iterate.c 16.9 KB
Newer Older
Marek Vavruša's avatar
Marek Vavruša committed
1
/*  Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
2

Marek Vavruša's avatar
Marek Vavruša committed
3 4 5 6
    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.
7

Marek Vavruša's avatar
Marek Vavruša committed
8 9 10 11
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
12

Marek Vavruša's avatar
Marek Vavruša committed
13 14 15
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
16

17 18
#include <sys/time.h>

19 20 21 22
#include <libknot/descriptor.h>
#include <libknot/rrtype/rdname.h>

#include "lib/layer/iterate.h"
23
#include "lib/resolve.h"
24
#include "lib/rplan.h"
25
#include "lib/defines.h"
26
#include "lib/nsrep.h"
27
#include "lib/module.h"
28
#include "lib/dnssec/ta.h"
29

30
#define DEBUG_MSG(fmt...) QRDEBUG(req->current_query, "iter", fmt)
31

32
/* Iterator often walks through packet section, this is an abstraction. */
33
typedef int (*rr_callback_t)(const knot_rrset_t *, unsigned, struct kr_request *);
34

35
/** Return minimized QNAME/QTYPE for current zone cut. */
36
static const knot_dname_t *minimized_qname(struct kr_query *query, uint16_t *qtype)
37
{
38 39
	/* Minimization disabled. */
	const knot_dname_t *qname = query->sname;
40
	if (qname[0] == '\0' || query->flags & QUERY_NO_MINIMIZE) {
41 42
		return qname;
	}
43

44 45 46
	/* Minimize name to contain current zone cut + 1 label. */
	int cut_labels = knot_dname_labels(query->zone_cut.name, NULL);
	int qname_labels = knot_dname_labels(qname, NULL);
Marek Vavruša's avatar
Marek Vavruša committed
47
	while(qname[0] && qname_labels > cut_labels + 1) {
48 49
		qname = knot_wire_next_label(qname, NULL);
		qname_labels -= 1;
50 51
	}

52 53 54
	/* Hide QTYPE if minimized. */
	if (qname != query->sname) {
		*qtype = KNOT_RRTYPE_NS;
55
	}
56

57 58 59
	return qname;
}

60
/** Answer is paired to query. */
61 62 63
static bool is_paired_to_query(const knot_pkt_t *answer, struct kr_query *query)
{
	uint16_t qtype = query->stype;
64
	const knot_dname_t *qname = minimized_qname(query, &qtype);
65

66
	return query->id      == knot_wire_get_id(answer->wire) &&
67
	       knot_wire_get_qdcount(answer->wire) > 0 &&
68
	       (query->sclass == KNOT_CLASS_ANY || query->sclass  == knot_pkt_qclass(answer)) &&
69 70
	       qtype          == knot_pkt_qtype(answer) &&
	       knot_dname_is_equal(qname, knot_pkt_qname(answer));
71 72
}

73
/** Relaxed rule for AA, either AA=1 or SOA matching zone cut is required. */
74 75 76 77 78 79 80 81 82
static bool is_authoritative(const knot_pkt_t *answer, struct kr_query *query)
{
	if (knot_wire_get_aa(answer->wire)) {
		return true;
	}

	const knot_pktsection_t *ns = knot_pkt_section(answer, KNOT_AUTHORITY);
	for (unsigned i = 0; i < ns->count; ++i) {
		const knot_rrset_t *rr = knot_pkt_rr(ns, i);
83
		if (rr->type == KNOT_RRTYPE_SOA && knot_dname_in(query->zone_cut.name, rr->owner)) {
84 85 86 87
			return true;
		}
	}

88 89 90 91 92 93
#ifndef STRICT_MODE
	/* Last resort to work around broken auths, if the zone cut is at/parent of the QNAME. */
	if (knot_dname_is_equal(query->zone_cut.name, knot_pkt_qname(answer))) {
		return true;
	}
#endif
94 95 96
	return false;
}

97
int kr_response_classify(knot_pkt_t *pkt)
98 99 100 101 102 103 104
{
	const knot_pktsection_t *an = knot_pkt_section(pkt, KNOT_ANSWER);
	switch (knot_wire_get_rcode(pkt->wire)) {
	case KNOT_RCODE_NOERROR:
		return (an->count == 0) ? PKT_NODATA : PKT_NOERROR;
	case KNOT_RCODE_NXDOMAIN:
		return PKT_NXDOMAIN;
105 106
	case KNOT_RCODE_REFUSED:
		return PKT_REFUSED;
107 108 109 110 111
	default:
		return PKT_ERROR;
	}
}

112
static void follow_cname_chain(const knot_dname_t **cname, const knot_rrset_t *rr,
113
                               struct kr_query *cur)
114
{
115 116
	if (rr->type == KNOT_RRTYPE_CNAME) {
		*cname = knot_cname_name(&rr->rrs);
117 118
	} else if (rr->type != KNOT_RRTYPE_RRSIG) {
		/* Terminate CNAME chain (if not RRSIG). */
119
		*cname = cur->sname;
120 121 122
	}
}

123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142
/** @internal Filter ANY or loopback addresses. */
static bool is_valid_addr(const uint8_t *addr, size_t len)
{
	if (len == sizeof(struct in_addr)) {
		/* Filter ANY and 127.0.0.0/8 */
		uint32_t ip_host = ntohl(*(const uint32_t *)(addr));
		if (ip_host == 0 || (ip_host & 0xff000000) == 0x7f000000) {
			return false;
		}
	} else if (len == sizeof(struct in6_addr)) {
		struct in6_addr ip6_mask;
		memset(&ip6_mask, 0, sizeof(ip6_mask));
		/* All except last byte are zeroed, last byte defines ANY/::1 */
		if (memcmp(addr, ip6_mask.s6_addr, sizeof(ip6_mask.s6_addr) - 1) == 0) {
			return (addr[len - 1] > 1);
		}
	}
	return true;
}

143
static int update_nsaddr(const knot_rrset_t *rr, struct kr_query *query)
144 145
{
	if (rr->type == KNOT_RRTYPE_A || rr->type == KNOT_RRTYPE_AAAA) {
146
		const knot_rdata_t *rdata = rr->rrs.data;
147 148 149 150
		if (!(query->flags & QUERY_ALLOW_LOCAL) &&
			!is_valid_addr(knot_rdata_data(rdata), knot_rdata_rdlen(rdata))) {
			return KNOT_STATE_CONSUME; /* Ignore invalid addresses */
		}
151 152 153
		int ret = kr_zonecut_add(&query->zone_cut, rr->owner, rdata);
		if (ret != 0) {
			return KNOT_STATE_FAIL;
154 155 156
		}
	}

157
	return KNOT_STATE_CONSUME;
158 159
}

160
static int update_parent(const knot_rrset_t *rr, struct kr_query *qry)
161
{
162
	return update_nsaddr(rr, qry->parent);
163 164
}

165
static int update_answer(const knot_rrset_t *rr, unsigned hint, knot_pkt_t *answer)
166
{
167
	/* Scrub DNSSEC records when not requested. */
168
	if (!knot_pkt_has_dnssec(answer)) {
169 170 171 172 173
		if (rr->type != knot_pkt_qtype(answer) && knot_rrtype_is_dnssec(rr->type)) {
			return KNOT_STATE_DONE; /* Scrub */
		}
	}

174
	int ret = knot_pkt_put(answer, hint, rr, 0);
175 176
	if (ret != KNOT_EOK) {
		knot_wire_set_tc(answer->wire);
177
		return KNOT_STATE_DONE;
178 179
	}

180
	return KNOT_STATE_DONE;
181 182
}

183
static void fetch_glue(knot_pkt_t *pkt, const knot_dname_t *ns, struct kr_query *qry)
184
{
185 186 187 188 189 190 191
	for (knot_section_t i = KNOT_ANSWER; i <= KNOT_ADDITIONAL; ++i) {
		const knot_pktsection_t *sec = knot_pkt_section(pkt, i);
		for (unsigned k = 0; k < sec->count; ++k) {
			const knot_rrset_t *rr = knot_pkt_rr(sec, k);
			if (knot_dname_is_equal(ns, rr->owner)) {
				(void) update_nsaddr(rr, qry);
			}
192 193
		}
	}
194 195 196
}

/** Attempt to find glue for given nameserver name (best effort). */
197
static int has_glue(knot_pkt_t *pkt, const knot_dname_t *ns)
198
{
199 200 201 202 203 204 205 206
	for (knot_section_t i = KNOT_ANSWER; i <= KNOT_ADDITIONAL; ++i) {
		const knot_pktsection_t *sec = knot_pkt_section(pkt, i);
		for (unsigned k = 0; k < sec->count; ++k) {
			const knot_rrset_t *rr = knot_pkt_rr(sec, k);
			if (knot_dname_is_equal(ns, rr->owner) &&
			    (rr->type == KNOT_RRTYPE_A || rr->type == KNOT_RRTYPE_AAAA)) {
				return 1;
			}
207 208 209
		}
	}
	return 0;
210 211
}

212
static int update_cut(knot_pkt_t *pkt, const knot_rrset_t *rr, struct kr_request *req)
213
{
214
	struct kr_query *qry = req->current_query;
215
	struct kr_zonecut *cut = &qry->zone_cut;
216
	int state = KNOT_STATE_CONSUME;
217

218 219
	/* Authority MUST be at/below the authority of the nameserver, otherwise
	 * possible cache injection attempt. */
220
	if (!knot_dname_in(cut->name, rr->owner)) {
221 222
		DEBUG_MSG("<= authority: ns outside bailiwick, ignoring\n");
		return state;
223
	}
224

225 226
	/* Update zone cut name */
	if (!knot_dname_is_equal(rr->owner, cut->name)) {
227 228 229 230 231 232 233 234 235 236 237
		/* Remember parent cut and descend to new (keep keys and TA). */
		struct kr_zonecut *parent = mm_alloc(&req->pool, sizeof(*parent));
		if (parent) {
			memcpy(parent, cut, sizeof(*parent));
			kr_zonecut_init(cut, rr->owner, &req->pool);
			cut->key = parent->key;
			cut->trust_anchor = parent->trust_anchor;
			cut->parent = parent;
		} else {
			kr_zonecut_set(cut, rr->owner);
		}
238
		state = KNOT_STATE_DONE;
239 240
	}

241 242 243
	/* Fetch glue for each NS */
	for (unsigned i = 0; i < rr->rrs.rr_count; ++i) {
		const knot_dname_t *ns_name = knot_ns_name(&rr->rrs, i);
244
		int glue_records = has_glue(pkt, ns_name);
245
		/* Glue is mandatory for NS below zone */
246 247 248
		if (!glue_records && knot_dname_in(rr->owner, ns_name)) {
			DEBUG_MSG("<= authority: missing mandatory glue, rejecting\n");
			continue;
249
		}
250
		kr_zonecut_add(cut, ns_name, NULL);
251
		fetch_glue(pkt, ns_name, qry);
252 253
	}

254
	return state;
255 256
}

257
static int process_authority(knot_pkt_t *pkt, struct kr_request *req)
258
{
259
	int result = KNOT_STATE_CONSUME;
260
	struct kr_query *qry = req->current_query;
261
	const knot_pktsection_t *ns = knot_pkt_section(pkt, KNOT_AUTHORITY);
262

263
#ifdef STRICT_MODE
264 265
	/* AA, terminate resolution chain. */
	if (knot_wire_get_aa(pkt->wire)) {
266
		return KNOT_STATE_CONSUME;
267
	}
268
#else
269 270 271 272 273 274 275 276
	/* Work around servers sending back CNAME with different delegation and no AA. */
	const knot_pktsection_t *an = knot_pkt_section(pkt, KNOT_ANSWER);
	if (an->count > 0 && ns->count > 0) {
		const knot_rrset_t *rr = knot_pkt_rr(an, 0);
		if (rr->type == KNOT_RRTYPE_CNAME) {
			return KNOT_STATE_CONSUME;
		}
	}
277
#endif
278

279
	/* Update zone cut information. */
280 281
	for (unsigned i = 0; i < ns->count; ++i) {
		const knot_rrset_t *rr = knot_pkt_rr(ns, i);
282
		if (rr->type == KNOT_RRTYPE_NS) {
283
			int state = update_cut(pkt, rr, req);
284 285 286 287
			switch(state) {
			case KNOT_STATE_DONE: result = state; break;
			case KNOT_STATE_FAIL: return state; break;
			default:              /* continue */ break;
288
			}
289
		} else if (rr->type == KNOT_RRTYPE_SOA && knot_dname_is_sub(rr->owner, qry->zone_cut.name)) {
290
			/* SOA below cut in authority indicates different authority, but same NS set. */
291
			qry->zone_cut.name = knot_dname_copy(rr->owner, &req->pool);
292
		}
293 294
	}

295
	/* CONSUME => Unhelpful referral.
296
	 * DONE    => Zone cut updated.  */
297
	return result;
298 299
}

300
static void finalize_answer(knot_pkt_t *pkt, struct kr_query *qry, struct kr_request *req)
301 302
{
	/* Finalize header */
303
	knot_pkt_t *answer = req->answer;
304 305
	knot_wire_set_rcode(answer->wire, knot_wire_get_rcode(pkt->wire));

306 307 308
	/* Fill in bailiwick records in authority */
	struct kr_zonecut *cut = &qry->zone_cut;
	int pkt_class = kr_response_classify(pkt);
309 310 311 312
	if (pkt_class & (PKT_NXDOMAIN|PKT_NODATA)) {
		const knot_pktsection_t *ns = knot_pkt_section(pkt, KNOT_AUTHORITY);
		for (unsigned i = 0; i < ns->count; ++i) {
			const knot_rrset_t *rr = knot_pkt_rr(ns, i);
313
			/* Stash the authority records, they will be written to wire on answer finalization. */
314
			if (knot_dname_in(cut->name, rr->owner)) {
315
				kr_rrarray_add(&req->authority, rr, &answer->mm);
316 317 318 319 320
			}
		}
	}
}

321
static int process_answer(knot_pkt_t *pkt, struct kr_request *req)
322
{
323
	struct kr_query *query = req->current_query;
324

325
	/* Response for minimized QNAME.
326 327
	 * NODATA   => may be empty non-terminal, retry (found zone cut)
	 * NOERROR  => found zone cut, retry
328
	 * NXDOMAIN => parent is zone cut, retry as a workaround for bad authoritatives
329
	 */
330
	bool is_final = (query->parent == NULL);
331
	int pkt_class = kr_response_classify(pkt);
332
	if (!knot_dname_is_equal(knot_pkt_qname(pkt), query->sname) &&
333
	    (pkt_class & (PKT_NOERROR|PKT_NXDOMAIN|PKT_REFUSED|PKT_NODATA))) {
334
		DEBUG_MSG("<= found cut, retrying with non-minimized name\n");
335
		query->flags |= QUERY_NO_MINIMIZE;
336
		return KNOT_STATE_CONSUME;
337 338
	}

339
	/* This answer didn't improve resolution chain, therefore must be authoritative (relaxed to negative). */
340 341 342 343 344
	if (!is_authoritative(pkt, query)) {
		if (pkt_class & (PKT_NXDOMAIN|PKT_NODATA)) {
			DEBUG_MSG("<= lame response: non-auth sent negative response\n");
			return KNOT_STATE_FAIL;
		}
345 346
	}

347 348
	/* Process answer type */
	const knot_pktsection_t *an = knot_pkt_section(pkt, KNOT_ANSWER);
349
	bool follow_chain = (query->stype != KNOT_RRTYPE_CNAME);
350
	const knot_dname_t *cname = query->sname;
351
	for (unsigned i = 0; i < an->count; ++i) {
352
		/* @todo construct a CNAME chain closure and accept all names from that set */ 
353
		const knot_rrset_t *rr = knot_pkt_rr(an, i);
354 355
		if (!knot_dname_is_equal(rr->owner, query->sname) &&
			!(follow_chain && knot_dname_is_equal(rr->owner, cname))) {
356 357 358 359 360 361
			continue;
		}
		unsigned hint = 0;
		if(knot_dname_is_equal(cname, knot_pkt_qname(req->answer))) {
			hint = KNOT_COMPR_HINT_QNAME;
		}
362
		int state = is_final ? update_answer(rr, hint, req->answer) : update_parent(rr, query);
363
		if (state == KNOT_STATE_FAIL) {
364
			return state;
365
		}
366
		/* Follow chain only within current cut (if secure). */
367 368
		if (follow_chain) {
			follow_cname_chain(&cname, rr, query);
369
			if (!(query->flags & QUERY_DNSSEC_WANT) || !knot_dname_in(query->zone_cut.name, cname)) {
370 371
				follow_chain = false; 
			}
372
		}
373 374
	}

375 376
	/* Make sure that this is an authoritative naswer (even with AA=0) for other layers */
	knot_wire_set_aa(pkt->wire);
377 378
	/* Either way it resolves current query. */
	query->flags |= QUERY_RESOLVED;
379
	/* Follow canonical name as next SNAME. */
380
	if (!knot_dname_is_equal(cname, query->sname)) {
381
		DEBUG_MSG("<= cname chain, following\n");
382
		struct kr_query *next = kr_rplan_push(&req->rplan, query->parent, cname, query->sclass, query->stype);
383 384 385 386
		if (!next) {
			return KNOT_STATE_FAIL;
		}
		next->flags |= QUERY_AWAIT_CUT;
387 388 389 390 391
		/* Want DNSSEC if it's posible to secure this name (e.g. is covered by any TA) */
		if (kr_ta_covers(&req->ctx->trust_anchors, cname) &&
		    !kr_ta_covers(&req->ctx->negative_anchors, cname)) {
			next->flags |= QUERY_DNSSEC_WANT;
		}
392 393
	} else if (!query->parent) {
		finalize_answer(pkt, query, req);
394
	}
395
	return KNOT_STATE_DONE;
396 397
}

398
/** Error handling, RFC1034 5.3.3, 4d. */
399
static int resolve_error(knot_pkt_t *pkt, struct kr_request *req)
400
{
401
	return KNOT_STATE_FAIL;
402 403
}

404
/* State-less single resolution iteration step, not needed. */
405
static int reset(knot_layer_t *ctx)  { return KNOT_STATE_PRODUCE; }
406 407

/* Set resolution context and parameters. */
408
static int begin(knot_layer_t *ctx, void *module_param)
409
{
410 411 412
	if (ctx->state & (KNOT_STATE_DONE|KNOT_STATE_FAIL)) {
		return ctx->state;
	}
413 414 415
	return reset(ctx);
}

416
int kr_make_query(struct kr_query *query, knot_pkt_t *pkt)
417
{
418
	/* Minimize QNAME (if possible). */
419 420
	uint16_t qtype = query->stype;
	const knot_dname_t *qname = minimized_qname(query, &qtype);
421

422
	/* Form a query for the authoritative. */
423
	knot_pkt_clear(pkt);
424
	int ret = knot_pkt_put_question(pkt, qname, query->sclass, qtype);
425
	if (ret != KNOT_EOK) {
426
		return ret;
427 428
	}

429
	/* Query built, expect answer. */
430
	query->id = kr_rand_uint(UINT16_MAX);
431
	knot_wire_set_id(pkt->wire, query->id);
432
	pkt->parsed = pkt->size;
433 434 435 436 437 438 439
	return kr_ok();
}

static int prepare_query(knot_layer_t *ctx, knot_pkt_t *pkt)
{
	assert(pkt && ctx);
	struct kr_request *req = ctx->data;
440
	struct kr_query *query = req->current_query;
441 442 443 444 445 446 447 448 449 450
	if (!query || ctx->state & (KNOT_STATE_DONE|KNOT_STATE_FAIL)) {
		return ctx->state;
	}

	/* Make query */
	int ret = kr_make_query(query, pkt);
	if (ret != 0) {
		return KNOT_STATE_FAIL;
	}

451
	return KNOT_STATE_CONSUME;
452 453
}

454 455
static int resolve_badmsg(knot_pkt_t *pkt, struct kr_request *req, struct kr_query *query)
{
456
#ifndef STRICT_MODE
457 458 459 460 461 462 463
	/* Work around broken auths/load balancers */
	if (query->flags & QUERY_SAFEMODE) {
		return resolve_error(pkt, req);
	} else {
		query->flags |= QUERY_SAFEMODE;
		return KNOT_STATE_DONE;
	}
464 465 466
#else
		return resolve_error(pkt, req);
#endif
467 468
}

469
/** Resolve input query or continue resolution with followups.
470 471 472
 *
 *  This roughly corresponds to RFC1034, 5.3.3 4a-d.
 */
473
static int resolve(knot_layer_t *ctx, knot_pkt_t *pkt)
474 475
{
	assert(pkt && ctx);
476
	struct kr_request *req = ctx->data;
477
	struct kr_query *query = req->current_query;
478
	if (!query || (query->flags & QUERY_RESOLVED)) {
479 480
		return ctx->state;
	}
481

482 483 484 485
	/* Check for packet processing errors first.
	 * Note - we *MUST* check if it has at least a QUESTION,
	 * otherwise it would crash on accessing QNAME. */
	if (pkt->parsed < pkt->size || pkt->parsed <= KNOT_WIRE_HEADER_SIZE) {
486
		DEBUG_MSG("<= malformed response\n");
487
		return resolve_badmsg(pkt, req, query);
488
	} else if (!is_paired_to_query(pkt, query)) {
489
		DEBUG_MSG("<= ignoring mismatching response\n");
490 491 492 493
		/* Force TCP, to work around authoritatives messing up question
		 * without yielding to spoofed responses. */
		query->flags |= QUERY_TCP;
		return resolve_badmsg(pkt, req, query);
494
	} else if (knot_wire_get_tc(pkt->wire)) {
495
		DEBUG_MSG("<= truncated response, failover to TCP\n");
496
		if (query) {
497
			/* Fail if already on TCP. */
498
			if (query->flags & QUERY_TCP) {
499
				DEBUG_MSG("<= TC=1 with TCP, bailing out\n");
500
				return resolve_error(pkt, req);
501
			}
502
			query->flags |= QUERY_TCP;
503
		}
504
		return KNOT_STATE_CONSUME;
505
	}
506

507
#ifndef NDEBUG
508
	lookup_table_t *rcode = lookup_by_id(knot_rcode_names, knot_wire_get_rcode(pkt->wire));
509
#endif
510 511

	/* Check response code. */
512 513 514
	switch(knot_wire_get_rcode(pkt->wire)) {
	case KNOT_RCODE_NOERROR:
	case KNOT_RCODE_NXDOMAIN:
515
	case KNOT_RCODE_REFUSED:
516
		break; /* OK */
517 518 519 520
	case KNOT_RCODE_FORMERR:
	case KNOT_RCODE_NOTIMPL:
		DEBUG_MSG("<= rcode: %s\n", rcode ? rcode->name : "??");
		return resolve_badmsg(pkt, req, query);
521
	default:
522
		DEBUG_MSG("<= rcode: %s\n", rcode ? rcode->name : "??");
523
		return resolve_error(pkt, req);
524 525
	}

526
	/* Resolve authority to see if it's referral or authoritative. */
527
	int state = KNOT_STATE_CONSUME;
528
	state = process_authority(pkt, req);
529
	switch(state) {
530
	case KNOT_STATE_CONSUME: /* Not referral, process answer. */
531
		DEBUG_MSG("<= rcode: %s\n", rcode ? rcode->name : "??");
532
		state = process_answer(pkt, req);
533
		break;
534
	case KNOT_STATE_DONE: /* Referral */
535
		DEBUG_MSG("<= referral response, follow\n");
536 537 538
		break;
	default:
		break;
539
	}
540

541
	return state;
542 543
}

544
/** Module implementation. */
545
const knot_layer_api_t *iterate_layer(struct kr_module *module)
546
{
547 548 549
	static const knot_layer_api_t _layer = {
		.begin = &begin,
		.reset = &reset,
550 551
		.consume = &resolve,
		.produce = &prepare_query
552 553
	};
	return &_layer;
554 555
}

556
KR_MODULE_EXPORT(iterate)