get_mem(p->com);
1816 void listen_stop_accept(struct listen_dnsport* listen)
1818 /* do not stop the ones that have no tcp_free list
1819 * (they have already stopped listening) */
1820 struct listen_list* p;
1821 for(p=listen->cps; p; p=p->next) {
1822 if(p->com->type == comm_tcp_accept &&
1823 p->com->tcp_free != NULL) {
1824 comm_point_stop_listening(p->com);
1829 void listen_start_accept(struct listen_dnsport* listen)
1831 /* do not start the ones that have no tcp_free list, it is no
1832 * use to listen to them because they have no free tcp handlers */
1833 struct listen_list* p;
1834 for(p=listen->cps; p; p=p->next) {
1835 if(p->com->type == comm_tcp_accept &&
1836 p->com->tcp_free != NULL) {
1837 comm_point_start_listening(p->com, -1, -1);
1842 struct tcp_req_info*
1843 tcp_req_info_create(struct sldns_buffer* spoolbuf)
1845 struct tcp_req_info* req = (struct tcp_req_info*)malloc(sizeof(*req));
1847 log_err("malloc failure for new stream outoforder processing structure");
1850 memset(req, 0, sizeof(*req));
1851 req->spool_buffer = spoolbuf;
1856 tcp_req_info_delete(struct tcp_req_info* req)
1859 tcp_req_info_clear(req);
1860 /* cp is pointer back to commpoint that owns this struct and
1861 * called delete on us */
1862 /* spool_buffer is shared udp buffer, not deleted here */
1866 void tcp_req_info_clear(struct tcp_req_info* req)
1868 struct tcp_req_open_item* open, *nopen;
1869 struct tcp_req_done_item* item, *nitem;
1872 /* free outstanding request mesh reply entries */
1873 open = req->open_req_list;
1876 mesh_state_remove_reply(open->mesh, open->mesh_state, req->cp);
1880 req->open_req_list = NULL;
1881 req->num_open_req = 0;
1883 /* free pending writable result packets */
1884 item = req->done_req_list;
1887 lock_basic_lock(&stream_wait_count_lock);
1888 stream_wait_count -= (sizeof(struct tcp_req_done_item)
1890 lock_basic_unlock(&stream_wait_count_lock);
1895 req->done_req_list = NULL;
1896 req->num_done_req = 0;
1897 req->read_is_closed = 0;
1901 tcp_req_info_remove_mesh_state(struct tcp_req_info* req, struct mesh_state* m)
1903 struct tcp_req_open_item* open, *prev = NULL;
1904 if(!req || !m) return;
1905 open = req->open_req_list;
1907 if(open->mesh_state == m) {
1908 struct tcp_req_open_item* next;
1909 if(prev) prev->next = open->next;
1910 else req->open_req_list = open->next;
1911 /* caller has to manage the mesh state reply entry */
1914 req->num_open_req --;
1925 /** setup listening for read or write */
1927 tcp_req_info_setup_listen(struct tcp_req_info* req)
1932 if(req->cp->tcp_byte_count != 0) {
1933 /* cannot change, halfway through */
1937 if(!req->cp->tcp_is_reading)
1939 if(!req->read_is_closed)
1943 req->cp->tcp_is_reading = 0;
1944 comm_point_stop_listening(req->cp);
1945 comm_point_start_listening(req->cp, -1,
1946 adjusted_tcp_timeout(req->cp));
1948 req->cp->tcp_is_reading = 1;
1949 comm_point_stop_listening(req->cp);
1950 comm_point_start_listening(req->cp, -1,
1951 adjusted_tcp_timeout(req->cp));
1952 /* and also read it (from SSL stack buffers), so
1953 * no event read event is expected since the remainder of
1954 * the TLS frame is sitting in the buffers. */
1955 req->read_again = 1;
1957 comm_point_stop_listening(req->cp);
1958 comm_point_start_listening(req->cp, -1,
1959 adjusted_tcp_timeout(req->cp));
1960 comm_point_listen_for_rw(req->cp, 0, 0);
1964 /** remove first item from list of pending results */
1965 static struct tcp_req_done_item*
1966 tcp_req_info_pop_done(struct tcp_req_info* req)
1968 struct tcp_req_done_item* item;
1969 log_assert(req->num_done_req > 0 && req->done_req_list);
1970 item = req->done_req_list;
1971 lock_basic_lock(&stream_wait_count_lock);
1972 stream_wait_count -= (sizeof(struct tcp_req_done_item)+item->len);
1973 lock_basic_unlock(&stream_wait_count_lock);
1974 req->done_req_list = req->done_req_list->next;
1975 req->num_done_req --;
1979 /** Send given buffer and setup to write */
1981 tcp_req_info_start_write_buf(struct tcp_req_info* req, uint8_t* buf,
1984 sldns_buffer_clear(req->cp->buffer);
1985 sldns_buffer_write(req->cp->buffer, buf, len);
1986 sldns_buffer_flip(req->cp->buffer);
1988 req->cp->tcp_is_reading = 0; /* we are now writing */
1991 /** pick up the next result and start writing it to the channel */
1993 tcp_req_pickup_next_result(struct tcp_req_info* req)
1995 if(req->num_done_req > 0) {
1996 /* unlist the done item from the list of pending results */
1997 struct tcp_req_done_item* item = tcp_req_info_pop_done(req);
1998 tcp_req_info_start_write_buf(req, item->buf, item->len);
2004 /** the read channel has closed */
2006 tcp_req_info_handle_read_close(struct tcp_req_info* req)
2008 verbose(VERB_ALGO, "tcp channel read side closed %d", req->cp->fd);
2009 /* reset byte count for (potential) partial read */
2010 req->cp->tcp_byte_count = 0;
2011 /* if we still have results to write, pick up next and write it */
2012 if(req->num_done_req != 0) {
2013 tcp_req_pickup_next_result(req);
2014 tcp_req_info_setup_listen(req);
2017 /* if nothing to do, this closes the connection */
2018 if(req->num_open_req == 0 && req->num_done_req == 0)
2020 /* otherwise, we must be waiting for dns resolve, wait with timeout */
2021 req->read_is_closed = 1;
2022 tcp_req_info_setup_listen(req);
2027 tcp_req_info_handle_writedone(struct tcp_req_info* req)
2029 /* back to reading state, we finished this write event */
2030 sldns_buffer_clear(req->cp->buffer);
2031 if(req->num_done_req == 0 && req->read_is_closed) {
2032 /* no more to write and nothing to read, close it */
2033 comm_point_drop_reply(&req->cp->repinfo);
2036 req->cp->tcp_is_reading = 1;
2037 /* see if another result needs writing */
2038 tcp_req_pickup_next_result(req);
2040 /* see if there is more to write, if not stop_listening for writing */
2041 /* see if new requests are allowed, if so, start_listening
2043 tcp_req_info_setup_listen(req);
2047 tcp_req_info_handle_readdone(struct tcp_req_info* req)
2049 struct comm_point* c = req->cp;
2051 /* we want to read up several requests, unless there are
2052 * pending answers */
2056 req->in_worker_handle = 1;
2057 sldns_buffer_set_limit(req->spool_buffer, 0);
2058 /* handle the current request */
2059 /* this calls the worker handle request routine that could give
2060 * a cache response, or localdata response, or drop the reply,
2061 * or schedule a mesh entry for later */
2062 fptr_ok(fptr_whitelist_comm_point(c->callback));
2063 if( (*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, &c->repinfo) ) {
2064 req->in_worker_handle = 0;
2065 /* there is an answer, put it up. It is already in the
2066 * c->buffer, just send it. */
2067 /* since we were just reading a query, the channel is
2068 * clear to write to */
2070 c->tcp_is_reading = 0;
2071 comm_point_stop_listening(c);
2072 comm_point_start_listening(c, -1, adjusted_tcp_timeout(c));
2075 req->in_worker_handle = 0;
2076 /* it should be waiting in the mesh for recursion.
2077 * If mesh failed to add a new entry and called commpoint_drop_reply.
2078 * Then the mesh state has been cleared. */
2080 /* the reply has been dropped, stream has been closed. */
2083 /* If mesh failed(mallocfail) and called commpoint_send_reply with
2084 * something like servfail then we pick up that reply below. */
2089 sldns_buffer_clear(c->buffer);
2090 /* if pending answers, pick up an answer and start sending it */
2091 tcp_req_pickup_next_result(req);
2093 /* if answers pending, start sending answers */
2094 /* read more requests if we can have more requests */
2095 tcp_req_info_setup_listen(req);
2099 tcp_req_info_add_meshstate(struct tcp_req_info* req,
2100 struct mesh_area* mesh, struct mesh_state* m)
2102 struct tcp_req_open_item* item;
2103 log_assert(req && mesh && m);
2104 item = (struct tcp_req_open_item*)malloc(sizeof(*item));
2106 item->next = req->open_req_list;
2108 item->mesh_state = m;
2109 req->open_req_list = item;
2110 req->num_open_req++;
2114 /** Add a result to the result list. At the end. */
2116 tcp_req_info_add_result(struct tcp_req_info* req, uint8_t* buf, size_t len)
2118 struct tcp_req_done_item* last = NULL;
2119 struct tcp_req_done_item* item;
2122 /* see if we have space */
2123 space = sizeof(struct tcp_req_done_item) + len;
2124 lock_basic_lock(&stream_wait_count_lock);
2125 if(stream_wait_count + space > stream_wait_max) {
2126 lock_basic_unlock(&stream_wait_count_lock);
2127 verbose(VERB_ALGO, "drop stream reply, no space left, in stream-wait-size");
2130 stream_wait_count += space;
2131 lock_basic_unlock(&stream_wait_count_lock);
2133 /* find last element */
2134 last = req->done_req_list;
2135 while(last && last->next)
2138 /* create new element */
2139 item = (struct tcp_req_done_item*)malloc(sizeof(*item));
2141 log_err("malloc failure, for stream result list");
2146 item->buf = memdup(buf, len);
2149 log_err("malloc failure, adding reply to stream result list");
2154 if(last) last->next = item;
2155 else req->done_req_list = item;
2156 req->num_done_req++;
2161 tcp_req_info_send_reply(struct tcp_req_info* req)
2163 if(req->in_worker_handle) {
2164 /* reply from mesh is in the spool_buffer */
2165 /* copy now, so that the spool buffer is free for other tasks
2166 * before the callback is done */
2167 sldns_buffer_clear(req->cp->buffer);
2168 sldns_buffer_write(req->cp->buffer,
2169 sldns_buffer_begin(req->spool_buffer),
2170 sldns_buffer_limit(req->spool_buffer));
2171 sldns_buffer_flip(req->cp->buffer);
2175 /* now that the query has been handled, that mesh_reply entry
2176 * should be removed, from the tcp_req_info list,
2177 * the mesh state cleanup removes then with region_cleanup and
2178 * replies_sent true. */
2179 /* see if we can send it straight away (we are not doing
2180 * anything else). If so, copy to buffer and start */
2181 if(req->cp->tcp_is_reading && req->cp->tcp_byte_count == 0) {
2182 /* buffer is free, and was ready to read new query into,
2183 * but we are now going to use it to send this answer */
2184 tcp_req_info_start_write_buf(req,
2185 sldns_buffer_begin(req->spool_buffer),
2186 sldns_buffer_limit(req->spool_buffer));
2187 /* switch to listen to write events */
2188 comm_point_stop_listening(req->cp);
2189 comm_point_start_listening(req->cp, -1,
2190 adjusted_tcp_timeout(req->cp));
2193 /* queue up the answer behind the others already pending */
2194 if(!tcp_req_info_add_result(req, sldns_buffer_begin(req->spool_buffer),
2195 sldns_buffer_limit(req->spool_buffer))) {
2196 /* drop the connection, we are out of resources */
2197 comm_point_drop_reply(&req->cp->repinfo);
2201 size_t tcp_req_info_get_stream_buffer_size(void)
2204 if(!stream_wait_lock_inited)
2205 return stream_wait_count;
2206 lock_basic_lock(&stream_wait_count_lock);
2207 s = stream_wait_count;
2208 lock_basic_unlock(&stream_wait_count_lock);
2212 size_t http2_get_query_buffer_size(void)
2215 if(!http2_query_buffer_lock_inited)
2216 return http2_query_buffer_count;
2217 lock_basic_lock(&http2_query_buffer_count_lock);
2218 s = http2_query_buffer_count;
2219 lock_basic_unlock(&http2_query_buffer_count_lock);
2223 size_t http2_get_response_buffer_size(void)
2226 if(!http2_response_buffer_lock_inited)
2227 return http2_response_buffer_count;
2228 lock_basic_lock(&http2_response_buffer_count_lock);
2229 s = http2_response_buffer_count;
2230 lock_basic_unlock(&http2_response_buffer_count_lock);
2235 /** nghttp2 callback. Used to copy response from rbuffer to nghttp2 session */
2236 static ssize_t http2_submit_response_read_callback(
2237 nghttp2_session* ATTR_UNUSED(session),
2238 int32_t stream_id, uint8_t* buf, size_t length, uint32_t* data_flags,
2239 nghttp2_data_source* source, void* ATTR_UNUSED(cb_arg))
2241 struct http2_stream* h2_stream;
2242 struct http2_session* h2_session = source->ptr;
2243 size_t copylen = length;
2244 if(!(h2_stream = nghttp2_session_get_stream_user_data(
2245 h2_session->session, stream_id))) {
2246 verbose(VERB_QUERY, "http2: cannot get stream data, closing "
2248 return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
2250 if(!h2_stream->rbuffer ||
2251 sldns_buffer_remaining(h2_stream->rbuffer) == 0) {
2252 verbose(VERB_QUERY, "http2: cannot submit buffer. No data "
2253 "available in rbuffer");
2254 /* rbuffer will be free'd in frame close cb */
2255 return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
2258 if(copylen > sldns_buffer_remaining(h2_stream->rbuffer))
2259 copylen = sldns_buffer_remaining(h2_stream->rbuffer);
2260 if(copylen > SSIZE_MAX)
2261 copylen = SSIZE_MAX; /* will probably never happen */
2263 memcpy(buf, sldns_buffer_current(h2_stream->rbuffer), copylen);
2264 sldns_buffer_skip(h2_stream->rbuffer, copylen);
2266 if(sldns_buffer_remaining(h2_stream->rbuffer) == 0) {
2267 *data_flags |= NGHTTP2_DATA_FLAG_EOF;
2268 lock_basic_lock(&http2_response_buffer_count_lock);
2269 http2_response_buffer_count -=
2270 sldns_buffer_capacity(h2_stream->rbuffer);
2271 lock_basic_unlock(&http2_response_buffer_count_lock);
2272 sldns_buffer_free(h2_stream->rbuffer);
2273 h2_stream->rbuffer = NULL;
2280 * Send RST_STREAM frame for stream.
2281 * @param h2_session: http2 session to submit frame to
2282 * @param h2_stream: http2 stream containing frame ID to use in RST_STREAM
2283 * @return 0 on error, 1 otherwise
2285 static int http2_submit_rst_stream(struct http2_session* h2_session,
2286 struct http2_stream* h2_stream)
2288 int ret = nghttp2_submit_rst_stream(h2_session->session,
2289 NGHTTP2_FLAG_NONE, h2_stream->stream_id,
2290 NGHTTP2_INTERNAL_ERROR);
2292 verbose(VERB_QUERY, "http2: nghttp2_submit_rst_stream failed, "
2293 "error: %s", nghttp2_strerror(ret));
2300 * DNS response ready to be submitted to nghttp2, to be prepared for sending
2301 * out. Response is stored in c->buffer. Copy to rbuffer because the c->buffer
2302 * might be used before this will be sent out.
2303 * @param h2_session: http2 session, containing c->buffer which contains answer
2304 * @return 0 on error, 1 otherwise
2306 int http2_submit_dns_response(struct http2_session* h2_session)
2309 nghttp2_data_provider data_prd;
2311 nghttp2_nv headers[3];
2312 struct http2_stream* h2_stream = h2_session->c->h2_stream;
2316 if(h2_stream->rbuffer) {
2317 log_err("http2 submit response error: rbuffer already "
2321 if(sldns_buffer_remaining(h2_session->c->buffer) == 0) {
2322 log_err("http2 submit response error: c->buffer not complete");
2326 if(snprintf(status, 4, "%d", h2_stream->status) != 3) {
2327 verbose(VERB_QUERY, "http2: submit response error: "
2332 rlen = sldns_buffer_remaining(h2_session->c->buffer);
2333 snprintf(rlen_str, sizeof(rlen_str), "%u", (unsigned)rlen);
2335 lock_basic_lock(&http2_response_buffer_count_lock);
2336 if(http2_response_buffer_count + rlen > http2_response_buffer_max) {
2337 lock_basic_unlock(&http2_response_buffer_count_lock);
2338 verbose(VERB_ALGO, "reset HTTP2 stream, no space left, "
2339 "in https-response-buffer-size");
2340 return http2_submit_rst_stream(h2_session, h2_stream);
2342 http2_response_buffer_count += rlen;
2343 lock_basic_unlock(&http2_response_buffer_count_lock);
2345 if(!(h2_stream->rbuffer = sldns_buffer_new(rlen))) {
2346 lock_basic_lock(&http2_response_buffer_count_lock);
2347 http2_response_buffer_count -= rlen;
2348 lock_basic_unlock(&http2_response_buffer_count_lock);
2349 log_err("http2 submit response error: malloc failure");
2353 headers[0].name = (uint8_t*)":status";
2354 headers[0].namelen = 7;
2355 headers[0].value = (uint8_t*)status;
2356 headers[0].valuelen = 3;
2357 headers[0].flags = NGHTTP2_NV_FLAG_NONE;
2359 headers[1].name = (uint8_t*)"content-type";
2360 headers[1].namelen = 12;
2361 headers[1].value = (uint8_t*)"application/dns-message";
2362 headers[1].valuelen = 23;
2363 headers[1].flags = NGHTTP2_NV_FLAG_NONE;
2365 headers[2].name = (uint8_t*)"content-length";
2366 headers[2].namelen = 14;
2367 headers[2].value = (uint8_t*)rlen_str;
2368 headers[2].valuelen = strlen(rlen_str);
2369 headers[2].flags = NGHTTP2_NV_FLAG_NONE;
2371 sldns_buffer_write(h2_stream->rbuffer,
2372 sldns_buffer_current(h2_session->c->buffer),
2373 sldns_buffer_remaining(h2_session->c->buffer));
2374 sldns_buffer_flip(h2_stream->rbuffer);
2376 data_prd.source.ptr = h2_session;
2377 data_prd.read_callback = http2_submit_response_read_callback;
2378 ret = nghttp2_submit_response(h2_session->session, h2_stream->stream_id,
2379 headers, 3, &data_prd);
2381 verbose(VERB_QUERY, "http2: set_stream_user_data failed, "
2382 "error: %s", nghttp2_strerror(ret));
2388 int http2_submit_dns_response(void* ATTR_UNUSED(v))
2395 /** HTTP status to descriptive string */
2396 static char* http_status_to_str(enum http_status s)
2399 case HTTP_STATUS_OK:
2401 case HTTP_STATUS_BAD_REQUEST:
2402 return "Bad Request";
2403 case HTTP_STATUS_NOT_FOUND:
2405 case HTTP_STATUS_PAYLOAD_TOO_LARGE:
2406 return "Payload Too Large";
2407 case HTTP_STATUS_URI_TOO_LONG:
2408 return "URI Too Long";
2409 case HTTP_STATUS_UNSUPPORTED_MEDIA_TYPE:
2410 return "Unsupported Media Type";
2411 case HTTP_STATUS_NOT_IMPLEMENTED:
2412 return "Not Implemented";
2414 return "Status Unknown";
2417 /** nghttp2 callback. Used to copy error message to nghttp2 session */
2418 static ssize_t http2_submit_error_read_callback(
2419 nghttp2_session* ATTR_UNUSED(session),
2420 int32_t stream_id, uint8_t* buf, size_t length, uint32_t* data_flags,
2421 nghttp2_data_source* source, void* ATTR_UNUSED(cb_arg))
2423 struct http2_stream* h2_stream;
2424 struct http2_session* h2_session = source->ptr;
2426 if(!(h2_stream = nghttp2_session_get_stream_user_data(
2427 h2_session->session, stream_id))) {
2428 verbose(VERB_QUERY, "http2: cannot get stream data, closing "
2430 return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
2432 *data_flags |= NGHTTP2_DATA_FLAG_EOF;
2433 msg = http_status_to_str(h2_stream->status);
2434 if(length < strlen(msg))
2435 return 0; /* not worth trying over multiple frames */
2436 memcpy(buf, msg, strlen(msg));
2442 * HTTP error response ready to be submitted to nghttp2, to be prepared for
2443 * sending out. Message body will contain descriptive string for HTTP status.
2444 * @param h2_session: http2 session to submit to
2445 * @param h2_stream: http2 stream containing HTTP status to use for error
2446 * @return 0 on error, 1 otherwise
2448 static int http2_submit_error(struct http2_session* h2_session,
2449 struct http2_stream* h2_stream)
2453 nghttp2_data_provider data_prd;
2454 nghttp2_nv headers[1]; /* will be copied by nghttp */
2455 if(snprintf(status, 4, "%d", h2_stream->status) != 3) {
2456 verbose(VERB_QUERY, "http2: submit error failed, "
2460 headers[0].name = (uint8_t*)":status";
2461 headers[0].namelen = 7;
2462 headers[0].value = (uint8_t*)status;
2463 headers[0].valuelen = 3;
2464 headers[0].flags = NGHTTP2_NV_FLAG_NONE;
2466 data_prd.source.ptr = h2_session;
2467 data_prd.read_callback = http2_submit_error_read_callback;
2469 ret = nghttp2_submit_response(h2_session->session, h2_stream->stream_id,
2470 headers, 1, &data_prd);
2472 verbose(VERB_QUERY, "http2: submit error failed, "
2473 "error: %s", nghttp2_strerror(ret));
2480 * Start query handling. Query is stored in the stream, and will be free'd here.
2481 * @param h2_session: http2 session, containing comm point
2482 * @param h2_stream: stream containing buffered query
2483 * @return: -1 on error, 1 if answer is stored in c->buffer, 0 if there is no
2484 * reply available (yet).
2486 static int http2_query_read_done(struct http2_session* h2_session,
2487 struct http2_stream* h2_stream)
2489 log_assert(h2_stream->qbuffer);
2491 if(h2_session->c->h2_stream) {
2492 verbose(VERB_ALGO, "http2_query_read_done failure: shared "
2493 "buffer already assigned to stream");
2497 /* the c->buffer might be used by mesh_send_reply and no be cleard
2498 * need to be cleared before use */
2499 sldns_buffer_clear(h2_session->c->buffer);
2500 if(sldns_buffer_remaining(h2_session->c->buffer) <
2501 sldns_buffer_remaining(h2_stream->qbuffer)) {
2502 /* qbuffer will be free'd in frame close cb */
2503 sldns_buffer_clear(h2_session->c->buffer);
2504 verbose(VERB_ALGO, "http2_query_read_done failure: can't fit "
2505 "qbuffer in c->buffer");
2509 sldns_buffer_write(h2_session->c->buffer,
2510 sldns_buffer_current(h2_stream->qbuffer),
2511 sldns_buffer_remaining(h2_stream->qbuffer));
2513 lock_basic_lock(&http2_query_buffer_count_lock);
2514 http2_query_buffer_count -= sldns_buffer_capacity(h2_stream->qbuffer);
2515 lock_basic_unlock(&http2_query_buffer_count_lock);
2516 sldns_buffer_free(h2_stream->qbuffer);
2517 h2_stream->qbuffer = NULL;
2519 sldns_buffer_flip(h2_session->c->buffer);
2520 h2_session->c->h2_stream = h2_stream;
2521 fptr_ok(fptr_whitelist_comm_point(h2_session->c->callback));
2522 if((*h2_session->c->callback)(h2_session->c, h2_session->c->cb_arg,
2523 NETEVENT_NOERROR, &h2_session->c->repinfo)) {
2524 return 1; /* answer in c->buffer */
2526 sldns_buffer_clear(h2_session->c->buffer);
2527 h2_session->c->h2_stream = NULL;
2528 return 0; /* mesh state added, or dropped */
2531 /** nghttp2 callback. Used to check if the received frame indicates the end of a
2532 * stream. Gather collected request data and start query handling. */
2533 static int http2_req_frame_recv_cb(nghttp2_session* session,
2534 const nghttp2_frame* frame, void* cb_arg)
2536 struct http2_session* h2_session = (struct http2_session*)cb_arg;
2537 struct http2_stream* h2_stream;
2538 int query_read_done;
2540 if((frame->hd.type != NGHTTP2_DATA &&
2541 frame->hd.type != NGHTTP2_HEADERS) ||
2542 !(frame->hd.flags & NGHTTP2_FLAG_END_STREAM)) {
2546 if(!(h2_stream = nghttp2_session_get_stream_user_data(
2547 session, frame->hd.stream_id)))
2550 if(h2_stream->invalid_endpoint) {
2551 h2_stream->status = HTTP_STATUS_NOT_FOUND;
2552 goto submit_http_error;
2555 if(h2_stream->invalid_content_type) {
2556 h2_stream->status = HTTP_STATUS_UNSUPPORTED_MEDIA_TYPE;
2557 goto submit_http_error;
2560 if(h2_stream->http_method != HTTP_METHOD_GET &&
2561 h2_stream->http_method != HTTP_METHOD_POST) {
2562 h2_stream->status = HTTP_STATUS_NOT_IMPLEMENTED;
2563 goto submit_http_error;
2566 if(h2_stream->query_too_large) {
2567 if(h2_stream->http_method == HTTP_METHOD_POST)
2568 h2_stream->status = HTTP_STATUS_PAYLOAD_TOO_LARGE;
2570 h2_stream->status = HTTP_STATUS_URI_TOO_LONG;
2571 goto submit_http_error;
2574 if(!h2_stream->qbuffer) {
2575 h2_stream->status = HTTP_STATUS_BAD_REQUEST;
2576 goto submit_http_error;
2579 if(h2_stream->status) {
2581 verbose(VERB_QUERY, "http2 request invalid, returning :status="
2582 "%d", h2_stream->status);
2583 if(!http2_submit_error(h2_session, h2_stream)) {
2584 return NGHTTP2_ERR_CALLBACK_FAILURE;
2588 h2_stream->status = HTTP_STATUS_OK;
2590 sldns_buffer_flip(h2_stream->qbuffer);
2591 h2_session->postpone_drop = 1;
2592 query_read_done = http2_query_read_done(h2_session, h2_stream);
2593 if(query_read_done < 0)
2594 return NGHTTP2_ERR_CALLBACK_FAILURE;
2595 else if(!query_read_done) {
2596 if(h2_session->is_drop) {
2597 /* connection needs to be closed. Return failure to make
2598 * sure no other action are taken anymore on comm point.
2599 * failure will result in reclaiming (and closing)
2601 verbose(VERB_QUERY, "http2 query dropped in worker cb");
2602 h2_session->postpone_drop = 0;
2603 return NGHTTP2_ERR_CALLBACK_FAILURE;
2605 /* nothing to submit right now, query added to mesh. */
2606 h2_session->postpone_drop = 0;
2609 if(!http2_submit_dns_response(h2_session)) {
2610 sldns_buffer_clear(h2_session->c->buffer);
2611 h2_session->c->h2_stream = NULL;
2612 return NGHTTP2_ERR_CALLBACK_FAILURE;
2614 verbose(VERB_QUERY, "http2 query submitted to session");
2615 sldns_buffer_clear(h2_session->c->buffer);
2616 h2_session->c->h2_stream = NULL;
2620 /** nghttp2 callback. Used to detect start of new streams. */
2621 static int http2_req_begin_headers_cb(nghttp2_session* session,
2622 const nghttp2_frame* frame, void* cb_arg)
2624 struct http2_session* h2_session = (struct http2_session*)cb_arg;
2625 struct http2_stream* h2_stream;
2627 if(frame->hd.type != NGHTTP2_HEADERS ||
2628 frame->headers.cat != NGHTTP2_HCAT_REQUEST) {
2629 /* only interested in request headers */
2632 if(!(h2_stream = http2_stream_create(frame->hd.stream_id))) {
2633 log_err("malloc failure while creating http2 stream");
2634 return NGHTTP2_ERR_CALLBACK_FAILURE;
2636 http2_session_add_stream(h2_session, h2_stream);
2637 ret = nghttp2_session_set_stream_user_data(session,
2638 frame->hd.stream_id, h2_stream);
2640 /* stream does not exist */
2641 verbose(VERB_QUERY, "http2: set_stream_user_data failed, "
2642 "error: %s", nghttp2_strerror(ret));
2643 return NGHTTP2_ERR_CALLBACK_FAILURE;
2650 * base64url decode, store in qbuffer
2651 * @param h2_session: http2 session
2652 * @param h2_stream: http2 stream
2653 * @param start: start of the base64 string
2654 * @param length: length of the base64 string
2655 * @return: 0 on error, 1 otherwise. query will be stored in h2_stream->qbuffer,
2656 * buffer will be NULL is unparseble.
2658 static int http2_buffer_uri_query(struct http2_session* h2_session,
2659 struct http2_stream* h2_stream, const uint8_t* start, size_t length)
2661 size_t expectb64len;
2663 if(h2_stream->http_method == HTTP_METHOD_POST)
2667 if(h2_stream->qbuffer) {
2668 verbose(VERB_ALGO, "http2_req_header fail, "
2669 "qbuffer already set");
2673 /* calculate size, might be a bit bigger than the real
2674 * decoded buffer size */
2675 expectb64len = sldns_b64_pton_calculate_size(length);
2676 log_assert(expectb64len > 0);
2678 h2_session->c->http2_stream_max_qbuffer_size) {
2679 h2_stream->query_too_large = 1;
2683 lock_basic_lock(&http2_query_buffer_count_lock);
2684 if(http2_query_buffer_count + expectb64len > http2_query_buffer_max) {
2685 lock_basic_unlock(&http2_query_buffer_count_lock);
2686 verbose(VERB_ALGO, "reset HTTP2 stream, no space left, "
2687 "in http2-query-buffer-size");
2688 return http2_submit_rst_stream(h2_session, h2_stream);
2690 http2_query_buffer_count += expectb64len;
2691 lock_basic_unlock(&http2_query_buffer_count_lock);
2692 if(!(h2_stream->qbuffer = sldns_buffer_new(expectb64len))) {
2693 lock_basic_lock(&http2_query_buffer_count_lock);
2694 http2_query_buffer_count -= expectb64len;
2695 lock_basic_unlock(&http2_query_buffer_count_lock);
2696 log_err("http2_req_header fail, qbuffer "
2701 if(sldns_b64_contains_nonurl((char const*)start, length)) {
2703 verbose(VERB_ALGO, "HTTP2 stream contains wrong b64 encoding");
2704 /* copy to the scratch buffer temporarily to terminate the
2705 * string with a zero */
2706 if(length+1 > sizeof(buf)) {
2708 lock_basic_lock(&http2_query_buffer_count_lock);
2709 http2_query_buffer_count -= expectb64len;
2710 lock_basic_unlock(&http2_query_buffer_count_lock);
2711 sldns_buffer_free(h2_stream->qbuffer);
2712 h2_stream->qbuffer = NULL;
2715 memmove(buf, start, length);
2717 if(!(b64len = sldns_b64_pton(buf, sldns_buffer_current(
2718 h2_stream->qbuffer), expectb64len)) || b64len < 0) {
2719 lock_basic_lock(&http2_query_buffer_count_lock);
2720 http2_query_buffer_count -= expectb64len;
2721 lock_basic_unlock(&http2_query_buffer_count_lock);
2722 sldns_buffer_free(h2_stream->qbuffer);
2723 h2_stream->qbuffer = NULL;
2727 if(!(b64len = sldns_b64url_pton(
2728 (char const *)start, length,
2729 sldns_buffer_current(h2_stream->qbuffer),
2730 expectb64len)) || b64len < 0) {
2731 lock_basic_lock(&http2_query_buffer_count_lock);
2732 http2_query_buffer_count -= expectb64len;
2733 lock_basic_unlock(&http2_query_buffer_count_lock);
2734 sldns_buffer_free(h2_stream->qbuffer);
2735 h2_stream->qbuffer = NULL;
2736 /* return without error, method can be an
2741 sldns_buffer_skip(h2_stream->qbuffer, (size_t)b64len);
2745 /** nghttp2 callback. Used to parse headers from HEADER frames. */
2746 static int http2_req_header_cb(nghttp2_session* session,
2747 const nghttp2_frame* frame, const uint8_t* name, size_t namelen,
2748 const uint8_t* value, size_t valuelen, uint8_t ATTR_UNUSED(flags),
2751 struct http2_stream* h2_stream = NULL;
2752 struct http2_session* h2_session = (struct http2_session*)cb_arg;
2753 /* nghttp2 deals with CONTINUATION frames and provides them as part of
2755 if(frame->hd.type != NGHTTP2_HEADERS ||
2756 frame->headers.cat != NGHTTP2_HCAT_REQUEST) {
2757 /* only interested in request headers */
2760 if(!(h2_stream = nghttp2_session_get_stream_user_data(session,
2761 frame->hd.stream_id)))
2764 /* earlier checks already indicate we can stop handling this query */
2765 if(h2_stream->http_method == HTTP_METHOD_UNSUPPORTED ||
2766 h2_stream->invalid_content_type ||
2767 h2_stream->invalid_endpoint)
2771 /* nghttp2 performs some sanity checks in the headers, including:
2772 * name and value are guaranteed to be null terminated
2773 * name is guaranteed to be lowercase
2774 * content-length value is guaranteed to contain digits
2777 if(!h2_stream->http_method && namelen == 7 &&
2778 memcmp(":method", name, namelen) == 0) {
2779 /* Case insensitive check on :method value to be on the safe
2780 * side. I failed to find text about case sensitivity in specs.
2782 if(valuelen == 3 && strcasecmp("GET", (const char*)value) == 0)
2783 h2_stream->http_method = HTTP_METHOD_GET;
2784 else if(valuelen == 4 &&
2785 strcasecmp("POST", (const char*)value) == 0) {
2786 h2_stream->http_method = HTTP_METHOD_POST;
2787 if(h2_stream->qbuffer) {
2788 /* POST method uses query from DATA frames */
2789 lock_basic_lock(&http2_query_buffer_count_lock);
2790 http2_query_buffer_count -=
2791 sldns_buffer_capacity(h2_stream->qbuffer);
2792 lock_basic_unlock(&http2_query_buffer_count_lock);
2793 sldns_buffer_free(h2_stream->qbuffer);
2794 h2_stream->qbuffer = NULL;
2797 h2_stream->http_method = HTTP_METHOD_UNSUPPORTED;
2800 if(namelen == 5 && memcmp(":path", name, namelen) == 0) {
2801 /* :path may contain DNS query, depending on method. Method might
2802 * not be known yet here, so check after finishing receiving
2804 #define HTTP_QUERY_PARAM "?dns="
2805 size_t el = strlen(h2_session->c->http_endpoint);
2806 size_t qpl = strlen(HTTP_QUERY_PARAM);
2808 if(valuelen < el || memcmp(h2_session->c->http_endpoint,
2810 h2_stream->invalid_endpoint = 1;
2813 /* larger than endpoint only allowed if it is for the query
2815 if(valuelen <= el+qpl ||
2816 memcmp(HTTP_QUERY_PARAM, value+el, qpl) != 0) {
2818 h2_stream->invalid_endpoint = 1;
2822 if(!http2_buffer_uri_query(h2_session, h2_stream,
2823 value+(el+qpl), valuelen-(el+qpl))) {
2824 return NGHTTP2_ERR_CALLBACK_FAILURE;
2828 /* Content type is a SHOULD (rfc7231#section-3.1.1.5) when using POST,
2829 * and not needed when using GET. Don't enfore.
2830 * If set only allow lowercase "application/dns-message".
2832 * Clients SHOULD (rfc8484#section-4.1) set an accept header, but MUST
2833 * be able to handle "application/dns-message". Since that is the only
2834 * content-type supported we can ignore the accept header.
2836 if((namelen == 12 && memcmp("content-type", name, namelen) == 0)) {
2837 if(valuelen != 23 || memcmp("application/dns-message", value,
2839 h2_stream->invalid_content_type = 1;
2843 /* Only interested in content-lentg for POST (on not yet known) method.
2845 if((!h2_stream->http_method ||
2846 h2_stream->http_method == HTTP_METHOD_POST) &&
2847 !h2_stream->content_length && namelen == 14 &&
2848 memcmp("content-length", name, namelen) == 0) {
2850 h2_stream->query_too_large = 1;
2853 /* guaranteed to only contain digits and be null terminated */
2854 h2_stream->content_length = atoi((const char*)value);
2855 if(h2_stream->content_length >
2856 h2_session->c->http2_stream_max_qbuffer_size) {
2857 h2_stream->query_too_large = 1;
2864 /** nghttp2 callback. Used to get data from DATA frames, which can contain
2865 * queries in POST requests. */
2866 static int http2_req_data_chunk_recv_cb(nghttp2_session* ATTR_UNUSED(session),
2867 uint8_t ATTR_UNUSED(flags), int32_t stream_id, const uint8_t* data,
2868 size_t len, void* cb_arg)
2870 struct http2_session* h2_session = (struct http2_session*)cb_arg;
2871 struct http2_stream* h2_stream;
2874 if(!(h2_stream = nghttp2_session_get_stream_user_data(
2875 h2_session->session, stream_id))) {
2879 if(h2_stream->query_too_large)
2882 if(!h2_stream->qbuffer) {
2883 if(h2_stream->content_length) {
2884 if(h2_stream->content_length < len)
2885 /* getting more data in DATA frame than
2886 * advertised in content-length header. */
2887 return NGHTTP2_ERR_CALLBACK_FAILURE;
2888 qlen = h2_stream->content_length;
2889 } else if(len <= h2_session->c->http2_stream_max_qbuffer_size) {
2890 /* setting this to msg-buffer-size can result in a lot
2891 * of memory consuption. Most queries should fit in a
2892 * single DATA frame, and most POST queries will
2893 * contain content-length which does not impose this
2898 if(!h2_stream->qbuffer && qlen) {
2899 lock_basic_lock(&http2_query_buffer_count_lock);
2900 if(http2_query_buffer_count + qlen > http2_query_buffer_max) {
2901 lock_basic_unlock(&http2_query_buffer_count_lock);
2902 verbose(VERB_ALGO, "reset HTTP2 stream, no space left, "
2903 "in http2-query-buffer-size");
2904 return http2_submit_rst_stream(h2_session, h2_stream);
2906 http2_query_buffer_count += qlen;
2907 lock_basic_unlock(&http2_query_buffer_count_lock);
2908 if(!(h2_stream->qbuffer = sldns_buffer_new(qlen))) {
2909 lock_basic_lock(&http2_query_buffer_count_lock);
2910 http2_query_buffer_count -= qlen;
2911 lock_basic_unlock(&http2_query_buffer_count_lock);
2915 if(!h2_stream->qbuffer ||
2916 sldns_buffer_remaining(h2_stream->qbuffer) < len) {
2917 verbose(VERB_ALGO, "http2 data_chunck_recv failed. Not enough "
2918 "buffer space for POST query. Can happen on multi "
2919 "frame requests without content-length header");
2920 h2_stream->query_too_large = 1;
2924 sldns_buffer_write(h2_stream->qbuffer, data, len);
2929 void http2_req_stream_clear(struct http2_stream* h2_stream)
2931 if(h2_stream->qbuffer) {
2932 lock_basic_lock(&http2_query_buffer_count_lock);
2933 http2_query_buffer_count -=
2934 sldns_buffer_capacity(h2_stream->qbuffer);
2935 lock_basic_unlock(&http2_query_buffer_count_lock);
2936 sldns_buffer_free(h2_stream->qbuffer);
2937 h2_stream->qbuffer = NULL;
2939 if(h2_stream->rbuffer) {
2940 lock_basic_lock(&http2_response_buffer_count_lock);
2941 http2_response_buffer_count -=
2942 sldns_buffer_capacity(h2_stream->rbuffer);
2943 lock_basic_unlock(&http2_response_buffer_count_lock);
2944 sldns_buffer_free(h2_stream->rbuffer);
2945 h2_stream->rbuffer = NULL;
2949 nghttp2_session_callbacks* http2_req_callbacks_create(void)
2951 nghttp2_session_callbacks *callbacks;
2952 if(nghttp2_session_callbacks_new(&callbacks) == NGHTTP2_ERR_NOMEM) {
2953 log_err("failed to initialize nghttp2 callback");
2956 /* reception of header block started, used to create h2_stream */
2957 nghttp2_session_callbacks_set_on_begin_headers_callback(callbacks,
2958 http2_req_begin_headers_cb);
2959 /* complete frame received, used to get data from stream if frame
2960 * has end stream flag, and start processing query */
2961 nghttp2_session_callbacks_set_on_frame_recv_callback(callbacks,
2962 http2_req_frame_recv_cb);
2963 /* get request info from headers */
2964 nghttp2_session_callbacks_set_on_header_callback(callbacks,
2965 http2_req_header_cb);
2966 /* get data from DATA frames, containing POST query */
2967 nghttp2_session_callbacks_set_on_data_chunk_recv_callback(callbacks,
2968 http2_req_data_chunk_recv_cb);
2970 /* generic HTTP2 callbacks */
2971 nghttp2_session_callbacks_set_recv_callback(callbacks, http2_recv_cb);
2972 nghttp2_session_callbacks_set_send_callback(callbacks, http2_send_cb);
2973 nghttp2_session_callbacks_set_on_stream_close_callback(callbacks,
2974 http2_stream_close_cb);
2978 #endif /* HAVE_NGHTTP2 */