DNS/実装/KnotDNSresolver/resolver.cについて、ここに記述してください。
1 /* Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
2
3 This program is free software: you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
5 the Free Software Foundation, either version 3 of the License, or
6 (at your option) any later version.
7
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
12
13 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
15 */
16
17 #include <ctype.h>
18 #include <stdio.h>
19 #include <fcntl.h>
20 #include <libknot/rrtype/rdname.h>
21 #include <libknot/descriptor.h>
22 #include <ucw/mempool.h>
23 #include "lib/resolve.h"
24 #include "lib/layer.h"
25 #include "lib/rplan.h"
26 #include "lib/layer/iterate.h"
27 #include "lib/dnssec/ta.h"
28
29 #define DEBUG_MSG(qry, fmt...) QRDEBUG((qry), "resl", fmt)
30
31 /** @internal Macro for iterating module layers. */
32 #define ITERATE_LAYERS(req, qry, func, ...) \
33 (req)->current_query = (qry); \
34 for (unsigned i = 0; i < (req)->ctx->modules->len; ++i) { \
35 struct kr_module *mod = (req)->ctx->modules->at[i]; \
36 if (mod->layer) { \
37 struct knot_layer layer = {.state = (req)->state, .api = mod->layer(mod), .data = (req)}; \
38 if (layer.api && layer.api->func) { \
39 (req)->state = layer.api->func(&layer, ##__VA_ARGS__); \
40 if ((req)->state == KNOT_STATE_YIELD) \
41 break; \
42 } \
43 } \
44 } /* Invalidate current query. */ \
45 (req)->current_query = NULL
46
47 /* Randomize QNAME letter case.
48 * This adds 32 bits of randomness at maximum, but that's more than an average domain name length.
49 * https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00
50 */
51 static void randomized_qname_case(knot_dname_t *qname, uint32_t secret)
52 {
53 unsigned k = 0;
54 while (*qname != '\0') {
55 for (unsigned i = *qname; i--;) {
56 int chr = qname[i + 1];
57 if (isalpha(chr)) {
58 if (secret & (1 << k)) {
59 qname[i + 1] ^= 0x20;
60 }
61 k = (k + 1) % (sizeof(secret) * CHAR_BIT);
62 }
63 }
64 qname = (uint8_t *)knot_wire_next_label(qname, NULL);
65 }
66 }
67
68 /** Invalidate current NS/addr pair. */
69 static int invalidate_ns(struct kr_rplan *rplan, struct kr_query *qry)
70 {
71 if (qry->ns.addr[0].ip.sa_family != AF_UNSPEC) {
72 uint8_t *addr = kr_nsrep_inaddr(qry->ns.addr[0]);
73 size_t addr_len = kr_nsrep_inaddr_len(qry->ns.addr[0]);
74 knot_rdata_t rdata[knot_rdata_array_size(addr_len)];
75 knot_rdata_init(rdata, addr_len, addr, 0);
76 return kr_zonecut_del(&qry->zone_cut, qry->ns.name, rdata);
77 } else {
78 return kr_zonecut_del(&qry->zone_cut, qry->ns.name, NULL);
79 }
80 }
81
82 static int ns_fetch_cut(struct kr_query *qry, struct kr_request *req, bool secured)
83 {
84 int ret = 0;
85
86 /* Find closest zone cut from cache */
87 struct kr_cache_txn txn;
88 if (kr_cache_txn_begin(&req->ctx->cache, &txn, NAMEDB_RDONLY) == 0) {
89 /* If at/subdomain of parent zone cut, start from its encloser.
90 * This is for case when we get to a dead end (and need glue from parent), or DS refetch. */
91 struct kr_query *parent = qry->parent;
92 if (parent && qry->sname[0] != '\0' && knot_dname_in(parent->zone_cut.name, qry->sname)) {
93 const knot_dname_t *encloser = knot_wire_next_label(parent->zone_cut.name, NULL);
94 ret = kr_zonecut_find_cached(req->ctx, &qry->zone_cut, encloser, &txn, qry->timestamp.tv_sec, secured);
95 } else {
96 ret = kr_zonecut_find_cached(req->ctx, &qry->zone_cut, qry->sname, &txn, qry->timestamp.tv_sec, secured);
97 }
98 kr_cache_txn_abort(&txn);
99 } else {
100 ret = kr_error(ENOENT);
101 }
102 return ret;
103 }
104
105 static int ns_resolve_addr(struct kr_query *qry, struct kr_request *param)
106 {
107 struct kr_rplan *rplan = ¶m->rplan;
108 struct kr_context *ctx = param->ctx;
109
110
111 /* Start NS queries from root, to avoid certain cases
112 * where a NS drops out of cache and the rest is unavailable,
113 * this would lead to dependency loop in current zone cut.
114 * Prefer IPv6 and continue with IPv4 if not available.
115 */
116 uint16_t next_type = 0;
117 if (!(qry->flags & QUERY_AWAIT_IPV6)) {
118 next_type = KNOT_RRTYPE_AAAA;
119 qry->flags |= QUERY_AWAIT_IPV6;
120 } else if (!(qry->flags & QUERY_AWAIT_IPV4)) {
121 next_type = KNOT_RRTYPE_A;
122 qry->flags |= QUERY_AWAIT_IPV4;
123 /* Hmm, no useable IPv6 then. */
124 qry->ns.reputation |= KR_NS_NOIP6;
125 kr_nsrep_update_rep(&qry->ns, qry->ns.reputation, ctx->cache_rep);
126 }
127 /* Bail out if the query is already pending or dependency loop. */
128 if (!next_type || kr_rplan_satisfies(qry->parent, qry->ns.name, KNOT_CLASS_IN, next_type)) {
129 /* Fall back to SBELT if root server query fails. */
130 if (!next_type && qry->zone_cut.name[0] == '\0') {
131 DEBUG_MSG(qry, "=> fallback to root hints\n");
132 kr_zonecut_set_sbelt(ctx, &qry->zone_cut);
133 qry->flags |= QUERY_NO_THROTTLE; /* Pick even bad SBELT servers */
134 return kr_error(EAGAIN);
135 }
136 /* No IPv4 nor IPv6, flag server as unuseable. */
137 DEBUG_MSG(qry, "=> unresolvable NS address, bailing out\n");
138 qry->ns.reputation |= KR_NS_NOIP4 | KR_NS_NOIP6;
139 kr_nsrep_update_rep(&qry->ns, qry->ns.reputation, ctx->cache_rep);
140 invalidate_ns(rplan, qry);
141 return kr_error(EHOSTUNREACH);
142 }
143 /* Push new query to the resolution plan */
144 struct kr_query *next = kr_rplan_push(rplan, qry, qry->ns.name, KNOT_CLASS_IN, next_type);
145 if (!next) {
146 return kr_error(ENOMEM);
147 }
148 /* At the root level with no NS addresses, add SBELT subrequest. */
149 int ret = 0;
150 if (qry->zone_cut.name[0] == '\0') {
151 ret = kr_zonecut_set_sbelt(ctx, &next->zone_cut);
152 if (ret == 0) { /* Copy TA and key since it's the same cut to avoid lookup. */
153 kr_zonecut_copy_trust(&next->zone_cut, &qry->zone_cut);
154 kr_zonecut_set_sbelt(ctx, &qry->zone_cut); /* Add SBELT to parent in case query fails. */
155 qry->flags |= QUERY_NO_THROTTLE; /* Pick even bad SBELT servers */
156 }
157 } else {
158 next->flags |= QUERY_AWAIT_CUT;
159 }
160 return ret;
161 }
162
163 static int edns_put(knot_pkt_t *pkt)
164 {
165 if (!pkt->opt_rr) {
166 return kr_ok();
167 }
168 /* Reclaim reserved size. */
169 int ret = knot_pkt_reclaim(pkt, knot_edns_wire_size(pkt->opt_rr));
170 if (ret != 0) {
171 return ret;
172 }
173 /* Write to packet. */
174 assert(pkt->current == KNOT_ADDITIONAL);
175 return knot_pkt_put(pkt, KNOT_COMPR_HINT_NONE, pkt->opt_rr, KNOT_PF_FREE);
176 }
177
178 static int edns_create(knot_pkt_t *pkt, knot_pkt_t *template, struct kr_request *req)
179 {
180 pkt->opt_rr = knot_rrset_copy(req->ctx->opt_rr, &pkt->mm);
181 return knot_pkt_reserve(pkt, knot_edns_wire_size(pkt->opt_rr));
182 }
183
184 static int answer_prepare(knot_pkt_t *answer, knot_pkt_t *query, struct kr_request *req)
185 {
186 if (knot_pkt_init_response(answer, query) != 0) {
187 return kr_error(ENOMEM); /* Failed to initialize answer */
188 }
189 /* Handle EDNS in the query */
190 if (knot_pkt_has_edns(query)) {
191 int ret = edns_create(answer, query, req);
192 if (ret != 0){
193 return ret;
194 }
195 /* Set DO bit if set (DNSSEC requested). */
196 if (knot_pkt_has_dnssec(query)) {
197 knot_edns_set_do(answer->opt_rr);
198 }
199 }
200 return kr_ok();
201 }
202
203 static int answer_finalize(struct kr_request *request, int state)
204 {
205 /* Write EDNS information */
206 knot_pkt_t *answer = request->answer;
207 knot_pkt_begin(answer, KNOT_ADDITIONAL);
208 if (answer->opt_rr) {
209 int ret = edns_put(answer);
210 if (ret != 0) {
211 return ret;
212 }
213 }
214 /* Set AD=1 if succeeded and requested secured answer. */
215 struct kr_rplan *rplan = &request->rplan;
216 if (state == KNOT_STATE_DONE && !EMPTY_LIST(rplan->resolved)) {
217 struct kr_query *last = TAIL(rplan->resolved);
218 /* Do not set AD for RRSIG query, as we can't validate it. */
219 if ((last->flags & QUERY_DNSSEC_WANT) && knot_pkt_has_dnssec(answer) &&
220 knot_pkt_qtype(answer) != KNOT_RRTYPE_RRSIG) {
221 knot_wire_set_ad(answer->wire);
222 }
223 }
224 return kr_ok();
225 }
226
227 static int query_finalize(struct kr_request *request, struct kr_query *qry, knot_pkt_t *pkt)
228 {
229 /* Randomize query case (if not in safemode) */
230 qry->secret = (qry->flags & QUERY_SAFEMODE) ? 0 : kr_rand_uint(UINT32_MAX);
231 knot_dname_t *qname_raw = (knot_dname_t *)knot_pkt_qname(pkt);
232 randomized_qname_case(qname_raw, qry->secret);
233
234 int ret = 0;
235 knot_pkt_begin(pkt, KNOT_ADDITIONAL);
236 if (!(qry->flags & QUERY_SAFEMODE)) {
237 ret = edns_create(pkt, request->answer, request);
238 if (ret == 0) { /* Enable DNSSEC for query. */
239 if (qry->flags & QUERY_DNSSEC_WANT) {
240 knot_edns_set_do(pkt->opt_rr);
241 knot_wire_set_cd(pkt->wire);
242 }
243 ret = edns_put(pkt);
244 }
245 }
246 return ret;
247 }
248
249 int kr_resolve_begin(struct kr_request *request, struct kr_context *ctx, knot_pkt_t *answer)
250 {
251 /* Initialize request */
252 request->ctx = ctx;
253 request->answer = answer;
254 request->options = ctx->options;
255 request->state = KNOT_STATE_CONSUME;
256 request->current_query = NULL;
257
258 /* Expect first query */
259 kr_rplan_init(&request->rplan, request, &request->pool);
260 return KNOT_STATE_CONSUME;
261 }
262
263 static int resolve_query(struct kr_request *request, const knot_pkt_t *packet)
264 {
265 struct kr_rplan *rplan = &request->rplan;
266 const knot_dname_t *qname = knot_pkt_qname(packet);
267 uint16_t qclass = knot_pkt_qclass(packet);
268 uint16_t qtype = knot_pkt_qtype(packet);
269 struct kr_query *qry = kr_rplan_push(rplan, NULL, qname, qclass, qtype);
270 if (!qry) {
271 return KNOT_STATE_FAIL;
272 }
273
274 /* Deferred zone cut lookup for this query. */
275 qry->flags |= QUERY_AWAIT_CUT;
276 /* Want DNSSEC if it's posible to secure this name (e.g. is covered by any TA) */
277 map_t *negative_anchors = &request->ctx->negative_anchors;
278 map_t *trust_anchors = &request->ctx->trust_anchors;
279 if (knot_pkt_has_dnssec(packet) &&
280 kr_ta_covers(trust_anchors, qname) && !kr_ta_covers(negative_anchors, qname)) {
281 qry->flags |= QUERY_DNSSEC_WANT;
282 }
283
284 /* Initialize answer packet */
285 knot_pkt_t *answer = request->answer;
286 knot_wire_set_qr(answer->wire);
287 knot_wire_clear_aa(answer->wire);
288 knot_wire_set_ra(answer->wire);
289 knot_wire_set_rcode(answer->wire, KNOT_RCODE_NOERROR);
290
291 /* Expect answer, pop if satisfied immediately */
292 ITERATE_LAYERS(request, qry, begin, request);
293 if (request->state == KNOT_STATE_DONE) {
294 kr_rplan_pop(rplan, qry);
295 }
296 return request->state;
297 }
298
299 int kr_resolve_consume(struct kr_request *request, const struct sockaddr *src, knot_pkt_t *packet)
300 {
301 struct kr_rplan *rplan = &request->rplan;
302 struct kr_context *ctx = request->ctx;
303
304 /* Empty resolution plan, push packet as the new query */
305 if (packet && kr_rplan_empty(rplan)) {
306 if (answer_prepare(request->answer, packet, request) != 0) {
307 return KNOT_STATE_FAIL;
308 }
309 return resolve_query(request, packet);
310 }
311
312 /* Different processing for network error */
313 struct kr_query *qry = TAIL(rplan->pending);
314 bool tried_tcp = (qry->flags & QUERY_TCP);
315 if (!packet || packet->size == 0) {
316 /* Network error, retry over TCP. */
317 if (!tried_tcp) {
318 DEBUG_MSG(qry, "=> NS unreachable, retrying over TCP\n");
319 qry->flags |= QUERY_TCP;
320 return KNOT_STATE_PRODUCE;
321 }
322 request->state = KNOT_STATE_FAIL;
323 } else {
324 /* Packet cleared, derandomize QNAME. */
325 knot_dname_t *qname_raw = (knot_dname_t *)knot_pkt_qname(packet);
326 if (qname_raw && qry->secret != 0) {
327 randomized_qname_case(qname_raw, qry->secret);
328 }
329 request->state = KNOT_STATE_CONSUME;
330 ITERATE_LAYERS(request, qry, consume, packet);
331 }
332
333 /* Resolution failed, invalidate current NS. */
334 if (request->state == KNOT_STATE_FAIL) {
335 kr_nsrep_update_rtt(&qry->ns, src, KR_NS_TIMEOUT, ctx->cache_rtt);
336 invalidate_ns(rplan, qry);
337 qry->flags &= ~QUERY_RESOLVED;
338 /* Track RTT for iterative answers */
339 } else if (!(qry->flags & QUERY_CACHED)) {
340 struct timeval now;
341 gettimeofday(&now, NULL);
342 kr_nsrep_update_rtt(&qry->ns, src, time_diff(&qry->timestamp, &now), ctx->cache_rtt);
343 /* Sucessful answer, lift any address resolution requests. */
344 qry->flags &= ~(QUERY_AWAIT_IPV6|QUERY_AWAIT_IPV4);
345 }
346
347 /* Pop query if resolved. */
348 if (qry->flags & QUERY_RESOLVED) {
349 kr_rplan_pop(rplan, qry);
350 } else if (!tried_tcp && (qry->flags & QUERY_TCP)) {
351 return KNOT_STATE_PRODUCE; /* Requery over TCP */
352 } else { /* Clear query flags for next attempt */
353 qry->flags &= ~(QUERY_CACHED|QUERY_TCP);
354 }
355
356 ITERATE_LAYERS(request, qry, reset);
357
358 /* Do not finish with bogus answer. */
359 if (qry->flags & QUERY_DNSSEC_BOGUS) {
360 return KNOT_STATE_FAIL;
361 }
362
363 return kr_rplan_empty(&request->rplan) ? KNOT_STATE_DONE : KNOT_STATE_PRODUCE;
364 }
365
366 /** @internal Spawn subrequest in current zone cut (no minimization or lookup). */
367 static struct kr_query *zone_cut_subreq(struct kr_rplan *rplan, struct kr_query *parent,
368 const knot_dname_t *qname, uint16_t qtype)
369 {
370 struct kr_query *next = kr_rplan_push(rplan, parent, qname, parent->sclass, qtype);
371 if (!next) {
372 return NULL;
373 }
374 kr_zonecut_set(&next->zone_cut, parent->zone_cut.name);
375 if (kr_zonecut_copy(&next->zone_cut, &parent->zone_cut) != 0 ||
376 kr_zonecut_copy_trust(&next->zone_cut, &parent->zone_cut) != 0) {
377 return NULL;
378 }
379 next->flags |= QUERY_NO_MINIMIZE;
380 if (parent->flags & QUERY_DNSSEC_WANT) {
381 next->flags |= QUERY_DNSSEC_WANT;
382 }
383 return next;
384 }
385
386 /** @internal Check current zone cut status and credibility, spawn subrequests if needed. */
387 static int zone_cut_check(struct kr_request *request, struct kr_query *qry, knot_pkt_t *packet)
388 {
389 struct kr_rplan *rplan = &request->rplan;
390 map_t *trust_anchors = &request->ctx->trust_anchors;
391 map_t *negative_anchors = &request->ctx->negative_anchors;
392
393 /* The query wasn't resolved from cache,
394 * now it's the time to look up closest zone cut from cache. */
395 if (qry->flags & QUERY_AWAIT_CUT) {
396 /* Want DNSSEC if it's posible to secure this name (e.g. is covered by any TA) */
397 if (!kr_ta_covers(negative_anchors, qry->zone_cut.name) &&
398 kr_ta_covers(trust_anchors, qry->zone_cut.name)) {
399 qry->flags |= QUERY_DNSSEC_WANT;
400 } else {
401 qry->flags &= ~QUERY_DNSSEC_WANT;
402 }
403 int ret = ns_fetch_cut(qry, request, (qry->flags & QUERY_DNSSEC_WANT));
404 if (ret != 0) {
405 /* No cached cut found, start from SBELT and issue priming query. */
406 if (ret == kr_error(ENOENT)) {
407 ret = kr_zonecut_set_sbelt(request->ctx, &qry->zone_cut);
408 if (ret != 0) {
409 return KNOT_STATE_FAIL;
410 }
411 if (qry->sname[0] != '\0') {
412 DEBUG_MSG(qry, "=> root priming query\n");
413 zone_cut_subreq(rplan, qry, qry->zone_cut.name, KNOT_RRTYPE_NS);
414 } else {
415 DEBUG_MSG(qry, "=> using root hints\n");
416 }
417 qry->flags &= ~QUERY_AWAIT_CUT;
418 return KNOT_STATE_DONE;
419 } else {
420 return KNOT_STATE_FAIL;
421 }
422 }
423 /* Update minimized QNAME if zone cut changed */
424 if (qry->zone_cut.name[0] != '\0' && !(qry->flags & QUERY_NO_MINIMIZE)) {
425 if (kr_make_query(qry, packet) != 0) {
426 return KNOT_STATE_FAIL;
427 }
428 }
429 qry->flags &= ~QUERY_AWAIT_CUT;
430 }
431 /* Disable DNSSEC if it enters NTA. */
432 if (kr_ta_get(negative_anchors, qry->zone_cut.name)){
433 DEBUG_MSG(qry, ">< negative TA, going insecure\n");
434 qry->flags &= ~QUERY_DNSSEC_WANT;
435 }
436 /* Enable DNSSEC if enters a new island of trust. */
437 bool want_secured = (qry->flags & QUERY_DNSSEC_WANT);
438 if (!want_secured && kr_ta_get(trust_anchors, qry->zone_cut.name)) {
439 qry->flags |= QUERY_DNSSEC_WANT;
440 want_secured = true;
441 WITH_DEBUG {
442 char qname_str[KNOT_DNAME_MAXLEN];
443 knot_dname_to_str(qname_str, qry->zone_cut.name, sizeof(qname_str));
444 DEBUG_MSG(qry, ">< TA: '%s'\n", qname_str);
445 }
446 }
447 if (want_secured && !qry->zone_cut.trust_anchor) {
448 knot_rrset_t *ta_rr = kr_ta_get(trust_anchors, qry->zone_cut.name);
449 qry->zone_cut.trust_anchor = knot_rrset_copy(ta_rr, qry->zone_cut.pool);
450 }
451 /* Try to fetch missing DS (from above the cut). */
452 const bool has_ta = (qry->zone_cut.trust_anchor != NULL);
453 const knot_dname_t *ta_name = (has_ta ? qry->zone_cut.trust_anchor->owner : NULL);
454 const bool refetch_ta = !has_ta || !knot_dname_is_equal(qry->zone_cut.name, ta_name);
455 if (want_secured && refetch_ta) {
456 /* @todo we could fetch the information from the parent cut, but we don't remember that now */
457 struct kr_query *next = kr_rplan_push(rplan, qry, qry->zone_cut.name, qry->sclass, KNOT_RRTYPE_DS);
458 if (!next) {
459 return KNOT_STATE_FAIL;
460 }
461 next->flags |= QUERY_AWAIT_CUT|QUERY_DNSSEC_WANT;
462 return KNOT_STATE_DONE;
463 }
464 /* Try to fetch missing DNSKEY (either missing or above current cut).
465 * Do not fetch if this is a DNSKEY subrequest to avoid circular dependency. */
466 const bool is_dnskey_subreq = kr_rplan_satisfies(qry, ta_name, KNOT_CLASS_IN, KNOT_RRTYPE_DNSKEY);
467 const bool refetch_key = has_ta && (!qry->zone_cut.key || !knot_dname_is_equal(ta_name, qry->zone_cut.key->owner));
468 if (want_secured && refetch_key && !is_dnskey_subreq) {
469 struct kr_query *next = zone_cut_subreq(rplan, qry, ta_name, KNOT_RRTYPE_DNSKEY);
470 if (!next) {
471 return KNOT_STATE_FAIL;
472 }
473 return KNOT_STATE_DONE;
474 }
475
476 return KNOT_STATE_PRODUCE;
477 }
478
479 int kr_resolve_produce(struct kr_request *request, struct sockaddr **dst, int *type, knot_pkt_t *packet)
480 {
481 struct kr_rplan *rplan = &request->rplan;
482 unsigned ns_election_iter = 0;
483
484 /* No query left for resolution */
485 if (kr_rplan_empty(rplan)) {
486 return KNOT_STATE_FAIL;
487 }
488
489 /* Resolve current query and produce dependent or finish */
490 struct kr_query *qry = TAIL(rplan->pending);
491 request->state = KNOT_STATE_PRODUCE;
492 ITERATE_LAYERS(request, qry, produce, packet);
493 if (request->state != KNOT_STATE_FAIL && knot_wire_get_qr(packet->wire)) {
494 /* Produced an answer, consume it. */
495 qry->secret = 0;
496 request->state = KNOT_STATE_CONSUME;
497 ITERATE_LAYERS(request, qry, consume, packet);
498 }
499 switch(request->state) {
500 case KNOT_STATE_FAIL: return request->state;
501 case KNOT_STATE_CONSUME: break;
502 case KNOT_STATE_DONE:
503 default: /* Current query is done */
504 if (qry->flags & QUERY_RESOLVED) {
505 kr_rplan_pop(rplan, qry);
506 }
507 ITERATE_LAYERS(request, qry, reset);
508 return kr_rplan_empty(rplan) ? KNOT_STATE_DONE : KNOT_STATE_PRODUCE;
509 }
510
511 /* This query has RD=0 or is ANY, stop here. */
512 if (qry->stype == KNOT_RRTYPE_ANY || !knot_wire_get_rd(request->answer->wire)) {
513 DEBUG_MSG(qry, "=> qtype is ANY or RD=0, bail out\n");
514 return KNOT_STATE_FAIL;
515 }
516
517 /* Update zone cut, spawn new subrequests. */
518 int state = zone_cut_check(request, qry, packet);
519 switch(state) {
520 case KNOT_STATE_FAIL: return KNOT_STATE_FAIL;
521 case KNOT_STATE_DONE: return KNOT_STATE_PRODUCE;
522 default: break;
523 }
524
525 ns_election:
526
527 /* If the query has already selected a NS and is waiting for IPv4/IPv6 record,
528 * elect best address only, otherwise elect a completely new NS.
529 */
530 if(++ns_election_iter >= KR_ITER_LIMIT) {
531 DEBUG_MSG(qry, "=> couldn't converge NS selection, bail out\n");
532 return KNOT_STATE_FAIL;
533 }
534 if (qry->flags & (QUERY_AWAIT_IPV4|QUERY_AWAIT_IPV6)) {
535 kr_nsrep_elect_addr(qry, request->ctx);
536 } else if (!qry->ns.name || !(qry->flags & QUERY_TCP)) { /* Keep address when TCP retransmit. */
537 /* Root DNSKEY must be fetched from the hints to avoid chicken and egg problem. */
538 if (qry->sname[0] == '\0' && qry->stype == KNOT_RRTYPE_DNSKEY) {
539 DEBUG_MSG(qry, "=> priming root DNSKEY\n");
540 kr_zonecut_set_sbelt(request->ctx, &qry->zone_cut);
541 qry->flags |= QUERY_NO_THROTTLE; /* Pick even bad SBELT servers */
542 }
543 kr_nsrep_elect(qry, request->ctx);
544 if (qry->ns.score > KR_NS_MAX_SCORE) {
545 DEBUG_MSG(qry, "=> no valid NS left\n");
546 ITERATE_LAYERS(request, qry, reset);
547 kr_rplan_pop(rplan, qry);
548 return KNOT_STATE_PRODUCE;
549 }
550 }
551
552 /* Resolve address records */
553 if (qry->ns.addr[0].ip.sa_family == AF_UNSPEC) {
554 int ret = ns_resolve_addr(qry, request);
555 if (ret != 0) {
556 qry->flags &= ~(QUERY_AWAIT_IPV6|QUERY_AWAIT_IPV4|QUERY_TCP);
557 goto ns_election; /* Must try different NS */
558 }
559 ITERATE_LAYERS(request, qry, reset);
560 return KNOT_STATE_PRODUCE;
561 }
562
563 /* Prepare additional query */
564 int ret = query_finalize(request, qry, packet);
565 if (ret != 0) {
566 return KNOT_STATE_FAIL;
567 }
568
569 WITH_DEBUG {
570 char qname_str[KNOT_DNAME_MAXLEN], zonecut_str[KNOT_DNAME_MAXLEN], ns_str[SOCKADDR_STRLEN], type_str[16];
571 knot_dname_to_str(qname_str, knot_pkt_qname(packet), sizeof(qname_str));
572 knot_dname_to_str(zonecut_str, qry->zone_cut.name, sizeof(zonecut_str));
573 knot_rrtype_to_string(knot_pkt_qtype(packet), type_str, sizeof(type_str));
574 for (size_t i = 0; i < KR_NSREP_MAXADDR; ++i) {
575 struct sockaddr *addr = &qry->ns.addr[i].ip;
576 if (addr->sa_family == AF_UNSPEC) {
577 break;
578 }
579 inet_ntop(addr->sa_family, kr_nsrep_inaddr(qry->ns.addr[i]), ns_str, sizeof(ns_str));
580 DEBUG_MSG(qry, "%s: '%s' score: %u zone cut: '%s' m12n: '%s' type: '%s'\n",
581 i == 0 ? "=> querying" : " optional",
582 ns_str, qry->ns.score, zonecut_str, qname_str, type_str);
583 }
584 }
585
586 gettimeofday(&qry->timestamp, NULL);
587 *dst = &qry->ns.addr[0].ip;
588 *type = (qry->flags & QUERY_TCP) ? SOCK_STREAM : SOCK_DGRAM;
589 return request->state;
590 }
591
592 int kr_resolve_finish(struct kr_request *request, int state)
593 {
594 #ifndef NDEBUG
595 struct kr_rplan *rplan = &request->rplan;
596 #endif
597 /* Finalize answer */
598 if (answer_finalize(request, state) != 0) {
599 state = KNOT_STATE_FAIL;
600 }
601 /* Error during procesing, internal failure */
602 if (state != KNOT_STATE_DONE) {
603 knot_pkt_t *answer = request->answer;
604 if (knot_wire_get_rcode(answer->wire) == KNOT_RCODE_NOERROR) {
605 knot_wire_set_rcode(answer->wire, KNOT_RCODE_SERVFAIL);
606 }
607 }
608
609 ITERATE_LAYERS(request, NULL, finish);
610 DEBUG_MSG(NULL, "finished: %d, queries: %zu, mempool: %zu B\n",
611 state, list_size(&rplan->resolved), (size_t) mp_total_size(request->pool.ctx));
612 return KNOT_STATE_DONE;
613 }
614
615 struct kr_rplan *kr_resolve_plan(struct kr_request *request)
616 {
617 if (request) {
618 return &request->rplan;
619 }
620 return NULL;
621 }