/* dnsmasq is Copyright (c) 2000-2009 Simon Kelley
|
|
This program is free software; you can redistribute it and/or modify
|
it under the terms of the GNU General Public License as published by
|
the Free Software Foundation; version 2 dated June, 1991, or
|
(at your option) version 3 dated 29 June, 2007.
|
|
This program is distributed in the hope that it will be useful,
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
GNU General Public License for more details.
|
|
You should have received a copy of the GNU General Public License
|
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
*/
|
|
#include "dnsmasq.h"
|
|
static struct frec* lookup_frec(unsigned short id, unsigned int crc);
|
static struct frec* lookup_frec_by_sender(unsigned short id, union mysockaddr* addr,
|
unsigned int crc);
|
static unsigned short get_id(int force, unsigned short force_id, unsigned int crc);
|
static void free_frec(struct frec* f);
|
static struct randfd* allocate_rfd(int family);
|
|
/* Send a UDP packet with its source address set as "source"
|
unless nowild is true, when we just send it with the kernel default */
|
static void send_from(int fd, int nowild, char* packet, size_t len, union mysockaddr* to,
|
struct all_addr* source, unsigned int iface) {
|
struct msghdr msg;
|
struct iovec iov[1];
|
union {
|
struct cmsghdr align; /* this ensures alignment */
|
#if defined(HAVE_LINUX_NETWORK)
|
char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
|
#elif defined(IP_SENDSRCADDR)
|
char control[CMSG_SPACE(sizeof(struct in_addr))];
|
#endif
|
#ifdef HAVE_IPV6
|
char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
|
#endif
|
} control_u;
|
|
iov[0].iov_base = packet;
|
iov[0].iov_len = len;
|
|
msg.msg_control = NULL;
|
msg.msg_controllen = 0;
|
msg.msg_flags = 0;
|
msg.msg_name = to;
|
msg.msg_namelen = sa_len(to);
|
msg.msg_iov = iov;
|
msg.msg_iovlen = 1;
|
|
if (!nowild) {
|
struct cmsghdr* cmptr;
|
msg.msg_control = &control_u;
|
msg.msg_controllen = sizeof(control_u);
|
cmptr = CMSG_FIRSTHDR(&msg);
|
|
if (to->sa.sa_family == AF_INET) {
|
#if defined(HAVE_LINUX_NETWORK)
|
struct in_pktinfo* pkt = (struct in_pktinfo*) CMSG_DATA(cmptr);
|
pkt->ipi_ifindex = 0;
|
pkt->ipi_spec_dst = source->addr.addr4;
|
msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
|
cmptr->cmsg_level = SOL_IP;
|
cmptr->cmsg_type = IP_PKTINFO;
|
#elif defined(IP_SENDSRCADDR)
|
struct in_addr* a = (struct in_addr*) CMSG_DATA(cmptr);
|
*a = source->addr.addr4;
|
msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
|
cmptr->cmsg_level = IPPROTO_IP;
|
cmptr->cmsg_type = IP_SENDSRCADDR;
|
#endif
|
} else
|
#ifdef HAVE_IPV6
|
{
|
struct in6_pktinfo* pkt = (struct in6_pktinfo*) CMSG_DATA(cmptr);
|
pkt->ipi6_ifindex = iface; /* Need iface for IPv6 to handle link-local addrs */
|
pkt->ipi6_addr = source->addr.addr6;
|
msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
|
cmptr->cmsg_type = IPV6_PKTINFO;
|
cmptr->cmsg_level = IPV6_LEVEL;
|
}
|
#else
|
iface = 0; /* eliminate warning */
|
#endif
|
}
|
|
retry:
|
if (sendmsg(fd, &msg, 0) == -1) {
|
/* certain Linux kernels seem to object to setting the source address in the IPv6 stack
|
by returning EINVAL from sendmsg. In that case, try again without setting the
|
source address, since it will nearly alway be correct anyway. IPv6 stinks. */
|
if (errno == EINVAL && msg.msg_controllen) {
|
msg.msg_controllen = 0;
|
goto retry;
|
}
|
if (retry_send()) goto retry;
|
}
|
}
|
|
static unsigned short search_servers(time_t now, struct all_addr** addrpp, unsigned short qtype,
|
char* qdomain, int* type, char** domain)
|
|
{
|
/* If the query ends in the domain in one of our servers, set
|
domain to point to that name. We find the largest match to allow both
|
domain.org and sub.domain.org to exist. */
|
|
unsigned int namelen = strlen(qdomain);
|
unsigned int matchlen = 0;
|
struct server* serv;
|
unsigned short flags = 0;
|
|
for (serv = daemon->servers; serv; serv = serv->next)
|
/* domain matches take priority over NODOTS matches */
|
if ((serv->flags & SERV_FOR_NODOTS) && *type != SERV_HAS_DOMAIN && !strchr(qdomain, '.') &&
|
namelen != 0) {
|
unsigned short sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
|
*type = SERV_FOR_NODOTS;
|
if (serv->flags & SERV_NO_ADDR)
|
flags = F_NXDOMAIN;
|
else if (serv->flags & SERV_LITERAL_ADDRESS) {
|
if (sflag & qtype) {
|
flags = sflag;
|
if (serv->addr.sa.sa_family == AF_INET)
|
*addrpp = (struct all_addr*) &serv->addr.in.sin_addr;
|
#ifdef HAVE_IPV6
|
else
|
*addrpp = (struct all_addr*) &serv->addr.in6.sin6_addr;
|
#endif
|
} else if (!flags || (flags & F_NXDOMAIN))
|
flags = F_NOERR;
|
}
|
} else if (serv->flags & SERV_HAS_DOMAIN) {
|
unsigned int domainlen = strlen(serv->domain);
|
char* matchstart = qdomain + namelen - domainlen;
|
if (namelen >= domainlen && hostname_isequal(matchstart, serv->domain) &&
|
domainlen >= matchlen &&
|
(domainlen == 0 || namelen == domainlen || *(serv->domain) == '.' ||
|
*(matchstart - 1) == '.')) {
|
unsigned short sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
|
*type = SERV_HAS_DOMAIN;
|
*domain = serv->domain;
|
matchlen = domainlen;
|
if (serv->flags & SERV_NO_ADDR)
|
flags = F_NXDOMAIN;
|
else if (serv->flags & SERV_LITERAL_ADDRESS) {
|
if (sflag & qtype) {
|
flags = sflag;
|
if (serv->addr.sa.sa_family == AF_INET)
|
*addrpp = (struct all_addr*) &serv->addr.in.sin_addr;
|
#ifdef HAVE_IPV6
|
else
|
*addrpp = (struct all_addr*) &serv->addr.in6.sin6_addr;
|
#endif
|
} else if (!flags || (flags & F_NXDOMAIN))
|
flags = F_NOERR;
|
}
|
}
|
}
|
|
if (flags == 0 && !(qtype & F_BIGNAME) && (daemon->options & OPT_NODOTS_LOCAL) &&
|
!strchr(qdomain, '.') && namelen != 0)
|
/* don't forward simple names, make exception for NS queries and empty name. */
|
flags = F_NXDOMAIN;
|
|
if (flags == F_NXDOMAIN && check_for_local_domain(qdomain, now)) flags = F_NOERR;
|
|
if (flags) {
|
int logflags = 0;
|
|
if (flags == F_NXDOMAIN || flags == F_NOERR) logflags = F_NEG | qtype;
|
|
log_query(logflags | flags | F_CONFIG | F_FORWARD, qdomain, *addrpp, NULL);
|
}
|
|
return flags;
|
}
|
|
static int forward_query(int udpfd, union mysockaddr* udpaddr, struct all_addr* dst_addr,
|
unsigned int dst_iface, HEADER* header, size_t plen, time_t now,
|
struct frec* forward) {
|
char* domain = NULL;
|
int type = 0;
|
struct all_addr* addrp = NULL;
|
unsigned int crc = questions_crc(header, plen, daemon->namebuff);
|
unsigned short flags = 0;
|
unsigned short gotname = extract_request(header, plen, daemon->namebuff, NULL);
|
struct server* start = NULL;
|
|
/* may be no servers available. */
|
if (!daemon->servers)
|
forward = NULL;
|
else if (forward || (forward = lookup_frec_by_sender(ntohs(header->id), udpaddr, crc))) {
|
/* retry on existing query, send to all available servers */
|
domain = forward->sentto->domain;
|
forward->sentto->failed_queries++;
|
if (!(daemon->options & OPT_ORDER)) {
|
forward->forwardall = 1;
|
daemon->last_server = NULL;
|
}
|
type = forward->sentto->flags & SERV_TYPE;
|
if (!(start = forward->sentto->next)) start = daemon->servers; /* at end of list, recycle */
|
header->id = htons(forward->new_id);
|
} else {
|
if (gotname) flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain);
|
|
if (!flags && !(forward = get_new_frec(now, NULL))) /* table full - server failure. */
|
flags = F_NEG;
|
|
if (forward) {
|
/* force unchanging id for signed packets */
|
int is_sign;
|
find_pseudoheader(header, plen, NULL, NULL, &is_sign);
|
|
forward->source = *udpaddr;
|
forward->dest = *dst_addr;
|
forward->iface = dst_iface;
|
forward->orig_id = ntohs(header->id);
|
forward->new_id = get_id(is_sign, forward->orig_id, crc);
|
forward->fd = udpfd;
|
forward->crc = crc;
|
forward->forwardall = 0;
|
header->id = htons(forward->new_id);
|
|
/* In strict_order mode, or when using domain specific servers
|
always try servers in the order specified in resolv.conf,
|
otherwise, use the one last known to work. */
|
|
if (type != 0 || (daemon->options & OPT_ORDER))
|
start = daemon->servers;
|
else if (!(start = daemon->last_server) || daemon->forwardcount++ > FORWARD_TEST ||
|
difftime(now, daemon->forwardtime) > FORWARD_TIME) {
|
start = daemon->servers;
|
forward->forwardall = 1;
|
daemon->forwardcount = 0;
|
daemon->forwardtime = now;
|
}
|
}
|
}
|
|
/* check for send errors here (no route to host)
|
if we fail to send to all nameservers, send back an error
|
packet straight away (helps modem users when offline) */
|
|
if (!flags && forward) {
|
struct server* firstsentto = start;
|
int forwarded = 0;
|
|
while (1) {
|
/* only send to servers dealing with our domain.
|
domain may be NULL, in which case server->domain
|
must be NULL also. */
|
|
if (type == (start->flags & SERV_TYPE) &&
|
(type != SERV_HAS_DOMAIN || hostname_isequal(domain, start->domain)) &&
|
!(start->flags & SERV_LITERAL_ADDRESS)) {
|
int fd;
|
|
/* find server socket to use, may need to get random one. */
|
if (start->sfd)
|
fd = start->sfd->fd;
|
else {
|
#ifdef HAVE_IPV6
|
if (start->addr.sa.sa_family == AF_INET6) {
|
if (!forward->rfd6 && !(forward->rfd6 = allocate_rfd(AF_INET6))) break;
|
daemon->rfd_save = forward->rfd6;
|
fd = forward->rfd6->fd;
|
} else
|
#endif
|
{
|
if (!forward->rfd4 && !(forward->rfd4 = allocate_rfd(AF_INET))) break;
|
daemon->rfd_save = forward->rfd4;
|
fd = forward->rfd4->fd;
|
}
|
|
#ifdef ANDROID
|
// Mark the socket so it goes out on the correct network. Note
|
// that we never clear the mark, only re-set it the next time we
|
// allocate a new random fd. This is because we buffer DNS
|
// queries (in daemon->srv_save, daemon->packet_len) and socket
|
// file descriptors (in daemon->rfd_save) with the expectation of
|
// being able to use them again.
|
//
|
// Server fds are marked separately in allocate_sfd.
|
setsockopt(fd, SOL_SOCKET, SO_MARK, &start->mark, sizeof(start->mark));
|
#endif
|
}
|
|
if (sendto(fd, (char*) header, plen, 0, &start->addr.sa, sa_len(&start->addr)) ==
|
-1) {
|
if (retry_send()) continue;
|
} else {
|
/* Keep info in case we want to re-send this packet */
|
daemon->srv_save = start;
|
daemon->packet_len = plen;
|
|
if (!gotname) strcpy(daemon->namebuff, "query");
|
if (start->addr.sa.sa_family == AF_INET)
|
log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
|
(struct all_addr*) &start->addr.in.sin_addr, NULL);
|
#ifdef HAVE_IPV6
|
else
|
log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
|
(struct all_addr*) &start->addr.in6.sin6_addr, NULL);
|
#endif
|
start->queries++;
|
forwarded = 1;
|
forward->sentto = start;
|
if (!forward->forwardall) break;
|
forward->forwardall++;
|
}
|
}
|
|
if (!(start = start->next)) start = daemon->servers;
|
|
if (start == firstsentto) break;
|
}
|
|
if (forwarded) return 1;
|
|
/* could not send on, prepare to return */
|
header->id = htons(forward->orig_id);
|
free_frec(forward); /* cancel */
|
}
|
|
/* could not send on, return empty answer or address if known for whole domain */
|
if (udpfd != -1) {
|
plen = setup_reply(header, plen, addrp, flags, daemon->local_ttl);
|
send_from(udpfd, daemon->options & OPT_NOWILD, (char*) header, plen, udpaddr, dst_addr,
|
dst_iface);
|
}
|
|
return 0;
|
}
|
|
static size_t process_reply(HEADER* header, time_t now, struct server* server, size_t n) {
|
unsigned char *pheader, *sizep;
|
int munged = 0, is_sign;
|
size_t plen;
|
|
/* If upstream is advertising a larger UDP packet size
|
than we allow, trim it so that we don't get overlarge
|
requests for the client. We can't do this for signed packets. */
|
|
if ((pheader = find_pseudoheader(header, n, &plen, &sizep, &is_sign)) && !is_sign) {
|
unsigned short udpsz;
|
unsigned char* psave = sizep;
|
|
GETSHORT(udpsz, sizep);
|
if (udpsz > daemon->edns_pktsz) PUTSHORT(daemon->edns_pktsz, psave);
|
}
|
|
if (header->opcode != QUERY || (header->rcode != NOERROR && header->rcode != NXDOMAIN))
|
return n;
|
|
/* Complain loudly if the upstream server is non-recursive. */
|
if (!header->ra && header->rcode == NOERROR && ntohs(header->ancount) == 0 && server &&
|
!(server->flags & SERV_WARNED_RECURSIVE)) {
|
prettyprint_addr(&server->addr, daemon->namebuff);
|
my_syslog(LOG_WARNING, _("nameserver %s refused to do a recursive query"), daemon->namebuff);
|
if (!(daemon->options & OPT_LOG)) server->flags |= SERV_WARNED_RECURSIVE;
|
}
|
|
if (daemon->bogus_addr && header->rcode != NXDOMAIN &&
|
check_for_bogus_wildcard(header, n, daemon->namebuff, daemon->bogus_addr, now)) {
|
munged = 1;
|
header->rcode = NXDOMAIN;
|
header->aa = 0;
|
} else {
|
if (header->rcode == NXDOMAIN && extract_request(header, n, daemon->namebuff, NULL) &&
|
check_for_local_domain(daemon->namebuff, now)) {
|
/* if we forwarded a query for a locally known name (because it was for
|
an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
|
since we know that the domain exists, even if upstream doesn't */
|
munged = 1;
|
header->aa = 1;
|
header->rcode = NOERROR;
|
}
|
|
if (extract_addresses(header, n, daemon->namebuff, now)) {
|
my_syslog(LOG_WARNING, _("possible DNS-rebind attack detected"));
|
munged = 1;
|
}
|
}
|
|
/* do this after extract_addresses. Ensure NODATA reply and remove
|
nameserver info. */
|
|
if (munged) {
|
header->ancount = htons(0);
|
header->nscount = htons(0);
|
header->arcount = htons(0);
|
}
|
|
/* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
|
sections of the packet. Find the new length here and put back pseudoheader
|
if it was removed. */
|
return resize_packet(header, n, pheader, plen);
|
}
|
|
/* sets new last_server */
|
void reply_query(int fd, int family, time_t now) {
|
/* packet from peer server, extract data for cache, and send to
|
original requester */
|
HEADER* header;
|
union mysockaddr serveraddr;
|
struct frec* forward;
|
socklen_t addrlen = sizeof(serveraddr);
|
ssize_t n = recvfrom(fd, daemon->packet, daemon->edns_pktsz, 0, &serveraddr.sa, &addrlen);
|
size_t nn;
|
struct server* server;
|
|
/* packet buffer overwritten */
|
daemon->srv_save = NULL;
|
|
/* Determine the address of the server replying so that we can mark that as good */
|
serveraddr.sa.sa_family = family;
|
#ifdef HAVE_IPV6
|
if (serveraddr.sa.sa_family == AF_INET6) serveraddr.in6.sin6_flowinfo = 0;
|
#endif
|
|
/* spoof check: answer must come from known server, */
|
for (server = daemon->servers; server; server = server->next)
|
if (!(server->flags & (SERV_LITERAL_ADDRESS | SERV_NO_ADDR)) &&
|
sockaddr_isequal(&server->addr, &serveraddr))
|
break;
|
|
header = (HEADER*) daemon->packet;
|
|
if (!server || n < (int) sizeof(HEADER) || !header->qr ||
|
!(forward = lookup_frec(ntohs(header->id), questions_crc(header, n, daemon->namebuff))))
|
return;
|
|
server = forward->sentto;
|
|
if ((header->rcode == SERVFAIL || header->rcode == REFUSED) && !(daemon->options & OPT_ORDER) &&
|
forward->forwardall == 0)
|
/* for broken servers, attempt to send to another one. */
|
{
|
unsigned char* pheader;
|
size_t plen;
|
int is_sign;
|
|
/* recreate query from reply */
|
pheader = find_pseudoheader(header, (size_t) n, &plen, NULL, &is_sign);
|
if (!is_sign) {
|
header->ancount = htons(0);
|
header->nscount = htons(0);
|
header->arcount = htons(0);
|
if ((nn = resize_packet(header, (size_t) n, pheader, plen))) {
|
header->qr = 0;
|
header->tc = 0;
|
forward_query(-1, NULL, NULL, 0, header, nn, now, forward);
|
return;
|
}
|
}
|
}
|
|
if ((forward->sentto->flags & SERV_TYPE) == 0) {
|
if (header->rcode == SERVFAIL || header->rcode == REFUSED)
|
server = NULL;
|
else {
|
struct server* last_server;
|
|
/* find good server by address if possible, otherwise assume the last one we sent to */
|
for (last_server = daemon->servers; last_server; last_server = last_server->next)
|
if (!(last_server->flags &
|
(SERV_LITERAL_ADDRESS | SERV_HAS_DOMAIN | SERV_FOR_NODOTS | SERV_NO_ADDR)) &&
|
sockaddr_isequal(&last_server->addr, &serveraddr)) {
|
server = last_server;
|
break;
|
}
|
}
|
if (!(daemon->options & OPT_ALL_SERVERS)) daemon->last_server = server;
|
}
|
|
/* If the answer is an error, keep the forward record in place in case
|
we get a good reply from another server. Kill it when we've
|
had replies from all to avoid filling the forwarding table when
|
everything is broken */
|
if (forward->forwardall == 0 || --forward->forwardall == 1 ||
|
(header->rcode != REFUSED && header->rcode != SERVFAIL)) {
|
if ((nn = process_reply(header, now, server, (size_t) n))) {
|
header->id = htons(forward->orig_id);
|
header->ra = 1; /* recursion if available */
|
send_from(forward->fd, daemon->options & OPT_NOWILD, daemon->packet, nn,
|
&forward->source, &forward->dest, forward->iface);
|
}
|
free_frec(forward); /* cancel */
|
}
|
}
|
|
void receive_query(struct listener* listen, time_t now) {
|
HEADER* header = (HEADER*) daemon->packet;
|
union mysockaddr source_addr;
|
unsigned short type;
|
struct all_addr dst_addr;
|
struct in_addr netmask, dst_addr_4;
|
size_t m;
|
ssize_t n;
|
int if_index = 0;
|
struct iovec iov[1];
|
struct msghdr msg;
|
struct cmsghdr* cmptr;
|
union {
|
struct cmsghdr align; /* this ensures alignment */
|
#ifdef HAVE_IPV6
|
char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
|
#endif
|
#if defined(HAVE_LINUX_NETWORK)
|
char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
|
#elif defined(IP_RECVDSTADDR)
|
char control[CMSG_SPACE(sizeof(struct in_addr)) + CMSG_SPACE(sizeof(struct sockaddr_dl))];
|
#endif
|
} control_u;
|
|
/* packet buffer overwritten */
|
daemon->srv_save = NULL;
|
|
if (listen->family == AF_INET && (daemon->options & OPT_NOWILD)) {
|
dst_addr_4 = listen->iface->addr.in.sin_addr;
|
netmask = listen->iface->netmask;
|
} else {
|
dst_addr_4.s_addr = 0;
|
netmask.s_addr = 0;
|
}
|
|
iov[0].iov_base = daemon->packet;
|
iov[0].iov_len = daemon->edns_pktsz;
|
|
msg.msg_control = control_u.control;
|
msg.msg_controllen = sizeof(control_u);
|
msg.msg_flags = 0;
|
msg.msg_name = &source_addr;
|
msg.msg_namelen = sizeof(source_addr);
|
msg.msg_iov = iov;
|
msg.msg_iovlen = 1;
|
|
if ((n = recvmsg(listen->fd, &msg, 0)) == -1) return;
|
|
if (n < (int) sizeof(HEADER) || (msg.msg_flags & MSG_TRUNC) || header->qr) return;
|
|
source_addr.sa.sa_family = listen->family;
|
#ifdef HAVE_IPV6
|
if (listen->family == AF_INET6) source_addr.in6.sin6_flowinfo = 0;
|
#endif
|
|
if (!(daemon->options & OPT_NOWILD)) {
|
struct ifreq ifr;
|
|
if (msg.msg_controllen < sizeof(struct cmsghdr)) return;
|
|
#if defined(HAVE_LINUX_NETWORK)
|
if (listen->family == AF_INET)
|
for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
|
if (cmptr->cmsg_level == SOL_IP && cmptr->cmsg_type == IP_PKTINFO) {
|
dst_addr_4 = dst_addr.addr.addr4 =
|
((struct in_pktinfo*) CMSG_DATA(cmptr))->ipi_spec_dst;
|
if_index = ((struct in_pktinfo*) CMSG_DATA(cmptr))->ipi_ifindex;
|
}
|
#elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
|
if (listen->family == AF_INET) {
|
for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
|
if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVDSTADDR)
|
dst_addr_4 = dst_addr.addr.addr4 = *((struct in_addr*) CMSG_DATA(cmptr));
|
else if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVIF)
|
if_index = ((struct sockaddr_dl*) CMSG_DATA(cmptr))->sdl_index;
|
}
|
#endif
|
|
#ifdef HAVE_IPV6
|
if (listen->family == AF_INET6) {
|
for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
|
if (cmptr->cmsg_level == IPV6_LEVEL && cmptr->cmsg_type == IPV6_PKTINFO) {
|
dst_addr.addr.addr6 = ((struct in6_pktinfo*) CMSG_DATA(cmptr))->ipi6_addr;
|
if_index = ((struct in6_pktinfo*) CMSG_DATA(cmptr))->ipi6_ifindex;
|
}
|
}
|
#endif
|
|
/* enforce available interface configuration */
|
|
if (!indextoname(listen->fd, if_index, ifr.ifr_name) ||
|
!iface_check(listen->family, &dst_addr, ifr.ifr_name, &if_index))
|
return;
|
|
if (listen->family == AF_INET && (daemon->options & OPT_LOCALISE) &&
|
ioctl(listen->fd, SIOCGIFNETMASK, &ifr) == -1)
|
return;
|
|
netmask = ((struct sockaddr_in*) &ifr.ifr_addr)->sin_addr;
|
}
|
|
if (extract_request(header, (size_t) n, daemon->namebuff, &type)) {
|
char types[20];
|
|
querystr(types, type);
|
|
if (listen->family == AF_INET)
|
log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
|
(struct all_addr*) &source_addr.in.sin_addr, types);
|
#ifdef HAVE_IPV6
|
else
|
log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
|
(struct all_addr*) &source_addr.in6.sin6_addr, types);
|
#endif
|
}
|
|
m = answer_request(header, ((char*) header) + PACKETSZ, (size_t) n, dst_addr_4, netmask, now);
|
if (m >= 1) {
|
send_from(listen->fd, daemon->options & OPT_NOWILD, (char*) header, m, &source_addr,
|
&dst_addr, if_index);
|
daemon->local_answer++;
|
} else if (forward_query(listen->fd, &source_addr, &dst_addr, if_index, header, (size_t) n, now,
|
NULL))
|
daemon->queries_forwarded++;
|
else
|
daemon->local_answer++;
|
}
|
|
/* The daemon forks before calling this: it should deal with one connection,
|
blocking as neccessary, and then return. Note, need to be a bit careful
|
about resources for debug mode, when the fork is suppressed: that's
|
done by the caller. */
|
unsigned char* tcp_request(int confd, time_t now, struct in_addr local_addr,
|
struct in_addr netmask) {
|
int size = 0;
|
size_t m;
|
unsigned short qtype, gotname;
|
unsigned char c1, c2;
|
/* Max TCP packet + slop */
|
unsigned char* packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ);
|
HEADER* header;
|
struct server* last_server;
|
|
while (1) {
|
if (!packet || !read_write(confd, &c1, 1, 1) || !read_write(confd, &c2, 1, 1) ||
|
!(size = c1 << 8 | c2) || !read_write(confd, packet, size, 1))
|
return packet;
|
|
if (size < (int) sizeof(HEADER)) continue;
|
|
header = (HEADER*) packet;
|
|
if ((gotname = extract_request(header, (unsigned int) size, daemon->namebuff, &qtype))) {
|
union mysockaddr peer_addr;
|
socklen_t peer_len = sizeof(union mysockaddr);
|
|
if (getpeername(confd, (struct sockaddr*) &peer_addr, &peer_len) != -1) {
|
char types[20];
|
|
querystr(types, qtype);
|
|
if (peer_addr.sa.sa_family == AF_INET)
|
log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
|
(struct all_addr*) &peer_addr.in.sin_addr, types);
|
#ifdef HAVE_IPV6
|
else
|
log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
|
(struct all_addr*) &peer_addr.in6.sin6_addr, types);
|
#endif
|
}
|
}
|
|
/* m > 0 if answered from cache */
|
m = answer_request(header, ((char*) header) + 65536, (unsigned int) size, local_addr,
|
netmask, now);
|
|
/* Do this by steam now we're not in the select() loop */
|
check_log_writer(NULL);
|
|
if (m == 0) {
|
unsigned short flags = 0;
|
struct all_addr* addrp = NULL;
|
int type = 0;
|
char* domain = NULL;
|
|
if (gotname)
|
flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain);
|
|
if (type != 0 || (daemon->options & OPT_ORDER) || !daemon->last_server)
|
last_server = daemon->servers;
|
else
|
last_server = daemon->last_server;
|
|
if (!flags && last_server) {
|
struct server* firstsendto = NULL;
|
unsigned int crc = questions_crc(header, (unsigned int) size, daemon->namebuff);
|
|
/* Loop round available servers until we succeed in connecting to one.
|
Note that this code subtley ensures that consecutive queries on this connection
|
which can go to the same server, do so. */
|
while (1) {
|
if (!firstsendto)
|
firstsendto = last_server;
|
else {
|
if (!(last_server = last_server->next)) last_server = daemon->servers;
|
|
if (last_server == firstsendto) break;
|
}
|
|
/* server for wrong domain */
|
if (type != (last_server->flags & SERV_TYPE) ||
|
(type == SERV_HAS_DOMAIN && !hostname_isequal(domain, last_server->domain)))
|
continue;
|
|
if ((last_server->tcpfd == -1) &&
|
(last_server->tcpfd =
|
socket(last_server->addr.sa.sa_family, SOCK_STREAM, 0)) != -1 &&
|
(!local_bind(last_server->tcpfd, &last_server->source_addr,
|
last_server->interface, last_server->mark, 1) ||
|
connect(last_server->tcpfd, &last_server->addr.sa,
|
sa_len(&last_server->addr)) == -1)) {
|
close(last_server->tcpfd);
|
last_server->tcpfd = -1;
|
}
|
|
if (last_server->tcpfd == -1) continue;
|
|
c1 = size >> 8;
|
c2 = size;
|
|
if (!read_write(last_server->tcpfd, &c1, 1, 0) ||
|
!read_write(last_server->tcpfd, &c2, 1, 0) ||
|
!read_write(last_server->tcpfd, packet, size, 0) ||
|
!read_write(last_server->tcpfd, &c1, 1, 1) ||
|
!read_write(last_server->tcpfd, &c2, 1, 1)) {
|
close(last_server->tcpfd);
|
last_server->tcpfd = -1;
|
continue;
|
}
|
|
m = (c1 << 8) | c2;
|
if (!read_write(last_server->tcpfd, packet, m, 1)) return packet;
|
|
if (!gotname) strcpy(daemon->namebuff, "query");
|
if (last_server->addr.sa.sa_family == AF_INET)
|
log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
|
(struct all_addr*) &last_server->addr.in.sin_addr, NULL);
|
#ifdef HAVE_IPV6
|
else
|
log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
|
(struct all_addr*) &last_server->addr.in6.sin6_addr, NULL);
|
#endif
|
|
/* There's no point in updating the cache, since this process will exit and
|
lose the information after a few queries. We make this call for the alias and
|
bogus-nxdomain side-effects. */
|
/* If the crc of the question section doesn't match the crc we sent, then
|
someone might be attempting to insert bogus values into the cache by
|
sending replies containing questions and bogus answers. */
|
if (crc == questions_crc(header, (unsigned int) m, daemon->namebuff))
|
m = process_reply(header, now, last_server, (unsigned int) m);
|
|
break;
|
}
|
}
|
|
/* In case of local answer or no connections made. */
|
if (m == 0)
|
m = setup_reply(header, (unsigned int) size, addrp, flags, daemon->local_ttl);
|
}
|
|
check_log_writer(NULL);
|
|
c1 = m >> 8;
|
c2 = m;
|
if (!read_write(confd, &c1, 1, 0) || !read_write(confd, &c2, 1, 0) ||
|
!read_write(confd, packet, m, 0))
|
return packet;
|
}
|
}
|
|
static struct frec* allocate_frec(time_t now) {
|
struct frec* f;
|
|
if ((f = (struct frec*) whine_malloc(sizeof(struct frec)))) {
|
f->next = daemon->frec_list;
|
f->time = now;
|
f->sentto = NULL;
|
f->rfd4 = NULL;
|
#ifdef HAVE_IPV6
|
f->rfd6 = NULL;
|
#endif
|
daemon->frec_list = f;
|
}
|
|
return f;
|
}
|
|
static struct randfd* allocate_rfd(int family) {
|
static int finger = 0;
|
int i;
|
|
/* limit the number of sockets we have open to avoid starvation of
|
(eg) TFTP. Once we have a reasonable number, randomness should be OK */
|
|
for (i = 0; i < RANDOM_SOCKS; i++)
|
if (daemon->randomsocks[i].refcount == 0) {
|
if ((daemon->randomsocks[i].fd = random_sock(family)) == -1) break;
|
|
daemon->randomsocks[i].refcount = 1;
|
daemon->randomsocks[i].family = family;
|
return &daemon->randomsocks[i];
|
}
|
|
/* No free ones or cannot get new socket, grab an existing one */
|
for (i = 0; i < RANDOM_SOCKS; i++) {
|
int j = (i + finger) % RANDOM_SOCKS;
|
if (daemon->randomsocks[j].refcount != 0 && daemon->randomsocks[j].family == family &&
|
daemon->randomsocks[j].refcount != 0xffff) {
|
finger = j;
|
daemon->randomsocks[j].refcount++;
|
return &daemon->randomsocks[j];
|
}
|
}
|
|
return NULL; /* doom */
|
}
|
|
static void free_frec(struct frec* f) {
|
if (f->rfd4 && --(f->rfd4->refcount) == 0) close(f->rfd4->fd);
|
|
f->rfd4 = NULL;
|
f->sentto = NULL;
|
|
#ifdef HAVE_IPV6
|
if (f->rfd6 && --(f->rfd6->refcount) == 0) close(f->rfd6->fd);
|
|
f->rfd6 = NULL;
|
#endif
|
}
|
|
/* if wait==NULL return a free or older than TIMEOUT record.
|
else return *wait zero if one available, or *wait is delay to
|
when the oldest in-use record will expire. Impose an absolute
|
limit of 4*TIMEOUT before we wipe things (for random sockets) */
|
struct frec* get_new_frec(time_t now, int* wait) {
|
struct frec *f, *oldest, *target;
|
int count;
|
|
if (wait) *wait = 0;
|
|
for (f = daemon->frec_list, oldest = NULL, target = NULL, count = 0; f; f = f->next, count++)
|
if (!f->sentto)
|
target = f;
|
else {
|
if (difftime(now, f->time) >= 4 * TIMEOUT) {
|
free_frec(f);
|
target = f;
|
}
|
|
if (!oldest || difftime(f->time, oldest->time) <= 0) oldest = f;
|
}
|
|
if (target) {
|
target->time = now;
|
return target;
|
}
|
|
/* can't find empty one, use oldest if there is one
|
and it's older than timeout */
|
if (oldest && ((int) difftime(now, oldest->time)) >= TIMEOUT) {
|
/* keep stuff for twice timeout if we can by allocating a new
|
record instead */
|
if (difftime(now, oldest->time) < 2 * TIMEOUT && count <= daemon->ftabsize &&
|
(f = allocate_frec(now)))
|
return f;
|
|
if (!wait) {
|
free_frec(oldest);
|
oldest->time = now;
|
}
|
return oldest;
|
}
|
|
/* none available, calculate time 'till oldest record expires */
|
if (count > daemon->ftabsize) {
|
if (oldest && wait) *wait = oldest->time + (time_t) TIMEOUT - now;
|
return NULL;
|
}
|
|
if (!(f = allocate_frec(now)) && wait) /* wait one second on malloc failure */
|
*wait = 1;
|
|
return f; /* OK if malloc fails and this is NULL */
|
}
|
|
/* crc is all-ones if not known. */
|
static struct frec* lookup_frec(unsigned short id, unsigned int crc) {
|
struct frec* f;
|
|
for (f = daemon->frec_list; f; f = f->next)
|
if (f->sentto && f->new_id == id && (f->crc == crc || crc == 0xffffffff)) return f;
|
|
return NULL;
|
}
|
|
static struct frec* lookup_frec_by_sender(unsigned short id, union mysockaddr* addr,
|
unsigned int crc) {
|
struct frec* f;
|
|
for (f = daemon->frec_list; f; f = f->next)
|
if (f->sentto && f->orig_id == id && f->crc == crc && sockaddr_isequal(&f->source, addr))
|
return f;
|
|
return NULL;
|
}
|
|
/* A server record is going away, remove references to it */
|
void server_gone(struct server* server) {
|
struct frec* f;
|
|
for (f = daemon->frec_list; f; f = f->next)
|
if (f->sentto && f->sentto == server) free_frec(f);
|
|
if (daemon->last_server == server) daemon->last_server = NULL;
|
|
if (daemon->srv_save == server) daemon->srv_save = NULL;
|
}
|
|
/* return unique random ids.
|
For signed packets we can't change the ID without breaking the
|
signing, so we keep the same one. In this case force is set, and this
|
routine degenerates into killing any conflicting forward record. */
|
static unsigned short get_id(int force, unsigned short force_id, unsigned int crc) {
|
unsigned short ret = 0;
|
|
if (force) {
|
struct frec* f = lookup_frec(force_id, crc);
|
if (f) free_frec(f); /* free */
|
ret = force_id;
|
} else
|
do
|
ret = rand16();
|
while (lookup_frec(ret, crc));
|
|
return ret;
|
}
|
