contrib/unbound/services/cache/dns.c

   1 /*
   2  * services/cache/dns.c - Cache services for DNS using msg and rrset caches.
   3  *
   4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * This file contains the DNS cache.
  40  */
  41 #include "config.h"
  42 #include "iterator/iter_delegpt.h"
  43 #include "validator/val_nsec.h"
  44 #include "services/cache/dns.h"
  45 #include "services/cache/rrset.h"
  46 #include "util/data/msgreply.h"
  47 #include "util/data/packed_rrset.h"
  48 #include "util/data/dname.h"
  49 #include "util/module.h"
  50 #include "util/net_help.h"
  51 #include "util/regional.h"
  52 #include "util/config_file.h"
  53 #include "sldns/sbuffer.h"
  54
  55 /** store rrsets in the rrset cache.
  56  * @param env: module environment with caches.
  57  * @param rep: contains list of rrsets to store.
  58  * @param now: current time.
  59  * @param leeway: during prefetch how much leeway to update TTLs.
  60  *      This makes rrsets (other than type NS) timeout sooner so they get
  61  *      updated with a new full TTL.
  62  *      Type NS does not get this, because it must not be refreshed from the
  63  *      child domain, but keep counting down properly.
  64  * @param pside: if from parentside discovered NS, so that its NS is okay
  65  *      in a prefetch situation to be updated (without becoming sticky).
  66  * @param qrep: update rrsets here if cache is better
  67  * @param region: for qrep allocs.
  68  */
  69 static void
  70 store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
  71         time_t leeway, int pside, struct reply_info* qrep,
  72         struct regional* region)
  73 {
  74         size_t i;
  75         /* see if rrset already exists in cache, if not insert it. */
  76         for(i=0; i<rep->rrset_count; i++) {
  77                 rep->ref[i].key = rep->rrsets[i];
  78                 rep->ref[i].id = rep->rrsets[i]->id;
  79                 /* update ref if it was in the cache */
  80                 switch(rrset_cache_update(env->rrset_cache, &rep->ref[i],
  81                         env->alloc, now + ((ntohs(rep->ref[i].key->rk.type)==
  82                         LDNS_RR_TYPE_NS && !pside)?0:leeway))) {
  83                 case 0: /* ref unchanged, item inserted */
  84                         break;
  85                 case 2: /* ref updated, cache is superior */
  86                         if(region) {
  87                                 struct ub_packed_rrset_key* ck;
  88                                 lock_rw_rdlock(&rep->ref[i].key->entry.lock);
  89                                 /* if deleted rrset, do not copy it */
  90                                 if(rep->ref[i].key->id == 0)
  91                                         ck = NULL;
  92                                 else    ck = packed_rrset_copy_region(
  93                                         rep->ref[i].key, region, now);
  94                                 lock_rw_unlock(&rep->ref[i].key->entry.lock);
  95                                 if(ck) {
  96                                         /* use cached copy if memory allows */
  97                                         qrep->rrsets[i] = ck;
  98                                 }
  99                         }
 100                         /* no break: also copy key item */
 101                 case 1: /* ref updated, item inserted */
 102                         rep->rrsets[i] = rep->ref[i].key;
 103                 }
 104         }
 105 }
 106
 107 void
 108 dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 109         hashvalue_t hash, struct reply_info* rep, time_t leeway, int pside,
 110         struct reply_info* qrep, struct regional* region)
 111 {
 112         struct msgreply_entry* e;
 113         time_t ttl = rep->ttl;
 114         size_t i;
 115
 116         /* store RRsets */
 117         for(i=0; i<rep->rrset_count; i++) {
 118                 rep->ref[i].key = rep->rrsets[i];
 119                 rep->ref[i].id = rep->rrsets[i]->id;
 120         }
 121
 122         /* there was a reply_info_sortref(rep) here but it seems to be
 123          * unnecessary, because the cache gets locked per rrset. */
 124         reply_info_set_ttls(rep, *env->now);
 125         store_rrsets(env, rep, *env->now, leeway, pside, qrep, region);
 126         if(ttl == 0) {
 127                 /* we do not store the message, but we did store the RRs,
 128                  * which could be useful for delegation information */
 129                 verbose(VERB_ALGO, "TTL 0: dropped msg from cache");
 130                 free(rep);
 131                 return;
 132         }
 133
 134         /* store msg in the cache */
 135         reply_info_sortref(rep);
 136         if(!(e = query_info_entrysetup(qinfo, rep, hash))) {
 137                 log_err("store_msg: malloc failed");
 138                 return;
 139         }
 140         slabhash_insert(env->msg_cache, hash, &e->entry, rep, env->alloc);
 141 }
 142
 143 /** find closest NS or DNAME and returns the rrset (locked) */
 144 static struct ub_packed_rrset_key*
 145 find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen,
 146         uint16_t qclass, time_t now, uint16_t searchtype, int stripfront)
 147 {
 148         struct ub_packed_rrset_key *rrset;
 149         uint8_t lablen;
 150
 151         if(stripfront) {
 152                 /* strip off so that DNAMEs have strict subdomain match */
 153                 lablen = *qname;
 154                 qname += lablen + 1;
 155                 qnamelen -= lablen + 1;
 156         }
 157
 158         /* snip off front part of qname until the type is found */
 159         while(qnamelen > 0) {
 160                 if((rrset = rrset_cache_lookup(env->rrset_cache, qname,
 161                         qnamelen, searchtype, qclass, 0, now, 0)))
 162                         return rrset;
 163
 164                 /* snip off front label */
 165                 lablen = *qname;
 166                 qname += lablen + 1;
 167                 qnamelen -= lablen + 1;
 168         }
 169         return NULL;
 170 }
 171
 172 /** add addr to additional section */
 173 static void
 174 addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region,
 175         struct dns_msg* msg, time_t now)
 176 {
 177         if((msg->rep->rrsets[msg->rep->rrset_count] =
 178                 packed_rrset_copy_region(rrset, region, now))) {
 179                 msg->rep->ar_numrrsets++;
 180                 msg->rep->rrset_count++;
 181         }
 182 }
 183
 184 /** lookup message in message cache */
 185 static struct msgreply_entry*
 186 msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen,
 187         uint16_t qtype, uint16_t qclass, uint16_t flags, time_t now, int wr)
 188 {
 189         struct lruhash_entry* e;
 190         struct query_info k;
 191         hashvalue_t h;
 192
 193         k.qname = qname;
 194         k.qname_len = qnamelen;
 195         k.qtype = qtype;
 196         k.qclass = qclass;
 197         h = query_info_hash(&k, flags);
 198         e = slabhash_lookup(env->msg_cache, h, &k, wr);
 199
 200         if(!e) return NULL;
 201         if( now > ((struct reply_info*)e->data)->ttl ) {
 202                 lock_rw_unlock(&e->lock);
 203                 return NULL;
 204         }
 205         return (struct msgreply_entry*)e->key;
 206 }
 207
 208 /** find and add A and AAAA records for nameservers in delegpt */
 209 static int
 210 find_add_addrs(struct module_env* env, uint16_t qclass,
 211         struct regional* region, struct delegpt* dp, time_t now,
 212         struct dns_msg** msg)
 213 {
 214         struct delegpt_ns* ns;
 215         struct msgreply_entry* neg;
 216         struct ub_packed_rrset_key* akey;
 217         for(ns = dp->nslist; ns; ns = ns->next) {
 218                 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 219                         ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 220                 if(akey) {
 221                         if(!delegpt_add_rrset_A(dp, region, akey, 0)) {
 222                                 lock_rw_unlock(&akey->entry.lock);
 223                                 return 0;
 224                         }
 225                         if(msg)
 226                                 addr_to_additional(akey, region, *msg, now);
 227                         lock_rw_unlock(&akey->entry.lock);
 228                 } else {
 229                         /* BIT_CD on false because delegpt lookup does
 230                          * not use dns64 translation */
 231                         neg = msg_cache_lookup(env, ns->name, ns->namelen,
 232                                 LDNS_RR_TYPE_A, qclass, 0, now, 0);
 233                         if(neg) {
 234                                 delegpt_add_neg_msg(dp, neg);
 235                                 lock_rw_unlock(&neg->entry.lock);
 236                         }
 237                 }
 238                 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 239                         ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 240                 if(akey) {
 241                         if(!delegpt_add_rrset_AAAA(dp, region, akey, 0)) {
 242                                 lock_rw_unlock(&akey->entry.lock);
 243                                 return 0;
 244                         }
 245                         if(msg)
 246                                 addr_to_additional(akey, region, *msg, now);
 247                         lock_rw_unlock(&akey->entry.lock);
 248                 } else {
 249                         /* BIT_CD on false because delegpt lookup does
 250                          * not use dns64 translation */
 251                         neg = msg_cache_lookup(env, ns->name, ns->namelen,
 252                                 LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 253                         if(neg) {
 254                                 delegpt_add_neg_msg(dp, neg);
 255                                 lock_rw_unlock(&neg->entry.lock);
 256                         }
 257                 }
 258         }
 259         return 1;
 260 }
 261
 262 /** find and add A and AAAA records for missing nameservers in delegpt */
 263 int
 264 cache_fill_missing(struct module_env* env, uint16_t qclass,
 265         struct regional* region, struct delegpt* dp)
 266 {
 267         struct delegpt_ns* ns;
 268         struct msgreply_entry* neg;
 269         struct ub_packed_rrset_key* akey;
 270         time_t now = *env->now;
 271         for(ns = dp->nslist; ns; ns = ns->next) {
 272                 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 273                         ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 274                 if(akey) {
 275                         if(!delegpt_add_rrset_A(dp, region, akey, ns->lame)) {
 276                                 lock_rw_unlock(&akey->entry.lock);
 277                                 return 0;
 278                         }
 279                         log_nametypeclass(VERB_ALGO, "found in cache",
 280                                 ns->name, LDNS_RR_TYPE_A, qclass);
 281                         lock_rw_unlock(&akey->entry.lock);
 282                 } else {
 283                         /* BIT_CD on false because delegpt lookup does
 284                          * not use dns64 translation */
 285                         neg = msg_cache_lookup(env, ns->name, ns->namelen,
 286                                 LDNS_RR_TYPE_A, qclass, 0, now, 0);
 287                         if(neg) {
 288                                 delegpt_add_neg_msg(dp, neg);
 289                                 lock_rw_unlock(&neg->entry.lock);
 290                         }
 291                 }
 292                 akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 293                         ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 294                 if(akey) {
 295                         if(!delegpt_add_rrset_AAAA(dp, region, akey, ns->lame)) {
 296                                 lock_rw_unlock(&akey->entry.lock);
 297                                 return 0;
 298                         }
 299                         log_nametypeclass(VERB_ALGO, "found in cache",
 300                                 ns->name, LDNS_RR_TYPE_AAAA, qclass);
 301                         lock_rw_unlock(&akey->entry.lock);
 302                 } else {
 303                         /* BIT_CD on false because delegpt lookup does
 304                          * not use dns64 translation */
 305                         neg = msg_cache_lookup(env, ns->name, ns->namelen,
 306                                 LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 307                         if(neg) {
 308                                 delegpt_add_neg_msg(dp, neg);
 309                                 lock_rw_unlock(&neg->entry.lock);
 310                         }
 311                 }
 312         }
 313         return 1;
 314 }
 315
 316 /** find and add DS or NSEC to delegation msg */
 317 static void
 318 find_add_ds(struct module_env* env, struct regional* region,
 319         struct dns_msg* msg, struct delegpt* dp, time_t now)
 320 {
 321         /* Lookup the DS or NSEC at the delegation point. */
 322         struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
 323                 env->rrset_cache, dp->name, dp->namelen, LDNS_RR_TYPE_DS,
 324                 msg->qinfo.qclass, 0, now, 0);
 325         if(!rrset) {
 326                 /* NOTE: this won't work for alternate NSEC schemes
 327                  *      (opt-in, NSEC3) */
 328                 rrset = rrset_cache_lookup(env->rrset_cache, dp->name,
 329                         dp->namelen, LDNS_RR_TYPE_NSEC, msg->qinfo.qclass,
 330                         0, now, 0);
 331                 /* Note: the PACKED_RRSET_NSEC_AT_APEX flag is not used.
 332                  * since this is a referral, we need the NSEC at the parent
 333                  * side of the zone cut, not the NSEC at apex side. */
 334                 if(rrset && nsec_has_type(rrset, LDNS_RR_TYPE_DS)) {
 335                         lock_rw_unlock(&rrset->entry.lock);
 336                         rrset = NULL; /* discard wrong NSEC */
 337                 }
 338         }
 339         if(rrset) {
 340                 /* add it to auth section. This is the second rrset. */
 341                 if((msg->rep->rrsets[msg->rep->rrset_count] =
 342                         packed_rrset_copy_region(rrset, region, now))) {
 343                         msg->rep->ns_numrrsets++;
 344                         msg->rep->rrset_count++;
 345                 }
 346                 lock_rw_unlock(&rrset->entry.lock);
 347         }
 348 }
 349
 350 struct dns_msg*
 351 dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 352         uint16_t qclass, struct regional* region, size_t capacity)
 353 {
 354         struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
 355                 sizeof(struct dns_msg));
 356         if(!msg)
 357                 return NULL;
 358         msg->qinfo.qname = regional_alloc_init(region, qname, qnamelen);
 359         if(!msg->qinfo.qname)
 360                 return NULL;
 361         msg->qinfo.qname_len = qnamelen;
 362         msg->qinfo.qtype = qtype;
 363         msg->qinfo.qclass = qclass;
 364         /* non-packed reply_info, because it needs to grow the array */
 365         msg->rep = (struct reply_info*)regional_alloc_zero(region,
 366                 sizeof(struct reply_info)-sizeof(struct rrset_ref));
 367         if(!msg->rep)
 368                 return NULL;
 369         if(capacity > RR_COUNT_MAX)
 370                 return NULL; /* integer overflow protection */
 371         msg->rep->flags = BIT_QR; /* with QR, no AA */
 372         msg->rep->qdcount = 1;
 373         msg->rep->rrsets = (struct ub_packed_rrset_key**)
 374                 regional_alloc(region,
 375                 capacity*sizeof(struct ub_packed_rrset_key*));
 376         if(!msg->rep->rrsets)
 377                 return NULL;
 378         return msg;
 379 }
 380
 381 int
 382 dns_msg_authadd(struct dns_msg* msg, struct regional* region,
 383         struct ub_packed_rrset_key* rrset, time_t now)
 384 {
 385         if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
 386                 packed_rrset_copy_region(rrset, region, now)))
 387                 return 0;
 388         msg->rep->ns_numrrsets++;
 389         return 1;
 390 }
 391
 392 /** add rrset to answer section */
 393 static int
 394 dns_msg_ansadd(struct dns_msg* msg, struct regional* region,
 395         struct ub_packed_rrset_key* rrset, time_t now)
 396 {
 397         if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
 398                 packed_rrset_copy_region(rrset, region, now)))
 399                 return 0;
 400         msg->rep->an_numrrsets++;
 401         return 1;
 402 }
 403
 404 struct delegpt*
 405 dns_cache_find_delegation(struct module_env* env, uint8_t* qname,
 406         size_t qnamelen, uint16_t qtype, uint16_t qclass,
 407         struct regional* region, struct dns_msg** msg, time_t now)
 408 {
 409         /* try to find closest NS rrset */
 410         struct ub_packed_rrset_key* nskey;
 411         struct packed_rrset_data* nsdata;
 412         struct delegpt* dp;
 413
 414         nskey = find_closest_of_type(env, qname, qnamelen, qclass, now,
 415                 LDNS_RR_TYPE_NS, 0);
 416         if(!nskey) /* hope the caller has hints to prime or something */
 417                 return NULL;
 418         nsdata = (struct packed_rrset_data*)nskey->entry.data;
 419         /* got the NS key, create delegation point */
 420         dp = delegpt_create(region);
 421         if(!dp || !delegpt_set_name(dp, region, nskey->rk.dname)) {
 422                 lock_rw_unlock(&nskey->entry.lock);
 423                 log_err("find_delegation: out of memory");
 424                 return NULL;
 425         }
 426         /* create referral message */
 427         if(msg) {
 428                 /* allocate the array to as much as we could need:
 429                  *      NS rrset + DS/NSEC rrset +
 430                  *      A rrset for every NS RR
 431                  *      AAAA rrset for every NS RR
 432                  */
 433                 *msg = dns_msg_create(qname, qnamelen, qtype, qclass, region,
 434                         2 + nsdata->count*2);
 435                 if(!*msg || !dns_msg_authadd(*msg, region, nskey, now)) {
 436                         lock_rw_unlock(&nskey->entry.lock);
 437                         log_err("find_delegation: out of memory");
 438                         return NULL;
 439                 }
 440         }
 441         if(!delegpt_rrset_add_ns(dp, region, nskey, 0))
 442                 log_err("find_delegation: addns out of memory");
 443         lock_rw_unlock(&nskey->entry.lock); /* first unlock before next lookup*/
 444         /* find and add DS/NSEC (if any) */
 445         if(msg)
 446                 find_add_ds(env, region, *msg, dp, now);
 447         /* find and add A entries */
 448         if(!find_add_addrs(env, qclass, region, dp, now, msg))
 449                 log_err("find_delegation: addrs out of memory");
 450         return dp;
 451 }
 452
 453 /** allocate dns_msg from query_info and reply_info */
 454 static struct dns_msg*
 455 gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
 456 {
 457         struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
 458                 sizeof(struct dns_msg));
 459         if(!msg)
 460                 return NULL;
 461         memcpy(&msg->qinfo, q, sizeof(struct query_info));
 462         msg->qinfo.qname = regional_alloc_init(region, q->qname, q->qname_len);
 463         if(!msg->qinfo.qname)
 464                 return NULL;
 465         /* allocate replyinfo struct and rrset key array separately */
 466         msg->rep = (struct reply_info*)regional_alloc(region,
 467                 sizeof(struct reply_info) - sizeof(struct rrset_ref));
 468         if(!msg->rep)
 469                 return NULL;
 470         if(num > RR_COUNT_MAX)
 471                 return NULL; /* integer overflow protection */
 472         msg->rep->rrsets = (struct ub_packed_rrset_key**)
 473                 regional_alloc(region,
 474                 num * sizeof(struct ub_packed_rrset_key*));
 475         if(!msg->rep->rrsets)
 476                 return NULL;
 477         return msg;
 478 }
 479
 480 /** generate dns_msg from cached message */
 481 static struct dns_msg*
 482 tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 483         struct regional* region, time_t now, struct regional* scratch)
 484 {
 485         struct dns_msg* msg;
 486         size_t i;
 487         if(now > r->ttl)
 488                 return NULL;
 489         msg = gen_dns_msg(region, q, r->rrset_count);
 490         if(!msg)
 491                 return NULL;
 492         msg->rep->flags = r->flags;
 493         msg->rep->qdcount = r->qdcount;
 494         msg->rep->ttl = r->ttl - now;
 495         if(r->prefetch_ttl > now)
 496                 msg->rep->prefetch_ttl = r->prefetch_ttl - now;
 497         else    msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 498         msg->rep->security = r->security;
 499         msg->rep->an_numrrsets = r->an_numrrsets;
 500         msg->rep->ns_numrrsets = r->ns_numrrsets;
 501         msg->rep->ar_numrrsets = r->ar_numrrsets;
 502         msg->rep->rrset_count = r->rrset_count;
 503         msg->rep->authoritative = r->authoritative;
 504         if(!rrset_array_lock(r->ref, r->rrset_count, now))
 505                 return NULL;
 506         if(r->an_numrrsets > 0 && (r->rrsets[0]->rk.type == htons(
 507                 LDNS_RR_TYPE_CNAME) || r->rrsets[0]->rk.type == htons(
 508                 LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(q, r)) {
 509                 /* cname chain is now invalid, reconstruct msg */
 510                 rrset_array_unlock(r->ref, r->rrset_count);
 511                 return NULL;
 512         }
 513         if(r->security == sec_status_secure && !reply_all_rrsets_secure(r)) {
 514                 /* message rrsets have changed status, revalidate */
 515                 rrset_array_unlock(r->ref, r->rrset_count);
 516                 return NULL;
 517         }
 518         for(i=0; i<msg->rep->rrset_count; i++) {
 519                 msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i],
 520                         region, now);
 521                 if(!msg->rep->rrsets[i]) {
 522                         rrset_array_unlock(r->ref, r->rrset_count);
 523                         return NULL;
 524                 }
 525         }
 526         rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref,
 527                 r->rrset_count);
 528         return msg;
 529 }
 530
 531 /** synthesize RRset-only response from cached RRset item */
 532 static struct dns_msg*
 533 rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 534         time_t now, struct query_info* q)
 535 {
 536         struct dns_msg* msg;
 537         struct packed_rrset_data* d = (struct packed_rrset_data*)
 538                 rrset->entry.data;
 539         if(now > d->ttl)
 540                 return NULL;
 541         msg = gen_dns_msg(region, q, 1); /* only the CNAME (or other) RRset */
 542         if(!msg)
 543                 return NULL;
 544         msg->rep->flags = BIT_QR; /* reply, no AA, no error */
 545         msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
 546         msg->rep->qdcount = 1;
 547         msg->rep->ttl = d->ttl - now;
 548         msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 549         msg->rep->security = sec_status_unchecked;
 550         msg->rep->an_numrrsets = 1;
 551         msg->rep->ns_numrrsets = 0;
 552         msg->rep->ar_numrrsets = 0;
 553         msg->rep->rrset_count = 1;
 554         msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
 555         if(!msg->rep->rrsets[0]) /* copy CNAME */
 556                 return NULL;
 557         return msg;
 558 }
 559
 560 /** synthesize DNAME+CNAME response from cached DNAME item */
 561 static struct dns_msg*
 562 synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 563         time_t now, struct query_info* q)
 564 {
 565         struct dns_msg* msg;
 566         struct ub_packed_rrset_key* ck;
 567         struct packed_rrset_data* newd, *d = (struct packed_rrset_data*)
 568                 rrset->entry.data;
 569         uint8_t* newname, *dtarg = NULL;
 570         size_t newlen, dtarglen;
 571         if(now > d->ttl)
 572                 return NULL;
 573         /* only allow validated (with DNSSEC) DNAMEs used from cache
 574          * for insecure DNAMEs, query again. */
 575         if(d->security != sec_status_secure)
 576                 return NULL;
 577         msg = gen_dns_msg(region, q, 2); /* DNAME + CNAME RRset */
 578         if(!msg)
 579                 return NULL;
 580         msg->rep->flags = BIT_QR; /* reply, no AA, no error */
 581         msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
 582         msg->rep->qdcount = 1;
 583         msg->rep->ttl = d->ttl - now;
 584         msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 585         msg->rep->security = sec_status_unchecked;
 586         msg->rep->an_numrrsets = 1;
 587         msg->rep->ns_numrrsets = 0;
 588         msg->rep->ar_numrrsets = 0;
 589         msg->rep->rrset_count = 1;
 590         msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
 591         if(!msg->rep->rrsets[0]) /* copy DNAME */
 592                 return NULL;
 593         /* synth CNAME rrset */
 594         get_cname_target(rrset, &dtarg, &dtarglen);
 595         if(!dtarg)
 596                 return NULL;
 597         newlen = q->qname_len + dtarglen - rrset->rk.dname_len;
 598         if(newlen > LDNS_MAX_DOMAINLEN) {
 599                 msg->rep->flags |= LDNS_RCODE_YXDOMAIN;
 600                 return msg;
 601         }
 602         newname = (uint8_t*)regional_alloc(region, newlen);
 603         if(!newname)
 604                 return NULL;
 605         /* new name is concatenation of qname front (without DNAME owner)
 606          * and DNAME target name */
 607         memcpy(newname, q->qname, q->qname_len-rrset->rk.dname_len);
 608         memmove(newname+(q->qname_len-rrset->rk.dname_len), dtarg, dtarglen);
 609         /* create rest of CNAME rrset */
 610         ck = (struct ub_packed_rrset_key*)regional_alloc(region,
 611                 sizeof(struct ub_packed_rrset_key));
 612         if(!ck)
 613                 return NULL;
 614         memset(&ck->entry, 0, sizeof(ck->entry));
 615         msg->rep->rrsets[1] = ck;
 616         ck->entry.key = ck;
 617         ck->rk.type = htons(LDNS_RR_TYPE_CNAME);
 618         ck->rk.rrset_class = rrset->rk.rrset_class;
 619         ck->rk.flags = 0;
 620         ck->rk.dname = regional_alloc_init(region, q->qname, q->qname_len);
 621         if(!ck->rk.dname)
 622                 return NULL;
 623         ck->rk.dname_len = q->qname_len;
 624         ck->entry.hash = rrset_key_hash(&ck->rk);
 625         newd = (struct packed_rrset_data*)regional_alloc_zero(region,
 626                 sizeof(struct packed_rrset_data) + sizeof(size_t) +
 627                 sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t)
 628                 + newlen);
 629         if(!newd)
 630                 return NULL;
 631         ck->entry.data = newd;
 632         newd->ttl = 0; /* 0 for synthesized CNAME TTL */
 633         newd->count = 1;
 634         newd->rrsig_count = 0;
 635         newd->trust = rrset_trust_ans_noAA;
 636         newd->rr_len = (size_t*)((uint8_t*)newd +
 637                 sizeof(struct packed_rrset_data));
 638         newd->rr_len[0] = newlen + sizeof(uint16_t);
 639         packed_rrset_ptr_fixup(newd);
 640         newd->rr_ttl[0] = newd->ttl;
 641         msg->rep->ttl = newd->ttl;
 642         msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(newd->ttl);
 643         sldns_write_uint16(newd->rr_data[0], newlen);
 644         memmove(newd->rr_data[0] + sizeof(uint16_t), newname, newlen);
 645         msg->rep->an_numrrsets ++;
 646         msg->rep->rrset_count ++;
 647         return msg;
 648 }
 649
 650 /** Fill TYPE_ANY response with some data from cache */
 651 static struct dns_msg*
 652 fill_any(struct module_env* env,
 653         uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
 654         struct regional* region)
 655 {
 656         time_t now = *env->now;
 657         struct dns_msg* msg = NULL;
 658         uint16_t lookup[] = {LDNS_RR_TYPE_A, LDNS_RR_TYPE_AAAA,
 659                 LDNS_RR_TYPE_MX, LDNS_RR_TYPE_SOA, LDNS_RR_TYPE_NS,
 660                 LDNS_RR_TYPE_DNAME, 0};
 661         int i, num=6; /* number of RR types to look up */
 662         log_assert(lookup[num] == 0);
 663
 664         for(i=0; i<num; i++) {
 665                 /* look up this RR for inclusion in type ANY response */
 666                 struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
 667                         env->rrset_cache, qname, qnamelen, lookup[i],
 668                         qclass, 0, now, 0);
 669                 struct packed_rrset_data *d;
 670                 if(!rrset)
 671                         continue;
 672
 673                 /* only if rrset from answer section */
 674                 d = (struct packed_rrset_data*)rrset->entry.data;
 675                 if(d->trust == rrset_trust_add_noAA ||
 676                         d->trust == rrset_trust_auth_noAA ||
 677                         d->trust == rrset_trust_add_AA ||
 678                         d->trust == rrset_trust_auth_AA) {
 679                         lock_rw_unlock(&rrset->entry.lock);
 680                         continue;
 681                 }
 682
 683                 /* create msg if none */
 684                 if(!msg) {
 685                         msg = dns_msg_create(qname, qnamelen, qtype, qclass,
 686                                 region, (size_t)(num-i));
 687                         if(!msg) {
 688                                 lock_rw_unlock(&rrset->entry.lock);
 689                                 return NULL;
 690                         }
 691                 }
 692
 693                 /* add RRset to response */
 694                 if(!dns_msg_ansadd(msg, region, rrset, now)) {
 695                         lock_rw_unlock(&rrset->entry.lock);
 696                         return NULL;
 697                 }
 698                 lock_rw_unlock(&rrset->entry.lock);
 699         }
 700         return msg;
 701 }
 702
 703 struct dns_msg*
 704 dns_cache_lookup(struct module_env* env,
 705         uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
 706         uint16_t flags, struct regional* region, struct regional* scratch)
 707 {
 708         struct lruhash_entry* e;
 709         struct query_info k;
 710         hashvalue_t h;
 711         time_t now = *env->now;
 712         struct ub_packed_rrset_key* rrset;
 713
 714         /* lookup first, this has both NXdomains and ANSWER responses */
 715         k.qname = qname;
 716         k.qname_len = qnamelen;
 717         k.qtype = qtype;
 718         k.qclass = qclass;
 719         h = query_info_hash(&k, flags);
 720         e = slabhash_lookup(env->msg_cache, h, &k, 0);
 721         if(e) {
 722                 struct msgreply_entry* key = (struct msgreply_entry*)e->key;
 723                 struct reply_info* data = (struct reply_info*)e->data;
 724                 struct dns_msg* msg = tomsg(env, &key->key, data, region, now,
 725                         scratch);
 726                 if(msg) {
 727                         lock_rw_unlock(&e->lock);
 728                         return msg;
 729                 }
 730                 /* could be msg==NULL; due to TTL or not all rrsets available */
 731                 lock_rw_unlock(&e->lock);
 732         }
 733
 734         /* see if a DNAME exists. Checked for first, to enforce that DNAMEs
 735          * are more important, the CNAME is resynthesized and thus
 736          * consistent with the DNAME */
 737         if( (rrset=find_closest_of_type(env, qname, qnamelen, qclass, now,
 738                 LDNS_RR_TYPE_DNAME, 1))) {
 739                 /* synthesize a DNAME+CNAME message based on this */
 740                 struct dns_msg* msg = synth_dname_msg(rrset, region, now, &k);
 741                 if(msg) {
 742                         lock_rw_unlock(&rrset->entry.lock);
 743                         return msg;
 744                 }
 745                 lock_rw_unlock(&rrset->entry.lock);
 746         }
 747
 748         /* see if we have CNAME for this domain,
 749          * but not for DS records (which are part of the parent) */
 750         if( qtype != LDNS_RR_TYPE_DS &&
 751            (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
 752                 LDNS_RR_TYPE_CNAME, qclass, 0, now, 0))) {
 753                 struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
 754                 if(msg) {
 755                         lock_rw_unlock(&rrset->entry.lock);
 756                         return msg;
 757                 }
 758                 lock_rw_unlock(&rrset->entry.lock);
 759         }
 760
 761         /* construct DS, DNSKEY, DLV messages from rrset cache. */
 762         if((qtype == LDNS_RR_TYPE_DS || qtype == LDNS_RR_TYPE_DNSKEY ||
 763                 qtype == LDNS_RR_TYPE_DLV) &&
 764                 (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
 765                 qtype, qclass, 0, now, 0))) {
 766                 /* if the rrset is from the additional section, and the
 767                  * signatures have fallen off, then do not synthesize a msg
 768                  * instead, allow a full query for signed results to happen.
 769                  * Forego all rrset data from additional section, because
 770                  * some signatures may not be present and cause validation
 771                  * failure.
 772                  */
 773                 struct packed_rrset_data *d = (struct packed_rrset_data*)
 774                         rrset->entry.data;
 775                 if(d->trust != rrset_trust_add_noAA &&
 776                         d->trust != rrset_trust_add_AA &&
 777                         (qtype == LDNS_RR_TYPE_DS ||
 778                                 (d->trust != rrset_trust_auth_noAA
 779                                 && d->trust != rrset_trust_auth_AA) )) {
 780                         struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
 781                         if(msg) {
 782                                 lock_rw_unlock(&rrset->entry.lock);
 783                                 return msg;
 784                         }
 785                 }
 786                 lock_rw_unlock(&rrset->entry.lock);
 787         }
 788
 789         /* stop downwards cache search on NXDOMAIN.
 790          * Empty nonterminals are NOERROR, so an NXDOMAIN for foo
 791          * means bla.foo also does not exist.  The DNSSEC proofs are
 792          * the same.  We search upwards for NXDOMAINs. */
 793         if(env->cfg->harden_below_nxdomain)
 794             while(!dname_is_root(k.qname)) {
 795                 dname_remove_label(&k.qname, &k.qname_len);
 796                 h = query_info_hash(&k, flags);
 797                 e = slabhash_lookup(env->msg_cache, h, &k, 0);
 798                 if(e) {
 799                         struct reply_info* data = (struct reply_info*)e->data;
 800                         struct dns_msg* msg;
 801                         if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN
 802                           && data->security == sec_status_secure
 803                           && (msg=tomsg(env, &k, data, region, now, scratch))){
 804                                 lock_rw_unlock(&e->lock);
 805                                 msg->qinfo.qname=qname;
 806                                 msg->qinfo.qname_len=qnamelen;
 807                                 /* check that DNSSEC really works out */
 808                                 msg->rep->security = sec_status_unchecked;
 809                                 return msg;
 810                         }
 811                         lock_rw_unlock(&e->lock);
 812                 }
 813         }
 814
 815         /* fill common RR types for ANY response to avoid requery */
 816         if(qtype == LDNS_RR_TYPE_ANY) {
 817                 return fill_any(env, qname, qnamelen, qtype, qclass, region);
 818         }
 819
 820         return NULL;
 821 }
 822
 823 int
 824 dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 825         struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
 826         struct regional* region, uint16_t flags)
 827 {
 828         struct reply_info* rep = NULL;
 829         /* alloc, malloc properly (not in region, like msg is) */
 830         rep = reply_info_copy(msgrep, env->alloc, NULL);
 831         if(!rep)
 832                 return 0;
 833         /* ttl must be relative ;i.e. 0..86400 not  time(0)+86400.
 834          * the env->now is added to message and RRsets in this routine. */
 835         /* the leeway is used to invalidate other rrsets earlier */
 836
 837         if(is_referral) {
 838                 /* store rrsets */
 839                 struct rrset_ref ref;
 840                 size_t i;
 841                 for(i=0; i<rep->rrset_count; i++) {
 842                         packed_rrset_ttl_add((struct packed_rrset_data*)
 843                                 rep->rrsets[i]->entry.data, *env->now);
 844                         ref.key = rep->rrsets[i];
 845                         ref.id = rep->rrsets[i]->id;
 846                         /*ignore ret: it was in the cache, ref updated */
 847                         /* no leeway for typeNS */
 848                         (void)rrset_cache_update(env->rrset_cache, &ref,
 849                                 env->alloc, *env->now +
 850                                 ((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS
 851                                  && !pside) ? 0:leeway));
 852                 }
 853                 free(rep);
 854                 return 1;
 855         } else {
 856                 /* store msg, and rrsets */
 857                 struct query_info qinf;
 858                 hashvalue_t h;
 859
 860                 qinf = *msgqinf;
 861                 qinf.qname = memdup(msgqinf->qname, msgqinf->qname_len);
 862                 if(!qinf.qname) {
 863                         reply_info_parsedelete(rep, env->alloc);
 864                         return 0;
 865                 }
 866                 /* fixup flags to be sensible for a reply based on the cache */
 867                 /* this module means that RA is available. It is an answer QR.
 868                  * Not AA from cache. Not CD in cache (depends on client bit). */
 869                 rep->flags |= (BIT_RA | BIT_QR);
 870                 rep->flags &= ~(BIT_AA | BIT_CD);
 871                 h = query_info_hash(&qinf, flags);
 872                 dns_cache_store_msg(env, &qinf, h, rep, leeway, pside, msgrep,
 873                         region);
 874                 /* qname is used inside query_info_entrysetup, and set to
 875                  * NULL. If it has not been used, free it. free(0) is safe. */
 876                 free(qinf.qname);
 877         }
 878         return 1;
 879 }
 880
 881 int
 882 dns_cache_prefetch_adjust(struct module_env* env, struct query_info* qinfo,
 883         time_t adjust, uint16_t flags)
 884 {
 885         struct msgreply_entry* msg;
 886         msg = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len,
 887                 qinfo->qtype, qinfo->qclass, flags, *env->now, 1);
 888         if(msg) {
 889                 struct reply_info* rep = (struct reply_info*)msg->entry.data;
 890                 if(rep) {
 891                         rep->prefetch_ttl += adjust;
 892                         lock_rw_unlock(&msg->entry.lock);
 893                         return 1;
 894                 }
 895                 lock_rw_unlock(&msg->entry.lock);
 896         }
 897         return 0;
 898 }