contrib/unbound/services/cache/dns.c

   1 /*
   2  * services/cache/dns.c - Cache services for DNS using msg and rrset caches.
   3  *
   4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * This file contains the DNS cache.
  40  */
  41 #include "config.h"
  42 #include "iterator/iter_delegpt.h"
  43 #include "iterator/iter_utils.h"
  44 #include "validator/val_nsec.h"
  45 #include "validator/val_utils.h"
  46 #include "services/cache/dns.h"
  47 #include "services/cache/rrset.h"
  48 #include "util/data/msgparse.h"
  49 #include "util/data/msgreply.h"
  50 #include "util/data/packed_rrset.h"
  51 #include "util/data/dname.h"
  52 #include "util/module.h"
  53 #include "util/net_help.h"
  54 #include "util/regional.h"
  55 #include "util/config_file.h"
  56 #include "sldns/sbuffer.h"
  57
  58 /** store rrsets in the rrset cache.
  59  * @param env: module environment with caches.
  60  * @param rep: contains list of rrsets to store.
  61  * @param now: current time.
  62  * @param leeway: during prefetch how much leeway to update TTLs.
  63  *      This makes rrsets (other than type NS) timeout sooner so they get
  64  *      updated with a new full TTL.
  65  *      Type NS does not get this, because it must not be refreshed from the
  66  *      child domain, but keep counting down properly.
  67  * @param pside: if from parentside discovered NS, so that its NS is okay
  68  *      in a prefetch situation to be updated (without becoming sticky).
  69  * @param qrep: update rrsets here if cache is better
  70  * @param region: for qrep allocs.
  71  */
  72 static void
  73 store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
  74         time_t leeway, int pside, struct reply_info* qrep,
  75         struct regional* region)
  76 {
  77         size_t i;
  78         /* see if rrset already exists in cache, if not insert it. */
  79         for(i=0; i<rep->rrset_count; i++) {
  80                 rep->ref[i].key = rep->rrsets[i];
  81                 rep->ref[i].id = rep->rrsets[i]->id;
  82                 /* update ref if it was in the cache */
  83                 switch(rrset_cache_update(env->rrset_cache, &rep->ref[i],
  84                                 env->alloc, now + ((ntohs(rep->ref[i].key->rk.type)==
  85                                 LDNS_RR_TYPE_NS && !pside)?0:leeway))) {
  86                 case 0: /* ref unchanged, item inserted */
  87                         break;
  88                 case 2: /* ref updated, cache is superior */
  89                         if(region) {
  90                                 struct ub_packed_rrset_key* ck;
  91                                 lock_rw_rdlock(&rep->ref[i].key->entry.lock);
  92                                 /* if deleted rrset, do not copy it */
  93                                 if(rep->ref[i].key->id == 0)
  94                                         ck = NULL;
  95                                 else    ck = packed_rrset_copy_region(
  96                                         rep->ref[i].key, region, now);
  97                                 lock_rw_unlock(&rep->ref[i].key->entry.lock);
  98                                 if(ck) {
  99                                         /* use cached copy if memory allows */
 100                                         qrep->rrsets[i] = ck;
 101                                 }
 102                         }
 103                         /* no break: also copy key item */
 104                         /* the line below is matched by gcc regex and silences
 105                          * the fallthrough warning */
 106                         /* fallthrough */
 107                 case 1: /* ref updated, item inserted */
 108                         rep->rrsets[i] = rep->ref[i].key;
 109                 }
 110         }
 111 }
 112
 113 /** delete message from message cache */
 114 void
 115 msg_cache_remove(struct module_env* env, uint8_t* qname, size_t qnamelen,
 116         uint16_t qtype, uint16_t qclass, uint16_t flags)
 117 {
 118         struct query_info k;
 119         hashvalue_type h;
 120
 121         k.qname = qname;
 122         k.qname_len = qnamelen;
 123         k.qtype = qtype;
 124         k.qclass = qclass;
 125         k.local_alias = NULL;
 126         h = query_info_hash(&k, flags);
 127         slabhash_remove(env->msg_cache, h, &k);
 128 }
 129
 130 /** remove servfail msg cache entry */
 131 static void
 132 msg_del_servfail(struct module_env* env, struct query_info* qinfo,
 133         uint32_t flags)
 134 {
 135         struct msgreply_entry* e;
 136         /* see if the entry is servfail, and then remove it, so that
 137          * lookups move from the cacheresponse stage to the recursionresponse
 138          * stage */
 139         e = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len,
 140                 qinfo->qtype, qinfo->qclass, flags, 0, 0);
 141         if(!e) return;
 142         /* we don't check for the ttl here, also expired servfail entries
 143          * are removed.  If the user uses serve-expired, they would still be
 144          * used to answer from cache */
 145         if(FLAGS_GET_RCODE(((struct reply_info*)e->entry.data)->flags)
 146                 != LDNS_RCODE_SERVFAIL) {
 147                 lock_rw_unlock(&e->entry.lock);
 148                 return;
 149         }
 150         lock_rw_unlock(&e->entry.lock);
 151         msg_cache_remove(env, qinfo->qname, qinfo->qname_len, qinfo->qtype,
 152                 qinfo->qclass, flags);
 153 }
 154
 155 void
 156 dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 157         hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside,
 158         struct reply_info* qrep, uint32_t flags, struct regional* region)
 159 {
 160         struct msgreply_entry* e;
 161         time_t ttl = rep->ttl;
 162         size_t i;
 163
 164         /* store RRsets */
 165         for(i=0; i<rep->rrset_count; i++) {
 166                 rep->ref[i].key = rep->rrsets[i];
 167                 rep->ref[i].id = rep->rrsets[i]->id;
 168         }
 169
 170         /* there was a reply_info_sortref(rep) here but it seems to be
 171          * unnecessary, because the cache gets locked per rrset. */
 172         reply_info_set_ttls(rep, *env->now);
 173         store_rrsets(env, rep, *env->now, leeway, pside, qrep, region);
 174         if(ttl == 0 && !(flags & DNSCACHE_STORE_ZEROTTL)) {
 175                 /* we do not store the message, but we did store the RRs,
 176                  * which could be useful for delegation information */
 177                 verbose(VERB_ALGO, "TTL 0: dropped msg from cache");
 178                 free(rep);
 179                 /* if the message is SERVFAIL in cache, remove that SERVFAIL,
 180                  * so that the TTL 0 response can be returned for future
 181                  * responses (i.e. don't get answered by the servfail from
 182                  * cache, but instead go to recursion to get this TTL0
 183                  * response). */
 184                 msg_del_servfail(env, qinfo, flags);
 185                 return;
 186         }
 187
 188         /* store msg in the cache */
 189         reply_info_sortref(rep);
 190         if(!(e = query_info_entrysetup(qinfo, rep, hash))) {
 191                 log_err("store_msg: malloc failed");
 192                 return;
 193         }
 194         slabhash_insert(env->msg_cache, hash, &e->entry, rep, env->alloc);
 195 }
 196
 197 /** find closest NS or DNAME and returns the rrset (locked) */
 198 static struct ub_packed_rrset_key*
 199 find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen,
 200         uint16_t qclass, time_t now, uint16_t searchtype, int stripfront)
 201 {
 202         struct ub_packed_rrset_key *rrset;
 203         uint8_t lablen;
 204
 205         if(stripfront) {
 206                 /* strip off so that DNAMEs have strict subdomain match */
 207                 lablen = *qname;
 208                 qname += lablen + 1;
 209                 qnamelen -= lablen + 1;
 210         }
 211
 212         /* snip off front part of qname until the type is found */
 213         while(qnamelen > 0) {
 214                 if((rrset = rrset_cache_lookup(env->rrset_cache, qname,
 215                         qnamelen, searchtype, qclass, 0, now, 0)))
 216                         return rrset;
 217
 218                 /* snip off front label */
 219                 lablen = *qname;
 220                 qname += lablen + 1;
 221                 qnamelen -= lablen + 1;
 222         }
 223         return NULL;
 224 }
 225
 226 /** add addr to additional section */
 227 static void
 228 addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region,
 229         struct dns_msg* msg, time_t now)
 230 {
 231         if((msg->rep->rrsets[msg->rep->rrset_count] =
 232                 packed_rrset_copy_region(rrset, region, now))) {
 233                 msg->rep->ar_numrrsets++;
 234                 msg->rep->rrset_count++;
 235         }
 236 }
 237
 238 /** lookup message in message cache */
 239 struct msgreply_entry*
 240 msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen,
 241         uint16_t qtype, uint16_t qclass, uint16_t flags, time_t now, int wr)
 242 {
 243         struct lruhash_entry* e;
 244         struct query_info k;
 245         hashvalue_type h;
 246
 247         k.qname = qname;
 248         k.qname_len = qnamelen;
 249         k.qtype = qtype;
 250         k.qclass = qclass;
 251         k.local_alias = NULL;
 252         h = query_info_hash(&k, flags);
 253         e = slabhash_lookup(env->msg_cache, h, &k, wr);
 254
 255         if(!e) return NULL;
 256         if( now > ((struct reply_info*)e->data)->ttl ) {
 257                 lock_rw_unlock(&e->lock);
 258                 return NULL;
 259         }
 260         return (struct msgreply_entry*)e->key;
 261 }
 262
 263 /** find and add A and AAAA records for nameservers in delegpt */
 264 static int
 265 find_add_addrs(struct module_env* env, uint16_t qclass,
 266         struct regional* region, struct delegpt* dp, time_t now,
 267         struct dns_msg** msg)
 268 {
 269         struct delegpt_ns* ns;
 270         struct msgreply_entry* neg;
 271         struct ub_packed_rrset_key* akey;
 272         for(ns = dp->nslist; ns; ns = ns->next) {
 273                 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 274                         ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 275                 if(akey) {
 276                         if(!delegpt_add_rrset_A(dp, region, akey, 0, NULL)) {
 277                                 lock_rw_unlock(&akey->entry.lock);
 278                                 return 0;
 279                         }
 280                         if(msg)
 281                                 addr_to_additional(akey, region, *msg, now);
 282                         lock_rw_unlock(&akey->entry.lock);
 283                 } else {
 284                         /* BIT_CD on false because delegpt lookup does
 285                          * not use dns64 translation */
 286                         neg = msg_cache_lookup(env, ns->name, ns->namelen,
 287                                 LDNS_RR_TYPE_A, qclass, 0, now, 0);
 288                         if(neg) {
 289                                 delegpt_add_neg_msg(dp, neg);
 290                                 lock_rw_unlock(&neg->entry.lock);
 291                         }
 292                 }
 293                 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 294                         ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 295                 if(akey) {
 296                         if(!delegpt_add_rrset_AAAA(dp, region, akey, 0, NULL)) {
 297                                 lock_rw_unlock(&akey->entry.lock);
 298                                 return 0;
 299                         }
 300                         if(msg)
 301                                 addr_to_additional(akey, region, *msg, now);
 302                         lock_rw_unlock(&akey->entry.lock);
 303                 } else {
 304                         /* BIT_CD on false because delegpt lookup does
 305                          * not use dns64 translation */
 306                         neg = msg_cache_lookup(env, ns->name, ns->namelen,
 307                                 LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 308                         if(neg) {
 309                                 delegpt_add_neg_msg(dp, neg);
 310                                 lock_rw_unlock(&neg->entry.lock);
 311                         }
 312                 }
 313         }
 314         return 1;
 315 }
 316
 317 /** find and add A and AAAA records for missing nameservers in delegpt */
 318 int
 319 cache_fill_missing(struct module_env* env, uint16_t qclass,
 320         struct regional* region, struct delegpt* dp)
 321 {
 322         struct delegpt_ns* ns;
 323         struct msgreply_entry* neg;
 324         struct ub_packed_rrset_key* akey;
 325         time_t now = *env->now;
 326         for(ns = dp->nslist; ns; ns = ns->next) {
 327                 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 328                         ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 329                 if(akey) {
 330                         if(!delegpt_add_rrset_A(dp, region, akey, ns->lame,
 331                                 NULL)) {
 332                                 lock_rw_unlock(&akey->entry.lock);
 333                                 return 0;
 334                         }
 335                         log_nametypeclass(VERB_ALGO, "found in cache",
 336                                 ns->name, LDNS_RR_TYPE_A, qclass);
 337                         lock_rw_unlock(&akey->entry.lock);
 338                 } else {
 339                         /* BIT_CD on false because delegpt lookup does
 340                          * not use dns64 translation */
 341                         neg = msg_cache_lookup(env, ns->name, ns->namelen,
 342                                 LDNS_RR_TYPE_A, qclass, 0, now, 0);
 343                         if(neg) {
 344                                 delegpt_add_neg_msg(dp, neg);
 345                                 lock_rw_unlock(&neg->entry.lock);
 346                         }
 347                 }
 348                 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 349                         ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 350                 if(akey) {
 351                         if(!delegpt_add_rrset_AAAA(dp, region, akey, ns->lame,
 352                                 NULL)) {
 353                                 lock_rw_unlock(&akey->entry.lock);
 354                                 return 0;
 355                         }
 356                         log_nametypeclass(VERB_ALGO, "found in cache",
 357                                 ns->name, LDNS_RR_TYPE_AAAA, qclass);
 358                         lock_rw_unlock(&akey->entry.lock);
 359                 } else {
 360                         /* BIT_CD on false because delegpt lookup does
 361                          * not use dns64 translation */
 362                         neg = msg_cache_lookup(env, ns->name, ns->namelen,
 363                                 LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 364                         if(neg) {
 365                                 delegpt_add_neg_msg(dp, neg);
 366                                 lock_rw_unlock(&neg->entry.lock);
 367                         }
 368                 }
 369         }
 370         return 1;
 371 }
 372
 373 /** find and add DS or NSEC to delegation msg */
 374 static void
 375 find_add_ds(struct module_env* env, struct regional* region,
 376         struct dns_msg* msg, struct delegpt* dp, time_t now)
 377 {
 378         /* Lookup the DS or NSEC at the delegation point. */
 379         struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
 380                 env->rrset_cache, dp->name, dp->namelen, LDNS_RR_TYPE_DS,
 381                 msg->qinfo.qclass, 0, now, 0);
 382         if(!rrset) {
 383                 /* NOTE: this won't work for alternate NSEC schemes
 384                  *      (opt-in, NSEC3) */
 385                 rrset = rrset_cache_lookup(env->rrset_cache, dp->name,
 386                         dp->namelen, LDNS_RR_TYPE_NSEC, msg->qinfo.qclass,
 387                         0, now, 0);
 388                 /* Note: the PACKED_RRSET_NSEC_AT_APEX flag is not used.
 389                  * since this is a referral, we need the NSEC at the parent
 390                  * side of the zone cut, not the NSEC at apex side. */
 391                 if(rrset && nsec_has_type(rrset, LDNS_RR_TYPE_DS)) {
 392                         lock_rw_unlock(&rrset->entry.lock);
 393                         rrset = NULL; /* discard wrong NSEC */
 394                 }
 395         }
 396         if(rrset) {
 397                 /* add it to auth section. This is the second rrset. */
 398                 if((msg->rep->rrsets[msg->rep->rrset_count] =
 399                         packed_rrset_copy_region(rrset, region, now))) {
 400                         msg->rep->ns_numrrsets++;
 401                         msg->rep->rrset_count++;
 402                 }
 403                 lock_rw_unlock(&rrset->entry.lock);
 404         }
 405 }
 406
 407 struct dns_msg*
 408 dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 409         uint16_t qclass, struct regional* region, size_t capacity)
 410 {
 411         struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
 412                 sizeof(struct dns_msg));
 413         if(!msg)
 414                 return NULL;
 415         msg->qinfo.qname = regional_alloc_init(region, qname, qnamelen);
 416         if(!msg->qinfo.qname)
 417                 return NULL;
 418         msg->qinfo.qname_len = qnamelen;
 419         msg->qinfo.qtype = qtype;
 420         msg->qinfo.qclass = qclass;
 421         msg->qinfo.local_alias = NULL;
 422         /* non-packed reply_info, because it needs to grow the array */
 423         msg->rep = (struct reply_info*)regional_alloc_zero(region,
 424                 sizeof(struct reply_info)-sizeof(struct rrset_ref));
 425         if(!msg->rep)
 426                 return NULL;
 427         if(capacity > RR_COUNT_MAX)
 428                 return NULL; /* integer overflow protection */
 429         msg->rep->flags = BIT_QR; /* with QR, no AA */
 430         msg->rep->qdcount = 1;
 431         msg->rep->rrsets = (struct ub_packed_rrset_key**)
 432                 regional_alloc(region,
 433                 capacity*sizeof(struct ub_packed_rrset_key*));
 434         if(!msg->rep->rrsets)
 435                 return NULL;
 436         return msg;
 437 }
 438
 439 int
 440 dns_msg_authadd(struct dns_msg* msg, struct regional* region,
 441         struct ub_packed_rrset_key* rrset, time_t now)
 442 {
 443         if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
 444                 packed_rrset_copy_region(rrset, region, now)))
 445                 return 0;
 446         msg->rep->ns_numrrsets++;
 447         return 1;
 448 }
 449
 450 int
 451 dns_msg_ansadd(struct dns_msg* msg, struct regional* region,
 452         struct ub_packed_rrset_key* rrset, time_t now)
 453 {
 454         if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
 455                 packed_rrset_copy_region(rrset, region, now)))
 456                 return 0;
 457         msg->rep->an_numrrsets++;
 458         return 1;
 459 }
 460
 461 struct delegpt*
 462 dns_cache_find_delegation(struct module_env* env, uint8_t* qname,
 463         size_t qnamelen, uint16_t qtype, uint16_t qclass,
 464         struct regional* region, struct dns_msg** msg, time_t now)
 465 {
 466         /* try to find closest NS rrset */
 467         struct ub_packed_rrset_key* nskey;
 468         struct packed_rrset_data* nsdata;
 469         struct delegpt* dp;
 470
 471         nskey = find_closest_of_type(env, qname, qnamelen, qclass, now,
 472                 LDNS_RR_TYPE_NS, 0);
 473         if(!nskey) /* hope the caller has hints to prime or something */
 474                 return NULL;
 475         nsdata = (struct packed_rrset_data*)nskey->entry.data;
 476         /* got the NS key, create delegation point */
 477         dp = delegpt_create(region);
 478         if(!dp || !delegpt_set_name(dp, region, nskey->rk.dname)) {
 479                 lock_rw_unlock(&nskey->entry.lock);
 480                 log_err("find_delegation: out of memory");
 481                 return NULL;
 482         }
 483         /* create referral message */
 484         if(msg) {
 485                 /* allocate the array to as much as we could need:
 486                  *      NS rrset + DS/NSEC rrset +
 487                  *      A rrset for every NS RR
 488                  *      AAAA rrset for every NS RR
 489                  */
 490                 *msg = dns_msg_create(qname, qnamelen, qtype, qclass, region,
 491                         2 + nsdata->count*2);
 492                 if(!*msg || !dns_msg_authadd(*msg, region, nskey, now)) {
 493                         lock_rw_unlock(&nskey->entry.lock);
 494                         log_err("find_delegation: out of memory");
 495                         return NULL;
 496                 }
 497         }
 498         if(!delegpt_rrset_add_ns(dp, region, nskey, 0))
 499                 log_err("find_delegation: addns out of memory");
 500         lock_rw_unlock(&nskey->entry.lock); /* first unlock before next lookup*/
 501         /* find and add DS/NSEC (if any) */
 502         if(msg)
 503                 find_add_ds(env, region, *msg, dp, now);
 504         /* find and add A entries */
 505         if(!find_add_addrs(env, qclass, region, dp, now, msg))
 506                 log_err("find_delegation: addrs out of memory");
 507         return dp;
 508 }
 509
 510 /** allocate dns_msg from query_info and reply_info */
 511 static struct dns_msg*
 512 gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
 513 {
 514         struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
 515                 sizeof(struct dns_msg));
 516         if(!msg)
 517                 return NULL;
 518         memcpy(&msg->qinfo, q, sizeof(struct query_info));
 519         msg->qinfo.qname = regional_alloc_init(region, q->qname, q->qname_len);
 520         if(!msg->qinfo.qname)
 521                 return NULL;
 522         /* allocate replyinfo struct and rrset key array separately */
 523         msg->rep = (struct reply_info*)regional_alloc(region,
 524                 sizeof(struct reply_info) - sizeof(struct rrset_ref));
 525         if(!msg->rep)
 526                 return NULL;
 527         if(num > RR_COUNT_MAX)
 528                 return NULL; /* integer overflow protection */
 529         msg->rep->rrsets = (struct ub_packed_rrset_key**)
 530                 regional_alloc(region,
 531                 num * sizeof(struct ub_packed_rrset_key*));
 532         if(!msg->rep->rrsets)
 533                 return NULL;
 534         return msg;
 535 }
 536
 537 struct dns_msg*
 538 tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 539         struct regional* region, time_t now, int allow_expired,
 540         struct regional* scratch)
 541 {
 542         struct dns_msg* msg;
 543         size_t i;
 544         int is_expired = 0;
 545         time_t now_control = now;
 546         if(now > r->ttl) {
 547                 /* Check if we are allowed to serve expired */
 548                 if(allow_expired) {
 549                         if(env->cfg->serve_expired_ttl &&
 550                                 r->serve_expired_ttl < now) {
 551                                 return NULL;
 552                         }
 553                 } else {
 554                         return NULL;
 555                 }
 556                 /* Change the current time so we can pass the below TTL checks when
 557                  * serving expired data. */
 558                 now_control = r->ttl - env->cfg->serve_expired_reply_ttl;
 559                 is_expired = 1;
 560         }
 561
 562         msg = gen_dns_msg(region, q, r->rrset_count);
 563         if(!msg) return NULL;
 564         msg->rep->flags = r->flags;
 565         msg->rep->qdcount = r->qdcount;
 566         msg->rep->ttl = is_expired
 567                 ?SERVE_EXPIRED_REPLY_TTL
 568                 :r->ttl - now;
 569         if(r->prefetch_ttl > now)
 570                 msg->rep->prefetch_ttl = r->prefetch_ttl - now;
 571         else
 572                 msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 573         msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
 574         msg->rep->security = r->security;
 575         msg->rep->an_numrrsets = r->an_numrrsets;
 576         msg->rep->ns_numrrsets = r->ns_numrrsets;
 577         msg->rep->ar_numrrsets = r->ar_numrrsets;
 578         msg->rep->rrset_count = r->rrset_count;
 579         msg->rep->authoritative = r->authoritative;
 580         if(!rrset_array_lock(r->ref, r->rrset_count, now_control)) {
 581                 return NULL;
 582         }
 583         if(r->an_numrrsets > 0 && (r->rrsets[0]->rk.type == htons(
 584                 LDNS_RR_TYPE_CNAME) || r->rrsets[0]->rk.type == htons(
 585                 LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(q, r)) {
 586                 /* cname chain is now invalid, reconstruct msg */
 587                 rrset_array_unlock(r->ref, r->rrset_count);
 588                 return NULL;
 589         }
 590         if(r->security == sec_status_secure && !reply_all_rrsets_secure(r)) {
 591                 /* message rrsets have changed status, revalidate */
 592                 rrset_array_unlock(r->ref, r->rrset_count);
 593                 return NULL;
 594         }
 595         for(i=0; i<msg->rep->rrset_count; i++) {
 596                 msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i],
 597                         region, now);
 598                 if(!msg->rep->rrsets[i]) {
 599                         rrset_array_unlock(r->ref, r->rrset_count);
 600                         return NULL;
 601                 }
 602         }
 603         if(env)
 604                 rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref,
 605                 r->rrset_count);
 606         else
 607                 rrset_array_unlock(r->ref, r->rrset_count);
 608         return msg;
 609 }
 610
 611 /** synthesize RRset-only response from cached RRset item */
 612 static struct dns_msg*
 613 rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 614         time_t now, struct query_info* q)
 615 {
 616         struct dns_msg* msg;
 617         struct packed_rrset_data* d = (struct packed_rrset_data*)
 618                 rrset->entry.data;
 619         if(now > d->ttl)
 620                 return NULL;
 621         msg = gen_dns_msg(region, q, 1); /* only the CNAME (or other) RRset */
 622         if(!msg)
 623                 return NULL;
 624         msg->rep->flags = BIT_QR; /* reply, no AA, no error */
 625         msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
 626         msg->rep->qdcount = 1;
 627         msg->rep->ttl = d->ttl - now;
 628         msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 629         msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
 630         msg->rep->security = sec_status_unchecked;
 631         msg->rep->an_numrrsets = 1;
 632         msg->rep->ns_numrrsets = 0;
 633         msg->rep->ar_numrrsets = 0;
 634         msg->rep->rrset_count = 1;
 635         msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
 636         if(!msg->rep->rrsets[0]) /* copy CNAME */
 637                 return NULL;
 638         return msg;
 639 }
 640
 641 /** synthesize DNAME+CNAME response from cached DNAME item */
 642 static struct dns_msg*
 643 synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 644         time_t now, struct query_info* q, enum sec_status* sec_status)
 645 {
 646         struct dns_msg* msg;
 647         struct ub_packed_rrset_key* ck;
 648         struct packed_rrset_data* newd, *d = (struct packed_rrset_data*)
 649                 rrset->entry.data;
 650         uint8_t* newname, *dtarg = NULL;
 651         size_t newlen, dtarglen;
 652         if(now > d->ttl)
 653                 return NULL;
 654         /* only allow validated (with DNSSEC) DNAMEs used from cache
 655          * for insecure DNAMEs, query again. */
 656         *sec_status = d->security;
 657         /* return sec status, so the status of the CNAME can be checked
 658          * by the calling routine. */
 659         msg = gen_dns_msg(region, q, 2); /* DNAME + CNAME RRset */
 660         if(!msg)
 661                 return NULL;
 662         msg->rep->flags = BIT_QR; /* reply, no AA, no error */
 663         msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
 664         msg->rep->qdcount = 1;
 665         msg->rep->ttl = d->ttl - now;
 666         msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 667         msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
 668         msg->rep->security = sec_status_unchecked;
 669         msg->rep->an_numrrsets = 1;
 670         msg->rep->ns_numrrsets = 0;
 671         msg->rep->ar_numrrsets = 0;
 672         msg->rep->rrset_count = 1;
 673         msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
 674         if(!msg->rep->rrsets[0]) /* copy DNAME */
 675                 return NULL;
 676         /* synth CNAME rrset */
 677         get_cname_target(rrset, &dtarg, &dtarglen);
 678         if(!dtarg)
 679                 return NULL;
 680         newlen = q->qname_len + dtarglen - rrset->rk.dname_len;
 681         if(newlen > LDNS_MAX_DOMAINLEN) {
 682                 msg->rep->flags |= LDNS_RCODE_YXDOMAIN;
 683                 return msg;
 684         }
 685         newname = (uint8_t*)regional_alloc(region, newlen);
 686         if(!newname)
 687                 return NULL;
 688         /* new name is concatenation of qname front (without DNAME owner)
 689          * and DNAME target name */
 690         memcpy(newname, q->qname, q->qname_len-rrset->rk.dname_len);
 691         memmove(newname+(q->qname_len-rrset->rk.dname_len), dtarg, dtarglen);
 692         /* create rest of CNAME rrset */
 693         ck = (struct ub_packed_rrset_key*)regional_alloc(region,
 694                 sizeof(struct ub_packed_rrset_key));
 695         if(!ck)
 696                 return NULL;
 697         memset(&ck->entry, 0, sizeof(ck->entry));
 698         msg->rep->rrsets[1] = ck;
 699         ck->entry.key = ck;
 700         ck->rk.type = htons(LDNS_RR_TYPE_CNAME);
 701         ck->rk.rrset_class = rrset->rk.rrset_class;
 702         ck->rk.flags = 0;
 703         ck->rk.dname = regional_alloc_init(region, q->qname, q->qname_len);
 704         if(!ck->rk.dname)
 705                 return NULL;
 706         ck->rk.dname_len = q->qname_len;
 707         ck->entry.hash = rrset_key_hash(&ck->rk);
 708         newd = (struct packed_rrset_data*)regional_alloc_zero(region,
 709                 sizeof(struct packed_rrset_data) + sizeof(size_t) +
 710                 sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t)
 711                 + newlen);
 712         if(!newd)
 713                 return NULL;
 714         ck->entry.data = newd;
 715         newd->ttl = 0; /* 0 for synthesized CNAME TTL */
 716         newd->count = 1;
 717         newd->rrsig_count = 0;
 718         newd->trust = rrset_trust_ans_noAA;
 719         newd->rr_len = (size_t*)((uint8_t*)newd +
 720                 sizeof(struct packed_rrset_data));
 721         newd->rr_len[0] = newlen + sizeof(uint16_t);
 722         packed_rrset_ptr_fixup(newd);
 723         newd->rr_ttl[0] = newd->ttl;
 724         msg->rep->ttl = newd->ttl;
 725         msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(newd->ttl);
 726         msg->rep->serve_expired_ttl = newd->ttl + SERVE_EXPIRED_TTL;
 727         sldns_write_uint16(newd->rr_data[0], newlen);
 728         memmove(newd->rr_data[0] + sizeof(uint16_t), newname, newlen);
 729         msg->rep->an_numrrsets ++;
 730         msg->rep->rrset_count ++;
 731         return msg;
 732 }
 733
 734 /** Fill TYPE_ANY response with some data from cache */
 735 static struct dns_msg*
 736 fill_any(struct module_env* env,
 737         uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
 738         struct regional* region)
 739 {
 740         time_t now = *env->now;
 741         struct dns_msg* msg = NULL;
 742         uint16_t lookup[] = {LDNS_RR_TYPE_A, LDNS_RR_TYPE_AAAA,
 743                 LDNS_RR_TYPE_MX, LDNS_RR_TYPE_SOA, LDNS_RR_TYPE_NS,
 744                 LDNS_RR_TYPE_DNAME, 0};
 745         int i, num=6; /* number of RR types to look up */
 746         log_assert(lookup[num] == 0);
 747
 748         if(env->cfg->deny_any) {
 749                 /* return empty message */
 750                 msg = dns_msg_create(qname, qnamelen, qtype, qclass,
 751                         region, 0);
 752                 if(!msg) {
 753                         return NULL;
 754                 }
 755                 /* set NOTIMPL for RFC 8482 */
 756                 msg->rep->flags |= LDNS_RCODE_NOTIMPL;
 757                 msg->rep->security = sec_status_indeterminate;
 758                 return msg;
 759         }
 760
 761         for(i=0; i<num; i++) {
 762                 /* look up this RR for inclusion in type ANY response */
 763                 struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
 764                         env->rrset_cache, qname, qnamelen, lookup[i],
 765                         qclass, 0, now, 0);
 766                 struct packed_rrset_data *d;
 767                 if(!rrset)
 768                         continue;
 769
 770                 /* only if rrset from answer section */
 771                 d = (struct packed_rrset_data*)rrset->entry.data;
 772                 if(d->trust == rrset_trust_add_noAA ||
 773                         d->trust == rrset_trust_auth_noAA ||
 774                         d->trust == rrset_trust_add_AA ||
 775                         d->trust == rrset_trust_auth_AA) {
 776                         lock_rw_unlock(&rrset->entry.lock);
 777                         continue;
 778                 }
 779
 780                 /* create msg if none */
 781                 if(!msg) {
 782                         msg = dns_msg_create(qname, qnamelen, qtype, qclass,
 783                                 region, (size_t)(num-i));
 784                         if(!msg) {
 785                                 lock_rw_unlock(&rrset->entry.lock);
 786                                 return NULL;
 787                         }
 788                 }
 789
 790                 /* add RRset to response */
 791                 if(!dns_msg_ansadd(msg, region, rrset, now)) {
 792                         lock_rw_unlock(&rrset->entry.lock);
 793                         return NULL;
 794                 }
 795                 lock_rw_unlock(&rrset->entry.lock);
 796         }
 797         return msg;
 798 }
 799
 800 struct dns_msg*
 801 dns_cache_lookup(struct module_env* env,
 802         uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
 803         uint16_t flags, struct regional* region, struct regional* scratch,
 804         int no_partial)
 805 {
 806         struct lruhash_entry* e;
 807         struct query_info k;
 808         hashvalue_type h;
 809         time_t now = *env->now;
 810         struct ub_packed_rrset_key* rrset;
 811
 812         /* lookup first, this has both NXdomains and ANSWER responses */
 813         k.qname = qname;
 814         k.qname_len = qnamelen;
 815         k.qtype = qtype;
 816         k.qclass = qclass;
 817         k.local_alias = NULL;
 818         h = query_info_hash(&k, flags);
 819         e = slabhash_lookup(env->msg_cache, h, &k, 0);
 820         if(e) {
 821                 struct msgreply_entry* key = (struct msgreply_entry*)e->key;
 822                 struct reply_info* data = (struct reply_info*)e->data;
 823                 struct dns_msg* msg = tomsg(env, &key->key, data, region, now, 0,
 824                         scratch);
 825                 if(msg) {
 826                         lock_rw_unlock(&e->lock);
 827                         return msg;
 828                 }
 829                 /* could be msg==NULL; due to TTL or not all rrsets available */
 830                 lock_rw_unlock(&e->lock);
 831         }
 832
 833         /* see if a DNAME exists. Checked for first, to enforce that DNAMEs
 834          * are more important, the CNAME is resynthesized and thus
 835          * consistent with the DNAME */
 836         if(!no_partial &&
 837                 (rrset=find_closest_of_type(env, qname, qnamelen, qclass, now,
 838                 LDNS_RR_TYPE_DNAME, 1))) {
 839                 /* synthesize a DNAME+CNAME message based on this */
 840                 enum sec_status sec_status = sec_status_unchecked;
 841                 struct dns_msg* msg = synth_dname_msg(rrset, region, now, &k,
 842                         &sec_status);
 843                 if(msg) {
 844                         struct ub_packed_rrset_key* cname_rrset;
 845                         lock_rw_unlock(&rrset->entry.lock);
 846                         /* now, after unlocking the DNAME rrset lock,
 847                          * check the sec_status, and see if we need to look
 848                          * up the CNAME record associated before it can
 849                          * be used */
 850                         /* normally, only secure DNAMEs allowed from cache*/
 851                         if(sec_status == sec_status_secure)
 852                                 return msg;
 853                         /* but if we have a CNAME cached with this name, then we
 854                          * have previously already allowed this name to pass.
 855                          * the next cache lookup is going to fetch that CNAME itself,
 856                          * but it is better to have the (unsigned)DNAME + CNAME in
 857                          * that case */
 858                         cname_rrset = rrset_cache_lookup(
 859                                 env->rrset_cache, qname, qnamelen,
 860                                 LDNS_RR_TYPE_CNAME, qclass, 0, now, 0);
 861                         if(cname_rrset) {
 862                                 /* CNAME already synthesized by
 863                                  * synth_dname_msg routine, so we can
 864                                  * straight up return the msg */
 865                                 lock_rw_unlock(&cname_rrset->entry.lock);
 866                                 return msg;
 867                         }
 868                 } else {
 869                         lock_rw_unlock(&rrset->entry.lock);
 870                 }
 871         }
 872
 873         /* see if we have CNAME for this domain,
 874          * but not for DS records (which are part of the parent) */
 875         if(!no_partial && qtype != LDNS_RR_TYPE_DS &&
 876            (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
 877                 LDNS_RR_TYPE_CNAME, qclass, 0, now, 0))) {
 878                 uint8_t* wc = NULL;
 879                 size_t wl;
 880                 /* if the rrset is not a wildcard expansion, with wcname */
 881                 /* because, if we return that CNAME rrset on its own, it is
 882                  * missing the NSEC or NSEC3 proof */
 883                 if(!(val_rrset_wildcard(rrset, &wc, &wl) && wc != NULL)) {
 884                         struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
 885                         if(msg) {
 886                                 lock_rw_unlock(&rrset->entry.lock);
 887                                 return msg;
 888                         }
 889                 }
 890                 lock_rw_unlock(&rrset->entry.lock);
 891         }
 892
 893         /* construct DS, DNSKEY, DLV messages from rrset cache. */
 894         if((qtype == LDNS_RR_TYPE_DS || qtype == LDNS_RR_TYPE_DNSKEY ||
 895                 qtype == LDNS_RR_TYPE_DLV) &&
 896                 (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
 897                 qtype, qclass, 0, now, 0))) {
 898                 /* if the rrset is from the additional section, and the
 899                  * signatures have fallen off, then do not synthesize a msg
 900                  * instead, allow a full query for signed results to happen.
 901                  * Forego all rrset data from additional section, because
 902                  * some signatures may not be present and cause validation
 903                  * failure.
 904                  */
 905                 struct packed_rrset_data *d = (struct packed_rrset_data*)
 906                         rrset->entry.data;
 907                 if(d->trust != rrset_trust_add_noAA &&
 908                         d->trust != rrset_trust_add_AA &&
 909                         (qtype == LDNS_RR_TYPE_DS ||
 910                                 (d->trust != rrset_trust_auth_noAA
 911                                 && d->trust != rrset_trust_auth_AA) )) {
 912                         struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
 913                         if(msg) {
 914                                 lock_rw_unlock(&rrset->entry.lock);
 915                                 return msg;
 916                         }
 917                 }
 918                 lock_rw_unlock(&rrset->entry.lock);
 919         }
 920
 921         /* stop downwards cache search on NXDOMAIN.
 922          * Empty nonterminals are NOERROR, so an NXDOMAIN for foo
 923          * means bla.foo also does not exist.  The DNSSEC proofs are
 924          * the same.  We search upwards for NXDOMAINs. */
 925         if(env->cfg->harden_below_nxdomain) {
 926                 while(!dname_is_root(k.qname)) {
 927                         dname_remove_label(&k.qname, &k.qname_len);
 928                         h = query_info_hash(&k, flags);
 929                         e = slabhash_lookup(env->msg_cache, h, &k, 0);
 930                         if(!e && k.qtype != LDNS_RR_TYPE_A &&
 931                                 env->cfg->qname_minimisation) {
 932                                 k.qtype = LDNS_RR_TYPE_A;
 933                                 h = query_info_hash(&k, flags);
 934                                 e = slabhash_lookup(env->msg_cache, h, &k, 0);
 935                         }
 936                         if(e) {
 937                                 struct reply_info* data = (struct reply_info*)e->data;
 938                                 struct dns_msg* msg;
 939                                 if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN
 940                                         && data->security == sec_status_secure
 941                                         && (data->an_numrrsets == 0 ||
 942                                                 ntohs(data->rrsets[0]->rk.type) != LDNS_RR_TYPE_CNAME)
 943                                         && (msg=tomsg(env, &k, data, region, now, 0, scratch))) {
 944                                         lock_rw_unlock(&e->lock);
 945                                         msg->qinfo.qname=qname;
 946                                         msg->qinfo.qname_len=qnamelen;
 947                                         /* check that DNSSEC really works out */
 948                                         msg->rep->security = sec_status_unchecked;
 949                                         iter_scrub_nxdomain(msg);
 950                                         return msg;
 951                                 }
 952                                 lock_rw_unlock(&e->lock);
 953                         }
 954                         k.qtype = qtype;
 955                 }
 956         }
 957
 958         /* fill common RR types for ANY response to avoid requery */
 959         if(qtype == LDNS_RR_TYPE_ANY) {
 960                 return fill_any(env, qname, qnamelen, qtype, qclass, region);
 961         }
 962
 963         return NULL;
 964 }
 965
 966 int
 967 dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 968         struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
 969         struct regional* region, uint32_t flags)
 970 {
 971         struct reply_info* rep = NULL;
 972         /* alloc, malloc properly (not in region, like msg is) */
 973         rep = reply_info_copy(msgrep, env->alloc, NULL);
 974         if(!rep)
 975                 return 0;
 976         /* ttl must be relative ;i.e. 0..86400 not  time(0)+86400.
 977          * the env->now is added to message and RRsets in this routine. */
 978         /* the leeway is used to invalidate other rrsets earlier */
 979
 980         if(is_referral) {
 981                 /* store rrsets */
 982                 struct rrset_ref ref;
 983                 size_t i;
 984                 for(i=0; i<rep->rrset_count; i++) {
 985                         packed_rrset_ttl_add((struct packed_rrset_data*)
 986                                 rep->rrsets[i]->entry.data, *env->now);
 987                         ref.key = rep->rrsets[i];
 988                         ref.id = rep->rrsets[i]->id;
 989                         /*ignore ret: it was in the cache, ref updated */
 990                         /* no leeway for typeNS */
 991                         (void)rrset_cache_update(env->rrset_cache, &ref,
 992                                 env->alloc, *env->now +
 993                                 ((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS
 994                                  && !pside) ? 0:leeway));
 995                 }
 996                 free(rep);
 997                 return 1;
 998         } else {
 999                 /* store msg, and rrsets */
1000                 struct query_info qinf;
1001                 hashvalue_type h;
1002
1003                 qinf = *msgqinf;
1004                 qinf.qname = memdup(msgqinf->qname, msgqinf->qname_len);
1005                 if(!qinf.qname) {
1006                         reply_info_parsedelete(rep, env->alloc);
1007                         return 0;
1008                 }
1009                 /* fixup flags to be sensible for a reply based on the cache */
1010                 /* this module means that RA is available. It is an answer QR.
1011                  * Not AA from cache. Not CD in cache (depends on client bit). */
1012                 rep->flags |= (BIT_RA | BIT_QR);
1013                 rep->flags &= ~(BIT_AA | BIT_CD);
1014                 h = query_info_hash(&qinf, (uint16_t)flags);
1015                 dns_cache_store_msg(env, &qinf, h, rep, leeway, pside, msgrep,
1016                         flags, region);
1017                 /* qname is used inside query_info_entrysetup, and set to
1018                  * NULL. If it has not been used, free it. free(0) is safe. */
1019                 free(qinf.qname);
1020         }
1021         return 1;
1022 }
1023
1024 int
1025 dns_cache_prefetch_adjust(struct module_env* env, struct query_info* qinfo,
1026         time_t adjust, uint16_t flags)
1027 {
1028         struct msgreply_entry* msg;
1029         msg = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len,
1030                 qinfo->qtype, qinfo->qclass, flags, *env->now, 1);
1031         if(msg) {
1032                 struct reply_info* rep = (struct reply_info*)msg->entry.data;
1033                 if(rep) {
1034                         rep->prefetch_ttl += adjust;
1035                         lock_rw_unlock(&msg->entry.lock);
1036                         return 1;
1037                 }
1038                 lock_rw_unlock(&msg->entry.lock);
1039         }
1040         return 0;
1041 }