X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=src%2Fdns.cpp;h=14305ccab2f49a2a4e94f94ee67dc543c34e92c2;hb=68211809ee3111bdc9609fbd46dc3c875fbb5ea6;hp=3381c18fa000e3886cb7e86d6ff058f418d4410a;hpb=c2022e89e5ae24366f99aae8acc55f59ae868690;p=user%2Fhenk%2Fcode%2Finspircd.git diff --git a/src/dns.cpp b/src/dns.cpp index 3381c18fa..14305ccab 100644 --- a/src/dns.cpp +++ b/src/dns.cpp @@ -1,19 +1,29 @@ -/* +------------------------------------+ - * | Inspire Internet Relay Chat Daemon | - * +------------------------------------+ +/* + * InspIRCd -- Internet Relay Chat Daemon + * + * Copyright (C) 2012 William Pitcock + * Copyright (C) 2009-2010 Daniel De Graaf + * Copyright (C) 2006, 2009 Robin Burchell + * Copyright (C) 2007, 2009 Dennis Friis + * Copyright (C) 2008 Thomas Stagner + * Copyright (C) 2005-2007 Craig Edwards * - * InspIRCd is copyright (C) 2002-2006 ChatSpike-Dev. - * E-mail: - * - * - * - * Written by Craig Edwards, Craig McLure, and others. - * This program is free but copyrighted software; see - * the file COPYING for details. + * This file is part of InspIRCd. InspIRCd is free software: you can + * redistribute it and/or modify it under the terms of the GNU General Public + * License as published by the Free Software Foundation, version 2. * - * --------------------------------------------------- + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS + * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more + * details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . */ + +/* $Core */ + /* dns.cpp - Nonblocking DNS functions. Very very loosely based on the firedns library, @@ -24,24 +34,22 @@ Please do not assume that firedns works like this, looks like this, walks like this or tastes like this. */ -using namespace std; - +#ifndef _WIN32 #include #include #include #include #include -#include "dns.h" +#else +#include "inspircd_win32wrapper.h" +#endif + #include "inspircd.h" #include "socketengine.h" #include "configreader.h" #include "socket.h" -using namespace std; -using irc::sockets::insp_sockaddr; -using irc::sockets::insp_inaddr; -using irc::sockets::insp_ntoa; -using irc::sockets::insp_aton; +#define DN_COMP_BITMASK 0xC000 /* highest 6 bits in a DN label header */ /** Masks to mask off the responses we get from the DNSRequest methods */ @@ -67,9 +75,8 @@ enum QueryFlags /** Represents a dns resource record (rr) */ -class ResourceRecord +struct ResourceRecord { - public: QueryType type; /* Record type */ unsigned int rr_class; /* Record class */ unsigned long ttl; /* Time to live */ @@ -98,58 +105,83 @@ class DNSRequest unsigned char* res; /* Result processing buffer */ unsigned int rr_class; /* Request class */ QueryType type; /* Request type */ - insp_inaddr myserver; /* DNS server address*/ DNS* dnsobj; /* DNS caller (where we get our FD from) */ + unsigned long ttl; /* Time to live */ + std::string orig; /* Original requested name/ip */ - DNSRequest(InspIRCd* Instance, DNS* dns, insp_inaddr server, int id, requestlist &requests); + DNSRequest(DNS* dns, int id, const std::string &original); ~DNSRequest(); - DNSInfo ResultIsReady(DNSHeader &h, int length); + DNSInfo ResultIsReady(DNSHeader &h, unsigned length); int SendRequests(const DNSHeader *header, const int length, QueryType qt); }; -class RequestTimeout : public InspTimer +class CacheTimer : public Timer +{ + private: + DNS* dns; + public: + CacheTimer(DNS* thisdns) + : Timer(3600, ServerInstance->Time(), true), dns(thisdns) { } + + virtual void Tick(time_t) + { + dns->PruneCache(); + } +}; + +class RequestTimeout : public Timer { - InspIRCd* ServerInstance; DNSRequest* watch; int watchid; - requestlist &rl; public: - RequestTimeout(unsigned long n, InspIRCd* SI, DNSRequest* watching, int id, requestlist &requests) : InspTimer(n, time(NULL)), ServerInstance(SI), watch(watching), watchid(id), rl(requests) + RequestTimeout(unsigned long n, DNSRequest* watching, int id) : Timer(n, ServerInstance->Time()), watch(watching), watchid(id) { - ServerInstance->Log(DEBUG, "New DNS timeout set on %08x", watching); + } + ~RequestTimeout() + { + if (ServerInstance->Res) + Tick(0); } - void Tick(time_t TIME) + void Tick(time_t) { - if (rl.find(watchid) != rl.end()) + if (ServerInstance->Res->requests[watchid] == watch) { /* Still exists, whack it */ - if (rl.find(watchid)->second == watch) + if (ServerInstance->Res->Classes[watchid]) { - if (ServerInstance->Res->Classes[watchid]) - { - ServerInstance->Res->Classes[watchid]->OnError(RESOLVER_TIMEOUT, "Request timed out"); - delete ServerInstance->Res->Classes[watchid]; - ServerInstance->Res->Classes[watchid] = NULL; - } - rl.erase(rl.find(watchid)); - delete watch; - ServerInstance->Log(DEBUG, "DNS timeout on %08x squished pointer", watch); + ServerInstance->Res->Classes[watchid]->OnError(RESOLVER_TIMEOUT, "Request timed out"); + delete ServerInstance->Res->Classes[watchid]; + ServerInstance->Res->Classes[watchid] = NULL; } - return; + ServerInstance->Res->requests[watchid] = NULL; + delete watch; } - ServerInstance->Log(DEBUG, "DNS timeout on %08x: result already received!", watch); } }; +CachedQuery::CachedQuery(const std::string &res, QueryType qt, unsigned int ttl) : data(res), type(qt) +{ + expires = ServerInstance->Time() + ttl; +} + +int CachedQuery::CalcTTLRemaining() +{ + int n = expires - ServerInstance->Time(); + return (n < 0 ? 0 : n); +} + /* Allocate the processing buffer */ -DNSRequest::DNSRequest(InspIRCd* Instance, DNS* dns, insp_inaddr server, int id, requestlist &requests) : dnsobj(dns) +DNSRequest::DNSRequest(DNS* dns, int rid, const std::string &original) : dnsobj(dns) { - res = new unsigned char[512]; + /* hardening against overflow here: make our work buffer twice the theoretical + * maximum size so that hostile input doesn't screw us over. + */ + res = new unsigned char[sizeof(DNSHeader) * 2]; *res = 0; - memcpy(&myserver, &server, sizeof(insp_inaddr)); - RequestTimeout* RT = new RequestTimeout(Instance->Config->dns_timeout ? Instance->Config->dns_timeout : 5, Instance, this, id, requests); - Instance->Timers->AddTimer(RT); /* The timer manager frees this */ + orig = original; + RequestTimeout* RT = new RequestTimeout(ServerInstance->Config->dns_timeout ? ServerInstance->Config->dns_timeout : 5, this, rid); + ServerInstance->Timers->AddTimer(RT); /* The timer manager frees this */ } /* Deallocate the processing buffer */ @@ -202,49 +234,55 @@ inline void DNS::EmptyHeader(unsigned char *output, const DNSHeader *header, con /** Send requests we have previously built down the UDP socket */ int DNSRequest::SendRequests(const DNSHeader *header, const int length, QueryType qt) { - insp_sockaddr addr; + ServerInstance->Logs->Log("RESOLVER", DEBUG,"DNSRequest::SendRequests"); + unsigned char payload[sizeof(DNSHeader)]; this->rr_class = 1; this->type = qt; - + DNS::EmptyHeader(payload,header,length); - memset(&addr,0,sizeof(addr)); -#ifdef IPV6 - memcpy(&addr.sin6_addr,&myserver,sizeof(addr.sin6_addr)); - addr.sin6_family = AF_FAMILY; - addr.sin6_port = htons(DNS::QUERY_PORT); -#else - memcpy(&addr.sin_addr.s_addr,&myserver,sizeof(addr.sin_addr)); - addr.sin_family = AF_FAMILY; - addr.sin_port = htons(DNS::QUERY_PORT); -#endif - if (sendto(dnsobj->GetFd(), payload, length + 12, 0, (sockaddr *) &addr, sizeof(addr)) == -1) + if (ServerInstance->SE->SendTo(dnsobj, payload, length + 12, 0, &(dnsobj->myserver.sa), sa_size(dnsobj->myserver)) != length+12) return -1; + ServerInstance->Logs->Log("RESOLVER",DEBUG,"Sent OK"); return 0; } /** Add a query with a predefined header, and allocate an ID for it. */ -DNSRequest* DNS::AddQuery(DNSHeader *header, int &id) +DNSRequest* DNS::AddQuery(DNSHeader *header, int &id, const char* original) { /* Is the DNS connection down? */ if (this->GetFd() == -1) return NULL; - /* Are there already the max number of requests on the go? */ - if (requests.size() == DNS::MAX_REQUEST_ID + 1) - return NULL; - /* Create an id */ - id = this->PRNG() & DNS::MAX_REQUEST_ID; + unsigned int tries = 0; + do { + id = ServerInstance->GenRandomInt(DNS::MAX_REQUEST_ID); + if (++tries == DNS::MAX_REQUEST_ID*5) + { + // If we couldn't find an empty slot this many times, do a sequential scan as a last + // resort. If an empty slot is found that way, go on, otherwise throw an exception + id = -1; + for (int i = 0; i < DNS::MAX_REQUEST_ID; i++) + { + if (!requests[i]) + { + id = i; + break; + } + } - /* If this id is already 'in flight', pick another. */ - while (requests.find(id) != requests.end()) - id = this->PRNG() & DNS::MAX_REQUEST_ID; + if (id == -1) + throw ModuleException("DNS: All ids are in use"); - DNSRequest* req = new DNSRequest(ServerInstance, this, this->myserver, id, requests); + break; + } + } while (requests[id]); + + DNSRequest* req = new DNSRequest(this, id, original); header->id[0] = req->id[0] = id >> 8; header->id[1] = req->id[1] = id & 0xFF; @@ -264,108 +302,111 @@ DNSRequest* DNS::AddQuery(DNSHeader *header, int &id) return req; } -/** Initialise the DNS UDP socket so that we can send requests */ -DNS::DNS(InspIRCd* Instance) : ServerInstance(Instance) +int DNS::ClearCache() { - ServerInstance->Log(DEBUG,"DNS::DNS: Instance = %08x",Instance); - - insp_inaddr addr; - - /* Clear the Resolver class table */ - memset(Classes,0,sizeof(Classes)); - - /* Set the id of the next request to 0 - */ - currid = 0; + /* This ensures the buckets are reset to sane levels */ + int rv = this->cache->size(); + delete this->cache; + this->cache = new dnscache(); + return rv; +} - /* By default we're not munging ip's - */ - ip6munge = false; +int DNS::PruneCache() +{ + int n = 0; + dnscache* newcache = new dnscache(); + for (dnscache::iterator i = this->cache->begin(); i != this->cache->end(); i++) + /* Dont include expired items (theres no point) */ + if (i->second.CalcTTLRemaining()) + newcache->insert(*i); + else + n++; - /* Clear the namesever address */ - memset(&myserver,0,sizeof(insp_inaddr)); + delete this->cache; + this->cache = newcache; + return n; +} - /* Convert the nameserver address into an insp_inaddr */ - if (insp_aton(ServerInstance->Config->DNSServer,&addr) > 0) +void DNS::Rehash() +{ + if (this->GetFd() > -1) { - memcpy(&myserver,&addr,sizeof(insp_inaddr)); - if ((strstr(ServerInstance->Config->DNSServer,"::ffff:") == (char*)&ServerInstance->Config->DNSServer) || (strstr(ServerInstance->Config->DNSServer,"::FFFF:") == (char*)&ServerInstance->Config->DNSServer)) - { - /* These dont come back looking like they did when they went in. - * We're forced to turn some checks off. - * If anyone knows how to fix this, let me know. --Brain - */ - ServerInstance->Log(DEFAULT,"WARNING: Using IPv4 addresses over IPv6 forces some DNS checks to be disabled."); - ServerInstance->Log(DEFAULT," This should not cause a problem, however it is recommended you migrate"); - ServerInstance->Log(DEFAULT," to a true IPv6 environment."); - this->ip6munge = true; - } - ServerInstance->Log(DEBUG,"Added nameserver '%s'",ServerInstance->Config->DNSServer); + ServerInstance->SE->DelFd(this); + ServerInstance->SE->Shutdown(this, 2); + ServerInstance->SE->Close(this); + this->SetFd(-1); + + /* Rehash the cache */ + this->PruneCache(); } else { - ServerInstance->Log(DEBUG,"GACK! insp_aton says the nameserver '%s' is invalid!",ServerInstance->Config->DNSServer); + /* Create initial dns cache */ + this->cache = new dnscache(); } + irc::sockets::aptosa(ServerInstance->Config->DNSServer, DNS::QUERY_PORT, myserver); + /* Initialize mastersocket */ - this->SetFd(socket(PF_PROTOCOL, SOCK_DGRAM, 0)); - if (this->GetFd() != -1) - { - /* Did it succeed? */ - if (fcntl(this->GetFd(), F_SETFL, O_NONBLOCK) != 0) - { - /* Couldn't make the socket nonblocking */ - shutdown(this->GetFd(),2); - close(this->GetFd()); - this->SetFd(-1); - } - } - else - { - ServerInstance->Log(DEBUG,"I cant socket() this socket! (%s)",strerror(errno)); - } + int s = socket(myserver.sa.sa_family, SOCK_DGRAM, 0); + this->SetFd(s); + /* Have we got a socket and is it nonblocking? */ if (this->GetFd() != -1) { -#ifdef IPV6 - insp_sockaddr addr; - memset(&addr,0,sizeof(addr)); - addr.sin6_family = AF_FAMILY; - addr.sin6_port = 0; - addr.sin6_addr = in6addr_any; -#else - insp_sockaddr addr; - memset(&addr,0,sizeof(addr)); - addr.sin_family = AF_FAMILY; - addr.sin_port = 0; - addr.sin_addr.s_addr = INADDR_ANY; -#endif - /* Bind the port */ - if (bind(this->GetFd(),(sockaddr *)&addr,sizeof(addr)) != 0) + ServerInstance->SE->SetReuse(s); + ServerInstance->SE->NonBlocking(s); + irc::sockets::sockaddrs bindto; + memset(&bindto, 0, sizeof(bindto)); + bindto.sa.sa_family = myserver.sa.sa_family; + if (ServerInstance->SE->Bind(this->GetFd(), bindto) < 0) { /* Failed to bind */ - ServerInstance->Log(DEBUG,"Cant bind DNS fd"); - shutdown(this->GetFd(),2); - close(this->GetFd()); + ServerInstance->Logs->Log("RESOLVER",SPARSE,"Error binding dns socket - hostnames will NOT resolve"); + ServerInstance->SE->Shutdown(this, 2); + ServerInstance->SE->Close(this); this->SetFd(-1); } - - if (this->GetFd() >= 0) + else if (!ServerInstance->SE->AddFd(this, FD_WANT_POLL_READ | FD_WANT_NO_WRITE)) { - ServerInstance->Log(DEBUG,"Add master socket %d",this->GetFd()); - /* Hook the descriptor into the socket engine */ - if (ServerInstance && ServerInstance->SE) - { - if (!ServerInstance->SE->AddFd(this)) - { - ServerInstance->Log(DEFAULT,"Internal error starting DNS - hostnames will NOT resolve."); - shutdown(this->GetFd(),2); - close(this->GetFd()); - this->SetFd(-1); - } - } + ServerInstance->Logs->Log("RESOLVER",SPARSE,"Internal error starting DNS - hostnames will NOT resolve."); + ServerInstance->SE->Shutdown(this, 2); + ServerInstance->SE->Close(this); + this->SetFd(-1); } } + else + { + ServerInstance->Logs->Log("RESOLVER",SPARSE,"Error creating DNS socket - hostnames will NOT resolve"); + } +} + +/** Initialise the DNS UDP socket so that we can send requests */ +DNS::DNS() +{ + ServerInstance->Logs->Log("RESOLVER",DEBUG,"DNS::DNS"); + /* Clear the Resolver class table */ + memset(Classes,0,sizeof(Classes)); + + /* Clear the requests class table */ + memset(requests,0,sizeof(requests)); + + /* DNS::Rehash() sets this to a valid ptr + */ + this->cache = NULL; + + /* Again, DNS::Rehash() sets this to a + * valid value + */ + this->SetFd(-1); + + /* Actually read the settings + */ + this->Rehash(); + + this->PruneTimer = new CacheTimer(this); + + ServerInstance->Timers->AddTimer(this->PruneTimer); } /** Build a payload to be placed after the header, based upon input data, a resource type, a class and a pointer to a buffer */ @@ -411,11 +452,11 @@ int DNS::GetIP(const char *name) DNSHeader h; int id; int length; - + if ((length = this->MakePayload(name, DNS_QUERY_A, 1, (unsigned char*)&h.payload)) == -1) return -1; - DNSRequest* req = this->AddQuery(&h, id); + DNSRequest* req = this->AddQuery(&h, id, name); if ((!req) || (req->SendRequests(&h, length, DNS_QUERY_A) == -1)) return -1; @@ -433,7 +474,7 @@ int DNS::GetIP6(const char *name) if ((length = this->MakePayload(name, DNS_QUERY_AAAA, 1, (unsigned char*)&h.payload)) == -1) return -1; - DNSRequest* req = this->AddQuery(&h, id); + DNSRequest* req = this->AddQuery(&h, id, name); if ((!req) || (req->SendRequests(&h, length, DNS_QUERY_AAAA) == -1)) return -1; @@ -451,7 +492,7 @@ int DNS::GetCName(const char *alias) if ((length = this->MakePayload(alias, DNS_QUERY_CNAME, 1, (unsigned char*)&h.payload)) == -1) return -1; - DNSRequest* req = this->AddQuery(&h, id); + DNSRequest* req = this->AddQuery(&h, id, alias); if ((!req) || (req->SendRequests(&h, length, DNS_QUERY_CNAME) == -1)) return -1; @@ -459,38 +500,6 @@ int DNS::GetCName(const char *alias) return id; } -/** Start lookup of an IP address to a hostname */ -int DNS::GetName(const insp_inaddr *ip) -{ - char query[128]; - DNSHeader h; - int id; - int length; - -#ifdef IPV6 - unsigned char* c = (unsigned char*)&ip->s6_addr; - if (c[0] == 0 && c[1] == 0 && c[2] == 0 && c[3] == 0 && - c[4] == 0 && c[5] == 0 && c[6] == 0 && c[7] == 0 && - c[8] == 0 && c[9] == 0 && c[10] == 0xFF && c[11] == 0xFF) - sprintf(query,"%d.%d.%d.%d.in-addr.arpa",c[15],c[14],c[13],c[12]); - else - DNS::MakeIP6Int(query, (in6_addr*)ip); -#else - unsigned char* c = (unsigned char*)&ip->s_addr; - sprintf(query,"%d.%d.%d.%d.in-addr.arpa",c[3],c[2],c[1],c[0]); -#endif - - if ((length = this->MakePayload(query, DNS_QUERY_PTR, 1, (unsigned char*)&h.payload)) == -1) - return -1; - - DNSRequest* req = this->AddQuery(&h, id); - - if ((!req) || (req->SendRequests(&h, length, DNS_QUERY_PTR) == -1)) - return -1; - - return id; -} - /** Start lookup of an IP address to a hostname */ int DNS::GetNameForce(const char *ip, ForceProtocol fp) { @@ -498,7 +507,7 @@ int DNS::GetNameForce(const char *ip, ForceProtocol fp) DNSHeader h; int id; int length; -#ifdef SUPPORT_IP6LINKS + if (fp == PROTOCOL_IPV6) { in6_addr i; @@ -507,11 +516,13 @@ int DNS::GetNameForce(const char *ip, ForceProtocol fp) DNS::MakeIP6Int(query, &i); } else + { + ServerInstance->Logs->Log("RESOLVER",DEBUG,"DNS::GetNameForce IPv6 bad format for '%s'", ip); /* Invalid IP address */ return -1; + } } else -#endif { in_addr i; if (inet_aton(ip, &i)) @@ -520,19 +531,33 @@ int DNS::GetNameForce(const char *ip, ForceProtocol fp) sprintf(query,"%d.%d.%d.%d.in-addr.arpa",c[3],c[2],c[1],c[0]); } else + { + ServerInstance->Logs->Log("RESOLVER",DEBUG,"DNS::GetNameForce IPv4 bad format for '%s'", ip); /* Invalid IP address */ return -1; + } } - ServerInstance->Log(DEBUG,"DNS::GetNameForce: %s %d",query, fp); - - if ((length = this->MakePayload(query, DNS_QUERY_PTR, 1, (unsigned char*)&h.payload)) == -1) + length = this->MakePayload(query, DNS_QUERY_PTR, 1, (unsigned char*)&h.payload); + if (length == -1) + { + ServerInstance->Logs->Log("RESOLVER",DEBUG,"DNS::GetNameForce can't query '%s' using '%s' because it's too long", ip, query); return -1; + } - DNSRequest* req = this->AddQuery(&h, id); + DNSRequest* req = this->AddQuery(&h, id, ip); - if ((!req) || (req->SendRequests(&h, length, DNS_QUERY_PTR) == -1)) + if (!req) + { + ServerInstance->Logs->Log("RESOLVER",DEBUG,"DNS::GetNameForce can't add query (resolver down?)"); return -1; + } + + if (req->SendRequests(&h, length, DNS_QUERY_PTR) == -1) + { + ServerInstance->Logs->Log("RESOLVER",DEBUG,"DNS::GetNameForce can't send (firewall?)"); + return -1; + } return id; } @@ -541,7 +566,6 @@ int DNS::GetNameForce(const char *ip, ForceProtocol fp) */ void DNS::MakeIP6Int(char* query, const in6_addr *ip) { -#ifdef SUPPORT_IP6LINKS const char* hex = "0123456789abcdef"; for (int index = 31; index >= 0; index--) /* for() loop steps twice per byte */ { @@ -554,9 +578,6 @@ void DNS::MakeIP6Int(char* query, const in6_addr *ip) *query++ = '.'; /* Seperator */ } strcpy(query,"ip6.arpa"); /* Suffix the string */ -#else - *query = 0; -#endif } /** Return the next id which is ready, and the result attached to it */ @@ -566,22 +587,18 @@ DNSResult DNS::GetResult() DNSHeader header; DNSRequest *req; unsigned char buffer[sizeof(DNSHeader)]; - sockaddr from; + irc::sockets::sockaddrs from; + memset(&from, 0, sizeof(from)); socklen_t x = sizeof(from); - const char* ipaddr_from = ""; - unsigned short int port_from = 0; - - int length = recvfrom(this->GetFd(),buffer,sizeof(DNSHeader),0,&from,&x); - if (length < 0) - ServerInstance->Log(DEBUG,"Error in recvfrom()! (%s)",strerror(errno)); + int length = ServerInstance->SE->RecvFrom(this, (char*)buffer, sizeof(DNSHeader), 0, &from.sa, &x); /* Did we get the whole header? */ if (length < 12) { + ServerInstance->Logs->Log("RESOLVER",DEBUG,"GetResult didn't get a full packet (len=%d)", length); /* Nope - something screwed up. */ - ServerInstance->Log(DEBUG,"Whole header not read!"); - return std::make_pair(-1,""); + return DNSResult(-1,"",0,""); } /* Check wether the reply came from a different DNS @@ -589,28 +606,17 @@ DNSResult DNS::GetResult() * is not 53. * A user could in theory still spoof dns packets anyway * but this is less trivial than just sending garbage - * to the client, which is possible without this check. + * to the server, which is possible without this check. * * -- Thanks jilles for pointing this one out. */ -#ifdef IPV6 - ipaddr_from = insp_ntoa(((sockaddr_in6*)&from)->sin6_addr); - port_from = ntohs(((sockaddr_in6*)&from)->sin6_port); -#else - ipaddr_from = insp_ntoa(((sockaddr_in*)&from)->sin_addr); - port_from = ntohs(((sockaddr_in*)&from)->sin_port); -#endif - - /* We cant perform this security check if you're using 4in6. - * Tough luck to you, choose one or't other! - */ - if (!ip6munge) + if (from != myserver) { - if ((port_from != DNS::QUERY_PORT) || (strcasecmp(ipaddr_from, ServerInstance->Config->DNSServer))) - { - ServerInstance->Log(DEBUG,"port %d is not 53, or %s is not %s",port_from, ipaddr_from, ServerInstance->Config->DNSServer); - return std::make_pair(-1,""); - } + std::string server1 = from.str(); + std::string server2 = myserver.str(); + ServerInstance->Logs->Log("RESOLVER",DEBUG,"Got a result from the wrong server! Bad NAT or DNS forging attempt? '%s' != '%s'", + server1.c_str(), server2.c_str()); + return DNSResult(-1,"",0,""); } /* Put the read header info into a header class */ @@ -623,18 +629,17 @@ DNSResult DNS::GetResult() unsigned long this_id = header.id[1] + (header.id[0] << 8); /* Do we have a pending request matching this id? */ - requestlist_iter n_iter = requests.find(this_id); - if (n_iter == requests.end()) + if (!requests[this_id]) { /* Somehow we got a DNS response for a request we never made... */ - ServerInstance->Log(DEBUG,"DNS: got a response for a query we didnt send with fd=%d queryid=%d",this->GetFd(),this_id); - return std::make_pair(-1,""); + ServerInstance->Logs->Log("RESOLVER",DEBUG,"Hmm, got a result that we didn't ask for (id=%lx). Ignoring.", this_id); + return DNSResult(-1,"",0,""); } else { /* Remove the query from the list of pending queries */ - req = (DNSRequest*)n_iter->second; - requests.erase(n_iter); + req = requests[this_id]; + requests[this_id] = NULL; } /* Inform the DNSRequest class that it has a result to be read. @@ -653,11 +658,13 @@ DNSResult DNS::GetResult() * an error response and needs to be treated uniquely. * Put the error message in the second field. */ + std::string ro = req->orig; delete req; - return std::make_pair(this_id | ERROR_MASK, data.second); + return DNSResult(this_id | ERROR_MASK, data.second, 0, ro); } else { + unsigned long ttl = req->ttl; char formatted[128]; /* Forward lookups come back as binary data. We must format them into ascii */ @@ -670,27 +677,13 @@ DNSResult DNS::GetResult() case DNS_QUERY_AAAA: { - snprintf(formatted,40,"%x:%x:%x:%x:%x:%x:%x:%x", - (ntohs(data.first[0]) + ntohs(data.first[1] << 8)), - (ntohs(data.first[2]) + ntohs(data.first[3] << 8)), - (ntohs(data.first[4]) + ntohs(data.first[5] << 8)), - (ntohs(data.first[6]) + ntohs(data.first[7] << 8)), - (ntohs(data.first[8]) + ntohs(data.first[9] << 8)), - (ntohs(data.first[10]) + ntohs(data.first[11] << 8)), - (ntohs(data.first[12]) + ntohs(data.first[13] << 8)), - (ntohs(data.first[14]) + ntohs(data.first[15] << 8))); - char* c = strstr(formatted,":0:"); - if (c != NULL) + if (!inet_ntop(AF_INET6, data.first, formatted, sizeof(formatted))) { - memmove(c+1,c+2,strlen(c+2) + 1); - c += 2; - while (memcmp(c,"0:",2) == 0) - memmove(c,c+2,strlen(c+2) + 1); - if (memcmp(c,"0",2) == 0) - *c = 0; - if (memcmp(formatted,"0::",3) == 0) - memmove(formatted,formatted + 1, strlen(formatted + 1) + 1); + std::string ro = req->orig; + delete req; + return DNSResult(this_id | ERROR_MASK, "inet_ntop() failed", 0, ro); } + resultstr = formatted; /* Special case. Sending ::1 around between servers @@ -699,7 +692,7 @@ DNSResult DNS::GetResult() * as the last parameter on the line with a value ":1". */ if (*formatted == ':') - resultstr = "0" + resultstr; + resultstr.insert(0, "0"); } break; @@ -707,31 +700,45 @@ DNSResult DNS::GetResult() /* Identical handling to PTR */ case DNS_QUERY_PTR: + { /* Reverse lookups just come back as char* */ resultstr = std::string((const char*)data.first); + if (resultstr.find_first_not_of("0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.-") != std::string::npos) + { + std::string ro = req->orig; + delete req; + return DNSResult(this_id | ERROR_MASK, "Invalid char(s) in reply", 0, ro); + } + } break; default: - ServerInstance->Log(DEBUG,"WARNING: Somehow we made a request for a DNS_QUERY_PTR4 or DNS_QUERY_PTR6, but these arent real rr types!"); break; - } /* Build the reply with the id and hostname/ip in it */ + std::string ro = req->orig; + DNSResult result = DNSResult(this_id,resultstr,ttl,ro,req->type); delete req; - return std::make_pair(this_id,resultstr); + return result; } } /** A result is ready, process it */ -DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, int length) +DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, unsigned length) { - int i = 0; + unsigned i = 0, o; int q = 0; - int curanswer, o; + int curanswer; ResourceRecord rr; unsigned short ptr; - + + /* This is just to keep _FORTIFY_SOURCE happy */ + rr.type = DNS_QUERY_NONE; + rr.rdlength = 0; + rr.ttl = 1; /* GCC is a whiney bastard -- see the XXX below. */ + rr.rr_class = 0; /* Same for VC++ */ + if (!(header.flags1 & FLAGS_MASK_QR)) return std::make_pair((unsigned char*)NULL,"Not a query result"); @@ -785,11 +792,14 @@ DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, int length) else i += header.payload[i] + 1; /* skip length and label */ } } - if (length - i < 10) + if (static_cast(length - i) < 10) return std::make_pair((unsigned char*)NULL,"Incorrectly sized DNS reply"); + /* XXX: We actually initialise 'rr' here including its ttl field */ DNS::FillResourceRecord(&rr,&header.payload[i]); + i += 10; + ServerInstance->Logs->Log("RESOLVER",DEBUG,"Resolver: rr.type is %d and this.type is %d rr.class %d this.class %d", rr.type, this->type, rr.rr_class, this->rr_class); if (rr.type != this->type) { curanswer++; @@ -805,7 +815,7 @@ DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, int length) break; } if ((unsigned int)curanswer == header.ancount) - return std::make_pair((unsigned char*)NULL,"No valid answers"); + return std::make_pair((unsigned char*)NULL,"No A, AAAA or PTR type answers (" + ConvToStr(header.ancount) + " answers)"); if (i + rr.rdlength > (unsigned int)length) return std::make_pair((unsigned char*)NULL,"Resource record larger than stated"); @@ -813,19 +823,41 @@ DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, int length) if (rr.rdlength > 1023) return std::make_pair((unsigned char*)NULL,"Resource record too large"); + this->ttl = rr.ttl; + switch (rr.type) { + /* + * CNAME and PTR are compressed. We need to decompress them. + */ case DNS_QUERY_CNAME: - /* CNAME and PTR have the same processing code */ case DNS_QUERY_PTR: + { + unsigned short lowest_pos = length; o = 0; q = 0; while (q == 0 && i < length && o + 256 < 1023) { + /* DN label found (byte over 63) */ if (header.payload[i] > 63) { memcpy(&ptr,&header.payload[i],2); - i = ntohs(ptr) - 0xC000 - 12; + + i = ntohs(ptr); + + /* check that highest two bits are set. if not, we've been had */ + if ((i & DN_COMP_BITMASK) != DN_COMP_BITMASK) + return std::make_pair((unsigned char *) NULL, "DN label decompression header is bogus"); + + /* mask away the two highest bits. */ + i &= ~DN_COMP_BITMASK; + + /* and decrease length by 12 bytes. */ + i -= 12; + + if (i >= lowest_pos) + return std::make_pair((unsigned char *) NULL, "Invalid decompression pointer"); + lowest_pos = i; } else { @@ -838,43 +870,91 @@ DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, int length) res[o] = 0; if (o != 0) res[o++] = '.'; - memcpy(&res[o],&header.payload[i + 1],header.payload[i]); + + if (o + header.payload[i] > sizeof(DNSHeader)) + return std::make_pair((unsigned char *) NULL, "DN label decompression is impossible -- malformed/hostile packet?"); + + memcpy(&res[o], &header.payload[i + 1], header.payload[i]); o += header.payload[i]; i += header.payload[i] + 1; } } } res[o] = 0; + } break; case DNS_QUERY_AAAA: + if (rr.rdlength != sizeof(struct in6_addr)) + return std::make_pair((unsigned char *) NULL, "rr.rdlength is larger than 16 bytes for an ipv6 entry -- malformed/hostile packet?"); + memcpy(res,&header.payload[i],rr.rdlength); res[rr.rdlength] = 0; break; case DNS_QUERY_A: + if (rr.rdlength != sizeof(struct in_addr)) + return std::make_pair((unsigned char *) NULL, "rr.rdlength is larger than 4 bytes for an ipv4 entry -- malformed/hostile packet?"); + memcpy(res,&header.payload[i],rr.rdlength); res[rr.rdlength] = 0; break; default: - memcpy(res,&header.payload[i],rr.rdlength); - res[rr.rdlength] = 0; + return std::make_pair((unsigned char *) NULL, "don't know how to handle undefined type (" + ConvToStr(rr.type) + ") -- rejecting"); break; } - return std::make_pair(res,"No error");; + return std::make_pair(res,"No error"); } /** Close the master socket */ DNS::~DNS() { - shutdown(this->GetFd(), 2); - close(this->GetFd()); + ServerInstance->SE->Shutdown(this, 2); + ServerInstance->SE->Close(this); + ServerInstance->Timers->DelTimer(this->PruneTimer); + if (cache) + delete cache; +} + +CachedQuery* DNS::GetCache(const std::string &source) +{ + dnscache::iterator x = cache->find(source.c_str()); + if (x != cache->end()) + return &(x->second); + else + return NULL; +} + +void DNS::DelCache(const std::string &source) +{ + cache->erase(source.c_str()); +} + +void Resolver::TriggerCachedResult() +{ + if (CQ) + OnLookupComplete(CQ->data, time_left, true); } /** High level abstraction of dns used by application at large */ -Resolver::Resolver(InspIRCd* Instance, const std::string &source, QueryType qt) : ServerInstance(Instance), input(source), querytype(qt) +Resolver::Resolver(const std::string &source, QueryType qt, bool &cached, Module* creator) : Creator(creator), input(source), querytype(qt) { - ServerInstance->Log(DEBUG,"Instance: %08x %08x",Instance, ServerInstance); + ServerInstance->Logs->Log("RESOLVER",DEBUG,"Resolver::Resolver"); + cached = false; - insp_inaddr binip; + CQ = ServerInstance->Res->GetCache(source); + if (CQ) + { + time_left = CQ->CalcTTLRemaining(); + if (!time_left) + { + ServerInstance->Res->DelCache(source); + } + else if (CQ->type == qt) + { + cached = true; + return; + } + CQ = NULL; + } switch (querytype) { @@ -882,20 +962,6 @@ Resolver::Resolver(InspIRCd* Instance, const std::string &source, QueryType qt) this->myid = ServerInstance->Res->GetIP(source.c_str()); break; - case DNS_QUERY_PTR: - if (insp_aton(source.c_str(), &binip) > 0) - { - /* Valid ip address */ - this->myid = ServerInstance->Res->GetName(&binip); - } - else - { - this->OnError(RESOLVER_BADIP, "Bad IP address for reverse lookup"); - throw ModuleException("Resolver: Bad IP address"); - return; - } - break; - case DNS_QUERY_PTR4: querytype = DNS_QUERY_PTR; this->myid = ServerInstance->Res->GetNameForce(source.c_str(), PROTOCOL_IPV4); @@ -915,23 +981,22 @@ Resolver::Resolver(InspIRCd* Instance, const std::string &source, QueryType qt) break; default: + ServerInstance->Logs->Log("RESOLVER",DEBUG,"DNS request with unknown query type %d", querytype); this->myid = -1; break; } if (this->myid == -1) { - ServerInstance->Log(DEBUG,"Resolver::Resolver: Could not get an id!"); - this->OnError(RESOLVER_NSDOWN, "Nameserver is down"); - throw ModuleException("Resolver: Couldnt get an id to make a request"); - /* We shouldnt get here really */ - return; + throw ModuleException("Resolver: Couldn't get an id to make a request"); + } + else + { + ServerInstance->Logs->Log("RESOLVER",DEBUG,"DNS request id %d", this->myid); } - - ServerInstance->Log(DEBUG,"Resolver::Resolver: this->myid=%d",this->myid); } /** Called when an error occurs */ -void Resolver::OnError(ResolverError e, const std::string &errormessage) +void Resolver::OnError(ResolverError, const std::string&) { /* Nothing in here */ } @@ -948,43 +1013,56 @@ int Resolver::GetId() return this->myid; } +Module* Resolver::GetCreator() +{ + return this->Creator; +} + /** Process a socket read event */ -void DNS::HandleEvent(EventType et, int errornum) +void DNS::HandleEvent(EventType, int) { - ServerInstance->Log(DEBUG,"Marshall reads: %d",this->GetFd()); /* Fetch the id and result of the next available packet */ - DNSResult res = this->GetResult(); + DNSResult res(0,"",0,""); + res.id = 0; + ServerInstance->Logs->Log("RESOLVER",DEBUG,"Handle DNS event"); + + res = this->GetResult(); + + ServerInstance->Logs->Log("RESOLVER",DEBUG,"Result id %d", res.id); + /* Is there a usable request id? */ - if (res.first != -1) + if (res.id != -1) { /* Its an error reply */ - if (res.first & ERROR_MASK) + if (res.id & ERROR_MASK) { /* Mask off the error bit */ - res.first -= ERROR_MASK; + res.id -= ERROR_MASK; /* Marshall the error to the correct class */ - ServerInstance->Log(DEBUG,"Error available, id=%d",res.first); - if (Classes[res.first]) + if (Classes[res.id]) { if (ServerInstance && ServerInstance->stats) ServerInstance->stats->statsDnsBad++; - Classes[res.first]->OnError(RESOLVER_NXDOMAIN, res.second); - delete Classes[res.first]; - Classes[res.first] = NULL; + Classes[res.id]->OnError(RESOLVER_NXDOMAIN, res.result); + delete Classes[res.id]; + Classes[res.id] = NULL; } + return; } else { - /* It is a non-error result */ - ServerInstance->Log(DEBUG,"Result available, id=%d",res.first); - /* Marshall the result to the correct class */ - if (Classes[res.first]) + /* It is a non-error result, marshall the result to the correct class */ + if (Classes[res.id]) { if (ServerInstance && ServerInstance->stats) ServerInstance->stats->statsDnsGood++; - Classes[res.first]->OnLookupComplete(res.second); - delete Classes[res.first]; - Classes[res.first] = NULL; + + if (!this->GetCache(res.original.c_str())) + this->cache->insert(std::make_pair(res.original.c_str(), CachedQuery(res.result, res.type, res.ttl))); + + Classes[res.id]->OnLookupComplete(res.result, res.ttl, false); + delete Classes[res.id]; + Classes[res.id] = NULL; } } @@ -996,6 +1074,7 @@ void DNS::HandleEvent(EventType et, int errornum) /** Add a derived Resolver to the working set */ bool DNS::AddResolverClass(Resolver* r) { + ServerInstance->Logs->Log("RESOLVER",DEBUG,"AddResolverClass 0x%08lx", (unsigned long)r); /* Check the pointers validity and the id's validity */ if ((r) && (r->GetId() > -1)) { @@ -1009,32 +1088,27 @@ bool DNS::AddResolverClass(Resolver* r) Classes[r->GetId()] = r; return true; } - else - /* Duplicate id */ - return false; } - else - { - /* Pointer or id not valid. - * Free the item and return - */ - if (r) - delete r; - return false; - } + /* Pointer or id not valid, or duplicate id. + * Free the item and return + */ + delete r; + return false; } -/** Generate pseudo-random number */ -unsigned long DNS::PRNG() +void DNS::CleanResolvers(Module* module) { - unsigned long val = 0; - timeval n; - serverstats* s = ServerInstance->stats; - gettimeofday(&n,NULL); - val = (n.tv_usec ^ getpid() ^ geteuid() ^ (this->currid++)) ^ s->statsAccept + n.tv_sec; - val = val + s->statsCollisions ^ s->statsDnsGood - s->statsDnsBad; - val += (s->statsConnects ^ (unsigned long)s->statsSent ^ (unsigned long)s->statsRecv) - s->BoundPortCount; - return val; + for (int i = 0; i < MAX_REQUEST_ID; i++) + { + if (Classes[i]) + { + if (Classes[i]->GetCreator() == module) + { + Classes[i]->OnError(RESOLVER_FORCEUNLOAD, "Parent module is unloading"); + delete Classes[i]; + Classes[i] = NULL; + } + } + } } -