?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Import bind-9.3.4
[dragonfly.git] / contrib / bind-9.3 / lib / dns / resolver.c
bloba56fecfd3ce1ca9926995c49aeedddda488e0fad
1 /*
2 * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
3 * Copyright (C) 1999-2003 Internet Software Consortium.
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
10 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
11 * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
12 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
13 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
14 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
15 * PERFORMANCE OF THIS SOFTWARE.
16 */
17
18 /* $Id: resolver.c,v 1.218.2.18.4.64.4.2 2007/01/11 05:05:10 marka Exp $ */
19
20 #include <config.h>
21
22 #include <isc/print.h>
23 #include <isc/string.h>
24 #include <isc/task.h>
25 #include <isc/timer.h>
26 #include <isc/util.h>
27
28 #include <dns/acl.h>
29 #include <dns/adb.h>
30 #include <dns/cache.h>
31 #include <dns/db.h>
32 #include <dns/dispatch.h>
33 #include <dns/ds.h>
34 #include <dns/events.h>
35 #include <dns/forward.h>
36 #include <dns/keytable.h>
37 #include <dns/log.h>
38 #include <dns/message.h>
39 #include <dns/ncache.h>
40 #include <dns/opcode.h>
41 #include <dns/peer.h>
42 #include <dns/rbt.h>
43 #include <dns/rcode.h>
44 #include <dns/rdata.h>
45 #include <dns/rdataclass.h>
46 #include <dns/rdatalist.h>
47 #include <dns/rdataset.h>
48 #include <dns/rdatastruct.h>
49 #include <dns/rdatatype.h>
50 #include <dns/resolver.h>
51 #include <dns/result.h>
52 #include <dns/rootns.h>
53 #include <dns/tsig.h>
54 #include <dns/validator.h>
55
56 #define DNS_RESOLVER_TRACE
57 #ifdef DNS_RESOLVER_TRACE
58 #define RTRACE(m) isc_log_write(dns_lctx, \
59 DNS_LOGCATEGORY_RESOLVER, \
60 DNS_LOGMODULE_RESOLVER, \
61 ISC_LOG_DEBUG(3), \
62 "res %p: %s", res, (m))
63 #define RRTRACE(r, m) isc_log_write(dns_lctx, \
64 DNS_LOGCATEGORY_RESOLVER, \
65 DNS_LOGMODULE_RESOLVER, \
66 ISC_LOG_DEBUG(3), \
67 "res %p: %s", (r), (m))
68 #define FCTXTRACE(m) isc_log_write(dns_lctx, \
69 DNS_LOGCATEGORY_RESOLVER, \
70 DNS_LOGMODULE_RESOLVER, \
71 ISC_LOG_DEBUG(3), \
72 "fctx %p(%s'): %s", fctx, fctx->info, (m))
73 #define FCTXTRACE2(m1, m2) \
74 isc_log_write(dns_lctx, \
75 DNS_LOGCATEGORY_RESOLVER, \
76 DNS_LOGMODULE_RESOLVER, \
77 ISC_LOG_DEBUG(3), \
78 "fctx %p(%s): %s %s", \
79 fctx, fctx->info, (m1), (m2))
80 #define FTRACE(m) isc_log_write(dns_lctx, \
81 DNS_LOGCATEGORY_RESOLVER, \
82 DNS_LOGMODULE_RESOLVER, \
83 ISC_LOG_DEBUG(3), \
84 "fetch %p (fctx %p(%s)): %s", \
85 fetch, fetch->private, \
86 fetch->private->info, (m))
87 #define QTRACE(m) isc_log_write(dns_lctx, \
88 DNS_LOGCATEGORY_RESOLVER, \
89 DNS_LOGMODULE_RESOLVER, \
90 ISC_LOG_DEBUG(3), \
91 "resquery %p (fctx %p(%s)): %s", \
92 query, query->fctx, \
93 query->fctx->info, (m))
94 #else
95 #define RTRACE(m)
96 #define RRTRACE(r, m)
97 #define FCTXTRACE(m)
98 #define FTRACE(m)
99 #define QTRACE(m)
100 #endif
101
102 /*
103 * Maximum EDNS0 input packet size.
104 */
105 #define RECV_BUFFER_SIZE 4096 /* XXXRTH Constant. */
106
107 /*
108 * This defines the maximum number of timeouts we will permit before we
109 * disable EDNS0 on the query.
110 */
111 #define MAX_EDNS0_TIMEOUTS 3
112
113 typedef struct fetchctx fetchctx_t;
114
115 typedef struct query {
116 /* Locked by task event serialization. */
117 unsigned int magic;
118 fetchctx_t * fctx;
119 isc_mem_t * mctx;
120 dns_dispatchmgr_t * dispatchmgr;
121 dns_dispatch_t * dispatch;
122 dns_adbaddrinfo_t * addrinfo;
123 isc_socket_t * tcpsocket;
124 isc_time_t start;
125 dns_messageid_t id;
126 dns_dispentry_t * dispentry;
127 ISC_LINK(struct query) link;
128 isc_buffer_t buffer;
129 isc_buffer_t *tsig;
130 dns_tsigkey_t *tsigkey;
131 unsigned int options;
132 unsigned int attributes;
133 unsigned int sends;
134 unsigned int connects;
135 unsigned char data[512];
136 } resquery_t;
137
138 #define QUERY_MAGIC ISC_MAGIC('Q', '!', '!', '!')
139 #define VALID_QUERY(query) ISC_MAGIC_VALID(query, QUERY_MAGIC)
140
141 #define RESQUERY_ATTR_CANCELED 0x02
142
143 #define RESQUERY_CONNECTING(q) ((q)->connects > 0)
144 #define RESQUERY_CANCELED(q) (((q)->attributes & \
145 RESQUERY_ATTR_CANCELED) != 0)
146 #define RESQUERY_SENDING(q) ((q)->sends > 0)
147
148 typedef enum {
149 fetchstate_init = 0, /* Start event has not run yet. */
150 fetchstate_active,
151 fetchstate_done /* FETCHDONE events posted. */
152 } fetchstate;
153
154 struct fetchctx {
155 /* Not locked. */
156 unsigned int magic;
157 dns_resolver_t * res;
158 dns_name_t name;
159 dns_rdatatype_t type;
160 unsigned int options;
161 unsigned int bucketnum;
162 char * info;
163 /* Locked by appropriate bucket lock. */
164 fetchstate state;
165 isc_boolean_t want_shutdown;
166 isc_boolean_t cloned;
167 unsigned int references;
168 isc_event_t control_event;
169 ISC_LINK(struct fetchctx) link;
170 ISC_LIST(dns_fetchevent_t) events;
171 /* Locked by task event serialization. */
172 dns_name_t domain;
173 dns_rdataset_t nameservers;
174 unsigned int attributes;
175 isc_timer_t * timer;
176 isc_time_t expires;
177 isc_interval_t interval;
178 dns_message_t * qmessage;
179 dns_message_t * rmessage;
180 ISC_LIST(resquery_t) queries;
181 dns_adbfindlist_t finds;
182 dns_adbfind_t * find;
183 dns_adbfindlist_t altfinds;
184 dns_adbfind_t * altfind;
185 dns_adbaddrinfolist_t forwaddrs;
186 dns_adbaddrinfolist_t altaddrs;
187 isc_sockaddrlist_t forwarders;
188 dns_fwdpolicy_t fwdpolicy;
189 isc_sockaddrlist_t bad;
190 ISC_LIST(dns_validator_t) validators;
191 dns_db_t * cache;
192 dns_adb_t * adb;
193
194 /*
195 * The number of events we're waiting for.
196 */
197 unsigned int pending;
198
199 /*
200 * The number of times we've "restarted" the current
201 * nameserver set. This acts as a failsafe to prevent
202 * us from pounding constantly on a particular set of
203 * servers that, for whatever reason, are not giving
204 * us useful responses, but are responding in such a
205 * way that they are not marked "bad".
206 */
207 unsigned int restarts;
208
209 /*
210 * The number of timeouts that have occurred since we
211 * last successfully received a response packet. This
212 * is used for EDNS0 black hole detection.
213 */
214 unsigned int timeouts;
215 /*
216 * Look aside state for DS lookups.
217 */
218 dns_name_t nsname;
219 dns_fetch_t * nsfetch;
220 dns_rdataset_t nsrrset;
221
222 /*%
223 * Number of queries that reference this context.
224 */
225 unsigned int nqueries;
226 };
227
228 #define FCTX_MAGIC ISC_MAGIC('F', '!', '!', '!')
229 #define VALID_FCTX(fctx) ISC_MAGIC_VALID(fctx, FCTX_MAGIC)
230
231 #define FCTX_ATTR_HAVEANSWER 0x0001
232 #define FCTX_ATTR_GLUING 0x0002
233 #define FCTX_ATTR_ADDRWAIT 0x0004
234 #define FCTX_ATTR_SHUTTINGDOWN 0x0008
235 #define FCTX_ATTR_WANTCACHE 0x0010
236 #define FCTX_ATTR_WANTNCACHE 0x0020
237 #define FCTX_ATTR_NEEDEDNS0 0x0040
238 #define FCTX_ATTR_TRIEDFIND 0x0080
239 #define FCTX_ATTR_TRIEDALT 0x0100
240
241 #define HAVE_ANSWER(f) (((f)->attributes & FCTX_ATTR_HAVEANSWER) != \
242 0)
243 #define GLUING(f) (((f)->attributes & FCTX_ATTR_GLUING) != \
244 0)
245 #define ADDRWAIT(f) (((f)->attributes & FCTX_ATTR_ADDRWAIT) != \
246 0)
247 #define SHUTTINGDOWN(f) (((f)->attributes & FCTX_ATTR_SHUTTINGDOWN) \
248 != 0)
249 #define WANTCACHE(f) (((f)->attributes & FCTX_ATTR_WANTCACHE) != 0)
250 #define WANTNCACHE(f) (((f)->attributes & FCTX_ATTR_WANTNCACHE) != 0)
251 #define NEEDEDNS0(f) (((f)->attributes & FCTX_ATTR_NEEDEDNS0) != 0)
252 #define TRIEDFIND(f) (((f)->attributes & FCTX_ATTR_TRIEDFIND) != 0)
253 #define TRIEDALT(f) (((f)->attributes & FCTX_ATTR_TRIEDALT) != 0)
254
255 typedef struct {
256 dns_adbaddrinfo_t * addrinfo;
257 fetchctx_t * fctx;
258 } dns_valarg_t;
259
260 struct dns_fetch {
261 unsigned int magic;
262 fetchctx_t * private;
263 };
264
265 #define DNS_FETCH_MAGIC ISC_MAGIC('F', 't', 'c', 'h')
266 #define DNS_FETCH_VALID(fetch) ISC_MAGIC_VALID(fetch, DNS_FETCH_MAGIC)
267
268 typedef struct fctxbucket {
269 isc_task_t * task;
270 isc_mutex_t lock;
271 ISC_LIST(fetchctx_t) fctxs;
272 isc_boolean_t exiting;
273 } fctxbucket_t;
274
275 typedef struct alternate {
276 isc_boolean_t isaddress;
277 union {
278 isc_sockaddr_t addr;
279 struct {
280 dns_name_t name;
281 in_port_t port;
282 } _n;
283 } _u;
284 ISC_LINK(struct alternate) link;
285 } alternate_t;
286
287 struct dns_resolver {
288 /* Unlocked. */
289 unsigned int magic;
290 isc_mem_t * mctx;
291 isc_mutex_t lock;
292 isc_mutex_t nlock;
293 isc_mutex_t primelock;
294 dns_rdataclass_t rdclass;
295 isc_socketmgr_t * socketmgr;
296 isc_timermgr_t * timermgr;
297 isc_taskmgr_t * taskmgr;
298 dns_view_t * view;
299 isc_boolean_t frozen;
300 unsigned int options;
301 dns_dispatchmgr_t * dispatchmgr;
302 dns_dispatch_t * dispatchv4;
303 dns_dispatch_t * dispatchv6;
304 unsigned int nbuckets;
305 fctxbucket_t * buckets;
306 isc_uint32_t lame_ttl;
307 ISC_LIST(alternate_t) alternates;
308 isc_uint16_t udpsize;
309 #if USE_ALGLOCK
310 isc_rwlock_t alglock;
311 #endif
312 dns_rbt_t * algorithms;
313 #if USE_MBSLOCK
314 isc_rwlock_t mbslock;
315 #endif
316 dns_rbt_t * mustbesecure;
317 /* Locked by lock. */
318 unsigned int references;
319 isc_boolean_t exiting;
320 isc_eventlist_t whenshutdown;
321 unsigned int activebuckets;
322 isc_boolean_t priming;
323 /* Locked by primelock. */
324 dns_fetch_t * primefetch;
325 /* Locked by nlock. */
326 unsigned int nfctx;
327 };
328
329 #define RES_MAGIC ISC_MAGIC('R', 'e', 's', '!')
330 #define VALID_RESOLVER(res) ISC_MAGIC_VALID(res, RES_MAGIC)
331
332 /*
333 * Private addrinfo flags. These must not conflict with DNS_FETCHOPT_NOEDNS0,
334 * which we also use as an addrinfo flag.
335 */
336 #define FCTX_ADDRINFO_MARK 0x0001
337 #define FCTX_ADDRINFO_FORWARDER 0x1000
338 #define UNMARKED(a) (((a)->flags & FCTX_ADDRINFO_MARK) \
339 == 0)
340 #define ISFORWARDER(a) (((a)->flags & \
341 FCTX_ADDRINFO_FORWARDER) != 0)
342
343 #define NXDOMAIN(r) (((r)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0)
344
345 static void destroy(dns_resolver_t *res);
346 static void empty_bucket(dns_resolver_t *res);
347 static isc_result_t resquery_send(resquery_t *query);
348 static void resquery_response(isc_task_t *task, isc_event_t *event);
349 static void resquery_connected(isc_task_t *task, isc_event_t *event);
350 static void fctx_try(fetchctx_t *fctx);
351 static isc_boolean_t fctx_destroy(fetchctx_t *fctx);
352 static isc_result_t ncache_adderesult(dns_message_t *message,
353 dns_db_t *cache, dns_dbnode_t *node,
354 dns_rdatatype_t covers,
355 isc_stdtime_t now, dns_ttl_t maxttl,
356 dns_rdataset_t *ardataset,
357 isc_result_t *eresultp);
358 static void validated(isc_task_t *task, isc_event_t *event);
359 static void maybe_destroy(fetchctx_t *fctx);
360
361 static isc_result_t
362 valcreate(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, dns_name_t *name,
363 dns_rdatatype_t type, dns_rdataset_t *rdataset,
364 dns_rdataset_t *sigrdataset, unsigned int valoptions,
365 isc_task_t *task)
366 {
367 dns_validator_t *validator = NULL;
368 dns_valarg_t *valarg;
369 isc_result_t result;
370
371 valarg = isc_mem_get(fctx->res->mctx, sizeof(*valarg));
372 if (valarg == NULL)
373 return (ISC_R_NOMEMORY);
374
375 valarg->fctx = fctx;
376 valarg->addrinfo = addrinfo;
377
378 if (!ISC_LIST_EMPTY(fctx->validators))
379 INSIST((valoptions & DNS_VALIDATOR_DEFER) != 0);
380
381 result = dns_validator_create(fctx->res->view, name, type, rdataset,
382 sigrdataset, fctx->rmessage,
383 valoptions, task, validated, valarg,
384 &validator);
385 if (result == ISC_R_SUCCESS)
386 ISC_LIST_APPEND(fctx->validators, validator, link);
387 else
388 isc_mem_put(fctx->res->mctx, valarg, sizeof(*valarg));
389 return (result);
390 }
391
392 static isc_boolean_t
393 fix_mustbedelegationornxdomain(dns_message_t *message, fetchctx_t *fctx) {
394 dns_name_t *name;
395 dns_name_t *domain = &fctx->domain;
396 dns_rdataset_t *rdataset;
397 dns_rdatatype_t type;
398 isc_result_t result;
399 isc_boolean_t keep_auth = ISC_FALSE;
400
401 if (message->rcode == dns_rcode_nxdomain)
402 return (ISC_FALSE);
403
404 /*
405 * Look for BIND 8 style delegations.
406 * Also look for answers to ANY queries where the duplicate NS RRset
407 * may have been stripped from the authority section.
408 */
409 if (message->counts[DNS_SECTION_ANSWER] != 0 &&
410 (fctx->type == dns_rdatatype_ns ||
411 fctx->type == dns_rdatatype_any)) {
412 result = dns_message_firstname(message, DNS_SECTION_ANSWER);
413 while (result == ISC_R_SUCCESS) {
414 name = NULL;
415 dns_message_currentname(message, DNS_SECTION_ANSWER,
416 &name);
417 for (rdataset = ISC_LIST_HEAD(name->list);
418 rdataset != NULL;
419 rdataset = ISC_LIST_NEXT(rdataset, link)) {
420 type = rdataset->type;
421 if (type != dns_rdatatype_ns)
422 continue;
423 if (dns_name_issubdomain(name, domain))
424 return (ISC_FALSE);
425 }
426 result = dns_message_nextname(message,
427 DNS_SECTION_ANSWER);
428 }
429 }
430
431 /* Look for referral. */
432 if (message->counts[DNS_SECTION_AUTHORITY] == 0)
433 goto munge;
434
435 result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
436 while (result == ISC_R_SUCCESS) {
437 name = NULL;
438 dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
439 for (rdataset = ISC_LIST_HEAD(name->list);
440 rdataset != NULL;
441 rdataset = ISC_LIST_NEXT(rdataset, link)) {
442 type = rdataset->type;
443 if (type == dns_rdatatype_soa &&
444 dns_name_equal(name, domain))
445 keep_auth = ISC_TRUE;
446 if (type != dns_rdatatype_ns &&
447 type != dns_rdatatype_soa)
448 continue;
449 if (dns_name_equal(name, domain))
450 goto munge;
451 if (dns_name_issubdomain(name, domain))
452 return (ISC_FALSE);
453 }
454 result = dns_message_nextname(message, DNS_SECTION_AUTHORITY);
455 }
456
457 munge:
458 message->rcode = dns_rcode_nxdomain;
459 message->counts[DNS_SECTION_ANSWER] = 0;
460 if (!keep_auth)
461 message->counts[DNS_SECTION_AUTHORITY] = 0;
462 message->counts[DNS_SECTION_ADDITIONAL] = 0;
463 return (ISC_TRUE);
464 }
465
466 static inline isc_result_t
467 fctx_starttimer(fetchctx_t *fctx) {
468 /*
469 * Start the lifetime timer for fctx.
470 *
471 * This is also used for stopping the idle timer; in that
472 * case we must purge events already posted to ensure that
473 * no further idle events are delivered.
474 */
475 return (isc_timer_reset(fctx->timer, isc_timertype_once,
476 &fctx->expires, NULL, ISC_TRUE));
477 }
478
479 static inline void
480 fctx_stoptimer(fetchctx_t *fctx) {
481 isc_result_t result;
482
483 /*
484 * We don't return a result if resetting the timer to inactive fails
485 * since there's nothing to be done about it. Resetting to inactive
486 * should never fail anyway, since the code as currently written
487 * cannot fail in that case.
488 */
489 result = isc_timer_reset(fctx->timer, isc_timertype_inactive,
490 NULL, NULL, ISC_TRUE);
491 if (result != ISC_R_SUCCESS) {
492 UNEXPECTED_ERROR(__FILE__, __LINE__,
493 "isc_timer_reset(): %s",
494 isc_result_totext(result));
495 }
496 }
497
498
499 static inline isc_result_t
500 fctx_startidletimer(fetchctx_t *fctx) {
501 /*
502 * Start the idle timer for fctx. The lifetime timer continues
503 * to be in effect.
504 */
505 return (isc_timer_reset(fctx->timer, isc_timertype_once,
506 &fctx->expires, &fctx->interval,
507 ISC_FALSE));
508 }
509
510 /*
511 * Stopping the idle timer is equivalent to calling fctx_starttimer(), but
512 * we use fctx_stopidletimer for readability in the code below.
513 */
514 #define fctx_stopidletimer fctx_starttimer
515
516
517 static inline void
518 resquery_destroy(resquery_t **queryp) {
519 resquery_t *query;
520
521 REQUIRE(queryp != NULL);
522 query = *queryp;
523 REQUIRE(!ISC_LINK_LINKED(query, link));
524
525 INSIST(query->tcpsocket == NULL);
526
527 query->fctx->nqueries--;
528 if (SHUTTINGDOWN(query->fctx))
529 maybe_destroy(query->fctx); /* Locks bucket. */
530 query->magic = 0;
531 isc_mem_put(query->mctx, query, sizeof(*query));
532 *queryp = NULL;
533 }
534
535 static void
536 fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp,
537 isc_time_t *finish, isc_boolean_t no_response)
538 {
539 fetchctx_t *fctx;
540 resquery_t *query;
541 unsigned int rtt;
542 unsigned int factor;
543 dns_adbfind_t *find;
544 dns_adbaddrinfo_t *addrinfo;
545
546 query = *queryp;
547 fctx = query->fctx;
548
549 FCTXTRACE("cancelquery");
550
551 REQUIRE(!RESQUERY_CANCELED(query));
552
553 query->attributes |= RESQUERY_ATTR_CANCELED;
554
555 /*
556 * Should we update the RTT?
557 */
558 if (finish != NULL || no_response) {
559 if (finish != NULL) {
560 /*
561 * We have both the start and finish times for this
562 * packet, so we can compute a real RTT.
563 */
564 rtt = (unsigned int)isc_time_microdiff(finish,
565 &query->start);
566 factor = DNS_ADB_RTTADJDEFAULT;
567 } else {
568 /*
569 * We don't have an RTT for this query. Maybe the
570 * packet was lost, or maybe this server is very
571 * slow. We don't know. Increase the RTT.
572 */
573 INSIST(no_response);
574 rtt = query->addrinfo->srtt +
575 (200000 * fctx->restarts);
576 if (rtt > 10000000)
577 rtt = 10000000;
578 /*
579 * Replace the current RTT with our value.
580 */
581 factor = DNS_ADB_RTTADJREPLACE;
582 }
583 dns_adb_adjustsrtt(fctx->adb, query->addrinfo, rtt, factor);
584 }
585
586 /*
587 * Age RTTs of servers not tried.
588 */
589 factor = DNS_ADB_RTTADJAGE;
590 if (finish != NULL)
591 for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs);
592 addrinfo != NULL;
593 addrinfo = ISC_LIST_NEXT(addrinfo, publink))
594 if (UNMARKED(addrinfo))
595 dns_adb_adjustsrtt(fctx->adb, addrinfo,
596 0, factor);
597
598 if (finish != NULL && TRIEDFIND(fctx))
599 for (find = ISC_LIST_HEAD(fctx->finds);
600 find != NULL;
601 find = ISC_LIST_NEXT(find, publink))
602 for (addrinfo = ISC_LIST_HEAD(find->list);
603 addrinfo != NULL;
604 addrinfo = ISC_LIST_NEXT(addrinfo, publink))
605 if (UNMARKED(addrinfo))
606 dns_adb_adjustsrtt(fctx->adb, addrinfo,
607 0, factor);
608
609 if (finish != NULL && TRIEDALT(fctx)) {
610 for (addrinfo = ISC_LIST_HEAD(fctx->altaddrs);
611 addrinfo != NULL;
612 addrinfo = ISC_LIST_NEXT(addrinfo, publink))
613 if (UNMARKED(addrinfo))
614 dns_adb_adjustsrtt(fctx->adb, addrinfo,
615 0, factor);
616 for (find = ISC_LIST_HEAD(fctx->altfinds);
617 find != NULL;
618 find = ISC_LIST_NEXT(find, publink))
619 for (addrinfo = ISC_LIST_HEAD(find->list);
620 addrinfo != NULL;
621 addrinfo = ISC_LIST_NEXT(addrinfo, publink))
622 if (UNMARKED(addrinfo))
623 dns_adb_adjustsrtt(fctx->adb, addrinfo,
624 0, factor);
625 }
626
627 if (query->dispentry != NULL)
628 dns_dispatch_removeresponse(&query->dispentry, deventp);
629
630 ISC_LIST_UNLINK(fctx->queries, query, link);
631
632 if (query->tsig != NULL)
633 isc_buffer_free(&query->tsig);
634
635 if (query->tsigkey != NULL)
636 dns_tsigkey_detach(&query->tsigkey);
637
638 /*
639 * Check for any outstanding socket events. If they exist, cancel
640 * them and let the event handlers finish the cleanup. The resolver
641 * only needs to worry about managing the connect and send events;
642 * the dispatcher manages the recv events.
643 */
644 if (RESQUERY_CONNECTING(query))
645 /*
646 * Cancel the connect.
647 */
648 isc_socket_cancel(query->tcpsocket, NULL,
649 ISC_SOCKCANCEL_CONNECT);
650 else if (RESQUERY_SENDING(query))
651 /*
652 * Cancel the pending send.
653 */
654 isc_socket_cancel(dns_dispatch_getsocket(query->dispatch),
655 NULL, ISC_SOCKCANCEL_SEND);
656
657 if (query->dispatch != NULL)
658 dns_dispatch_detach(&query->dispatch);
659
660 if (! (RESQUERY_CONNECTING(query) || RESQUERY_SENDING(query)))
661 /*
662 * It's safe to destroy the query now.
663 */
664 resquery_destroy(&query);
665 }
666
667 static void
668 fctx_cancelqueries(fetchctx_t *fctx, isc_boolean_t no_response) {
669 resquery_t *query, *next_query;
670
671 FCTXTRACE("cancelqueries");
672
673 for (query = ISC_LIST_HEAD(fctx->queries);
674 query != NULL;
675 query = next_query) {
676 next_query = ISC_LIST_NEXT(query, link);
677 fctx_cancelquery(&query, NULL, NULL, no_response);
678 }
679 }
680
681 static void
682 fctx_cleanupfinds(fetchctx_t *fctx) {
683 dns_adbfind_t *find, *next_find;
684
685 REQUIRE(ISC_LIST_EMPTY(fctx->queries));
686
687 for (find = ISC_LIST_HEAD(fctx->finds);
688 find != NULL;
689 find = next_find) {
690 next_find = ISC_LIST_NEXT(find, publink);
691 ISC_LIST_UNLINK(fctx->finds, find, publink);
692 dns_adb_destroyfind(&find);
693 }
694 fctx->find = NULL;
695 }
696
697 static void
698 fctx_cleanupaltfinds(fetchctx_t *fctx) {
699 dns_adbfind_t *find, *next_find;
700
701 REQUIRE(ISC_LIST_EMPTY(fctx->queries));
702
703 for (find = ISC_LIST_HEAD(fctx->altfinds);
704 find != NULL;
705 find = next_find) {
706 next_find = ISC_LIST_NEXT(find, publink);
707 ISC_LIST_UNLINK(fctx->altfinds, find, publink);
708 dns_adb_destroyfind(&find);
709 }
710 fctx->altfind = NULL;
711 }
712
713 static void
714 fctx_cleanupforwaddrs(fetchctx_t *fctx) {
715 dns_adbaddrinfo_t *addr, *next_addr;
716
717 REQUIRE(ISC_LIST_EMPTY(fctx->queries));
718
719 for (addr = ISC_LIST_HEAD(fctx->forwaddrs);
720 addr != NULL;
721 addr = next_addr) {
722 next_addr = ISC_LIST_NEXT(addr, publink);
723 ISC_LIST_UNLINK(fctx->forwaddrs, addr, publink);
724 dns_adb_freeaddrinfo(fctx->adb, &addr);
725 }
726 }
727
728 static void
729 fctx_cleanupaltaddrs(fetchctx_t *fctx) {
730 dns_adbaddrinfo_t *addr, *next_addr;
731
732 REQUIRE(ISC_LIST_EMPTY(fctx->queries));
733
734 for (addr = ISC_LIST_HEAD(fctx->altaddrs);
735 addr != NULL;
736 addr = next_addr) {
737 next_addr = ISC_LIST_NEXT(addr, publink);
738 ISC_LIST_UNLINK(fctx->altaddrs, addr, publink);
739 dns_adb_freeaddrinfo(fctx->adb, &addr);
740 }
741 }
742
743 static inline void
744 fctx_stopeverything(fetchctx_t *fctx, isc_boolean_t no_response) {
745 FCTXTRACE("stopeverything");
746 fctx_cancelqueries(fctx, no_response);
747 fctx_cleanupfinds(fctx);
748 fctx_cleanupaltfinds(fctx);
749 fctx_cleanupforwaddrs(fctx);
750 fctx_cleanupaltaddrs(fctx);
751 fctx_stoptimer(fctx);
752 }
753
754 static inline void
755 fctx_sendevents(fetchctx_t *fctx, isc_result_t result) {
756 dns_fetchevent_t *event, *next_event;
757 isc_task_t *task;
758
759 /*
760 * Caller must be holding the appropriate bucket lock.
761 */
762 REQUIRE(fctx->state == fetchstate_done);
763
764 FCTXTRACE("sendevents");
765
766 for (event = ISC_LIST_HEAD(fctx->events);
767 event != NULL;
768 event = next_event) {
769 next_event = ISC_LIST_NEXT(event, ev_link);
770 ISC_LIST_UNLINK(fctx->events, event, ev_link);
771 task = event->ev_sender;
772 event->ev_sender = fctx;
773 if (!HAVE_ANSWER(fctx))
774 event->result = result;
775
776 INSIST(result != ISC_R_SUCCESS ||
777 dns_rdataset_isassociated(event->rdataset) ||
778 fctx->type == dns_rdatatype_any ||
779 fctx->type == dns_rdatatype_rrsig ||
780 fctx->type == dns_rdatatype_sig);
781
782 isc_task_sendanddetach(&task, ISC_EVENT_PTR(&event));
783 }
784 }
785
786 static void
787 fctx_done(fetchctx_t *fctx, isc_result_t result) {
788 dns_resolver_t *res;
789 isc_boolean_t no_response;
790
791 FCTXTRACE("done");
792
793 res = fctx->res;
794
795 if (result == ISC_R_SUCCESS)
796 no_response = ISC_TRUE;
797 else
798 no_response = ISC_FALSE;
799 fctx_stopeverything(fctx, no_response);
800
801 LOCK(&res->buckets[fctx->bucketnum].lock);
802
803 fctx->state = fetchstate_done;
804 fctx->attributes &= ~FCTX_ATTR_ADDRWAIT;
805 fctx_sendevents(fctx, result);
806
807 UNLOCK(&res->buckets[fctx->bucketnum].lock);
808 }
809
810 static void
811 resquery_senddone(isc_task_t *task, isc_event_t *event) {
812 isc_socketevent_t *sevent = (isc_socketevent_t *)event;
813 resquery_t *query = event->ev_arg;
814 isc_boolean_t retry = ISC_FALSE;
815 isc_result_t result;
816 fetchctx_t *fctx;
817
818 REQUIRE(event->ev_type == ISC_SOCKEVENT_SENDDONE);
819
820 QTRACE("senddone");
821
822 /*
823 * XXXRTH
824 *
825 * Currently we don't wait for the senddone event before retrying
826 * a query. This means that if we get really behind, we may end
827 * up doing extra work!
828 */
829
830 UNUSED(task);
831
832 INSIST(RESQUERY_SENDING(query));
833
834 query->sends--;
835 fctx = query->fctx;
836
837 if (RESQUERY_CANCELED(query)) {
838 if (query->sends == 0) {
839 /*
840 * This query was canceled while the
841 * isc_socket_sendto() was in progress.
842 */
843 if (query->tcpsocket != NULL)
844 isc_socket_detach(&query->tcpsocket);
845 resquery_destroy(&query);
846 }
847 } else
848 switch (sevent->result) {
849 case ISC_R_SUCCESS:
850 break;
851
852 case ISC_R_HOSTUNREACH:
853 case ISC_R_NETUNREACH:
854 case ISC_R_NOPERM:
855 case ISC_R_ADDRNOTAVAIL:
856 case ISC_R_CONNREFUSED:
857
858 /*
859 * No route to remote.
860 */
861 fctx_cancelquery(&query, NULL, NULL, ISC_TRUE);
862 retry = ISC_TRUE;
863 break;
864
865 default:
866 fctx_cancelquery(&query, NULL, NULL, ISC_FALSE);
867 break;
868 }
869
870 isc_event_free(&event);
871
872 if (retry) {
873 /*
874 * Behave as if the idle timer has expired. For TCP
875 * this may not actually reflect the latest timer.
876 */
877 fctx->attributes &= ~FCTX_ATTR_ADDRWAIT;
878 result = fctx_stopidletimer(fctx);
879 if (result != ISC_R_SUCCESS)
880 fctx_done(fctx, result);
881 else
882 fctx_try(fctx);
883 }
884 }
885
886 static inline isc_result_t
887 fctx_addopt(dns_message_t *message, dns_resolver_t *res) {
888 dns_rdataset_t *rdataset;
889 dns_rdatalist_t *rdatalist;
890 dns_rdata_t *rdata;
891 isc_result_t result;
892
893 rdatalist = NULL;
894 result = dns_message_gettemprdatalist(message, &rdatalist);
895 if (result != ISC_R_SUCCESS)
896 return (result);
897 rdata = NULL;
898 result = dns_message_gettemprdata(message, &rdata);
899 if (result != ISC_R_SUCCESS)
900 return (result);
901 rdataset = NULL;
902 result = dns_message_gettemprdataset(message, &rdataset);
903 if (result != ISC_R_SUCCESS)
904 return (result);
905 dns_rdataset_init(rdataset);
906
907 rdatalist->type = dns_rdatatype_opt;
908 rdatalist->covers = 0;
909
910 /*
911 * Set Maximum UDP buffer size.
912 */
913 rdatalist->rdclass = res->udpsize;
914
915 /*
916 * Set EXTENDED-RCODE, VERSION, and Z to 0, and the DO bit to 1.
917 */
918 rdatalist->ttl = DNS_MESSAGEEXTFLAG_DO;
919
920 /*
921 * No EDNS options.
922 */
923 rdata->data = NULL;
924 rdata->length = 0;
925 rdata->rdclass = rdatalist->rdclass;
926 rdata->type = rdatalist->type;
927 rdata->flags = 0;
928
929 ISC_LIST_INIT(rdatalist->rdata);
930 ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
931 RUNTIME_CHECK(dns_rdatalist_tordataset(rdatalist, rdataset) == ISC_R_SUCCESS);
932
933 return (dns_message_setopt(message, rdataset));
934 }
935
936 static inline void
937 fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
938 unsigned int seconds;
939
940 /*
941 * We retry every 2 seconds the first two times through the address
942 * list, and then we do exponential back-off.
943 */
944 if (fctx->restarts < 3)
945 seconds = 2;
946 else
947 seconds = (2 << (fctx->restarts - 1));
948
949 /*
950 * Double the round-trip time and convert to seconds.
951 */
952 rtt /= 500000;
953
954 /*
955 * Always wait for at least the doubled round-trip time.
956 */
957 if (seconds < rtt)
958 seconds = rtt;
959
960 /*
961 * But don't ever wait for more than 30 seconds.
962 */
963 if (seconds > 30)
964 seconds = 30;
965
966 isc_interval_set(&fctx->interval, seconds, 0);
967 }
968
969 static isc_result_t
970 fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
971 unsigned int options)
972 {
973 dns_resolver_t *res;
974 isc_task_t *task;
975 isc_result_t result;
976 resquery_t *query;
977
978 FCTXTRACE("query");
979
980 res = fctx->res;
981 task = res->buckets[fctx->bucketnum].task;
982
983 fctx_setretryinterval(fctx, addrinfo->srtt);
984 result = fctx_startidletimer(fctx);
985 if (result != ISC_R_SUCCESS)
986 return (result);
987
988 INSIST(ISC_LIST_EMPTY(fctx->validators));
989
990 dns_message_reset(fctx->rmessage, DNS_MESSAGE_INTENTPARSE);
991
992 query = isc_mem_get(res->mctx, sizeof(*query));
993 if (query == NULL) {
994 result = ISC_R_NOMEMORY;
995 goto stop_idle_timer;
996 }
997 query->mctx = res->mctx;
998 query->options = options;
999 query->attributes = 0;
1000 query->sends = 0;
1001 query->connects = 0;
1002 /*
1003 * Note that the caller MUST guarantee that 'addrinfo' will remain
1004 * valid until this query is canceled.
1005 */
1006 query->addrinfo = addrinfo;
1007 TIME_NOW(&query->start);
1008
1009 /*
1010 * If this is a TCP query, then we need to make a socket and
1011 * a dispatch for it here. Otherwise we use the resolver's
1012 * shared dispatch.
1013 */
1014 query->dispatchmgr = res->dispatchmgr;
1015 query->dispatch = NULL;
1016 query->tcpsocket = NULL;
1017 if ((query->options & DNS_FETCHOPT_TCP) != 0) {
1018 isc_sockaddr_t addr;
1019 int pf;
1020
1021 pf = isc_sockaddr_pf(&addrinfo->sockaddr);
1022
1023 switch (pf) {
1024 case PF_INET:
1025 result = dns_dispatch_getlocaladdress(res->dispatchv4,
1026 &addr);
1027 break;
1028 case PF_INET6:
1029 result = dns_dispatch_getlocaladdress(res->dispatchv6,
1030 &addr);
1031 break;
1032 default:
1033 result = ISC_R_NOTIMPLEMENTED;
1034 break;
1035 }
1036 if (result != ISC_R_SUCCESS)
1037 goto cleanup_query;
1038
1039 isc_sockaddr_setport(&addr, 0);
1040
1041 result = isc_socket_create(res->socketmgr, pf,
1042 isc_sockettype_tcp,
1043 &query->tcpsocket);
1044 if (result != ISC_R_SUCCESS)
1045 goto cleanup_query;
1046
1047 #ifndef BROKEN_TCP_BIND_BEFORE_CONNECT
1048 result = isc_socket_bind(query->tcpsocket, &addr);
1049 if (result != ISC_R_SUCCESS)
1050 goto cleanup_socket;
1051 #endif
1052
1053 /*
1054 * A dispatch will be created once the connect succeeds.
1055 */
1056 } else {
1057 switch (isc_sockaddr_pf(&addrinfo->sockaddr)) {
1058 case PF_INET:
1059 dns_dispatch_attach(res->dispatchv4, &query->dispatch);
1060 break;
1061 case PF_INET6:
1062 dns_dispatch_attach(res->dispatchv6, &query->dispatch);
1063 break;
1064 default:
1065 result = ISC_R_NOTIMPLEMENTED;
1066 goto cleanup_query;
1067 }
1068 /*
1069 * We should always have a valid dispatcher here. If we
1070 * don't support a protocol family, then its dispatcher
1071 * will be NULL, but we shouldn't be finding addresses for
1072 * protocol types we don't support, so the dispatcher
1073 * we found should never be NULL.
1074 */
1075 INSIST(query->dispatch != NULL);
1076 }
1077
1078 query->dispentry = NULL;
1079 query->fctx = fctx;
1080 query->tsig = NULL;
1081 query->tsigkey = NULL;
1082 ISC_LINK_INIT(query, link);
1083 query->magic = QUERY_MAGIC;
1084
1085 if ((query->options & DNS_FETCHOPT_TCP) != 0) {
1086 /*
1087 * Connect to the remote server.
1088 *
1089 * XXXRTH Should we attach to the socket?
1090 */
1091 result = isc_socket_connect(query->tcpsocket,
1092 &addrinfo->sockaddr, task,
1093 resquery_connected, query);
1094 if (result != ISC_R_SUCCESS)
1095 goto cleanup_socket;
1096 query->connects++;
1097 QTRACE("connecting via TCP");
1098 } else {
1099 result = resquery_send(query);
1100 if (result != ISC_R_SUCCESS)
1101 goto cleanup_dispatch;
1102 }
1103
1104 ISC_LIST_APPEND(fctx->queries, query, link);
1105 query->fctx->nqueries++;
1106
1107 return (ISC_R_SUCCESS);
1108
1109 cleanup_socket:
1110 isc_socket_detach(&query->tcpsocket);
1111
1112 cleanup_dispatch:
1113 if (query->dispatch != NULL)
1114 dns_dispatch_detach(&query->dispatch);
1115
1116 cleanup_query:
1117 query->magic = 0;
1118 isc_mem_put(res->mctx, query, sizeof(*query));
1119
1120 stop_idle_timer:
1121 RUNTIME_CHECK(fctx_stopidletimer(fctx) == ISC_R_SUCCESS);
1122
1123 return (result);
1124 }
1125
1126 static isc_result_t
1127 resquery_send(resquery_t *query) {
1128 fetchctx_t *fctx;
1129 isc_result_t result;
1130 dns_name_t *qname = NULL;
1131 dns_rdataset_t *qrdataset = NULL;
1132 isc_region_t r;
1133 dns_resolver_t *res;
1134 isc_task_t *task;
1135 isc_socket_t *socket;
1136 isc_buffer_t tcpbuffer;
1137 isc_sockaddr_t *address;
1138 isc_buffer_t *buffer;
1139 isc_netaddr_t ipaddr;
1140 dns_tsigkey_t *tsigkey = NULL;
1141 dns_peer_t *peer = NULL;
1142 isc_boolean_t useedns;
1143 dns_compress_t cctx;
1144 isc_boolean_t cleanup_cctx = ISC_FALSE;
1145 isc_boolean_t secure_domain;
1146
1147 fctx = query->fctx;
1148 QTRACE("send");
1149
1150 res = fctx->res;
1151 task = res->buckets[fctx->bucketnum].task;
1152 address = NULL;
1153
1154 if ((query->options & DNS_FETCHOPT_TCP) != 0) {
1155 /*
1156 * Reserve space for the TCP message length.
1157 */
1158 isc_buffer_init(&tcpbuffer, query->data, sizeof(query->data));
1159 isc_buffer_init(&query->buffer, query->data + 2,
1160 sizeof(query->data) - 2);
1161 buffer = &tcpbuffer;
1162 } else {
1163 isc_buffer_init(&query->buffer, query->data,
1164 sizeof(query->data));
1165 buffer = &query->buffer;
1166 }
1167
1168 result = dns_message_gettempname(fctx->qmessage, &qname);
1169 if (result != ISC_R_SUCCESS)
1170 goto cleanup_temps;
1171 result = dns_message_gettemprdataset(fctx->qmessage, &qrdataset);
1172 if (result != ISC_R_SUCCESS)
1173 goto cleanup_temps;
1174
1175 /*
1176 * Get a query id from the dispatch.
1177 */
1178 result = dns_dispatch_addresponse(query->dispatch,
1179 &query->addrinfo->sockaddr,
1180 task,
1181 resquery_response,
1182 query,
1183 &query->id,
1184 &query->dispentry);
1185 if (result != ISC_R_SUCCESS)
1186 goto cleanup_temps;
1187
1188 fctx->qmessage->opcode = dns_opcode_query;
1189
1190 /*
1191 * Set up question.
1192 */
1193 dns_name_init(qname, NULL);
1194 dns_name_clone(&fctx->name, qname);
1195 dns_rdataset_init(qrdataset);
1196 dns_rdataset_makequestion(qrdataset, res->rdclass, fctx->type);
1197 ISC_LIST_APPEND(qname->list, qrdataset, link);
1198 dns_message_addname(fctx->qmessage, qname, DNS_SECTION_QUESTION);
1199 qname = NULL;
1200 qrdataset = NULL;
1201
1202 /*
1203 * Set RD if the client has requested that we do a recursive query,
1204 * or if we're sending to a forwarder.
1205 */
1206 if ((query->options & DNS_FETCHOPT_RECURSIVE) != 0 ||
1207 ISFORWARDER(query->addrinfo))
1208 fctx->qmessage->flags |= DNS_MESSAGEFLAG_RD;
1209
1210 /*
1211 * Set CD if the client says don't validate or the question is
1212 * under a secure entry point.
1213 */
1214 if ((query->options & DNS_FETCHOPT_NOVALIDATE) == 0) {
1215 result = dns_keytable_issecuredomain(res->view->secroots,
1216 &fctx->name,
1217 &secure_domain);
1218 if (result != ISC_R_SUCCESS)
1219 secure_domain = ISC_FALSE;
1220 if (res->view->dlv != NULL)
1221 secure_domain = ISC_TRUE;
1222 if (secure_domain)
1223 fctx->qmessage->flags |= DNS_MESSAGEFLAG_CD;
1224 } else
1225 fctx->qmessage->flags |= DNS_MESSAGEFLAG_CD;
1226
1227 /*
1228 * We don't have to set opcode because it defaults to query.
1229 */
1230 fctx->qmessage->id = query->id;
1231
1232 /*
1233 * Convert the question to wire format.
1234 */
1235 result = dns_compress_init(&cctx, -1, fctx->res->mctx);
1236 if (result != ISC_R_SUCCESS)
1237 goto cleanup_message;
1238 cleanup_cctx = ISC_TRUE;
1239
1240 result = dns_message_renderbegin(fctx->qmessage, &cctx,
1241 &query->buffer);
1242 if (result != ISC_R_SUCCESS)
1243 goto cleanup_message;
1244
1245 result = dns_message_rendersection(fctx->qmessage,
1246 DNS_SECTION_QUESTION, 0);
1247 if (result != ISC_R_SUCCESS)
1248 goto cleanup_message;
1249
1250 peer = NULL;
1251 isc_netaddr_fromsockaddr(&ipaddr, &query->addrinfo->sockaddr);
1252 (void) dns_peerlist_peerbyaddr(fctx->res->view->peers, &ipaddr, &peer);
1253
1254 /*
1255 * The ADB does not know about servers with "edns no". Check this,
1256 * and then inform the ADB for future use.
1257 */
1258 if ((query->addrinfo->flags & DNS_FETCHOPT_NOEDNS0) == 0 &&
1259 peer != NULL &&
1260 dns_peer_getsupportedns(peer, &useedns) == ISC_R_SUCCESS &&
1261 !useedns)
1262 {
1263 query->options |= DNS_FETCHOPT_NOEDNS0;
1264 dns_adb_changeflags(fctx->adb,
1265 query->addrinfo,
1266 DNS_FETCHOPT_NOEDNS0,
1267 DNS_FETCHOPT_NOEDNS0);
1268 }
1269
1270 /*
1271 * Use EDNS0, unless the caller doesn't want it, or we know that
1272 * the remote server doesn't like it.
1273 */
1274 if (fctx->timeouts >= MAX_EDNS0_TIMEOUTS &&
1275 (query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
1276 query->options |= DNS_FETCHOPT_NOEDNS0;
1277 FCTXTRACE("too many timeouts, disabling EDNS0");
1278 }
1279
1280 if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
1281 if ((query->addrinfo->flags & DNS_FETCHOPT_NOEDNS0) == 0) {
1282 result = fctx_addopt(fctx->qmessage, res);
1283 if (result != ISC_R_SUCCESS) {
1284 /*
1285 * We couldn't add the OPT, but we'll press on.
1286 * We're not using EDNS0, so set the NOEDNS0
1287 * bit.
1288 */
1289 query->options |= DNS_FETCHOPT_NOEDNS0;
1290 }
1291 } else {
1292 /*
1293 * We know this server doesn't like EDNS0, so we
1294 * won't use it. Set the NOEDNS0 bit since we're
1295 * not using EDNS0.
1296 */
1297 query->options |= DNS_FETCHOPT_NOEDNS0;
1298 }
1299 }
1300
1301 /*
1302 * If we need EDNS0 to do this query and aren't using it, we lose.
1303 */
1304 if (NEEDEDNS0(fctx) && (query->options & DNS_FETCHOPT_NOEDNS0) != 0) {
1305 result = DNS_R_SERVFAIL;
1306 goto cleanup_message;
1307 }
1308
1309 /*
1310 * Clear CD if EDNS is not in use.
1311 */
1312 if ((query->options & DNS_FETCHOPT_NOEDNS0) != 0)
1313 fctx->qmessage->flags &= ~DNS_MESSAGEFLAG_CD;
1314
1315 /*
1316 * Add TSIG record tailored to the current recipient.
1317 */
1318 result = dns_view_getpeertsig(fctx->res->view, &ipaddr, &tsigkey);
1319 if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND)
1320 goto cleanup_message;
1321
1322 if (tsigkey != NULL) {
1323 result = dns_message_settsigkey(fctx->qmessage, tsigkey);
1324 dns_tsigkey_detach(&tsigkey);
1325 if (result != ISC_R_SUCCESS)
1326 goto cleanup_message;
1327 }
1328
1329 result = dns_message_rendersection(fctx->qmessage,
1330 DNS_SECTION_ADDITIONAL, 0);
1331 if (result != ISC_R_SUCCESS)
1332 goto cleanup_message;
1333
1334 result = dns_message_renderend(fctx->qmessage);
1335 if (result != ISC_R_SUCCESS)
1336 goto cleanup_message;
1337
1338 dns_compress_invalidate(&cctx);
1339 cleanup_cctx = ISC_FALSE;
1340
1341 if (dns_message_gettsigkey(fctx->qmessage) != NULL) {
1342 dns_tsigkey_attach(dns_message_gettsigkey(fctx->qmessage),
1343 &query->tsigkey);
1344 result = dns_message_getquerytsig(fctx->qmessage,
1345 fctx->res->mctx,
1346 &query->tsig);
1347 if (result != ISC_R_SUCCESS)
1348 goto cleanup_message;
1349 }
1350
1351 /*
1352 * If using TCP, write the length of the message at the beginning
1353 * of the buffer.
1354 */
1355 if ((query->options & DNS_FETCHOPT_TCP) != 0) {
1356 isc_buffer_usedregion(&query->buffer, &r);
1357 isc_buffer_putuint16(&tcpbuffer, (isc_uint16_t)r.length);
1358 isc_buffer_add(&tcpbuffer, r.length);
1359 }
1360
1361 /*
1362 * We're now done with the query message.
1363 */
1364 dns_message_reset(fctx->qmessage, DNS_MESSAGE_INTENTRENDER);
1365
1366 socket = dns_dispatch_getsocket(query->dispatch);
1367 /*
1368 * Send the query!
1369 */
1370 if ((query->options & DNS_FETCHOPT_TCP) == 0)
1371 address = &query->addrinfo->sockaddr;
1372 isc_buffer_usedregion(buffer, &r);
1373
1374 /*
1375 * XXXRTH Make sure we don't send to ourselves! We should probably
1376 * prune out these addresses when we get them from the ADB.
1377 */
1378 result = isc_socket_sendto(socket, &r, task, resquery_senddone,
1379 query, address, NULL);
1380 if (result != ISC_R_SUCCESS)
1381 goto cleanup_message;
1382 query->sends++;
1383 QTRACE("sent");
1384
1385 return (ISC_R_SUCCESS);
1386
1387 cleanup_message:
1388 if (cleanup_cctx)
1389 dns_compress_invalidate(&cctx);
1390
1391 dns_message_reset(fctx->qmessage, DNS_MESSAGE_INTENTRENDER);
1392
1393 /*
1394 * Stop the dispatcher from listening.
1395 */
1396 dns_dispatch_removeresponse(&query->dispentry, NULL);
1397
1398 cleanup_temps:
1399 if (qname != NULL)
1400 dns_message_puttempname(fctx->qmessage, &qname);
1401 if (qrdataset != NULL)
1402 dns_message_puttemprdataset(fctx->qmessage, &qrdataset);
1403
1404 return (result);
1405 }
1406
1407 static void
1408 resquery_connected(isc_task_t *task, isc_event_t *event) {
1409 isc_socketevent_t *sevent = (isc_socketevent_t *)event;
1410 resquery_t *query = event->ev_arg;
1411 isc_boolean_t retry = ISC_FALSE;
1412 isc_result_t result;
1413 unsigned int attrs;
1414 fetchctx_t *fctx;
1415
1416 REQUIRE(event->ev_type == ISC_SOCKEVENT_CONNECT);
1417 REQUIRE(VALID_QUERY(query));
1418
1419 QTRACE("connected");
1420
1421 UNUSED(task);
1422
1423 /*
1424 * XXXRTH
1425 *
1426 * Currently we don't wait for the connect event before retrying
1427 * a query. This means that if we get really behind, we may end
1428 * up doing extra work!
1429 */
1430
1431 query->connects--;
1432 fctx = query->fctx;
1433
1434 if (RESQUERY_CANCELED(query)) {
1435 /*
1436 * This query was canceled while the connect() was in
1437 * progress.
1438 */
1439 isc_socket_detach(&query->tcpsocket);
1440 resquery_destroy(&query);
1441 } else {
1442 switch (sevent->result) {
1443 case ISC_R_SUCCESS:
1444 /*
1445 * We are connected. Create a dispatcher and
1446 * send the query.
1447 */
1448 attrs = 0;
1449 attrs |= DNS_DISPATCHATTR_TCP;
1450 attrs |= DNS_DISPATCHATTR_PRIVATE;
1451 attrs |= DNS_DISPATCHATTR_CONNECTED;
1452 if (isc_sockaddr_pf(&query->addrinfo->sockaddr) ==
1453 AF_INET)
1454 attrs |= DNS_DISPATCHATTR_IPV4;
1455 else
1456 attrs |= DNS_DISPATCHATTR_IPV6;
1457 attrs |= DNS_DISPATCHATTR_MAKEQUERY;
1458
1459 result = dns_dispatch_createtcp(query->dispatchmgr,
1460 query->tcpsocket,
1461 query->fctx->res->taskmgr,
1462 4096, 2, 1, 1, 3, attrs,
1463 &query->dispatch);
1464
1465 /*
1466 * Regardless of whether dns_dispatch_create()
1467 * succeeded or not, we don't need our reference
1468 * to the socket anymore.
1469 */
1470 isc_socket_detach(&query->tcpsocket);
1471
1472 if (result == ISC_R_SUCCESS)
1473 result = resquery_send(query);
1474
1475 if (result != ISC_R_SUCCESS) {
1476 fctx_cancelquery(&query, NULL, NULL,
1477 ISC_FALSE);
1478 fctx_done(fctx, result);
1479 }
1480 break;
1481
1482 case ISC_R_NETUNREACH:
1483 case ISC_R_HOSTUNREACH:
1484 case ISC_R_CONNREFUSED:
1485 case ISC_R_NOPERM:
1486 case ISC_R_ADDRNOTAVAIL:
1487 case ISC_R_CONNECTIONRESET:
1488 /*
1489 * No route to remote.
1490 */
1491 isc_socket_detach(&query->tcpsocket);
1492 fctx_cancelquery(&query, NULL, NULL, ISC_TRUE);
1493 retry = ISC_TRUE;
1494 break;
1495
1496 default:
1497 isc_socket_detach(&query->tcpsocket);
1498 fctx_cancelquery(&query, NULL, NULL, ISC_FALSE);
1499 break;
1500 }
1501 }
1502
1503 isc_event_free(&event);
1504
1505 if (retry) {
1506 /*
1507 * Behave as if the idle timer has expired. For TCP
1508 * connections this may not actually reflect the latest timer.
1509 */
1510 fctx->attributes &= ~FCTX_ATTR_ADDRWAIT;
1511 result = fctx_stopidletimer(fctx);
1512 if (result != ISC_R_SUCCESS)
1513 fctx_done(fctx, result);
1514 else
1515 fctx_try(fctx);
1516 }
1517 }
1518
1519 static void
1520 fctx_finddone(isc_task_t *task, isc_event_t *event) {
1521 fetchctx_t *fctx;
1522 dns_adbfind_t *find;
1523 dns_resolver_t *res;
1524 isc_boolean_t want_try = ISC_FALSE;
1525 isc_boolean_t want_done = ISC_FALSE;
1526 isc_boolean_t bucket_empty = ISC_FALSE;
1527 unsigned int bucketnum;
1528
1529 find = event->ev_sender;
1530 fctx = event->ev_arg;
1531 REQUIRE(VALID_FCTX(fctx));
1532 res = fctx->res;
1533
1534 UNUSED(task);
1535
1536 FCTXTRACE("finddone");
1537
1538 INSIST(fctx->pending > 0);
1539 fctx->pending--;
1540
1541 if (ADDRWAIT(fctx)) {
1542 /*
1543 * The fetch is waiting for a name to be found.
1544 */
1545 INSIST(!SHUTTINGDOWN(fctx));
1546 fctx->attributes &= ~FCTX_ATTR_ADDRWAIT;
1547 if (event->ev_type == DNS_EVENT_ADBMOREADDRESSES)
1548 want_try = ISC_TRUE;
1549 else if (fctx->pending == 0) {
1550 /*
1551 * We've got nothing else to wait for and don't
1552 * know the answer. There's nothing to do but
1553 * fail the fctx.
1554 */
1555 want_done = ISC_TRUE;
1556 }
1557 } else if (SHUTTINGDOWN(fctx) && fctx->pending == 0 &&
1558 fctx->nqueries == 0 && ISC_LIST_EMPTY(fctx->validators)) {
1559 bucketnum = fctx->bucketnum;
1560 LOCK(&res->buckets[bucketnum].lock);
1561 /*
1562 * Note that we had to wait until we had the lock before
1563 * looking at fctx->references.
1564 */
1565 if (fctx->references == 0)
1566 bucket_empty = fctx_destroy(fctx);
1567 UNLOCK(&res->buckets[bucketnum].lock);
1568 }
1569
1570 isc_event_free(&event);
1571 dns_adb_destroyfind(&find);
1572
1573 if (want_try)
1574 fctx_try(fctx);
1575 else if (want_done)
1576 fctx_done(fctx, ISC_R_FAILURE);
1577 else if (bucket_empty)
1578 empty_bucket(res);
1579 }
1580
1581
1582 static inline isc_boolean_t
1583 bad_server(fetchctx_t *fctx, isc_sockaddr_t *address) {
1584 isc_sockaddr_t *sa;
1585
1586 for (sa = ISC_LIST_HEAD(fctx->bad);
1587 sa != NULL;
1588 sa = ISC_LIST_NEXT(sa, link)) {
1589 if (isc_sockaddr_equal(sa, address))
1590 return (ISC_TRUE);
1591 }
1592
1593 return (ISC_FALSE);
1594 }
1595
1596 static inline isc_boolean_t
1597 mark_bad(fetchctx_t *fctx) {
1598 dns_adbfind_t *curr;
1599 dns_adbaddrinfo_t *addrinfo;
1600 isc_boolean_t all_bad = ISC_TRUE;
1601
1602 /*
1603 * Mark all known bad servers, so we don't try to talk to them
1604 * again.
1605 */
1606
1607 /*
1608 * Mark any bad nameservers.
1609 */
1610 for (curr = ISC_LIST_HEAD(fctx->finds);
1611 curr != NULL;
1612 curr = ISC_LIST_NEXT(curr, publink)) {
1613 for (addrinfo = ISC_LIST_HEAD(curr->list);
1614 addrinfo != NULL;
1615 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) {
1616 if (bad_server(fctx, &addrinfo->sockaddr))
1617 addrinfo->flags |= FCTX_ADDRINFO_MARK;
1618 else
1619 all_bad = ISC_FALSE;
1620 }
1621 }
1622
1623 /*
1624 * Mark any bad forwarders.
1625 */
1626 for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs);
1627 addrinfo != NULL;
1628 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) {
1629 if (bad_server(fctx, &addrinfo->sockaddr))
1630 addrinfo->flags |= FCTX_ADDRINFO_MARK;
1631 else
1632 all_bad = ISC_FALSE;
1633 }
1634
1635 /*
1636 * Mark any bad alternates.
1637 */
1638 for (curr = ISC_LIST_HEAD(fctx->altfinds);
1639 curr != NULL;
1640 curr = ISC_LIST_NEXT(curr, publink)) {
1641 for (addrinfo = ISC_LIST_HEAD(curr->list);
1642 addrinfo != NULL;
1643 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) {
1644 if (bad_server(fctx, &addrinfo->sockaddr))
1645 addrinfo->flags |= FCTX_ADDRINFO_MARK;
1646 else
1647 all_bad = ISC_FALSE;
1648 }
1649 }
1650
1651 for (addrinfo = ISC_LIST_HEAD(fctx->altaddrs);
1652 addrinfo != NULL;
1653 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) {
1654 if (bad_server(fctx, &addrinfo->sockaddr))
1655 addrinfo->flags |= FCTX_ADDRINFO_MARK;
1656 else
1657 all_bad = ISC_FALSE;
1658 }
1659
1660 return (all_bad);
1661 }
1662
1663 static void
1664 add_bad(fetchctx_t *fctx, isc_sockaddr_t *address, isc_result_t reason) {
1665 char namebuf[DNS_NAME_FORMATSIZE];
1666 char addrbuf[ISC_SOCKADDR_FORMATSIZE];
1667 char classbuf[64];
1668 char typebuf[64];
1669 char code[64];
1670 isc_buffer_t b;
1671 isc_sockaddr_t *sa;
1672 const char *sep1, *sep2;
1673
1674 if (bad_server(fctx, address)) {
1675 /*
1676 * We already know this server is bad.
1677 */
1678 return;
1679 }
1680
1681 FCTXTRACE("add_bad");
1682
1683 sa = isc_mem_get(fctx->res->mctx, sizeof(*sa));
1684 if (sa == NULL)
1685 return;
1686 *sa = *address;
1687 ISC_LIST_INITANDAPPEND(fctx->bad, sa, link);
1688
1689 if (reason == DNS_R_LAME) /* already logged */
1690 return;
1691
1692 if (reason == DNS_R_UNEXPECTEDRCODE) {
1693 isc_buffer_init(&b, code, sizeof(code) - 1);
1694 dns_rcode_totext(fctx->rmessage->rcode, &b);
1695 code[isc_buffer_usedlength(&b)] = '\0';
1696 sep1 = "(";
1697 sep2 = ") ";
1698 } else if (reason == DNS_R_UNEXPECTEDOPCODE) {
1699 isc_buffer_init(&b, code, sizeof(code) - 1);
1700 dns_opcode_totext((dns_opcode_t)fctx->rmessage->opcode, &b);
1701 code[isc_buffer_usedlength(&b)] = '\0';
1702 sep1 = "(";
1703 sep2 = ") ";
1704 } else {
1705 code[0] = '\0';
1706 sep1 = "";
1707 sep2 = "";
1708 }
1709 dns_name_format(&fctx->name, namebuf, sizeof(namebuf));
1710 dns_rdatatype_format(fctx->type, typebuf, sizeof(typebuf));
1711 dns_rdataclass_format(fctx->res->rdclass, classbuf, sizeof(classbuf));
1712 isc_sockaddr_format(address, addrbuf, sizeof(addrbuf));
1713 isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS,
1714 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
1715 "%s %s%s%sresolving '%s/%s/%s': %s",
1716 dns_result_totext(reason), sep1, code, sep2,
1717 namebuf, typebuf, classbuf, addrbuf);
1718 }
1719
1720 static void
1721 sort_adbfind(dns_adbfind_t *find) {
1722 dns_adbaddrinfo_t *best, *curr;
1723 dns_adbaddrinfolist_t sorted;
1724
1725 /*
1726 * Lame N^2 bubble sort.
1727 */
1728
1729 ISC_LIST_INIT(sorted);
1730 while (!ISC_LIST_EMPTY(find->list)) {
1731 best = ISC_LIST_HEAD(find->list);
1732 curr = ISC_LIST_NEXT(best, publink);
1733 while (curr != NULL) {
1734 if (curr->srtt < best->srtt)
1735 best = curr;
1736 curr = ISC_LIST_NEXT(curr, publink);
1737 }
1738 ISC_LIST_UNLINK(find->list, best, publink);
1739 ISC_LIST_APPEND(sorted, best, publink);
1740 }
1741 find->list = sorted;
1742 }
1743
1744 static void
1745 sort_finds(fetchctx_t *fctx) {
1746 dns_adbfind_t *best, *curr;
1747 dns_adbfindlist_t sorted;
1748 dns_adbaddrinfo_t *addrinfo, *bestaddrinfo;
1749
1750 /*
1751 * Lame N^2 bubble sort.
1752 */
1753
1754 ISC_LIST_INIT(sorted);
1755 while (!ISC_LIST_EMPTY(fctx->finds)) {
1756 best = ISC_LIST_HEAD(fctx->finds);
1757 bestaddrinfo = ISC_LIST_HEAD(best->list);
1758 INSIST(bestaddrinfo != NULL);
1759 curr = ISC_LIST_NEXT(best, publink);
1760 while (curr != NULL) {
1761 addrinfo = ISC_LIST_HEAD(curr->list);
1762 INSIST(addrinfo != NULL);
1763 if (addrinfo->srtt < bestaddrinfo->srtt) {
1764 best = curr;
1765 bestaddrinfo = addrinfo;
1766 }
1767 curr = ISC_LIST_NEXT(curr, publink);
1768 }
1769 ISC_LIST_UNLINK(fctx->finds, best, publink);
1770 ISC_LIST_APPEND(sorted, best, publink);
1771 }
1772 fctx->finds = sorted;
1773
1774 ISC_LIST_INIT(sorted);
1775 while (!ISC_LIST_EMPTY(fctx->altfinds)) {
1776 best = ISC_LIST_HEAD(fctx->altfinds);
1777 bestaddrinfo = ISC_LIST_HEAD(best->list);
1778 INSIST(bestaddrinfo != NULL);
1779 curr = ISC_LIST_NEXT(best, publink);
1780 while (curr != NULL) {
1781 addrinfo = ISC_LIST_HEAD(curr->list);
1782 INSIST(addrinfo != NULL);
1783 if (addrinfo->srtt < bestaddrinfo->srtt) {
1784 best = curr;
1785 bestaddrinfo = addrinfo;
1786 }
1787 curr = ISC_LIST_NEXT(curr, publink);
1788 }
1789 ISC_LIST_UNLINK(fctx->altfinds, best, publink);
1790 ISC_LIST_APPEND(sorted, best, publink);
1791 }
1792 fctx->altfinds = sorted;
1793 }
1794
1795 static void
1796 findname(fetchctx_t *fctx, dns_name_t *name, in_port_t port,
1797 unsigned int options, unsigned int flags, isc_stdtime_t now,
1798 isc_boolean_t *pruned, isc_boolean_t *need_alternate)
1799 {
1800 dns_adbaddrinfo_t *ai;
1801 dns_adbfind_t *find;
1802 dns_resolver_t *res;
1803 isc_boolean_t unshared;
1804 isc_result_t result;
1805
1806 res = fctx->res;
1807 unshared = ISC_TF((fctx->options | DNS_FETCHOPT_UNSHARED) != 0);
1808 /*
1809 * If this name is a subdomain of the query domain, tell
1810 * the ADB to start looking using zone/hint data. This keeps us
1811 * from getting stuck if the nameserver is beneath the zone cut
1812 * and we don't know its address (e.g. because the A record has
1813 * expired).
1814 */
1815 if (dns_name_issubdomain(name, &fctx->domain))
1816 options |= DNS_ADBFIND_STARTATZONE;
1817 options |= DNS_ADBFIND_GLUEOK;
1818 options |= DNS_ADBFIND_HINTOK;
1819
1820 /*
1821 * See what we know about this address.
1822 */
1823 find = NULL;
1824 result = dns_adb_createfind(fctx->adb,
1825 res->buckets[fctx->bucketnum].task,
1826 fctx_finddone, fctx, name,
1827 &fctx->domain, options, now, NULL,
1828 res->view->dstport, &find);
1829 if (result != ISC_R_SUCCESS) {
1830 if (result == DNS_R_ALIAS) {
1831 /*
1832 * XXXRTH Follow the CNAME/DNAME chain?
1833 */
1834 dns_adb_destroyfind(&find);
1835 }
1836 } else if (!ISC_LIST_EMPTY(find->list)) {
1837 /*
1838 * We have at least some of the addresses for the
1839 * name.
1840 */
1841 INSIST((find->options & DNS_ADBFIND_WANTEVENT) == 0);
1842 sort_adbfind(find);
1843 if (flags != 0 || port != 0) {
1844 for (ai = ISC_LIST_HEAD(find->list);
1845 ai != NULL;
1846 ai = ISC_LIST_NEXT(ai, publink)) {
1847 ai->flags |= flags;
1848 if (port != 0)
1849 isc_sockaddr_setport(&ai->sockaddr,
1850 port);
1851 }
1852 }
1853 if ((flags & FCTX_ADDRINFO_FORWARDER) != 0)
1854 ISC_LIST_APPEND(fctx->altfinds, find, publink);
1855 else
1856 ISC_LIST_APPEND(fctx->finds, find, publink);
1857 } else {
1858 /*
1859 * We don't know any of the addresses for this
1860 * name.
1861 */
1862 if ((find->options & DNS_ADBFIND_WANTEVENT) != 0) {
1863 /*
1864 * We're looking for them and will get an
1865 * event about it later.
1866 */
1867 fctx->pending++;
1868 /*
1869 * Bootstrap.
1870 */
1871 if (need_alternate != NULL &&
1872 !*need_alternate && unshared &&
1873 ((res->dispatchv4 == NULL &&
1874 find->result_v6 != DNS_R_NXDOMAIN) ||
1875 (res->dispatchv6 == NULL &&
1876 find->result_v4 != DNS_R_NXDOMAIN)))
1877 *need_alternate = ISC_TRUE;
1878 } else {
1879 /*
1880 * If we know there are no addresses for
1881 * the family we are using then try to add
1882 * an alternative server.
1883 */
1884 if (need_alternate != NULL && !*need_alternate &&
1885 ((res->dispatchv4 == NULL &&
1886 find->result_v6 == DNS_R_NXRRSET) ||
1887 (res->dispatchv6 == NULL &&
1888 find->result_v4 == DNS_R_NXRRSET)))
1889 *need_alternate = ISC_TRUE;
1890 /*
1891 * And ADB isn't going to send us any events
1892 * either. This find loses.
1893 */
1894 if ((find->options & DNS_ADBFIND_LAMEPRUNED) != 0) {
1895 /*
1896 * The ADB pruned lame servers for
1897 * this name. Remember that in case
1898 * we get desperate later on.
1899 */
1900 *pruned = ISC_TRUE;
1901 }
1902 dns_adb_destroyfind(&find);
1903 }
1904 }
1905 }
1906
1907 static isc_result_t
1908 fctx_getaddresses(fetchctx_t *fctx) {
1909 dns_rdata_t rdata = DNS_RDATA_INIT;
1910 isc_result_t result;
1911 dns_resolver_t *res;
1912 isc_stdtime_t now;
1913 unsigned int stdoptions;
1914 isc_sockaddr_t *sa;
1915 dns_adbaddrinfo_t *ai;
1916 isc_boolean_t pruned, all_bad;
1917 dns_rdata_ns_t ns;
1918 isc_boolean_t need_alternate = ISC_FALSE;
1919
1920 FCTXTRACE("getaddresses");
1921
1922 /*
1923 * Don't pound on remote servers. (Failsafe!)
1924 */
1925 fctx->restarts++;
1926 if (fctx->restarts > 10) {
1927 FCTXTRACE("too many restarts");
1928 return (DNS_R_SERVFAIL);
1929 }
1930
1931 res = fctx->res;
1932 pruned = ISC_FALSE;
1933 stdoptions = 0; /* Keep compiler happy. */
1934
1935 /*
1936 * Forwarders.
1937 */
1938
1939 INSIST(ISC_LIST_EMPTY(fctx->forwaddrs));
1940 INSIST(ISC_LIST_EMPTY(fctx->altaddrs));
1941
1942 /*
1943 * If this fctx has forwarders, use them; otherwise use any
1944 * selective forwarders specified in the view; otherwise use the
1945 * resolver's forwarders (if any).
1946 */
1947 sa = ISC_LIST_HEAD(fctx->forwarders);
1948 if (sa == NULL) {
1949 dns_forwarders_t *forwarders = NULL;
1950 dns_name_t *name = &fctx->name;
1951 dns_name_t suffix;
1952 unsigned int labels;
1953
1954 /*
1955 * DS records are found in the parent server.
1956 * Strip label to get the correct forwarder (if any).
1957 */
1958 if (fctx->type == dns_rdatatype_ds &&
1959 dns_name_countlabels(name) > 1) {
1960 dns_name_init(&suffix, NULL);
1961 labels = dns_name_countlabels(name);
1962 dns_name_getlabelsequence(name, 1, labels - 1, &suffix);
1963 name = &suffix;
1964 }
1965 result = dns_fwdtable_find(fctx->res->view->fwdtable, name,
1966 &forwarders);
1967 if (result == ISC_R_SUCCESS) {
1968 sa = ISC_LIST_HEAD(forwarders->addrs);
1969 fctx->fwdpolicy = forwarders->fwdpolicy;
1970 }
1971 }
1972
1973 while (sa != NULL) {
1974 ai = NULL;
1975 result = dns_adb_findaddrinfo(fctx->adb,
1976 sa, &ai, 0); /* XXXMLG */
1977 if (result == ISC_R_SUCCESS) {
1978 dns_adbaddrinfo_t *cur;
1979 ai->flags |= FCTX_ADDRINFO_FORWARDER;
1980 cur = ISC_LIST_HEAD(fctx->forwaddrs);
1981 while (cur != NULL && cur->srtt < ai->srtt)
1982 cur = ISC_LIST_NEXT(cur, publink);
1983 if (cur != NULL)
1984 ISC_LIST_INSERTBEFORE(fctx->forwaddrs, cur,
1985 ai, publink);
1986 else
1987 ISC_LIST_APPEND(fctx->forwaddrs, ai, publink);
1988 }
1989 sa = ISC_LIST_NEXT(sa, link);
1990 }
1991
1992 /*
1993 * If the forwarding policy is "only", we don't need the addresses
1994 * of the nameservers.
1995 */
1996 if (fctx->fwdpolicy == dns_fwdpolicy_only)
1997 goto out;
1998
1999 /*
2000 * Normal nameservers.
2001 */
2002
2003 stdoptions = DNS_ADBFIND_WANTEVENT | DNS_ADBFIND_EMPTYEVENT;
2004 if (fctx->restarts == 1) {
2005 /*
2006 * To avoid sending out a flood of queries likely to
2007 * result in NXRRSET, we suppress fetches for address
2008 * families we don't have the first time through,
2009 * provided that we have addresses in some family we
2010 * can use.
2011 *
2012 * We don't want to set this option all the time, since
2013 * if fctx->restarts > 1, we've clearly been having trouble
2014 * with the addresses we had, so getting more could help.
2015 */
2016 stdoptions |= DNS_ADBFIND_AVOIDFETCHES;
2017 }
2018 if (res->dispatchv4 != NULL)
2019 stdoptions |= DNS_ADBFIND_INET;
2020 if (res->dispatchv6 != NULL)
2021 stdoptions |= DNS_ADBFIND_INET6;
2022 isc_stdtime_get(&now);
2023
2024 restart:
2025 INSIST(ISC_LIST_EMPTY(fctx->finds));
2026 INSIST(ISC_LIST_EMPTY(fctx->altfinds));
2027
2028 for (result = dns_rdataset_first(&fctx->nameservers);
2029 result == ISC_R_SUCCESS;
2030 result = dns_rdataset_next(&fctx->nameservers))
2031 {
2032 dns_rdataset_current(&fctx->nameservers, &rdata);
2033 /*
2034 * Extract the name from the NS record.
2035 */
2036 result = dns_rdata_tostruct(&rdata, &ns, NULL);
2037 if (result != ISC_R_SUCCESS)
2038 continue;
2039
2040 findname(fctx, &ns.name, 0, stdoptions, 0, now,
2041 &pruned, &need_alternate);
2042 dns_rdata_reset(&rdata);
2043 dns_rdata_freestruct(&ns);
2044 }
2045 if (result != ISC_R_NOMORE)
2046 return (result);
2047
2048 /*
2049 * Do we need to use 6 to 4?
2050 */
2051 if (need_alternate) {
2052 int family;
2053 alternate_t *a;
2054 family = (res->dispatchv6 != NULL) ? AF_INET6 : AF_INET;
2055 for (a = ISC_LIST_HEAD(fctx->res->alternates);
2056 a != NULL;
2057 a = ISC_LIST_NEXT(a, link)) {
2058 if (!a->isaddress) {
2059 findname(fctx, &a->_u._n.name, a->_u._n.port,
2060 stdoptions, FCTX_ADDRINFO_FORWARDER,
2061 now, &pruned, NULL);
2062 continue;
2063 }
2064 if (isc_sockaddr_pf(&a->_u.addr) != family)
2065 continue;
2066 ai = NULL;
2067 result = dns_adb_findaddrinfo(fctx->adb, &a->_u.addr,
2068 &ai, 0);
2069 if (result == ISC_R_SUCCESS) {
2070 dns_adbaddrinfo_t *cur;
2071 ai->flags |= FCTX_ADDRINFO_FORWARDER;
2072 cur = ISC_LIST_HEAD(fctx->altaddrs);
2073 while (cur != NULL && cur->srtt < ai->srtt)
2074 cur = ISC_LIST_NEXT(cur, publink);
2075 if (cur != NULL)
2076 ISC_LIST_INSERTBEFORE(fctx->altaddrs,
2077 cur, ai, publink);
2078 else
2079 ISC_LIST_APPEND(fctx->altaddrs, ai,
2080 publink);
2081 }
2082 }
2083 }
2084
2085 out:
2086 /*
2087 * Mark all known bad servers.
2088 */
2089 all_bad = mark_bad(fctx);
2090
2091 /*
2092 * How are we doing?
2093 */
2094 if (all_bad) {
2095 /*
2096 * We've got no addresses.
2097 */
2098 if (fctx->pending > 0) {
2099 /*
2100 * We're fetching the addresses, but don't have any
2101 * yet. Tell the caller to wait for an answer.
2102 */
2103 result = DNS_R_WAIT;
2104 } else if (pruned) {
2105 /*
2106 * Some addresses were removed by lame pruning.
2107 * Turn pruning off and try again.
2108 */
2109 FCTXTRACE("restarting with returnlame");
2110 INSIST((stdoptions & DNS_ADBFIND_RETURNLAME) == 0);
2111 stdoptions |= DNS_ADBFIND_RETURNLAME;
2112 pruned = ISC_FALSE;
2113 fctx_cleanupaltfinds(fctx);
2114 fctx_cleanupfinds(fctx);
2115 goto restart;
2116 } else {
2117 /*
2118 * We've lost completely. We don't know any
2119 * addresses, and the ADB has told us it can't get
2120 * them.
2121 */
2122 FCTXTRACE("no addresses");
2123 result = ISC_R_FAILURE;
2124 }
2125 } else {
2126 /*
2127 * We've found some addresses. We might still be looking
2128 * for more addresses.
2129 */
2130 sort_finds(fctx);
2131 result = ISC_R_SUCCESS;
2132 }
2133
2134 return (result);
2135 }
2136
2137 static inline void
2138 possibly_mark(fetchctx_t *fctx, dns_adbaddrinfo_t *addr)
2139 {
2140 isc_netaddr_t na;
2141 char buf[ISC_NETADDR_FORMATSIZE];
2142 isc_sockaddr_t *sa;
2143 isc_boolean_t aborted = ISC_FALSE;
2144 isc_boolean_t bogus;
2145 dns_acl_t *blackhole;
2146 isc_netaddr_t ipaddr;
2147 dns_peer_t *peer = NULL;
2148 dns_resolver_t *res;
2149 const char *msg = NULL;
2150
2151 sa = &addr->sockaddr;
2152
2153 res = fctx->res;
2154 isc_netaddr_fromsockaddr(&ipaddr, sa);
2155 blackhole = dns_dispatchmgr_getblackhole(res->dispatchmgr);
2156 (void) dns_peerlist_peerbyaddr(res->view->peers, &ipaddr, &peer);
2157
2158 if (blackhole != NULL) {
2159 int match;
2160
2161 if (dns_acl_match(&ipaddr, NULL, blackhole,
2162 &res->view->aclenv,
2163 &match, NULL) == ISC_R_SUCCESS &&
2164 match > 0)
2165 aborted = ISC_TRUE;
2166 }
2167
2168 if (peer != NULL &&
2169 dns_peer_getbogus(peer, &bogus) == ISC_R_SUCCESS &&
2170 bogus)
2171 aborted = ISC_TRUE;
2172
2173 if (aborted) {
2174 addr->flags |= FCTX_ADDRINFO_MARK;
2175 msg = "ignoring blackholed / bogus server: ";
2176 } else if (isc_sockaddr_ismulticast(sa)) {
2177 addr->flags |= FCTX_ADDRINFO_MARK;
2178 msg = "ignoring multicast address: ";
2179 } else if (isc_sockaddr_isexperimental(sa)) {
2180 addr->flags |= FCTX_ADDRINFO_MARK;
2181 msg = "ignoring experimental address: ";
2182 } else if (sa->type.sa.sa_family != AF_INET6) {
2183 return;
2184 } else if (IN6_IS_ADDR_V4MAPPED(&sa->type.sin6.sin6_addr)) {
2185 addr->flags |= FCTX_ADDRINFO_MARK;
2186 msg = "ignoring IPv6 mapped IPV4 address: ";
2187 } else if (IN6_IS_ADDR_V4COMPAT(&sa->type.sin6.sin6_addr)) {
2188 addr->flags |= FCTX_ADDRINFO_MARK;
2189 msg = "ignoring IPv6 compatibility IPV4 address: ";
2190 } else
2191 return;
2192
2193 if (!isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3)))
2194 return;
2195
2196 isc_netaddr_fromsockaddr(&na, sa);
2197 isc_netaddr_format(&na, buf, sizeof(buf));
2198 FCTXTRACE2(msg, buf);
2199 }
2200
2201 static inline dns_adbaddrinfo_t *
2202 fctx_nextaddress(fetchctx_t *fctx) {
2203 dns_adbfind_t *find, *start;
2204 dns_adbaddrinfo_t *addrinfo;
2205 dns_adbaddrinfo_t *faddrinfo;
2206
2207 /*
2208 * Return the next untried address, if any.
2209 */
2210
2211 /*
2212 * Find the first unmarked forwarder (if any).
2213 */
2214 for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs);
2215 addrinfo != NULL;
2216 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) {
2217 if (!UNMARKED(addrinfo))
2218 continue;
2219 possibly_mark(fctx, addrinfo);
2220 if (UNMARKED(addrinfo)) {
2221 addrinfo->flags |= FCTX_ADDRINFO_MARK;
2222 fctx->find = NULL;
2223 return (addrinfo);
2224 }
2225 }
2226
2227 /*
2228 * No forwarders. Move to the next find.
2229 */
2230
2231 fctx->attributes |= FCTX_ATTR_TRIEDFIND;
2232
2233 find = fctx->find;
2234 if (find == NULL)
2235 find = ISC_LIST_HEAD(fctx->finds);
2236 else {
2237 find = ISC_LIST_NEXT(find, publink);
2238 if (find == NULL)
2239 find = ISC_LIST_HEAD(fctx->finds);
2240 }
2241
2242 /*
2243 * Find the first unmarked addrinfo.
2244 */
2245 addrinfo = NULL;
2246 if (find != NULL) {
2247 start = find;
2248 do {
2249 for (addrinfo = ISC_LIST_HEAD(find->list);
2250 addrinfo != NULL;
2251 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) {
2252 if (!UNMARKED(addrinfo))
2253 continue;
2254 possibly_mark(fctx, addrinfo);
2255 if (UNMARKED(addrinfo)) {
2256 addrinfo->flags |= FCTX_ADDRINFO_MARK;
2257 break;
2258 }
2259 }
2260 if (addrinfo != NULL)
2261 break;
2262 find = ISC_LIST_NEXT(find, publink);
2263 if (find == NULL)
2264 find = ISC_LIST_HEAD(fctx->finds);
2265 } while (find != start);
2266 }
2267
2268 fctx->find = find;
2269 if (addrinfo != NULL)
2270 return (addrinfo);
2271
2272 /*
2273 * No nameservers left. Try alternates.
2274 */
2275
2276 fctx->attributes |= FCTX_ATTR_TRIEDALT;
2277
2278 find = fctx->altfind;
2279 if (find == NULL)
2280 find = ISC_LIST_HEAD(fctx->altfinds);
2281 else {
2282 find = ISC_LIST_NEXT(find, publink);
2283 if (find == NULL)
2284 find = ISC_LIST_HEAD(fctx->altfinds);
2285 }
2286
2287 /*
2288 * Find the first unmarked addrinfo.
2289 */
2290 addrinfo = NULL;
2291 if (find != NULL) {
2292 start = find;
2293 do {
2294 for (addrinfo = ISC_LIST_HEAD(find->list);
2295 addrinfo != NULL;
2296 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) {
2297 if (!UNMARKED(addrinfo))
2298 continue;
2299 possibly_mark(fctx, addrinfo);
2300 if (UNMARKED(addrinfo)) {
2301 addrinfo->flags |= FCTX_ADDRINFO_MARK;
2302 break;
2303 }
2304 }
2305 if (addrinfo != NULL)
2306 break;
2307 find = ISC_LIST_NEXT(find, publink);
2308 if (find == NULL)
2309 find = ISC_LIST_HEAD(fctx->altfinds);
2310 } while (find != start);
2311 }
2312
2313 faddrinfo = addrinfo;
2314
2315 /*
2316 * See if we have a better alternate server by address.
2317 */
2318
2319 for (addrinfo = ISC_LIST_HEAD(fctx->altaddrs);
2320 addrinfo != NULL;
2321 addrinfo = ISC_LIST_NEXT(addrinfo, publink)) {
2322 if (!UNMARKED(addrinfo))
2323 continue;
2324 possibly_mark(fctx, addrinfo);
2325 if (UNMARKED(addrinfo) &&
2326 (faddrinfo == NULL ||
2327 addrinfo->srtt < faddrinfo->srtt)) {
2328 if (faddrinfo != NULL)
2329 faddrinfo->flags &= ~FCTX_ADDRINFO_MARK;
2330 addrinfo->flags |= FCTX_ADDRINFO_MARK;
2331 break;
2332 }
2333 }
2334
2335 if (addrinfo == NULL) {
2336 addrinfo = faddrinfo;
2337 fctx->altfind = find;
2338 }
2339
2340 return (addrinfo);
2341 }
2342
2343 static void
2344 fctx_try(fetchctx_t *fctx) {
2345 isc_result_t result;
2346 dns_adbaddrinfo_t *addrinfo;
2347
2348 FCTXTRACE("try");
2349
2350 REQUIRE(!ADDRWAIT(fctx));
2351
2352 addrinfo = fctx_nextaddress(fctx);
2353 if (addrinfo == NULL) {
2354 /*
2355 * We have no more addresses. Start over.
2356 */
2357 fctx_cancelqueries(fctx, ISC_TRUE);
2358 fctx_cleanupfinds(fctx);
2359 fctx_cleanupaltfinds(fctx);
2360 fctx_cleanupforwaddrs(fctx);
2361 fctx_cleanupaltaddrs(fctx);
2362 result = fctx_getaddresses(fctx);
2363 if (result == DNS_R_WAIT) {
2364 /*
2365 * Sleep waiting for addresses.
2366 */
2367 FCTXTRACE("addrwait");
2368 fctx->attributes |= FCTX_ATTR_ADDRWAIT;
2369 return;
2370 } else if (result != ISC_R_SUCCESS) {
2371 /*
2372 * Something bad happened.
2373 */
2374 fctx_done(fctx, result);
2375 return;
2376 }
2377
2378 addrinfo = fctx_nextaddress(fctx);
2379 /*
2380 * While we may have addresses from the ADB, they
2381 * might be bad ones. In this case, return SERVFAIL.
2382 */
2383 if (addrinfo == NULL) {
2384 fctx_done(fctx, DNS_R_SERVFAIL);
2385 return;
2386 }
2387 }
2388
2389 result = fctx_query(fctx, addrinfo, fctx->options);
2390 if (result != ISC_R_SUCCESS)
2391 fctx_done(fctx, result);
2392 }
2393
2394 static isc_boolean_t
2395 fctx_destroy(fetchctx_t *fctx) {
2396 dns_resolver_t *res;
2397 unsigned int bucketnum;
2398 isc_sockaddr_t *sa, *next_sa;
2399
2400 /*
2401 * Caller must be holding the bucket lock.
2402 */
2403
2404 REQUIRE(VALID_FCTX(fctx));
2405 REQUIRE(fctx->state == fetchstate_done ||
2406 fctx->state == fetchstate_init);
2407 REQUIRE(ISC_LIST_EMPTY(fctx->events));
2408 REQUIRE(ISC_LIST_EMPTY(fctx->queries));
2409 REQUIRE(ISC_LIST_EMPTY(fctx->finds));
2410 REQUIRE(ISC_LIST_EMPTY(fctx->altfinds));
2411 REQUIRE(fctx->pending == 0);
2412 REQUIRE(fctx->references == 0);
2413 REQUIRE(ISC_LIST_EMPTY(fctx->validators));
2414
2415 FCTXTRACE("destroy");
2416
2417 res = fctx->res;
2418 bucketnum = fctx->bucketnum;
2419
2420 ISC_LIST_UNLINK(res->buckets[bucketnum].fctxs, fctx, link);
2421
2422 /*
2423 * Free bad.
2424 */
2425 for (sa = ISC_LIST_HEAD(fctx->bad);
2426 sa != NULL;
2427 sa = next_sa) {
2428 next_sa = ISC_LIST_NEXT(sa, link);
2429 ISC_LIST_UNLINK(fctx->bad, sa, link);
2430 isc_mem_put(res->mctx, sa, sizeof(*sa));
2431 }
2432
2433 isc_timer_detach(&fctx->timer);
2434 dns_message_destroy(&fctx->rmessage);
2435 dns_message_destroy(&fctx->qmessage);
2436 if (dns_name_countlabels(&fctx->domain) > 0)
2437 dns_name_free(&fctx->domain, res->mctx);
2438 if (dns_rdataset_isassociated(&fctx->nameservers))
2439 dns_rdataset_disassociate(&fctx->nameservers);
2440 dns_name_free(&fctx->name, res->mctx);
2441 dns_db_detach(&fctx->cache);
2442 dns_adb_detach(&fctx->adb);
2443 isc_mem_free(res->mctx, fctx->info);
2444 isc_mem_put(res->mctx, fctx, sizeof(*fctx));
2445
2446 LOCK(&res->nlock);
2447 res->nfctx--;
2448 UNLOCK(&res->nlock);
2449
2450 if (res->buckets[bucketnum].exiting &&
2451 ISC_LIST_EMPTY(res->buckets[bucketnum].fctxs))
2452 return (ISC_TRUE);
2453
2454 return (ISC_FALSE);
2455 }
2456
2457 /*
2458 * Fetch event handlers.
2459 */
2460
2461 static void
2462 fctx_timeout(isc_task_t *task, isc_event_t *event) {
2463 fetchctx_t *fctx = event->ev_arg;
2464
2465 REQUIRE(VALID_FCTX(fctx));
2466
2467 UNUSED(task);
2468
2469 FCTXTRACE("timeout");
2470
2471 if (event->ev_type == ISC_TIMEREVENT_LIFE) {
2472 fctx_done(fctx, ISC_R_TIMEDOUT);
2473 } else {
2474 isc_result_t result;
2475
2476 fctx->timeouts++;
2477 /*
2478 * We could cancel the running queries here, or we could let
2479 * them keep going. Right now we choose the latter...
2480 */
2481 fctx->attributes &= ~FCTX_ATTR_ADDRWAIT;
2482 /*
2483 * Our timer has triggered. Reestablish the fctx lifetime
2484 * timer.
2485 */
2486 result = fctx_starttimer(fctx);
2487 if (result != ISC_R_SUCCESS)
2488 fctx_done(fctx, result);
2489 else
2490 /*
2491 * Keep trying.
2492 */
2493 fctx_try(fctx);
2494 }
2495
2496 isc_event_free(&event);
2497 }
2498
2499 static void
2500 fctx_shutdown(fetchctx_t *fctx) {
2501 isc_event_t *cevent;
2502
2503 /*
2504 * Start the shutdown process for fctx, if it isn't already underway.
2505 */
2506
2507 FCTXTRACE("shutdown");
2508
2509 /*
2510 * The caller must be holding the appropriate bucket lock.
2511 */
2512
2513 if (fctx->want_shutdown)
2514 return;
2515
2516 fctx->want_shutdown = ISC_TRUE;
2517
2518 /*
2519 * Unless we're still initializing (in which case the
2520 * control event is still outstanding), we need to post
2521 * the control event to tell the fetch we want it to
2522 * exit.
2523 */
2524 if (fctx->state != fetchstate_init) {
2525 cevent = &fctx->control_event;
2526 isc_task_send(fctx->res->buckets[fctx->bucketnum].task,
2527 &cevent);
2528 }
2529 }
2530
2531 static void
2532 fctx_doshutdown(isc_task_t *task, isc_event_t *event) {
2533 fetchctx_t *fctx = event->ev_arg;
2534 isc_boolean_t bucket_empty = ISC_FALSE;
2535 dns_resolver_t *res;
2536 unsigned int bucketnum;
2537 dns_validator_t *validator;
2538
2539 REQUIRE(VALID_FCTX(fctx));
2540
2541 UNUSED(task);
2542
2543 res = fctx->res;
2544 bucketnum = fctx->bucketnum;
2545
2546 FCTXTRACE("doshutdown");
2547
2548 /*
2549 * An fctx that is shutting down is no longer in ADDRWAIT mode.
2550 */
2551 fctx->attributes &= ~FCTX_ATTR_ADDRWAIT;
2552
2553 /*
2554 * Cancel all pending validators. Note that this must be done
2555 * without the bucket lock held, since that could cause deadlock.
2556 */
2557 validator = ISC_LIST_HEAD(fctx->validators);
2558 while (validator != NULL) {
2559 dns_validator_cancel(validator);
2560 validator = ISC_LIST_NEXT(validator, link);
2561 }
2562
2563 if (fctx->nsfetch != NULL)
2564 dns_resolver_cancelfetch(fctx->nsfetch);
2565
2566 /*
2567 * Shut down anything that is still running on behalf of this
2568 * fetch. To avoid deadlock with the ADB, we must do this
2569 * before we lock the bucket lock.
2570 */
2571 fctx_stopeverything(fctx, ISC_FALSE);
2572
2573 LOCK(&res->buckets[bucketnum].lock);
2574
2575 fctx->attributes |= FCTX_ATTR_SHUTTINGDOWN;
2576
2577 INSIST(fctx->state == fetchstate_active ||
2578 fctx->state == fetchstate_done);
2579 INSIST(fctx->want_shutdown);
2580
2581 if (fctx->state != fetchstate_done) {
2582 fctx->state = fetchstate_done;
2583 fctx_sendevents(fctx, ISC_R_CANCELED);
2584 }
2585
2586 if (fctx->references == 0 && fctx->pending == 0 &&
2587 fctx->nqueries == 0 && ISC_LIST_EMPTY(fctx->validators))
2588 bucket_empty = fctx_destroy(fctx);
2589
2590 UNLOCK(&res->buckets[bucketnum].lock);
2591
2592 if (bucket_empty)
2593 empty_bucket(res);
2594 }
2595
2596 static void
2597 fctx_start(isc_task_t *task, isc_event_t *event) {
2598 fetchctx_t *fctx = event->ev_arg;
2599 isc_boolean_t done = ISC_FALSE, bucket_empty = ISC_FALSE;
2600 dns_resolver_t *res;
2601 unsigned int bucketnum;
2602
2603 REQUIRE(VALID_FCTX(fctx));
2604
2605 UNUSED(task);
2606
2607 res = fctx->res;
2608 bucketnum = fctx->bucketnum;
2609
2610 FCTXTRACE("start");
2611
2612 LOCK(&res->buckets[bucketnum].lock);
2613
2614 INSIST(fctx->state == fetchstate_init);
2615 if (fctx->want_shutdown) {
2616 /*
2617 * We haven't started this fctx yet, and we've been requested
2618 * to shut it down.
2619 */
2620 fctx->attributes |= FCTX_ATTR_SHUTTINGDOWN;
2621 fctx->state = fetchstate_done;
2622 fctx_sendevents(fctx, ISC_R_CANCELED);
2623 /*
2624 * Since we haven't started, we INSIST that we have no
2625 * pending ADB finds and no pending validations.
2626 */
2627 INSIST(fctx->pending == 0);
2628 INSIST(fctx->nqueries == 0);
2629 INSIST(ISC_LIST_EMPTY(fctx->validators));
2630 if (fctx->references == 0) {
2631 /*
2632 * It's now safe to destroy this fctx.
2633 */
2634 bucket_empty = fctx_destroy(fctx);
2635 }
2636 done = ISC_TRUE;
2637 } else {
2638 /*
2639 * Normal fctx startup.
2640 */
2641 fctx->state = fetchstate_active;
2642 /*
2643 * Reset the control event for later use in shutting down
2644 * the fctx.
2645 */
2646 ISC_EVENT_INIT(event, sizeof(*event), 0, NULL,
2647 DNS_EVENT_FETCHCONTROL, fctx_doshutdown, fctx,
2648 NULL, NULL, NULL);
2649 }
2650
2651 UNLOCK(&res->buckets[bucketnum].lock);
2652
2653 if (!done) {
2654 isc_result_t result;
2655
2656 /*
2657 * All is well. Start working on the fetch.
2658 */
2659 result = fctx_starttimer(fctx);
2660 if (result != ISC_R_SUCCESS)
2661 fctx_done(fctx, result);
2662 else
2663 fctx_try(fctx);
2664 } else if (bucket_empty)
2665 empty_bucket(res);
2666 }
2667
2668 /*
2669 * Fetch Creation, Joining, and Cancelation.
2670 */
2671
2672 static inline isc_result_t
2673 fctx_join(fetchctx_t *fctx, isc_task_t *task, isc_taskaction_t action,
2674 void *arg, dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
2675 dns_fetch_t *fetch)
2676 {
2677 isc_task_t *clone;
2678 dns_fetchevent_t *event;
2679
2680 FCTXTRACE("join");
2681
2682 /*
2683 * We store the task we're going to send this event to in the
2684 * sender field. We'll make the fetch the sender when we actually
2685 * send the event.
2686 */
2687 clone = NULL;
2688 isc_task_attach(task, &clone);
2689 event = (dns_fetchevent_t *)
2690 isc_event_allocate(fctx->res->mctx, clone,
2691 DNS_EVENT_FETCHDONE,
2692 action, arg, sizeof(*event));
2693 if (event == NULL) {
2694 isc_task_detach(&clone);
2695 return (ISC_R_NOMEMORY);
2696 }
2697 event->result = DNS_R_SERVFAIL;
2698 event->qtype = fctx->type;
2699 event->db = NULL;
2700 event->node = NULL;
2701 event->rdataset = rdataset;
2702 event->sigrdataset = sigrdataset;
2703 event->fetch = fetch;
2704 dns_fixedname_init(&event->foundname);
2705
2706 /*
2707 * Make sure that we can store the sigrdataset in the
2708 * first event if it is needed by any of the events.
2709 */
2710 if (event->sigrdataset != NULL)
2711 ISC_LIST_PREPEND(fctx->events, event, ev_link);
2712 else
2713 ISC_LIST_APPEND(fctx->events, event, ev_link);
2714 fctx->references++;
2715
2716 fetch->magic = DNS_FETCH_MAGIC;
2717 fetch->private = fctx;
2718
2719 return (ISC_R_SUCCESS);
2720 }
2721
2722 static isc_result_t
2723 fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
2724 dns_name_t *domain, dns_rdataset_t *nameservers,
2725 unsigned int options, unsigned int bucketnum, fetchctx_t **fctxp)
2726 {
2727 fetchctx_t *fctx;
2728 isc_result_t result;
2729 isc_result_t iresult;
2730 isc_interval_t interval;
2731 dns_fixedname_t fixed;
2732 unsigned int findoptions = 0;
2733 char buf[DNS_NAME_FORMATSIZE + DNS_RDATATYPE_FORMATSIZE];
2734 char typebuf[DNS_RDATATYPE_FORMATSIZE];
2735 dns_name_t suffix;
2736
2737 /*
2738 * Caller must be holding the lock for bucket number 'bucketnum'.
2739 */
2740 REQUIRE(fctxp != NULL && *fctxp == NULL);
2741
2742 fctx = isc_mem_get(res->mctx, sizeof(*fctx));
2743 if (fctx == NULL)
2744 return (ISC_R_NOMEMORY);
2745 dns_name_format(name, buf, sizeof(buf));
2746 dns_rdatatype_format(type, typebuf, sizeof(typebuf));
2747 strcat(buf, "/"); /* checked */
2748 strcat(buf, typebuf); /* checked */
2749 fctx->info = isc_mem_strdup(res->mctx, buf);
2750 if (fctx->info == NULL) {
2751 result = ISC_R_NOMEMORY;
2752 goto cleanup_fetch;
2753 }
2754 FCTXTRACE("create");
2755 dns_name_init(&fctx->name, NULL);
2756 result = dns_name_dup(name, res->mctx, &fctx->name);
2757 if (result != ISC_R_SUCCESS)
2758 goto cleanup_info;
2759 dns_name_init(&fctx->domain, NULL);
2760 dns_rdataset_init(&fctx->nameservers);
2761
2762 fctx->type = type;
2763 fctx->options = options;
2764 /*
2765 * Note! We do not attach to the task. We are relying on the
2766 * resolver to ensure that this task doesn't go away while we are
2767 * using it.
2768 */
2769 fctx->res = res;
2770 fctx->references = 0;
2771 fctx->bucketnum = bucketnum;
2772 fctx->state = fetchstate_init;
2773 fctx->want_shutdown = ISC_FALSE;
2774 fctx->cloned = ISC_FALSE;
2775 ISC_LIST_INIT(fctx->queries);
2776 ISC_LIST_INIT(fctx->finds);
2777 ISC_LIST_INIT(fctx->altfinds);
2778 ISC_LIST_INIT(fctx->forwaddrs);
2779 ISC_LIST_INIT(fctx->altaddrs);
2780 ISC_LIST_INIT(fctx->forwarders);
2781 fctx->fwdpolicy = dns_fwdpolicy_none;
2782 ISC_LIST_INIT(fctx->bad);
2783 ISC_LIST_INIT(fctx->validators);
2784 fctx->find = NULL;
2785 fctx->altfind = NULL;
2786 fctx->pending = 0;
2787 fctx->restarts = 0;
2788 fctx->timeouts = 0;
2789 fctx->attributes = 0;
2790 fctx->nqueries = 0;
2791
2792 dns_name_init(&fctx->nsname, NULL);
2793 fctx->nsfetch = NULL;
2794 dns_rdataset_init(&fctx->nsrrset);
2795
2796 if (domain == NULL) {
2797 dns_forwarders_t *forwarders = NULL;
2798 unsigned int labels;
2799
2800 /*
2801 * DS records are found in the parent server.
2802 * Strip label to get the correct forwarder (if any).
2803 */
2804 if (fctx->type == dns_rdatatype_ds &&
2805 dns_name_countlabels(name) > 1) {
2806 dns_name_init(&suffix, NULL);
2807 labels = dns_name_countlabels(name);
2808 dns_name_getlabelsequence(name, 1, labels - 1, &suffix);
2809 name = &suffix;
2810 }
2811 dns_fixedname_init(&fixed);
2812 domain = dns_fixedname_name(&fixed);
2813 result = dns_fwdtable_find2(fctx->res->view->fwdtable, name,
2814 domain, &forwarders);
2815 if (result == ISC_R_SUCCESS)
2816 fctx->fwdpolicy = forwarders->fwdpolicy;
2817
2818 if (fctx->fwdpolicy != dns_fwdpolicy_only) {
2819 /*
2820 * The caller didn't supply a query domain and
2821 * nameservers, and we're not in forward-only mode,
2822 * so find the best nameservers to use.
2823 */
2824 if (dns_rdatatype_atparent(type))
2825 findoptions |= DNS_DBFIND_NOEXACT;
2826 result = dns_view_findzonecut(res->view, name, domain,
2827 0, findoptions, ISC_TRUE,
2828 &fctx->nameservers,
2829 NULL);
2830 if (result != ISC_R_SUCCESS)
2831 goto cleanup_name;
2832 result = dns_name_dup(domain, res->mctx, &fctx->domain);
2833 if (result != ISC_R_SUCCESS) {
2834 dns_rdataset_disassociate(&fctx->nameservers);
2835 goto cleanup_name;
2836 }
2837 } else {
2838 /*
2839 * We're in forward-only mode. Set the query domain.
2840 */
2841 result = dns_name_dup(domain, res->mctx, &fctx->domain);
2842 if (result != ISC_R_SUCCESS)
2843 goto cleanup_name;
2844 }
2845 } else {
2846 result = dns_name_dup(domain, res->mctx, &fctx->domain);
2847 if (result != ISC_R_SUCCESS)
2848 goto cleanup_name;
2849 dns_rdataset_clone(nameservers, &fctx->nameservers);
2850 }
2851
2852 INSIST(dns_name_issubdomain(&fctx->name, &fctx->domain));
2853
2854 fctx->qmessage = NULL;
2855 result = dns_message_create(res->mctx, DNS_MESSAGE_INTENTRENDER,
2856 &fctx->qmessage);
2857
2858 if (result != ISC_R_SUCCESS)
2859 goto cleanup_domain;
2860
2861 fctx->rmessage = NULL;
2862 result = dns_message_create(res->mctx, DNS_MESSAGE_INTENTPARSE,
2863 &fctx->rmessage);
2864
2865 if (result != ISC_R_SUCCESS)
2866 goto cleanup_qmessage;
2867
2868 /*
2869 * Compute an expiration time for the entire fetch.
2870 */
2871 isc_interval_set(&interval, 30, 0); /* XXXRTH constant */
2872 iresult = isc_time_nowplusinterval(&fctx->expires, &interval);
2873 if (iresult != ISC_R_SUCCESS) {
2874 UNEXPECTED_ERROR(__FILE__, __LINE__,
2875 "isc_time_nowplusinterval: %s",
2876 isc_result_totext(iresult));
2877 result = ISC_R_UNEXPECTED;
2878 goto cleanup_rmessage;
2879 }
2880
2881 /*
2882 * Default retry interval initialization. We set the interval now
2883 * mostly so it won't be uninitialized. It will be set to the
2884 * correct value before a query is issued.
2885 */
2886 isc_interval_set(&fctx->interval, 2, 0);
2887
2888 /*
2889 * Create an inactive timer. It will be made active when the fetch
2890 * is actually started.
2891 */
2892 fctx->timer = NULL;
2893 iresult = isc_timer_create(res->timermgr, isc_timertype_inactive,
2894 NULL, NULL,
2895 res->buckets[bucketnum].task, fctx_timeout,
2896 fctx, &fctx->timer);
2897 if (iresult != ISC_R_SUCCESS) {
2898 UNEXPECTED_ERROR(__FILE__, __LINE__,
2899 "isc_timer_create: %s",
2900 isc_result_totext(iresult));
2901 result = ISC_R_UNEXPECTED;
2902 goto cleanup_rmessage;
2903 }
2904
2905 /*
2906 * Attach to the view's cache and adb.
2907 */
2908 fctx->cache = NULL;
2909 dns_db_attach(res->view->cachedb, &fctx->cache);
2910 fctx->adb = NULL;
2911 dns_adb_attach(res->view->adb, &fctx->adb);
2912
2913 ISC_LIST_INIT(fctx->events);
2914 ISC_LINK_INIT(fctx, link);
2915 fctx->magic = FCTX_MAGIC;
2916
2917 ISC_LIST_APPEND(res->buckets[bucketnum].fctxs, fctx, link);
2918
2919 LOCK(&res->nlock);
2920 res->nfctx++;
2921 UNLOCK(&res->nlock);
2922
2923 *fctxp = fctx;
2924
2925 return (ISC_R_SUCCESS);
2926
2927 cleanup_rmessage:
2928 dns_message_destroy(&fctx->rmessage);
2929
2930 cleanup_qmessage:
2931 dns_message_destroy(&fctx->qmessage);
2932
2933 cleanup_domain:
2934 if (dns_name_countlabels(&fctx->domain) > 0)
2935 dns_name_free(&fctx->domain, res->mctx);
2936 if (dns_rdataset_isassociated(&fctx->nameservers))
2937 dns_rdataset_disassociate(&fctx->nameservers);
2938
2939 cleanup_name:
2940 dns_name_free(&fctx->name, res->mctx);
2941
2942 cleanup_info:
2943 isc_mem_free(res->mctx, fctx->info);
2944
2945 cleanup_fetch:
2946 isc_mem_put(res->mctx, fctx, sizeof(*fctx));
2947
2948 return (result);
2949 }
2950
2951 /*
2952 * Handle Responses
2953 */
2954 static inline isc_boolean_t
2955 is_lame(fetchctx_t *fctx) {
2956 dns_message_t *message = fctx->rmessage;
2957 dns_name_t *name;
2958 dns_rdataset_t *rdataset;
2959 isc_result_t result;
2960
2961 if (message->rcode != dns_rcode_noerror &&
2962 message->rcode != dns_rcode_nxdomain)
2963 return (ISC_FALSE);
2964
2965 if (message->counts[DNS_SECTION_ANSWER] != 0)
2966 return (ISC_FALSE);
2967
2968 if (message->counts[DNS_SECTION_AUTHORITY] == 0)
2969 return (ISC_FALSE);
2970
2971 result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
2972 while (result == ISC_R_SUCCESS) {
2973 name = NULL;
2974 dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
2975 for (rdataset = ISC_LIST_HEAD(name->list);
2976 rdataset != NULL;
2977 rdataset = ISC_LIST_NEXT(rdataset, link)) {
2978 dns_namereln_t namereln;
2979 int order;
2980 unsigned int labels;
2981 if (rdataset->type != dns_rdatatype_ns)
2982 continue;
2983 namereln = dns_name_fullcompare(name, &fctx->domain,
2984 &order, &labels);
2985 if (namereln == dns_namereln_equal &&
2986 (message->flags & DNS_MESSAGEFLAG_AA) != 0)
2987 return (ISC_FALSE);
2988 if (namereln == dns_namereln_subdomain)
2989 return (ISC_FALSE);
2990 return (ISC_TRUE);
2991 }
2992 result = dns_message_nextname(message, DNS_SECTION_AUTHORITY);
2993 }
2994
2995 return (ISC_FALSE);
2996 }
2997
2998 static inline void
2999 log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) {
3000 char namebuf[DNS_NAME_FORMATSIZE];
3001 char domainbuf[DNS_NAME_FORMATSIZE];
3002 char addrbuf[ISC_SOCKADDR_FORMATSIZE];
3003
3004 dns_name_format(&fctx->name, namebuf, sizeof(namebuf));
3005 dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
3006 isc_sockaddr_format(&addrinfo->sockaddr, addrbuf, sizeof(addrbuf));
3007 isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS,
3008 DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
3009 "lame server resolving '%s' (in '%s'?): %s",
3010 namebuf, domainbuf, addrbuf);
3011 }
3012
3013 static inline isc_result_t
3014 same_question(fetchctx_t *fctx) {
3015 isc_result_t result;
3016 dns_message_t *message = fctx->rmessage;
3017 dns_name_t *name;
3018 dns_rdataset_t *rdataset;
3019
3020 /*
3021 * Caller must be holding the fctx lock.
3022 */
3023
3024 /*
3025 * XXXRTH Currently we support only one question.
3026 */
3027 if (message->counts[DNS_SECTION_QUESTION] != 1)
3028 return (DNS_R_FORMERR);
3029
3030 result = dns_message_firstname(message, DNS_SECTION_QUESTION);
3031 if (result != ISC_R_SUCCESS)
3032 return (result);
3033 name = NULL;
3034 dns_message_currentname(message, DNS_SECTION_QUESTION, &name);
3035 rdataset = ISC_LIST_HEAD(name->list);
3036 INSIST(rdataset != NULL);
3037 INSIST(ISC_LIST_NEXT(rdataset, link) == NULL);
3038 if (fctx->type != rdataset->type ||
3039 fctx->res->rdclass != rdataset->rdclass ||
3040 !dns_name_equal(&fctx->name, name))
3041 return (DNS_R_FORMERR);
3042
3043 return (ISC_R_SUCCESS);
3044 }
3045
3046 static void
3047 clone_results(fetchctx_t *fctx) {
3048 dns_fetchevent_t *event, *hevent;
3049 isc_result_t result;
3050 dns_name_t *name, *hname;
3051
3052 FCTXTRACE("clone_results");
3053
3054 /*
3055 * Set up any other events to have the same data as the first
3056 * event.
3057 *
3058 * Caller must be holding the appropriate lock.
3059 */
3060
3061 fctx->cloned = ISC_TRUE;
3062 hevent = ISC_LIST_HEAD(fctx->events);
3063 if (hevent == NULL)
3064 return;
3065 hname = dns_fixedname_name(&hevent->foundname);
3066 for (event = ISC_LIST_NEXT(hevent, ev_link);
3067 event != NULL;
3068 event = ISC_LIST_NEXT(event, ev_link)) {
3069 name = dns_fixedname_name(&event->foundname);
3070 result = dns_name_copy(hname, name, NULL);
3071 if (result != ISC_R_SUCCESS)
3072 event->result = result;
3073 else
3074 event->result = hevent->result;
3075 dns_db_attach(hevent->db, &event->db);
3076 dns_db_attachnode(hevent->db, hevent->node, &event->node);
3077 INSIST(hevent->rdataset != NULL);
3078 INSIST(event->rdataset != NULL);
3079 if (dns_rdataset_isassociated(hevent->rdataset))
3080 dns_rdataset_clone(hevent->rdataset, event->rdataset);
3081 INSIST(! (hevent->sigrdataset == NULL &&
3082 event->sigrdataset != NULL));
3083 if (hevent->sigrdataset != NULL &&
3084 dns_rdataset_isassociated(hevent->sigrdataset) &&
3085 event->sigrdataset != NULL)
3086 dns_rdataset_clone(hevent->sigrdataset,
3087 event->sigrdataset);
3088 }
3089 }
3090
3091 #define CACHE(r) (((r)->attributes & DNS_RDATASETATTR_CACHE) != 0)
3092 #define ANSWER(r) (((r)->attributes & DNS_RDATASETATTR_ANSWER) != 0)
3093 #define ANSWERSIG(r) (((r)->attributes & DNS_RDATASETATTR_ANSWERSIG) != 0)
3094 #define EXTERNAL(r) (((r)->attributes & DNS_RDATASETATTR_EXTERNAL) != 0)
3095 #define CHAINING(r) (((r)->attributes & DNS_RDATASETATTR_CHAINING) != 0)
3096 #define CHASE(r) (((r)->attributes & DNS_RDATASETATTR_CHASE) != 0)
3097 #define CHECKNAMES(r) (((r)->attributes & DNS_RDATASETATTR_CHECKNAMES) != 0)
3098
3099
3100 /*
3101 * Destroy '*fctx' if it is ready to be destroyed (i.e., if it has
3102 * no references and is no longer waiting for any events). If this
3103 * was the last fctx in the resolver, destroy the resolver.
3104 *
3105 * Requires:
3106 * '*fctx' is shutting down.
3107 */
3108 static void
3109 maybe_destroy(fetchctx_t *fctx) {
3110 unsigned int bucketnum;
3111 isc_boolean_t bucket_empty = ISC_FALSE;
3112 dns_resolver_t *res = fctx->res;
3113 dns_validator_t *validator;
3114
3115 REQUIRE(SHUTTINGDOWN(fctx));
3116
3117 if (fctx->pending != 0 || fctx->nqueries != 0)
3118 return;
3119
3120 for (validator = ISC_LIST_HEAD(fctx->validators);
3121 validator != NULL;
3122 validator = ISC_LIST_HEAD(fctx->validators)) {
3123 ISC_LIST_UNLINK(fctx->validators, validator, link);
3124 dns_validator_cancel(validator);
3125 dns_validator_destroy(&validator);
3126 }
3127
3128 bucketnum = fctx->bucketnum;
3129 LOCK(&res->buckets[bucketnum].lock);
3130 if (fctx->references == 0)
3131 bucket_empty = fctx_destroy(fctx);
3132 UNLOCK(&res->buckets[bucketnum].lock);
3133
3134 if (bucket_empty)
3135 empty_bucket(res);
3136 }
3137
3138 /*
3139 * The validator has finished.
3140 */
3141 static void
3142 validated(isc_task_t *task, isc_event_t *event) {
3143 isc_result_t result = ISC_R_SUCCESS;
3144 isc_result_t eresult = ISC_R_SUCCESS;
3145 isc_stdtime_t now;
3146 fetchctx_t *fctx;
3147 dns_validatorevent_t *vevent;
3148 dns_fetchevent_t *hevent;
3149 dns_rdataset_t *ardataset = NULL;
3150 dns_rdataset_t *asigrdataset = NULL;
3151 dns_dbnode_t *node = NULL;
3152 isc_boolean_t negative;
3153 isc_boolean_t chaining;
3154 isc_boolean_t sentresponse;
3155 isc_uint32_t ttl;
3156 dns_dbnode_t *nsnode = NULL;
3157 dns_name_t *name;
3158 dns_rdataset_t *rdataset;
3159 dns_rdataset_t *sigrdataset;
3160 dns_valarg_t *valarg;
3161 dns_adbaddrinfo_t *addrinfo;
3162
3163 UNUSED(task); /* for now */
3164
3165 REQUIRE(event->ev_type == DNS_EVENT_VALIDATORDONE);
3166 valarg = event->ev_arg;
3167 fctx = valarg->fctx;
3168 addrinfo = valarg->addrinfo;
3169 REQUIRE(VALID_FCTX(fctx));
3170 REQUIRE(!ISC_LIST_EMPTY(fctx->validators));
3171
3172 vevent = (dns_validatorevent_t *)event;
3173
3174 FCTXTRACE("received validation completion event");
3175
3176 ISC_LIST_UNLINK(fctx->validators, vevent->validator, link);
3177
3178 /*
3179 * Destroy the validator early so that we can
3180 * destroy the fctx if necessary.
3181 */
3182 dns_validator_destroy(&vevent->validator);
3183 isc_mem_put(fctx->res->mctx, valarg, sizeof(*valarg));
3184
3185 negative = ISC_TF(vevent->rdataset == NULL);
3186
3187 sentresponse = ISC_TF((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0);
3188
3189 /*
3190 * If shutting down, ignore the results. Check to see if we're
3191 * done waiting for validator completions and ADB pending events; if
3192 * so, destroy the fctx.
3193 */
3194 if (SHUTTINGDOWN(fctx) && !sentresponse) {
3195 maybe_destroy(fctx); /* Locks bucket. */
3196 goto cleanup_event;
3197 }
3198
3199 LOCK(&fctx->res->buckets[fctx->bucketnum].lock);
3200
3201 /*
3202 * If chaining, we need to make sure that the right result code is
3203 * returned, and that the rdatasets are bound.
3204 */
3205 if (vevent->result == ISC_R_SUCCESS &&
3206 !negative &&
3207 vevent->rdataset != NULL &&
3208 CHAINING(vevent->rdataset))
3209 {
3210 if (vevent->rdataset->type == dns_rdatatype_cname)
3211 eresult = DNS_R_CNAME;
3212 else {
3213 INSIST(vevent->rdataset->type == dns_rdatatype_dname);
3214 eresult = DNS_R_DNAME;
3215 }
3216 chaining = ISC_TRUE;
3217 } else
3218 chaining = ISC_FALSE;
3219
3220 /*
3221 * Either we're not shutting down, or we are shutting down but want
3222 * to cache the result anyway (if this was a validation started by
3223 * a query with cd set)
3224 */
3225
3226 hevent = ISC_LIST_HEAD(fctx->events);
3227 if (hevent != NULL) {
3228 if (!negative && !chaining &&
3229 (fctx->type == dns_rdatatype_any ||
3230 fctx->type == dns_rdatatype_rrsig ||
3231 fctx->type == dns_rdatatype_sig)) {
3232 /*
3233 * Don't bind rdatasets; the caller
3234 * will iterate the node.
3235 */
3236 } else {
3237 ardataset = hevent->rdataset;
3238 asigrdataset = hevent->sigrdataset;
3239 }
3240 }
3241
3242 if (vevent->result != ISC_R_SUCCESS) {
3243 FCTXTRACE("validation failed");
3244 result = ISC_R_NOTFOUND;
3245 if (vevent->rdataset != NULL)
3246 result = dns_db_findnode(fctx->cache, vevent->name,
3247 ISC_TRUE, &node);
3248 if (result == ISC_R_SUCCESS)
3249 (void)dns_db_deleterdataset(fctx->cache, node, NULL,
3250 vevent->type, 0);
3251 if (result == ISC_R_SUCCESS && vevent->sigrdataset != NULL)
3252 (void)dns_db_deleterdataset(fctx->cache, node, NULL,
3253 dns_rdatatype_rrsig,
3254 vevent->type);
3255 if (result == ISC_R_SUCCESS)
3256 dns_db_detachnode(fctx->cache, &node);
3257 result = vevent->result;
3258 add_bad(fctx, &addrinfo->sockaddr, result);
3259 isc_event_free(&event);
3260 UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock);
3261 if (!ISC_LIST_EMPTY(fctx->validators))
3262 dns_validator_send(ISC_LIST_HEAD(fctx->validators));
3263 else if (sentresponse)
3264 fctx_done(fctx, result); /* Locks bucket. */
3265 else
3266 fctx_try(fctx); /* Locks bucket. */
3267 return;
3268 }
3269
3270 isc_stdtime_get(&now);
3271
3272 if (negative) {
3273 dns_rdatatype_t covers;
3274 FCTXTRACE("nonexistence validation OK");
3275
3276 if (fctx->rmessage->rcode == dns_rcode_nxdomain)
3277 covers = dns_rdatatype_any;
3278 else
3279 covers = fctx->type;
3280
3281 result = dns_db_findnode(fctx->cache, vevent->name, ISC_TRUE,
3282 &node);
3283 if (result != ISC_R_SUCCESS)
3284 goto noanswer_response;
3285
3286 /*
3287 * If we are asking for a SOA record set the cache time
3288 * to zero to facilitate locating the containing zone of
3289 * a arbitary zone.
3290 */
3291 ttl = fctx->res->view->maxncachettl;
3292 if (fctx->type == dns_rdatatype_soa &&
3293 covers == dns_rdatatype_any)
3294 ttl = 0;
3295
3296 result = ncache_adderesult(fctx->rmessage, fctx->cache, node,
3297 covers, now, ttl,
3298 ardataset, &eresult);
3299 if (result != ISC_R_SUCCESS)
3300 goto noanswer_response;
3301 goto answer_response;
3302 }
3303
3304 FCTXTRACE("validation OK");
3305
3306 if (vevent->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL) {
3307
3308 result = dns_rdataset_addnoqname(vevent->rdataset,
3309 vevent->proofs[DNS_VALIDATOR_NOQNAMEPROOF]);
3310 RUNTIME_CHECK(result == ISC_R_SUCCESS);
3311 INSIST(vevent->sigrdataset != NULL);
3312 vevent->sigrdataset->ttl = vevent->rdataset->ttl;
3313 }
3314
3315 /*
3316 * The data was already cached as pending data.
3317 * Re-cache it as secure and bind the cached
3318 * rdatasets to the first event on the fetch
3319 * event list.
3320 */
3321 result = dns_db_findnode(fctx->cache, vevent->name, ISC_TRUE, &node);
3322 if (result != ISC_R_SUCCESS)
3323 goto noanswer_response;
3324
3325 result = dns_db_addrdataset(fctx->cache, node, NULL, now,
3326 vevent->rdataset, 0, ardataset);
3327 if (result != ISC_R_SUCCESS &&
3328 result != DNS_R_UNCHANGED)
3329 goto noanswer_response;
3330 if (vevent->sigrdataset != NULL) {
3331 result = dns_db_addrdataset(fctx->cache, node, NULL, now,
3332 vevent->sigrdataset, 0,
3333 asigrdataset);
3334 if (result != ISC_R_SUCCESS &&
3335 result != DNS_R_UNCHANGED)
3336 goto noanswer_response;
3337 }
3338
3339 if (sentresponse) {
3340 /*
3341 * If we only deferred the destroy because we wanted to cache
3342 * the data, destroy now.
3343 */
3344 UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock);
3345 if (SHUTTINGDOWN(fctx))
3346 maybe_destroy(fctx); /* Locks bucket. */
3347 goto cleanup_event;
3348 }
3349
3350 if (!ISC_LIST_EMPTY(fctx->validators)) {
3351 INSIST(!negative);
3352 INSIST(fctx->type == dns_rdatatype_any ||
3353 fctx->type == dns_rdatatype_rrsig ||
3354 fctx->type == dns_rdatatype_sig);
3355 /*
3356 * Don't send a response yet - we have
3357 * more rdatasets that still need to
3358 * be validated.
3359 */
3360 UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock);
3361 dns_validator_send(ISC_LIST_HEAD(fctx->validators));
3362 goto cleanup_event;
3363 }
3364
3365 answer_response:
3366 /*
3367 * Cache any NS/NSEC records that happened to be validated.
3368 */
3369 result = dns_message_firstname(fctx->rmessage, DNS_SECTION_AUTHORITY);
3370 while (result == ISC_R_SUCCESS) {
3371 name = NULL;
3372 dns_message_currentname(fctx->rmessage, DNS_SECTION_AUTHORITY,
3373 &name);
3374 for (rdataset = ISC_LIST_HEAD(name->list);
3375 rdataset != NULL;
3376 rdataset = ISC_LIST_NEXT(rdataset, link)) {
3377 if ((rdataset->type != dns_rdatatype_ns &&
3378 rdataset->type != dns_rdatatype_nsec) ||
3379 rdataset->trust != dns_trust_secure)
3380 continue;
3381 for (sigrdataset = ISC_LIST_HEAD(name->list);
3382 sigrdataset != NULL;
3383 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) {
3384 if (sigrdataset->type != dns_rdatatype_rrsig ||
3385 sigrdataset->covers != rdataset->type)
3386 continue;
3387 break;
3388 }
3389 if (sigrdataset == NULL ||
3390 sigrdataset->trust != dns_trust_secure)
3391 continue;
3392 result = dns_db_findnode(fctx->cache, name, ISC_TRUE,
3393 &nsnode);
3394 if (result != ISC_R_SUCCESS)
3395 continue;
3396
3397 result = dns_db_addrdataset(fctx->cache, nsnode, NULL,
3398 now, rdataset, 0, NULL);
3399 if (result == ISC_R_SUCCESS)
3400 result = dns_db_addrdataset(fctx->cache, nsnode,
3401 NULL, now,
3402 sigrdataset, 0,
3403 NULL);
3404 dns_db_detachnode(fctx->cache, &nsnode);
3405 }
3406 result = dns_message_nextname(fctx->rmessage,
3407 DNS_SECTION_AUTHORITY);
3408 }
3409
3410 result = ISC_R_SUCCESS;
3411
3412 /*
3413 * Respond with an answer, positive or negative,
3414 * as opposed to an error. 'node' must be non-NULL.
3415 */
3416
3417 fctx->attributes |= FCTX_ATTR_HAVEANSWER;
3418
3419 if (hevent != NULL) {
3420 hevent->result = eresult;
3421 RUNTIME_CHECK(dns_name_copy(vevent->name,
3422 dns_fixedname_name(&hevent->foundname), NULL)
3423 == ISC_R_SUCCESS);
3424 dns_db_attach(fctx->cache, &hevent->db);
3425 hevent->node = node;
3426 node = NULL;
3427 clone_results(fctx);
3428 }
3429
3430 noanswer_response:
3431 if (node != NULL)
3432 dns_db_detachnode(fctx->cache, &node);
3433
3434 UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock);
3435
3436 fctx_done(fctx, result); /* Locks bucket. */
3437
3438 cleanup_event:
3439 isc_event_free(&event);
3440 }
3441
3442 static inline isc_result_t
3443 cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
3444 isc_stdtime_t now) {
3445 dns_rdataset_t *rdataset, *sigrdataset;
3446 dns_rdataset_t *addedrdataset, *ardataset, *asigrdataset;
3447 dns_rdataset_t *valrdataset = NULL, *valsigrdataset = NULL;
3448 dns_dbnode_t *node, **anodep;
3449 dns_db_t **adbp;
3450 dns_name_t *aname;
3451 dns_resolver_t *res;
3452 isc_boolean_t need_validation, secure_domain, have_answer;
3453 isc_result_t result, eresult;
3454 dns_fetchevent_t *event;
3455 unsigned int options;
3456 isc_task_t *task;
3457 isc_boolean_t fail;
3458 unsigned int valoptions = 0;
3459
3460 /*
3461 * The appropriate bucket lock must be held.
3462 */
3463
3464 res = fctx->res;
3465 need_validation = ISC_FALSE;
3466 secure_domain = ISC_FALSE;
3467 have_answer = ISC_FALSE;
3468 eresult = ISC_R_SUCCESS;
3469 task = res->buckets[fctx->bucketnum].task;
3470
3471 /*
3472 * Is DNSSEC validation required for this name?
3473 */
3474 result = dns_keytable_issecuredomain(res->view->secroots, name,
3475 &secure_domain);
3476 if (result != ISC_R_SUCCESS)
3477 return (result);
3478
3479 if (!secure_domain && res->view->dlv != NULL) {
3480 valoptions = DNS_VALIDATOR_DLV;
3481 secure_domain = ISC_TRUE;
3482 }
3483
3484 if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0)
3485 need_validation = ISC_FALSE;
3486 else
3487 need_validation = secure_domain;
3488
3489 adbp = NULL;
3490 aname = NULL;
3491 anodep = NULL;
3492 ardataset = NULL;
3493 asigrdataset = NULL;
3494 event = NULL;
3495 if ((name->attributes & DNS_NAMEATTR_ANSWER) != 0 &&
3496 !need_validation) {
3497 have_answer = ISC_TRUE;
3498 event = ISC_LIST_HEAD(fctx->events);
3499 if (event != NULL) {
3500 adbp = &event->db;
3501 aname = dns_fixedname_name(&event->foundname);
3502 result = dns_name_copy(name, aname, NULL);
3503 if (result != ISC_R_SUCCESS)
3504 return (result);
3505 anodep = &event->node;
3506 /*
3507 * If this is an ANY, SIG or RRSIG query, we're not
3508 * going to return any rdatasets, unless we encountered
3509 * a CNAME or DNAME as "the answer". In this case,
3510 * we're going to return DNS_R_CNAME or DNS_R_DNAME
3511 * and we must set up the rdatasets.
3512 */
3513 if ((fctx->type != dns_rdatatype_any &&
3514 fctx->type != dns_rdatatype_rrsig &&
3515 fctx->type != dns_rdatatype_sig) ||
3516 (name->attributes & DNS_NAMEATTR_CHAINING) != 0) {
3517 ardataset = event->rdataset;
3518 asigrdataset = event->sigrdataset;
3519 }
3520 }
3521 }
3522
3523 /*
3524 * Find or create the cache node.
3525 */
3526 node = NULL;
3527 result = dns_db_findnode(fctx->cache, name, ISC_TRUE, &node);
3528 if (result != ISC_R_SUCCESS)
3529 return (result);
3530
3531 /*
3532 * Cache or validate each cacheable rdataset.
3533 */
3534 fail = ISC_TF((fctx->res->options & DNS_RESOLVER_CHECKNAMESFAIL) != 0);
3535 for (rdataset = ISC_LIST_HEAD(name->list);
3536 rdataset != NULL;
3537 rdataset = ISC_LIST_NEXT(rdataset, link)) {
3538 if (!CACHE(rdataset))
3539 continue;
3540 if (CHECKNAMES(rdataset)) {
3541 char namebuf[DNS_NAME_FORMATSIZE];
3542 char typebuf[DNS_RDATATYPE_FORMATSIZE];
3543 char classbuf[DNS_RDATATYPE_FORMATSIZE];
3544
3545 dns_name_format(name, namebuf, sizeof(namebuf));
3546 dns_rdatatype_format(rdataset->type, typebuf,
3547 sizeof(typebuf));
3548 dns_rdataclass_format(rdataset->rdclass, classbuf,
3549 sizeof(classbuf));
3550 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
3551 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
3552 "check-names %s %s/%s/%s",
3553 fail ? "failure" : "warning",
3554 namebuf, typebuf, classbuf);
3555 if (fail) {
3556 if (ANSWER(rdataset))
3557 return (DNS_R_BADNAME);
3558 continue;
3559 }
3560 }
3561
3562 /*
3563 * Enforce the configure maximum cache TTL.
3564 */
3565 if (rdataset->ttl > res->view->maxcachettl)
3566 rdataset->ttl = res->view->maxcachettl;
3567
3568 /*
3569 * If this rrset is in a secure domain, do DNSSEC validation
3570 * for it, unless it is glue.
3571 */
3572 if (secure_domain && rdataset->trust != dns_trust_glue) {
3573 /*
3574 * RRSIGs are validated as part of validating the
3575 * type they cover.
3576 */
3577 if (rdataset->type == dns_rdatatype_rrsig)
3578 continue;
3579 /*
3580 * Find the SIG for this rdataset, if we have it.
3581 */
3582 for (sigrdataset = ISC_LIST_HEAD(name->list);
3583 sigrdataset != NULL;
3584 sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) {
3585 if (sigrdataset->type == dns_rdatatype_rrsig &&
3586 sigrdataset->covers == rdataset->type)
3587 break;
3588 }
3589 if (sigrdataset == NULL) {
3590 if (!ANSWER(rdataset) && need_validation) {
3591 /*
3592 * Ignore non-answer rdatasets that
3593 * are missing signatures.
3594 */
3595 continue;
3596 }
3597 }
3598
3599 /*
3600 * Normalize the rdataset and sigrdataset TTLs.
3601 */
3602 if (sigrdataset != NULL) {
3603 rdataset->ttl = ISC_MIN(rdataset->ttl,
3604 sigrdataset->ttl);
3605 sigrdataset->ttl = rdataset->ttl;
3606 }
3607
3608 /*
3609 * Cache this rdataset/sigrdataset pair as
3610 * pending data.
3611 */
3612 rdataset->trust = dns_trust_pending;
3613 if (sigrdataset != NULL)
3614 sigrdataset->trust = dns_trust_pending;
3615 if (!need_validation)
3616 addedrdataset = ardataset;
3617 else
3618 addedrdataset = NULL;
3619 result = dns_db_addrdataset(fctx->cache, node, NULL,
3620 now, rdataset, 0,
3621 addedrdataset);
3622 if (result == DNS_R_UNCHANGED)
3623 result = ISC_R_SUCCESS;
3624 if (result != ISC_R_SUCCESS)
3625 break;
3626 if (sigrdataset != NULL) {
3627 if (!need_validation)
3628 addedrdataset = asigrdataset;
3629 else
3630 addedrdataset = NULL;
3631 result = dns_db_addrdataset(fctx->cache,
3632 node, NULL, now,
3633 sigrdataset, 0,
3634 addedrdataset);
3635 if (result == DNS_R_UNCHANGED)
3636 result = ISC_R_SUCCESS;
3637 if (result != ISC_R_SUCCESS)
3638 break;
3639 } else if (!ANSWER(rdataset))
3640 continue;
3641
3642 if (ANSWER(rdataset) && need_validation) {
3643 if (fctx->type != dns_rdatatype_any &&
3644 fctx->type != dns_rdatatype_rrsig &&
3645 fctx->type != dns_rdatatype_sig) {
3646 /*
3647 * This is The Answer. We will
3648 * validate it, but first we cache
3649 * the rest of the response - it may
3650 * contain useful keys.
3651 */
3652 INSIST(valrdataset == NULL &&
3653 valsigrdataset == NULL);
3654 valrdataset = rdataset;
3655 valsigrdataset = sigrdataset;
3656 } else {
3657 /*
3658 * This is one of (potentially)
3659 * multiple answers to an ANY
3660 * or SIG query. To keep things
3661 * simple, we just start the
3662 * validator right away rather
3663 * than caching first and
3664 * having to remember which
3665 * rdatasets needed validation.
3666 */
3667 result = valcreate(fctx, addrinfo,
3668 name, rdataset->type,
3669 rdataset,
3670 sigrdataset,
3671 valoptions, task);
3672 /*
3673 * Defer any further validations.
3674 * This prevents multiple validators
3675 * from manipulating fctx->rmessage
3676 * simultaniously.
3677 */
3678 valoptions |= DNS_VALIDATOR_DEFER;
3679 }
3680 } else if (CHAINING(rdataset)) {
3681 if (rdataset->type == dns_rdatatype_cname)
3682 eresult = DNS_R_CNAME;
3683 else {
3684 INSIST(rdataset->type ==
3685 dns_rdatatype_dname);
3686 eresult = DNS_R_DNAME;
3687 }
3688 }
3689 } else if (!EXTERNAL(rdataset)) {
3690 /*
3691 * It's OK to cache this rdataset now.
3692 */
3693 if (ANSWER(rdataset))
3694 addedrdataset = ardataset;
3695 else if (ANSWERSIG(rdataset))
3696 addedrdataset = asigrdataset;
3697 else
3698 addedrdataset = NULL;
3699 if (CHAINING(rdataset)) {
3700 if (rdataset->type == dns_rdatatype_cname)
3701 eresult = DNS_R_CNAME;
3702 else {
3703 INSIST(rdataset->type ==
3704 dns_rdatatype_dname);
3705 eresult = DNS_R_DNAME;
3706 }
3707 }
3708 if (rdataset->trust == dns_trust_glue &&
3709 (rdataset->type == dns_rdatatype_ns ||
3710 (rdataset->type == dns_rdatatype_rrsig &&
3711 rdataset->covers == dns_rdatatype_ns))) {
3712 /*
3713 * If the trust level is 'dns_trust_glue'
3714 * then we are adding data from a referral
3715 * we got while executing the search algorithm.
3716 * New referral data always takes precedence
3717 * over the existing cache contents.
3718 */
3719 options = DNS_DBADD_FORCE;
3720 } else
3721 options = 0;
3722 /*
3723 * Now we can add the rdataset.
3724 */
3725 result = dns_db_addrdataset(fctx->cache,
3726 node, NULL, now,
3727 rdataset,
3728 options,
3729 addedrdataset);
3730 if (result == DNS_R_UNCHANGED) {
3731 if (ANSWER(rdataset) &&
3732 ardataset != NULL &&
3733 ardataset->type == 0) {
3734 /*
3735 * The answer in the cache is better
3736 * than the answer we found, and is
3737 * a negative cache entry, so we
3738 * must set eresult appropriately.
3739 */
3740 if (NXDOMAIN(ardataset))
3741 eresult =
3742 DNS_R_NCACHENXDOMAIN;
3743 else
3744 eresult =
3745 DNS_R_NCACHENXRRSET;
3746 }
3747 result = ISC_R_SUCCESS;
3748 } else if (result != ISC_R_SUCCESS)
3749 break;
3750 }
3751 }
3752
3753 if (valrdataset != NULL)
3754 result = valcreate(fctx, addrinfo, name, fctx->type,
3755 valrdataset, valsigrdataset, valoptions,
3756 task);
3757
3758 if (result == ISC_R_SUCCESS && have_answer) {
3759 fctx->attributes |= FCTX_ATTR_HAVEANSWER;
3760 if (event != NULL) {
3761 event->result = eresult;
3762 dns_db_attach(fctx->cache, adbp);
3763 *anodep = node;
3764 node = NULL;
3765 clone_results(fctx);
3766 }
3767 }
3768
3769 if (node != NULL)
3770 dns_db_detachnode(fctx->cache, &node);
3771
3772 return (result);
3773 }
3774
3775 static inline isc_result_t
3776 cache_message(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, isc_stdtime_t now)
3777 {
3778 isc_result_t result;
3779 dns_section_t section;
3780 dns_name_t *name;
3781
3782 FCTXTRACE("cache_message");
3783
3784 fctx->attributes &= ~FCTX_ATTR_WANTCACHE;
3785
3786 LOCK(&fctx->res->buckets[fctx->bucketnum].lock);
3787
3788 for (section = DNS_SECTION_ANSWER;
3789 section <= DNS_SECTION_ADDITIONAL;
3790 section++) {
3791 result = dns_message_firstname(fctx->rmessage, section);
3792 while (result == ISC_R_SUCCESS) {
3793 name = NULL;
3794 dns_message_currentname(fctx->rmessage, section,
3795 &name);
3796 if ((name->attributes & DNS_NAMEATTR_CACHE) != 0) {
3797 result = cache_name(fctx, name, addrinfo, now);
3798 if (result != ISC_R_SUCCESS)
3799 break;
3800 }
3801 result = dns_message_nextname(fctx->rmessage, section);
3802 }
3803 if (result != ISC_R_NOMORE)
3804 break;
3805 }
3806 if (result == ISC_R_NOMORE)
3807 result = ISC_R_SUCCESS;
3808
3809 UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock);
3810
3811 return (result);
3812 }
3813
3814 /*
3815 * Do what dns_ncache_add() does, and then compute an appropriate eresult.
3816 */
3817 static isc_result_t
3818 ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
3819 dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t maxttl,
3820 dns_rdataset_t *ardataset,
3821 isc_result_t *eresultp)
3822 {
3823 isc_result_t result;
3824 dns_rdataset_t rdataset;
3825
3826 if (ardataset == NULL) {
3827 dns_rdataset_init(&rdataset);
3828 ardataset = &rdataset;
3829 }
3830 result = dns_ncache_add(message, cache, node, covers, now,
3831 maxttl, ardataset);
3832 if (result == DNS_R_UNCHANGED || result == ISC_R_SUCCESS) {
3833 /*
3834 * If the cache now contains a negative entry and we
3835 * care about whether it is DNS_R_NCACHENXDOMAIN or
3836 * DNS_R_NCACHENXRRSET then extract it.
3837 */
3838 if (ardataset->type == 0) {
3839 /*
3840 * The cache data is a negative cache entry.
3841 */
3842 if (NXDOMAIN(ardataset))
3843 *eresultp = DNS_R_NCACHENXDOMAIN;
3844 else
3845 *eresultp = DNS_R_NCACHENXRRSET;
3846 } else {
3847 /*
3848 * Either we don't care about the nature of the
3849 * cache rdataset (because no fetch is interested
3850 * in the outcome), or the cache rdataset is not
3851 * a negative cache entry. Whichever case it is,
3852 * we can return success.
3853 *
3854 * XXXRTH There's a CNAME/DNAME problem here.
3855 */
3856 *eresultp = ISC_R_SUCCESS;
3857 }
3858 result = ISC_R_SUCCESS;
3859 }
3860 if (ardataset == &rdataset && dns_rdataset_isassociated(ardataset))
3861 dns_rdataset_disassociate(ardataset);
3862
3863 return (result);
3864 }
3865
3866 static inline isc_result_t
3867 ncache_message(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
3868 dns_rdatatype_t covers, isc_stdtime_t now)
3869 {
3870 isc_result_t result, eresult;
3871 dns_name_t *name;
3872 dns_resolver_t *res;
3873 dns_db_t **adbp;
3874 dns_dbnode_t *node, **anodep;
3875 dns_rdataset_t *ardataset;
3876 isc_boolean_t need_validation, secure_domain;
3877 dns_name_t *aname;
3878 dns_fetchevent_t *event;
3879 isc_uint32_t ttl;
3880 unsigned int valoptions = 0;
3881
3882 FCTXTRACE("ncache_message");
3883
3884 fctx->attributes &= ~FCTX_ATTR_WANTNCACHE;
3885
3886 res = fctx->res;
3887 need_validation = ISC_FALSE;
3888 secure_domain = ISC_FALSE;
3889 eresult = ISC_R_SUCCESS;
3890 name = &fctx->name;
3891 node = NULL;
3892
3893 /*
3894 * XXXMPA remove when we follow cnames and adjust the setting
3895 * of FCTX_ATTR_WANTNCACHE in noanswer_response().
3896 */
3897 INSIST(fctx->rmessage->counts[DNS_SECTION_ANSWER] == 0);
3898
3899 /*
3900 * Is DNSSEC validation required for this name?
3901 */
3902 result = dns_keytable_issecuredomain(res->view->secroots, name,
3903 &secure_domain);
3904 if (result != ISC_R_SUCCESS)
3905 return (result);
3906
3907 if (!secure_domain && res->view->dlv != NULL) {
3908 valoptions = DNS_VALIDATOR_DLV;
3909 secure_domain = ISC_TRUE;
3910 }
3911
3912 if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0)
3913 need_validation = ISC_FALSE;
3914 else
3915 need_validation = secure_domain;
3916
3917 if (secure_domain) {
3918 /*
3919 * Mark all rdatasets as pending.
3920 */
3921 dns_rdataset_t *trdataset;
3922 dns_name_t *tname;
3923
3924 result = dns_message_firstname(fctx->rmessage,
3925 DNS_SECTION_AUTHORITY);
3926 while (result == ISC_R_SUCCESS) {
3927 tname = NULL;
3928 dns_message_currentname(fctx->rmessage,
3929 DNS_SECTION_AUTHORITY,
3930 &tname);
3931 for (trdataset = ISC_LIST_HEAD(tname->list);
3932 trdataset != NULL;
3933 trdataset = ISC_LIST_NEXT(trdataset, link))
3934 trdataset->trust = dns_trust_pending;
3935 result = dns_message_nextname(fctx->rmessage,
3936 DNS_SECTION_AUTHORITY);
3937 }
3938 if (result != ISC_R_NOMORE)
3939 return (result);
3940
3941 }
3942
3943 if (need_validation) {
3944 /*
3945 * Do negative response validation.
3946 */
3947 result = valcreate(fctx, addrinfo, name, fctx->type,
3948 NULL, NULL, valoptions,
3949 res->buckets[fctx->bucketnum].task);
3950 /*
3951 * If validation is necessary, return now. Otherwise continue
3952 * to process the message, letting the validation complete
3953 * in its own good time.
3954 */
3955 return (result);
3956 }
3957
3958 LOCK(&res->buckets[fctx->bucketnum].lock);
3959
3960 adbp = NULL;
3961 aname = NULL;
3962 anodep = NULL;
3963 ardataset = NULL;
3964 if (!HAVE_ANSWER(fctx)) {
3965 event = ISC_LIST_HEAD(fctx->events);
3966 if (event != NULL) {
3967 adbp = &event->db;
3968 aname = dns_fixedname_name(&event->foundname);
3969 result = dns_name_copy(name, aname, NULL);
3970 if (result != ISC_R_SUCCESS)
3971 goto unlock;
3972 anodep = &event->node;
3973 ardataset = event->rdataset;
3974 }
3975 } else
3976 event = NULL;
3977
3978 result = dns_db_findnode(fctx->cache, name, ISC_TRUE, &node);
3979 if (result != ISC_R_SUCCESS)
3980 goto unlock;
3981
3982 /*
3983 * If we are asking for a SOA record set the cache time
3984 * to zero to facilitate locating the containing zone of
3985 * a arbitary zone.
3986 */
3987 ttl = fctx->res->view->maxncachettl;
3988 if (fctx->type == dns_rdatatype_soa &&
3989 covers == dns_rdatatype_any)
3990 ttl = 0;
3991
3992 result = ncache_adderesult(fctx->rmessage, fctx->cache, node,
3993 covers, now, ttl, ardataset, &eresult);
3994 if (result != ISC_R_SUCCESS)
3995 goto unlock;
3996
3997 if (!HAVE_ANSWER(fctx)) {
3998 fctx->attributes |= FCTX_ATTR_HAVEANSWER;
3999 if (event != NULL) {
4000 event->result = eresult;
4001 dns_db_attach(fctx->cache, adbp);
4002 *anodep = node;
4003 node = NULL;
4004 clone_results(fctx);
4005 }
4006 }
4007
4008 unlock:
4009 UNLOCK(&res->buckets[fctx->bucketnum].lock);
4010
4011 if (node != NULL)
4012 dns_db_detachnode(fctx->cache, &node);
4013
4014 return (result);
4015 }
4016
4017 static inline void
4018 mark_related(dns_name_t *name, dns_rdataset_t *rdataset,
4019 isc_boolean_t external, isc_boolean_t gluing)
4020 {
4021 name->attributes |= DNS_NAMEATTR_CACHE;
4022 if (gluing) {
4023 rdataset->trust = dns_trust_glue;
4024 /*
4025 * Glue with 0 TTL causes problems. We force the TTL to
4026 * 1 second to prevent this.
4027 */
4028 if (rdataset->ttl == 0)
4029 rdataset->ttl = 1;
4030 } else
4031 rdataset->trust = dns_trust_additional;
4032 /*
4033 * Avoid infinite loops by only marking new rdatasets.
4034 */
4035 if (!CACHE(rdataset)) {
4036 name->attributes |= DNS_NAMEATTR_CHASE;
4037 rdataset->attributes |= DNS_RDATASETATTR_CHASE;
4038 }
4039 rdataset->attributes |= DNS_RDATASETATTR_CACHE;
4040 if (external)
4041 rdataset->attributes |= DNS_RDATASETATTR_EXTERNAL;
4042 }
4043
4044 static isc_result_t
4045 check_related(void *arg, dns_name_t *addname, dns_rdatatype_t type) {
4046 fetchctx_t *fctx = arg;
4047 isc_result_t result;
4048 dns_name_t *name;
4049 dns_rdataset_t *rdataset;
4050 isc_boolean_t external;
4051 dns_rdatatype_t rtype;
4052 isc_boolean_t gluing;
4053
4054 REQUIRE(VALID_FCTX(fctx));
4055
4056 if (GLUING(fctx))
4057 gluing = ISC_TRUE;
4058 else
4059 gluing = ISC_FALSE;
4060 name = NULL;
4061 rdataset = NULL;
4062 result = dns_message_findname(fctx->rmessage, DNS_SECTION_ADDITIONAL,
4063 addname, dns_rdatatype_any, 0, &name,
4064 NULL);
4065 if (result == ISC_R_SUCCESS) {
4066 external = ISC_TF(!dns_name_issubdomain(name, &fctx->domain));
4067 if (type == dns_rdatatype_a) {
4068 for (rdataset = ISC_LIST_HEAD(name->list);
4069 rdataset != NULL;
4070 rdataset = ISC_LIST_NEXT(rdataset, link)) {
4071 if (rdataset->type == dns_rdatatype_rrsig)
4072 rtype = rdataset->covers;
4073 else
4074 rtype = rdataset->type;
4075 if (rtype == dns_rdatatype_a ||
4076 rtype == dns_rdatatype_aaaa)
4077 mark_related(name, rdataset, external,
4078 gluing);
4079 }
4080 } else {
4081 result = dns_message_findtype(name, type, 0,
4082 &rdataset);
4083 if (result == ISC_R_SUCCESS) {
4084 mark_related(name, rdataset, external, gluing);
4085 /*
4086 * Do we have its SIG too?
4087 */
4088 rdataset = NULL;
4089 result = dns_message_findtype(name,
4090 dns_rdatatype_rrsig,
4091 type, &rdataset);
4092 if (result == ISC_R_SUCCESS)
4093 mark_related(name, rdataset, external,
4094 gluing);
4095 }
4096 }
4097 }
4098
4099 return (ISC_R_SUCCESS);
4100 }
4101
4102 static void
4103 chase_additional(fetchctx_t *fctx) {
4104 isc_boolean_t rescan;
4105 dns_section_t section = DNS_SECTION_ADDITIONAL;
4106 isc_result_t result;
4107
4108 again:
4109 rescan = ISC_FALSE;
4110
4111 for (result = dns_message_firstname(fctx->rmessage, section);
4112 result == ISC_R_SUCCESS;
4113 result = dns_message_nextname(fctx->rmessage, section)) {
4114 dns_name_t *name = NULL;
4115 dns_rdataset_t *rdataset;
4116 dns_message_currentname(fctx->rmessage, DNS_SECTION_ADDITIONAL,
4117 &name);
4118 if ((name->attributes & DNS_NAMEATTR_CHASE) == 0)
4119 continue;
4120 name->attributes &= ~DNS_NAMEATTR_CHASE;
4121 for (rdataset = ISC_LIST_HEAD(name->list);
4122 rdataset != NULL;
4123 rdataset = ISC_LIST_NEXT(rdataset, link)) {
4124 if (CHASE(rdataset)) {
4125 rdataset->attributes &= ~DNS_RDATASETATTR_CHASE;
4126 (void)dns_rdataset_additionaldata(rdataset,
4127 check_related,
4128 fctx);
4129 rescan = ISC_TRUE;
4130 }
4131 }
4132 }
4133 if (rescan)
4134 goto again;
4135 }
4136
4137 static inline isc_result_t
4138 cname_target(dns_rdataset_t *rdataset, dns_name_t *tname) {
4139 isc_result_t result;
4140 dns_rdata_t rdata = DNS_RDATA_INIT;
4141 dns_rdata_cname_t cname;
4142
4143 result = dns_rdataset_first(rdataset);
4144 if (result != ISC_R_SUCCESS)
4145 return (result);
4146 dns_rdataset_current(rdataset, &rdata);
4147 result = dns_rdata_tostruct(&rdata, &cname, NULL);
4148 if (result != ISC_R_SUCCESS)
4149 return (result);
4150 dns_name_init(tname, NULL);
4151 dns_name_clone(&cname.cname, tname);
4152 dns_rdata_freestruct(&cname);
4153
4154 return (ISC_R_SUCCESS);
4155 }
4156
4157 static inline isc_result_t
4158 dname_target(dns_rdataset_t *rdataset, dns_name_t *qname, dns_name_t *oname,
4159 dns_fixedname_t *fixeddname)
4160 {
4161 isc_result_t result;
4162 dns_rdata_t rdata = DNS_RDATA_INIT;
4163 unsigned int nlabels;
4164 int order;
4165 dns_namereln_t namereln;
4166 dns_rdata_dname_t dname;
4167 dns_fixedname_t prefix;
4168
4169 /*
4170 * Get the target name of the DNAME.
4171 */
4172
4173 result = dns_rdataset_first(rdataset);
4174 if (result != ISC_R_SUCCESS)
4175 return (result);
4176 dns_rdataset_current(rdataset, &rdata);
4177 result = dns_rdata_tostruct(&rdata, &dname, NULL);
4178 if (result != ISC_R_SUCCESS)
4179 return (result);
4180
4181 /*
4182 * Get the prefix of qname.
4183 */
4184 namereln = dns_name_fullcompare(qname, oname, &order, &nlabels);
4185 if (namereln != dns_namereln_subdomain) {
4186 dns_rdata_freestruct(&dname);
4187 return (DNS_R_FORMERR);
4188 }
4189 dns_fixedname_init(&prefix);
4190 dns_name_split(qname, nlabels, dns_fixedname_name(&prefix), NULL);
4191 dns_fixedname_init(fixeddname);
4192 result = dns_name_concatenate(dns_fixedname_name(&prefix),
4193 &dname.dname,
4194 dns_fixedname_name(fixeddname), NULL);
4195 dns_rdata_freestruct(&dname);
4196 return (result);
4197 }
4198
4199 /*
4200 * Handle a no-answer response (NXDOMAIN, NXRRSET, or referral).
4201 * If bind8_ns_resp is ISC_TRUE, this is a suspected BIND 8
4202 * response to an NS query that should be treated as a referral
4203 * even though the NS records occur in the answer section
4204 * rather than the authority section.
4205 */
4206 static isc_result_t
4207 noanswer_response(fetchctx_t *fctx, dns_name_t *oqname,
4208 isc_boolean_t bind8_ns_resp)
4209 {
4210 isc_result_t result;
4211 dns_message_t *message;
4212 dns_name_t *name, *qname, *ns_name, *soa_name, *ds_name;
4213 dns_rdataset_t *rdataset, *ns_rdataset;
4214 isc_boolean_t done, aa, negative_response;
4215 dns_rdatatype_t type;
4216 dns_section_t section =
4217 bind8_ns_resp ? DNS_SECTION_ANSWER : DNS_SECTION_AUTHORITY;
4218
4219 FCTXTRACE("noanswer_response");
4220
4221 message = fctx->rmessage;
4222
4223 /*
4224 * Setup qname.
4225 */
4226 if (oqname == NULL) {
4227 /*
4228 * We have a normal, non-chained negative response or
4229 * referral.
4230 */
4231 if ((message->flags & DNS_MESSAGEFLAG_AA) != 0)
4232 aa = ISC_TRUE;
4233 else
4234 aa = ISC_FALSE;
4235 qname = &fctx->name;
4236 } else {
4237 /*
4238 * We're being invoked by answer_response() after it has
4239 * followed a CNAME/DNAME chain.
4240 */
4241 qname = oqname;
4242 aa = ISC_FALSE;
4243 /*
4244 * If the current qname is not a subdomain of the query
4245 * domain, there's no point in looking at the authority
4246 * section without doing DNSSEC validation.
4247 *
4248 * Until we do that validation, we'll just return success
4249 * in this case.
4250 */
4251 if (!dns_name_issubdomain(qname, &fctx->domain))
4252 return (ISC_R_SUCCESS);
4253 }
4254
4255 /*
4256 * We have to figure out if this is a negative response, or a
4257 * referral.
4258 */
4259
4260 /*
4261 * Sometimes we can tell if its a negative response by looking at
4262 * the message header.
4263 */
4264 negative_response = ISC_FALSE;
4265 if (message->rcode == dns_rcode_nxdomain ||
4266 (message->counts[DNS_SECTION_ANSWER] == 0 &&
4267 message->counts[DNS_SECTION_AUTHORITY] == 0))
4268 negative_response = ISC_TRUE;
4269
4270 /*
4271 * Process the authority section.
4272 */
4273 done = ISC_FALSE;
4274 ns_name = NULL;
4275 ns_rdataset = NULL;
4276 soa_name = NULL;
4277 ds_name = NULL;
4278 result = dns_message_firstname(message, section);
4279 while (!done && result == ISC_R_SUCCESS) {
4280 name = NULL;
4281 dns_message_currentname(message, section, &name);
4282 if (dns_name_issubdomain(name, &fctx->domain)) {
4283 /*
4284 * Look for NS/SOA RRsets first.
4285 */
4286 for (rdataset = ISC_LIST_HEAD(name->list);
4287 rdataset != NULL;
4288 rdataset = ISC_LIST_NEXT(rdataset, link)) {
4289 type = rdataset->type;
4290 if (type == dns_rdatatype_rrsig)
4291 type = rdataset->covers;
4292 if (((type == dns_rdatatype_ns ||
4293 type == dns_rdatatype_soa) &&
4294 !dns_name_issubdomain(qname, name)))
4295 return (DNS_R_FORMERR);
4296 if (type == dns_rdatatype_ns) {
4297 /*
4298 * NS or RRSIG NS.
4299 *
4300 * Only one set of NS RRs is allowed.
4301 */
4302 if (rdataset->type ==
4303 dns_rdatatype_ns) {
4304 if (ns_name != NULL &&
4305 name != ns_name)
4306 return (DNS_R_FORMERR);
4307 ns_name = name;
4308 ns_rdataset = rdataset;
4309 }
4310 name->attributes |=
4311 DNS_NAMEATTR_CACHE;
4312 rdataset->attributes |=
4313 DNS_RDATASETATTR_CACHE;
4314 rdataset->trust = dns_trust_glue;
4315 }
4316 if (type == dns_rdatatype_soa) {
4317 /*
4318 * SOA, or RRSIG SOA.
4319 *
4320 * Only one SOA is allowed.
4321 */
4322 if (rdataset->type ==
4323 dns_rdatatype_soa) {
4324 if (soa_name != NULL &&
4325 name != soa_name)
4326 return (DNS_R_FORMERR);
4327 soa_name = name;
4328 }
4329 name->attributes |=
4330 DNS_NAMEATTR_NCACHE;
4331 rdataset->attributes |=
4332 DNS_RDATASETATTR_NCACHE;
4333 if (aa)
4334 rdataset->trust =
4335 dns_trust_authauthority;
4336 else
4337 rdataset->trust =
4338 dns_trust_additional;
4339 }
4340 }
4341 /*
4342 * A negative response has a SOA record (Type 2)
4343 * and a optional NS RRset (Type 1) or it has neither
4344 * a SOA or a NS RRset (Type 3, handled above) or
4345 * rcode is NXDOMAIN (handled above) in which case
4346 * the NS RRset is allowed (Type 4).
4347 */
4348 if (soa_name != NULL)
4349 negative_response = ISC_TRUE;
4350 for (rdataset = ISC_LIST_HEAD(name->list);
4351 rdataset != NULL;
4352 rdataset = ISC_LIST_NEXT(rdataset, link)) {
4353 type = rdataset->type;
4354 if (type == dns_rdatatype_rrsig)
4355 type = rdataset->covers;
4356 if (type == dns_rdatatype_nsec) {
4357 /*
4358 * NSEC or RRSIG NSEC.
4359 */
4360 if (negative_response) {
4361 name->attributes |=
4362 DNS_NAMEATTR_NCACHE;
4363 rdataset->attributes |=
4364 DNS_RDATASETATTR_NCACHE;
4365 } else {
4366 name->attributes |=
4367 DNS_NAMEATTR_CACHE;
4368 rdataset->attributes |=
4369 DNS_RDATASETATTR_CACHE;
4370 }
4371 if (aa)
4372 rdataset->trust =
4373 dns_trust_authauthority;
4374 else
4375 rdataset->trust =
4376 dns_trust_additional;
4377 /*
4378 * No additional data needs to be
4379 * marked.
4380 */
4381 } else if (type == dns_rdatatype_ds) {
4382 /*
4383 * DS or SIG DS.
4384 *
4385 * These should only be here if
4386 * this is a referral, and there
4387 * should only be one DS.
4388 */
4389 if (ns_name == NULL)
4390 return (DNS_R_FORMERR);
4391 if (rdataset->type ==
4392 dns_rdatatype_ds) {
4393 if (ds_name != NULL &&
4394 name != ds_name)
4395 return (DNS_R_FORMERR);
4396 ds_name = name;
4397 }
4398 name->attributes |=
4399 DNS_NAMEATTR_CACHE;
4400 rdataset->attributes |=
4401 DNS_RDATASETATTR_CACHE;
4402 if (aa)
4403 rdataset->trust =
4404 dns_trust_authauthority;
4405 else
4406 rdataset->trust =
4407 dns_trust_additional;
4408 }
4409 }
4410 }
4411 result = dns_message_nextname(message, section);
4412 if (result == ISC_R_NOMORE)
4413 break;
4414 else if (result != ISC_R_SUCCESS)
4415 return (result);
4416 }
4417
4418 /*
4419 * Trigger lookups for DNS nameservers.
4420 */
4421 if (negative_response && message->rcode == dns_rcode_noerror &&
4422 fctx->type == dns_rdatatype_ds && soa_name != NULL &&
4423 dns_name_equal(soa_name, qname) &&
4424 !dns_name_equal(qname, dns_rootname))
4425 return (DNS_R_CHASEDSSERVERS);
4426
4427 /*
4428 * Did we find anything?
4429 */
4430 if (!negative_response && ns_name == NULL) {
4431 /*
4432 * Nope.
4433 */
4434 if (oqname != NULL) {
4435 /*
4436 * We've already got a partial CNAME/DNAME chain,
4437 * and haven't found else anything useful here, but
4438 * no error has occurred since we have an answer.
4439 */
4440 return (ISC_R_SUCCESS);
4441 } else {
4442 /*
4443 * The responder is insane.
4444 */
4445 return (DNS_R_FORMERR);
4446 }
4447 }
4448
4449 /*
4450 * If we found both NS and SOA, they should be the same name.
4451 */
4452 if (ns_name != NULL && soa_name != NULL && ns_name != soa_name)
4453 return (DNS_R_FORMERR);
4454
4455 /*
4456 * Do we have a referral? (We only want to follow a referral if
4457 * we're not following a chain.)
4458 */
4459 if (!negative_response && ns_name != NULL && oqname == NULL) {
4460 /*
4461 * We already know ns_name is a subdomain of fctx->domain.
4462 * If ns_name is equal to fctx->domain, we're not making
4463 * progress. We return DNS_R_FORMERR so that we'll keep
4464 * trying other servers.
4465 */
4466 if (dns_name_equal(ns_name, &fctx->domain))
4467 return (DNS_R_FORMERR);
4468
4469 /*
4470 * If the referral name is not a parent of the query
4471 * name, consider the responder insane.
4472 */
4473 if (! dns_name_issubdomain(&fctx->name, ns_name)) {
4474 FCTXTRACE("referral to non-parent");
4475 return (DNS_R_FORMERR);
4476 }
4477
4478 /*
4479 * Mark any additional data related to this rdataset.
4480 * It's important that we do this before we change the
4481 * query domain.
4482 */
4483 INSIST(ns_rdataset != NULL);
4484 fctx->attributes |= FCTX_ATTR_GLUING;
4485 (void)dns_rdataset_additionaldata(ns_rdataset, check_related,
4486 fctx);
4487 fctx->attributes &= ~FCTX_ATTR_GLUING;
4488 /*
4489 * NS rdatasets with 0 TTL cause problems.
4490 * dns_view_findzonecut() will not find them when we
4491 * try to follow the referral, and we'll SERVFAIL
4492 * because the best nameservers are now above QDOMAIN.
4493 * We force the TTL to 1 second to prevent this.
4494 */
4495 if (ns_rdataset->ttl == 0)
4496 ns_rdataset->ttl = 1;
4497 /*
4498 * Set the current query domain to the referral name.
4499 *
4500 * XXXRTH We should check if we're in forward-only mode, and
4501 * if so we should bail out.
4502 */
4503 INSIST(dns_name_countlabels(&fctx->domain) > 0);
4504 dns_name_free(&fctx->domain, fctx->res->mctx);
4505 if (dns_rdataset_isassociated(&fctx->nameservers))
4506 dns_rdataset_disassociate(&fctx->nameservers);
4507 dns_name_init(&fctx->domain, NULL);
4508 result = dns_name_dup(ns_name, fctx->res->mctx, &fctx->domain);
4509 if (result != ISC_R_SUCCESS)
4510 return (result);
4511 fctx->attributes |= FCTX_ATTR_WANTCACHE;
4512 return (DNS_R_DELEGATION);
4513 }
4514
4515 /*
4516 * Since we're not doing a referral, we don't want to cache any
4517 * NS RRs we may have found.
4518 */
4519 if (ns_name != NULL)
4520 ns_name->attributes &= ~DNS_NAMEATTR_CACHE;
4521
4522 if (negative_response && oqname == NULL)
4523 fctx->attributes |= FCTX_ATTR_WANTNCACHE;
4524
4525 return (ISC_R_SUCCESS);
4526 }
4527
4528 static isc_result_t
4529 answer_response(fetchctx_t *fctx) {
4530 isc_result_t result;
4531 dns_message_t *message;
4532 dns_name_t *name, *qname, tname;
4533 dns_rdataset_t *rdataset;
4534 isc_boolean_t done, external, chaining, aa, found, want_chaining;
4535 isc_boolean_t have_answer, found_cname, found_type, wanted_chaining;
4536 unsigned int aflag;
4537 dns_rdatatype_t type;
4538 dns_fixedname_t dname, fqname;
4539
4540 FCTXTRACE("answer_response");
4541
4542 message = fctx->rmessage;
4543
4544 /*
4545 * Examine the answer section, marking those rdatasets which are
4546 * part of the answer and should be cached.
4547 */
4548
4549 done = ISC_FALSE;
4550 found_cname = ISC_FALSE;
4551 found_type = ISC_FALSE;
4552 chaining = ISC_FALSE;
4553 have_answer = ISC_FALSE;
4554 want_chaining = ISC_FALSE;
4555 if ((message->flags & DNS_MESSAGEFLAG_AA) != 0)
4556 aa = ISC_TRUE;
4557 else
4558 aa = ISC_FALSE;
4559 qname = &fctx->name;
4560 type = fctx->type;
4561 result = dns_message_firstname(message, DNS_SECTION_ANSWER);
4562 while (!done && result == ISC_R_SUCCESS) {
4563 name = NULL;
4564 dns_message_currentname(message, DNS_SECTION_ANSWER, &name);
4565 external = ISC_TF(!dns_name_issubdomain(name, &fctx->domain));
4566 if (dns_name_equal(name, qname)) {
4567 wanted_chaining = ISC_FALSE;
4568 for (rdataset = ISC_LIST_HEAD(name->list);
4569 rdataset != NULL;
4570 rdataset = ISC_LIST_NEXT(rdataset, link)) {
4571 found = ISC_FALSE;
4572 want_chaining = ISC_FALSE;
4573 aflag = 0;
4574 if (rdataset->type == type && !found_cname) {
4575 /*
4576 * We've found an ordinary answer.
4577 */
4578 found = ISC_TRUE;
4579 found_type = ISC_TRUE;
4580 done = ISC_TRUE;
4581 aflag = DNS_RDATASETATTR_ANSWER;
4582 } else if (type == dns_rdatatype_any) {
4583 /*
4584 * We've found an answer matching
4585 * an ANY query. There may be
4586 * more.
4587 */
4588 found = ISC_TRUE;
4589 aflag = DNS_RDATASETATTR_ANSWER;
4590 } else if (rdataset->type == dns_rdatatype_rrsig
4591 && rdataset->covers == type
4592 && !found_cname) {
4593 /*
4594 * We've found a signature that
4595 * covers the type we're looking for.
4596 */
4597 found = ISC_TRUE;
4598 found_type = ISC_TRUE;
4599 aflag = DNS_RDATASETATTR_ANSWERSIG;
4600 } else if (rdataset->type ==
4601 dns_rdatatype_cname
4602 && !found_type) {
4603 /*
4604 * We're looking for something else,
4605 * but we found a CNAME.
4606 *
4607 * Getting a CNAME response for some
4608 * query types is an error.
4609 */
4610 if (type == dns_rdatatype_rrsig ||
4611 type == dns_rdatatype_dnskey ||
4612 type == dns_rdatatype_nsec)
4613 return (DNS_R_FORMERR);
4614 found = ISC_TRUE;
4615 found_cname = ISC_TRUE;
4616 want_chaining = ISC_TRUE;
4617 aflag = DNS_RDATASETATTR_ANSWER;
4618 result = cname_target(rdataset,
4619 &tname);
4620 if (result != ISC_R_SUCCESS)
4621 return (result);
4622 } else if (rdataset->type == dns_rdatatype_rrsig
4623 && rdataset->covers ==
4624 dns_rdatatype_cname
4625 && !found_type) {
4626 /*
4627 * We're looking for something else,
4628 * but we found a SIG CNAME.
4629 */
4630 found = ISC_TRUE;
4631 found_cname = ISC_TRUE;
4632 aflag = DNS_RDATASETATTR_ANSWERSIG;
4633 }
4634
4635 if (found) {
4636 /*
4637 * We've found an answer to our
4638 * question.
4639 */
4640 name->attributes |=
4641 DNS_NAMEATTR_CACHE;
4642 rdataset->attributes |=
4643 DNS_RDATASETATTR_CACHE;
4644 rdataset->trust = dns_trust_answer;
4645 if (!chaining) {
4646 /*
4647 * This data is "the" answer
4648 * to our question only if
4649 * we're not chaining (i.e.
4650 * if we haven't followed
4651 * a CNAME or DNAME).
4652 */
4653 INSIST(!external);
4654 if (aflag ==
4655 DNS_RDATASETATTR_ANSWER)
4656 have_answer = ISC_TRUE;
4657 name->attributes |=
4658 DNS_NAMEATTR_ANSWER;
4659 rdataset->attributes |= aflag;
4660 if (aa)
4661 rdataset->trust =
4662 dns_trust_authanswer;
4663 } else if (external) {
4664 /*
4665 * This data is outside of
4666 * our query domain, and
4667 * may only be cached if it
4668 * comes from a secure zone
4669 * and validates.
4670 */
4671 rdataset->attributes |=
4672 DNS_RDATASETATTR_EXTERNAL;
4673 }
4674
4675 /*
4676 * Mark any additional data related
4677 * to this rdataset.
4678 */
4679 (void)dns_rdataset_additionaldata(
4680 rdataset,
4681 check_related,
4682 fctx);
4683
4684 /*
4685 * CNAME chaining.
4686 */
4687 if (want_chaining) {
4688 wanted_chaining = ISC_TRUE;
4689 name->attributes |=
4690 DNS_NAMEATTR_CHAINING;
4691 rdataset->attributes |=
4692 DNS_RDATASETATTR_CHAINING;
4693 qname = &tname;
4694 }
4695 }
4696 /*
4697 * We could add an "else" clause here and
4698 * log that we're ignoring this rdataset.
4699 */
4700 }
4701 /*
4702 * If wanted_chaining is true, we've done
4703 * some chaining as the result of processing
4704 * this node, and thus we need to set
4705 * chaining to true.
4706 *
4707 * We don't set chaining inside of the
4708 * rdataset loop because doing that would
4709 * cause us to ignore the signatures of
4710 * CNAMEs.
4711 */
4712 if (wanted_chaining)
4713 chaining = ISC_TRUE;
4714 } else {
4715 /*
4716 * Look for a DNAME (or its SIG). Anything else is
4717 * ignored.
4718 */
4719 wanted_chaining = ISC_FALSE;
4720 for (rdataset = ISC_LIST_HEAD(name->list);
4721 rdataset != NULL;
4722 rdataset = ISC_LIST_NEXT(rdataset, link)) {
4723 isc_boolean_t found_dname = ISC_FALSE;
4724 found = ISC_FALSE;
4725 aflag = 0;
4726 if (rdataset->type == dns_rdatatype_dname) {
4727 /*
4728 * We're looking for something else,
4729 * but we found a DNAME.
4730 *
4731 * If we're not chaining, then the
4732 * DNAME should not be external.
4733 */
4734 if (!chaining && external)
4735 return (DNS_R_FORMERR);
4736 found = ISC_TRUE;
4737 want_chaining = ISC_TRUE;
4738 aflag = DNS_RDATASETATTR_ANSWER;
4739 result = dname_target(rdataset,
4740 qname, name,
4741 &dname);
4742 if (result == ISC_R_NOSPACE) {
4743 /*
4744 * We can't construct the
4745 * DNAME target. Do not
4746 * try to continue.
4747 */
4748 want_chaining = ISC_FALSE;
4749 } else if (result != ISC_R_SUCCESS)
4750 return (result);
4751 else
4752 found_dname = ISC_TRUE;
4753 } else if (rdataset->type == dns_rdatatype_rrsig
4754 && rdataset->covers ==
4755 dns_rdatatype_dname) {
4756 /*
4757 * We've found a signature that
4758 * covers the DNAME.
4759 */
4760 found = ISC_TRUE;
4761 aflag = DNS_RDATASETATTR_ANSWERSIG;
4762 }
4763
4764 if (found) {
4765 /*
4766 * We've found an answer to our
4767 * question.
4768 */
4769 name->attributes |=
4770 DNS_NAMEATTR_CACHE;
4771 rdataset->attributes |=
4772 DNS_RDATASETATTR_CACHE;
4773 rdataset->trust = dns_trust_answer;
4774 if (!chaining) {
4775 /*
4776 * This data is "the" answer
4777 * to our question only if
4778 * we're not chaining.
4779 */
4780 INSIST(!external);
4781 if (aflag ==
4782 DNS_RDATASETATTR_ANSWER)
4783 have_answer = ISC_TRUE;
4784 name->attributes |=
4785 DNS_NAMEATTR_ANSWER;
4786 rdataset->attributes |= aflag;
4787 if (aa)
4788 rdataset->trust =
4789 dns_trust_authanswer;
4790 } else if (external) {
4791 rdataset->attributes |=
4792 DNS_RDATASETATTR_EXTERNAL;
4793 }
4794
4795 /*
4796 * DNAME chaining.
4797 */
4798 if (found_dname) {
4799 /*
4800 * Copy the the dname into the
4801 * qname fixed name.
4802 *
4803 * Although we check for
4804 * failure of the copy
4805 * operation, in practice it
4806 * should never fail since
4807 * we already know that the
4808 * result fits in a fixedname.
4809 */
4810 dns_fixedname_init(&fqname);
4811 result = dns_name_copy(
4812 dns_fixedname_name(&dname),
4813 dns_fixedname_name(&fqname),
4814 NULL);
4815 if (result != ISC_R_SUCCESS)
4816 return (result);
4817 wanted_chaining = ISC_TRUE;
4818 name->attributes |=
4819 DNS_NAMEATTR_CHAINING;
4820 rdataset->attributes |=
4821 DNS_RDATASETATTR_CHAINING;
4822 qname = dns_fixedname_name(
4823 &fqname);
4824 }
4825 }
4826 }
4827 if (wanted_chaining)
4828 chaining = ISC_TRUE;
4829 }
4830 result = dns_message_nextname(message, DNS_SECTION_ANSWER);
4831 }
4832 if (result == ISC_R_NOMORE)
4833 result = ISC_R_SUCCESS;
4834 if (result != ISC_R_SUCCESS)
4835 return (result);
4836
4837 /*
4838 * We should have found an answer.
4839 */
4840 if (!have_answer)
4841 return (DNS_R_FORMERR);
4842
4843 /*
4844 * This response is now potentially cacheable.
4845 */
4846 fctx->attributes |= FCTX_ATTR_WANTCACHE;
4847
4848 /*
4849 * Did chaining end before we got the final answer?
4850 */
4851 if (chaining) {
4852 /*
4853 * Yes. This may be a negative reply, so hand off
4854 * authority section processing to the noanswer code.
4855 * If it isn't a noanswer response, no harm will be
4856 * done.
4857 */
4858 return (noanswer_response(fctx, qname, ISC_FALSE));
4859 }
4860
4861 /*
4862 * We didn't end with an incomplete chain, so the rcode should be
4863 * "no error".
4864 */
4865 if (message->rcode != dns_rcode_noerror)
4866 return (DNS_R_FORMERR);
4867
4868 /*
4869 * Examine the authority section (if there is one).
4870 *
4871 * We expect there to be only one owner name for all the rdatasets
4872 * in this section, and we expect that it is not external.
4873 */
4874 done = ISC_FALSE;
4875 result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
4876 while (!done && result == ISC_R_SUCCESS) {
4877 name = NULL;
4878 dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
4879 external = ISC_TF(!dns_name_issubdomain(name, &fctx->domain));
4880 if (!external) {
4881 /*
4882 * We expect to find NS or SIG NS rdatasets, and
4883 * nothing else.
4884 */
4885 for (rdataset = ISC_LIST_HEAD(name->list);
4886 rdataset != NULL;
4887 rdataset = ISC_LIST_NEXT(rdataset, link)) {
4888 if (rdataset->type == dns_rdatatype_ns ||
4889 (rdataset->type == dns_rdatatype_rrsig &&
4890 rdataset->covers == dns_rdatatype_ns)) {
4891 name->attributes |=
4892 DNS_NAMEATTR_CACHE;
4893 rdataset->attributes |=
4894 DNS_RDATASETATTR_CACHE;
4895 if (aa && !chaining)
4896 rdataset->trust =
4897 dns_trust_authauthority;
4898 else
4899 rdataset->trust =
4900 dns_trust_additional;
4901
4902 /*
4903 * Mark any additional data related
4904 * to this rdataset.
4905 */
4906 (void)dns_rdataset_additionaldata(
4907 rdataset,
4908 check_related,
4909 fctx);
4910 done = ISC_TRUE;
4911 }
4912 }
4913 }
4914 result = dns_message_nextname(message, DNS_SECTION_AUTHORITY);
4915 }
4916 if (result == ISC_R_NOMORE)
4917 result = ISC_R_SUCCESS;
4918
4919 return (result);
4920 }
4921
4922 static void
4923 resume_dslookup(isc_task_t *task, isc_event_t *event) {
4924 dns_fetchevent_t *fevent;
4925 dns_resolver_t *res;
4926 fetchctx_t *fctx;
4927 isc_result_t result;
4928 isc_boolean_t bucket_empty = ISC_FALSE;
4929 isc_boolean_t locked = ISC_FALSE;
4930 unsigned int bucketnum;
4931 dns_rdataset_t nameservers;
4932 dns_fixedname_t fixed;
4933 dns_name_t *domain;
4934
4935 REQUIRE(event->ev_type == DNS_EVENT_FETCHDONE);
4936 fevent = (dns_fetchevent_t *)event;
4937 fctx = event->ev_arg;
4938 REQUIRE(VALID_FCTX(fctx));
4939 res = fctx->res;
4940
4941 UNUSED(task);
4942 FCTXTRACE("resume_dslookup");
4943
4944 if (fevent->node != NULL)
4945 dns_db_detachnode(fevent->db, &fevent->node);
4946 if (fevent->db != NULL)
4947 dns_db_detach(&fevent->db);
4948
4949 dns_rdataset_init(&nameservers);
4950
4951 bucketnum = fctx->bucketnum;
4952 if (fevent->result == ISC_R_CANCELED) {
4953 dns_resolver_destroyfetch(&fctx->nsfetch);
4954 fctx_done(fctx, ISC_R_CANCELED);
4955 } else if (fevent->result == ISC_R_SUCCESS) {
4956
4957 FCTXTRACE("resuming DS lookup");
4958
4959 dns_resolver_destroyfetch(&fctx->nsfetch);
4960 if (dns_rdataset_isassociated(&fctx->nameservers))
4961 dns_rdataset_disassociate(&fctx->nameservers);
4962 dns_rdataset_clone(fevent->rdataset, &fctx->nameservers);
4963 dns_name_free(&fctx->domain, fctx->res->mctx);
4964 dns_name_init(&fctx->domain, NULL);
4965 result = dns_name_dup(&fctx->nsname, fctx->res->mctx,
4966 &fctx->domain);
4967 if (result != ISC_R_SUCCESS) {
4968 fctx_done(fctx, DNS_R_SERVFAIL);
4969 goto cleanup;
4970 }
4971 /*
4972 * Try again.
4973 */
4974 fctx_try(fctx);
4975 } else {
4976 unsigned int n;
4977 dns_rdataset_t *nsrdataset = NULL;
4978
4979 /*
4980 * Retrieve state from fctx->nsfetch before we destroy it.
4981 */
4982 dns_fixedname_init(&fixed);
4983 domain = dns_fixedname_name(&fixed);
4984 dns_name_copy(&fctx->nsfetch->private->domain, domain, NULL);
4985 if (dns_name_equal(&fctx->nsname, domain)) {
4986 fctx_done(fctx, DNS_R_SERVFAIL);
4987 dns_resolver_destroyfetch(&fctx->nsfetch);
4988 goto cleanup;
4989 }
4990 if (dns_rdataset_isassociated(
4991 &fctx->nsfetch->private->nameservers)) {
4992 dns_rdataset_clone(
4993 &fctx->nsfetch->private->nameservers,
4994 &nameservers);
4995 nsrdataset = &nameservers;
4996 } else
4997 domain = NULL;
4998 dns_resolver_destroyfetch(&fctx->nsfetch);
4999 n = dns_name_countlabels(&fctx->nsname);
5000 dns_name_getlabelsequence(&fctx->nsname, 1, n - 1,
5001 &fctx->nsname);
5002
5003 if (dns_rdataset_isassociated(fevent->rdataset))
5004 dns_rdataset_disassociate(fevent->rdataset);
5005 FCTXTRACE("continuing to look for parent's NS records");
5006 result = dns_resolver_createfetch(fctx->res, &fctx->nsname,
5007 dns_rdatatype_ns, domain,
5008 nsrdataset, NULL, 0, task,
5009 resume_dslookup, fctx,
5010 &fctx->nsrrset, NULL,
5011 &fctx->nsfetch);
5012 if (result != ISC_R_SUCCESS)
5013 fctx_done(fctx, result);
5014 else {
5015 LOCK(&res->buckets[bucketnum].lock);
5016 locked = ISC_TRUE;
5017 fctx->references++;
5018 }
5019 }
5020
5021 cleanup:
5022 if (dns_rdataset_isassociated(&nameservers))
5023 dns_rdataset_disassociate(&nameservers);
5024 if (dns_rdataset_isassociated(fevent->rdataset))
5025 dns_rdataset_disassociate(fevent->rdataset);
5026 INSIST(fevent->sigrdataset == NULL);
5027 isc_event_free(&event);
5028 if (!locked)
5029 LOCK(&res->buckets[bucketnum].lock);
5030 fctx->references--;
5031 if (fctx->references == 0)
5032 bucket_empty = fctx_destroy(fctx);
5033 UNLOCK(&res->buckets[bucketnum].lock);
5034 if (bucket_empty)
5035 empty_bucket(res);
5036 }
5037
5038 static inline void
5039 checknamessection(dns_message_t *message, dns_section_t section) {
5040 isc_result_t result;
5041 dns_name_t *name;
5042 dns_rdata_t rdata = DNS_RDATA_INIT;
5043 dns_rdataset_t *rdataset;
5044
5045 for (result = dns_message_firstname(message, section);
5046 result == ISC_R_SUCCESS;
5047 result = dns_message_nextname(message, section))
5048 {
5049 name = NULL;
5050 dns_message_currentname(message, section, &name);
5051 for (rdataset = ISC_LIST_HEAD(name->list);
5052 rdataset != NULL;
5053 rdataset = ISC_LIST_NEXT(rdataset, link)) {
5054 for (result = dns_rdataset_first(rdataset);
5055 result == ISC_R_SUCCESS;
5056 result = dns_rdataset_next(rdataset)) {
5057 dns_rdataset_current(rdataset, &rdata);
5058 if (!dns_rdata_checkowner(name, rdata.rdclass,
5059 rdata.type,
5060 ISC_FALSE) ||
5061 !dns_rdata_checknames(&rdata, name, NULL))
5062 {
5063 rdataset->attributes |=
5064 DNS_RDATASETATTR_CHECKNAMES;
5065 }
5066 dns_rdata_reset(&rdata);
5067 }
5068 }
5069 }
5070 }
5071
5072 static void
5073 checknames(dns_message_t *message) {
5074
5075 checknamessection(message, DNS_SECTION_ANSWER);
5076 checknamessection(message, DNS_SECTION_AUTHORITY);
5077 checknamessection(message, DNS_SECTION_ADDITIONAL);
5078 }
5079
5080 static void
5081 log_packet(dns_message_t *message, int level, isc_mem_t *mctx) {
5082 isc_buffer_t buffer;
5083 char *buf = NULL;
5084 int len = 1024;
5085 isc_result_t result;
5086
5087 if (! isc_log_wouldlog(dns_lctx, level))
5088 return;
5089
5090 /*
5091 * Note that these are multiline debug messages. We want a newline
5092 * to appear in the log after each message.
5093 */
5094
5095 do {
5096 buf = isc_mem_get(mctx, len);
5097 if (buf == NULL)
5098 break;
5099 isc_buffer_init(&buffer, buf, len);
5100 result = dns_message_totext(message, &dns_master_style_debug,
5101 0, &buffer);
5102 if (result == ISC_R_NOSPACE) {
5103 isc_mem_put(mctx, buf, len);
5104 len += 1024;
5105 } else if (result == ISC_R_SUCCESS)
5106 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
5107 DNS_LOGMODULE_RESOLVER, level,
5108 "received packet:\n%.*s",
5109 (int)isc_buffer_usedlength(&buffer),
5110 buf);
5111 } while (result == ISC_R_NOSPACE);
5112
5113 if (buf != NULL)
5114 isc_mem_put(mctx, buf, len);
5115 }
5116
5117 static void
5118 resquery_response(isc_task_t *task, isc_event_t *event) {
5119 isc_result_t result = ISC_R_SUCCESS;
5120 resquery_t *query = event->ev_arg;
5121 dns_dispatchevent_t *devent = (dns_dispatchevent_t *)event;
5122 isc_boolean_t keep_trying, get_nameservers, resend;
5123 isc_boolean_t truncated;
5124 dns_message_t *message;
5125 fetchctx_t *fctx;
5126 dns_name_t *fname;
5127 dns_fixedname_t foundname;
5128 isc_stdtime_t now;
5129 isc_time_t tnow, *finish;
5130 dns_adbaddrinfo_t *addrinfo;
5131 unsigned int options;
5132 unsigned int findoptions;
5133 isc_result_t broken_server;
5134
5135 REQUIRE(VALID_QUERY(query));
5136 fctx = query->fctx;
5137 options = query->options;
5138 REQUIRE(VALID_FCTX(fctx));
5139 REQUIRE(event->ev_type == DNS_EVENT_DISPATCH);
5140
5141 QTRACE("response");
5142
5143 (void)isc_timer_touch(fctx->timer);
5144
5145 keep_trying = ISC_FALSE;
5146 broken_server = ISC_R_SUCCESS;
5147 get_nameservers = ISC_FALSE;
5148 resend = ISC_FALSE;
5149 truncated = ISC_FALSE;
5150 finish = NULL;
5151
5152 if (fctx->res->exiting) {
5153 result = ISC_R_SHUTTINGDOWN;
5154 goto done;
5155 }
5156
5157 fctx->timeouts = 0;
5158
5159 /*
5160 * XXXRTH We should really get the current time just once. We
5161 * need a routine to convert from an isc_time_t to an
5162 * isc_stdtime_t.
5163 */
5164 TIME_NOW(&tnow);
5165 finish = &tnow;
5166 isc_stdtime_get(&now);
5167
5168 /*
5169 * Did the dispatcher have a problem?
5170 */
5171 if (devent->result != ISC_R_SUCCESS) {
5172 if (devent->result == ISC_R_EOF &&
5173 (query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
5174 /*
5175 * The problem might be that they
5176 * don't understand EDNS0. Turn it
5177 * off and try again.
5178 */
5179 options |= DNS_FETCHOPT_NOEDNS0;
5180 resend = ISC_TRUE;
5181 /*
5182 * Remember that they don't like EDNS0.
5183 */
5184 dns_adb_changeflags(fctx->adb,
5185 query->addrinfo,
5186 DNS_FETCHOPT_NOEDNS0,
5187 DNS_FETCHOPT_NOEDNS0);
5188 } else {
5189 /*
5190 * There's no hope for this query.
5191 */
5192 keep_trying = ISC_TRUE;
5193 }
5194 goto done;
5195 }
5196
5197 message = fctx->rmessage;
5198
5199 if (query->tsig != NULL) {
5200 result = dns_message_setquerytsig(message, query->tsig);
5201 if (result != ISC_R_SUCCESS)
5202 goto done;
5203 }
5204
5205 if (query->tsigkey) {
5206 result = dns_message_settsigkey(message, query->tsigkey);
5207 if (result != ISC_R_SUCCESS)
5208 goto done;
5209 }
5210
5211 result = dns_message_parse(message, &devent->buffer, 0);
5212 if (result != ISC_R_SUCCESS) {
5213 switch (result) {
5214 case ISC_R_UNEXPECTEDEND:
5215 if (!message->question_ok ||
5216 (message->flags & DNS_MESSAGEFLAG_TC) == 0 ||
5217 (options & DNS_FETCHOPT_TCP) != 0) {
5218 /*
5219 * Either the message ended prematurely,
5220 * and/or wasn't marked as being truncated,
5221 * and/or this is a response to a query we
5222 * sent over TCP. In all of these cases,
5223 * something is wrong with the remote
5224 * server and we don't want to retry using
5225 * TCP.
5226 */
5227 if ((query->options & DNS_FETCHOPT_NOEDNS0)
5228 == 0) {
5229 /*
5230 * The problem might be that they
5231 * don't understand EDNS0. Turn it
5232 * off and try again.
5233 */
5234 options |= DNS_FETCHOPT_NOEDNS0;
5235 resend = ISC_TRUE;
5236 /*
5237 * Remember that they don't like EDNS0.
5238 */
5239 dns_adb_changeflags(
5240 fctx->adb,
5241 query->addrinfo,
5242 DNS_FETCHOPT_NOEDNS0,
5243 DNS_FETCHOPT_NOEDNS0);
5244 } else {
5245 broken_server = result;
5246 keep_trying = ISC_TRUE;
5247 }
5248 goto done;
5249 }
5250 /*
5251 * We defer retrying via TCP for a bit so we can
5252 * check out this message further.
5253 */
5254 truncated = ISC_TRUE;
5255 break;
5256 case DNS_R_FORMERR:
5257 if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
5258 /*
5259 * The problem might be that they
5260 * don't understand EDNS0. Turn it
5261 * off and try again.
5262 */
5263 options |= DNS_FETCHOPT_NOEDNS0;
5264 resend = ISC_TRUE;
5265 /*
5266 * Remember that they don't like EDNS0.
5267 */
5268 dns_adb_changeflags(fctx->adb,
5269 query->addrinfo,
5270 DNS_FETCHOPT_NOEDNS0,
5271 DNS_FETCHOPT_NOEDNS0);
5272 } else {
5273 broken_server = DNS_R_UNEXPECTEDRCODE;
5274 keep_trying = ISC_TRUE;
5275 }
5276 goto done;
5277 default:
5278 /*
5279 * Something bad has happened.
5280 */
5281 goto done;
5282 }
5283 }
5284
5285 /*
5286 * Log the incoming packet.
5287 */
5288 log_packet(message, ISC_LOG_DEBUG(10), fctx->res->mctx);
5289
5290 /*
5291 * If the message is signed, check the signature. If not, this
5292 * returns success anyway.
5293 */
5294 result = dns_message_checksig(message, fctx->res->view);
5295 if (result != ISC_R_SUCCESS)
5296 goto done;
5297
5298 /*
5299 * The dispatcher should ensure we only get responses with QR set.
5300 */
5301 INSIST((message->flags & DNS_MESSAGEFLAG_QR) != 0);
5302 /*
5303 * INSIST() that the message comes from the place we sent it to,
5304 * since the dispatch code should ensure this.
5305 *
5306 * INSIST() that the message id is correct (this should also be
5307 * ensured by the dispatch code).
5308 */
5309
5310
5311 /*
5312 * Deal with truncated responses by retrying using TCP.
5313 */
5314 if ((message->flags & DNS_MESSAGEFLAG_TC) != 0)
5315 truncated = ISC_TRUE;
5316
5317 if (truncated) {
5318 if ((options & DNS_FETCHOPT_TCP) != 0) {
5319 broken_server = DNS_R_TRUNCATEDTCP;
5320 keep_trying = ISC_TRUE;
5321 } else {
5322 options |= DNS_FETCHOPT_TCP;
5323 resend = ISC_TRUE;
5324 }
5325 goto done;
5326 }
5327
5328 /*
5329 * Is it a query response?
5330 */
5331 if (message->opcode != dns_opcode_query) {
5332 /* XXXRTH Log */
5333 broken_server = DNS_R_UNEXPECTEDOPCODE;
5334 keep_trying = ISC_TRUE;
5335 goto done;
5336 }
5337
5338 /*
5339 * Is the remote server broken, or does it dislike us?
5340 */
5341 if (message->rcode != dns_rcode_noerror &&
5342 message->rcode != dns_rcode_nxdomain) {
5343 if ((message->rcode == dns_rcode_formerr ||
5344 message->rcode == dns_rcode_notimp ||
5345 message->rcode == dns_rcode_servfail) &&
5346 (query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
5347 /*
5348 * It's very likely they don't like EDNS0.
5349 *
5350 * XXXRTH We should check if the question
5351 * we're asking requires EDNS0, and
5352 * if so, we should bail out.
5353 */
5354 options |= DNS_FETCHOPT_NOEDNS0;
5355 resend = ISC_TRUE;
5356 /*
5357 * Remember that they don't like EDNS0.
5358 */
5359 if (message->rcode != dns_rcode_servfail)
5360 dns_adb_changeflags(fctx->adb, query->addrinfo,
5361 DNS_FETCHOPT_NOEDNS0,
5362 DNS_FETCHOPT_NOEDNS0);
5363 } else if (message->rcode == dns_rcode_formerr) {
5364 if (ISFORWARDER(query->addrinfo)) {
5365 /*
5366 * This forwarder doesn't understand us,
5367 * but other forwarders might. Keep trying.
5368 */
5369 broken_server = DNS_R_REMOTEFORMERR;
5370 keep_trying = ISC_TRUE;
5371 } else {
5372 /*
5373 * The server doesn't understand us. Since
5374 * all servers for a zone need similar
5375 * capabilities, we assume that we will get
5376 * FORMERR from all servers, and thus we
5377 * cannot make any more progress with this
5378 * fetch.
5379 */
5380 result = DNS_R_FORMERR;
5381 }
5382 } else if (message->rcode == dns_rcode_yxdomain) {
5383 /*
5384 * DNAME mapping failed because the new name
5385 * was too long. There's no chance of success
5386 * for this fetch.
5387 */
5388 result = DNS_R_YXDOMAIN;
5389 } else {
5390 /*
5391 * XXXRTH log.
5392 */
5393 broken_server = DNS_R_UNEXPECTEDRCODE;
5394 INSIST(broken_server != ISC_R_SUCCESS);
5395 keep_trying = ISC_TRUE;
5396 }
5397 goto done;
5398 }
5399
5400 /*
5401 * Is the question the same as the one we asked?
5402 */
5403 result = same_question(fctx);
5404 if (result != ISC_R_SUCCESS) {
5405 /* XXXRTH Log */
5406 if (result == DNS_R_FORMERR)
5407 keep_trying = ISC_TRUE;
5408 goto done;
5409 }
5410
5411 /*
5412 * Is the server lame?
5413 */
5414 if (fctx->res->lame_ttl != 0 && !ISFORWARDER(query->addrinfo) &&
5415 is_lame(fctx)) {
5416 log_lame(fctx, query->addrinfo);
5417 result = dns_adb_marklame(fctx->adb, query->addrinfo,
5418 &fctx->domain,
5419 now + fctx->res->lame_ttl);
5420 if (result != ISC_R_SUCCESS)
5421 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
5422 DNS_LOGMODULE_RESOLVER, ISC_LOG_ERROR,
5423 "could not mark server as lame: %s",
5424 isc_result_totext(result));
5425 broken_server = DNS_R_LAME;
5426 keep_trying = ISC_TRUE;
5427 goto done;
5428 }
5429
5430 /*
5431 * Enforce delegations only zones like NET and COM.
5432 */
5433 if (!ISFORWARDER(query->addrinfo) &&
5434 dns_view_isdelegationonly(fctx->res->view, &fctx->domain) &&
5435 !dns_name_equal(&fctx->domain, &fctx->name) &&
5436 fix_mustbedelegationornxdomain(message, fctx)) {
5437 char namebuf[DNS_NAME_FORMATSIZE];
5438 char domainbuf[DNS_NAME_FORMATSIZE];
5439 char addrbuf[ISC_SOCKADDR_FORMATSIZE];
5440 char classbuf[64];
5441 char typebuf[64];
5442
5443 dns_name_format(&fctx->name, namebuf, sizeof(namebuf));
5444 dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
5445 dns_rdatatype_format(fctx->type, typebuf, sizeof(typebuf));
5446 dns_rdataclass_format(fctx->res->rdclass, classbuf,
5447 sizeof(classbuf));
5448 isc_sockaddr_format(&query->addrinfo->sockaddr, addrbuf,
5449 sizeof(addrbuf));
5450
5451 isc_log_write(dns_lctx, DNS_LOGCATEGORY_DELEGATION_ONLY,
5452 DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
5453 "enforced delegation-only for '%s' (%s/%s/%s) "
5454 "from %s",
5455 domainbuf, namebuf, typebuf, classbuf, addrbuf);
5456 }
5457
5458 if ((fctx->res->options & DNS_RESOLVER_CHECKNAMES) != 0)
5459 checknames(message);
5460
5461 /*
5462 * Clear cache bits.
5463 */
5464 fctx->attributes &= ~(FCTX_ATTR_WANTNCACHE | FCTX_ATTR_WANTCACHE);
5465
5466 /*
5467 * Did we get any answers?
5468 */
5469 if (message->counts[DNS_SECTION_ANSWER] > 0 &&
5470 (message->rcode == dns_rcode_noerror ||
5471 message->rcode == dns_rcode_nxdomain)) {
5472 /*
5473 * We've got answers. However, if we sent
5474 * a BIND 8 server an NS query, it may have
5475 * incorrectly responded with a non-authoritative
5476 * answer instead of a referral. Since this
5477 * answer lacks the SIGs necessary to do DNSSEC
5478 * validation, we must invoke the following special
5479 * kludge to treat it as a referral.
5480 */
5481 if (fctx->type == dns_rdatatype_ns &&
5482 (message->flags & DNS_MESSAGEFLAG_AA) == 0 &&
5483 !ISFORWARDER(query->addrinfo))
5484 {
5485 result = noanswer_response(fctx, NULL, ISC_TRUE);
5486 if (result != DNS_R_DELEGATION) {
5487 /*
5488 * The answer section must have contained
5489 * something other than the NS records
5490 * we asked for. Since AA is not set
5491 * and the server is not a forwarder,
5492 * it is technically lame and it's easier
5493 * to treat it as such than to figure out
5494 * some more elaborate course of action.
5495 */
5496 broken_server = DNS_R_LAME;
5497 keep_trying = ISC_TRUE;
5498 goto done;
5499 }
5500 goto force_referral;
5501 }
5502 result = answer_response(fctx);
5503 if (result != ISC_R_SUCCESS) {
5504 if (result == DNS_R_FORMERR)
5505 keep_trying = ISC_TRUE;
5506 goto done;
5507 }
5508 } else if (message->counts[DNS_SECTION_AUTHORITY] > 0 ||
5509 message->rcode == dns_rcode_noerror ||
5510 message->rcode == dns_rcode_nxdomain) {
5511 /*
5512 * NXDOMAIN, NXRDATASET, or referral.
5513 */
5514 result = noanswer_response(fctx, NULL, ISC_FALSE);
5515 if (result == DNS_R_CHASEDSSERVERS) {
5516 } else if (result == DNS_R_DELEGATION) {
5517 force_referral:
5518 /*
5519 * We don't have the answer, but we know a better
5520 * place to look.
5521 */
5522 get_nameservers = ISC_TRUE;
5523 keep_trying = ISC_TRUE;
5524 /*
5525 * We have a new set of name servers, and it
5526 * has not experienced any restarts yet.
5527 */
5528 fctx->restarts = 0;
5529 result = ISC_R_SUCCESS;
5530 } else if (result != ISC_R_SUCCESS) {
5531 /*
5532 * Something has gone wrong.
5533 */
5534 if (result == DNS_R_FORMERR)
5535 keep_trying = ISC_TRUE;
5536 goto done;
5537 }
5538 } else {
5539 /*
5540 * The server is insane.
5541 */
5542 /* XXXRTH Log */
5543 broken_server = DNS_R_UNEXPECTEDRCODE;
5544 keep_trying = ISC_TRUE;
5545 goto done;
5546 }
5547
5548 /*
5549 * Follow additional section data chains.
5550 */
5551 chase_additional(fctx);
5552
5553 /*
5554 * Cache the cacheable parts of the message. This may also cause
5555 * work to be queued to the DNSSEC validator.
5556 */
5557 if (WANTCACHE(fctx)) {
5558 result = cache_message(fctx, query->addrinfo, now);
5559 if (result != ISC_R_SUCCESS)
5560 goto done;
5561 }
5562
5563 /*
5564 * Ncache the negatively cacheable parts of the message. This may
5565 * also cause work to be queued to the DNSSEC validator.
5566 */
5567 if (WANTNCACHE(fctx)) {
5568 dns_rdatatype_t covers;
5569 if (message->rcode == dns_rcode_nxdomain)
5570 covers = dns_rdatatype_any;
5571 else
5572 covers = fctx->type;
5573
5574 /*
5575 * Cache any negative cache entries in the message.
5576 */
5577 result = ncache_message(fctx, query->addrinfo, covers, now);
5578 }
5579
5580 done:
5581 /*
5582 * Remember the query's addrinfo, in case we need to mark the
5583 * server as broken.
5584 */
5585 addrinfo = query->addrinfo;
5586
5587 /*
5588 * Cancel the query.
5589 *
5590 * XXXRTH Don't cancel the query if waiting for validation?
5591 */
5592 fctx_cancelquery(&query, &devent, finish, ISC_FALSE);
5593
5594 if (keep_trying) {
5595 if (result == DNS_R_FORMERR)
5596 broken_server = DNS_R_FORMERR;
5597 if (broken_server != ISC_R_SUCCESS) {
5598 /*
5599 * Add this server to the list of bad servers for
5600 * this fctx.
5601 */
5602 add_bad(fctx, &addrinfo->sockaddr, broken_server);
5603 }
5604
5605 if (get_nameservers) {
5606 dns_name_t *name;
5607 dns_fixedname_init(&foundname);
5608 fname = dns_fixedname_name(&foundname);
5609 if (result != ISC_R_SUCCESS) {
5610 fctx_done(fctx, DNS_R_SERVFAIL);
5611 return;
5612 }
5613 findoptions = 0;
5614 if (dns_rdatatype_atparent(fctx->type))
5615 findoptions |= DNS_DBFIND_NOEXACT;
5616 if ((options & DNS_FETCHOPT_UNSHARED) == 0)
5617 name = &fctx->name;
5618 else
5619 name = &fctx->domain;
5620 result = dns_view_findzonecut(fctx->res->view,
5621 name, fname,
5622 now, findoptions,
5623 ISC_TRUE,
5624 &fctx->nameservers,
5625 NULL);
5626 if (result != ISC_R_SUCCESS) {
5627 FCTXTRACE("couldn't find a zonecut");
5628 fctx_done(fctx, DNS_R_SERVFAIL);
5629 return;
5630 }
5631 if (!dns_name_issubdomain(fname, &fctx->domain)) {
5632 /*
5633 * The best nameservers are now above our
5634 * QDOMAIN.
5635 */
5636 FCTXTRACE("nameservers now above QDOMAIN");
5637 fctx_done(fctx, DNS_R_SERVFAIL);
5638 return;
5639 }
5640 dns_name_free(&fctx->domain, fctx->res->mctx);
5641 dns_name_init(&fctx->domain, NULL);
5642 result = dns_name_dup(fname, fctx->res->mctx,
5643 &fctx->domain);
5644 if (result != ISC_R_SUCCESS) {
5645 fctx_done(fctx, DNS_R_SERVFAIL);
5646 return;
5647 }
5648 fctx_cancelqueries(fctx, ISC_TRUE);
5649 fctx_cleanupfinds(fctx);
5650 fctx_cleanupaltfinds(fctx);
5651 fctx_cleanupforwaddrs(fctx);
5652 fctx_cleanupaltaddrs(fctx);
5653 }
5654 /*
5655 * Try again.
5656 */
5657 fctx_try(fctx);
5658 } else if (resend) {
5659 /*
5660 * Resend (probably with changed options).
5661 */
5662 FCTXTRACE("resend");
5663 result = fctx_query(fctx, addrinfo, options);
5664 if (result != ISC_R_SUCCESS)
5665 fctx_done(fctx, result);
5666 } else if (result == ISC_R_SUCCESS && !HAVE_ANSWER(fctx)) {
5667 /*
5668 * All has gone well so far, but we are waiting for the
5669 * DNSSEC validator to validate the answer.
5670 */
5671 FCTXTRACE("wait for validator");
5672 fctx_cancelqueries(fctx, ISC_TRUE);
5673 /*
5674 * We must not retransmit while the validator is working;
5675 * it has references to the current rmessage.
5676 */
5677 result = fctx_stopidletimer(fctx);
5678 if (result != ISC_R_SUCCESS)
5679 fctx_done(fctx, result);
5680 } else if (result == DNS_R_CHASEDSSERVERS) {
5681 unsigned int n;
5682 add_bad(fctx, &addrinfo->sockaddr, result);
5683 fctx_cancelqueries(fctx, ISC_TRUE);
5684 fctx_cleanupfinds(fctx);
5685 fctx_cleanupforwaddrs(fctx);
5686
5687 n = dns_name_countlabels(&fctx->name);
5688 dns_name_getlabelsequence(&fctx->name, 1, n - 1, &fctx->nsname);
5689
5690 FCTXTRACE("suspending DS lookup to find parent's NS records");
5691
5692 result = dns_resolver_createfetch(fctx->res, &fctx->nsname,
5693 dns_rdatatype_ns,
5694 NULL, NULL, NULL, 0, task,
5695 resume_dslookup, fctx,
5696 &fctx->nsrrset, NULL,
5697 &fctx->nsfetch);
5698 if (result != ISC_R_SUCCESS)
5699 fctx_done(fctx, result);
5700 LOCK(&fctx->res->buckets[fctx->bucketnum].lock);
5701 fctx->references++;
5702 UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock);
5703 result = fctx_stopidletimer(fctx);
5704 if (result != ISC_R_SUCCESS)
5705 fctx_done(fctx, result);
5706 } else {
5707 /*
5708 * We're done.
5709 */
5710 fctx_done(fctx, result);
5711 }
5712 }
5713
5714
5715 /***
5716 *** Resolver Methods
5717 ***/
5718
5719 static void
5720 destroy(dns_resolver_t *res) {
5721 unsigned int i;
5722 alternate_t *a;
5723
5724 REQUIRE(res->references == 0);
5725 REQUIRE(!res->priming);
5726 REQUIRE(res->primefetch == NULL);
5727
5728 RTRACE("destroy");
5729
5730 INSIST(res->nfctx == 0);
5731
5732 DESTROYLOCK(&res->primelock);
5733 DESTROYLOCK(&res->nlock);
5734 DESTROYLOCK(&res->lock);
5735 for (i = 0; i < res->nbuckets; i++) {
5736 INSIST(ISC_LIST_EMPTY(res->buckets[i].fctxs));
5737 isc_task_shutdown(res->buckets[i].task);
5738 isc_task_detach(&res->buckets[i].task);
5739 DESTROYLOCK(&res->buckets[i].lock);
5740 }
5741 isc_mem_put(res->mctx, res->buckets,
5742 res->nbuckets * sizeof(fctxbucket_t));
5743 if (res->dispatchv4 != NULL)
5744 dns_dispatch_detach(&res->dispatchv4);
5745 if (res->dispatchv6 != NULL)
5746 dns_dispatch_detach(&res->dispatchv6);
5747 while ((a = ISC_LIST_HEAD(res->alternates)) != NULL) {
5748 ISC_LIST_UNLINK(res->alternates, a, link);
5749 if (!a->isaddress)
5750 dns_name_free(&a->_u._n.name, res->mctx);
5751 isc_mem_put(res->mctx, a, sizeof(*a));
5752 }
5753 dns_resolver_reset_algorithms(res);
5754 dns_resolver_resetmustbesecure(res);
5755 #if USE_ALGLOCK
5756 isc_rwlock_destroy(&res->alglock);
5757 #endif
5758 #if USE_MBSLOCK
5759 isc_rwlock_destroy(&res->mbslock);
5760 #endif
5761 res->magic = 0;
5762 isc_mem_put(res->mctx, res, sizeof(*res));
5763 }
5764
5765 static void
5766 send_shutdown_events(dns_resolver_t *res) {
5767 isc_event_t *event, *next_event;
5768 isc_task_t *etask;
5769
5770 /*
5771 * Caller must be holding the resolver lock.
5772 */
5773
5774 for (event = ISC_LIST_HEAD(res->whenshutdown);
5775 event != NULL;
5776 event = next_event) {
5777 next_event = ISC_LIST_NEXT(event, ev_link);
5778 ISC_LIST_UNLINK(res->whenshutdown, event, ev_link);
5779 etask = event->ev_sender;
5780 event->ev_sender = res;
5781 isc_task_sendanddetach(&etask, &event);
5782 }
5783 }
5784
5785 static void
5786 empty_bucket(dns_resolver_t *res) {
5787 RTRACE("empty_bucket");
5788
5789 LOCK(&res->lock);
5790
5791 INSIST(res->activebuckets > 0);
5792 res->activebuckets--;
5793 if (res->activebuckets == 0)
5794 send_shutdown_events(res);
5795
5796 UNLOCK(&res->lock);
5797 }
5798
5799 isc_result_t
5800 dns_resolver_create(dns_view_t *view,
5801 isc_taskmgr_t *taskmgr, unsigned int ntasks,
5802 isc_socketmgr_t *socketmgr,
5803 isc_timermgr_t *timermgr,
5804 unsigned int options,
5805 dns_dispatchmgr_t *dispatchmgr,
5806 dns_dispatch_t *dispatchv4,
5807 dns_dispatch_t *dispatchv6,
5808 dns_resolver_t **resp)
5809 {
5810 dns_resolver_t *res;
5811 isc_result_t result = ISC_R_SUCCESS;
5812 unsigned int i, buckets_created = 0;
5813 char name[16];
5814
5815 /*
5816 * Create a resolver.
5817 */
5818
5819 REQUIRE(DNS_VIEW_VALID(view));
5820 REQUIRE(ntasks > 0);
5821 REQUIRE(resp != NULL && *resp == NULL);
5822 REQUIRE(dispatchmgr != NULL);
5823 REQUIRE(dispatchv4 != NULL || dispatchv6 != NULL);
5824
5825 res = isc_mem_get(view->mctx, sizeof(*res));
5826 if (res == NULL)
5827 return (ISC_R_NOMEMORY);
5828 RTRACE("create");
5829 res->mctx = view->mctx;
5830 res->rdclass = view->rdclass;
5831 res->socketmgr = socketmgr;
5832 res->timermgr = timermgr;
5833 res->taskmgr = taskmgr;
5834 res->dispatchmgr = dispatchmgr;
5835 res->view = view;
5836 res->options = options;
5837 res->lame_ttl = 0;
5838 ISC_LIST_INIT(res->alternates);
5839 res->udpsize = RECV_BUFFER_SIZE;
5840 res->algorithms = NULL;
5841 res->mustbesecure = NULL;
5842
5843 res->nbuckets = ntasks;
5844 res->activebuckets = ntasks;
5845 res->buckets = isc_mem_get(view->mctx,
5846 ntasks * sizeof(fctxbucket_t));
5847 if (res->buckets == NULL) {
5848 result = ISC_R_NOMEMORY;
5849 goto cleanup_res;
5850 }
5851 for (i = 0; i < ntasks; i++) {
5852 result = isc_mutex_init(&res->buckets[i].lock);
5853 if (result != ISC_R_SUCCESS)
5854 goto cleanup_buckets;
5855 res->buckets[i].task = NULL;
5856 result = isc_task_create(taskmgr, 0, &res->buckets[i].task);
5857 if (result != ISC_R_SUCCESS) {
5858 DESTROYLOCK(&res->buckets[i].lock);
5859 goto cleanup_buckets;
5860 }
5861 snprintf(name, sizeof(name), "res%u", i);
5862 isc_task_setname(res->buckets[i].task, name, res);
5863 ISC_LIST_INIT(res->buckets[i].fctxs);
5864 res->buckets[i].exiting = ISC_FALSE;
5865 buckets_created++;
5866 }
5867
5868 res->dispatchv4 = NULL;
5869 if (dispatchv4 != NULL)
5870 dns_dispatch_attach(dispatchv4, &res->dispatchv4);
5871 res->dispatchv6 = NULL;
5872 if (dispatchv6 != NULL)
5873 dns_dispatch_attach(dispatchv6, &res->dispatchv6);
5874
5875 res->references = 1;
5876 res->exiting = ISC_FALSE;
5877 res->frozen = ISC_FALSE;
5878 ISC_LIST_INIT(res->whenshutdown);
5879 res->priming = ISC_FALSE;
5880 res->primefetch = NULL;
5881 res->nfctx = 0;
5882
5883 result = isc_mutex_init(&res->lock);
5884 if (result != ISC_R_SUCCESS)
5885 goto cleanup_dispatches;
5886
5887 result = isc_mutex_init(&res->nlock);
5888 if (result != ISC_R_SUCCESS)
5889 goto cleanup_lock;
5890
5891 result = isc_mutex_init(&res->primelock);
5892 if (result != ISC_R_SUCCESS)
5893 goto cleanup_nlock;
5894
5895 #if USE_ALGLOCK
5896 result = isc_rwlock_init(&res->alglock, 0, 0);
5897 if (result != ISC_R_SUCCESS)
5898 goto cleanup_primelock;
5899 #endif
5900 #if USE_MBSLOCK
5901 result = isc_rwlock_init(&res->mbslock, 0, 0);
5902 if (result != ISC_R_SUCCESS)
5903 goto cleanup_alglock;
5904 #endif
5905
5906 res->magic = RES_MAGIC;
5907
5908 *resp = res;
5909
5910 return (ISC_R_SUCCESS);
5911
5912 #if USE_MBSLOCK
5913 cleanup_alglock:
5914 #if USE_ALGLOCK
5915 isc_rwlock_destroy(&res->alglock);
5916 #endif
5917 #endif
5918 #if USE_ALGLOCK || USE_MBSLOCK
5919 cleanup_primelock:
5920 DESTROYLOCK(&res->primelock);
5921 #endif
5922
5923 cleanup_nlock:
5924 DESTROYLOCK(&res->nlock);
5925
5926 cleanup_lock:
5927 DESTROYLOCK(&res->lock);
5928
5929 cleanup_dispatches:
5930 if (res->dispatchv6 != NULL)
5931 dns_dispatch_detach(&res->dispatchv6);
5932 if (res->dispatchv4 != NULL)
5933 dns_dispatch_detach(&res->dispatchv4);
5934
5935 cleanup_buckets:
5936 for (i = 0; i < buckets_created; i++) {
5937 DESTROYLOCK(&res->buckets[i].lock);
5938 isc_task_shutdown(res->buckets[i].task);
5939 isc_task_detach(&res->buckets[i].task);
5940 }
5941 isc_mem_put(view->mctx, res->buckets,
5942 res->nbuckets * sizeof(fctxbucket_t));
5943
5944 cleanup_res:
5945 isc_mem_put(view->mctx, res, sizeof(*res));
5946
5947 return (result);
5948 }
5949
5950 static void
5951 prime_done(isc_task_t *task, isc_event_t *event) {
5952 dns_resolver_t *res;
5953 dns_fetchevent_t *fevent;
5954 dns_fetch_t *fetch;
5955
5956 REQUIRE(event->ev_type == DNS_EVENT_FETCHDONE);
5957 fevent = (dns_fetchevent_t *)event;
5958 res = event->ev_arg;
5959 REQUIRE(VALID_RESOLVER(res));
5960
5961 UNUSED(task);
5962
5963 LOCK(&res->lock);
5964
5965 INSIST(res->priming);
5966 res->priming = ISC_FALSE;
5967 LOCK(&res->primelock);
5968 fetch = res->primefetch;
5969 res->primefetch = NULL;
5970 UNLOCK(&res->primelock);
5971
5972 UNLOCK(&res->lock);
5973
5974 if (fevent->node != NULL)
5975 dns_db_detachnode(fevent->db, &fevent->node);
5976 if (fevent->db != NULL)
5977 dns_db_detach(&fevent->db);
5978 if (dns_rdataset_isassociated(fevent->rdataset))
5979 dns_rdataset_disassociate(fevent->rdataset);
5980 INSIST(fevent->sigrdataset == NULL);
5981
5982 isc_mem_put(res->mctx, fevent->rdataset, sizeof(*fevent->rdataset));
5983
5984 isc_event_free(&event);
5985 dns_resolver_destroyfetch(&fetch);
5986 }
5987
5988 void
5989 dns_resolver_prime(dns_resolver_t *res) {
5990 isc_boolean_t want_priming = ISC_FALSE;
5991 dns_rdataset_t *rdataset;
5992 isc_result_t result;
5993
5994 REQUIRE(VALID_RESOLVER(res));
5995 REQUIRE(res->frozen);
5996
5997 RTRACE("dns_resolver_prime");
5998
5999 LOCK(&res->lock);
6000
6001 if (!res->exiting && !res->priming) {
6002 INSIST(res->primefetch == NULL);
6003 res->priming = ISC_TRUE;
6004 want_priming = ISC_TRUE;
6005 }
6006
6007 UNLOCK(&res->lock);
6008
6009 if (want_priming) {
6010 /*
6011 * To avoid any possible recursive locking problems, we
6012 * start the priming fetch like any other fetch, and holding
6013 * no resolver locks. No one else will try to start it
6014 * because we're the ones who set res->priming to true.
6015 * Any other callers of dns_resolver_prime() while we're
6016 * running will see that res->priming is already true and
6017 * do nothing.
6018 */
6019 RTRACE("priming");
6020 rdataset = isc_mem_get(res->mctx, sizeof(*rdataset));
6021 if (rdataset == NULL) {
6022 LOCK(&res->lock);
6023 INSIST(res->priming);
6024 INSIST(res->primefetch == NULL);
6025 res->priming = ISC_FALSE;
6026 UNLOCK(&res->lock);
6027 return;
6028 }
6029 dns_rdataset_init(rdataset);
6030 LOCK(&res->primelock);
6031 result = dns_resolver_createfetch(res, dns_rootname,
6032 dns_rdatatype_ns,
6033 NULL, NULL, NULL, 0,
6034 res->buckets[0].task,
6035 prime_done,
6036 res, rdataset, NULL,
6037 &res->primefetch);
6038 UNLOCK(&res->primelock);
6039 if (result != ISC_R_SUCCESS) {
6040 LOCK(&res->lock);
6041 INSIST(res->priming);
6042 res->priming = ISC_FALSE;
6043 UNLOCK(&res->lock);
6044 }
6045 }
6046 }
6047
6048 void
6049 dns_resolver_freeze(dns_resolver_t *res) {
6050
6051 /*
6052 * Freeze resolver.
6053 */
6054
6055 REQUIRE(VALID_RESOLVER(res));
6056 REQUIRE(!res->frozen);
6057
6058 res->frozen = ISC_TRUE;
6059 }
6060
6061 void
6062 dns_resolver_attach(dns_resolver_t *source, dns_resolver_t **targetp) {
6063 REQUIRE(VALID_RESOLVER(source));
6064 REQUIRE(targetp != NULL && *targetp == NULL);
6065
6066 RRTRACE(source, "attach");
6067 LOCK(&source->lock);
6068 REQUIRE(!source->exiting);
6069
6070 INSIST(source->references > 0);
6071 source->references++;
6072 INSIST(source->references != 0);
6073 UNLOCK(&source->lock);
6074
6075 *targetp = source;
6076 }
6077
6078 void
6079 dns_resolver_whenshutdown(dns_resolver_t *res, isc_task_t *task,
6080 isc_event_t **eventp)
6081 {
6082 isc_task_t *clone;
6083 isc_event_t *event;
6084
6085 REQUIRE(VALID_RESOLVER(res));
6086 REQUIRE(eventp != NULL);
6087
6088 event = *eventp;
6089 *eventp = NULL;
6090
6091 LOCK(&res->lock);
6092
6093 if (res->exiting && res->activebuckets == 0) {
6094 /*
6095 * We're already shutdown. Send the event.
6096 */
6097 event->ev_sender = res;
6098 isc_task_send(task, &event);
6099 } else {
6100 clone = NULL;
6101 isc_task_attach(task, &clone);
6102 event->ev_sender = clone;
6103 ISC_LIST_APPEND(res->whenshutdown, event, ev_link);
6104 }
6105
6106 UNLOCK(&res->lock);
6107 }
6108
6109 void
6110 dns_resolver_shutdown(dns_resolver_t *res) {
6111 unsigned int i;
6112 fetchctx_t *fctx;
6113 isc_socket_t *sock;
6114
6115 REQUIRE(VALID_RESOLVER(res));
6116
6117 RTRACE("shutdown");
6118
6119 LOCK(&res->lock);
6120
6121 if (!res->exiting) {
6122 RTRACE("exiting");
6123 res->exiting = ISC_TRUE;
6124
6125 for (i = 0; i < res->nbuckets; i++) {
6126 LOCK(&res->buckets[i].lock);
6127 for (fctx = ISC_LIST_HEAD(res->buckets[i].fctxs);
6128 fctx != NULL;
6129 fctx = ISC_LIST_NEXT(fctx, link))
6130 fctx_shutdown(fctx);
6131 if (res->dispatchv4 != NULL) {
6132 sock = dns_dispatch_getsocket(res->dispatchv4);
6133 isc_socket_cancel(sock, res->buckets[i].task,
6134 ISC_SOCKCANCEL_ALL);
6135 }
6136 if (res->dispatchv6 != NULL) {
6137 sock = dns_dispatch_getsocket(res->dispatchv6);
6138 isc_socket_cancel(sock, res->buckets[i].task,
6139 ISC_SOCKCANCEL_ALL);
6140 }
6141 res->buckets[i].exiting = ISC_TRUE;
6142 if (ISC_LIST_EMPTY(res->buckets[i].fctxs)) {
6143 INSIST(res->activebuckets > 0);
6144 res->activebuckets--;
6145 }
6146 UNLOCK(&res->buckets[i].lock);
6147 }
6148 if (res->activebuckets == 0)
6149 send_shutdown_events(res);
6150 }
6151
6152 UNLOCK(&res->lock);
6153 }
6154
6155 void
6156 dns_resolver_detach(dns_resolver_t **resp) {
6157 dns_resolver_t *res;
6158 isc_boolean_t need_destroy = ISC_FALSE;
6159
6160 REQUIRE(resp != NULL);
6161 res = *resp;
6162 REQUIRE(VALID_RESOLVER(res));
6163
6164 RTRACE("detach");
6165
6166 LOCK(&res->lock);
6167
6168 INSIST(res->references > 0);
6169 res->references--;
6170 if (res->references == 0) {
6171 INSIST(res->exiting && res->activebuckets == 0);
6172 need_destroy = ISC_TRUE;
6173 }
6174
6175 UNLOCK(&res->lock);
6176
6177 if (need_destroy)
6178 destroy(res);
6179
6180 *resp = NULL;
6181 }
6182
6183 static inline isc_boolean_t
6184 fctx_match(fetchctx_t *fctx, dns_name_t *name, dns_rdatatype_t type,
6185 unsigned int options)
6186 {
6187 if (fctx->type != type || fctx->options != options)
6188 return (ISC_FALSE);
6189 return (dns_name_equal(&fctx->name, name));
6190 }
6191
6192 static inline void
6193 log_fetch(dns_name_t *name, dns_rdatatype_t type) {
6194 char namebuf[DNS_NAME_FORMATSIZE];
6195 char typebuf[DNS_RDATATYPE_FORMATSIZE];
6196 int level = ISC_LOG_DEBUG(1);
6197
6198 if (! isc_log_wouldlog(dns_lctx, level))
6199 return;
6200
6201 dns_name_format(name, namebuf, sizeof(namebuf));
6202 dns_rdatatype_format(type, typebuf, sizeof(typebuf));
6203
6204 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
6205 DNS_LOGMODULE_RESOLVER, level,
6206 "createfetch: %s %s", namebuf, typebuf);
6207 }
6208
6209 isc_result_t
6210 dns_resolver_createfetch(dns_resolver_t *res, dns_name_t *name,
6211 dns_rdatatype_t type,
6212 dns_name_t *domain, dns_rdataset_t *nameservers,
6213 dns_forwarders_t *forwarders,
6214 unsigned int options, isc_task_t *task,
6215 isc_taskaction_t action, void *arg,
6216 dns_rdataset_t *rdataset,
6217 dns_rdataset_t *sigrdataset,
6218 dns_fetch_t **fetchp)
6219 {
6220 dns_fetch_t *fetch;
6221 fetchctx_t *fctx = NULL;
6222 isc_result_t result;
6223 unsigned int bucketnum;
6224 isc_boolean_t new_fctx = ISC_FALSE;
6225 isc_event_t *event;
6226
6227 UNUSED(forwarders);
6228
6229 REQUIRE(VALID_RESOLVER(res));
6230 REQUIRE(res->frozen);
6231 /* XXXRTH Check for meta type */
6232 if (domain != NULL) {
6233 REQUIRE(DNS_RDATASET_VALID(nameservers));
6234 REQUIRE(nameservers->type == dns_rdatatype_ns);
6235 } else
6236 REQUIRE(nameservers == NULL);
6237 REQUIRE(forwarders == NULL);
6238 REQUIRE(!dns_rdataset_isassociated(rdataset));
6239 REQUIRE(sigrdataset == NULL ||
6240 !dns_rdataset_isassociated(sigrdataset));
6241 REQUIRE(fetchp != NULL && *fetchp == NULL);
6242
6243 log_fetch(name, type);
6244
6245 /*
6246 * XXXRTH use a mempool?
6247 */
6248 fetch = isc_mem_get(res->mctx, sizeof(*fetch));
6249 if (fetch == NULL)
6250 return (ISC_R_NOMEMORY);
6251
6252 bucketnum = dns_name_hash(name, ISC_FALSE) % res->nbuckets;
6253
6254 LOCK(&res->buckets[bucketnum].lock);
6255
6256 if (res->buckets[bucketnum].exiting) {
6257 result = ISC_R_SHUTTINGDOWN;
6258 goto unlock;
6259 }
6260
6261 if ((options & DNS_FETCHOPT_UNSHARED) == 0) {
6262 for (fctx = ISC_LIST_HEAD(res->buckets[bucketnum].fctxs);
6263 fctx != NULL;
6264 fctx = ISC_LIST_NEXT(fctx, link)) {
6265 if (fctx_match(fctx, name, type, options))
6266 break;
6267 }
6268 }
6269
6270 /*
6271 * If we didn't have a fetch, would attach to a done fetch, this
6272 * fetch has already cloned its results, or if the fetch has gone
6273 * "idle" (no one was interested in it), we need to start a new
6274 * fetch instead of joining with the existing one.
6275 */
6276 if (fctx == NULL ||
6277 fctx->state == fetchstate_done ||
6278 fctx->cloned ||
6279 ISC_LIST_EMPTY(fctx->events)) {
6280 fctx = NULL;
6281 result = fctx_create(res, name, type, domain, nameservers,
6282 options, bucketnum, &fctx);
6283 if (result != ISC_R_SUCCESS)
6284 goto unlock;
6285 new_fctx = ISC_TRUE;
6286 }
6287
6288 result = fctx_join(fctx, task, action, arg,
6289 rdataset, sigrdataset, fetch);
6290 if (new_fctx) {
6291 if (result == ISC_R_SUCCESS) {
6292 /*
6293 * Launch this fctx.
6294 */
6295 event = &fctx->control_event;
6296 ISC_EVENT_INIT(event, sizeof(*event), 0, NULL,
6297 DNS_EVENT_FETCHCONTROL,
6298 fctx_start, fctx, NULL,
6299 NULL, NULL);
6300 isc_task_send(res->buckets[bucketnum].task, &event);
6301 } else {
6302 /*
6303 * We don't care about the result of fctx_destroy()
6304 * since we know we're not exiting.
6305 */
6306 (void)fctx_destroy(fctx);
6307 }
6308 }
6309
6310 unlock:
6311 UNLOCK(&res->buckets[bucketnum].lock);
6312
6313 if (result == ISC_R_SUCCESS) {
6314 FTRACE("created");
6315 *fetchp = fetch;
6316 } else
6317 isc_mem_put(res->mctx, fetch, sizeof(*fetch));
6318
6319 return (result);
6320 }
6321
6322 void
6323 dns_resolver_cancelfetch(dns_fetch_t *fetch) {
6324 fetchctx_t *fctx;
6325 dns_resolver_t *res;
6326 dns_fetchevent_t *event, *next_event;
6327 isc_task_t *etask;
6328
6329 REQUIRE(DNS_FETCH_VALID(fetch));
6330 fctx = fetch->private;
6331 REQUIRE(VALID_FCTX(fctx));
6332 res = fctx->res;
6333
6334 FTRACE("cancelfetch");
6335
6336 LOCK(&res->buckets[fctx->bucketnum].lock);
6337
6338 /*
6339 * Find the completion event for this fetch (as opposed
6340 * to those for other fetches that have joined the same
6341 * fctx) and send it with result = ISC_R_CANCELED.
6342 */
6343 event = NULL;
6344 if (fctx->state != fetchstate_done) {
6345 for (event = ISC_LIST_HEAD(fctx->events);
6346 event != NULL;
6347 event = next_event) {
6348 next_event = ISC_LIST_NEXT(event, ev_link);
6349 if (event->fetch == fetch) {
6350 ISC_LIST_UNLINK(fctx->events, event, ev_link);
6351 break;
6352 }
6353 }
6354 }
6355 if (event != NULL) {
6356 etask = event->ev_sender;
6357 event->ev_sender = fctx;
6358 event->result = ISC_R_CANCELED;
6359 isc_task_sendanddetach(&etask, ISC_EVENT_PTR(&event));
6360 }
6361 /*
6362 * The fctx continues running even if no fetches remain;
6363 * the answer is still cached.
6364 */
6365
6366 UNLOCK(&res->buckets[fctx->bucketnum].lock);
6367 }
6368
6369 void
6370 dns_resolver_destroyfetch(dns_fetch_t **fetchp) {
6371 dns_fetch_t *fetch;
6372 dns_resolver_t *res;
6373 dns_fetchevent_t *event, *next_event;
6374 fetchctx_t *fctx;
6375 unsigned int bucketnum;
6376 isc_boolean_t bucket_empty = ISC_FALSE;
6377
6378 REQUIRE(fetchp != NULL);
6379 fetch = *fetchp;
6380 REQUIRE(DNS_FETCH_VALID(fetch));
6381 fctx = fetch->private;
6382 REQUIRE(VALID_FCTX(fctx));
6383 res = fctx->res;
6384
6385 FTRACE("destroyfetch");
6386
6387 bucketnum = fctx->bucketnum;
6388 LOCK(&res->buckets[bucketnum].lock);
6389
6390 /*
6391 * Sanity check: the caller should have gotten its event before
6392 * trying to destroy the fetch.
6393 */
6394 event = NULL;
6395 if (fctx->state != fetchstate_done) {
6396 for (event = ISC_LIST_HEAD(fctx->events);
6397 event != NULL;
6398 event = next_event) {
6399 next_event = ISC_LIST_NEXT(event, ev_link);
6400 RUNTIME_CHECK(event->fetch != fetch);
6401 }
6402 }
6403
6404 INSIST(fctx->references > 0);
6405 fctx->references--;
6406 if (fctx->references == 0) {
6407 /*
6408 * No one cares about the result of this fetch anymore.
6409 */
6410 if (fctx->pending == 0 && fctx->nqueries == 0 &&
6411 ISC_LIST_EMPTY(fctx->validators) &&
6412 SHUTTINGDOWN(fctx)) {
6413 /*
6414 * This fctx is already shutdown; we were just
6415 * waiting for the last reference to go away.
6416 */
6417 bucket_empty = fctx_destroy(fctx);
6418 } else {
6419 /*
6420 * Initiate shutdown.
6421 */
6422 fctx_shutdown(fctx);
6423 }
6424 }
6425
6426 UNLOCK(&res->buckets[bucketnum].lock);
6427
6428 isc_mem_put(res->mctx, fetch, sizeof(*fetch));
6429 *fetchp = NULL;
6430
6431 if (bucket_empty)
6432 empty_bucket(res);
6433 }
6434
6435 dns_dispatchmgr_t *
6436 dns_resolver_dispatchmgr(dns_resolver_t *resolver) {
6437 REQUIRE(VALID_RESOLVER(resolver));
6438 return (resolver->dispatchmgr);
6439 }
6440
6441 dns_dispatch_t *
6442 dns_resolver_dispatchv4(dns_resolver_t *resolver) {
6443 REQUIRE(VALID_RESOLVER(resolver));
6444 return (resolver->dispatchv4);
6445 }
6446
6447 dns_dispatch_t *
6448 dns_resolver_dispatchv6(dns_resolver_t *resolver) {
6449 REQUIRE(VALID_RESOLVER(resolver));
6450 return (resolver->dispatchv6);
6451 }
6452
6453 isc_socketmgr_t *
6454 dns_resolver_socketmgr(dns_resolver_t *resolver) {
6455 REQUIRE(VALID_RESOLVER(resolver));
6456 return (resolver->socketmgr);
6457 }
6458
6459 isc_taskmgr_t *
6460 dns_resolver_taskmgr(dns_resolver_t *resolver) {
6461 REQUIRE(VALID_RESOLVER(resolver));
6462 return (resolver->taskmgr);
6463 }
6464
6465 isc_uint32_t
6466 dns_resolver_getlamettl(dns_resolver_t *resolver) {
6467 REQUIRE(VALID_RESOLVER(resolver));
6468 return (resolver->lame_ttl);
6469 }
6470
6471 void
6472 dns_resolver_setlamettl(dns_resolver_t *resolver, isc_uint32_t lame_ttl) {
6473 REQUIRE(VALID_RESOLVER(resolver));
6474 resolver->lame_ttl = lame_ttl;
6475 }
6476
6477 unsigned int
6478 dns_resolver_nrunning(dns_resolver_t *resolver) {
6479 unsigned int n;
6480 LOCK(&resolver->nlock);
6481 n = resolver->nfctx;
6482 UNLOCK(&resolver->nlock);
6483 return (n);
6484 }
6485
6486 isc_result_t
6487 dns_resolver_addalternate(dns_resolver_t *resolver, isc_sockaddr_t *alt,
6488 dns_name_t *name, in_port_t port) {
6489 alternate_t *a;
6490 isc_result_t result;
6491
6492 REQUIRE(VALID_RESOLVER(resolver));
6493 REQUIRE(!resolver->frozen);
6494 REQUIRE((alt == NULL) ^ (name == NULL));
6495
6496 a = isc_mem_get(resolver->mctx, sizeof(*a));
6497 if (a == NULL)
6498 return (ISC_R_NOMEMORY);
6499 if (alt != NULL) {
6500 a->isaddress = ISC_TRUE;
6501 a->_u.addr = *alt;
6502 } else {
6503 a->isaddress = ISC_FALSE;
6504 a->_u._n.port = port;
6505 dns_name_init(&a->_u._n.name, NULL);
6506 result = dns_name_dup(name, resolver->mctx, &a->_u._n.name);
6507 if (result != ISC_R_SUCCESS) {
6508 isc_mem_put(resolver->mctx, a, sizeof(*a));
6509 return (result);
6510 }
6511 }
6512 ISC_LINK_INIT(a, link);
6513 ISC_LIST_APPEND(resolver->alternates, a, link);
6514
6515 return (ISC_R_SUCCESS);
6516 }
6517
6518 void
6519 dns_resolver_setudpsize(dns_resolver_t *resolver, isc_uint16_t udpsize) {
6520 REQUIRE(VALID_RESOLVER(resolver));
6521 resolver->udpsize = udpsize;
6522 }
6523
6524 isc_uint16_t
6525 dns_resolver_getudpsize(dns_resolver_t *resolver) {
6526 REQUIRE(VALID_RESOLVER(resolver));
6527 return (resolver->udpsize);
6528 }
6529
6530 static void
6531 free_algorithm(void *node, void *arg) {
6532 unsigned char *algorithms = node;
6533 isc_mem_t *mctx = arg;
6534
6535 isc_mem_put(mctx, algorithms, *algorithms);
6536 }
6537
6538 void
6539 dns_resolver_reset_algorithms(dns_resolver_t *resolver) {
6540
6541 REQUIRE(VALID_RESOLVER(resolver));
6542
6543 #if USE_ALGLOCK
6544 RWLOCK(&resolver->alglock, isc_rwlocktype_write);
6545 #endif
6546 if (resolver->algorithms != NULL)
6547 dns_rbt_destroy(&resolver->algorithms);
6548 #if USE_ALGLOCK
6549 RWUNLOCK(&resolver->alglock, isc_rwlocktype_write);
6550 #endif
6551 }
6552
6553 isc_result_t
6554 dns_resolver_disable_algorithm(dns_resolver_t *resolver, dns_name_t *name,
6555 unsigned int alg)
6556 {
6557 unsigned int len, mask;
6558 unsigned char *new;
6559 unsigned char *algorithms;
6560 isc_result_t result;
6561 dns_rbtnode_t *node = NULL;
6562
6563 REQUIRE(VALID_RESOLVER(resolver));
6564 if (alg > 255)
6565 return (ISC_R_RANGE);
6566
6567 #if USE_ALGLOCK
6568 RWLOCK(&resolver->alglock, isc_rwlocktype_write);
6569 #endif
6570 if (resolver->algorithms == NULL) {
6571 result = dns_rbt_create(resolver->mctx, free_algorithm,
6572 resolver->mctx, &resolver->algorithms);
6573 if (result != ISC_R_SUCCESS)
6574 goto cleanup;
6575 }
6576
6577 len = alg/8 + 2;
6578 mask = 1 << (alg%8);
6579
6580 result = dns_rbt_addnode(resolver->algorithms, name, &node);
6581
6582 if (result == ISC_R_SUCCESS || result == ISC_R_EXISTS) {
6583 algorithms = node->data;
6584 if (algorithms == NULL || len > *algorithms) {
6585 new = isc_mem_get(resolver->mctx, len);
6586 if (new == NULL) {
6587 result = ISC_R_NOMEMORY;
6588 goto cleanup;
6589 }
6590 memset(new, 0, len);
6591 if (algorithms != NULL)
6592 memcpy(new, algorithms, *algorithms);
6593 new[len-1] |= mask;
6594 *new = len;
6595 node->data = new;
6596 if (algorithms != NULL)
6597 isc_mem_put(resolver->mctx, algorithms,
6598 *algorithms);
6599 } else
6600 algorithms[len-1] |= mask;
6601 }
6602 result = ISC_R_SUCCESS;
6603 cleanup:
6604 #if USE_ALGLOCK
6605 RWUNLOCK(&resolver->alglock, isc_rwlocktype_write);
6606 #endif
6607 return (result);
6608 }
6609
6610 isc_boolean_t
6611 dns_resolver_algorithm_supported(dns_resolver_t *resolver, dns_name_t *name,
6612 unsigned int alg)
6613 {
6614 unsigned int len, mask;
6615 unsigned char *algorithms;
6616 void *data = NULL;
6617 isc_result_t result;
6618 isc_boolean_t found = ISC_FALSE;
6619
6620 REQUIRE(VALID_RESOLVER(resolver));
6621
6622 #if USE_ALGLOCK
6623 RWLOCK(&resolver->alglock, isc_rwlocktype_read);
6624 #endif
6625 if (resolver->algorithms == NULL)
6626 goto unlock;
6627 result = dns_rbt_findname(resolver->algorithms, name, 0, NULL, &data);
6628 if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
6629 len = alg/8 + 2;
6630 mask = 1 << (alg%8);
6631 algorithms = data;
6632 if (len <= *algorithms && (algorithms[len-1] & mask) != 0)
6633 found = ISC_TRUE;
6634 }
6635 unlock:
6636 #if USE_ALGLOCK
6637 RWUNLOCK(&resolver->alglock, isc_rwlocktype_read);
6638 #endif
6639 if (found)
6640 return (ISC_FALSE);
6641 return (dst_algorithm_supported(alg));
6642 }
6643
6644 void
6645 dns_resolver_resetmustbesecure(dns_resolver_t *resolver) {
6646
6647 REQUIRE(VALID_RESOLVER(resolver));
6648
6649 #if USE_MBSLOCK
6650 RWLOCK(&resolver->mbslock, isc_rwlocktype_write);
6651 #endif
6652 if (resolver->mustbesecure != NULL)
6653 dns_rbt_destroy(&resolver->mustbesecure);
6654 #if USE_MBSLOCK
6655 RWUNLOCK(&resolver->mbslock, isc_rwlocktype_write);
6656 #endif
6657 }
6658
6659 static isc_boolean_t yes = ISC_TRUE, no = ISC_FALSE;
6660
6661 isc_result_t
6662 dns_resolver_setmustbesecure(dns_resolver_t *resolver, dns_name_t *name,
6663 isc_boolean_t value)
6664 {
6665 isc_result_t result;
6666
6667 REQUIRE(VALID_RESOLVER(resolver));
6668
6669 #if USE_MBSLOCK
6670 RWLOCK(&resolver->mbslock, isc_rwlocktype_write);
6671 #endif
6672 if (resolver->mustbesecure == NULL) {
6673 result = dns_rbt_create(resolver->mctx, NULL, NULL,
6674 &resolver->mustbesecure);
6675 if (result != ISC_R_SUCCESS)
6676 goto cleanup;
6677 }
6678 result = dns_rbt_addname(resolver->mustbesecure, name,
6679 value ? &yes : &no);
6680 cleanup:
6681 #if USE_MBSLOCK
6682 RWUNLOCK(&resolver->mbslock, isc_rwlocktype_write);
6683 #endif
6684 return (result);
6685 }
6686
6687 isc_boolean_t
6688 dns_resolver_getmustbesecure(dns_resolver_t *resolver, dns_name_t *name) {
6689 void *data = NULL;
6690 isc_boolean_t value = ISC_FALSE;
6691 isc_result_t result;
6692
6693 REQUIRE(VALID_RESOLVER(resolver));
6694
6695 #if USE_MBSLOCK
6696 RWLOCK(&resolver->mbslock, isc_rwlocktype_read);
6697 #endif
6698 if (resolver->mustbesecure == NULL)
6699 goto unlock;
6700 result = dns_rbt_findname(resolver->mustbesecure, name, 0, NULL, &data);
6701 if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH)
6702 value = *(isc_boolean_t*)data;
6703 unlock:
6704 #if USE_MBSLOCK
6705 RWUNLOCK(&resolver->mbslock, isc_rwlocktype_read);
6706 #endif
6707 return (value);
6708 }
DragonFly BSD