contrib/unbound/services/cache/dns.c

   1 /*
   2  * services/cache/dns.c - Cache services for DNS using msg and rrset caches.
   3  *
   4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  25  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  26  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
  27  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  28  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  29  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  30  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  31  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  32  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  33  * POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * This file contains the DNS cache.
  40  */
  41 #include "config.h"
  42 #include "iterator/iter_delegpt.h"
  43 #include "validator/val_nsec.h"
  44 #include "services/cache/dns.h"
  45 #include "services/cache/rrset.h"
  46 #include "util/data/msgreply.h"
  47 #include "util/data/packed_rrset.h"
  48 #include "util/data/dname.h"
  49 #include "util/module.h"
  50 #include "util/net_help.h"
  51 #include "util/regional.h"
  52 #include "util/config_file.h"
  53
  54 /** store rrsets in the rrset cache.
  55  * @param env: module environment with caches.
  56  * @param rep: contains list of rrsets to store.
  57  * @param now: current time.
  58  * @param leeway: during prefetch how much leeway to update TTLs.
  59  *      This makes rrsets (other than type NS) timeout sooner so they get
  60  *      updated with a new full TTL.
  61  *      Type NS does not get this, because it must not be refreshed from the
  62  *      child domain, but keep counting down properly.
  63  * @param pside: if from parentside discovered NS, so that its NS is okay
  64  *      in a prefetch situation to be updated (without becoming sticky).
  65  * @param qrep: update rrsets here if cache is better
  66  * @param region: for qrep allocs.
  67  */
  68 static void
  69 store_rrsets(struct module_env* env, struct reply_info* rep, uint32_t now,
  70         uint32_t leeway, int pside, struct reply_info* qrep,
  71         struct regional* region)
  72 {
  73         size_t i;
  74         /* see if rrset already exists in cache, if not insert it. */
  75         for(i=0; i<rep->rrset_count; i++) {
  76                 rep->ref[i].key = rep->rrsets[i];
  77                 rep->ref[i].id = rep->rrsets[i]->id;
  78                 /* update ref if it was in the cache */
  79                 switch(rrset_cache_update(env->rrset_cache, &rep->ref[i],
  80                         env->alloc, now + ((ntohs(rep->ref[i].key->rk.type)==
  81                         LDNS_RR_TYPE_NS && !pside)?0:leeway))) {
  82                 case 0: /* ref unchanged, item inserted */
  83                         break;
  84                 case 2: /* ref updated, cache is superior */
  85                         if(region) {
  86                                 struct ub_packed_rrset_key* ck;
  87                                 lock_rw_rdlock(&rep->ref[i].key->entry.lock);
  88                                 /* if deleted rrset, do not copy it */
  89                                 if(rep->ref[i].key->id == 0)
  90                                         ck = NULL;
  91                                 else    ck = packed_rrset_copy_region(
  92                                         rep->ref[i].key, region, now);
  93                                 lock_rw_unlock(&rep->ref[i].key->entry.lock);
  94                                 if(ck) {
  95                                         /* use cached copy if memory allows */
  96                                         qrep->rrsets[i] = ck;
  97                                 }
  98                         }
  99                         /* no break: also copy key item */
 100                 case 1: /* ref updated, item inserted */
 101                         rep->rrsets[i] = rep->ref[i].key;
 102                 }
 103         }
 104 }
 105
 106 void
 107 dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 108         hashvalue_t hash, struct reply_info* rep, uint32_t leeway, int pside,
 109         struct reply_info* qrep, struct regional* region)
 110 {
 111         struct msgreply_entry* e;
 112         uint32_t ttl = rep->ttl;
 113         size_t i;
 114
 115         /* store RRsets */
 116         for(i=0; i<rep->rrset_count; i++) {
 117                 rep->ref[i].key = rep->rrsets[i];
 118                 rep->ref[i].id = rep->rrsets[i]->id;
 119         }
 120
 121         /* there was a reply_info_sortref(rep) here but it seems to be
 122          * unnecessary, because the cache gets locked per rrset. */
 123         reply_info_set_ttls(rep, *env->now);
 124         store_rrsets(env, rep, *env->now, leeway, pside, qrep, region);
 125         if(ttl == 0) {
 126                 /* we do not store the message, but we did store the RRs,
 127                  * which could be useful for delegation information */
 128                 verbose(VERB_ALGO, "TTL 0: dropped msg from cache");
 129                 free(rep);
 130                 return;
 131         }
 132
 133         /* store msg in the cache */
 134         reply_info_sortref(rep);
 135         if(!(e = query_info_entrysetup(qinfo, rep, hash))) {
 136                 log_err("store_msg: malloc failed");
 137                 return;
 138         }
 139         slabhash_insert(env->msg_cache, hash, &e->entry, rep, env->alloc);
 140 }
 141
 142 /** find closest NS or DNAME and returns the rrset (locked) */
 143 static struct ub_packed_rrset_key*
 144 find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen,
 145         uint16_t qclass, uint32_t now, uint16_t searchtype, int stripfront)
 146 {
 147         struct ub_packed_rrset_key *rrset;
 148         uint8_t lablen;
 149
 150         if(stripfront) {
 151                 /* strip off so that DNAMEs have strict subdomain match */
 152                 lablen = *qname;
 153                 qname += lablen + 1;
 154                 qnamelen -= lablen + 1;
 155         }
 156
 157         /* snip off front part of qname until the type is found */
 158         while(qnamelen > 0) {
 159                 if((rrset = rrset_cache_lookup(env->rrset_cache, qname,
 160                         qnamelen, searchtype, qclass, 0, now, 0)))
 161                         return rrset;
 162
 163                 /* snip off front label */
 164                 lablen = *qname;
 165                 qname += lablen + 1;
 166                 qnamelen -= lablen + 1;
 167         }
 168         return NULL;
 169 }
 170
 171 /** add addr to additional section */
 172 static void
 173 addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region,
 174         struct dns_msg* msg, uint32_t now)
 175 {
 176         if((msg->rep->rrsets[msg->rep->rrset_count] =
 177                 packed_rrset_copy_region(rrset, region, now))) {
 178                 msg->rep->ar_numrrsets++;
 179                 msg->rep->rrset_count++;
 180         }
 181 }
 182
 183 /** lookup message in message cache */
 184 static struct msgreply_entry*
 185 msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen,
 186         uint16_t qtype, uint16_t qclass, uint32_t now, int wr)
 187 {
 188         struct lruhash_entry* e;
 189         struct query_info k;
 190         hashvalue_t h;
 191
 192         k.qname = qname;
 193         k.qname_len = qnamelen;
 194         k.qtype = qtype;
 195         k.qclass = qclass;
 196         h = query_info_hash(&k);
 197         e = slabhash_lookup(env->msg_cache, h, &k, wr);
 198
 199         if(!e) return NULL;
 200         if( now > ((struct reply_info*)e->data)->ttl ) {
 201                 lock_rw_unlock(&e->lock);
 202                 return NULL;
 203         }
 204         return (struct msgreply_entry*)e->key;
 205 }
 206
 207 /** find and add A and AAAA records for nameservers in delegpt */
 208 static int
 209 find_add_addrs(struct module_env* env, uint16_t qclass,
 210         struct regional* region, struct delegpt* dp, uint32_t now,
 211         struct dns_msg** msg)
 212 {
 213         struct delegpt_ns* ns;
 214         struct msgreply_entry* neg;
 215         struct ub_packed_rrset_key* akey;
 216         for(ns = dp->nslist; ns; ns = ns->next) {
 217                 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 218                         ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 219                 if(akey) {
 220                         if(!delegpt_add_rrset_A(dp, region, akey, 0)) {
 221                                 lock_rw_unlock(&akey->entry.lock);
 222                                 return 0;
 223                         }
 224                         if(msg)
 225                                 addr_to_additional(akey, region, *msg, now);
 226                         lock_rw_unlock(&akey->entry.lock);
 227                 } else {
 228                         neg = msg_cache_lookup(env, ns->name, ns->namelen,
 229                                 LDNS_RR_TYPE_A, qclass, now, 0);
 230                         if(neg) {
 231                                 delegpt_add_neg_msg(dp, neg);
 232                                 lock_rw_unlock(&neg->entry.lock);
 233                         }
 234                 }
 235                 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 236                         ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 237                 if(akey) {
 238                         if(!delegpt_add_rrset_AAAA(dp, region, akey, 0)) {
 239                                 lock_rw_unlock(&akey->entry.lock);
 240                                 return 0;
 241                         }
 242                         if(msg)
 243                                 addr_to_additional(akey, region, *msg, now);
 244                         lock_rw_unlock(&akey->entry.lock);
 245                 } else {
 246                         neg = msg_cache_lookup(env, ns->name, ns->namelen,
 247                                 LDNS_RR_TYPE_AAAA, qclass, now, 0);
 248                         if(neg) {
 249                                 delegpt_add_neg_msg(dp, neg);
 250                                 lock_rw_unlock(&neg->entry.lock);
 251                         }
 252                 }
 253         }
 254         return 1;
 255 }
 256
 257 /** find and add A and AAAA records for missing nameservers in delegpt */
 258 int
 259 cache_fill_missing(struct module_env* env, uint16_t qclass,
 260         struct regional* region, struct delegpt* dp)
 261 {
 262         struct delegpt_ns* ns;
 263         struct msgreply_entry* neg;
 264         struct ub_packed_rrset_key* akey;
 265         uint32_t now = *env->now;
 266         for(ns = dp->nslist; ns; ns = ns->next) {
 267                 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 268                         ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 269                 if(akey) {
 270                         if(!delegpt_add_rrset_A(dp, region, akey, (int)ns->lame)) {
 271                                 lock_rw_unlock(&akey->entry.lock);
 272                                 return 0;
 273                         }
 274                         log_nametypeclass(VERB_ALGO, "found in cache",
 275                                 ns->name, LDNS_RR_TYPE_A, qclass);
 276                         lock_rw_unlock(&akey->entry.lock);
 277                 } else {
 278                         neg = msg_cache_lookup(env, ns->name, ns->namelen,
 279                                 LDNS_RR_TYPE_A, qclass, now, 0);
 280                         if(neg) {
 281                                 delegpt_add_neg_msg(dp, neg);
 282                                 lock_rw_unlock(&neg->entry.lock);
 283                         }
 284                 }
 285                 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 286                         ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 287                 if(akey) {
 288                         if(!delegpt_add_rrset_AAAA(dp, region, akey, (int)ns->lame)) {
 289                                 lock_rw_unlock(&akey->entry.lock);
 290                                 return 0;
 291                         }
 292                         log_nametypeclass(VERB_ALGO, "found in cache",
 293                                 ns->name, LDNS_RR_TYPE_AAAA, qclass);
 294                         lock_rw_unlock(&akey->entry.lock);
 295                 } else {
 296                         neg = msg_cache_lookup(env, ns->name, ns->namelen,
 297                                 LDNS_RR_TYPE_AAAA, qclass, now, 0);
 298                         if(neg) {
 299                                 delegpt_add_neg_msg(dp, neg);
 300                                 lock_rw_unlock(&neg->entry.lock);
 301                         }
 302                 }
 303         }
 304         return 1;
 305 }
 306
 307 /** find and add DS or NSEC to delegation msg */
 308 static void
 309 find_add_ds(struct module_env* env, struct regional* region,
 310         struct dns_msg* msg, struct delegpt* dp, uint32_t now)
 311 {
 312         /* Lookup the DS or NSEC at the delegation point. */
 313         struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
 314                 env->rrset_cache, dp->name, dp->namelen, LDNS_RR_TYPE_DS,
 315                 msg->qinfo.qclass, 0, now, 0);
 316         if(!rrset) {
 317                 /* NOTE: this won't work for alternate NSEC schemes
 318                  *      (opt-in, NSEC3) */
 319                 rrset = rrset_cache_lookup(env->rrset_cache, dp->name,
 320                         dp->namelen, LDNS_RR_TYPE_NSEC, msg->qinfo.qclass,
 321                         0, now, 0);
 322                 /* Note: the PACKED_RRSET_NSEC_AT_APEX flag is not used.
 323                  * since this is a referral, we need the NSEC at the parent
 324                  * side of the zone cut, not the NSEC at apex side. */
 325                 if(rrset && nsec_has_type(rrset, LDNS_RR_TYPE_DS)) {
 326                         lock_rw_unlock(&rrset->entry.lock);
 327                         rrset = NULL; /* discard wrong NSEC */
 328                 }
 329         }
 330         if(rrset) {
 331                 /* add it to auth section. This is the second rrset. */
 332                 if((msg->rep->rrsets[msg->rep->rrset_count] =
 333                         packed_rrset_copy_region(rrset, region, now))) {
 334                         msg->rep->ns_numrrsets++;
 335                         msg->rep->rrset_count++;
 336                 }
 337                 lock_rw_unlock(&rrset->entry.lock);
 338         }
 339 }
 340
 341 struct dns_msg*
 342 dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 343         uint16_t qclass, struct regional* region, size_t capacity)
 344 {
 345         struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
 346                 sizeof(struct dns_msg));
 347         if(!msg)
 348                 return NULL;
 349         msg->qinfo.qname = regional_alloc_init(region, qname, qnamelen);
 350         if(!msg->qinfo.qname)
 351                 return NULL;
 352         msg->qinfo.qname_len = qnamelen;
 353         msg->qinfo.qtype = qtype;
 354         msg->qinfo.qclass = qclass;
 355         /* non-packed reply_info, because it needs to grow the array */
 356         msg->rep = (struct reply_info*)regional_alloc_zero(region,
 357                 sizeof(struct reply_info)-sizeof(struct rrset_ref));
 358         if(!msg->rep)
 359                 return NULL;
 360         msg->rep->flags = BIT_QR; /* with QR, no AA */
 361         msg->rep->qdcount = 1;
 362         msg->rep->rrsets = (struct ub_packed_rrset_key**)
 363                 regional_alloc(region,
 364                 capacity*sizeof(struct ub_packed_rrset_key*));
 365         if(!msg->rep->rrsets)
 366                 return NULL;
 367         return msg;
 368 }
 369
 370 int
 371 dns_msg_authadd(struct dns_msg* msg, struct regional* region,
 372         struct ub_packed_rrset_key* rrset, uint32_t now)
 373 {
 374         if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
 375                 packed_rrset_copy_region(rrset, region, now)))
 376                 return 0;
 377         msg->rep->ns_numrrsets++;
 378         return 1;
 379 }
 380
 381 struct delegpt*
 382 dns_cache_find_delegation(struct module_env* env, uint8_t* qname,
 383         size_t qnamelen, uint16_t qtype, uint16_t qclass,
 384         struct regional* region, struct dns_msg** msg, uint32_t now)
 385 {
 386         /* try to find closest NS rrset */
 387         struct ub_packed_rrset_key* nskey;
 388         struct packed_rrset_data* nsdata;
 389         struct delegpt* dp;
 390
 391         nskey = find_closest_of_type(env, qname, qnamelen, qclass, now,
 392                 LDNS_RR_TYPE_NS, 0);
 393         if(!nskey) /* hope the caller has hints to prime or something */
 394                 return NULL;
 395         nsdata = (struct packed_rrset_data*)nskey->entry.data;
 396         /* got the NS key, create delegation point */
 397         dp = delegpt_create(region);
 398         if(!dp || !delegpt_set_name(dp, region, nskey->rk.dname)) {
 399                 lock_rw_unlock(&nskey->entry.lock);
 400                 log_err("find_delegation: out of memory");
 401                 return NULL;
 402         }
 403         /* create referral message */
 404         if(msg) {
 405                 /* allocate the array to as much as we could need:
 406                  *      NS rrset + DS/NSEC rrset +
 407                  *      A rrset for every NS RR
 408                  *      AAAA rrset for every NS RR
 409                  */
 410                 *msg = dns_msg_create(qname, qnamelen, qtype, qclass, region,
 411                         2 + nsdata->count*2);
 412                 if(!*msg || !dns_msg_authadd(*msg, region, nskey, now)) {
 413                         lock_rw_unlock(&nskey->entry.lock);
 414                         log_err("find_delegation: out of memory");
 415                         return NULL;
 416                 }
 417         }
 418         if(!delegpt_rrset_add_ns(dp, region, nskey, 0))
 419                 log_err("find_delegation: addns out of memory");
 420         lock_rw_unlock(&nskey->entry.lock); /* first unlock before next lookup*/
 421         /* find and add DS/NSEC (if any) */
 422         if(msg)
 423                 find_add_ds(env, region, *msg, dp, now);
 424         /* find and add A entries */
 425         if(!find_add_addrs(env, qclass, region, dp, now, msg))
 426                 log_err("find_delegation: addrs out of memory");
 427         return dp;
 428 }
 429
 430 /** allocate dns_msg from query_info and reply_info */
 431 static struct dns_msg*
 432 gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
 433 {
 434         struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
 435                 sizeof(struct dns_msg));
 436         if(!msg)
 437                 return NULL;
 438         memcpy(&msg->qinfo, q, sizeof(struct query_info));
 439         msg->qinfo.qname = regional_alloc_init(region, q->qname, q->qname_len);
 440         if(!msg->qinfo.qname)
 441                 return NULL;
 442         /* allocate replyinfo struct and rrset key array separately */
 443         msg->rep = (struct reply_info*)regional_alloc(region,
 444                 sizeof(struct reply_info) - sizeof(struct rrset_ref));
 445         if(!msg->rep)
 446                 return NULL;
 447         msg->rep->rrsets = (struct ub_packed_rrset_key**)
 448                 regional_alloc(region,
 449                 num * sizeof(struct ub_packed_rrset_key*));
 450         if(!msg->rep->rrsets)
 451                 return NULL;
 452         return msg;
 453 }
 454
 455 /** generate dns_msg from cached message */
 456 static struct dns_msg*
 457 tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 458         struct regional* region, uint32_t now, struct regional* scratch)
 459 {
 460         struct dns_msg* msg;
 461         size_t i;
 462         if(now > r->ttl)
 463                 return NULL;
 464         msg = gen_dns_msg(region, q, r->rrset_count);
 465         if(!msg)
 466                 return NULL;
 467         msg->rep->flags = r->flags;
 468         msg->rep->qdcount = r->qdcount;
 469         msg->rep->ttl = r->ttl - now;
 470         if(r->prefetch_ttl > now)
 471                 msg->rep->prefetch_ttl = r->prefetch_ttl - now;
 472         else    msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 473         msg->rep->security = r->security;
 474         msg->rep->an_numrrsets = r->an_numrrsets;
 475         msg->rep->ns_numrrsets = r->ns_numrrsets;
 476         msg->rep->ar_numrrsets = r->ar_numrrsets;
 477         msg->rep->rrset_count = r->rrset_count;
 478         msg->rep->authoritative = r->authoritative;
 479         if(!rrset_array_lock(r->ref, r->rrset_count, now))
 480                 return NULL;
 481         if(r->an_numrrsets > 0 && (r->rrsets[0]->rk.type == htons(
 482                 LDNS_RR_TYPE_CNAME) || r->rrsets[0]->rk.type == htons(
 483                 LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(r)) {
 484                 /* cname chain is now invalid, reconstruct msg */
 485                 rrset_array_unlock(r->ref, r->rrset_count);
 486                 return NULL;
 487         }
 488         if(r->security == sec_status_secure && !reply_all_rrsets_secure(r)) {
 489                 /* message rrsets have changed status, revalidate */
 490                 rrset_array_unlock(r->ref, r->rrset_count);
 491                 return NULL;
 492         }
 493         for(i=0; i<msg->rep->rrset_count; i++) {
 494                 msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i],
 495                         region, now);
 496                 if(!msg->rep->rrsets[i]) {
 497                         rrset_array_unlock(r->ref, r->rrset_count);
 498                         return NULL;
 499                 }
 500         }
 501         rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref,
 502                 r->rrset_count);
 503         return msg;
 504 }
 505
 506 /** synthesize RRset-only response from cached RRset item */
 507 static struct dns_msg*
 508 rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 509         uint32_t now, struct query_info* q)
 510 {
 511         struct dns_msg* msg;
 512         struct packed_rrset_data* d = (struct packed_rrset_data*)
 513                 rrset->entry.data;
 514         if(now > d->ttl)
 515                 return NULL;
 516         msg = gen_dns_msg(region, q, 1); /* only the CNAME (or other) RRset */
 517         if(!msg)
 518                 return NULL;
 519         msg->rep->flags = BIT_QR; /* reply, no AA, no error */
 520         msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
 521         msg->rep->qdcount = 1;
 522         msg->rep->ttl = d->ttl - now;
 523         msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 524         msg->rep->security = sec_status_unchecked;
 525         msg->rep->an_numrrsets = 1;
 526         msg->rep->ns_numrrsets = 0;
 527         msg->rep->ar_numrrsets = 0;
 528         msg->rep->rrset_count = 1;
 529         msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
 530         if(!msg->rep->rrsets[0]) /* copy CNAME */
 531                 return NULL;
 532         return msg;
 533 }
 534
 535 /** synthesize DNAME+CNAME response from cached DNAME item */
 536 static struct dns_msg*
 537 synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 538         uint32_t now, struct query_info* q)
 539 {
 540         struct dns_msg* msg;
 541         struct ub_packed_rrset_key* ck;
 542         struct packed_rrset_data* newd, *d = (struct packed_rrset_data*)
 543                 rrset->entry.data;
 544         uint8_t* newname, *dtarg = NULL;
 545         size_t newlen, dtarglen;
 546         if(now > d->ttl)
 547                 return NULL;
 548         /* only allow validated (with DNSSEC) DNAMEs used from cache
 549          * for insecure DNAMEs, query again. */
 550         if(d->security != sec_status_secure)
 551                 return NULL;
 552         msg = gen_dns_msg(region, q, 2); /* DNAME + CNAME RRset */
 553         if(!msg)
 554                 return NULL;
 555         msg->rep->flags = BIT_QR; /* reply, no AA, no error */
 556         msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
 557         msg->rep->qdcount = 1;
 558         msg->rep->ttl = d->ttl - now;
 559         msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 560         msg->rep->security = sec_status_unchecked;
 561         msg->rep->an_numrrsets = 1;
 562         msg->rep->ns_numrrsets = 0;
 563         msg->rep->ar_numrrsets = 0;
 564         msg->rep->rrset_count = 1;
 565         msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
 566         if(!msg->rep->rrsets[0]) /* copy DNAME */
 567                 return NULL;
 568         /* synth CNAME rrset */
 569         get_cname_target(rrset, &dtarg, &dtarglen);
 570         if(!dtarg)
 571                 return NULL;
 572         newlen = q->qname_len + dtarglen - rrset->rk.dname_len;
 573         if(newlen > LDNS_MAX_DOMAINLEN) {
 574                 msg->rep->flags |= LDNS_RCODE_YXDOMAIN;
 575                 return msg;
 576         }
 577         newname = (uint8_t*)regional_alloc(region, newlen);
 578         if(!newname)
 579                 return NULL;
 580         /* new name is concatenation of qname front (without DNAME owner)
 581          * and DNAME target name */
 582         memcpy(newname, q->qname, q->qname_len-rrset->rk.dname_len);
 583         memmove(newname+(q->qname_len-rrset->rk.dname_len), dtarg, dtarglen);
 584         /* create rest of CNAME rrset */
 585         ck = (struct ub_packed_rrset_key*)regional_alloc(region,
 586                 sizeof(struct ub_packed_rrset_key));
 587         if(!ck)
 588                 return NULL;
 589         memset(&ck->entry, 0, sizeof(ck->entry));
 590         msg->rep->rrsets[1] = ck;
 591         ck->entry.key = ck;
 592         ck->rk.type = htons(LDNS_RR_TYPE_CNAME);
 593         ck->rk.rrset_class = rrset->rk.rrset_class;
 594         ck->rk.flags = 0;
 595         ck->rk.dname = regional_alloc_init(region, q->qname, q->qname_len);
 596         if(!ck->rk.dname)
 597                 return NULL;
 598         ck->rk.dname_len = q->qname_len;
 599         ck->entry.hash = rrset_key_hash(&ck->rk);
 600         newd = (struct packed_rrset_data*)regional_alloc_zero(region,
 601                 sizeof(struct packed_rrset_data) + sizeof(size_t) +
 602                 sizeof(uint8_t*) + sizeof(uint32_t) + sizeof(uint16_t)
 603                 + newlen);
 604         if(!newd)
 605                 return NULL;
 606         ck->entry.data = newd;
 607         newd->ttl = 0; /* 0 for synthesized CNAME TTL */
 608         newd->count = 1;
 609         newd->rrsig_count = 0;
 610         newd->trust = rrset_trust_ans_noAA;
 611         newd->rr_len = (size_t*)((uint8_t*)newd +
 612                 sizeof(struct packed_rrset_data));
 613         newd->rr_len[0] = newlen + sizeof(uint16_t);
 614         packed_rrset_ptr_fixup(newd);
 615         newd->rr_ttl[0] = newd->ttl;
 616         msg->rep->ttl = newd->ttl;
 617         msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(newd->ttl);
 618         ldns_write_uint16(newd->rr_data[0], newlen);
 619         memmove(newd->rr_data[0] + sizeof(uint16_t), newname, newlen);
 620         msg->rep->an_numrrsets ++;
 621         msg->rep->rrset_count ++;
 622         return msg;
 623 }
 624
 625 struct dns_msg*
 626 dns_cache_lookup(struct module_env* env,
 627         uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
 628         struct regional* region, struct regional* scratch)
 629 {
 630         struct lruhash_entry* e;
 631         struct query_info k;
 632         hashvalue_t h;
 633         uint32_t now = *env->now;
 634         struct ub_packed_rrset_key* rrset;
 635
 636         /* lookup first, this has both NXdomains and ANSWER responses */
 637         k.qname = qname;
 638         k.qname_len = qnamelen;
 639         k.qtype = qtype;
 640         k.qclass = qclass;
 641         h = query_info_hash(&k);
 642         e = slabhash_lookup(env->msg_cache, h, &k, 0);
 643         if(e) {
 644                 struct msgreply_entry* key = (struct msgreply_entry*)e->key;
 645                 struct reply_info* data = (struct reply_info*)e->data;
 646                 struct dns_msg* msg = tomsg(env, &key->key, data, region, now,
 647                         scratch);
 648                 if(msg) {
 649                         lock_rw_unlock(&e->lock);
 650                         return msg;
 651                 }
 652                 /* could be msg==NULL; due to TTL or not all rrsets available */
 653                 lock_rw_unlock(&e->lock);
 654         }
 655
 656         /* see if a DNAME exists. Checked for first, to enforce that DNAMEs
 657          * are more important, the CNAME is resynthesized and thus
 658          * consistent with the DNAME */
 659         if( (rrset=find_closest_of_type(env, qname, qnamelen, qclass, now,
 660                 LDNS_RR_TYPE_DNAME, 1))) {
 661                 /* synthesize a DNAME+CNAME message based on this */
 662                 struct dns_msg* msg = synth_dname_msg(rrset, region, now, &k);
 663                 if(msg) {
 664                         lock_rw_unlock(&rrset->entry.lock);
 665                         return msg;
 666                 }
 667                 lock_rw_unlock(&rrset->entry.lock);
 668         }
 669
 670         /* see if we have CNAME for this domain,
 671          * but not for DS records (which are part of the parent) */
 672         if( qtype != LDNS_RR_TYPE_DS &&
 673            (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
 674                 LDNS_RR_TYPE_CNAME, qclass, 0, now, 0))) {
 675                 struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
 676                 if(msg) {
 677                         lock_rw_unlock(&rrset->entry.lock);
 678                         return msg;
 679                 }
 680                 lock_rw_unlock(&rrset->entry.lock);
 681         }
 682
 683         /* construct DS, DNSKEY, DLV messages from rrset cache. */
 684         if((qtype == LDNS_RR_TYPE_DS || qtype == LDNS_RR_TYPE_DNSKEY ||
 685                 qtype == LDNS_RR_TYPE_DLV) &&
 686                 (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
 687                 qtype, qclass, 0, now, 0))) {
 688                 /* if the rrset is from the additional section, and the
 689                  * signatures have fallen off, then do not synthesize a msg
 690                  * instead, allow a full query for signed results to happen.
 691                  * Forego all rrset data from additional section, because
 692                  * some signatures may not be present and cause validation
 693                  * failure.
 694                  */
 695                 struct packed_rrset_data *d = (struct packed_rrset_data*)
 696                         rrset->entry.data;
 697                 if(d->trust != rrset_trust_add_noAA &&
 698                         d->trust != rrset_trust_add_AA &&
 699                         (qtype == LDNS_RR_TYPE_DS ||
 700                                 (d->trust != rrset_trust_auth_noAA
 701                                 && d->trust != rrset_trust_auth_AA) )) {
 702                         struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
 703                         if(msg) {
 704                                 lock_rw_unlock(&rrset->entry.lock);
 705                                 return msg;
 706                         }
 707                 }
 708                 lock_rw_unlock(&rrset->entry.lock);
 709         }
 710
 711         /* stop downwards cache search on NXDOMAIN.
 712          * Empty nonterminals are NOERROR, so an NXDOMAIN for foo
 713          * means bla.foo also does not exist.  The DNSSEC proofs are
 714          * the same.  We search upwards for NXDOMAINs. */
 715         if(env->cfg->harden_below_nxdomain)
 716             while(!dname_is_root(k.qname)) {
 717                 dname_remove_label(&k.qname, &k.qname_len);
 718                 h = query_info_hash(&k);
 719                 e = slabhash_lookup(env->msg_cache, h, &k, 0);
 720                 if(e) {
 721                         struct reply_info* data = (struct reply_info*)e->data;
 722                         struct dns_msg* msg;
 723                         if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN
 724                           && data->security == sec_status_secure
 725                           && (msg=tomsg(env, &k, data, region, now, scratch))){
 726                                 lock_rw_unlock(&e->lock);
 727                                 msg->qinfo.qname=qname;
 728                                 msg->qinfo.qname_len=qnamelen;
 729                                 /* check that DNSSEC really works out */
 730                                 msg->rep->security = sec_status_unchecked;
 731                                 return msg;
 732                         }
 733                         lock_rw_unlock(&e->lock);
 734                 }
 735         }
 736
 737         return NULL;
 738 }
 739
 740 int
 741 dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 742         struct reply_info* msgrep, int is_referral, uint32_t leeway, int pside,
 743         struct regional* region)
 744 {
 745         struct reply_info* rep = NULL;
 746         /* alloc, malloc properly (not in region, like msg is) */
 747         rep = reply_info_copy(msgrep, env->alloc, NULL);
 748         if(!rep)
 749                 return 0;
 750         /* ttl must be relative ;i.e. 0..86400 not  time(0)+86400.
 751          * the env->now is added to message and RRsets in this routine. */
 752         /* the leeway is used to invalidate other rrsets earlier */
 753
 754         if(is_referral) {
 755                 /* store rrsets */
 756                 struct rrset_ref ref;
 757                 size_t i;
 758                 for(i=0; i<rep->rrset_count; i++) {
 759                         packed_rrset_ttl_add((struct packed_rrset_data*)
 760                                 rep->rrsets[i]->entry.data, *env->now);
 761                         ref.key = rep->rrsets[i];
 762                         ref.id = rep->rrsets[i]->id;
 763                         /*ignore ret: it was in the cache, ref updated */
 764                         /* no leeway for typeNS */
 765                         (void)rrset_cache_update(env->rrset_cache, &ref,
 766                                 env->alloc, *env->now +
 767                                 ((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS
 768                                  && !pside) ? 0:leeway));
 769                 }
 770                 free(rep);
 771                 return 1;
 772         } else {
 773                 /* store msg, and rrsets */
 774                 struct query_info qinf;
 775                 hashvalue_t h;
 776
 777                 qinf = *msgqinf;
 778                 qinf.qname = memdup(msgqinf->qname, msgqinf->qname_len);
 779                 if(!qinf.qname) {
 780                         reply_info_parsedelete(rep, env->alloc);
 781                         return 0;
 782                 }
 783                 /* fixup flags to be sensible for a reply based on the cache */
 784                 /* this module means that RA is available. It is an answer QR.
 785                  * Not AA from cache. Not CD in cache (depends on client bit). */
 786                 rep->flags |= (BIT_RA | BIT_QR);
 787                 rep->flags &= ~(BIT_AA | BIT_CD);
 788                 h = query_info_hash(&qinf);
 789                 dns_cache_store_msg(env, &qinf, h, rep, leeway, pside, msgrep,
 790                         region);
 791                 /* qname is used inside query_info_entrysetup, and set to
 792                  * NULL. If it has not been used, free it. free(0) is safe. */
 793                 free(qinf.qname);
 794         }
 795         return 1;
 796 }